FortiGate VMX Installation v1

FortiOS Handbook - FortiGate-VMX Installation - v1
VMX Security Nodes using FortiOS v5.2.4
FORTINET DOCUMENTLIBRARY
http://docs.fortinet.com
FORTINETVIDEOGUIDE
http://video.fortinet.com
FORTINETBLOG
https://blog.fortinet.com
CUSTOMERSERVICE&SUPPORT
https://support.fortinet.com
http://cookbook.fortinet.com/how-to-work-with-fortinet-support/
FORTIGATECOOKBOOK
http://cookbook.fortinet.com
FORTINETTRAININGSERVICES
http://www.fortinet.com/training
FORTIGUARDCENTER
http://www.fortiguard.com
ENDUSER LICENSE AGREEMENT
http://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: techdocs@fortinet.com
Thursday, September 24, 2015

FortiOS Handbook - FortiGate-VMX Installation
01-520-203906-20150304
TABLEOFCONTENTS
Change Log
Introduction
Overview
The Integration/Interaction Process
Terms and concepts
dvPortGroups
dvSwitch
ESXi
Host
Kernel agent
NetX
NSX
Security Node
Service Manager
vCenter
vCNS
vSphere Enterprise
FortiGate-VMX and FortiGate-VM - similarities
FortiGate-VMX and FortiGate-VM - differences
The FortiGate-VMX Target Customer
Environmental prerequisites
VMware components:
VMware technologies
Other resources
Licensing
Getting the License
Installation of FortiGate-VMX Service Manager

Assumptions
Configuring ESXi Agent VM Settings
Relevant settings
How to configure them:
Registering FortiGate-VMX
Downloading the images
5
6
7
7
8
8
8
9
9
9
9
9
9
9
10
10
10
10
11
12
13
13
13
13
14
14
15
15
15
15
15
16
17
Deployment Package Contents

Placing FortiGate-VMX Security Node files on the Web Server
Deploying the FortiGate-VMX Service Manager
Configuring FortiGate-VMX Service Manager

Configure FortiGate-VMX Service Manager MGMT Interface
Set MGMT port IP address
Set default gateway
Set DNS
Connecting to the FortiGate-VMX Service Manager Web UI
Uploading FortiGate-VMX Service Manager license file
VMware settings
Interface settings
Enable Services
Enable cluster for service
Enable dvPortGroups for service
Enable the NetX service
Setting Policies
18
18
18
24
24
24
24
24
25
25
25
26
27
27
27
28
29
Change Log
Change Log
Date
Change Description
2015-09-15
Added diagram to overview.
2015-09-02
Initial Release.
FortiGate-VMX Installation - v1
Fortinet Technologies Inc.
Introduction
Just because its in the cloud does not make it secure. The nature of virtual systems make it difficult for most of
us to properly visualize what is really going on and how it really works. The analogy that a virtual systemis exactly
like itshardware counterpart, except that it is a computersimulation, gets most of the important ideas across but
it doesn't convey everything. A single computer that spread over multiple computers across the world is a little
harder to comprehend, especially when you consider that it is in multiple places at the same time. For the final
step, add in the idea of a network between virtual computers that is on one computer; or the more likely scenario,
multiple computers that are synthesizinga platform that hosts virtual systemsas if it is one computer. With every
extra layer of complexity, it gets moredifficult for the mindto grasp.
Now, to make this more confusing, consider this
If you introduce malware to the computer hosting some virtual computers, you might detect it by running AV on
the OS of the host computer. If you introduce malware into one of the virtual systems hosted by that
computer,antivirus softwaremight be able to detect the malware if run on the OS of the virtual computer. What
about the virtual networkused to communicate between the virtual computers? This network is running within a
computer, but the operating system'slogictells it a network is something separate from the OSand thus to be
ignored when running scans. The tendency so far in the world of IT, is that if there is a weakness in a system,
someone is going to find a way to exploit it. Therefore defenses need to be put in place.
FortiGate VMX is one of the tools in the strategy of that defense.
The following topics are included in this section:
l
"Overview" on page 7
"Environmental prerequisites" on page 13
"Licensing" on page 14
"Installation of FortiGate-VMX Service Manager" on page 15
"Configuring FortiGate-VMX Service Manager" on page 24
"Setting Policies" on page 29
Overview
The FortiGate-VMX solution is intended to provide integrated protection of East/West traffic flow inside a virtual
environment.
It is designed for a VMware-only environment with interoperability with vSphere, vCloud Networking and Security
or NSX.
FortiGate-VMX is able to achieve this level of co-existence because it is the result of a partnership between
VMware and Fortinet to integrate FortiGate -VMX into the environment by allowing it to use VMware's own API
NetX. This allows communication directly with the vSphere hypervisor. In fact, FortiGate-VMX has two WMware
certifications:
1. vCNS (vCloud Networking & Security)

