Fortigate-vdom 1y4e6n

For information on which commands are global and which are per-VDOM, see Global and per-VDOM settings.

Changes to FortiGate unit settings Settings configured outside of a VDOM are called global settings. These settings affect the entire FortiGate unit and include areas such as interfaces, HA, maintenance, some antivirus settings, and some logging settings. In general, any unit settings that should only be changed by the top level are global settings. Settings configured within a VDOM are called VDOM settings. These settings affect only that specific VDOM and include areas such as operating mode, routing, firewall, VPN, some antivirus, some logging, and reporting.

13

Compliance

Virtual Domains

For more information, see Global and per-VDOM settings.

Viewing the VDOM list The VDOM list shows all virtual domains, their status, and which VDOM is the management VDOM. It is accessible if you are logged in on an with the super_ profile such as the “” . In the VDOM list you can create or delete VDOMs, edit VDOMs, change the management VDOM, and enable or disable VDOMs. You can access the VDOM list in Global > VDOM > VDOM.

The root domain cannot be disabled, even if it is not the management VDOM.

List of VDOMs

Create New

Select to add a new VDOM. See Creating a Virtual Domain.

Edit

Select to change an existing selected VDOM.

Delete

Select to delete the selected VDOM. See Deleting a VDOM. Select to switch the management VDOM. Also shows the current management VDOM.

Switch Management

You must select an active non-management VDOM before this option becomes available. See Changing the management virtual domain.

Selected

When checked, this checkbox indicates this VDOM has been selected. Nearly all operations such as Edit, Delete, and Switch Management require a VDOM to first be selected.

14

Compliance

Virtual Domains

The name of the VDOM. VDOMs are listed in alphabetical order. Name

Operation Mode

Interfaces Enable

When the VDOM is active, you can select the VDOM name to enter that VDOM. See Enabling and accessing Virtual Domains. Indicates the operation mode as either NAT (for NAT/Route mode) or TP (for Transparent mode). The interfaces associated with this VDOM. Each VDOM also includes an interface that starts with “ssl.” that is created by default. A green checkmark indicates this VDOM is active. See Disabling a Virtual Domain. A grey X indicated this VDOM is disabled. See Disabling a Virtual Domain.

Comments

Comments entered when the VDOM was created are displayed here.

Ref.

The number of references to this VDOM in the configuration.

Global and per-VDOM settings Settings configured outside of a VDOM are called global settings. These settings affect the entire FortiGate unit and include areas such as interfaces, HA, maintenance, some antivirus, and some logging. In general, any unit settings that should only be changed by the top level are global settings. Settings configured within a VDOM are called VDOM settings. These settings affect only that specific VDOM and include areas such as operating mode, routing, firewall, VPN, some antivirus, some logging settings, and reporting. When Virtual Domains are not enabled, the entire FortiGate unit is effectively a single VDOM. Per-VDOM limits apply. For some resource types, the global limit cannot be reached with only one VDOM. Some FortiGate unit documentation indicates which parts of the web-based manager, or the CLI are global and which are per-VDOM using the icons shown below. These icons are also present in the Online Help, available on your FortiGate unit.

15

Compliance

Virtual Domains

Global and VDOM icons

For more information on CLI commands, see the FortiGate CLI Reference. This section includes: l

Global settings - web-based manager

l

Per-VDOM settings - web-based manager

l

Global settings - CLI

l

Per-VDOM settings - CLI

Global settings - web-based manager The following table lists commands in the web-based manager that are considered global settings when VDOMs are enabled. The following configuration settings affect all virtual domains. When virtual domains are enabled, only s with the default super_ profile can access global settings.

16

Compliance

Virtual Domains

Global configuration settings System

Dashboard > Status - Host name Dashboard > Status - HA Status Dashboard > Status - System Time Dashboard > Status - Firmware version Dashboard > Status - Configuration backup and restore VDOM > VDOM - list VDOM > VDOM - edit VDOM (mode and resources) VDOM > Global Resources Network > Interfaces Network > DNS - DNS and DDNS settings Config > HA Config > SNMP Config > Replacement Message - messages and images Config > FortiGuard - configuration Config > Advanced - scripts, USB Auto-install, debug log Config > Messaging Servers > s > Profile > Settings - web istration ports, policy, display settings, timeouts, LCD Certificates - local, remote, and CA certificates, CRLs

Log&Report

Log Config - Log Setting

17

Compliance

Virtual Domains

Per-VDOM settings - web-based manager The following table lists commands in the web-based manager that are considered per-VDOM settings when VDOMs are enabled.

VDOM configuration settings System

Dashboard > Status - read-only except for Network > Interfaces (and zones) Network > DH Server Network > Explicit Proxy Network > Routing Table (Transparent mode only) Network > Packet Capture Config > Replacement Message (messages and images) Config > Advanced Monitor > DH Monitor

Router

All settings, including dead gateway detection

Policy

All settings

Firewall Objects

All settings

Security Profiles

All settings

VPN

All settings

& Device

All settings

WiFi Controller

All settings

Log&Report

Traffic and Event Logs Reports FortiCloud Log Config > Log Setting and Alert E-mail Logging Monitor

18

Compliance

Virtual Domains

Global settings - CLI The following table lists commands in the CLI that are considered global settings when VDOMs are enabled. From a super_ profile , use this command to configure features that apply to the complete FortiGate unit including all virtual domains. Virtual domain configuration (vdom-) must be enabled first. This command syntax shows how you access the commands within config global. For information on these commands, refer to the relevant sections in this Reference. If there are multiple versions of the same command with a “2” or “3” added, the additional commands are not listed but fall under the unnumbered command of the same name. config global config antivirus heuristic config antivirus quarfilepattern config antivirus service config application name config dlp settings config endpoint-control app-detect config firewall ssl config gui console config ips decoder config ips global config ips rule config log fortianalyzer setting config log fortiguard setting config log memory global-setting config log syslogd filter config log syslogd setting config log webtrends ... config spamfilter fortishield config spamfilter options config system acrofile config system config system alertemail config system amc config system auto-install config system autoupdate ... config system aux config system bug-report config system central-management config system chassis-loadbalance config system console config system ddns config system dialinsvr config system dns config system dynamic-profile config system fips-cc config system fortiguard conifg system fortiguard-log config system global config system ha config system interface config system npu config system ntp config system -policy config system replacemsg ...

19

Compliance

Virtual Domains

config system replacemsg-image config system resource-limits config system session-helper config system session-sync config system sflow config system snmp ... config system switch-interface conifg system tos-based-priority config system vdom-link config system vdom-property config vpn certificate ... config wanopt storage config webfilter fortiguard config wireless-controller global config wireless-controller timers config wireless-controller vap execute backup execute batch execute central-mgmt execute cfg reload execute cfg save execute cli check-template-status execute cli status-msg-only execute date execute disconnect--session execute disk execute enter execute factoryreset execute firmware-list execute formatlogdisk execute forticlient execute fortiguard-log execute ha disconnect execute ha manage execute ha synchronize execute log ... execute log-report execute reboot execute report-config execute restore execute revision execute router ... (except clear) execute scsi-dev execute send-fds-statistics execute set-next-reboot execute sfp-mode-sgmii execute shutdown execute tac execute time execute update-ase execute update-av execute update-ips execute update-netscan execute update-now execute execute usb-disk execute vpn certificate ...

20

Compliance

Virtual Domains

execute wireless-controller ... (except reset-wtp) get firewall vip ... end

Per-VDOM settings - CLI The following table lists commands in the CLI that are considered VDOM-specific settings when VDOMs are enabled. From the super_ , you can use the commands below to add and configure virtual domains. The number of virtual domains you can add is dependent on the FortiGate model. Virtual domain configuration (vdom-) must be enabled. Once you add a virtual domain you can configure it by adding zones, firewall policies, routing settings, and VPN settings. You can also move physical interfaces from the root virtual domain to other virtual domains and move VLAN subinterfaces from one virtual domain to another. By default all physical interfaces are in the root virtual domain. You cannot remove an interface from a virtual domain if the interface is part of any of the following configurations: l

routing

l

proxy arp

l

DH server

l

zone

l

firewall policy

l

redundant pair

l

link aggregate (802.3ad) group

Delete these objects, or modify them, to be able to remove the interface. This command syntax shows how you access the commands within a VDOM. Refer to the relevant sections in this Reference for information on these commands. config vdom edit config antivirus profile config antivirus quarantine config antivirus settings config application list config application rule-settings config dlp ... (except settings) config endpoint-control app-detect config endpoint-control profile config endpoint-control settings config firewall ... (except ssl) config ftp-proxy config icap config imp2p config ips DoS config ips custom config ips rule-settings config ips sensor config ips settings config log custom-field config log disk config log eventfilter

