# System Configuration System Configuration is the backbone of FortiGate firewalls. It is where everything begins—from setting up the device, configuring the network, and ensuring system reliability. ### **1.1 Device Initialization** This phase involves setting up the FortiGate device for the first time, including configuring interfaces, services, and basic management access. #### **1.1.1 Interface Configuration** - **What is an interface?** An interface is like a network port on your FortiGate device. Think of it as a door connecting the FortiGate to different parts of your network or the internet. - **Assigning IP addresses:** Each interface must have an IP address and subnet mask. These help the FortiGate know where it is in the network. - **Example:** Assign the IP address `192.168.1.1/24` to an interface called `port1`. ```bash config system interface edit "port1" set ip 192.168.1.1/24 set allowaccess https ssh next end ``` - The `allowaccess` command enables specific management protocols like: - **HTTPS:** For web-based management. - **SSH:** For command-line management. - **SNMP:** For monitoring with network tools. - **VLAN Configuration:** VLANs (Virtual Local Area Networks) allow you to separate traffic into logical groups even if they share the same physical interface. - **Example:** Create a VLAN interface with ID `10` under `port2`: ```bash config system interface edit "VLAN10" set ip 10.10.10.1/24 set interface "port2" set vlanid 10 next end ``` - **Management Interface:** The management interface is where you access and configure your FortiGate. - Bind a specific interface (e.g., `port1`) to be used exclusively for management tasks. #### **1.1.2 System Services** - **DNS Configuration:** DNS (Domain Name System) translates domain names (e.g., `google.com`) into IP addresses. - Configure DNS servers for FortiGate to resolve domain names: ```bash config system dns set primary 8.8.8.8 set secondary 8.8.4.4 end ``` - **NTP Configuration:** NTP (Network Time Protocol) ensures your FortiGate’s clock is accurate. This is vital for VPNs, logs, and troubleshooting. - Example configuration: ```bash config system ntp set server "pool.ntp.org" set sync-interval 60 end ``` - **Hostname and Admin Setup:** A hostname makes it easier to identify the FortiGate device in large networks. You can also set up administrator accounts: - Set the hostname: ```bash config system global set hostname "FortiGate-1" end ``` - Add an admin account: ```bash config system admin edit "new-admin" set password "securepassword" next end ``` #### **1.1.3 CLI Basics** - **Why use the CLI?** The Command-Line Interface (CLI) provides faster and more advanced configurations than the graphical user interface (GUI). - **Basic Commands:** - `show system interface`: Displays all interface configurations. - `execute ping `: Tests connectivity to an IP address. - `execute traceroute `: Shows the path traffic takes to reach an IP. ### **1.2 High Availability (HA) Configuration** HA ensures that your network remains operational even if one FortiGate device fails. #### **1.2.1 HA Modes** - **Active-Passive Mode:** One device is active (handling all traffic), and the other is in standby (ready to take over if needed). - **Active-Active Mode:** Both devices share the traffic load. This is useful in high-performance networks. - **FGCP (FortiGate Cluster Protocol):** This protocol keeps the devices in sync, ensuring configurations, sessions, and data are mirrored. #### **1.2.2 Heartbeat Detection and Session Synchronization** - **Heartbeat Detection:** FortiGate devices use dedicated HA interfaces to send heartbeat signals, ensuring cluster health. - Configure HA heartbeat interfaces: ```bash config system ha set group-name "HA-Cluster" set mode a-p set password "ha_password" set hbdev "port3" 50 set priority 200 end ``` - **Session Synchronization:** Keeps active connections alive during a failover. For example, if a user is downloading a file, the connection won’t drop when the primary device fails. #### **1.2.3 HA Troubleshooting** - **Check HA Status:** Use the following command to view HA cluster status: ```bash diagnose sys ha status ``` - **Priority and Failover:** Devices with a higher priority value take over as the primary. Adjusting priority ensures the correct device becomes the leader. ### **1.3 Performance Optimization** FortiGate is designed for high performance. Hardware acceleration and diagnostic tools help optimize system efficiency. #### **1.3.1 Hardware Acceleration** - **NP (Network Processor):** Handles tasks like packet forwarding and VPN encryption, improving firewall performance. - **CP (Content Processor):** Optimizes UTM (Unified Threat Management) functions like IPS and antivirus scanning. - **Checking Acceleration:** Use the following command to view hardware acceleration: ```bash diagnose npu np6 status ``` #### **1.3.2 Diagnostic Tools** - **Monitor CPU and Memory:** The `diagnose sys top` command helps identify resource-heavy processes. - Example: ```bash diagnose sys top ``` - **Trace Traffic Flow:** The `diag debug flow` command is used to trace how packets are handled. - Example: ```bash diag debug enable diag debug flow filter addr 192.168.1.100 diag debug flow show console enable ``` #### **Summary** By mastering these System Configuration fundamentals, you’ll establish a strong foundation in FortiGate operations. As a beginner, start with GUI management for hands-on familiarity, then gradually explore the CLI for advanced configurations. --- # Central Management Central Management simplifies network operations by using FortiManager and FortiAnalyzer to handle device configurations, log analysis, and security policies across large-scale environments. ### **2.1 FortiManager Functions** FortiManager is a centralized management tool designed to simplify configuration and policy management across multiple FortiGate devices. #### **2.1.1 Device Management** - **Import FortiGate Configurations:** - FortiManager can import existing configurations from FortiGate devices, allowing centralized control without starting from scratch. - **Steps:** 1. Add the FortiGate device to FortiManager: - Navigate to **Device Manager** in FortiManager. - Select **Add Device** and input the FortiGate's IP and credentials. 