2. vCNS compatible in NSX
Once it is configured and licensed properly, every time a VMware host is introduced into the infrastructure, a
virtual FortiGate called a Security Node will be placed between the host and the virtual switch. The Security Node
is not in Transparent Mode as might be assumed because there is no NATing occuring. Rather, what is going on
is the virtual equivalent of a port pairing. The Security Node has only 2 interfaces; internal and external. Anything
reaching the external port can only go out through the internal port and vice versa. Configured policies can be
applied using these interfaces rather than the same profiles to everything going through the FortiGate.
The Integration/Interaction Process

Once everything has been properly installed the deployment of Security Nodes will be automatic. An overview of
the deployment process is laid out as follows:
1. Initiate communication with vCenter Server
Overview
Terms and concepts
The connection is required for dynamic updates of the object database.
2. Register Fortinet as security service with vCNS Manager

l
The registration process uses the NetX management plane API to enable bi-directional communication
between FortiGate-VMX Service Manager and the vCNS Manager.
3. Auto-deploy FortiGate-VMX to all hosts in security cluster

l
The vCNS Manager collects the FortiGate-VMX image from the URL specified during registration and installs
an instance of FortiGate-VMX on each ESXi host in the ESXi cluster.
4. FortiGate-VMX connects with FortiGate-VMX Service Manager

l
The FortiGate-VMX initiates a connection to the FortiGate-VMX Service Manager to obtain its license.
5. License verification and configuration synchronization with FortiGate-VMX

l
FortiGate-VMX reconnects with the FortiGate-VMX Service Manager and provides its serial number. Once
verified the FortiGate-VMX Service Manager synchronizes the configuration.
6. Kernel agent creation and default re-direction rules for each host in cluster
l
For all objects secured in the cluster, a default policy of re-direction of all traffic to FortiGate-VMX is set.
7. Real-time updates of object database

l
The vCenter Server and vCNS Manager send real-time updates on the changes in the virtual environment to
the FortiGate-VMX Service Manager.
8. Push policy synchronization to all FortiGate-VMX deployed in cluster

l
Create security policies and then push these policies to the FortiGate-VMX instances. Every FortiGate-VMX
deployed to the cluster will have the same set of policies.
Terms and concepts