21

Compliance

Virtual Domains

config log fortianalyzer config log gui config log memory config log syslogd config log trafficfilter config log visibility config netscan config router config spamfilter ... (except fortishield and options) config system 3g-modem config system config system arp-table config system carrier-endpoint-translation config system dh ... config system dh6 ... config system dns-database config system dns-server config system gre-tunnel config system interface config system ipv6-tunnel config system modem config system monitors config system object-tag config system proxy-arp config system replacemsg-group config system session-ttl config system settings config system sit-tunnel config system switch-interface config system wc config system zone config ... config voip config vpn ... config wanopt config web-proxy config webfilter (except fortiguard) config wireless-controller (except global and timers) execute backup execute clear system arp table execute cli check-template-status execute cli status-msg-only execute dh lease-clear execute dh lease-list execute dh6 lease-clear execute dh6 lease-list execute enter execute fortitoken ... execute fsso refresh execute interface dhclient-renew execute interface pppoe-reconnect execute log ... execute log-report ... execute modem dial execute modem hangup execute modem trigger execute mrouter clear

22

Compliance

Virtual Domains

execute netscan ... execute ping, ping6 execute ping-options, ping6-options execute restore execute revision execute router clear bgp execute router clear ospf process execute router restart execute sfp-mode-sgmii execute ssh execute tac execute telnet execute traceroute execute tracert6 execute execute usb-disk execute vpn ipsec tunnel execute vpn sslvpn ... execute wireless-controller reset-wtp next edit config ... execute ... end end

For more information, see Global and per-VDOM settings.

Resource settings Your FortiGate unit has a limited amount of hardware resources such as memory, disk storage, U operations. When Virtual Domains are disabled, this limit is not a major concern because all sessions, s, and other processes share all the resources equally. When using Virtual Domains, hardware resources can be divided differently between Virtual Domains as they are needed. Minimum levels of resources can be specified for each VDOM, so that no Virtual Domain will suffer a complete lack of resources. For example, if one VDOM has only a web server and logging server connected, and a second VDOM has an internal network of 20 s, these two VDOMs will require different levels of resources. The first VDOM will require many sessions but no s. This compares to the second VDOM where s and management resources are required, but fewer sessions. Using the global and per-VDOM resource settings, you can customize the resources allocated to each VDOM to ensure the proper level of service is maintained on each VDOM. This section includes: l

Global resource settings

l

Per-VDOM resource settings

Global resource settings Global Resources apply to the whole FortiGate unit. They represent all of the hardware capabilities of your unit. By default the values are set to their maximum values. These values vary by your model due to each model having differing hardware capabilities.

23

Compliance

Virtual Domains

It can be useful to change the maximum values for some resources to ensure there is enough memory available for other resources that may be more important to your configuration. To use the earlier example, if your FortiGate unit is protecting a number of web servers and other publicly accessible servers you would want to maximize the available sessions and proxies while minimizing other settings that are unused such as settings, VPNs, and dial-up tunnels. Global Resources are only configurable at the global level, and only the has access to these settings. Note that global resources, such as the log disk quota resource, will only be visible if your FortiGate unit hardware s those resources, such as having a hard disk to the log disk resource.

Global Resources- web-based manager

To view global resource settings - web-based manager: 1. Select Global > VDOM > Global Resources. The following information is displayed: Edit

Select to edit the Configured Maximum value for a single selected Resource. If multiple Resources are selected, Edit is not available.

Reset to default value

Select to return one or more selected Resources to factory default settings.

Checkbox

Select a Resource for editing or resetting to default values.

Resource

The name of the available global resources.

Configured Maximum

The currently configured maximum for this resource. This value can be changed by selecting the Resource and editing it.

24

Compliance

Virtual Domains

Default Maximum

The factory configured maximum value for this resource. You cannot set the Configured Maximum higher than the Default Maximum.

Current Usage

The amount of this resource that is currently being used. This value is useful for determining when and if you may need to adjust Configured Maximum values for some resources on your FortiGate unit.

To view global resource settings - CLI: config global config system resource-limits get

When viewing the global resource limits in the CLI, the output appears similar to: FGT1000A (global) # config system resource-limits FGT1000A (resource-limits) # get session : 0 ipsec-phase1 : 10000 ipsec-phase2 : 10000 dialup-tunnel : 0 firewall-policy : 100000 firewall-address : 20000 firewall-addrgrp : 10000 custom-service : 0 service-group : 0 onetime-schedule : 0 recurring-schedule : 0 : 0 -group : 0 sslvpn : 0 proxy : 2000

For explicit proxies, when configuring limits on the number of concurrent s, you need to allow for the number of s based on their authentication method. Otherwise you may run out of resources prematurely. Each session-based authenticated is counted as a single using their authentication hip (RADIUS, LDAP, FSAE, local database etc.) to match s in other sessions. So one authenticated in multiple sessions is still one . For all other situations, the source IP address is used to determine a . All sessions from a single source address are assumed to be from the same .

Per-VDOM resource settings While Global resources apply to resources shared by the whole FortiGate unit, per-VDOM resources are specific to only one Virtual Domain. By default all the per-VDOM resource settings are set to no limits. This means that any single VDOM can use up all the resources of the entire FortiGate unit if it needs to do so. This would starve the other VDOMs for resources

25

Compliance

Virtual Domains

to the point where they would be unable to function. For this reason, it is recommended that you set some maximums on resources that are most vital to your customers. Each Virtual Domain has its own resource settings. These settings include both maximum, and minimum levels. The maximum level is the highest amount of that resource that this VDOM can use if it is available on the FortiGate unit. Minimum levels are a guaranteed level that this minimum level of the resource will always be available no matter what the other VDOMs may be using.

Figure 6: Per-VDOM resources - web-based manager:

For example, consider a FortiGate unit that has ten VDOMs configured. vdom1 has a maximum of 5000 sessions and a minimum of 1000 sessions. If the FortiGate unit has a global maximum of 20,000 sessions, it is possible that vdom1 will not be able to reach its 5000 session upper limit. However, at all times vdom1 is guaranteed to have 1000 sessions available that it can use. On the other hand, if the remaining nine VDOMs use only 1000 sessions each, vdom1 will be able to reach its maximum of 5000.

26

Compliance

Virtual Domains

To view per-VDOM resource settings - web-based manager: 1. Select Global > VDOM > VDOM. 2. Select the root VDOM, and select Edit. 3. Adjust the settings in the Resource Usage section of the page. Resource

Name of the resource. Includes dynamic and static resources.

Maximum

Override the global limit to reduce the amount of each resource available for this VDOM. The maximum must be the same as or lower than the global limit. The default value is 0, which means the maximum is the same as the global limit.

Note: If you set the maximum resource usage for a VDOM you cannot reduce the default maximum global limit for all VDOMs below this maximum. Guaranteed

Enter the minimum amount of the resource available to this VDOM regardless of usage by other VDOMs. The default value is 0, which means that an amount of this resource is not guaranteed for this VDOM.

Current

The amount of the resource that this VDOM currently uses.

4. Select OK.

To view per-VDOM resource settings - CLI: config global config system vdom-property edit root get

When viewing the per-VDOM resource limits in the CLI, the output appears similar to the following. Note that the first two lines are not part of the resource limits. In the CLI, the first number is the maximum value, and the second number is the guaranteed minimum. FGT1KA3607500810 (vdom-property) # edit root FGT1KA3607500810 (root) # get name : root description : property limits for vdom root session : 0 0 ipsec-phase1 : 0 0 ipsec-phase2 : 0 0 dialup-tunnel : 0 0 firewall-policy : 0 0 firewall-address : 0 0 firewall-addrgrp : 0 0 custom-service : 0 0 service-group : 0 0 onetime-schedule : 0 0 recurring-schedule : 0 0 : 0 0 -group : 0 0

27

Compliance

Virtual Domains

sslvpn : 0 0 proxy : 0 0

Virtual Domain Licensing For select FortiGate models in the 1U category and higher, you can purchase a license key to increase the maximum number of VDOMs. Most Enterprise and Large Enterprise (2U) models can up to 500 VDOMs. Chassis-based models can over 500 VDOMs. For specific information, see the product data sheet. Configuring 500 or more VDOMs will result in reduced system performance. See FortiGate unit running very slowly. Your FortiGate unit has limited resources that are divided among all configured VDOMs. These resources include system memory and U. Running security features on many VDOMs at once can limit resources available for basic processing. If you require many VDOMs, all with active security features, it is recommended to a more powerful FortiGate unit.

It is important to backup your configuration before upgrading the VDOM license on your FortiGate unit or units, especially with FortiGate units in HA mode.

To obtain a VDOM license key 1. with a super_ . 2. Go to System > Dashboard > Status. 3. Record your FortiGate unit serial number as shown in System Information. 4. Under License Information > Virtual Domain, select Purchase More.

If you do not see the Purchase More option on the System Dashboard, your FortiGate model does not more than 10 VDOMs.