2. Import the configuration when prompted. - **Device Groups:** - Group multiple FortiGate devices for easier management. Devices in the same group can share settings and policies. - **Example Use Case:** - All branch office FortiGate devices can belong to a single group, making updates consistent across locations. #### **2.1.2 Policy Management** - **Policy Packages:** - FortiManager allows creating policy packages that can be deployed to multiple devices. - **Steps:** 1. Go to the **Policy & Objects** section. 2. Create a new policy package. 3. Define rules (e.g., allow/block specific traffic) and apply them to the desired devices. - **Scripts for Bulk Changes:** - Use scripts to perform bulk configuration updates, saving time in large deployments. - **Example:** - A script to set an NTP server across all devices: ```bash config system ntp set server "pool.ntp.org" end ``` #### **2.1.3 Version Control** - **Configuration Snapshots:** - FortiManager automatically creates snapshots of device configurations whenever changes are made. These snapshots allow you to track changes and revert to previous versions if needed. - **Rollbacks:** - If a change causes issues, you can roll back to a stable version using the snapshot history. - **Steps:** 1. Go to the **Revision History** for a device. 2. Select a previous configuration version and click **Restore**. #### **2.1.4 Local FortiGuard Server** - **Purpose:** - Cache FortiGuard signature updates (antivirus, IPS, web filtering) locally instead of fetching them from the cloud, improving update speed. - **Steps to Configure:** 1. Enable the local FortiGuard server in FortiManager. 2. Configure devices to use FortiManager as their FortiGuard update source. ### **2.2 FortiAnalyzer Functions** FortiAnalyzer is a logging and analytics platform that collects data from FortiGate devices to provide insights into network performance and security. #### **2.2.1 Log Storage and Analysis** - **Log Collection:** - FortiAnalyzer collects logs such as: - **Traffic Logs:** Monitor data flows across the network. - **Event Logs:** Record system events like logins or configuration changes. - **User Activity Logs:** Track user behavior and access. - **Dashboards:** - Visualize data through interactive dashboards, showing trends in traffic, threats, and system performance. - **Example:** - A dashboard can display the top 10 sources of blocked traffic, helping identify potential threats. #### **2.2.2 Report Generation** - **Custom Report Templates:** - Create tailored reports to meet organizational needs, such as compliance audits or security reviews. - **Example:** - Generate a report highlighting web filtering activities over the past week. - **Automated Reports:** - Schedule reports to be generated and emailed automatically at specific intervals (e.g., daily, weekly). ### **2.3 Global Policy and Management** Global management capabilities allow administrators to create security rules and configurations that apply to multiple devices or domains, reducing redundancy. #### **2.3.1 Global Policy Configuration** - **Centralized Rules:** - Define a global policy set in FortiManager that applies to all connected devices or specific groups. - **Benefits:** - Avoid redundant configurations. - Ensure consistency across devices and locations. - **Use Case:** - A global policy might include rules for: - Blocking access to high-risk websites. - Enforcing SSL inspection for all traffic. #### **2.3.2 Integrated Management** - **Combining FortiManager and FortiAnalyzer:** - FortiManager handles configuration and policy management, while FortiAnalyzer provides logs and analytics. - Together, they enable centralized visibility and control over the network. #### **Step-by-Step Example Workflow** Here’s an example of how FortiManager and FortiAnalyzer might be used in a real scenario: 1. **Device Configuration:** - Add a new FortiGate device to FortiManager and import its settings. - Assign it to a device group. 2. **Policy Deployment:** - Create a policy package for the device group, defining rules to allow business-critical traffic and block unauthorized access. - Deploy the policy package to all devices in the group. 3. **Log Analysis:** - FortiAnalyzer collects logs from these devices. - Use dashboards to identify unusual traffic patterns. 4. **Report Generation:** - Generate a report summarizing detected threats and policy violations. #### **Why Central Management Matters** In environments with multiple FortiGate devices, managing each one individually becomes inefficient. FortiManager and FortiAnalyzer allow you to: - Save time through automation. - Maintain consistency across devices. - Gain deeper insights into network performance and security. If you’re new to FortiManager and FortiAnalyzer, start by adding a single device to FortiManager, explore the policy creation process, and view logs in FortiAnalyzer to get hands-on experience. --- # Security Profiles Security Profiles are essential for FortiGate’s role as a Unified Threat Management (UTM) device. These profiles allow you to identify, filter, and block threats before they affect your network. ### **3.1 Web Filtering** Web Filtering controls access to websites by categorizing them or blocking specific URLs, protecting users from inappropriate or malicious content. #### **3.1.1 URL Categorization** - **What it Does:** - FortiGuard’s database categorizes websites into predefined groups (e.g., Social Media, Gambling, Malicious Sites). - Administrators can allow or block traffic based on these categories. - **How to Configure:** - In the GUI: 1. Go to **Security Profiles > Web Filter**. 2. Create or edit a Web Filter profile. 