This product, more than most, is dependent on its interaction with a third party product as well as being designed
differently from most of the other virtual Fortinet products, so a short listing of terms and concepts not common to
our other products is included to avoid confusion.
dvPortGroups
Distributed Port groups in VMware are similar to vLANs traditionally used to isolate traffic in a network.
VMwares official definition of a dvPortGroup is:
A distributed port group specifies port configuration options for each member port on a vSphere
distributed switch. Distributed port groups define how a connection is made to a network.
dvSwitch
A dvSwitch is a distributed Virtual Switch. In the traditional virtual environment that hosts multiple VM instances
on a single host, there is one virtual switch that all the instances are attached to inside the host. The difference
in a distributed virtual switch is that this switch can span multiple hosts.
Terms and concepts
Overview
ESXi
VMware's enterprise-class, type-1 hypervisor, used for deploying and hosting virtual computers. Because it is a
type-1 hypervisor it is not a software application that is installed on top of an existing operating system. It has its
own OS components and can be installed directly on the computer hardware or as its own virtual OS.
Host
In a VMware infrastructure, a host is an instance of ESXi that holds one or more VMs. These VMs can be virtual
servers or virtual network devices.
Kernel agent
This is a component of the infrastructure that is situated between each virtual NIC and the vDistrubuted Switch.
As traffic goes between the vNIC and the vSwitch, it gets passed over to the VMX instance to be processed.
NetX
A program that is available to specific Technical Alliance Partner (TAP) Elite partners. It is called the Network
Extensibility API or NetX.This allows the interception of traffic between a VMs vNIC and the virtual switch its
plugged into to make policy decisions.
This API allows FortiGate-VMX to integrate into the VMware infrastructure.
Fortinet use NetX version 1, which allows deployment into either NSX or vCNS environments. NetX version 2 only
allows deployment into NSX environments.
NSX
NSX is VMwares network virtualization platform for the Software-defined Data Center. In NSX, virtual networks
are programmed, provisioned, and managed independent of the underlying hardware. It reproduces the entire
network model in software, enabling any network topology to be created and provisioned without all the physical
work of having to rewire, move and connect your hardware.
There are 2 variations of NSX; NSX-V and SNX-MH. FortiGate-VMX works with NSX-V, which works with NSX
vSphere. NSX-MH doesn't work with NSX Multi-hypervisor which is a requirement for VMX's functionality.
Security Node
The FortiGate-VMX Security Node is the virtual FortiGate-VMX Firewall instance deployed with each host.
Service Manager
The Service Manager, of if you prefer its full name, FortiGate-VMX Service Manager, is the interface between the
FortiGate-VMX Security Nodes and the VMware infrastructure.It is through the Service Manager that the Security
Nodes are deployed, configured and licensed. In some ways if could be thought of a FortiManager for VMX
Security Nodes only.
Overview
vCenter
VMware vCenter server is the centralized management application portion of vSphere that lets you centrally
manage virtual machines and ESXi hosts. vCenter is a requirement to have enterprise features like vMotion,
VMware High Availability, VMware Update Manager and VMware Distributed Resource Scheduler (DRS).
vCNS
vCloud Networking and Security (vCNS) is a framework of APIs that give VMware partners the capability to
integrate 3rd party solutions into VMware environments.
VMware has announced EOA (End of Availability) of vCNS v5.5. Support is currently scheduled to run through
2016. This was done to primarily push customers (and partners) to support NSX. The majority of vCNS users plan
to keep their environments for a few more years before taking the plunge to NSX.
While the majority of customer inquiries fielded are cloaked around NSX support, there are many more vCNS
users than NSX users. FortiGate-VMX v1 allows us to address 100% of the market instead of just the NSX
portion.
vSphere Enterprise
VMware's cloud computing virtualization operation system.

Both the FortiGate VM and VMX are security virtual appliances. In fact, they are based on the same FortiOS
firmware. The current version of FortiGate-VMX is based on FortiOS 5.2.4. Just like the FortiGate hardware
appliances and FortiGate virtual appliances, FortiGate-VMX includes the following advanced functions and
features:
10
Firewall
Application Control
Application Security
Anti Virus
Data Leak Prevention
Email Filter
IPS/IDS
Web filtering
Explicit Proxy
FortiGuard Services
Overview

While a FortiGate-VMX functions in the same way as a FortiGate VM, securing and filtering traffic that goes
through it, there are some differences which include:
l
The FortiGate-VM is an edge security solution. It has features like VPN termination and NAT. The FortiGate-VMX
security service secures traffic between vNICs of each VM and the virtual ports of the vSwitch they are connected
to. FortiGate-VMX is more closely analogous to a host-based firewall, except the firewall is external to the host
rather than on the OS.
FortiGate-VMX is designed to sit inside of the virtual infrastructure, not outside of it.
FortiGate-VMX is a two component system. Both are required for it to function properly.
A FortiGate VM is a virtual appliance deployed from an OVF file either manually by using the VM administrator or as
part of an orchestrated event.It has the same feature set of the hardware version of a FortiGate. It is intended for a
static environment. By comparison, the FortiGate VMX is part of an automated deployment process that is part of
the VMware virtual environment through it use of an API.
Once the VMX Service Manager is integrated into the SDDC, any time an ESXi host is added, a FortiGate-VMX
instance will be auto deployed and self-register with the FortiGate-VMX Service Manager.
The configuration of FortiGate-VMX instances is handled by the FortiGate-VMX Service Manager rather than by
logging on to the instance itself to configure it. No manual configuration of the node required.
Because the node is effectively part of the vSphere infrastructure, the vMotion feature which allows for live
migration, will also move the node.
The licensing of FortiGate-VM relates to the number of vCPUs assigned to it. FortiGate-VMX is instance-based; 1
instance requires 1 license regardless of the resources assigned to it.
The only available support options for FortiGate-VMX are the 24x7 UTM or 24x7 NGFW bundles.
Regular FortiGate functions not supported by VMX:

l
VPN tunnels.
WAN optimization
NAT
Dynamic Routing
Normal VDOMs or VDOM upgrades

