FortiGateLab Setup Guide for FortiGate 5.4.1 FortiGate Lab Setup Guide for FortiGate 5.4.1 Last Updated: 27 October 2016 ® ® ® Fortinet , FortiGate , and FortiGuard are registered trademarks of Fortinet, Inc. in the U.S. and other jurisdictions, and other Fortinet names herein may also be trademarks, registered or otherwise, of Fortinet. All other product or company names may be trademarks of their respective owners. Copyright © 2002 - 2016 Fortinet, Inc. All rights reserved. Contents and terms are subject to change by Fortinet without prior notice. No part of this publication may be reproduced in any form or by any means or used to make any derivative such as translation, transformation, or adaptation without permission from Fortinet, Inc., as stipulated by the United States Copyright Act of 1976. Table of Contents INTRODUCTION .............................................................................................4 MATERIALS ..................................................................................................5 System Requirements.............................................................................................................6 Network Topology ...................................................................................................................6 LOADING THE VMS .......................................................................................8 CONFIGURING VMWARE VIRTUAL NETWORKING............................................10 CONFIGURING THE VMS ...............................................................................13 Linux ........................................................................................................................................13 Local-FortiGate .......................................................................................................................19 Local-Windows ........................................................................................................................21 FortiManager ...........................................................................................................................31 FortiAnalyzer ...........................................................................................................................33 Restoring the Local-FortiGate License and Initial Configuration ............................................33 Remote-FortiGate ...................................................................................................................33 Remote-Windows ....................................................................................................................34 TESTING ......................................................................................................36 CREATING SNAPSHOTS .................................................................................37 APPENDIX A: ADDITIONAL RESOURCES........................................................38 Introduction Introduction This guide explains how to configure the lab for the following Fortinet training courses: FortiGate I 5.4.1 (NSE4 preparation) FortiGate II 5.4.1 (NSE4 preparation) In this environment, the FortiManager is acting as a local FortiGuard server. It validates the FortiGate licenses and replies to FortiGuard Web Filtering rating requests from FortiGate VMs. The FortiManager is configured in closed network mode, providing FortiGuard services to local FortiGate VMs, without requiring Internet access. To administer this lab as designed, you will: 1. Load, configure, and test the VM images required for this lab. 2. Save a VMware snapshot of the VM images. 3. Each time there is a class, deploy a copy of all VMs for each student. FortiGate Lab Setup Guide 4 Materials Materials To build the virtual lab required for this class, you must purchase or download: 1 VMware workstation installation per student For hardware system requirements, see System Requirements. 2 FortiGate VM licenses 1 FortiAnalyzer VM license (registered with the IP address 10.0.1.210) 1 FortiManager VM license (registered with the IP address 10.0.1.241) 4 FortiCare contracts (one for each VM) 1 FortiGuard Web Filtering and IPS contract, bound to the first FortiGate VM Note: One of the FortiGate VMs requires a valid FortiGuard Web Filtering and IPS contract. This license will be installed on the Local-FortiGate. The other VMs do not require a FortiGuard service contract. 