Category Archives: FortiOS 5.4 Handbook

The complete handbook for FortiOS 5.4

DNS services

Leave a reply

DNS services

A DNS server is a public service that converts symbolic node names to IP addresses. A Domain Name System (DNS) server implements the protocol. In simple terms, it acts as a phone book for the Internet. A DNS server matches domain names with the computer IP address. This enables you to use readable locations, such as fortinet.com when browsing the Internet. FortiOS supports DNS configuration for both IPv4 and IPv6 addressing.

The FortiGate unit includes default DNS server addresses. However, these should be changed to those provided by your Internet Service Provider. The defaults are DNS proxies and are not as reliable as those from your ISP.

Within FortiOS, there are two DNS configuration options; each provide a specific service, and can work together to provide a complete DNS solution.

 

DNS settings

Basic DNS queries are configured on interfaces that connect to the Internet. When a web site is requested, for example, the FortiGate unit will look to the configured DNS servers to provide the IP address to know which server to contact to complete the transaction.

DNS server addresses are configured by going to System > Network > DNS. Here you specify the DNS server addresses. Typically, these addresses are supplied by your ISP. An additional option is available if you have local Microsoft domains on the network, by entering a domain name in the Local Domain Name field.

In a situation where all three fields are configured, the FortiGate unit will first look to the local domain. If no match is found, a request is sent to the external DNS servers.

If virtual domains are enabled, you create a DNS database in each VDOM. All of the interfaces in a VDOM share the DNS database in that VDOM.

 

Additional DNS CLI configuration

Further options are available from the CLI with the command config system dns. Within this command you can set the following commands:

  • dns-cache-limit – enables you to set how many DNS entries are stored in the cache. Entries that remain in the cache provide a quicker response to requests than going out to the Internet to get the same information.
  • dns-cache-ttl – enables you to set how long entries remain in the cache in seconds, between 60 and 86,400 (24 hours).
  • cache-notfound-responses – when enabled, any DNS requests that are returned with NOTFOUND can be stored in the cache.
  • source-ip – enables you to define a dedicated IP address for communications with the DNS server.

 

DNS server

You can also create local DNS servers for your network. Depending on your requirements, you can manually maintain your entries (master DNS server), or use it as a jumping point, where the server refers to an outside source (slave DNS server). A local master DNS server works similarly to the DNS server addresses configured in System > Network > DNS, but all entries must be added manually. This enables you to add a local DNS server to include specific URL/IP address combinations.

 

The DNS server options are not visible in the web-based manager by default. To enable the server, go to System > Config > Featuresand select DNS Database.

While a master DNS server is an easy method of including regularly used addresses to save on going to an outside DNS server, it is not recommended to make it the authoritative DNS server. IP addresses may change, and maintaining any type of list can quickly become labor-intensive.

A FortiGate master DNS server is best set for local services. For example, if your company has a web server on the DMZ that is accessed by internal employees as well as external users, such as customers or remote users. In this situation, the internal users when accessing the site would send a request for website.example.com, that would go out to the DNS server on the web, to return an IP address or virtual IP. With an internal DNS, the same site request is resolved internally to the internal web server IP address, minimizing inbound/outbound traffic and access time.

As a slave, DNS server, the FortiGate server refers to an external or alternate source as way to obtain the url/IP combination. This useful if there is a master DNS server for a large company where a list is maintained. Satellite offices can then connect to the master DNS server to obtain the correct addressing.

The DNS server entries does not allow CNAME entries, as per RFC 1912, section 2.4.

 

To configure a master DNS server – web-based manager

1. Go to System > Network > DNS Server, and select Create New for DNS Database.

2. Select the Type of Master.

3. Select the View as Shadow.

4. The view is the accessibility of the DNS server. Selecting Public, external users can access, or use, the DNS server. Selecting Shadow, only internal users can use it.