3. Under **FortiGuard Categories**, select categories to allow or block (e.g., block "Malicious Websites"). - Example CLI: ```bash config webfilter profile edit "example-profile" config web set category-action 52 block # 52 represents a specific category ID. end next end ``` #### **3.1.2 HTTPS Traffic Scanning** - **Why It’s Important:** - Most modern web traffic is encrypted (HTTPS). Without SSL inspection, FortiGate cannot analyze this traffic, potentially missing threats. - **How to Configure SSL Inspection:** - Enable SSL inspection in your Web Filter profile: 1. Go to **Security Profiles > SSL/SSH Inspection**. 2. Select a pre-defined profile or create a custom profile. 3. Deploy the SSL certificate to user devices for decryption and inspection. #### **3.1.3 Custom URL Filtering** - **When to Use:** - For blocking or allowing specific websites that don’t fall neatly into FortiGuard’s predefined categories. - **How to Configure:** - Example: Block `example.com`: ```bash config webfilter urlfilter edit 1 set url "example.com" set action block next end ``` ### **3.2 Intrusion Prevention System (IPS)** IPS is used to detect and block attacks by analyzing traffic for known vulnerabilities and exploits. #### **3.2.1 IPS Signatures** - **Predefined Signatures:** - FortiGuard provides an extensive database of known attack patterns (e.g., SQL Injection, Buffer Overflow). - **Custom Signatures:** - Create custom rules to detect specific patterns unique to your environment. - Example: ```bash config ips custom edit "custom-signature" set signature "alert tcp any any -> any 80 (content:\"/malicious-pattern\"; msg:\"Blocked Malicious Pattern\")" next end ``` #### **3.2.2 Deep Packet Inspection (DPI)** - **What DPI Does:** - Analyzes application-layer traffic to detect threats beyond basic protocol analysis. - **How to Enable:** - Enable IPS in a Security Policy: 1. Go to **Policy & Objects > IPv4 Policy**. 2. Create/Edit a policy and attach the IPS profile. ### **3.3 Application Control** Application Control helps identify and manage application traffic, ensuring proper use of bandwidth and resources. #### **3.3.1 Application Identification** - **What it Does:** - Detects applications (e.g., Facebook, Dropbox) based on behavior and traffic patterns. - **How to Configure:** - Enable Application Control in a Security Policy: 1. Go to **Security Profiles > Application Control**. 2. Select or create a profile. 3. Add applications or categories to allow/block. #### **3.3.2 Bandwidth Prioritization** - **Why It’s Useful:** - Ensures critical applications (e.g., VoIP, Video Conferencing) receive priority bandwidth. - **How to Configure:** - Use Shaping Policies under Application Control: - Define traffic priorities using QoS settings. ### **3.4 Antivirus and DNS Filtering** These features protect against malicious files and domains. #### **3.4.1 Antivirus Features** - **Real-Time Scanning:** - Inspects files in transit for viruses and malware. - **Static Analysis:** - Scans files for malicious signatures before they are downloaded. - **How to Configure:** 1. Go to **Security Profiles > Antivirus**. 2. Create or edit an Antivirus profile. 3. Enable features like **Real-Time Scan** or **Archive Scanning**. 4. Attach the Antivirus profile to a policy. - **Quarantine Example CLI:** ```bash config antivirus quarantine set enable end ``` #### **3.4.2 DNS Filtering** - **What It Does:** - Blocks access to malicious domains before the connection is established. - **How to Configure:** - Use FortiGuard DNS Filtering: 1. Go to **Security Profiles > DNS Filter**. 2. Create a profile and enable FortiGuard Category Filtering. - CLI Example: ```bash config dnsfilter profile edit "dns-block-malicious" set block-botnet enable next end ``` #### **Practical Example Workflow** Here’s how Security Profiles might be applied in a real-world scenario: 1. **Web Filtering:** - Block access to gambling and malicious sites. 2. **IPS:** - Enable a default IPS profile to detect common network attacks. 3. **Application Control:** - Limit access to social media applications during work hours. 4. **Antivirus:** - Scan all downloaded files and quarantine suspicious ones. 5. **DNS Filtering:** - Block known botnet domains. #### **Why Security Profiles Are Important** Security Profiles are FortiGate’s primary defense against modern threats. By combining Web Filtering, IPS, Application Control, and DNS Filtering, you create a layered security strategy. Start by enabling default profiles, then customize them as you gain familiarity with your network’s needs. --- # Routing Routing is a critical function in FortiGate that ensures traffic is directed efficiently through the network. It includes basic static routes, advanced dynamic routing protocols, and modern SD-WAN features to optimize traffic flow. ### **4.1 Static Routing** Static Routing involves manually defining routes for traffic to specific destinations. It’s the simplest form of routing but lacks the flexibility of dynamic routing. #### **4.1.1 Default and Destination-Specific Routes** - **Default Route:** - A route used when no specific route matches the destination. It typically points to the internet gateway. - **Example Configuration:** ```bash config router static edit 1 set dst 0.0.0.0/0 set gateway 192.168.1.254 next end ``` - Here, `0.0.0.0/0` means "all traffic," and the gateway is `192.168.1.254`. - **Destination-Specific Route:** - Used for traffic to a particular network or host. - **Example Configuration:** ```bash config router static edit 2 set dst 10.0.0.0/24 set gateway 192.168.2.1 next end ``` #### **4.1.2 ECMP (Equal Cost Multi-Path)** - **What is ECMP?** - ECMP allows FortiGate to use multiple paths for the same destination, improving bandwidth and redundancy. - **How to Configure ECMP:** - Add multiple static routes with the same destination but different gateways: ```bash config router static edit 1 set dst 0.0.0.0/0 set gateway 192.168.1.254 set distance 10 next edit 2 set dst 0.0.0.0/0 set gateway 192.168.2.254 set distance 10 next end ``` - FortiGate will load balance traffic across both gateways. ### **4.2 Dynamic Routing** Dynamic Routing uses protocols to automatically adjust routes based on network changes. FortiGate supports OSPF and BGP, two widely used protocols. #### **4.2.1 OSPF (Open Shortest Path First)** - **Key Features:** - OSPF divides networks into areas to optimize routing efficiency. - Neighbor relationships are established between OSPF-enabled routers to exchange routing information. - **Steps to Configure OSPF:** 1. **Define OSPF Areas:** - Example: Set up area 0 as the backbone area. ```bash config router ospf set router-id 1.1.1.1 config area edit 0.0.0.0 next end end ``` 2. **Enable OSPF on Interfaces:** - Assign networks to the OSPF process: ```bash config router ospf config network edit 1 set prefix 192.168.1.0/24 set area 0.0.0.0 next end end ``` 3. **Adjust OSPF Costs:** - Lower costs prioritize specific routes. ```bash config system interface edit "port1" set ospf-cost 10 next end ``` #### **4.2.2 BGP (Border Gateway Protocol)** - **Key Features:** - BGP is used in larger networks, such as those connecting multiple ISPs. - It relies on neighbor relationships (peers) and AS (Autonomous System) numbers for route propagation. - **Steps to Configure BGP:** 1. **Define BGP Neighbors:** ```bash config router bgp set as 65001 config neighbor edit "192.168.1.2" set remote-as 65002 next end end ``` - `65001` and `65002` are the AS numbers for local and remote devices. 2. **Advertise Networks:** - Share networks with BGP peers: ```bash config router bgp config network edit 1 set prefix 192.168.1.0/24 next end end ``` 3. **Apply Route Filters:** - Control which routes are shared or accepted: ```bash config router access-list edit "filter1" config rule edit 1 set prefix 10.0.0.0/24 set action deny next end next end ``` ### **4.3 SD-WAN** SD-WAN (Software-Defined WAN) is a modern approach to routing, offering dynamic traffic management and link optimization. #### **4.3.1 Load Balancing** - **What It Does:** - Dynamically distribute traffic across multiple WAN links based on performance metrics (e.g., latency, jitter, bandwidth). - **Steps to Configure Load Balancing:** 1. Go to **Network > SD-WAN** in the GUI. 2. Add member interfaces (e.g., WAN1, WAN2). 3. Create a performance-based rule: - Define thresholds for latency, jitter, and packet loss. - CLI Example: ```bash config system sdwan config members edit 1 set interface "wan1" next edit 2 set interface "wan2" next end end ``` #### **4.3.2 Monitoring and Optimization** - **Health-Check Rules:** - FortiGate can monitor the health of WAN links and dynamically reroute traffic if a link fails. - **Example Configuration:** ```bash config system sdwan config health-check edit "internet-check" set server "8.8.8.8" set interval 500 set failtime 3 set recoverytime 5 next end end ``` #### **Practical Example Workflow** Here’s how routing features might be applied in a real-world scenario: 1. **Static Routing:** - Configure a default route for internet traffic and a specific route for internal subnets. 2. **Dynamic Routing:** - Use OSPF to manage routes between branch offices and adjust costs to prioritize specific paths. 3. **SD-WAN:** - Distribute traffic between two ISPs based on link performance, ensuring optimal user experience. #### **Why Routing is Important** Routing ensures that data packets reach their destinations efficiently. Mastering static, dynamic, and SD-WAN routing allows you to design resilient and high-performance networks. Start with simple static routes and gradually explore dynamic protocols and SD-WAN for more advanced use cases. --- # VPN Virtual Private Networks (VPNs) enable secure communication over public or private networks. FortiGate supports multiple VPN types, including IPsec VPN, SSL VPN, and Auto-Discovery VPN (ADVPN). ### **5.1 IPsec VPN** IPsec VPNs are commonly used for secure, encrypted communication between two networks (site-to-site) or between a remote device and a network. #### **5.1.1 Site-to-Site VPN** - **Purpose:** - Connects two networks securely over the internet. - Often used between a corporate office and a branch office. - **Configuration Components:** 1. **Phase 1 (IKE Negotiation):** - Establishes a secure connection between the two endpoints. - Defines encryption (e.g., AES256) and authentication (e.g., SHA256) methods. 2. **Phase 2 (IPsec Tunnel):** - Defines the traffic to be encrypted and additional encryption parameters. - **Configuration Steps:** 1. **Phase 1 Setup:** ```bash config vpn ipsec phase1-interface edit "Site-to-Site" set interface "port1" set peertype any set proposal aes256-sha256 set psksecret "YourPSK" set remote-gw 203.0.113.1 next end ``` 2. **Phase 2 Setup:** ```bash config vpn ipsec phase2-interface edit "P2-Site-to-Site" set phase1name "Site-to-Site" set proposal aes256-sha256 set src-subnet 192.168.1.0/24 set dst-subnet 192.168.2.0/24 next end ``` 3. **Create Policies:** - Allow traffic between source and destination subnets. ```bash config firewall policy edit 1 set srcintf "port1" set dstintf "port2" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set logtraffic all next end ``` #### **5.1.2 IKEv2** - **Why IKEv2?** - Faster key exchange, better reliability, and support for NAT traversal. - **How to Enable IKEv2:** - Add the following to the Phase 1 configuration: ```bash set ike-version 2 ``` ### **5.2 SSL VPN** SSL VPN provides secure remote access to corporate networks. It is easier to configure for end users than IPsec VPN and operates over HTTPS. #### **5.2.1 Web Mode and Tunnel Mode** - **Web Mode:** - Provides browser-based access to specific resources (e.g., file servers or intranet applications). - Ideal for users needing limited access. - **Tunnel Mode:** - Creates a secure tunnel for full network access. - Suitable for employees requiring extensive access to corporate resources. - **Configuration Steps:** 1. **Enable SSL VPN:** ```bash config vpn ssl settings set servercert "Fortinet_Factory" set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1" set port 443 end ``` 2. **Configure User Access:** - Create SSL VPN users in the local database or integrate with LDAP/RADIUS. ```bash config user local edit "remote-user" set type password set passwd "SecurePassword" next end ``` 3. **Create SSL Policies:** ```bash config firewall policy edit 2 set srcintf "ssl.root" set dstintf "port2" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" next end ``` #### **5.2.2 User Authentication** - **LDAP Integration:** - Authenticate users using a corporate LDAP server. - Example configuration: ```bash config user ldap edit "LDAP_Server" set server "192.168.1.10" set cnid "uid" set dn "dc=example,dc=com" next end ``` - **RADIUS Integration:** - Use a RADIUS server for user authentication. ```bash config user radius edit "RADIUS_Server" set server "192.168.1.20" set secret "RADIUS_Secret" next end ``` ### **5.3 Auto-Discovery VPN (ADVPN)** ADVPN simplifies VPN setup by dynamically creating tunnels between branch offices when needed. #### **5.3.1 Dynamic Tunnel Creation** - **How It Works:** - In traditional VPNs, all traffic is routed through a central hub, which may cause latency. - ADVPN allows branch offices to establish direct tunnels dynamically, bypassing the hub. - **Configuration Steps:** 1. Enable ADVPN in the hub: ```bash config vpn ipsec phase1-interface edit "Hub-ADVPN" set net-device enable set add-route enable set proposal aes256-sha256 set remote-gw 0.0.0.0 next end ``` 2. Enable dynamic tunnels in the branches: ```bash config vpn ipsec phase1-interface edit "Branch-ADVPN" set net-device enable set add-route enable set proposal aes256-sha256 set remote-gw 192.168.1.1 next end ``` #### **5.3.2 Centralized Management** - **Why Use FortiManager?** - FortiManager can automate VPN configurations across multiple sites, saving time in large deployments. - **How to Configure VPNs in FortiManager:** 1. Add devices to FortiManager. 2. Create a VPN community that includes hub and branch devices. 3. Deploy the VPN configurations to all devices automatically. #### **Practical Example Workflow** Here’s how VPN features might be applied in a real-world scenario: 1. **IPsec VPN:** - Securely connect a branch office to the main office for shared file access. 2. **SSL VPN:** - Enable remote employees to access corporate resources securely from home. 3. **ADVPN:** - Allow two branch offices to communicate directly for faster collaboration. #### **Why VPNs are Important** VPNs are crucial for secure communication in both small and large networks. By mastering IPsec, SSL, and ADVPN configurations, you can build flexible and secure remote access solutions for any organization. --- # System Configuration (Additional Content) ### **1. Virtual Domains (VDOMs)** #### **What Are VDOMs?** VDOMs (Virtual Domains) are a feature of FortiGate that allows a single physical device to operate as multiple, logically separated firewalls. Each VDOM can have its own routing table, firewall policies, interfaces, administrators, and resources. #### **Use Cases:** - Managed service providers (MSPs) who provide firewall services to multiple customers. - Large enterprises that want to separate different departments or business units. - Segregating traffic in a multi-tenant environment or hybrid cloud infrastructure. #### **VDOM Types:** - **Root VDOM:** The default VDOM where system-level settings reside. - **Additional VDOMs:** Created by the administrator to segment traffic and control policies independently. #### **Enabling Multi-VDOM Mode:** VDOMs must be explicitly enabled from the global configuration context. ```bash config global config system global set vdom-mode multi-vdom end ``` After this, you can create and manage individual VDOMs: ```bash config vdom edit "VDOM1" next edit "VDOM2" next end ``` Once VDOMs are enabled, you can switch between them using: ```bash config vdom edit ``` Each VDOM can have its own set of firewall rules, routing configuration, and user authentication settings. ### **2. Configuration Backup and Restore** #### **Why It Matters:** Backing up and restoring configurations is essential for disaster recovery, auditing, migration, and rapid deployment. FortiGate allows you to back up configurations via CLI or GUI, with optional encryption for security. #### **Backing Up Configuration to Local Storage:** ```bash execute backup config flash ``` This command saves the current configuration to the device's local flash memory. You can also specify FTP, TFTP, SCP, or USB as the backup location. #### **Example - Backup to FTP:** ```bash execute backup config ftp ``` #### **Best Practices:** - Always encrypt backup files when storing on external or cloud systems. - Store backups securely with restricted access. - Maintain version history for configuration change tracking. #### **Restoring a Backup:** ```bash execute restore config flash ``` Restoring will immediately overwrite the current configuration, and the system will reboot unless otherwise specified. ### **3. System Events and Logging** #### **Purpose:** Logging is critical for monitoring system health, security events, resource usage, HA status, and for forensic analysis in the case of incidents. FortiGate provides both local and remote logging options. #### **Viewing Logs Locally:** ```bash execute log display ``` This command displays logs in the CLI. It can be filtered for system, event, or specific categories like authentication or HA events. #### **Forwarding Logs to a Syslog Server:** To ensure centralized log management and compliance, FortiGate can be configured to send logs to an external syslog server. ```bash config log syslogd setting set status enable set server "192.168.10.100" set port 514 set facility local7 set format default end ``` #### **Additional Parameters:** - **reliable**: Enables TCP-based log transmission. - **enc-algorithm**: Sets encryption for syslog data. - **source-ip**: Specifies the source IP used for sending logs. #### **Use Cases:** - Integrate with SIEM tools (e.g., Splunk, QRadar). - Centralize logs for HA clusters. - Track system-level events such as interface failures, admin login attempts, or firmware changes. ### **Summary:** These three topics add important operational depth to the **System Configuration** knowledge domain: | Feature | Purpose | Exam Relevance | | --- | --- | --- | | VDOMs | Segment traffic and configurations per tenant/department | High (common in enterprise deployments) | | Backup & Restore | Prevent configuration loss; enable rollback and migration | Medium-High (disaster recovery tasks) | | System Logging | Event tracking, compliance, troubleshooting | High (especially with HA, syslog, etc.) | --- # Central Management (Additional Content) ### **1. Administrative Domains (ADOMs)** #### **What Are ADOMs?** ADOMs (Administrative Domains) are logical containers in FortiManager that allow multiple customers, business units, or regions to be managed independently within the same FortiManager instance. #### **Why Use ADOMs?** - To isolate device configurations, policies, and logs. - Ideal for: - Managed Service Providers (MSPs) who manage multiple clients. - Enterprises with multiple departments needing policy separation. - Multi-tenant environments requiring strict separation of management tasks. #### **Key Features:** - Separate policy packages and object databases per ADOM. - Role-based access control (RBAC) can be applied per ADOM. - Logging and reporting are also isolated by ADOM when integrated with FortiAnalyzer. #### **How to Enable ADOMs:** 1. **Enable in the Global Settings:** ```bash config system global set adom-mode advanced end ``` 2. **Create ADOMs via GUI or CLI:** ```bash config system admin adom edit "CustomerA" next edit "DeptB" next end ``` 3. **Assign devices to each ADOM individually after import.** ### **2. Policy Package Status Check** FortiManager verifies the synchronization status between policy packages and the configurations currently on managed FortiGate devices. #### **Color Indicators:** - **Green** – The policy package is fully installed and matches the device configuration. - **Red** – The policy package has changes that have not been installed yet. - **Orange** – There is a partial mismatch, possibly due to manual changes made directly on the device. #### **Exam Scenario:** You may be asked: **"How can an administrator identify if the policy configuration on FortiGate is out-of-sync with FortiManager?"** Answer: **By checking the color-coded policy status indicator** under the Device Manager or Policy & Objects sections. #### **Common Causes of Mismatch:** - Manual configuration changes on the device. - A policy package was edited but not reinstalled. - Device or ADOM synchronization issues. ### **3. FortiManager CLI Shortcuts and Commands** While most FortiManager tasks are performed via the GUI, certain exam scenarios or advanced workflows may require knowledge of CLI commands. #### **Check Device and Policy Package Status:** ```bash diagnose dvm device list ``` - Lists devices and their status within the Device Manager. - Shows details like ADOM membership, sync status, and policy status. #### **Force Policy Installation (Push):** ```bash execute fmpolicy push ``` - Installs the latest policy package to the specified device. - Useful when automated push fails or needs to be forced during troubleshooting. #### **Check ADOM lock status:** ```bash diagnose fmupdate adom-lock-status ``` - Verifies whether an ADOM is locked by another user or task. #### **Bonus Tip:** CLI is also used in script-based bulk configuration workflows within FortiManager. ### **4. FortiAnalyzer Log Forwarding** FortiAnalyzer is primarily used for centralized log collection, analysis, and reporting, but it also supports **log forwarding** to external systems. #### **Why Use Log Forwarding?** - Integration with third-party **SIEM platforms** (e.g., Splunk, QRadar). - Redundancy in log storage or regulatory compliance. - Load balancing across multiple log analysis systems. #### **Key Configuration Areas:** ```bash config log fortianalyzer setting set status enable set reliable enable set server "192.168.1.100" set enc-algorithm high end ``` - **Log format** can be set to default or customized. - **Retry interval and failover servers** can be defined. - **Filters** allow selection of only specific log types (e.g., only traffic logs). #### **Syslog Forwarding Example (via FortiAnalyzer):** ```bash config system log-forward edit "SIEM" set server "10.10.10.10" set format syslog set mode reliable next end ``` ### **Summary Table:** | Topic | Description | | --- | --- | | ADOM | Logical domains to separate devices, policies, logs across tenants or units | | Policy Status Check | Color-coded sync indicators for policy packages before deployment | | FortiManager CLI Commands | Useful for script execution, sync troubleshooting, and device monitoring | | FortiAnalyzer Log Forwarding | Sends logs to third-party SIEM or syslog servers with filtering and retry control | --- # Security Profiles (Additional Content) ### **1. Email Filtering** #### **What It Does:** Email filtering is used to protect inbound and outbound email traffic against: - **Spam** - **Malware attachments** - **Phishing attempts** - **Impersonation attacks** FortiGate supports email filtering via **FortiGuard Antispam**, combined with basic DLP and antivirus scanning for email protocols (SMTP, POP3, IMAP). #### **How to Configure Email Filtering:** Create or edit an email filter profile and enable spam filtering: ```bash config emailfilter profile edit "email-security" set spam-filtering enable set spam-action discard next end ``` You can also: - Use FortiGuard DNS-based and IP-based blocklists (RBLs/ORBLs). - Tag suspected spam instead of discarding. - Configure additional filters such as banned file types or subject keywords. #### **Key Use Cases:** - Blocking phishing campaigns targeting user credentials. - Preventing malicious attachments from reaching inboxes. - Tagging or redirecting promotional/spam content. #### **Exam Tip:** Expect scenario questions on: - Recognizing spam actions (discard, tag, quarantine). - Integration with mail relays. - Protocols protected by email filtering. ### **2. Data Loss Prevention (DLP)** #### **What It Does:** DLP is a security mechanism that prevents **sensitive or confidential data** from leaving the organization’s network unintentionally or maliciously. #### **Common