28

Compliance

Virtual Domains

VDOM License Information

5. You will be taken to the Fortinet customer website where you can and purchase a license key for 25, 50, 100, 250, 500, or more VDOMs. 6. When you receive your license key, go to the Dashboard and select License under License Information, Virtual Domains. 7. In the Input License Key field, enter the 32-character license key you received from Fortinet customer . 8. Select Apply. To the new VDOM license, in global configuration go to System > Dashboard. Under License Information, Virtual Domains the maximum number of VDOMs allowed is shown. VDOMs created on a ed FortiGate unit are recognized as real devices by any connected FortiAnalyzer unit. The FortiAnalyzer unit includes VDOMs in its total number of ed devices. For example, if three FortiGate units are ed on the FortiAnalyzer unit and they contain a total of four VDOMs, the total number of ed FortiGate units on the FortiAnalyzer unit is seven. For more information, see the FortiAnalyzer istration Guide.

Logging in to VDOMs Only super_ s can access all global settings on the FortiGate unit and all of the VDOMs as well. Other s can access and configure only their single VDOM and they must connect to an interface that is part of that VDOM. For example, B is the for vdomB. If he tries to to vdomA, or an interface that is part of vdomA he will not be able to log on. For more information on s in VDOMs, see s in Virtual Domains. Management services communicate using the management VDOM, which is the root VDOM by default. For more information, see Changing the management virtual domain.

29

Compliance

Virtual Domains

Management traffic requires an interface that has access to the Internet. If there is no interface assigned to the VDOM containing the management traffic, services including updates will not function. For more information, see Changing the management virtual domain.

To access a VDOM with a super_ - web-based manager: 1. with a super_ . 2. In the Virtual Domains menu on the left-hand side, select the VDOM to configure. The menu will expand to show the various pages and settings for that VDOM. 3. When you have finished configuring the VDOM, you can l

open the Global menu to return to global configuration

l

log out

To access a VDOM with a super_ - CLI: With the super_, logging into the CLI involves also logging into the specific VDOM. If you need a reminder, use edit ? to see a list of existing VDOMs before you editing a VDOM. If you misspell a VDOM you are trying to switch to, you will create a new VDOM by that name. Any changes you make will be part of the new VDOM, and not the intended VDOM. If you are having problems where your changes aren’t visible, back up to the top level and use edit ? to see a list of VDOMs to ensure this has not happened. If it has happened, see Deleting a VDOM. config vdom edit ? edit .. <enter vdom related commands> .. end exit

To access a VDOM with a non super_ - web-based manager: 1. Connect to the FortiGate unit using an interface that belongs to the VDOM to be configured. 2. using an that has access to the VDOM. The main web-based manager page opens. The interface is largely the same as if the device has VDOMs disabled. From here you can access VDOM-specific settings.

To access a VDOM with a non-super_ - CLI: A non-super_ has access to only one VDOM and must through an interface that belongs to the same VDOM, but the process is the same as logging into a non-VDOM unit. : regular_ : <> .. <enter vdom related commands> .. exit

30

Compliance

Virtual Domains

Configuring Virtual Domains Only a super_ such as the default “” can create, disable, or delete VDOMs. That can create additional s for each VDOM. This section includes: l

Creating a Virtual Domain

l

Disabling a Virtual Domain

l

Deleting a VDOM

l

s in Virtual Domains

Creating a Virtual Domain Once you have enabled Virtual Domains on your FortiGate unit, you can create additional Virtual Domains beyond the default root Virtual Domain. By default new Virtual Domains are set to NAT/Route operation mode. If you want a Virtual Domain to be in Transparent operation mode, you must manually change it. See Virtual Domains in Transparent mode. You can name new Virtual Domains as you like with the following restrictions: l

only letters, numbers, “-”, and “_” are allowed

l

no more than 11 characters are allowed

l

no spaces are allowed

l

VDOMs cannot have the same names as interfaces, zones, switch interfaces, or other VDOMs. When creating large numbers of VDOMs you should not enable advanced features such as proxies, web filtering, and antivirus due to limited FortiGate unit resources. Also when creating large numbers of VDOMs, you may experience reduced performance for the same reason.

To create a VDOM - web-based manager: 1. with a super_ . 2. Go to System > Dashboard > Status and ensure that Virtual Domains are enabled. If not, see Enabling and accessing Virtual Domains. 3. Select System > VDOM > VDOM. 4. Select Create New. 5. Enter a unique name for your new VDOM. 6. Enter a short and descriptive comment to identify this VDOM. 7. Select OK. Repeat Steps4 through 7 to add additional VDOMs.

To create a VDOM - CLI: config vdom edit

31

Compliance

Virtual Domains

end

If you want to edit an existing Virtual Domain in the CLI, and mistype the name a new Virtual Domain will be created with this new misspelled name. If you notice expected configuration changes are not visible, this may be the reason. You should periodically check your VDOM list to ensure there are none of these misspelled VDOMs present.

Disabling a Virtual Domain The status of a VDOM can be Enabled, or Disabled. Active status VDOMs can be configured. Active is the default status when a VDOM is created. The management VDOM must be an Active VDOM. For more information on the management VDOM, see Changing the management virtual domain. Disabled status VDOMs are considered “offline”. The configuration remains, but you cannot use the VDOM, and only the super_ can view it. You cannot delete a disabled VDOM without first enabling it, and removing references to it like usual—there is no Delete icon for disabled status VDOMs. You can assign interfaces to a disabled VDOM. See Deleting a VDOM. The following procedures show how to disable a VDOM called “test-vdom”.

To disable a VDOM - web-based manager: 1. Go to Global > VDOM > VDOM. 2. Open the VDOM for editing. 3. Ensure Enable is not selected and then select OK. The VDOM’s Enable icon in the VDOM list is a grey X.

To disable a VDOM - CLI: config vdom edit test-vdom config system settings set status disable end end

To enable a VDOM - web-based manager: 1. Go to Global > VDOM > VDOM. 2. Open the VDOM for editing. 3. Ensure Enable is selected and then select OK. The VDOM’s Enable icon in the VDOM list is a green checkmark.

To enable a VDOM - CLI: config vdom edit test-vdom config system settings set status enable end end

32

Compliance

Virtual Domains

Deleting a VDOM Deleting a VDOM removes it from the FortiGate unit configuration. Before you can delete a VDOM, all references to it must be removed. This includes any objects listed in PerVDOM settings - web-based manager. If there are any references to the VDOM remaining, you will see an error message and not be able to delete the VDOM. The VDOM must also be enabled. A disabled VDOM cannot be deleted. You cannot delete the root VDOM or the management VDOM.

Before deleting a VDOM, a good practice is to reset any interface referencing that VDOM to its default configuration, with “root” selected as the Virtual Domain.

The following procedures show how to delete the test-vdom VDOM.

To delete a VDOM - web-based manager: 1. Go to Global > VDOM > VDOM. 2. Select the check box for the VDOM and then select the Delete icon. If the Delete icon is not active, there are still references to the VDOM that must first be removed. The Delete icon is available when all the references to this VDOM are removed. 3. Confirm the deletion.

To delete a VDOM - CLI: config vdom delete test-vdom end

Removing references to a VDOM When you are going to delete a VDOM, all references to that VDOM must first be removed. It can be difficult to find all the references to the VDOM. This section provides a list of common objects that must be removed before a VDOM can be deleted, and a CLI command to help list the dependencies. Interfaces are an important part of VDOMs. If you can move all the interfaces out of a VDOM, generally you will be able to delete that VDOM.

Common objects that refer to VDOMs When you are getting ready to delete a VDOM check for, and remove the following objects that refer to that VDOM or its components: l

Routing - both static and dynamic routes

l

Firewall addresses, policies, groups, or other settings

l

Security Features/Profiles

l

VPN configuration

33

Compliance

Virtual Domains

l

s or groups

l

Logging

l

DH servers

l

Network interfaces, zones, custom DNS servers

l

VDOM s

s in Virtual Domains When Virtual Domains are enabled, permissions change for s. s are now divided into per-VDOM s, and super_ s. Only super_ s can create other s and assign them to a VDOM. This section includes: l

VDOM permissions

l

Creating s for Virtual Domains

l

Virtual Domain dashboard display

VDOM permissions Different types of s have different permissions within VDOMs. For example, if you are using a super_ profile , you can perform all tasks. However, if you are using a regular , the tasks available to you depend on whether you have read only or read/write permissions. The following table shows what tasks can be performed by which s.

Table 3: VDOM permissions Tasks

Regular

Super_ profile

Read only permission

Read/write permission

View global settings

yes

yes

yes

Configure global settings

no

no

yes

Create or delete VDOMs

no

no

yes

Configure multiple VDOMs

no

no

yes

Assign interfaces to a VDOM

no

no

yes

Revision Control Backup and Restore

no

no

yes

Create VLANs

no

yes - for 1 VDOM

yes - for all VDOMs

34

Compliance

Virtual Domains

Assign an to a VDOM Create additional s Create and edit protection profiles

no

no

yes

no

yes - for 1 VDOM

yes - for all VDOMs

no

yes - for 1 VDOM

yes - for all VDOMs

The only difference in s when VDOMs are enabled is selecting which VDOM the belongs to. Otherwise, by default the istration s are the same as when VDOMs are disabled and closely resemble the super_ in their privileges.