5. Enter the DNS Zone, for example, WebServer.

6. Enter the domain name for the zone, for example com.

7. Enter the hostname of the DNS server, for example, Corporate.

8. Enter the contact address for the administrator, for example, admin@example.com.

9. Set Authoritative to Disable.

10. Select OK.

11. Enter the DNS entries for the server by selecting Create New.

12. Select the Type, for example, Address (A).

13. Enter the Hostname, for example example.com.

14. Enter the remaining information, which varies depending on the Type selected.

15. Select OK.

 

To configure a DNS server – CLI

config system dns-database edit WebServer

set domain example.com set type master

set view shadow set ttl 86400

set primary-name corporate set contact admin@exmple.com set authoritative disable

config dns-entry edit 1

set hostname web.example.com set type A

set ip 192.168.21.12 set status enable

end end

 

Recursive DNS

You can set an option to ensure these types of DNS server is not the authoritative server. When configured, the FortiGate unit will check its internal DNS server (Master or Slave). If the request cannot be fulfilled, it will look to the external DNS servers. This is known as a split DNS configuration.

You can also have the FortiGate unit look to an internal server should the Master or Slave not fulfill the request by using the CLI commands:

config system dns-database edit example.com

…

set view shadow

end

 

For this behavior to work completely, for the external port, you must set the DNS query for the external interface to be recursive. This option is configured in the CLI only.

 

To set the DNS query

config system dns-server edit wan1

end

set mode recursive

DHCP servers and relays

1 Reply

DHCP servers and relays

Note that DHCP server options are not available in transparent mode.

A DHCP server provides an address to a client on the network, when requested, from a defined address range. An interface cannot provide both a server and a relay for connections of the same type (regular or IPsec).

However, you can configure a Regular DHCP server on an interface only if the interface is a physical interface with a static IP address. You can configure an IPsec DHCP server on an interface that has either a static or a dynamic IP address.

You can configure one or more DHCP servers on any FortiGate interface. A DHCP server dynamically assigns IP addresses to hosts on the network connected to the interface. The host computers must be configured to obtain their IP addresses using DHCP.

If an interface is connected to multiple networks via routers, you can add a DHCP server for each network. The IP range of each DHCP server must match the network address range. The routers must be configured for DHCP relay.

You can configure a FortiGate interface as a DHCP relay. The interface forwards DHCP requests from DHCP clients to an external DHCP server and returns the responses to the DHCP clients. The DHCP server must have appropriate routing so that its response packets to the DHCP clients arrive at the unit.

 

DHCP Server configuration

To add a DHCP server, go to System > Network > Interface. Edit the interface, and select Enable for the DHCP Server row.

 

DHCP Server IP                         This appears only when Mode is Relay. Enter the IP address of the DHCP

server where the FortiGate unit obtains the requested IP address.

 

Address Range

By default, the FortiGate unit assigns an address range based on the address of the interface for the complete scope of the address. For example, if the interface address is 172.20.120.230, the default range cre- ated is 172.20.120.231 to 172.20.120.254. Select the range and select Edit to adjust the range as needed, or select Create New to add a dif- ferent range.

 

Netmask      Enter the netmask of the addresses that the DHCP server assigns.

 

Default Gateway

Select to either use the same IP as the interface or select Specify and enter the IP address of the default gateway that the DHCP server assigns to DHCP clients.

 

DNS Server    Select to use the system’s DNS settings or select Specify and enter the IP address of the DNS server.

 

Advanced... (expand to reveal more options)

 

Mode    Select the type of DHCP server the FortiGate unit will be. By default, it is a server. Select Relay if needed. When Relay is selected, the above con- figuration is replaced by a field to enter the DHCP Server IP address.

 

Type   Select to use the DHCP in regular or IPsec mode.

 

MAC Address Access Con- trol List

Select to match an IP address from the DHCP server to a specific client or device using its MAC address.

 

In a typical situation, an IP address is assigned ad hoc to a client, and that assignment times out after a specific time of inactivity from the client, known as the lease time. To ensure a client or device always has the same IP address, that is, there is no lease time, use IP reservation.

 

Add from DHCP Client List      If the client is currently connected and using an IP address from the DHCP server, you can select this option to select the client from the list.