There are only 2 VDOMs available.
Root- used for synchronization between FortiGate-VMX Service Manager and FortiGate-VMX
Security Nodes
Vd-fgtvmx - In transparent Mode and is used for the actual configuration of the VMX
instances
While the functionality of some regular feature may not be included in the VMX version
of FortiGate, the menu items may still be present in the GUI.
11
Overview

If you are trying to figure out if FortiGate-VMX is the sort of solution that you are looking for the first question you
need to ask yourself is what sort of security solution you are looking for. If its a device that terminates VPNs and
requires NAT for external traffic flow, then FortiGate-VM likely the better fit for your needs.
If you still think that FortiGate-VMX might be what you are looking for you need to look at your existing virtual
infrastructure. Are you running VMware? If so, are you running vSphere with either NSX or vCNS? If these
answers are yes then there is the possibility that this solution is a potential fit.
The VMware environment that is suitable for FortiGate-VMX is a full VMware Software Defined Datacenter
(SDDC) and can be a fairly extensive design and installation process. The entry point and VMware requirements,
at this juncture, generally lean towards significant investment both in dollars and manpower. A FortiGate-VMX
solution is most likely to be desired in the infrastructures of Service Providers and large enterprise installations.
12
Environmental prerequisites
The deployment of FortiGate-VMX requires a properly licensed VMware vSphere 5.5 environment as well as
knowledge of how to configure and maintain the environment. Other VMware platforms such as Workstation,
Fusion, Player for Server are not supported. The following environment should be set up and properly licensed in
the environment:
VMware components:
l
vCenter Server Standard version 5.5, Update 1 or Update 2
vSphere Enterprise Plus version 5.5, Update 1 or Update 2 (Update 2 is recommended version)
l
vSphere Enterprise Plus licenses for ESXi
vSphere Web Client - the Windows client is no longer supported for this version of VMware vSphere.
A vCNS (vCloud Networking & Security) or NSX environment including the associated manager.
l
vCNS environment - VMware vShield Manager version 5.5.2.1 or newer
NSX environment - VMware NSX Manager, version 6.1.3 or version 6.1.4
FortiGate -VMX is certified for version 5.5 WMware products (except NSX Manager).
Version 6 is not yet supported.
VMware technologies
l
vDistributed switches (standard vSwitches arent supported this is an VMware requirement).Only traffic going
through the vDistributed switches can be secured by the VMX solution.
DRS Cluster(s) - These clusters will contain the hosts. The clusters containing the hosts must be DRS enabled for
the solution to work.
Other resources
l
Web server (for FortiGate-VMX Security Node deployment files) - there is no particular type or version of web
server. It can be hardware based or vm-based. The requirements are that it be:
l
able to serve up files designated by a URL.
be accessible to the vShield Manager and vCentre Server
2 networks configured
l
A subnet that includes vCenter Server and vShield Manager
A subnet that includes admin access to the VMX Security Nodes
13
Licensing
There are two Fortinet products that make up a FortiGate-VMX environment.Each of these components has its
own license scheme, but the FortiGate-VMX Security Node license(s) are 'associated' with the FortiGate-VMX
Service Manager license and are made available in it's license repository after validation:
1. FortiGate-VMX Service Manager

l
l
Licensing the Service Manager requires the installation of a license file

A single Service Manger can handle an almost unlimited number of FortiGate-VMX Security Nodes so only
one license is required.
The Service Manager must be able to connect to the Internet to validate its license against the FortiGuard
Network
2. FortiGate-VMX instances
l
A license is required for each FortiGate-VMX instance deployed
Only one FortiGate-VMX Security Node is required for a ESXi Host
It is kept simple in that 1 Security Node requires 1 license. RAM and virtual CPUs are not used when calculating
license requirements.
The FortiGate-VMX Security Nodes received their license from, and validate against the FortiGate-VMX
Service Manager.
The licenses for the instances are not assigned directly to the instance by the administrator, they are applied to
the FortiGate-VMX Service Manager.The Service Manager keeps track of how many licenses have been
purchased and how many are available for use. The total number of instances deployed is not as relevant as how
many are concurrently in operation. As instances are brought up licenses are used and as instances are brought
out of services, licenses are returned to the pool. If a deployment is attempted when there are no licenses left in
the pool, the instance will be deployed, but when it communicates to the Service Manager that it is up and needs
a license it will be denied. This means that any VM on that host will have its traffic blocked.
The information on VMX License usage is located in the licensing widget so if you are planning on future
deployments you can quickly see if you have enough available licenses.
While the logical limit to the number of nodes that a Service Manager can handle is
theoretically unlimited, there are practical limitations that are likely to limit the
number.Things like IT resources may put an upper limit on how many instances can be
effectively installed and managed.
Getting the License