Creating s for Virtual Domains Using the , you can create additional s and assign them to VDOMs. The newly-created can access the FortiGate unit only through network interfaces that belong to their assigned VDOM or through the console interface. The network interface must be configured to allow management access, such as HTTPS and SSH. Without these in place, the new will not be able to access the FortiGate unit and will have to the super_ for access. The following procedure creates a new Local called _sales with a of fortinet in the sales VDOM using the _prof default profile.

To create an for a VDOM - web-based manager: 1. with a super_ . 2. Go to System > > s. 3. Select Create New. 4. Select Regular for Type, as you are creating a Local . 5. Enter the necessary information about the : email, , etc. 6. If this will be accessing the VDOM from a particular IP address or subnet, enable Restrict this from Trusted Hosts Only and enter the IP in Trusted Host #1. See Using trusted hosts. 7. Select prof_ for the Profile. 8. Select sales from the list of Virtual Domains. 9. Select OK.

To create s for VDOMs - CLI: config global config system edit set vdom set set acrofile ... end

35

Compliance

Virtual Domains

Using trusted hosts Setting trusted hosts for all of your s increases the security of your network by further restricting istrative access. In addition to knowing the , an must connect only through the subnet or subnets you specify. You can even restrict an to a single IP address if you define only one trusted host IP address with a netmask of 255.255.255.255. When you set trusted hosts for all s, the FortiGate unit does not respond to istrative access attempts from any other hosts. This provides the highest security. If you leave even one unrestricted, the unit accepts istrative access attempts on any interface that has istrative access enabled, potentially exposing the unit to attempts to gain unauthorized access. The trusted hosts you define apply both to the web-based manager and to the CLI when accessed through Telnet or SSH. CLI access through the console is not affected. The trusted host addresses all default to 0.0.0.0/0.0.0.0 for IPv4, or ::/0 for IPv6. If you set one of the zero addresses to a non-zero address, the other zero addresses will be ignored. The only way to use a wildcard entry is to leave the trusted hosts at 0.0.0.0/0.0.0.0 or ::0. However, this configuration is less secure.

Virtual Domain dashboard display When s logs into their virtual domain, they see a different dashboard than the global will see. The VDOM dashboard displays information only relevant to that VDOM — no global or other VDOM information is displayed.

Table 4: VDOM dashboard information Information

per-VDOM

Global

System Information

read-only

yes

License Information

no

yes

CLI console

yes

yes

Unit Operation

read-only

yes

Alert Message Console

no

yes

Top Sessions

limited to VDOM sessions

yes

Traffic

limited to VDOM interfaces

yes

Statistics

yes

yes

36

Compliance

Virtual Domains

VDOM dashboard

37

Compliance

Virtual Domains in NAT/Route mode Virtual domains (VDOMs) are a method of dividing a FortiGate unit into two or more virtual units that each function as independent units. Each virtual domain has separate routing and security policies. A single FortiGate unit with virtual domains is flexible enough to serve multiple departments of an organization, separate organizations, or be the basis for a service provider’s managed security service. The examples in this chapter are intended to be followed in order as procedures build on previous procedures. If you do not complete the previous procedures, the procedure you are working on may not work properly. If this happens, consult previous procedures or FortiGate documentation. This chapter contains the following sections: l

Virtual domains in NAT/Route mode

l

Example NAT/Route VDOM configuration

l

Figure 9: Example VDOM configuration

Virtual domains in NAT/Route mode Once you have enabled virtual domains and created one or more VDOMs, you need to configure them. Configuring VDOMs on your FortiGate unit includes tasks such as the ones listed here; while you may not require all for your network topology, it is recommended that you perform them in the order given: l

Changing the management virtual domain

l

Configuring interfaces in a NAT/Route VDOM

l

Configuring VDOM routing

l

Configuring security policies for NAT/Route VDOMs

l

Configuring security profiles for NAT/Route VDOMs

Changing the management virtual domain The management virtual domain is the virtual domain where all the management traffic for the FortiGate unit originates. This management traffic needs access to remote servers, such as FortiGuard services and NTP, to perform its duties. It needs access to the Internet to send and receive this traffic. Management traffic includes, but is not limited to l

DNS lookups

l

logging to FortiAnalyzer or syslog

l

FortiGuard service

l

sending alert emails

l

Network time protocol traffic (NTP)

l

Sending SNMP traps

l

Quarantining suspicious files and email.

38

Compliance

Virtual Domains in NAT/Route mode

By default the management VDOM is the root domain. When other VDOMs are configured on your FortiGate unit, management traffic can be moved to one of these other VDOMs. Reasons to move the management VDOM include selecting a non-root VDOM to be your istration VDOM, or the root VDOM not having an interface with a connection to the Internet.

You cannot change the management VDOM if any s are using RADIUS authentication.

The following procedure will change the management VDOM from the default root to a VDOM named mgmt_ vdom. It is assumed that mgmt_vdom has already been created and has an interface that can access the Internet.

To change the management VDOM - web-based manager: 1. Select Global > VDOM > VDOM. 2. Select the checkbox next to the required VDOM. 3. Select Switch Management. The current management VDOM is shown in square brackets, “[root]” for example.

To change the management VDOM - CLI: config global config system global set management-vdom mgmt_vdom end

Management traffic will now originate from mgmt_vdom.

Configuring interfaces in a NAT/Route VDOM A VDOM must contain at least two interfaces to be useful. These can be physical interfaces or VLAN interfaces. By default, all physical interfaces are in the root VDOM. When you create a new VLAN, it is in the root VDOM by default. When there are VDOMs on the FortiGate unit in both NAT and Transparent operation modes, some interface fields will be displayed as “-” on System > Network > Interfaces. Only someone with a super_ can view all the VDOMs. When moving an interface to a different VDOM, firewall IP pools and virtual IPs for this interface are deleted. You should manually delete any routes that refer to this interface. Once the interface has been moved to the new VDOM, you can add these services to the interface again.

39

Compliance


When configuring VDOMs on FortiGate units with accelerated interfaces you must assign both interfaces in the pair to the same VDOM for those interfaces to retain their acceleration. Otherwise they will become normal interfaces.

This section includes the following topics: l

Adding a VLAN to a NAT/Route VDOM

l

Moving an interface to a VDOM

l

Deleting an interface

l

Adding a zone to a VDOM

Adding a VLAN to a NAT/Route VDOM The following example shows one way that multiple companies can maintain their security when they are using one FortiGate unit with VLANs that share interfaces on the unit. This procedure will add a VLAN interface called client1-v100 with a VLAN ID of 100 to an existing VDOM called client1 using the physical interface called port2.

The physical interface does not need to belong to the VDOM that the VLAN belongs to.

To add a VLAN subinterface to a VDOM - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select Create New. 3. Enter the following information and select OK: Name

client1-v100

Interface

port2

VLAN ID

100

Virtual Domain

Client1

Addressing mode

Manual

IP/Netmask

172.20.120.110/255.255.255.0

istrative Access

HTTPS, SSH

You will see an expand arrow added to the port2 interface. When the arrow is expanded, the interface shows the client1-v100 VLAN subinterface.

To add a VLAN subinterface to a VDOM - CLI: config global config system interface

40

Compliance


edit client1-v100 set type vlan set vlanid 100 set vdom Client1 set interface port2 set ip 172.20.120.110 255.255.255.0 set allowaccess https ssh end

Moving an interface to a VDOM Interfaces belong to the root VDOM by default. Moving an interface is the same procedure no matter if its moving from the root VDOM or a any other VDOM. If you have an accelerated pair of physical interfaces both interfaces must be in the same VDOM or you will lose their acceleration. The following procedure will move the port3 interface to the Client2 VDOM. This is a common action when configuring a VDOM. It is assumed that the Client2 VDOM has already been created. It is also assumed that your FortiGate unit has a port3 interface. If you are using a different model, your physical interfaces may not be named port2, external or port3.

To move an existing interface to a different VDOM - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select Edit for the port3 interface. 3. Select Client2 as the new Virtual Domain. 4. Select OK.

To move an existing interface to a different VDOM - CLI: config global config system interface edit port3 set vdom Client2 end

Deleting an interface Before you can delete a virtual interface, or move an interface from one VDOM to another, all references to that interface must be removed. For a list of objects that can refer to an interface see Per-VDOM settings - web-based manager. The easiest way to be sure an interface can be deleted is when the Delete icon is no longer greyed out. If it remains greyed out when an interface is selected, that interface still has objects referring to it, or it is a physical interface that cannot be deleted.

To delete a virtual interface - web-based manager: 1. Ensure all objects referring to this interface have been removed. 2. Select Global > Network > Interfaces. 3. Select the interface to delete. 4. Select the delete icon.