 

DHCP in IPv6

You can use DHCP with IPv6 using the CLI. To configure DHCP, ensure IPv6 is enabled by going to System > Config > Features and enable IPv6. Use the CLI command

config system dhcp6 server

For more information on the configuration options, see the CLI Reference.

 

Service

On low-end FortiGate units, a DHCP server is configured, by default on the Internal interface:

 

IP Range                                     192.168.1.110 to 192.168.1.210

Netmask                                     255.255.255.0

Default gateway                         192.168.1.99

Lease time                                 7 days

DNS Server 1                             192.168.1.99

These settings are appropriate for the default Internal interface IP address of 192.168.1.99. If you change this address to a different network, you need to change the DHCP server settings to match.

Alternatively, after the FortiGate unit assigns an address, you can go to System > Monitor > DHCP Monitor, locate the particular user. Select the check box for the user and select Add to Reserved.

 

Lease time

The lease time determines the length of time an IP address remains assigned to a client. Once the lease expires, the address is released for allocation to the next client request for an IP address The default lease time is seven days. To change the lease time, use the following CLI commands:

config system dhcp server

edit <server_entry_number>

set lease-time <seconds>

end

 

To have an unlimited lease time, set the value to zero.

 

DHCP options

When adding a DHCP server, you have the ability to include DHCP codes and options. The DHCP options are BOOTP vendor information fields that provide additional vendor-independent configuration parameters to manage the DHCP server. For example, you may need to configure a FortiGate DHCP server that gives out a separate option as well as an IP address. For example, an environment that needs to support PXE boot with Windows images.

The option numbers and codes are specific to the particular application. The documentation for the application will indicate the values to use. Option codes are represented in a option value/HEX value pairs. The option is a value 1 and 255.

You can add up to three DHCP code/option pairs per DHCP server.

 

To configure option 252 with value http://192.168.1.1/wpad.dat – CLI

config system dhcp server edit <server_entry_number>

set option1 252 687474703a2f2f3139322e3136382e312e312f777061642e646174

end

 

For detailed information about DHCP options, see RFC 2132, DHCP Options and BOOTP Vendor Extensions.

 

Exclude addresses in DHCP a range

If you have a large address range for the DHCP server, you can block a range of addresses that will not be included in the available addresses for the connecting users. To do this, go to the CLI and enter the commands:

config system dhcp server edit <server_entry_number>

config exclude-range

edit <sequence_number> set start-ip <address> set end-ip <address>

end end

end

 

DHCP Monitor

To view information about DHCP server connections, go to System > Monitor > DHCP Monitor. On this page, you can also add IP address to the reserved IP address list.

 

Breaking an address lease

Should you need to end an IP address lease, you can break the lease using the CLI. This is useful if you have limited addresses, longer lease times where leases are no longer necessary. For example, with corporate visitors.

 

To break a lease enter the CLI command:

execute dhcp lease-clear <ip_address>

 

Assigning IP address by MAC address

To prevent users in the from changing their IP addresses and causing IP address conflicts or unauthorized use of IP addresses, you can bind an IP address to a specific MAC address using DHCP.

Use the CLI to reserve an IP address for a particular client identified by its device MAC address and type of connection. The DHCP server then always assigns the reserved IP address to the client. The number of reserved addresses that you can define ranges from 10 to 200 depending on the FortiGate model.

After setting up a DHCP server on an interface by going to System > Network > Interface, select the blue arrow next to Advanced to expand the options. If you know the MAC address of the system select Create New to add it, or if the system has already connected, locate it in the list, select its check box and select Add from DHCP Client List.

You can also match an address to a MAC address in the CLI. In the example below, the IP address 10.10.10.55 for User1 is assigned to MAC address 00:09:0F:30:CA:4F.

 

config system dhcp reserved-address edit User1

set ip 10.10.10.55

set mac 00:09:0F:30:CA:4F

set type regular end

FortiExtender

1 Reply

FortiExtender

FortiGate units support the use of wireless, 3G and 4G modems connected to a FortiExtender which will be connected to the FortiGate unit.

 

Installing the 3G/4G modem

Remove the housing cover of the FortiExtender and use the provided USB extension cable to connect your 3G/4G modem to the device.