The procedure for getting the license file is essential the same as with FortiGate-VM.
When you order a Service Manager and a number of VMX instances, usually 10 as a starting point. You will get
one license registration code. When you go to register the license there will be 2 links in the product information
window. The link to select is the one that says "License File Download".
14

The installation of FortiGate-VMX Service Manager shares a number of the same procedures as a FortiGate VM
deployment. However, there are differences due to how the FortiGate-VMX Service Manager is integrated into
the VMware environment and these differences warrant separate documentation of the installation procedure
apart from that of a regular FortiGate-VM in VMware.
Because the FortiGate-VMX Security Nodes are automatically deployed, even though there are two components
to the FortiGate-VMX solution, the installation instructions will focus on the installation and configuration of the
FortiGate-VMX Service Manager.
Assumptions
Because the successful installation of this product depends on a third-party technology that is responsible for its
own documentation, some assumptions will have to be made in reference to the instructions and documentation
for the installation.
l
The installer has knowledge of the required VMware components that will be interacting with FortiGate-VMX
Service Manager.
All of the VMware components required are already installed, configured, licensed, and communicating properly.
Distributed Virtual Switches have been properly configured to allow traffic to and from the setup.
Configuring ESXi Agent VM Settings

The Agent VM Settings must be properly set on each ESXi host which you plan to make part of the cluster.
Relevant settings
Datastore
Used when deploying the FortiGate -VMX Security Node to the host. The Datastore setting is where the Service
VMs files will reside. In Fortinets case, the Service VM is a FortiGate-VMX Security Node
Network
The Network setting is for communication between the FortiGate-VMX Service Manager and FortiGate-VMX
Security Node instance.
How to configure them:

1. Log into the vCenter Server with the vSphere Web Client.
2. Select the Manage tab for each ESXi host.
3. Under Settings, look for Agent VM Settings in the left pane.
4. Click Edit
15
5. Select Datastore and set the value

6. Select Network and set the value
Fortinet recommends choosing a local Datastore if one is available
In order to properly license FortiGate-VMX Service Manager you will need the correct license file. To obtain the
license file, the FortiGate-VMX Service Manager must be registered with Fortinet Customer Service & Support.
To register the FortiGate VMX Service Manager:
1. Go to the Fortinet Customer Service & Support website at: https://support.fortinet.com

2. Log in to the Customer Service & Support portal
l
Use an existing support account or select Sign Up to create a new account
4. Go to the Asset section on the page or select the Asset tab at the top of the page, and choose Register/Renew.
The Registration Wizard page will open.
5. The first step in the Wizard is to specifiy a registration code. Enter the registration code that was emailed to you in
the field. select Next.
6. Complete filling out the fields in the wizard. There are 4 pages to the wizard.
7. After completing the wizard, a registration acknowledgment page will appear.
8. Select the License File Download link.
9. You will be prompted to save the license file (.lic) to your local computer.
10. Once the FortiGate-VMX Service Manager has been installed, the license file can be upload and the registration
process can be completed. See "Uploading FortiGate-VMX license file" for instructions in the process.
16

Like all FortiGate images, whether firmware for hardware appliances or virtual instances,the images for
FortiGate-VMX products are found on the Fortinet Customer Service & Support site.
1. Login to the site with your credentials

2. Got to the Download section
3. Select Firmware Images
4. In the Select Product drop down menu, select FortiGate.
5. Select the Download tab
6. From the Image Folders/Files list, choose v5.00
7. From the resulting secondary sub-list, choose the 5.2 directory
8. From the resulting tertiary sub-list, choose the version that you wish to install. The earliest firmware version that
includes FortiGate-VMX is 5.2.4
9. There are two image files that you will need.
l
The image for the FortiGate-VMX Service Manager - these files will have the prefix FGT_VM64_SVM-v5build
The image for the FortiGate-VMX Security Node - these files will have the prefix FGT_VM64_VMX-v5build
For each of these prefexes there will be two variations of file extensions; the .out file or the
.outovf.zip file.
Below is an example of what the file links will look like:
The files that need to be downloaded are the deployment packages for each component. These will be the ones
with the extension: .out.ovf.zip.
Other things that you may want to consider downloading are the checksums of the
files to verify that you got a good copy and the Release Notes for the FortiGate
firmware version that you downloaded.
Once you have downloaded the deployment packages, the files will need to be extracted from the zip file. There
are a number of applications and utilities that will do this. Use whichever is available to you depending upon the
OS of the system that you downloaded the files to.
17
Deployment Package Contents