2 Windows Server 2012 VM 1 Linux VM image (prebuilt image is provided by Fortinet Training) VM firmware image files (provided by Fortinet Training, or Fortinet Technical Support's web site): o FortiGate 5.4.1 o FortiAnalyzer 5.4.0 o FortiManager 5.4.0 1 Resources folder (prebuilt files are provided by Fortinet Training): o Initial configuration files for each lab o Solution configuration files for each lab o Additional files required for the labs Software to install on the Windows VM: o Mozilla Firefox 46.0.1 (https://www.mozilla.org/en-US/firefox/new/) o Mozilla Thunderbird 45.1.0 (https://www.mozilla.org/en-US/thunderbird/) o PuTTY 0.67 (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html) o ActivePerl 5.22.1.2201 (http://www.activestate.com/activeperl/downloads) o Perl script for converting FortiGate sniffer output to Wireshark PCAP (packet capture) format. File name: fgt2eth.pl (http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=1 1186) o Windows Server 2012 patch KB9089134 (installation file provided inside the Lab Setup Guide ZIP package) o Wireshark 2.0.3 (https://www.wireshark.org/download.html) FortiGate Lab Setup Guide 5 Materials o nikto 2.1.5 (http://www.cirt.net/nikto2) o Notepad++ 6.9.1 (https://notepad-plus-plus.org/download/v6.9.html) o FileZilla Client 3.17.0.1 (https://filezilla-project.org/download.php) o Adobe Reader (https://get.adobe.com/reader/) o Adobe Flash Player 17.0.0 (http://get.adobe.com/flashplayer/) o FortiClient 5.4.0 build 0780 (https://support.fortinet.com). o Java 8 update 91 o GNU Wget 1.11.4 (http://gnuwin32.sourceforge.net/packages/wget.htm) Some of these files are provided in the Lab Setup Guide ZIP package. System Requirements Each workstation running VMware Workstation requires: 1 Ethernet interface 8 GB RAM 300 GB storage (hard disk, SAN, etc.) Network Topology FortiGate Lab Setup Guide 6 Materials port2 10.200.1.241 FortiManager FortiAnalyzer LOCAL-WINDOWS port1 port1 10.0.1.10 10.0.1.241 10.0.1.210 10.0.1.254/24 port3 port3 10.200.1.210 LOCAL-FORTIGATE port2 port1 10.200.2.1/24 10.200.1.1/24 LINUX 10.200.2.254 10.200.1.254 eth2 eth1 eth0 eth4 eth3 10.200.4.254 10.200.3.254 REMOTE-FORTIGATE 10.200.4.1/24 10.200.3.1/24 port5 port4 REMOTE-WINDOWS 10.0.2.10 port6 10.0.2.254/24 FortiGate Lab Setup Guide 7 Loading the VMs Loading the VMs The Lab Setup Guide ZIP package provides a prebuilt image of the Linux VM, which does not require additional configuration; you only need to load it and deploy it. This guide provides the steps for building the Linux image from scratch, in case you do not want to use the prebuilt image. For the other VMs (Windows, FortiGates, and so on), you must load, configure, and save the OVF files before you deploy them. Use standard VMware steps for the installation media, an ISO file, or Fortinet OVF file. Create Windows VMs To create a Windows VMs on VMware Workstation 11: 1. Go to File > New Virtual Machine. 2. Click Custom, then click Next 3. Select Workstation 11 hardware compatibility. 4. Click Next, then select Installer disk image file (ISO). 5. Click Next, then specify the VM name. 6. Accept all other default settings. 7. Click Finish to build the VM. Name the VM according to the diagram (Local-Windows and Remote-Windows). Create FortiGate, FortiManager, and FortiAnalyzer VMs To create FortiGate, FortiManager, and FortiAnalyzer VMs on VMware Workstation 11: 1. Go to File > Open. 2. Select the Open Virtualization Format file format. 3. Select the file name, such as FortiGate-VM.ovf. Name the VM according to the diagram (Local-FortiGate, Remote-FortiGate, FortiAnalyzer, FortiManager). Install the prebuilt Linux image To install the prebuilt Linux image on VMware Workstation 11: 4. Go to File > Open. 5. Select the Open Virtualization Format file format. 6. Select prebuild image: Linux.ovf. Name the VM Linux. FortiGate Lab Setup Guide 8 Loading the VMs FortiGate Lab Setup Guide 9 Configuring VMware Virtual Networking Configuring VMware Virtual Networking Once you've loaded the VMs, you must configure their virtual network adapters to make the lab's required virtual network topology. Inside each student’s virtual lab, there are seven VMs. The topology supports both HA and non-HA topology, which the students will switch between during the labs by reconfiguring their VMs; no VMware reconfiguration is required. The key to this flexible networking is the six LAN segments used in the current setup, plus the predefined interfaces: vmnet0 and vmnet1. vmnet0 bridges the physical NIC which provides the default route to the Internet. vmnet1 is a host-only private network shared between the host and the guest systems. By mapping the guest VMs’ virtual NICs to virtual LAN segments, you create the topology. Configure VMWare Virtual Networking 1. Create one additional virtual NIC on each of your Windows VMs: Local-Windows: Add 1 more NIC (2 NICs total). Remote-Windows: Add 1 more NIC (2 NICs total). 