InfoSecMonkey: No fluff. Just the config that works.

Category Archives: FortiGate

VRF Explained: Virtual Routing and Forwarding on FortiGate, Cisco and Juniper
12 November, 2026

VRF Explained: Virtual Routing and Forwarding on FortiGate, Cisco and Juniper

Learn virtual routing and forwarding (VRF), then build VRFs and route leaking on FortiGate, Cisco IOS XE and Juniper Junos with tested CLI.

Read More
FortiGate IPAM vs DHCP: Differences, Overlap, and What to Check Before You Turn IPAM On
11 November, 2026

FortiGate IPAM vs DHCP: Differences, Overlap, and What to Check Before You Turn IPAM On

FortiGate IPAM vs DHCP explained: what each one assigns, where they overlap, and what to check before enabling IPAM so it does not renumber...

Read More
Outlook CVE-2026-124194: Patch the Zero-Day That Leaks NTLM Hashes
11 November, 2026

Outlook CVE-2026-124194: Patch the Zero-Day That Leaks NTLM Hashes

Outlook CVE-2026-124194 leaks NTLMv2 hashes from one opened .msg file. Check fixed builds, force the Office update, and block SMB egress on FortiGate.

Read More
CVE-2026-98432 Mitigation on FortiGate: Blocking the Linux Kernel TCP Use-After-Free (FG-IR-26-188)
10 November, 2026

CVE-2026-98432 Mitigation on FortiGate: Blocking the Linux Kernel TCP Use-After-Free (FG-IR-26-188)

CVE-2026-98432 mitigation for FortiGate and Linux: drop IPv4 options in the NPU, apply the FMWP virtual patch, and block the TCP trigger until you...

Read More
Fortinet PSIRT Countermeasures: Pre-Auth Bugs Trusted Hosts Won’t Stop
10 November, 2026

Fortinet PSIRT Countermeasures: Pre-Auth Bugs Trusted Hosts Won’t Stop

Fortinet PSIRT countermeasures for pre-auth FortiGate, FortiManager and FortiAnalyzer bugs on FGFM, OFTP, OSPF and HA that trusted hosts can't stop.

Read More
FortiGate IKEv2 Certificate Pinning: Machine Certificate Plus EAP-MSCHAPv2 Remote Access VPN
10 November, 2026

FortiGate IKEv2 Certificate Pinning: Machine Certificate Plus EAP-MSCHAPv2 Remote Access VPN

Set up FortiGate IKEv2 certificate pinning: require a machine certificate from your own CA before EAP-MSCHAPv2 login, with OpenSSL and CRL.

Read More
Malware in 2026: A Practitioner’s Field Guide to the Types You Will Actually See
10 November, 2026

Malware in 2026: A Practitioner’s Field Guide to the Types You Will Actually See

Infostealers, ransomware, loaders, RATs, worms, botnets, wipers, EDR killers, mobile NFC relay, and the first LLM-in-the-loop families. What each one does, how it shows...

Read More
FortiGate Incomplete Certificate Chain: Fixing the Missing GoDaddy Intermediate
9 November, 2026

FortiGate Incomplete Certificate Chain: Fixing the Missing GoDaddy Intermediate

Fix an incomplete FortiGate certificate chain: prove the GoDaddy intermediate is missing with OpenSSL, import it or rebuild the PKCS#12, then verify.

Read More
FortiGate Threat Feed Stuck on Not Start? Check for a 301 Redirect
8 November, 2026

FortiGate Threat Feed Stuck on Not Start? Check for a 301 Redirect

FortiGate threat feed troubleshooting: why an external connector shows Not start, how forticron debug exposes a 301 redirect, and the one-line fix.

Read More
PAC Files Explained: How Proxy Auto-Config Really Works
1 November, 2026

PAC Files Explained: How Proxy Auto-Config Really Works

Learn what a PAC file does, the standard FindProxyForURL format, helper functions, WPAD discovery, FortiGate hosting, and testing with pactester.

Read More
ICAP Configuration on FortiGate, Palo Alto and Cisco: How Content Redirection Really Works
29 October, 2026

ICAP Configuration on FortiGate, Palo Alto and Cisco: How Content Redirection Really Works

ICAP configuration for FortiGate, Palo Alto Enterprise DLP and Cisco Secure Web Appliance: REQMOD vs RESPMOD, fail-open choices, ICAPS and tests.

Read More
The /31 Subnet: Myth or Standard? Network and Broadcast Addresses on Point-to-Point Links
27 October, 2026

The /31 Subnet: Myth or Standard? Network and Broadcast Addresses on Point-to-Point Links

Is the /31 subnet a myth? Learn how RFC 3021 drops the network and broadcast address, when to use /31 links, and when not...

Read More
Cisco Duo MFA for FortiGate Remote Access VPN: SAML and RADIUS on IKEv2
21 October, 2026

Cisco Duo MFA for FortiGate Remote Access VPN: SAML and RADIUS on IKEv2

Set up Duo FortiGate VPN MFA on IKEv2: Duo SSO as SAML IdP or the Duo Authentication Proxy over RADIUS, with configs, debugs, and...

Read More
FortiGate SD-WAN Debugs: The Diag Commands That Actually Find the Problem
19 October, 2026

FortiGate SD-WAN Debugs: The Diag Commands That Actually Find the Problem

Use FortiGate SD-WAN debug commands to trace health checks, rules, and policy routes. Follow this CLI workflow to find why traffic takes the wrong...

Read More
Deploying Cisco TRex: A Line-Rate Traffic Generator for Your Firewall Lab
17 October, 2026

Deploying Cisco TRex: A Line-Rate Traffic Generator for Your Firewall Lab

Deploy Cisco TRex traffic generator on Ubuntu to test FortiGate throughput. Run stateless and stateful tests with Python automation for accurate lab results.

Read More
Legacy Protocols Must Die: FTP, Telnet, HTTP, and Their Secure Replacements
16 October, 2026

Legacy Protocols Must Die: FTP, Telnet, HTTP, and Their Secure Replacements

Replace legacy protocols like FTP, Telnet, and HTTP with secure alternatives. Get the exact configs for FortiGate, Linux, and macOS to harden your network.

Read More
FortiGate and EntraID: Renewing an Expiring Entra ID SAML Signing Certificate Without Breaking SSO
15 October, 2026

FortiGate and EntraID: Renewing an Expiring Entra ID SAML Signing Certificate Without Breaking SSO

Learn how to renew an expiring Entra ID SAML certificate on FortiGate with zero downtime. Follow this step-by-step guide to stage and activate the...

Read More
FortiGate PCP NAT: Letting Clients Request Their Own Port Mappings
15 October, 2026

FortiGate PCP NAT: Letting Clients Request Their Own Port Mappings

Configure FortiGate PCP server config for dynamic port mappings. Learn to deploy pcp-outbound SNAT and pcp-inbound DNAT policies for CGNAT and VoIP.

Read More