For more information on installing the 3G/4G modem, see the QuickStart Guide.

 

Connecting the FortiExtender unit

 

If you are using the provided PoE injector:

1. Plug the provided Ethernet cable into the Ethernet port of the FortiExtender and insert the other end of the

Ethernet cable into the AP/Bridge port on the injector, then plug the injector into an electrical outlet.

2. Connect the LAN port of the PoE injector to a FortiGate, FortiWifi, or FortiSwitch device.

 

If you are not using the PoE injector:

1. Insert the other end of the Ethernet cable into a PoE LAN port on an appropriate FortiGate, FortiWifi or FortiSwitch device.

For more information on connecting the FortiExtender unit, see the QuickStart Guide.

Once connected, your FortiGate appliance can automatically detect, connect with, and control the FortiExtender and modem via a CAPWAP tunnel.To do this, FortiExtender and FortiGate must be on the same Layer 2/3 subnet (or have DHCP relay between) and FortiGate must respond to FortiExtender’s request. In this example FortiExtender is connected to the lan interface of the FortiGate unit.

 

By default, FortiExtender is hidden and disabled.Enable it in FortiGate’s CLI:

config system global

set fortiextender enable

set wireless-cotnroller enable end

 

The control and provisioning of Wireless Access Point (CAPWAP) service must be enabled on the port to which the FortiExtender unit is connected (lan interface in this example) using the following CLI commands:

config system interface edit lan

set allowaccess capwap end

 

Once FortiExtender is discovered and authorized, a virtual WAN interface such as fext-wan1 is created on the Fortigate.

 

Configuring the FortiExtender unit

At this point, you can fully manage the FortiExtender from the FortiGate unit. To achieve this, you need to authorize the FortiExtender by going to System > Network > FortiExtender and click on Authorize. Once authorized, you can configure you device as required:

Link Status: Shows you if the link is Up or Down, click on Details to see the System and Modem Status.

IP Address: Shows you the current FortiExtender’s IP address, click on the link of the IP address to connect to the FortiExtender GUI.

OS Version: Shows the current FortiExtender’s build, click on Upgrade if you wish to upgrade the Firmware.

Configure Settings: Allows you to configure the Modem Settings, PPP Authentication, General, GSM / LTE, and CDMA.

Diagnostics: Allows you to diagnose the FortiExtender unit, you can choose a command form the existing commands and click on Run.

Existing commands are: Show device info, Show data session connection status, test connection, test disconnection, Get signal strength, AT Command.

 

Sample output of Show device info:

Manufacturer: Sierra Wireless, Incorporated

Model: AirCard 330U

Revision: SWI9200X_03.00.08.03AP R4019 CARMD-EN-10527 2011/12/07 18:43:13

IMEI: 359615040996060

IMEI SV: 7

FSN: CDU3153118210

3GPP Release 8

+GCAP: +CGSM OK

 

Modem Settings

The FortiExtender unit allows for two modes of operation for the modem; On Demand and Always Connect. In On Demand mode, the modem connects to an ISP only upon execution of the dial up operation and disconnects only upon subsequent hang up operation from the CLI.

 

Syntax

To connect, run the following CLI command:

execute extender dial <SN> // <SN> is the FortiExtender’s serial number.

 

To disconnect, run the following CLI command:

execute extender hangup <SN> // <SN> is the FortiExtender’s serial number.

 

In Always Connect mode, the modem is always connected to the internet, it can acts as a primary or backup method of connecting to the Internet.

 

By default, the Fortiextender will be in Always Connect mode once authorized.

 

Modem Settings is a matter of configuring the dialing mode. The dial mode is either Always Connect or On demand. Selecting Always Connect ensures that once the modem has connected, it remains connected to the ISP.

 

To configure the dial mode as needed – web-based manager

1. Go to System > Network > FortiExtender and click Configuring Settings.

2. Extend Modem Settings.

3. Select the Dial Mode of Always Connect or On Demand.

4. Enter the Redial Limit to 5 – Only applicable in On Demand mode.

5. If needed, enter the Quota Limit to the desired limit in Mega Byte -The recorded quota usage values are not persistent and lost upon rebooting Fortigate.