2. Ensure that the prebuilt Linux VM has five NICs. If not, add the as many as needed to have five. 3. Create the LAN segments: Right-click the Local-Windows VM and select Settings. Select any of the two Network Adapters. Click LAN Segments. Click Add as many times as needed to create the six LAN segments: FortiGate Lab Setup Guide 10 Configuring VMware Virtual Networking Click OK twice to close the windows. 4. Map the LAN segments to each vNIC: For Local-Windows, edit the first network adapter, choose LAN Segment 3, then click OK. This maps this interface to that LAN segment. Also edit the second network adapter and map this to the default host-only network (VMnet1.) For the Remote-Windows, map the first network adapter to LAN Segment 6, and the second to VMnet1. For both FortiGates (Local-FortiGate and Remote-FortiGate) map the first seven network adapters in the following way: Network Adapter LAN Segment 1 1 2 2 3 3 4 4 5 5 6 6 7 3 For FortiManager VM, map these network adapters: Network Adapter LAN Segment 1 3 FortiGate Lab Setup Guide 11 Configuring VMware Virtual Networking 2 1 For FortiAnalyzer, map these network adapters: Network Adapter LAN Segment 2 3 4 1 This actually maps FortiAnalyzer port1 to LAN3, as VMWare port2 corresponds to FortiAnalyzer port1. It also maps port3 to LAN1, as VMWare port4 corresponds to FortiAnalyzer port3. For the Linux VM, map these network adapter: Network Adapter LAN Segment 1 VMnet0 2 1 3 2 4 4 5 5 FortiGate Lab Setup Guide 12 Configuring the VMs Configuring the VMs Before you deploy the VMs, you must first install the required software and files on your Windows VM. You must also configure some initial settings on your Fortinet VMs so that they have network connectivity, and load their VM license. Note: The prebuilt VM is already configured. However, if you need to modify or understand the configuration of the prebuilt VM, this section provides the necessary details. The root password for the prebuilt VM is: password. Linux Configure networking 1. From the network configuration tools, configure the interface IP addressing. eth0 = LAN0 = Management network eth1 = LAN1 = 10.200.1.254/24 eth2 = LAN2 = 10.200.2.254/24 eth3 = LAN4 = 10.200.3.254/24 eth4 = LAN5 = 10.200.4.254/24 2. Activate the network adaptors. 3. Enable routing and add iptables NAT policy: vi /etc/sysctl.conf and set net.ipv4.ip_forward = 1 4. Enter the following command to reload the sysctl configuration: sysctl -p /etc/sysctl.conf 5. Clear the existing iptables rules: iptables –F iptables –t nat –F 6. Add a single NAT rule to NAT all outing packets with the address obtained by DHCP on eth0: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 7. Check that the NAT rule is there: iptables –t nat –L service iptables save FortiGate Lab Setup Guide 13 Configuring the VMs (or # /sbin/service iptables save.) 8. In order to be able to clone the image, edit the following files: /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth1 /etc/sysconfig/network-scripts/ifcfg-eth2 /etc/sysconfig/network-scripts/ifcfg-eth3 /etc/sysconfig/network-scripts/ifcfg-eth4 In each of these files, find a line that says HWADDR=mac-address-here and delete the whole HWADDR line. Install HTTP and FTP services 1. Enter the following commands: yum install httpd chkconfig --levels 345 httpd on yum install vsftpd chkconfig --levels 345 vsftpd on touch /var/ftp/pub/test.text Configure FTP service 1. Disable security-enhanced Linux (SELinux): setenforce 0 2. Edit the file: /etc/selinux/config and change the SELINUX setting to disabled: SELINUX=disabled 3. Create two VSFTPd configuration files based on the default one: cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd-222.conf cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd-21.conf FortiGate Lab Setup Guide 14 Configuring the VMs 4. Delete the default configuration file: rm /etc/vsftpd/vsftpd.conf 5. Edit the configuration file vsftpd-222.conf and add the following lines at the end of the file: port_enable=YES port_promiscuous=YES pasv_enable=NO listen_port=222 listen_address=10.200.3.254 6. Edit the configuration file vsftpd-21.conf and add the following line at the end of the file: listen_address=10.200.1.254 7. Restart the FTP server: /sbin/service vsftpd restart Configure Syslog 1. The syslog package should already be installed. Enable remote logging on the service: vi /etc/sysconfig/syslog and add ‘-r’ to the SYSLOG OPTIONS 2. Add the following line to the syslog.conf: local6.