NSE7_EFW-7.2 System configuration

System Configuration Detailed Explanation

System Configuration is the backbone of FortiGate firewalls. It is where everything begins—from setting up the device, configuring the network, and ensuring system reliability.

1.1 Device Initialization

This phase involves setting up the FortiGate device for the first time, including configuring interfaces, services, and basic management access.

1.1.1 Interface Configuration

• What is an interface? An interface is like a network port on your FortiGate device. Think of it as a door connecting the FortiGate to different parts of your network or the internet.

• Assigning IP addresses: Each interface must have an IP address and subnet mask. These help the FortiGate know where it is in the network.

  • Example: Assign the IP address 192.168.1.1/24 to an interface called port1.

    config system interface
        edit "port1"
            set ip 192.168.1.1/24
            set allowaccess https ssh
        next
    end
    

  • The allowaccess command enables specific management protocols like:

    • HTTPS: For web-based management.
    • SSH: For command-line management.
    • SNMP: For monitoring with network tools.

• VLAN Configuration: VLANs (Virtual Local Area Networks) allow you to separate traffic into logical groups even if they share the same physical interface.

  • Example: Create a VLAN interface with ID 10 under port2:

    config system interface
        edit "VLAN10"
            set ip 10.10.10.1/24
            set interface "port2"
            set vlanid 10
        next
    end
    

• Management Interface: The management interface is where you access and configure your FortiGate.

  • Bind a specific interface (e.g., port1) to be used exclusively for management tasks.

1.1.2 System Services

• DNS Configuration: DNS (Domain Name System) translates domain names (e.g., google.com) into IP addresses.

  • Configure DNS servers for FortiGate to resolve domain names:

    config system dns
        set primary 8.8.8.8
        set secondary 8.8.4.4
    end
    

• NTP Configuration: NTP (Network Time Protocol) ensures your FortiGate’s clock is accurate. This is vital for VPNs, logs, and troubleshooting.

  • Example configuration:

    config system ntp
        set server "pool.ntp.org"
        set sync-interval 60
    end
    

• Hostname and Admin Setup: A hostname makes it easier to identify the FortiGate device in large networks. You can also set up administrator accounts:

  • Set the hostname:

    config system global
        set hostname "FortiGate-1"
    end
    

  • Add an admin account:

    config system admin
        edit "new-admin"
            set password "securepassword"
        next
    end
    

1.1.3 CLI Basics

• Why use the CLI? The Command-Line Interface (CLI) provides faster and more advanced configurations than the graphical user interface (GUI).

• Basic Commands:

  • show system interface: Displays all interface configurations.
  • execute ping <IP>: Tests connectivity to an IP address.
  • execute traceroute <IP>: Shows the path traffic takes to reach an IP.

1.2 High Availability (HA) Configuration

HA ensures that your network remains operational even if one FortiGate device fails.

1.2.1 HA Modes

• Active-Passive Mode: One device is active (handling all traffic), and the other is in standby (ready to take over if needed).

• Active-Active Mode: Both devices share the traffic load. This is useful in high-performance networks.

• FGCP (FortiGate Cluster Protocol): This protocol keeps the devices in sync, ensuring configurations, sessions, and data are mirrored.

1.2.2 Heartbeat Detection and Session Synchronization

• Heartbeat Detection: FortiGate devices use dedicated HA interfaces to send heartbeat signals, ensuring cluster health.

  • Configure HA heartbeat interfaces:

    config system ha
        set group-name "HA-Cluster"
        set mode a-p
        set password "ha_password"
        set hbdev "port3" 50
        set priority 200
    end
    

• Session Synchronization: Keeps active connections alive during a failover. For example, if a user is downloading a file, the connection won’t drop when the primary device fails.

1.2.3 HA Troubleshooting

• Check HA Status: Use the following command to view HA cluster status:

  diagnose sys ha status
  

• Priority and Failover: Devices with a higher priority value take over as the primary. Adjusting priority ensures the correct device becomes the leader.

1.3 Performance Optimization

FortiGate is designed for high performance. Hardware acceleration and diagnostic tools help optimize system efficiency.

1.3.1 Hardware Acceleration

• NP (Network Processor): Handles tasks like packet forwarding and VPN encryption, improving firewall performance.

• CP (Content Processor): Optimizes UTM (Unified Threat Management) functions like IPS and antivirus scanning.

• Checking Acceleration: Use the following command to view hardware acceleration:

  diagnose npu np6 status
  

1.3.2 Diagnostic Tools

• Monitor CPU and Memory: The diagnose sys top command helps identify resource-heavy processes.

  • Example:

    diagnose sys top
    

• Trace Traffic Flow: The diag debug flow command is used to trace how packets are handled.

  • Example:

    diag debug enable
    diag debug flow filter addr 192.168.1.100
    diag debug flow show console enable
    

Summary

By mastering these System Configuration fundamentals, you’ll establish a strong foundation in FortiGate operations. As a beginner, start with GUI management for hands-on familiarity, then gradually explore the CLI for advanced configurations.

System Configuration (Additional Content)

1. Virtual Domains (VDOMs)

What Are VDOMs?

VDOMs (Virtual Domains) are a feature of FortiGate that allows a single physical device to operate as multiple, logically separated firewalls. Each VDOM can have its own routing table, firewall policies, interfaces, administrators, and resources.

Use Cases:

• Managed service providers (MSPs) who provide firewall services to multiple customers.
• Large enterprises that want to separate different departments or business units.
• Segregating traffic in a multi-tenant environment or hybrid cloud infrastructure.

VDOM Types:

• Root VDOM: The default VDOM where system-level settings reside.
• Additional VDOMs: Created by the administrator to segment traffic and control policies independently.

Enabling Multi-VDOM Mode:

VDOMs must be explicitly enabled from the global configuration context.

config global
config system global
    set vdom-mode multi-vdom
end

After this, you can create and manage individual VDOMs:

config vdom
    edit "VDOM1"
    next
    edit "VDOM2"
    next
end

Once VDOMs are enabled, you can switch between them using:

config vdom
edit <vdom-name>

Each VDOM can have its own set of firewall rules, routing configuration, and user authentication settings.

2. Configuration Backup and Restore

Why It Matters:

Backing up and restoring configurations is essential for disaster recovery, auditing, migration, and rapid deployment. FortiGate allows you to back up configurations via CLI or GUI, with optional encryption for security.

Backing Up Configuration to Local Storage:

execute backup config flash <filename>

This command saves the current configuration to the device's local flash memory. You can also specify FTP, TFTP, SCP, or USB as the backup location.

Example - Backup to FTP:

execute backup config ftp <filename> <server_ip> <username> <password>

Best Practices:

• Always encrypt backup files when storing on external or cloud systems.
• Store backups securely with restricted access.
• Maintain version history for configuration change tracking.

Restoring a Backup:

execute restore config flash <filename>

Restoring will immediately overwrite the current configuration, and the system will reboot unless otherwise specified.

3. System Events and Logging

Purpose:

Logging is critical for monitoring system health, security events, resource usage, HA status, and for forensic analysis in the case of incidents. FortiGate provides both local and remote logging options.

Viewing Logs Locally:

execute log display

This command displays logs in the CLI. It can be filtered for system, event, or specific categories like authentication or HA events.

Forwarding Logs to a Syslog Server:

To ensure centralized log management and compliance, FortiGate can be configured to send logs to an external syslog server.

config log syslogd setting
    set status enable
    set server "192.168.10.100"
    set port 514
    set facility local7
    set format default
end

Additional Parameters:

• reliable: Enables TCP-based log transmission.
• enc-algorithm: Sets encryption for syslog data.
• source-ip: Specifies the source IP used for sending logs.

Use Cases:

• Integrate with SIEM tools (e.g., Splunk, QRadar).
• Centralize logs for HA clusters.
• Track system-level events such as interface failures, admin login attempts, or firmware changes.

Summary:

These three topics add important operational depth to the System Configuration knowledge domain:

Feature	Purpose	Exam Relevance
VDOMs	Segment traffic and configurations per tenant/department	High (common in enterprise deployments)
Backup & Restore	Prevent configuration loss; enable rollback and migration	Medium-High (disaster recovery tasks)
System Logging	Event tracking, compliance, troubleshooting	High (especially with HA, syslog, etc.)