6. Select Ok.

 

Configuring the FortiGate unit

In order to allow inbound and outbound traffic through the 3G/4G modem, you need to add a security policy and, depending the scenario, a static route in the FortiGate unit.

 

Adding a policy

If your network will be using IPv4 addresses, go to Policy & Objects > Policy > IPv4 and select Create New to add a policy that allows users on the private network to access the Internet.

In the policy, set the Incoming Interface to the internal interface and the Outgoing Interface to fext-wan1 interface. You will also need to set Source Address, Destination Address, Schedule, and Service according to your network requirements.

Make sure the Action is set to ACCEPT. Turn on NAT and make sure Use Destination Interface Address is selected. Select OK.

 

Always–on, redundant of wan1

No route required as in FortiOS 5.2.2 the routing shows only active routes. Use the following CLI command to show all routes:

get router info routing-table all

 

Sample Output

Codes: K – kernel, C – connected, S – static, R – RIP, B – BGP O – OSPF, IA – OSPF inter area

N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2

E1 – OSPF external type 1, E2 – OSPF external type 2

i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area

* – candidate default

S* 0.0.0.0/0 [10/0] via 172.20.120.2, wan1

C 25.49.248.0/24 is directly connected, fext-wan1

C 169.254.1.1/32 is directly connected, ssl.root is directly connected, ssl.root

C 172.20.120.0/24 is directly connected, wan1

C 192.168.1.0/24 is directly connected, lan

 

Always–on, with select traffic going through the FortiExtender

In this scenario, a static route is required, if your network using IPv4 addresses, go to Router > Static > Static Routes or System > Network > Routing, depending on your FortiGate model, and select Create New. Set the Destination IP/Mask to 0.0.0.0/0.0.0.0, Device to fext-wan1, and set the Gateway to your gateway IP or to the next hop router, depending on your network requirements. Select OK.

Modem

Leave a reply

Modem

FortiGate units support the use of wireless, 3G and 4G modems connected using the USB port or, if available, the express card slot. Modem access provides either primary or secondary (redundant) access to the Internet. For FortiGate units that do not include an internal modem (those units with an “M” designation), the modem interface will not appear in the web-based manager until enabled in the CLI. To enable the modem interface enter the CLI commands:

config system modem set status enable

end

 

You will need to log out of the FortiGate and log back in to see the modem configuration page at System > Network > Modem. Once enabled, modem options become available by going to System > Network > Interface.

Note that the modem interface is only available when the FortiGate unit is in NAT mode. To configure modem settings, go to System > Network > Modem.

Configuring the modem settings is a matter of entering the ISP phone number, user name and password. Depending on the modem, additional information may need to be supplied such as product identifiers, and initialization strings.

The FortiGate unit includes a number of common modems within its internal database. You can view these by selecting the Configure Modem link on the Modem Settings page. If your modem is not on the list, select Create New to add the information. This information is stored on the device, and will remain after a reboot.

Fortinet has an online database of modem models and configuration settings through FortiGuard. A subscription to the FortiGuard services is not required to access the information. As models are added, you can select the Configure Modem link and select Update Now to download new configurations.

 

USB modem port

Each USB modem has a specific dial-out port. This will be indicated with the documentation for your modem. To enable the correct USB port, use the CLI commands:

config system modem

set wireless-port {0 | 1 | 2}

end

 

To test the port, use the diagnose command:

diagnose sys modem com /1

 

The 1 will be the value of your USB port selected. The response will be:

Serial port: /dev/1

Press Ctrl+W to exit.

 

If the port does not respond the output will be:

Can not open modem device ‘/dev/1’ : Broken pipe

 

Modes

The FortiGate unit allows for two modes of operation for the modem; stand alone and redundant. In stand alone mode, the modem connects to a dialup ISP account to provide the connection to the Internet. In redundant mode, the modem acts as a backup method of connecting to the Internet, should the primary port for this function fails.