* /var/log/fortinet 3. Restart syslog: /sbin/service syslog restart 4. Check the service is listening: netstat –anp | grep 514 5. Configure SNMP-Utils: yum install net-snmp-utils Configuring email 1. Enter the following commands: yum install dovecot postfix yum remove sendmail 2. Edit /etc/dovecot.conf to have the line: FortiGate Lab Setup Guide 15 Configuring the VMs protocols = imap imaps pop3 pop3s 3. Make that change operational for the current session by running the command: /sbin/service dovecot restart 4. Make that change operational after the next reboot by running the command: chkconfig dovecot on 5. Edit the /etc/postfix/main.cf file using vi. Uncomment : mydomain = domain.tld and replace domain.tld with the domain training.lab: mydomain = training.lab Uncomment: myorigin = $mydomain Uncomment: myhostname = host.domain.tld replace host.domain.tld with the hostname linux.training.lab: myhostname = linux.training.lab Uncomment : mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain Comment (add a # at the beginning): # mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain Uncomment: mynetworks = 168.100.189.0/28 replace 168.100.189.0/28 with 10.0.0.0/8, 127.0.0.0/8 mynetworks = 10.0.0.0/8, 127.0.0.0/8 Uncomment: inet_interfaces = all Comment: inet_interfaces = localhost line. 6. Restart the postfix service: /sbin/service postfix restart FortiGate Lab Setup Guide 16 Configuring the VMs Configuring OpenSSL 1. From the /root directory: mkdir ssl cd ssl mkdir certs mkdir newcerts mkdir requests mkdir keys touch index.txt touch serial echo ‘01’ > serial cp /etc/pki/tls/openssl.cnf 2. Edit file /root/ssl/openssl.cnf and set: dir = /root/ssl, search for the [ v3_ca ] section and uncomment: keyUsage = cRLSign, keyCertSign Configure accounts 1. Open a terminal and type: system-config-users 2. In the User Manager dialog box, click Add User and add the following accounts: User Password admin fortinet1 student fortinet1 FortiGate fortinet1 Download the EICAR file 1. From the Linux GUI open Mozilla Firefox browser. 2. Navigate to http://eicar.org. FortiGate Lab Setup Guide 17 Configuring the VMs 3. Download the eicar.com antivirus test file. 4. Store the file in /var/ftp/pub. Configure a webpage to upload files 1. Go to /var/www/html. 2. Right click and click Create Document > Empty File. 3. Name it result.html. 4. Right click and select Open with "Text Editor". 5. Copy and paste the html syntax as below: <html> <head> <title> Result from upload </title> </head> <body> File Upload Processed! </body> </html> 6. Click Save. 7. Click Close. 8. Still in /var/www/html, right-click and selec Create Document > Empty File. 9. Name it fileupload.html. 10. Right click and click Open with "Text Editor". 11. Copy and paste the html syntax as below: <html> <head> <title> Test for file upload DLP Lab </title> </head> <body> <font face='Comic Sans MS'> <h1> DLP Upload Test Page</h1> FortiGate Lab Setup Guide 18 Configuring the VMs <h2>In order to test the DLP Sensor either upload a file or type in the text to be blocked into the text area and press submit, if the post would have been successful you will see a upload processed page</h2><br> <h4>File Upload</h4> <form action='result.html' method='post' enctype='multipart/form-data'> <input type='file' name='TestFile'/><br> <input type='submit' value='Submit the file'><br> </form> <h4>Text Input</h4> <form action='result.html' method='post' enctype='multipart/form-data'> <input type='textarea' name='TestArea'/><br> <input type='submit' value='Submit the TextArea'><br> </form> </font> </body> </html> 12. Click Save. 13. Click Close. Local-FortiGate 1. Start the Local-FortiGate VM and open the VM console. 2. Enter: exec formatlogdisk This formats the virtual disk, which is required to store data such as local reports or logs. The device will reboot after the format is complete. 3. Enter this configuration to configure the network interfaces: config system interface edit port1 FortiGate Lab Setup Guide 19 Configuring the VMs set ip 10.200.1.1 255.255.255.0 set allowaccess http next edit port3 set ip 10.0.1.254 255.255.255.0 set allowaccess http next end config router static edit 1 set gateway 10.200.1.254 set device port1 next end config firewall policy edit 1 set srcintf port3 set dstintf port1 set srcaddr all set dstaddr all set action accept set schedule always set service ALL set nat enable next end FortiGate Lab Setup Guide 20 Configuring the VMs Local-Windows The Local-Windows VM is used as the student's network management computer in the lab. Students will initiate most client network connections from it, and administer Fortinet VMs. Perform Initial Setup 1. On this VM, verify that the correct local time and time zone is set, and that the screen has a resolution of at least 1280x1024. (This ensures proper display of the FortiOS GUI.) 2. Change the administrator account password to password. (Disable password complexity check if required.) 