FortiGate-VMX Service Manager .out.ovf.zip:
l
FortiGate-VMX-Service-Manager.ovf - OVF template file
fortios.vmdk - FortiGate-VMX Service Manager system hard disk in VMDK format
datadrive.vmdk - FortiGate-VMX Service Manager log disk in VMDK format
The contents of the FortiGate VMX Service Manager package only needs to be placed in a folder, where you will
remember where to find it, on the computer that you will be doing the deployment from.
FortiGate-VMX Security Node .out.ovf.zip:

l
FortiGate-VMX.ovf - OVF template file
fortios.vmdk - FortiGate-VMX system hard disk in VMDK format
datadrive.vmdk - FortiGate-VMX log disk in VMDK format (not currently used)
The contents of the the FortiGate-VMX Security Node package will need to be place on a webserver that can be
accessed by the FortiGate-VMX Service Manager when generating new instances of the security node.
Placing FortiGate-VMX Security Node files on the Web Server

There are no special requirements for the placing of the files on the web server other than making sure the access
and permissions allow the downloading of the files by the use of a URL. Placing the files on the web server should
be an easy step but it is an important one because deployment cannot occur if the files are not there.

1. Using VMware's vSphere Web Client, select the virtual instance that you which to use, right-click on it to reveal the
drop down menu and select Deploy OVF Template to open the OVF deployment wizard.
18
2. Select Source
l
Select Local File and browse to the FortiGate-VMX-Service-Manager.ovf file.
Press Next.
19
3. Review details
l
Review the information about the location of the OVF file to make sure that it is correct.
Press the Next.
4. Accept Licence Agreements
20
Read the EULA and if you accept it press Accept.
Press Next.
5. Select name and folder

l
Enter a name for the instance in the Name field
Select a location for this instance to be placed.
Press Next.
6. Select storage
l
Select the virtual disk format from its drop down menu.
21
Select the VM Storage policy from its drop down menu.
Select the destination datastore from the list of available datastores.
Press Next.
7. Setup networks
l
22
Select a Management Network that the deployed template should use from the drop down menu. This will
be the network that is used to communicate between the FortiGate-VMX Service Manager and the VMware
components as well as connecting to the FortiGate-VMX Server Manager Web Interface or other
Management communications.
Select an Agent Sync Network that the deployed template should use from the drop down menu.This will
be the network thatwill be used for all communications between the FortiGate-VMX Service Manager and
FortiGate-VMX Security Node instances. It is recommended that this should be a closed network with only
VMX components connected to it.
Press Next.
8. Ready to complete
l
Review the settings to make sure they are correct.
Press Finish.
23

The following steps need to be completed to establish a basic FortiGate-VMX Service Manager setup.
Configure FortiGate-VMX Service Manager MGMT Interface

Before you can connect to the FortiGate-VMX Service Manager web-based manager you must configure a
network interface in the FortiGate-VMX Service Manager console. This is done by using the console feature of
VMware to connect to the VM in a terminal emulator mode.
Set MGMT port IP address

Using the CLI type in the following commands:
config global
config system interface
edit mgmt
set ip <IP address for the MGMT interface > <subnet mask>
set allowaccess ping https ssh http
end
Set default gateway

config vdom
edit root
config router static
edit 0
set device mgmt
set gateway <IP address of gateway>
end
Set DNS
config global
config system dns
set primary <IPv4 address of DNS server>
set secondary <IPv4 address of DNS server>
end
Once you have configured the management interface you should be able to connect through the Web-based user
interface to complete the configuration.
An added reason to make sure that the network settings are properly configured is that
the FortiGate-VMX Service Manager requires Internet connectivity to validate its
license against FDN. A regular FortiGate-VM can validate against a FortiManager but
this capability is not supported by FortiGate-VMX.
24

The Graphic User Interface (GUI) of the FortiGate-VMX Service Manager is web-based so before it can be used
the MGMT port must be configured with an IP address and netmask. The default gateway and DNS should also
be set up.
1. Opening up a browser
2. Enter in the URL field, the IP address that was assigned to the MGMT port.
3. At the login page, enter your credentials into the Name and Password fields
4. Select Login
The default username on a factory fresh system will be "admin". There is no default
password. Leave the field blank. As always, a password should be set up as soon as
possible.
Uploading FortiGate-VMX Service Manager license file