41

Compliance


Adding a zone to a VDOM Grouping interfaces and VLAN subinterfaces into zones simplifies policy creation. You can configure policies for connections to and from a zone, but not between interfaces in a zone. Zones are VDOM-specific. A zone cannot be moved to a different VDOM. Any interfaces in a zone cannot be used in another zone. To move a zone to a new VDOM requires deleting the current zone and re-creating a zone in the new VDOM. The following procedure will create a zone called ing in the client2 VDOM. It will not allow intrazone traffic, and both port3 and port2 interfaces belong to this zone. This is a method of grouping and isolating traffic over particular interfaces—it is useful for added security and control within a larger network.

To add a zone to a VDOM - web-based manager: 1. In Virtual Domains, select the client2 VDOM. 2. Go to System > Network > Interfaces. 3. Select Create New > Zone. 4. Enter the following information and select OK: Zone Name

ing

Block intra-zone traffic

Select

Interface

port3, port2

To add a zone to a VDOM - CLI: config vdom edit client2 config system zone edit ing set interface port3 port2 set intrazone deny end end

Configuring VDOM routing Routing is VDOM-specific. Each VDOM should have a default static route configured as a minimum. Within a VDOM, routing is the same as routing on your FortiGate unit without VDOMs enabled. When configuring dynamic routing on a VDOM, other VDOMs on the FortiGate unit can be neighbors. The following topics give a brief introduction to the routing protocols, and show specific examples of how to configure dynamic routing for VDOMs. Figures are included to show the FortiGate unit configuration after the successful completion of the routing example. This section includes: l

Default static route for a VDOM

l

Dynamic Routing in VDOMs

42

Compliance


Default static route for a VDOM The routing you define applies only to network traffic entering non-ssl interfaces belonging to this VDOM. Set the istrative distance high enough, typically 20, so that automatically configured routes will be preferred to the default. In the following procedure, it is assumed that a VDOM called “Client2” exists. The procedure will create a default static route for this VDOM. The route has a destination IP of 0.0.0.0, on the port3 interface. It has a gateway of 10.10.10.1, and an istrative distance of 20. The values used in this procedure are very standard, and this procedure should be part of configuring all VDOMs.

To add a default static route for a VDOM - web-based manager: 1. In Virtual Domains, select the client2 VDOM. 2. Go to Router > Static > Static Routes. 3. Select Create New. 4. Enter the following information and select OK: Destination IP/Mask

0.0.0.0/0.0.0.0

Device

port2

Gateway

10.10.10.1

Distance

20

To add a default static route for a VDOM - CLI: config vdom edit client2 config router static edit 4 set device port2 set dst 0.0.0.0 0.0.0.0 set gateway 10.10.10.1 set distance 20 end end

Dynamic Routing in VDOMs Dynamic routing is VDOM-specific, like all other routing. Dynamic routing configuration is the same with VDOMs as with your FortiGate unit without VDOMs enabled, once you are at the routing menu. If you have multiple VDOMs configured, the dynamic routing configuration between them can become quite complex. VDOMs provide some interesting changes to dynamic routing. Each VDOM can be a neighbor to the other VDOMs. This is useful in simulating a dynamic routing area or AS or network using only your FortiGate unit. You can separate different types of routing to different VDOMs if required. This allows for easier troubleshooting. This is very useful if your FortiGate unit is on the border of a number of different routing domains. For more information on dynamic routing in FortiOS, see Dynamic Routing Overview .

43

Compliance


Inter-VDOM links must have IP addresses assigned to them if they are part of a dynamic routing configuration. Inter-VDOM links may or may not have IP addresses assigned to them. Without IP addresses, you need to be careful how you configure routing. While the default static route can be assigned an address of 0.0.0.0 and rely instead on the interface, dynamic routing almost always requires an IP address.

RIP The RIP dynamic routing protocol uses hop count to determine the best route, with a hop count of 1 being directly attached to the interface and a hop count of 16 being unreachable. For example if two VDOMs on the same FortiGate unit are RIP neighbors, they have a hop count of 1.

OSPF OSPF communicates the status of its network links to adjacent neighbor routers instead of the complete routing table. When compared to RIP, OSPF is more suitable for large networks, it is not limited by hop count, and is more complex to configure. For smaller OSPF configurations its easiest to just use the backbone area, instead of multiple areas.

BGP BGP is an Internet gateway protocol (IGP) used to connect autonomous systems (ASes) and is used by Internet service providers (ISPs). BGP stores the full path, or path vector, to a destination and its attributes which aid in proper routing.

Configuring security policies for NAT/Route VDOMs Security policies are VDOM-specific. This means that all firewall settings for a VDOM, such as firewall addresses and security policies, are configured within the VDOM. In VDOMs, all firewall related objects are configured per-VDOM including addresses, service groups, security profiles, schedules, traffic shaping, and so on. If you want firewall addresses, you will have to create them on each VDOM separately. If you have many addresses, and VDOMs this can be tedious and time consuming. Consider using a FortiManager unit to manage your VDOM configuration — it can get firewall objects from a configured VDOM or FortiGate unit, and push those objects to many other VDOMs or FortiGate units. See the FortiManager istration Guide. You can customize the Policy display by including some or all columns, and customize the column order onscreen. Due to this feature, security policy screenshots may not appear the same as on your screen.

Configuring a security policy for a VDOM Your security policies can involve only the interfaces, zones, and firewall addresses that are part of the current VDOM, and they are only visible when you are viewing the current VDOM. The security policies of this VDOM filter the network traffic on the interfaces and VLAN subinterfaces in this VDOM. A firewall service group can be configured to group multiple services into one service group. When a descriptive name is used, service groups make it easier for an to quickly determine what services are allowed by a security policy.

44

Compliance


In the following procedure, it is assumed that a VDOM called Client2 exists. The procedure will configure an outgoing security policy. The security policy will allow all HTTPS and SSH traffic for the SalesLocal address group on VLAN_200 going to all addresses on port3. This traffic will be scanned and logged.

To configure a security policy for a VDOM - web-based manager: 1. In Virtual Domains, select the client2 VDOM. 2. Go to Policy > Policy. 3. Select Create New. 4. Enter the following information and select OK: Source Interface/Zone

VLAN_200

Source Address

SalesLocal

Destination Interface/Zone

port3

Destination Address

any

Schedule

always

Service

Multiple - HTTPS, SSH

Action

ACCEPT

Log Allowed Traffic

enable

To configure a security policy for a VDOM - CLI: config vdom edit Client2 config firewall policy edit 12 set srcintf VLAN_200 set srcaddr SalesLocal set dstintf port3(dmz) set dstaddr any set schedule always set service HTTPS SSH set action accept set status enable set logtraffic enable end end

Configuring security profiles for NAT/Route VDOMs In NAT/Route VDOMs, security profiles are exactly like regular FortiGate unit operation with one exception. In VDOMs, there are no default security profiles. If you want security profiles in VDOMs, you must create them yourself. If you have many security profiles to create in each VDOM, you should consider using a FortiManager unit. It can get existing profiles from a VDOM or FortiGate unit, and push those profiles down to multiple other VDOMs or FortiGate units. See the FortiManager istration Guide.

45

Compliance


When VDOMs are enabled, you only need one FortiGuard license for the physical unit, and FortiGuard updates once for the physical unit. This can result in a large time and money savings over multiple physical units if you have many VDOMs.

Configuring VPNs for a VDOM Virtual Private Networking (VPN) settings are VDOM-specific, and must be configured within each VDOM. Configurations for IPsec Tunnel, IPsec Interface, PPTP and SSL are VDOM-specific. However, certificates are shared by all VDOMs and are added and configured globally to the FortiGate unit.

Example NAT/Route VDOM configuration Company A and Company B each have their own internal networks and their own ISPs. They share a FortiGate unit that is configured with two separate VDOMs, with each VDOM running in NAT/Route mode enabling separate configuration of network protection profiles. Each ISP is connected to a different interface on the FortiGate unit. This network example was chosen to illustrate one of the most typical VDOM configurations. This example has the following sections: l

Network topology and assumptions

l

General configuration steps

l

Creating the VDOMs

l

Configuring the FortiGate interfaces

l

Configuring the vdomA VDOM

l

Configuring the vdomB VDOM

l

Testing the configuration

Network topology and assumptions Both companies have their own ISPs and their own internal interface, external interface, and VDOM on the FortiGate unit. For easier configuration, the following IP addressing is used: l

all IP addresses on the FortiGate unit end in “.2” such as 10.11.101.2.

l

all IP addresses for ISPs end in “.7”, such as 172.20.201.7.

l

all internal networks are 10.*.*.* networks, and sample internal addresses end in “.55”.

The IP address matrix for this example is as follows.