3. Configure the IPv4 network settings for LAN3: IP address: 10.0.1.10 Netmask: 255.255.255.0 Default gateway: 10.0.1.254 DNS: 10.0.1.254 4. Configure the IPv6 network settings for LAN3: Obtain an IPv6 address automatically Obtain DNS server address automatically 5. Install the following software: Firefox PuTTY ActivePerl Nikto Thunderbird FileZilla Wireshark Adobe Reader Adobe Flash Notepad++ Java 6. VMnet1 is your guest access network. When editing this network adapter, choose a unique address. Do not configure a gateway. 7. Open Windows Firewall and disable Windows Firewall in all the network types. Install AD, Web, and DNS Services 1. Open Server Manager and select Add roles and features. 2. Click Next. 3. Select Role-based or feature-based installation. 4. Click Next. 5. Select the server with the IP address 10.0.1.10. 6. Click Next. FortiGate Lab Setup Guide 21 Configuring the VMs 7. On the Server Roles screen, select Active Directory Domain Services, DNS Server, and Web Server (ISS). Add all the features for those three roles. 8. Click Next. 9. Click Next until you get the Confirmation screen. 10. Click Install. Wait until the installation finishes. 11. From the Server Manager, click the flag icon with the exclamation point and select Promote this server to a domain controller: 12. Select Add a new forest. 13. Type trainingAD.training.lab as the domain name. 14. Click Next. 15. Type any DSRM password and click Next. 16. Omit the DNS warning and click Next. 17. Accept all the remaining default values and click Next until you get the Prerequisites Check screen. 18. Click Install. Wait until the installation finishes. Create the Student User 1. Open Active Directory Users and Computer. 2. Expand the trainingAD.training.lab tree. 3. Right click the Users container. Select to New > User. 4. Create the user student for the class, with password password. Disable User must change password at next logon and enable Password never expires. Create the ADadmin User 1. Open Active Directory Users and Computer. 2. Expand the trainingAD.training.lab tree. 3. Right click the Users container. Select to New > User. 4. Create user ADadmin for the class, with password Training!. Disable User must change FortiGate Lab Setup Guide 22 Configuring the VMs password at next logon and enable Password never expires. Create the Training Organizational Unit and Additional Users 1. Open Active Directory Users and Computer. 2. Right-click trainingAD.training.lab from the tree. 3. Select New > Organizational Unit. 4. Name the organizational unit Training. 5. Right-click Training from the tree and select New > User. 6. Create the following user: 7. Type Training! as the password. Disable User must change password at next logon and enable Password never expires. 8. Repeat the process to create another user in the Training organizational unit, but this time call the user aduser2. Use the same password (Training!). Create an Active Directory group 1. Open Active Directory Users and Computer. 2. Expand the trainingAD.training.lab tree and right click the Training container. 3. Select New > Group. 4. Create a new security group called AD-users. 5. Click OK. FortiGate Lab Setup Guide 23 Configuring the VMs 6. Double-click the AD-user group from the right pane. 7. Select the Members tab and add aduser1 and aduser2. 8. Click OK. Install Remote Desktop Services 1. Open the Server Manager. 2. Select Add roles and features. 3. Select Role-based or feature-based installation. 4. Select the server 10.0.1.10. 5. Select Remote Desktop Services. Click Next three times. 6. For the Role Service, select Remote Desktop Session Host. Click Next. FortiGate Lab Setup Guide 24 Configuring the VMs 7. Confirm the installation and reboot the VM after the installation finishes. Enable Remote Desktop Access to the Student User 1. Open Active Directory Users and Computer. 2. Go to Active Directory Users and Computers > trainingAD.training.lab > Users. 3. Right-click the user student and select Add to a group. 4. Add the student user to the Remote Desktop Users group. 5. Go to the Start menu and right-click This PC. Select Properties. 6. Click Remote Settings. 7. Select Allow remote connections to this computer. 8. Clear the Allow connections only from computers running checkbox. 9. Click Apply. Configure Thunderbird 1. Open Mozilla Thunderbird and click the three bars icon in the upper right of the application. 2. Select Options > Account Settings. 3. Select Outgoing Server (SMTP) and click Add. Configure the following settings: Setting Value Server Name 10.200.1.254 Port 25 FortiGate Lab Setup Guide 25 Configuring the VMs Connection security None Authentication Method Password, transmitted insecurely Username student 4. Click OK. 5. From the bottom of the left menu of the Account Settings dialog, click Account Actions > Add Mail Account. 6. Add the following account: Your name admin Email address
[email protected] Password fortinet1 7. Click Continue. 8. Add the following incoming and outgoing server settings: 9. Click Done. Accept the certificate exception. 10. Select Account Actions > Add Mail Account again to create a second user. 11. Add the second account: Your name student Email address
[email protected] Password fortinet1 12. Click Continue. 13. Add the following incoming and outgoing server settings: 14. Click Done. Configure FileZilla 1. Open FileZilla. 2. Click on the upper left icon to open the site manager. FortiGate Lab Setup Guide 26 Configuring the VMs 3. Add this site and name it FTPsite: Host: 10.200.3.254 Port: 222 Protocol: FTP Encryption: Use plain FTP Logon type: Anonymous Before saving the site, click on the Transfer Settings tab and select Active as the transfer mode. 4. Add this second site and name it Linux: Host: 10.200.1.254 Port: Leave it empty Protocol: FTP Encryption: Use plain FTP Logon type: Anonymous Before saving the site, click on the Transfer Settings tab and select Default as the transfer mode. Configure SMB file share The Local-Window machine requires adding SMB file share. To create share folder 1. Open File Explorer. 2. Go to C drive. 3. Create new folder with name of DLPshare. To add the file share 1. Go to Server Manager > File and Storage Services. 2. Click Shares. 3. From the TASKS dropdown menu, New Share. A wizard opens. 4. Select SMB Share-Quick. 5. Click Next. 6. Select Type a custom path. FortiGate Lab Setup Guide 27 Configuring the VMs 7. Click Browse and select dlpshare folder. 8. Click Select Folder. 9. Click Next until you get to Permissions screen. On the Permissions screen, make sure BUILTIN\Administrators have full access. 10. Click Next. 11. Click Create. 12. Click Close on View Result screen. Disable HSTS in Firefox 1. Open Firefox. 2. Open the about:config page. 3. Right click New -> Integer, add an item named test.currentTimeOffsetSeconds and value 11491200, confirm. 4. Clear the cache. Disable certificate pinning 1. Open Firefox. 2. Open the about:config page. 3. Search security.cert_pinning.enforcement_level. 4. Edit and change value to 0. 5. Clear the cache. Create a Bookmark in PuTTY 1. Open PuTTY. 2. Complete the following: Host Name (or IP address field) 10.0.1.254. FortiGate Lab Setup Guide 28 Configuring the VMs Saved Sessions LOCAL-FORTIGATE 3. Click Save. 4. Repeat steps 2 and 3 for the following VMs: Host Name (or IP address field) 10.200.3.1 Saved Sessions REMOTE-FORTIGATE Host Name (or IP address field) 10.0.1.210. Saved Sessions FORTIANALYZER Host Name (or IP address field) 10.0.1.241 Saved Sessions FORTIMANAGER Host Name (or IP address field) 10.0.1.254 Saved Sessions LINUX Install the CA certificates in Firefox 1. From Local-Windows, open Firefox and connect HTTP to Local-FortiGate. 2. Go to System > Certificates. 3. Select the certificate Fortinet_CA_SSL and click Download. 4. Click Open menu in Firefox and select Options. FortiGate Lab Setup Guide 29 Configuring the VMs 5. Go to Advanced > Certificates and click View Certificates. 6. Select the Authorities tab 7. Click Import and select the Fortinet_CA_SSL certificate. 8. Enable the three options: Trust this CA to identify websites. Trust this CA to identify email users. Trust this CA to identify software developers. Click OK. Install Additional Files 1. After that, copy the Resources folder that comes with the Lab Setup ZIP file to the desktop. 2. Copy the Perl script to convert FortiGate sniffer capture to PCAP to the Active Perl bin folder: c:\Perl64\bin 3. Add shortcuts to the Windows task bar and desktop for the following applications: File Explorer, Firefox, PuTTY, command prompt, Notepad++, Windows Remote Desktop Connection, and FileZilla. 4. Add the following paths to the Path System variable: C:\Users\Administrator\Desktop\Resources\FortiGate-II\IPS\nikto- 2.1.5 C:\Program Files (x86)\GnuWin32\bin C:\Users\Administrator\Desktop\Resources\FortiGate-I\Logging FortiGate Lab Setup Guide 30 Configuring the VMs C:\Users\Administrator\Desktop\Resources\FortiGate-II\IPv6 5. Open Mozilla and add the following four bookmarks to the bookmarks toolbar: Local-FortiGate: http://10.0.1.254 Remote-FortiGate: http://10.200.3.1 FortiManager: https://10.0.1.241 FortiAnalyzer: https://10.0.1.210 FortiManager Even though FortiManager is not the focus of FortiAnalyzer and FortiGate courses, it is required for the lab setup due to the use of closed network mode. More information about the FortiManager closed network mode can be found in this document: http://docs.fortinet.com/uploaded/files/2153/LicensingIsolatedFortiGates.pdf Request closed network entitlement files After you have purchased VM licenses and registered them on https://support.fortinet.com, you must request closed network entitlement files. These files are required for manually uploading FortiGate license validation information to FortiManager in close network mode: 1. On the Fortinet Technical Support web site (https://support.fortinet.com/) create a ticket with Fortinet Technical Support by going to Assistance > Create Ticket > Customer Service > Submit Ticket. 2. Enter the Serial Number. Under Category, select CS Contact/License. 3. In the Comment field, ask for an entitlement file for your FortiGate VMs. Provide the serial number and license number. If you don't remember them, you can find them in Asset > Manage View Products > <Select product>. Example: Serial Number: FGVM010000024628 License Number: FGVM0035444 Note: Alternatively, as with registration, you can attach a spreadsheet that contains serial and license numbers if you want to ask for entitlement files for two or more FortiGate VMs at the same time. Fortinet Technical Support will provide one entitlement file that contains validation information for all of your FortiGate VMs. All FortiGate VMs must be registered with the same account;devices registered under different accounts cannot be combined into the same entitlement file. Within a day or two, you should receive an entitlement file from customer service. Configure initial settings 1. Start the FortiManager and open the VM console. From the console make the following changes: FortiGate Lab Setup Guide 31 Configuring the VMs config system interface edit port1 set ip 10.0.1.241 255.255.255.0 set allowaccess http https ssh ping telnet next end 2. Connect to the GUI from the Local-Windows VM and restore the FortiManager-initial.dat file from the folder Resources/FortiManager/. 3. Upload a valid FortiManager VM license. Configure FortiManager as a local FDN server 1. Log into the FortiManager GUI and click FortiGuard > Advanced Settings. 2. Clear the Disable Communication with FortiGuard Servers checkbox and click Apply. 3. Click on Enable AntiVirus and IPS Update Service 4. Click the Enable AntiVirus and IPS Update Service for FortiGate dropdown and select the checkbox under Download for OS 5.0. 5. Select the checkboxes for Enable Web Filter Service and Enable Email Filter Service. 6. Click Apply. 7. Wait until FortiManager has downloaded and synchronized all the service packages and updates. This could take several hours. 8. Under FortiGuard > Advanced Settings, check that the status of Enable AntiVirus and IPS Service, Enable Web Filter Service, and Enable Email Filter Service show synchronized. 9. Check the status of the downloads under FortiGuard > Query Server Management > Receive Status. 10. Check the status of downloads under FortiGuard > Package Management > Receive Status. 11. If the status under FortiGuard > Advanced Settings is stuck in the Connected state, and not changing to the Syncronized state, even after waiting a few hours, you can manually trigger the update: diagnose fmupdate fds-updatenow diagnose fmupdate fgd-updatenow 12. After the packages and updates are synchronized, click FortiGuard > Advanced Settings and check Disable Communication with FortiGuard Servers. 13. Click Apply. 14. Go to FortiGuard > Advanced Settings > Upload Options for FortiGate/FortiMail > Service License and upload both FortiGate entitlement files. 15. To verify the configuration, once you've configured other Fortinet VMs with an override to use FortiManager as their local FDN server, you can reboot them or use their CLI commands to FortiGate Lab Setup Guide 32 Configuring the VMs force them to send a new VM license validation request to FortiManager. If validation succeeds, the license status indicated on the dashboard should say Valid. FortiAnalyzer 1. Start FortiAnalyzer and open the VM console. From the console make the following changes: config system interface edit port1 set ip 10.0.1.210 255.255.255.0 set allowaccess http https ssh ping telnet next end 2. Connect to the GUI from the Local-Windows VM and restore the file from the folder Resources/FortiAnalyzer/FortiAnalyzer-initial.dat. 3. Upload the FortiAnalyzer VM license. Restoring the Local-FortiGate License and Initial Configuration 1. On the Local-Windows VM, open a web browser and connect to the FortiGate VM's GUI. 2. Upload the initial configuration file that's located in Resources/FortiGate-I/Introduction/local- initial.conf. 3. After that, upload the VM license. FortiGate should query FortiManager to validate its VM license and FortiGuard service contracts. Remote-FortiGate 1. Start the Remote-Windows FortiGate VM and open the VM console. 2. Enter exec formatlogdisk to format the virtual disk, which is required to store data such as local reports or logs. The device will reboot after the format is complete. 3. From the console, enter these commands: config system interface edit port4 set ip 10.200.3.1 255.255.255.0 set allowaccess ping https ssh http fgfm FortiGate Lab Setup Guide 33 Configuring the VMs next end config router static edit 1 set device port4 set gateway 10.200.3.254 next end 4. Connect to the GUI from the Local-Windows VM and upload the remote-initial.conf file from the folder Resources/FortiGate-I/Introduction. 5. Upload the VM license for this unit. FortiGate should validate the license against FortiManager. None of the FortiGuard services are required in this FortiGate. Remote-Windows Configure Initial Settings 1. On this VM, verify that the correct local time and time zone is set, and that the screen has a resolution of at least 1280x1024 (this ensures proper display of the FortiOS GUI). 2. Configure the network settings for LAN6: IP address: 10.0.2.10 Netmask: 255.255.255.0 Default gateway: 10.0.2.254 DNS: 10.0.2.254 3. VMnet1 is your guest access network. When editing this network adapter, chose a unique address and do not configure a gateway on this adapter. 4. Open Windows Firewall and disable Windows Firewall in all the network types. Install Microsoft patch for SSL VPN For SSL VPN tunnel mode to work properly, It is required the installation of a Microsoft hotfix that solves a Microsoft problem with the FortiSSL adapter. Follow these steps: 1. Execute this command from the Remote-Windows command prompt: bcdedit -set testsigning on 2. After that, install the hotfix file named: FortiGate Lab Setup Guide 34 Configuring the VMs Windows8.1-KB9089134-x64.exe This file can be found compressed in the Lab Setup ZIP file. If you get an error indicating that the hotfix has expired, change the Local-Windows system date to April 1, 2015 and try the installation again. After the installation, you can change it back to the right date. Install additional software 1. Install the following software: Firefox PuTTY Wireshark Java Adobe Flash Notepad++ FortiClient (install only the VPN module) 2. Add shortcuts to the Windows task bar and desktop for the following applications: File Explorer, Firefox, PuTTY, command prompt, and FortiClient. FortiGate Lab Setup Guide 35 Testing Testing Once you have all VMs installed, and have configured all LAN segments, host IP settings and virtual network connections, test connectivity. From Local-Windows server, test connectivity to: 10.0.1.254 LAN3 STUDENT_port3 10.0.1.241 FortiManager 10.0.1.210 FortiAnalyzer From Local-FortiGate, test connectivity to: 10.0.1.10 LAN3 Local-Windows server 10.200.1.254 LAN1 LINUX_eth1 10.200.2.254 LAN2 LINUX_eth2 10.0.1.241 FortiManager 10.0.1.210 FortiAnalyzer 4.2.2.2 To test IP Forwarding and NAT on your Linux VM. From the Linux host, test connectivity to: 10.200.1.1 LAN1 STUDENT_port1 10.200.2.1 LAN2 STUDENT_port2 10.200.3.1 LAN4 REMOTE_port4 10.200.4.1 LAN5 REMOTE_port5 4.2.2.2 LAN0 From Remote-FortiGate, test connectivity to: 10.0.2.10 LAN6 Remote-Windows server 10.200.3.254 LAN4 LINUX_eth1 10.200.4.254 LAN5 LINUX_eth2 10.200.1.241 FortiManager 10.200.1.210 FortiAnalyzer From Remote-Windows, test connectivity to: 10.0.2.254 LAN6 REMOTE_port6 FortiGate Lab Setup Guide 36 Creating snapshots Creating snapshots Once you have completed and tested your configuration, save a snapshot of each VM. These snapshots are what you will deploy for each student in the class. You can also re-deploy these snapshots to revert a student's VM if their configuration is not working and they need to quickly restore it to a functional state. FortiGate Lab Setup Guide 37 Appendix A: Additional Resources Appendix A: Additional Resources Training Services http://training.fortinet.com Technical Documentation http://help.fortinet.com Knowledge Base http://kb.fortinet.com Forums https://forum.fortinet.com/ Customer Service & Support https://support.fortinet.com FortiGuard Threat Research & Response http://www.fortiguard.com FortiGate Lab Setup Guide 38