差異處
這裏顯示兩個版本的差異處。
| 兩邊的前次修訂版 前次修改 下次修改 | 前次修改 | ||
| tech:fortigate_tips [2019/10/24 09:31] – jonathan_tsai | tech:fortigate_tips [2025/10/17 11:05] (目前版本) – [設定 HA] jonathan | ||
|---|---|---|---|
| 行 80: | 行 80: | ||
| * ++點這裡看參考畫面|{{: | * ++點這裡看參考畫面|{{: | ||
| </ | </ | ||
| + | |||
| + | ===== 防止暴力登入 SSL VPN 方式 ===== | ||
| + | * 參考 - https:// | ||
| + | * 當 Log & Report 的 VPN Events 出現大量 ssl-login-fail , sslvpn_login_unknown_user 狀況 | ||
| + | * 設定當 SSL VPN 登入失敗超過 x 次就鎖定 n 秒, 來降低嘗試暴力登入的狀況 Exp. 失敗超過 3 次, 就鎖 3600 秒< | ||
| + | config vpn ssl settings | ||
| + | set login-attempt-limit 3 | ||
| + | set login-block-time 3600 | ||
| + | end | ||
| + | </ | ||
| + | |||
| + | ===== 當出現 CPU 100% 時釐清問題方式 ===== | ||
| + | - 看哪個服務造成 < | ||
| + | FortiGate # diagnose sys top -d 3 | ||
| + | Run Time: 443 days, 19 hours and 44 minutes | ||
| + | 17U, 0N, 3S, 80I; 1838T, 1135F | ||
| + | | ||
| + | newcli | ||
| + | | ||
| + | Run Time: 443 days, 19 hours and 44 minutes | ||
| + | 26U, 0N, 3S, 71I; 1838T, 1135F | ||
| + | | ||
| + | httpsd | ||
| + | httpsd | ||
| + | |||
| + | FortiGate # | ||
| + | </ | ||
| + | - 先刪除這程序 < | ||
| + | - 針對這程序進行處理, | ||
| ===== IPSec - L2TP 用戶撥入 VPN 設定 ===== | ===== IPSec - L2TP 用戶撥入 VPN 設定 ===== | ||
| 行 95: | 行 124: | ||
| </ | </ | ||
| * 可以在外部 192.168.1.140 的 Windows 10 PC 執行 ping 與 tracert , 只要有經過 Fortigate 就會顯示流量訊息 | * 可以在外部 192.168.1.140 的 Windows 10 PC 執行 ping 與 tracert , 只要有經過 Fortigate 就會顯示流量訊息 | ||
| - | * ping 範例 ++PC 端 |<xtermrtf> | + | * ping 範例 ++PC 端 |<cli> |
| C: | C: | ||
| 行 102: | 行 131: | ||
| 回覆自 192.168.0.250: | 回覆自 192.168.0.250: | ||
| - | </xtermrtf> ++ ++Fortigate 端 |<xtermrtf> | + | </cli> ++ ++Fortigate 端 |<cli> |
| TPFortiGate40C-1 # diag debug reset | TPFortiGate40C-1 # diag debug reset | ||
| 行 122: | 行 151: | ||
| 0 packets dropped by kernel | 0 packets dropped by kernel | ||
| - | </xtermrtf>++ | + | </cli>++ |
| - | * tracert 範例 ++PC 端 |<xtermrtf> | + | * tracert 範例 ++PC 端 |<cli> |
| C: | C: | ||
| 行 133: | 行 162: | ||
| 追蹤完成。 | 追蹤完成。 | ||
| - | </xtermrtf> | + | </cli> |
| TPFortiGate40C-1 # diagnose sniffer packet any "host 192.168.0.250 and icmp" 4 | TPFortiGate40C-1 # diagnose sniffer packet any "host 192.168.0.250 and icmp" 4 | ||
| interfaces=[any] | interfaces=[any] | ||
| 行 167: | 行 196: | ||
| 27 packets received by filter | 27 packets received by filter | ||
| 0 packets dropped by kernel | 0 packets dropped by kernel | ||
| - | </xtermrtf>++ | + | </cli>++ |
| ===== FortiGate 60D 特別設定 ===== | ===== FortiGate 60D 特別設定 ===== | ||
| ==== 端對端 VPN 使用 traceroute 非預期出現 DMZ IP ==== | ==== 端對端 VPN 使用 traceroute 非預期出現 DMZ IP ==== | ||
| - | * 參考 - http:// | + | * 參考 - http:// |
| traceroute 192.168.1.5 | traceroute 192.168.1.5 | ||
| 行 178: | 行 207: | ||
| | | ||
| | | ||
| - | </xtermrtf> | + | </cli> |
| - | * 只要設定 VPN 虛擬介面的 IP 即可解決 Exp. 192.168.101.254 ++看畫面|{{: | + | * 只要設定 VPN 虛擬介面的 IP 即可解決 Exp. 192.168.101.254 ++看畫面|{{: |
| traceroute 192.168.1.5 | traceroute 192.168.1.5 | ||
| traceroute to 192.168.1.5 (192.168.1.5), | traceroute to 192.168.1.5 (192.168.1.5), | ||
| 行 185: | 行 214: | ||
| | | ||
| | | ||
| - | </xtermrtf> | + | </cli> |
| ===== FortiGate 40C 特別設定 ===== | ===== FortiGate 40C 特別設定 ===== | ||
| 行 193: | 行 222: | ||
| ==== 建立 VLAN ==== | ==== 建立 VLAN ==== | ||
| * http:// | * http:// | ||
| + | * https:// | ||
| ==== 設定 HA ==== | ==== 設定 HA ==== | ||
| 行 212: | 行 242: | ||
| * 預計設定的 HA 架構與模式 | * 預計設定的 HA 架構與模式 | ||
| * 設定 HA 的模式 : FGCP Active-Active HA (這模式最多可以設定到四台 FortiGate((fortigate-ha-56.pdf Page.24))) | * 設定 HA 的模式 : FGCP Active-Active HA (這模式最多可以設定到四台 FortiGate((fortigate-ha-56.pdf Page.24))) | ||
| - | * ++配置架構圖 |<ditaa name=env_desc> | + | * 配置架構圖 |
| + | |||
| + | < | ||
| + | graph TD | ||
| + | Internet[" | ||
| + | Router[" | ||
| + | FG1[" | ||
| + | FG2[" | ||
| + | Switch[" | ||
| + | PC1[" | ||
| + | AP[" | ||
| + | PC2[" | ||
| + | |||
| + | Internet < | ||
| + | Router --> | ||
| + | Router --> | ||
| + | FG1 < | ||
| + | FG1 --> | ||
| + | FG2 --> | ||
| + | Switch --> PC1 | ||
| + | Switch --> AP | ||
| + | Switch --> PC2 | ||
| + | |||
| + | style Internet fill:# | ||
| + | style Router fill:# | ||
| + | style FG1 fill:# | ||
| + | style FG2 fill:# | ||
| + | style Switch fill:# | ||
| + | style PC1 fill:# | ||
| + | style AP fill:# | ||
| + | style PC2 fill:# | ||
| + | </mermaid> | ||
| - | / | ||
| - | | | | ||
| - | | | ||
| - | | | | ||
| - | \-------^-------/ | ||
| - | | | ||
| - | v | ||
| - | +-------+-------+ | ||
| - | | | | ||
| - | | VDSL Router | ||
| - | | | | ||
| - | +----+-----+----+ | ||
| - | Static IP^ | ||
| - | | ||
| - | +----------------+ | ||
| - | wan1| |wan1 | ||
| - | v v | ||
| - | +----------------------+ | ||
| - | |cBLU |wan2 wan2| | | ||
| - | | Fortigate 40c |< | ||
| - | | ichiayi-01-FG40C | ||
| - | | | | | ||
| - | +-------------------^--+ | ||
| - | Internal| | ||
| - | +----------------+ | ||
| - | | ||
| - | | ||
| - | +------------------------+ | ||
| - | | | | ||
| - | | Internal Switch | ||
| - | | | | ||
| - | +---^-------^-------^----+ | ||
| - | | | ||
| - | | ||
| - | | ||
| - | | ||
| - | +-------------+ | ||
| - | | | ||
| - | | | ||
| - | | | ||
| - | | | ||
| - | +---| | +-------+ | ||
| - | +------------+ | ||
| - | </ | ||
| * 設定方式 | * 設定方式 | ||
| - 每一台都登入啟用 HA ++CLI 語法|< | - 每一台都登入啟用 HA ++CLI 語法|< | ||
| 行 439: | 行 456: | ||
| * http:// | * http:// | ||
| * http:// | * http:// | ||
| - | |||
| - | < | ||
| - | Extruder Machine</ | ||
| {{tag> | {{tag> | ||