Address

Company A

Company B

ISP

172.20.201.7

192.168.201.7

Internal network

10.11.101.0

10.12.101.0

46

Compliance


Address

Company A

Company B

FortiGate / VDOM

172.20.101.2 (port1)

192.168.201.2 (port3)

10.11.101.2 (port4)

10.12.101.2 (port2)

The Company A internal network is on the 10.11.101.0/255.255.255.0 subnet. The Company B internal network is on the 10.12.101.0/255.255.255.0 subnet. There are no switches or routers required for this configuration. There are no VLANs in this network topology. The interfaces used in this example are port1 through port4. Different FortiGate models may have different interface labels. port1 and port3 are used as external interfaces. port2 and port4 are internal interfaces. The is a super_ . If you are a using a non-super_ , refer to "Global and per-VDOM settings" to see which parts a non-super_ can also configure. When configuring security policies in the CLI always choose a policy number that is higher than any existing policy numbers, select services before profile-status, and profile-status before profile. If these commands are not entered in that order, they may not be available to enter.

Figure 9: Example VDOM configuration

ISP B 192.168.201.7

port3 192.168.101.2

ISP A 172.20.201.7

port2 10.12.101.2 172.20.101.2 port1 10.11.101.2 port4

10.12.101.55

10.11.101.55 Company B 10.12.101.0

Company A 10.11.101.0

47

Compliance


General configuration steps For best results in this configuration, follow the procedures in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results. 1. Creating the VDOMs 2. Configuring the FortiGate interfaces 3. Configuring the vdomA VDOM, and Configuring the vdomB VDOM 4. Testing the configuration

Creating the VDOMs In this example, two new VDOMs are created — vdomA for Company A and vdomB for Company B. These VDOMs will keep the traffic for these two companies separate while enabling each company to access its own ISP.

To create two VDOMs - web-based manager: 1. with a super_ . 2. Go to Global > VDOM > VDOM, and select Create New. 3. Enter vdomA and select OK. 4. Select OK again to return to the VDOM list. 5. Select Create New. 6. Enter vdomB and select OK.

To create two VDOMs - CLI: config vdom edit vdomA next edit vdomB end

Configuring the FortiGate interfaces This section configures the interfaces that connect to the companies’ internal networks, and to the companies’ ISPs. All interfaces on the FortiGate unit will be configured with an IP address ending in “.2” such as 10.11.101.2. This will simplify network istration both for the companies, and for the FortiGate unit global . Also the internal addresses for each company differ in the second octet of their IP address - Company A is 10.11.*, and Company B is 10.12.*. This section includes the following topics: l

Configuring the vdomA interfaces

l

Configuring the vdomB interfaces

48

Compliance


If you cannot change the VDOM of an network interface it is because something is referring to that interface that needs to be deleted. Once all the references are deleted the interface will be available to switch to a different VDOM. For example a common reference to the external interface is the default static route entry. See Configuring interfaces in a NAT/Route VDOM.

Configuring the vdomA interfaces The vdomA VDOM includes two FortiGate unit interfaces: port1 and external. The port4 interface connects the Company A internal network to the FortiGate unit, and shares the internal network subnet of 10.11.101.0/255.255.255.0. The external interface connects the FortiGate unit to ISP A and the Internet. It shares the ISP A subnet of 172.20.201.0/255.255.255.0.

To configure the vdomA interfaces - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select Edit on the port1 interface. 3. Enter the following information and select OK: Virtual Domain

vdomA

Addressing mode

Manual

IP/Netmask

172.20.101.2/255.255.255.0

4. Select Edit on the port4 interface. 5. Enter the following information and select OK: Virtual Domain

vdomA

Addressing mode

Manual

IP/Netmask

10.11.101.2/255.255.255.0

To configure the vdomA interfaces - CLI: config global config system interface edit port1 set vdom vdomA set mode static set ip 172.20.101.2 255.255.255.0 next edit port4 set vdom vdomA set mode static set ip 10.11.101.2 255.255.255.0 end

49

Compliance


Configuring the vdomB interfaces The vdomB VDOM uses two FortiGate unit interfaces: port2 and port3. The port2 interface connects the Company B internal network to the FortiGate unit, and shares the internal network subnet of 10.12.101.0/255.255.255.0. The port3 interface connects the FortiGate unit to ISP B and the Internet. It shares the ISP B subnet of 192.168.201.0/255.255.255.0.

To configure the vdomB interfaces - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select Edit on the port3 interface. 3. Enter the following information and select OK: Virtual domain

vdomB

Addressing mode

Manual

IP/Netmask

192.168.201.2/255.255.255.0

4. Select Edit on the port2 interface. 5. Enter the following information and select OK: Virtual domain

vdomB

Addressing mode

Manual

IP/Netmask

10.12.101.2/255.255.255.0

To configure the vdomB interfaces - CLI: config global config system interface edit port3 set vdom vdomB set mode static set ip 192.168.201.2 255.255.255.0 next edit port2 set vdom vdomB set mode static set ip 10.12.101.2 255.255.255.0 end

Configuring the vdomA VDOM With the VDOMs created and the ISPs connected, the next step is to configure the vdomA VDOM. Configuring the vdomA includes the following:

50

Compliance


l

Adding vdomA firewall addresses

l

Adding the vdomA security policy

l

Adding the vdomA default route

Adding vdomA firewall addresses You need to define the addresses used by Company A’s internal network for use in security policies. This internal network is the 10.11.101.0/255.255.255.0 subnet. The FortiGate unit provides one default address, “all”, that you can use when a security policy applies to all addresses as the source or destination of a packet.

To add the vdomA firewall addresses - web-based manager: 1. In Virtual Domains, select vdomA . 2. Go to Firewall Objects > Address > Address. 3. Select Create New. 4. Enter the following information and select OK: Address Name

Ainternal

Type

Subnet / IP Range

Subnet / IP Range

10.11.101.0/255.255.255.0

Interface

port4

To add the vdomA VDOM firewall addresses - CLI: config vdom edit vdomA config firewall address edit Ainternal set type ipmask set subnet 10.11.101.0 255.255.255.0 end end

Adding the vdomA security policy You need to add the vdomA security policy to allow traffic from the internal network to reach the external network, and from the external network to internal as well. You need two policies for this domain.

To add the vdomA security policy - web-based manager: 1. In Virtual Domains, select vdomA . 2. Go to Policy > Policy. 3. Select Create New. 4. Enter the following information and select OK: Source Interface/Zone

port4

51

Compliance


Source Address

Ainternal


port1

Destination Address

all

Schedule

Always

Service

ANY

Action

ACCEPT

5. Select Create New. 6. Enter the following information and select OK: Source Interface/Zone

port1

Source Address

all


port4

Destination Address

Ainternal

Schedule

Always

Service

ANY

Action

ACCEPT

To add the vdomA security policy - CLI: config vdom edit vdomA config firewall policy edit 1 set srcintf port4 set srcaddr Ainternal set dstintf port1 set dstaddr all set schedule always set service ANY set action accept set status enable next edit 2 set srcintf port1 set srcaddr all set dstintf port4 set dstaddr Ainternal set schedule always set service ANY set action accept set status enable end

52

Compliance


Adding the vdomA default route You also need to define a default route to direct packets from the Company A internal network to ISP A. Every VDOM needs a default static route, as a minimum, to handle traffic addressed to external networks such as the Internet. The istrative distance should be set slightly higher than other routes. Lower distances will get checked first, and this default route will only be used as a last resort.

To add a default route to the vdomA - web-based manager: 1. For Virtual Domains, select vdomA 2. Go to Router > Static > Static Routes. 3. Select Create New. 4. Enter the following information and select OK: Destination IP/Mask

0.0.0.0/0.0.0.0

Device

port1

Gateway

172.20.201.7

Distance

20

To add a default route to the vdomA - CLI: config vdom edit vdomA config router static edit 1 set device port1 set gateway 172.20.201.7 end

Configuring the vdomB VDOM In this example, the vdomB VDOM is used for Company B. Firewall and routing settings are specific to a single VDOM. vdomB includes the FortiGate port2 interface to connect to the Company B internal network, and the FortiGate port3 interface to connect to ISP B. Security policies are needed to allow traffic from port2 to external and from external to port2 interfaces. This section includes the following topics: l

Adding the vdomB firewall address

l

Adding the vdomB security policy

l

Adding a default route to the vdomB VDOM

53

Compliance


Adding the vdomB firewall address You need to define addresses for use in security policies. In this example, the vdomB VDOM needs an address for the port2 interface and the “all” address.

To add the vdomB firewall address - web-based manager: 1. In Virtual Domains, select vdomB . 2. Go to Firewall Objects > Address > Address. 3. Select Create New. 4. Enter the following information and select OK: Address Name

Binternal

Type

Subnet / IP Range

Subnet / IP Range

10.12.101.0/255.255.255.0

Interface

port2

To add the vdomB firewall address - CLI: config vdom edit vdomB config firewall address edit Binternal set type ipmask set subnet 10.12.101.0 255.255.255.0 end end

Adding the vdomB security policy You also need a security policy for the Company B domain. In this example, the security policy allows all traffic.