The FortiGate-VMX license files are uploaded to the FortiGate-VMX Service Manager through the FortiGateVMX Service Manager's GUI.
The Login page will include a setting called Evaluation License.
1. At Select Enter License
2. This will reveal the License Upload page
3. Select Browse and locate the license file (.lic) on your computer.
4. Select OK to upload the license file.
5. Refresh the browser to login.
6. Enter admin in the Name field and select Login. The Virtual Machine License registration status appears as Valid
in the License Information widget once the license has been validated by the FortiGuard Distribution Network
(FDN).
To add FortiGate-VMX Instance licenses:
1. Go to the License Information widget in the Dashboard
2. Select the Update button in the Virtual Machine row
3. Fill out the information in the window.
The widget line of VMX License Usage will show how many licenses are currently being used out of how many
licenses are registered and available.
VMware settings
The Web-based interface should be familiar to anyone that has worked with FortiGates or FortiGate-VMs. The
only significant difference should be that there is now a VMware setting.
1. In the FortiGate VMX Service Manager GUI, go to Global > VMware > Settings
25
Interface settings
2. Configure the connection to the vCenter Server

l
l
Use the Hostname field to enter the IP address of the vCenter Server
Use the Username and Password fields to enter credentials that have sufficient privileges on the vCenter
Server
3. Configure the connection to the NSX Manager (vShield Manager for vCNS environments)
l
Use the Hostname field to enter the IP address of the server
Use the Username and Password fields to enter credentials that have sufficient privileges on the server
4. Set the location of the FortiGate-VMX Security Node

l
The Image Location field should contain the URL of the webserver where the FortiGate-VMX Security Node
.ovf file is located.
Interface settings
There are two ports on the FortiGate-VMX Service Manager. The MGMT port was configured through the CLI in
order to enable access to the Web-based user interface. This is the part where the Sync network is configured.
This is the network that is only for communication between the FortiGate-VMX Service Manager and the VMX
instances.
Fortinet recommends the sync network to be a closed network, only used by FortiGate-VMX components for
communication. While a corporate DHCP server may be used for enabling IP addresses on FortiGate-VMX
Security Nodes, the FortiGate-VMX Service Manager has those capabilities built into it. Setting a static IP
address on the sync interface and using the interface DHCP server is the preferred approach.
To configure the 'sync' network, log into the FortiGate-VMX Service Manager and go to Global > Network >
Interfaces.
1. Set the Addressing Mode to Manual
2. Enable the DHCP Server function by checking the Enable box
3. Select Create New to define an address ranges scope that is large enough to handle the likely number of VMX
instances that you are going to be creating. Choose an IP addressing scheme and starting point that will allow for
26
Enable Services
growth beyond the number of initial FortiGate-VMX licenses acquired.
Enable Services
Before enabling the service, verify that the cluster and dvPortGroups are properly imported and configured. These
are "off" by default, so there is no disruption of service during installation/deployment.
Currently the enabling of these services is done through the CLI. The following commands are run in the global
settings context.
Enable cluster for service

This setting enables the NetX service on specific clusters. Some environments will have multiple clusters and in
some case it may not be wanted to have all the clusters protected with VMX. Enabling the service on a cluster by
cluster basis allows for some granularity. The service has to be enabled on each cluster that is to be protected.
config global
config netx cluster
edit <cluster name>
set firewall-service enable
end
Enable dvPortGroups for service

This setting enables the NetX service on specific dvPortGroups. If the service on the cluster is enabled,
dvPortGroups within the cluster can have the service enabled or not. This allows for an even further level of
granularity.
config global
config netx dvportgroup
edit <dvportgroup name>
set firewall-service enable
end
27
Enable Services
At least one of the dvPortGroups in a cluster must be enabled otherwise the service
will not start for the cluster and FortiGate-VMX Security Node instances will not be
deployed.
Enable the NetX service