Configuring either stand alone or redundant modes are very similar. The primary difference is the selection of the interface that the modem will replace in the event of it failing, and the configuration of a PING server to monitor the chosen interface.

 

Configuring stand alone mode

Configuring stand alone mode is a matter of configuring the modem information and the dialing mode. The dial mode is either Always Connect or Dial on demand. Selecting Always Connect ensures that once the modem has connected, it remains connected to the ISP. Selecting Dial on Demand, the modem only calls the ISP if packets are routed to the modem interface. Once sent, the modem will disconnect after a specified amount of time.

 

To configure standalone mode as needed – web-based manager

1. Go to System > Network > Modem.

2. Select the Mode of Standalone.

3. Select the Dial Mode of Dial on Demand.

4. Select the number of redials the modem attempts if connection fails to 5.

5. Select Apply.

 

To configure standalone mode as needed- CLI

config system modem set status enable set mode standalone

set auto-dial enable set redial 5

end

 

Configuring redundant mode

Redundant mode provides a backup to an interface, typically to the Internet. If that interface fails or disconnects, the modem automatically dials the configured phone number(s). Once connected, the FortiGate unit routes all traffic to the modem interface until the monitored interface is up again. The FortiGate unit pings the connection to determine when it is back online.

For the FortiGate to verify when the interface is back up, you need to configure a Ping server for that interface. You will also need to configure security policies between the modem interface and the other interfaces of the FortiGate unit to ensure traffic flow.

 

To configure redundant mode as needed – web-based manager

1. Go to System > Network > Modem.

2. Select the Mode of Redundant.

3. Select the interface the modem takes over from if it fails.

4. Select the Dial Mode of Dial on Demand.

5. Select the number of redials the modem attempts if connection fails to 5.

6. Select Apply.

 

To configure standalone mode as needed- CLI

config system modem set status enable set mode redundant set interface wan1

set auto-dial enable set redial 5

end

 

Link Health Monitor

Adding a link health monitor is required for routing fail over traffic. A link health monitor will confirm the connectivity of the device’s interface

 

To add a link health monitor

config system link-monitor edit “Example1”

set srcint <Interface_sending_probe>

set server <ISP_IP_address>

set protocol <Ping or http>

set gateway-ip <the_gateway_IP_to_reach_the_server_if_required>

set failtime <failure_count>

set interval <seconds>

set update-cascade-interface enable set update-static-route enable

set status enable

end

 

Additional modem configuration

The CLI provides additional configuration options when setting up the modem options including adding multiple ISP dialing and initialization options and routing. For more information, see the CLI Reference.

 

Modem interface routing

The modem interface can be used in FortiOS as a dedicated interface. Once enabled and configured, you can use it in security policies and define static and dynamic routing. Within the CLI commands for the modem, you can configure the distance and priority of routes involving the modem interface. The CLI commands are:

config system modem

set distance <route_distance>

set priority <priority_value>

end

 

For more information on the routing configuration in the CLI, see the CLI Reference. For more information on routing and configuring routing, see the Advanced Routing Guide.

Single firewall vs. vdoms

Leave a reply

Single firewall vs. vdoms

When VDOMs are not enabled, and the FortiGate unit is in transparent mode, all the interfaces on your unit become broadcast interfaces. The problem is there are no interfaces free for additional network segments.

A FortiGate with three interfaces means only limited network segments are possible without purchasing more FortiGate devices.

With multiple VDOMs you can have one of them configured in transparent mode, and the rest in NAT mode. In this configuration, you have an available transparent mode FortiGate unit you can drop into your network for troubleshooting, and you also have the standard.

This example shows how to enable VDOMs on the FortiGate unit and the basic and create a VDOM accounting on the DMZ2 port and assign an administrator to maintain the VDOM. First enable Virtual Domains on the FortiGate unit.

 

To enable VDOMs – web-based manager

1. Go to System > Dashboard > Status.

2. In the System Information widget, select Enable for Virtual Domain.

Note that on FortiGate-60 series and lower models, you need to enable VDOMs in the CLI only.