To add the vdomB security policy - web-based manager: 1. with a super_ . 2. In Virtual Domains, select vdomB. 3. Go to Policy > Policy. 4. Select Create New. 5. Enter the following information and select OK: Source Interface/Zone

port2

Source Address

Binternal


port3

Destination Address

all

54

Compliance


Schedule

Always

Service

ANY

Action

ACCEPT

6. Select Create New. 7. Enter the following information and select OK: Source Interface/Zone

port3

Source Address

all


port2

Destination Address

Binternal

Schedule

Always

Service

ANY

Action

ACCEPT

To add the vdomB security policy - CLI: config vdom edit vdomB config firewall policy edit 1 set srcintf port2 set dstintf port3 set srcaddr Binternal set dstaddr all set schedule always set service ANY set action accept set status enable edit 1 set srcintf port3 set dstintf port2 set srcaddr all set dstaddr Binternal set schedule always set service ANY set action accept set status enable end end

Adding a default route to the vdomB VDOM You need to define a default route to direct packets to ISP B.

55

Compliance


To add a default route to the vdomB VDOM - web-based manager: 1. as the super_ . 2. In Virtual Domains, select vdomB. 3. Go to Router > Static > Static Routes. 4. Select Create New. 5. Enter the following information and select OK: Destination IP/Mask

0.0.0.0/0.0.0.0

Device

port3

Gateway

192.168.201.7

Distance

20

To add a default route to the vdomB VDOM - CLI: config vdom edit vdomB config router static edit 1 set dst 0.0.0.0/0 set device external set gateway 192.168.201.7 end end

Testing the configuration Once you have completed configuration for both company VDOMs, you can use diagnostic commands, such as tracert in Windows, to test traffic routed through the FortiGate unit. Alternately, you can use the traceroute command on a Linux system with similar output. Possible errors during the traceroute test are: l

l

“* * * Request timed out” - the trace was not able to make the next connection towards the destination fast enough “Destination host unreachable” - after a number of timed-out responses the trace will give up

Possible reasons for these errors are bad connections or configuration errors. For additional troubleshooting, see Troubleshooting Virtual Domains.

Testing traffic from the internal network to the ISP In this example, a route is traced from the Company A internal network to ISP A. The test was run on a Windows PC with an IP address of 10.11.101.55. The output here indicates three hops between the source and destination, the IP address of each hop, and that the trace was successful. From the Company A internal network, access a command prompt and enter this command:

56

Compliance


C:\>tracert 172.20.201.7 Tracing route to 172.20.201.7 over a maximum of 30 hops: 1 <10 ms <10 ms <10 ms 10.11.101.2 2 <10 ms <10 ms <10 ms 172.20.101.2 3 <10 ms <10 ms <10 ms 172.20.201.7 Trace complete.

57

Compliance

Virtual Domains in Transparent mode In Transparent mode, the FortiGate unit behaves like a layer-2 bridge but can still provide services such as antivirus scanning, web filtering, spam filtering and intrusion protection to traffic. There are some limitations in Transparent mode in that you cannot use SSL VPN, PPTP/L2TP VPN, DH server, or easily perform NAT on traffic. The limits in Transparent mode apply to IEEE 802.1Q VLAN trunks ing through the unit. VDOMs can each be configured to operate either in Transparent or NAT/Route operation mode, with each VDOM behaving like a separate FortiGate unit operating in the respective mode. VLANs configured on a VDOM in Transparent mode are the same as VLANs configured on the FortiGate unit when VDOMs are disabled. This chapter includes the following sections: l

Transparent operation mode

l

Configuring VDOMs in Transparent mode

l

Example of VDOMs in Transparent mode

Transparent operation mode In transparent mode, the FortiGate unit becomes a layer-2 IP forwarding bridge. This means that Ethernet frames are forwarded based on destination MAC address, and no other routing is performed. All incoming traffic that is accepted by the firewall, is broadcast out on all interfaces. In transparent mode the FortiGate unit is a forwarding bridge, not a switch. A switch can develop a port table and associated MAC addresses, so that it can bridge two ports to deliver the traffic instead of broadcasting to all ports. In transparent mode, the FortiGate unit does not following this switch behavior, but instead is the forwarding bridge that broadcasts all packets out over all interfaces, subject to security policies. Features such as broadcast domains, forwarding domains, and STP apply to both FortiGate units and VDOMs in Transparent mode.

Broadcast domains A broadcast domain is a network segment in which any network equipment can transmit data directly to another device without going through a routing device. All the devices share the same subnet. The subnets are separated by layer-3 devices, such as routers, that can forward traffic from one broadcast domain to the next. Broadcast domains are important to transparent mode FortiGate units because the broadcast domain is the limit of where the FortiGate unit can forward packets when it is in transparent mode.

Forwarding domains Address Resolution Protocol (ARP) packets are vital to communication on a network, and ARP is enabled on FortiGate unit interfaces by default. Normally you want ARP packets to through the FortiGate unit. However, in Transparent mode ARP packets arriving on one interface are sent to all other interfaces including VLANs giving the appearance of duplicates of the same MAC address on different interfaces. Some layer-2

58

Compliance

Virtual Domains in Transparent mode

switches become unstable when they detect these duplicate MAC addresses. Unstable switches may become unreliable or reset and cause network traffic to slow down considerably. When you are using VLANs in Transparent mode, the solution to the duplicate MAC address issue is to use the forward-domain CLI command. This command tags VLAN traffic as belonging to a particular collision group, and only VLANs tagged as part of that collision group receive that traffic—it is like an additional set of VLANs. By default, all interfaces and VLANs are part of forward-domain collision group 0. To assign VLAN 200 to collision group 2, VLAN 300 to collision group 3, and all other interfaces to stay in the default collision group 0 enter the following CLI commands: config system interface edit vlan200 set vlanid 200 set forward_domain 2 next edit vlan300 set vlanid 300 set forward_domain 3 next end

When using forwarding domains, you may experience connection issues with layer-2 traffic, such as ping, if your network configuration has l

packets going through the FortiGate unit in Transparent mode multiple times,

l

more than one forwarding domain (such as incoming on one forwarding domain and outgoing on another)

l

IPS and AV enabled.

Spanning Tree Protocol VDOMs and FortiGate units do not participate in the Spanning Tree Protocol (STP). STP is an IEEE 802.1 protocol that ensures there are no layer-2 loops on the network. Loops are created when there is more than one route for traffic to take and that traffic is broadcast back to the original switch. This loop floods the network with traffic, quickly reducing available bandwidth to zero. If you use your VDOM or FortiGate unit in a network topology that relies on STP for network loop protection, you need to make changes to your FortiGate configuration. Otherwise, STP recognizes your FortiGate unit as a blocked link and forwards the data to another path. By default, your FortiGate unit blocks STP as well as other non-IP protocol traffic. Using the CLI, you can enable forwarding of STP and other layer-2 protocols through the interface. In this example, layer-2 forwarding is enabled on the port2 interface: config global config system interface edit port2 set l2forward enable set stpforward enable next end

There are different CLI commands to allow other common layer-2 protocols such as IPX, PPTP or L2TP on the network. For more information, see the FortiOS CLI Reference.

59

Compliance


Differences between NAT/Route and Transparent mode The differences between NAT/Route mode and Transparent mode include:

Differences between NAT/Route and Transparent modes Features

NAT/Route mode

Transparent mode

Specific Management IP address required

No

Yes

Perform Network Address Translation (NAT)

Yes

Yes

Stateful packet inspection

Yes

Yes

Layer-2 forwarding

Yes

Yes

Layer-3 routing

Yes

No

Unicast Routing / Policy Based routing

Yes

No

DH server

Yes

No

IPsec VPN

Yes

Yes

PPTP/L2TP VPN

Yes

No

SSL VPN

Yes

No

Security features

Yes

Yes

VLAN

Yes

Yes - limited to VLAN trunks.

Ping servers (dead gateway detection)

Yes

No

To provide istrative access to a FortiGate unit or VDOM in Transparent mode, you must define a management IP address and a gateway. This step is not required in NAT/Route mode where you can access the FortiGate unit through the assigned IP address of any interface where istrative access is permitted. If you incorrectly set the Transparent mode management IP address for your FortiGate unit, you will be unable to access your unit through the web-based manager. In this situation, you will need to connect to the FortiGate unit using the console cable and change the settings so you can access the unit. Alternately, if your unit has an LCD , you can change the operation mode and interface information through the LCD .