This setting is for the overall enablement of the service. No instances will deploy unless the NetX service itself is
enabled.
config global
config netx setting
set status enable
end
28
Setting Policies
Setting policies in a VMX instance doesn't look that much different than setting up a policy on any other FortiGate
product except for a few minor differences.
The policies for the VMX instances are set up on the FortiGate-VMX Service Manager.
Go to Virtual Domains > netx > Policy & Objects > Policy > IPv4.
There is a lot going on under the hood, but the effect is that a VMX instance will only have 2 interfaces to apply
policies to. These interfaces are the two ends of a port pairing. This solution is integrated with VMware's NetX API
and traffic is intercepted between any given vNIC of a VM and its port on the dvSwitch.In effect, the Internal port
can be considered the VM itself and the External port as everything else. Policy grouping is based on using source
and destination addresses.
The two interfaces are:
1. Internal - the VM itself
2. External - everything else
When setting up a new policy, instead of matching up physical or virtual ports, all that really needs to be done is
determine whether the traffic is inbound to the VM or outbound to everything else. All other parameters involved
in a policy such as Service, Action, Schedule, Security profiles etc are just like a regular FortiGate. For
instructions on the detailed operation and administration of a FortiGate Firewall see the FortiOS manuals. You
can either choose the FortiOS Handbook - The Complete Guide to FortiOS or one of the specific topic
handbooks found at The Fortinet Document Library - http://docs.fortinet.com.
29
Copyright (Undefined variable: FortinetVariables.Year) Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks
are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of
Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab
tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect
performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the
extent Fortinet enters a binding written contract, signed by Fortinets General Counsel, with a purchaser that expressly warrants that the identified product will perform
according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written
contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinets internal lab tests. In
no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking
statements herein are not accurate. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet
reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.

FortiGate VMX Installation v1

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

FortiGate VMX Installation v1

Hochgeladen von

Copyright:

Verfügbare Formate

FortiOS Handbook - FortiGate-VMX Installation - v1

VMX Security Nodes using FortiOS v5.2.4

Thursday, September 24, 2015

Installation of FortiGate-VMX Service Manager

Deployment Package Contents

Configuring FortiGate-VMX Service Manager

Added diagram to overview.

"Environmental prerequisites" on page 13

"Installation of FortiGate-VMX Service Manager" on page 15

"Configuring FortiGate-VMX Service Manager" on page 24

"Setting Policies" on page 29

1. vCNS (vCloud Networking & Security)

The Integration/Interaction Process

1. Initiate communication with vCenter Server

Terms and concepts

The connection is required for dynamic updates of the object database.

2. Register Fortinet as security service with vCNS Manager

3. Auto-deploy FortiGate-VMX to all hosts in security cluster

4. FortiGate-VMX connects with FortiGate-VMX Service Manager

5. License verification and configuration synchronization with FortiGate-VMX

7. Real-time updates of object database

8. Push policy synchronization to all FortiGate-VMX deployed in cluster

Terms and concepts

Terms and concepts

FortiGate-VMX and FortiGate-VM - similarities

FortiGate-VMX and FortiGate-VM - similarities

Data Leak Prevention

FortiGate-VMX and FortiGate-VM - differences

FortiGate-VMX and FortiGate-VM - differences

Regular FortiGate functions not supported by VMX:

Normal VDOMs or VDOM upgrades

The FortiGate-VMX Target Customer

The FortiGate-VMX Target Customer

vCenter Server Standard version 5.5, Update 1 or Update 2

vSphere Enterprise Plus licenses for ESXi

vCNS environment - VMware vShield Manager version 5.5.2.1 or newer

NSX environment - VMware NSX Manager, version 6.1.3 or version 6.1.4

able to serve up files designated by a URL.

be accessible to the vShield Manager and vCentre Server

A subnet that includes vCenter Server and vShield Manager

A subnet that includes admin access to the VMX Security Nodes

1. FortiGate-VMX Service Manager

Licensing the Service Manager requires the installation of a license file

A license is required for each FortiGate-VMX instance deployed

Only one FortiGate-VMX Security Node is required for a ESXi Host

Getting the License

Installation of FortiGate-VMX Service Manager

Configuring ESXi Agent VM Settings

How to configure them:

Installation of FortiGate-VMX Service Manager

5. Select Datastore and set the value

Fortinet recommends choosing a local Datastore if one is available

1. Go to the Fortinet Customer Service & Support website at: https://support.fortinet.com

Use an existing support account or select Sign Up to create a new account

Downloading the images

Installation of FortiGate-VMX Service Manager

Downloading the images

1. Login to the site with your credentials

Installation of FortiGate-VMX Service Manager

Deploying the FortiGate-VMX Service Manager

Deployment Package Contents

FortiGate-VMX-Service-Manager.ovf - OVF template file

fortios.vmdk - FortiGate-VMX Service Manager system hard disk in VMDK format

datadrive.vmdk - FortiGate-VMX Service Manager log disk in VMDK format