The FortiGate unit logs you out. Once you log back in, you will notice that the menu structure has changed. This reflects the global settings for all Virtual Domains.

 

To enable VDOMs – CLI

config system global

set vdom-admin enable end

 

Next, add the VDOM called accounting.

 

To add a VDOM – web-based manager

1. Go to Global > VDOM > VDOM, and select Create New.

2. Enter the VDOM name accounting.

3. Select OK.

 

To add a VDOM – CLI

config vdom

edit <new_vdom_name>

end

 

With the Virtual Domain created, you can assign a physical interface to it, and assign it an IP address.

 

To assign physical interface to the accounting Virtual Domain – web-based manager

1. Go to Global > Network > Interface.

2. Select the DMZ2 port row and select Edit.

3. For the Virtual Domain drop-down list, select accounting.

4. Select the Addressing Mode of Manual.

5. Enter the IP address for the port of 10.13.101.100/24.

6. Set the Administrative Access to HTTPS and SSH.

7. Select OK.

 

To assign physical interface to the accounting Virtual Domain – CLI

config global

config system interface edit dmz2

set vdom accounting

set ip 10.13.101.100/24 set allowaccess https ssh

next end

Single firewall vs. multiple virtual domains

Leave a reply

Single firewall vs. multiple virtual domains

A typical FortiGate setup, with a small to mid-range appliance, enables you to include a number of subnets on your network using the available ports and switch interfaces. This can potentially provide a means of having three or more mini networks for the various groups in a company. Within this infrastructure, multiple network administrators have access to the FortiGate to maintain security policies.

However, the FortiGate unit may not have enough interfaces to match the number of departments in the organization. If the FortiGate unit it running in transparent mode however, there is only one interface, and multiple network branches through the FortiGate are not possible.

A FortiGate unit with Virtual Domains (VDOMs) enabled, provides a means to provide the same functionality in transparent mode as a FortiGate in NAT mode. VDOMs are a method of dividing a FortiGate unit into two or more virtual units that function as multiple independent units. VDOMs can provide separate security policies and, in NAT mode, completely separate configurations for routing and VPN services for each connected network. For administration, an administrator can be assigned to each VDOM, minimizing the possibility of error or fouling network communications.

By default, most FortiGate units support 10 VDOMs. Many FortiGate models support purchasing a license key to increase the maximum number.

Advanced concepts

Leave a reply

Advanced concepts

This chapter provides configuration concepts and techniques to enhance your network security. This section includes the topics:

  • Dual internet connections (redundant Internet connections)
  • Single firewall vs. multiple virtual domains
  • Modem
  • FortiExtender
  • DHCP servers and relays
  • Assigning IP address by MAC address
  • DNS services
  • Dynamic DNS
  • FortiClient discovery and registration
  • IP addresses for self-originated traffic
  • Administration for schools
  • Replacement messages list
  • Disk
  • CLI Scripts
  • Rejecting PING requests
  • Opening TCP 113
  • Obfuscate HTTP responses

 

Dual Internet connections (redundant Internet connections)

Dual internet connection, dual WAN, or redundant internet connection refers to using two FortiGate interfaces to connect to the Internet. Dual internet connections can be used in three ways:

 

  • Redundant interfaces, should one interface go down, the second automatically becomes the main internet connection
  • For load sharing to ensure better throughput.
  • A combination of redundancy and load sharing.

 

Redundant interfaces

Redundant interfaces, ensures that should your internet access be no longer available through a certain port, the FortiGate unit will use an alternate port to connect to the Internet.

 

Configuring redundant interfaces

In this scenario, two interfaces, WAN1 and WAN2 are connected to the Internet using two different ISPs. WAN1 is the primary connection. In an event of a failure of WAN1, WAN2 automatically becomes the connection to the Internet. For this configuration to function correctly, you need to configure three specific settings:

  • Configure a link health monitor to determine when the primary interface (WAN1) is down and when the connection returns
  • Configure a default route for each interface.
  • Configure security policies to allow traffic through each interface to the internal network.

 

Link Health Monitor

Adding a link health monitor is required for routing fail over traffic. A link health monitor will confirm the connectivity of the device’s interface

 

To add a link health monitor

config system link-monitor edit “Example1”

set srcint <Interface_sending_probe>

set server <ISP_IP_address>

set protocol <Ping or http>

set gateway-ip <the_gateway_IP_to_reach_the_server_if_required>

set failtime <failure_count>

set interval <seconds>

set update-cascade-interface enable set update-static-route enable

set status enable

end

 

 

Routing

You need to configure a default route for each interface and indicate which route is preferred by specifying the distance. The lower distance is declared active and placed higher in the routing table.

When you have dual WAN interfaces that are configured to provide fail over, you might not be able to connect to the backup WAN interface because the FortiGate unit may not route traffic (even responses) out of the backup interface. The FortiGate unit per- forms a reverse path lookup to prevent spoofed traffic. If no entry can be found in the routing table which sends the return traffic out the same interface, then the incoming traffic is dropped.

 

To configure the routing of the two interfaces – web-based manager

1. Go to Router > Static > Static Routes and select Create New Route or IPv6 Route.

For low-end FortiGate units, go to System > Network > Routing and select Create New Route or

IPv6 Route.

2. Set the Destination IP/Mask to the address and netmask of 0.0.0.0/0.0.0.0 if it’s an IPv4 route. If it’s an IPv6 route, set Destination IP/Mask to the address and netmask of ::/0

3. Select the Device to the primary connection, WAN1.

4. Enter the Gateway address.

5. Select Advanced.

6. Set the Distance to 10.

7. Select OK.

8. Repeat steps 1 through 7 setting the Device to WAN2 and a Distance of 20.

 

To configure the IPv4 routing of the two interfaces – CLI

config router static edit 0

set dst 0.0.0.0 0.0.0.0 set device WAN1

set gateway <gateway_address>

set distance 10 next

edit 0

set dst 0.0.0.0 0.0.0.0 set device WAN2

set gateway <gateway_address>

set distance 20 next

end

 

To configure the IPv6 routing of the two interfaces – CLI

config router static6 edit 0

set dst ::/0

set device WAN1

set gateway <gateway_address>

set distance 10 next

edit 0

set dst ::/0

set device WAN2

set gateway <gateway_address>

set distance 20 next

end

 

Security policies

When creating security policies, you need to configure duplicate policies to ensure that after traffic fails over WAN1, regular traffic will be allowed to pass through WAN2 as it did with WAN1. This ensures that fail-over will occur with minimal affect to users. For more information on creating security policies see the Firewall Guide.

 

Load sharing

Load sharing enables you to use both connections to the internet at the same time, but do not provide fail over support. When configuring for load sharing, you need to ensure routing is configured for both external ports, for example, WAN1 and WAN2, have static routes with the same distance and priority.

Further configuration can be done using Equal Cost Multiple Path (ECMP). For more information on ECMP and load sharing, see the Advanced Routing Guide.

 

Link redundancy and load sharing

In this scenario, both links are available to distribute Internet traffic over both links. Should one of the interfaces fail, the FortiGate unit will continue to send traffic over the other active interface. Configuration is similar to the Redundant interfaces configuration, with the main difference being that the configured routes should have equal distance settings.

This means both routes will remain active in the routing table. To make one interface the preferred interface, use a default policy route to indicate the interface that is preferred for accessing the Internet. If traffic matches the security policy, the policy overrides all entries in the routing table, including connected routes. You may need to add a specific policy routes that override these default policy routes.

To redirect traffic over the secondary interface, create policy routes to direct some traffic onto it rather than the primary interface. When adding the policy route, only define the outgoing interface and leave the gateway blank. This ensures that the policy route will not be active when the link is down.

Oracle TNS listener session helper (tns)

Leave a reply

Oracle TNS listener session helper (tns)

The Oracle Transparent Network Substrate (TNS) listener listens on port TCP port 1521 for network requests to be passed to a database instance. The Oracle TNS listener session helper (tns) listens for TNS sessions on TCP port 1521. TNS is a foundation technology built into the Oracle Net foundation layer and used by SQLNET.