60

Compliance


Operation mode differences in VDOMs A VDOM, such as root, can have a maximum of 255 interfaces in Network Address Translation (NAT) mode or Transparent mode. This includes VLANs, other virtual interfaces, and physical interfaces. To have more than a total of 255 interfaces configured, you need multiple VDOMs with multiple interfaces on each. In Transparent mode without VDOMs enabled, all interfaces on the FortiGate unit act as a bridge — all traffic coming in on one interface is sent back out on all the other interfaces. This effectively turns the FortiGate unit into a two interface unit no matter how many physical interfaces it has. When VDOMs are enabled, this allows you to determine how many interfaces to assign to a VDOM running in Transparent mode. If there are reasons for asg more than two interfaces based on your network topology, you are able to. However, the benefit of VDOMs in this case is that you have the functionality of Transparent mode, but you can use interfaces for NAT/Route traffic as well. You can add more VDOMs to separate groups of VLAN subinterfaces. When using a FortiGate unit to serve multiple organizations, this configuration simplifies istration because you see only the security policies and settings for the VDOM you are configuring. For information on adding and configuring virtual domains, see Benefits of Virtual Domains. One essential application of VDOMs is to prevent problems caused when a FortiGate unit is connected to a layer2 switch that has a global MAC table. FortiGate units normally forward ARP requests to all interfaces, including VLAN subinterfaces. It is then possible for the switch to receive duplicate ARP packets on different VLANs. Some layer-2 switches reset when this happens. As ARP requests are only forwarded to interfaces in the same VDOM, you can solve this problem by creating a VDOM for each VLAN. For a configuration example, see Example of VDOMs in Transparent mode.

Configuring VDOMs in Transparent mode In Transparent mode, your FortiGate unit becomes a layer-2 bridge — any traffic coming in on one port is broadcast out on all the other ports. If your FortiGate unit has many interfaces, this is not the best use of those interfaces. VDOMs can limit Transparent mode to only a few interfaces while allowing the rest of the FortiGate unit to remain in NAT/Route mode. The essential steps to configure your FortiGate unit to work with VLANs in Transparent mode are: l

Switching to Transparent mode

l

Adding VLAN subinterfaces

l

Creating security policies

You can also configure the security profiles that manage antivirus scanning, web filtering and spam filtering. In Transparent mode, you can access the FortiGate web-based manager by connecting to an interface configured for istrative access and using HTTPS to access the management IP address. On the FortiGateunit used for examples in this guide, istrative access is enabled by default on the internal interface and the default management IP address is 10.11.0.1.

61

Compliance


Switching to Transparent mode A VDOM is in NAT/Route mode by default when it is created. You must switch it to Transparent mode, and add a management IP address so you can access the VDOM from your management computer.

Before applying the change to Transparent mode, ensure the VDOM has istrative access on the selected interface, and that the selected management IP address is reachable on your network.

To switch the tpVDOM VDOM to Transparent mode - web-based manager: 1. Go to Global > VDOM > VDOM. 2. Edit the tpVDOM. 3. Select Transparent for Operation mode. 4. Enter the management IP/Netmask. The IP address must be accessible to the subnet where the management computer is located. For example 10.11.0.99/255.255.255.0 will be able to access the 10.11.0.0 subnet. 5. Select Apply. When you select Apply, the FortiGate unit will log you out. When you log back in, the VDOM will be in Transparent mode.

To switch the tpVDOM VDOM to Transparent mode - CLI: config vdom edit tpVDOM config system settings set opmode transparent set mangeip 10.11.0.99 255.255.255.0 end end

Adding VLAN subinterfaces There are a few differences when adding VLANs in Transparent mode compared to NAT/Route mode. In Transparent mode, VLAN traffic is trunked across the VDOM. That means VLAN traffic cannot be routed, changed, or inspected. For this reason when you assign a VLAN to a Transparent mode VDOM, you will see the Addressing Mode section of the interface configuration disappear in from the web-based manager. It is because with no routing, inspection, or any activities able to be performed on VLAN traffic the VDOM simply rebroadcasts the VLAN traffic. This requires no addressing. Also any routing related features such as dynamic routing or Virtual Router Redundancy Protocol (VRRP) are not available in Transparent mode for any interfaces.

Creating security policies Security policies permit communication between the FortiGate unit’s network interfaces based on source and destination IP addresses. Typically you will also limit communication to desired times and services for additional

62

Compliance


security. In Transparent mode, the FortiGate unit performs antivirus and antispam scanning on each packet as it es through the unit. You need security policies to permit packets to from the VLAN interface where they enter the unit to the VLAN interface where they exit the unit. If there are no security policies configured, no packets will be allowed to from one interface to another. For more information, see the FortiGate istration Guide.

Example of VDOMs in Transparent mode In this example, the FortiGate unit provides network protection to two organizations — Company A and Company B. Each company has different policies for incoming and outgoing traffic, requiring three different security policies and protection profiles. VDOMs are not required for this configuration, but by using VDOMs the profiles and policies can be more easily managed on a per-VDOM basis either by one central or separate s for each company. Also future expansion is simply a matter of adding additional VDOMs, whilst not disrupt the existing VDOMs. For this example, firewalls are only included to deal with web traffic. This is to provide an example without making configuration unnecessarily complicated. This example includes the following sections: l


l

General configuration steps

l

Configuring common items

l

Creating virtual domains

l

Configuring the Company_A VDOM

l

Configuring the Company_B VDOM

l


l


Network topology and assumptions Each organization’s internal network consists of a different range of IP addresses: l

10.11.0.0.0/255.255.0.0 for Company A.

l

10.12.0.0/255.255.0.0 for Company B.

For the procedures in this section, it is assumed that you have enabled VDOM configuration on your FortiGate unit. For more information, see Enabling and accessing Virtual Domains. The VDOM names are similar to the company names for easy recognition. The root VDOM cannot be renamed and is not used in this example. Interfaces used in this example are port1 and port2. Some FortiGate models may not have interfaces with these names. port1 is an external interface. port2 is an internal interface.

63

Compliance


Figure 10: VLAN and VDOM Transparent example network topology

192.168.0.1 10.0.0.1 VLAN Router VLAN Trunk VLAN_100_ext VLAN_200_ext

port1

in TTransparent mode

VLAN_100_ext VLAN_200_ext

port2 port po rt2 rt 2

VLAN Trunk

Fa0/8

Fa0/5 Fa

Fa Fa0/ 0/1 0/ 1 Fa0/1

Switch VL Switc VLAN

Company B VLAN ID 200 10.12.0.0 Company A VLAN ID 100 10.11.0.0

General configuration steps The following steps summarize the configuration for this example. For best results, follow the procedures in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results. 1. Configuring common items 2. Creating virtual domains 3. Configuring the Company_A VDOM 4. Configuring the Company_B VDOM 5. Virtual Domains in Transparent mode 6. Testing the configuration

Configuring common items Both VDOMs require you configure security profiles. These will be configured the same way, but need to be configured in both VDOMs.

64

Compliance


The relaxed profile allows s to surf websites they are not allowed to visit during normal business hours. Also a quota is in place to restrict s to one hour of access to these websites to ensure employees do not take long and unproductive lunches.

To create a strict web filtering profile - web-based manager: 1. Go to the proper VDOM, and select Security Profiles > Web Filter > Profile. 2. Select Create New. 3. Enter strict for the Name. 4. Expand FortiGuard Web Filtering, and select block for all Categories except Business Oriented, and Other. 5. Block all Classifications except Cached Content, and Image Search. 6. Ensure FortiGuard Quota for all Categories and Classifications is Disabled. 7. Select OK.

To create a strict web filtering profile - CLI: config vdom edit config webfilter profile edit strict config ftgd-wf set allow g07 g08 g21 g22 c01 c03 set deny g01 g02 g03 g04 g05 g06 c02 c04 c05 c06 c07 end set web-ftgd-err-log enable end

To create a relaxed web filtering profile - web-based manager: 1. Go to the proper VDOM, and select Security Profiles > Web Filter > Profile. 2. Select Create New. 3. Enter relaxed for the Name. 4. Expand FortiGuard Web Filtering, and select block for Potentially Security Violating Category, and Spam URL Classification. 5. Enable FortiGuard Quotas to allow 1 hour for all allowed Categories and Classifications.

Creating virtual domains The FortiGate unit s 10 virtual domains. Root is the default VDOM. It cannot be deleted or renamed. The root VDOM is not used in this example. New VDOMs are created for Company A and Company B

To create the virtual domains - web-based manager: 1. With VDOMs enabled, select System > VDOM > VDOM. 2. Select Create New. 3. Enter Company_A for Name, and select OK. 4. Select Create New. 5. Enter Company_B for Name, and select OK.

65

Compliance


To create the virtual domains - CLI: config system vdom edit Company_A next edit Company_B end

Configuring the Company_A VDOM This section describes how to add VLAN subinterfaces and configure security policies for the Company_A VDOM. This section includes the following topics: l


l

Creating the Lunch schedule

l

Configuring Company_A firewall addresses

l

Creating Company_A security policies

Adding VLAN subinterfaces You need to create a VLAN subinterface on the port2 interface and another one on the port1 interface, both with the same VLAN ID.

To add VLAN subinterfaces - web-based manager: 1. Go to System > