Fortigate Setup

on

 

Entry-level models port1 is LAN, mid-range and high end models has MGMT interface,  with default IP 192.168.1.99

User: admin
Password:  blank

super_admin
Prof_admin   (vdom admin)


super-admin provides full access to the device globally.
prof_admin provides full access to a VDOM but not globally.


Fortiguard
1. Package updates: antivirus and IPS    (update.fortiguard.net)
2. Live queries: Web filter, DNS filter,  antispam 
    service.fortiguard.net   -- Proprietary protocol on UDP 53 or 8888
    securewf.fortiguard.net   -- HTTPS over 443, 53, or 8888


FortiGate-VM virtual appliance evaluation license

Version 7.2.0 and lower
The FortiGate-VM virtual appliance includes a limited 15-day evaluation license that supports:

Above version 7.2.0  
One permanent trial license per FortiCare account.

     Remove the trial VM from cloud:
     Login Forticloud > Services > Asset Management, decommission the unit. Once this VM is decommissioned, a new VM can be added with evaluation license.


    

  • Support for low encryption operation only
  • Maximum of 1 CPU and 2GiB of memory
  • Maximum of three interfaces, firewall policies, and routes each
  • No FortiCare Support

diag debug vm-print-license


After license expired:   exe factoryreset  or exe factoryreset2 (keep vdom, interface and route settings)


    1 CPU maximum
    1024 MB memory maximum
    Low encryption only (no HTTPS administrative access, 7.2 has HTTPS access )

    All features except FortiGuard updates



System is starting...
Formatting shared data partition ... done!
Starting system maintenance...
Serial number is FGVMEVX455AXV9CD

FortiGate-VM64-KVM login: admin
Password:
You are forced to change your password. Please input a new password.
New Password:
Confirm Password:
Welcome!

FortiGate-VM64-KVM # config system interface
FortiGate-VM64-KVM (interface) # edit port1
FortiGate-VM64-KVM (port1) # set mode static
FortiGate-VM64-KVM (port1) # set ip 192.168.2.101/24
FortiGate-VM64-KVM (port1) # set allowaccess http    --- (optional)
FortiGate-VM64-KVM (port1) # end
FortiGate-VM64-KVM #
FortiGate-VM64-KVM # config router static
FortiGate-VM64-KVM (static) # edit 1
new entry '1' added


FortiGate-VM64-KVM (1) # set dst 0.0.0.0/0
FortiGate-VM64-KVM (1) # set gateway 192.168.2.1
FortiGate-VM64-KVM (1) # set device port1
FortiGate-VM64-KVM (1) # end


FortiGate-VM64-KVM # execute ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=14016 ttl=117 time=12.3 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=11.3 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 11.3/11.8/12.3 ms

FortiGate-VM64-KVM # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default


Routing table for VRF=0

C       192.168.2.0/24 is directly connected, port1



























FortiGate-VM64-KVM # execute shutdown


Configure Time Zone and specify NTP server











Set DNS server:









NGFW mode and Central SNAT:
Profile-based:  Central SNAT is disabled by default, SNAT can be turned on in Firewall Policy.    
Policy-based: (Central NAT is always enabled)


Security Profile
1. Created base AntiVirus (cloned from default)
2. Created base Web Filter (cloned from default)
    if no active license, enable the following option:
    Allow websites when a rating error occurs
3. Create base Application Control  (cloned from default)
4. Create base DNS Filter  (cloned from default)
     if no active license, enable the following option:
    Allow DNS requests when a rating error occurs













============Fortigate 60==========




















































Entry Level models port1 is LAN,  has default IP 192.168.1.99

connect http://192.168.1.99 for initial setup, configure WAN, default route, outbound security policy.

support.fortinet.com to register device

Out of box, all LAN ports are in VLAN switch  internal:









To disable Telnet.
# config system global
    set admin-telnet disable
end

 

Comments

Post a Comment