Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
This procedure recovers administrative access to a FortiGate when you have lost or forgotten the admin password. It uses FortiOS's built-in maintainer account, which lets you log in over the serial console immediately after a hard power cycle and reset the administrator password. That is the only thing it changes: one admin account's password. It does not erase your configuration.
This guide adds two FortiGuard security profiles — Web Filter and Application Control — to an existing firewall policy so the FortiGate inspects outbound traffic and blocks the categories and applications you choose. It's how you stop users reaching malware and phishing sites, or using peer-to-peer and proxy apps, on the way out to the internet.
This guide configures a FortiGate to forward its logs to an external syslog server and/or a FortiAnalyzer . The purpose is centralized retention and search — logs live off the box, survive a reboot or an RMA, and can be correlated across devices.
This guide walks a standalone FortiGate through a firmware upgrade — checking the supported upgrade path, backing up config, flashing the new image, and verifying it — with the least possible disruption. A firmware upgrade reboots the unit . On a single (non-HA) FortiGate there is no way to avoid a short traffic outage during that reboot; "without losing connectivity" here means without locking yourself out and without losing your configuration , not zero downtime. Only an HA pair gives you a near-seamless upgrade, and that is a different procedure (noted at the end).
This guide backs up a FortiGate's running configuration to a file you can store off-box, and restores that file when you need to roll back or rebuild. A backup is harmless. A restore is not: restoring a full configuration overwrites everything on the unit and reboots it. If the file is for a different model or firmware, or was captured with private-data encryption you can't unlock, the restore can leave the box unreachable.
This guide builds an FGCP active-passive cluster from two FortiGate firewalls: one unit passes all traffic while the second stays fully configured and idle, ready to take over within seconds if the primary fails. The two units share one configuration, one set of virtual MAC addresses, and appear on the network as a single firewall.
A Virtual IP (VIP) on a FortiGate is how you take traffic arriving at a public address and port and redirect it to an internal host — classic destination NAT (port forwarding). This guide walks the standard one-to-one VIP with port forwarding, both in the GUI and the CLI, and shows how to verify and roll it back.
This walks through a standard tunnel-mode SSL VPN on a FortiGate running FortiOS 7.4 , the kind you hand to remote staff with FortiClient. I'll do it in the GUI (the normal path on a FortiGate) and give the equivalent CLI so you can review or script it. Web-mode (clientless) portals are being wound down by Fortinet, so this guide is tunnel mode only.
FortiGate evaluates IPv4 policies top to bottom, first match wins . A correct rule in the wrong position does nothing, or worse, a broad "allow" above a specific "deny" quietly opens traffic you meant to block. This guide covers creating a standard IPv4 policy and placing it in the right spot, on FortiOS 7.4 (the same steps apply across 7.2–7.6, but menu labels and CLI keywords can shift between minor versions, so confirm against your build).
This guide builds a route-based IPsec tunnel between two FortiGate firewalls so the LAN behind Site A can reach the LAN behind Site B and vice versa. "Route-based" means each end gets a virtual tunnel interface, and you steer traffic into the tunnel with a static route plus firewall policies — the mainstream FortiOS approach for a permanent office-to-office link.
This guide builds a PowerShell script that onboards one new employee in four steps: it creates an Active Directory user account , adds them to security groups , provisions an on-premises Exchange mailbox , and creates their home folder on a file server and sets NTFS permissions . The purpose is to replace the error-prone click-through in Active Directory Users and Computers with one repeatable, reviewable run.
This guide finds Active Directory computer accounts that haven't logged in for a long time and retires them in three deliberate stages: report , disable and move to a holding OU , then delete . The purpose is to keep AD tidy and reduce the attack surface of forgotten machine accounts without accidentally killing a computer that's simply been powered off for a while.
This guide sets up an unattended nightly full database backup . A short PowerShell script calls Backup-SqlDatabase to write a .bak file to a folder, and Windows Task Scheduler runs that script on a schedule under a service account.