Use Cases:** - Blocking credit card or personal identification numbers via email. - Preventing unauthorized uploads of confidential documents. - Enforcing compliance with regulations (e.g., PCI-DSS, HIPAA, GDPR). #### **How to Configure a Basic DLP Rule:** Example: Block credit card number patterns over SMTP. ```bash config dlp sensor edit "Block-CC" config rule edit 1 set protocol smtp set filter-by regex set regex "4[0-9]{12}(?:[0-9]{3})?" # Visa card pattern set action block next end next end ``` After defining a sensor, apply it to a firewall policy: ```bash config firewall policy edit 10 set srcintf "port1" set dstintf "wan1" set action accept set schedule "always" set service "SMTP" set dlp-sensor "Block-CC" next end ``` #### **DLP Matching Options:** - File types (e.g., .docx, .pdf) - Regular expressions (credit card, ID numbers) - File fingerprinting (for document control) ### **3. SSL Inspection – Modes and Configuration** #### **Why SSL Inspection Matters:** Today, over 90% of internet traffic is encrypted via HTTPS. Without SSL inspection, FortiGate **cannot inspect payloads**, leaving malware, C2 traffic, or data leaks hidden inside SSL tunnels. FortiGate offers **three SSL Inspection Modes:** #### **1. Certificate Inspection (Basic Mode):** - Does **not decrypt traffic** - Only inspects **SSL/TLS handshake** - Faster but limited visibility - Detects basic issues like expired or untrusted certificates #### **2. Deep SSL Inspection (Full Decryption):** - **Decrypts full SSL traffic** - Enables full inspection by Antivirus, IPS, Web Filter, Application Control - Requires deployment of the FortiGate CA certificate to all client devices - May break applications using certificate pinning #### **3. No Inspection:** - All SSL traffic is passed without inspection - Not recommended unless for specific trusted traffic (e.g., banking apps) #### **How to Configure Deep SSL Inspection:** ```bash config firewall ssl-ssh-profile edit "Deep-Inspection" set can-decrypt-ssl enable set ssl-anomalies block set expired-server-cert block set untrusted-server-cert block next end ``` Apply the profile in a firewall policy: ```bash config firewall policy edit 3 set ssl-ssh-profile "Deep-Inspection" next end ``` #### **Best Practices:** - Deploy FortiGate’s CA certificate to endpoints to avoid browser warnings. - Whitelist applications that break under decryption. - Use certificate inspection for high-privacy apps (e.g., banking) where decryption is inappropriate. ### **Quick Comparison Table** | Feature | Purpose | Config Interface | Exam Notes | | --- | --- | --- | --- | | Email Filtering | Protects email from spam, phishing, malware | `emailfilter profile` | Often tested in phishing cases | | DLP | Prevents sensitive data from leaving network | `dlp sensor` + firewall | Regex-based content detection | | SSL Inspection | Enables payload visibility in HTTPS traffic | `ssl-ssh-profile` | Key concept in threat prevention | --- # Routing (Additional Content) ### **1. Policy-Based Routing (PBR)** #### **What Is Policy-Based Routing?** Policy-Based Routing (PBR) allows you to override the routing table and direct traffic based on custom criteria such as: - Source IP address or subnet - Destination IP address - Services or applications - Incoming interface Unlike regular routing, which chooses the path based on the **destination IP and routing table**, PBR **gives control to the administrator** to route traffic differently based on needs. #### **Use Cases:** - In a dual-WAN scenario: Force specific users or applications (e.g., VoIP, video) through a preferred ISP. - In SD-WAN: Fine-tune traffic steering without relying solely on performance SLAs. - When integrating with MPLS/private circuits and needing traffic segmentation. #### **Configuration Example:** ```bash config router policy edit 1 set input-device "port1" set src 192.168.1.0 255.255.255.0 set dst 0.0.0.0 0.0.0.0 set gateway 10.10.10.1 set output-device "wan2" next end ``` #### **Explanation:** This rule forces all traffic from `192.168.1.0/24` entering from `port1` to use the gateway `10.10.10.1` through `wan2`, regardless of the default routing table. ### **2. Route Lookup and Diagnostic Commands** Troubleshooting routing issues is an essential skill. These CLI commands help determine **how FortiGate is making routing decisions** and are commonly used in both real-world troubleshooting and exams. #### **Useful CLI Commands:** - **View all routes:** ```bash get router info routing-table all ``` - **List current active routes (kernel routing table):** ```bash diagnose ip route list ``` - **Trace the path to a destination:** ```bash execute traceroute ``` - **Check OSPF neighbor status:** ```bash get router info ospf neighbor ``` - **Check BGP peer and route status:** ```bash get router info bgp summary ``` #### **Exam Scenario:** You may get questions such as: “Which command shows whether FortiGate has learned a specific route via OSPF?” Correct answer: `get router info ospf neighbor` (or specific route checks via the routing table) ### **3. Route Preference and Administrative Distance** #### **What Is Administrative Distance?** Administrative Distance (AD) determines the **priority** of a route when **multiple routing protocols** provide paths to the same destination. #### **AD Comparison Table:** | Route Type | Default AD (Lower = Higher Priority) | | --- | --- | | Directly Connected | 0 | | Static Route | 10 | | eBGP | 20 | | OSPF | 110 | | iBGP | 200 | #### **Route Selection Logic:** If a route to `10.0.0.0/24` exists in both OSPF and static routes: - FortiGate will **prefer the static route** due to a lower AD (10 < 110). #### **CLI Example to Set Distance:** ```bash config router static edit 1 set dst 10.0.0.0/24 set gateway 192.168.1.1 set distance 5 next end ``` This overrides the default static route preference, giving it the highest priority. ### **4. BGP Route Map (Advanced Use Case)** #### **What Is a Route Map?** A BGP **route map** is used to **filter, modify, or influence** routing updates. It's FortiGate's way of controlling **which routes are advertised or accepted**, and **how they're treated** (e.g., modifying attributes like local preference or MED). #### **Use Cases:** - Block the advertisement of private routes. - Prefer one BGP peer over another. - Change route metrics for traffic engineering. #### **Basic Configuration Example:** 1. Define an IP prefix list: ```bash config router prefix-list edit "BLOCKED-PREFIX" config rule edit 1 set prefix 10.0.0.0/24 set ge 24 set le 24 next end next end ``` 2. Create the route map: ```bash config router route-map edit "BLOCK-NET" config rule edit 1 set match-ip-address "BLOCKED-PREFIX" set action deny next end next end ``` 3. Apply the route map to the BGP neighbor: ```bash config router bgp config neighbor edit "192.168.1.2" set route-map-out "BLOCK-NET" next end end ``` ### **Summary Table** | Topic | Purpose | Exam Relevance | | --- | --- | --- | | Policy-Based Routing | Override route table using traffic policies | High (real-world + exam use) | | Routing Diagnostics | Command-line tools to trace and validate routing decisions | Very High | | Route Preference & AD | Determines which route is preferred | High (common trick questions) | | BGP Route Maps | Filter or modify advertised/received routes | Medium (bonus points topic) | --- # VPN (Additional Content) ### **1. Route-Based VPN vs Policy-Based VPN** #### **Route-Based VPN (Interface-Based) – Default and Recommended** **Key Characteristics:** - Creates a **virtual interface** (e.g., `vpn-to-siteA`) for the IPsec tunnel. - Routing decisions are made based on the **routing table**. - Offers greater flexibility and better integration with: - SD-WAN - Advanced routing (OSPF/BGP) - Diagnostics and monitoring tools **Configuration Steps:** - Create a **Phase 1 interface**. - Create a **Phase 2 selector**. - Add **static routes or dynamic protocols** pointing to the tunnel interface. - Apply **firewall policies** using the tunnel interface as `srcintf` or `dstintf`. **Use Case:** - Complex enterprise networks, dynamic routing, or multiple tunnels. #### **Policy-Based VPN – Legacy Style** **Key Characteristics:** - No virtual interface is created. - VPN configuration is tied directly to a firewall policy. - Phase 1 and Phase 2 selectors are invoked by the policy itself. - Less flexible, **not recommended** for modern deployments. **Configuration Steps:** - Define Phase 1 and Phase 2 as non-interface based. - Create a policy with `action ipsec`. - Define source, destination, and services in the policy. **Use Case:** - Simple point-to-point connections with fixed policies and no dynamic routing. #### **Comparison Table:** | Feature | Route-Based VPN | Policy-Based VPN | | --- | --- | --- | | Interface Created | Yes (e.g., vpn-to-siteA) | No | | Routing Method | Static/dynamic routes | Policy-defined | | Flexibility | High | Low | | Modern Best Practice | Yes | No | | Fortinet Exam Coverage | Frequently tested | Frequently tested | ### **2. IPsec VPN Diagnostics – CLI Troubleshooting Commands** #### **View Phase 1 Tunnel Status:** ```bash diagnose vpn ike gateway list ``` - Displays tunnel name, status, remote IP, and current phase 1 status. #### **View Phase 2 Security Associations:** ```bash get vpn ipsec tunnel details ``` - Shows encryption details, selectors, byte counters, and tunnel uptime. #### **Debug IKE Negotiation:** ```bash diagnose debug application ike -1 diagnose debug enable ``` - Enables verbose output for Phase 1 and Phase 2 negotiations. - Use with caution in production—can generate large outputs. #### **Stop Debugging:** ```bash diagnose debug reset ``` #### **Exam Tip:** You may encounter a question like: “You configured a VPN tunnel, but traffic is not passing. Which command helps verify Phase 2 selectors?” Correct answer: `get vpn ipsec tunnel details` ### **3. SSL VPN Split Tunneling** #### **What Is Split Tunneling?** Split tunneling allows **only specified traffic** (e.g., internal subnet `10.0.0.0/24`) to go through the SSL VPN tunnel, while all other traffic (e.g., general internet access) stays local. #### **Why Use It?** - Reduces load on the FortiGate VPN gateway. - Improves internet performance for remote users. - Enhances security by limiting VPN access scope. #### **How to Enable:** ```bash config vpn ssl web portal edit "tunnel-access" set tunnel-mode enable set split-tunneling enable set ip-pools "SSLVPN_TUNNEL_ADDR1" set split-tunneling-routing-address "LAN-SUBNET" next end ``` - Ensure that your firewall policy **only allows** specific subnets for split tunneling. ### **4. SSL VPN Security Best Practices** To secure remote access via SSL VPN, Fortinet recommends several **hardening techniques**, which are also commonly tested in the exam. #### **1. Enforce Two-Factor Authentication (2FA):** - Add a second authentication factor (e.g., FortiToken or external RADIUS with OTP). - Applied via user group settings. #### **2. Block Access to Local Subnets (Prevent VPN Pivoting):** - Prevent connected SSL VPN users from accessing their local subnet. - Achieved by modifying the split tunneling settings or using deny policies. #### **3. Limit Access to Internal Resources:** - Use **address groups** or **firewall policies** to restrict SSL VPN users to only the necessary services or subnets. #### **4. Use Secure TLS Settings:** - Disable legacy TLS versions (TLS 1.0 / 1.1). - Use strong ciphers only. #### **5. Regularly Rotate Certificates and Keys:** - Avoid long-term self-signed certificates. - Ensure VPN servers use up-to-date, trusted certificates. ### **Summary Table:** | Topic | Key Point | | --- | --- | | Route-based vs Policy-based VPN | Route-based preferred; policy-based is legacy but still exam-tested | | IPsec VPN Diagnostics | Use CLI to verify Phase 1/2 status and troubleshoot negotiation issues | | SSL VPN Split Tunneling | Allows partial traffic to go through VPN while keeping local access open | | SSL VPN Security Best Practices | 2FA, access restriction, local subnet block, TLS hardening | ---

Shopping cart

Subtotal:

Examination Introduction

Learning Method

Study Plan

Exam Center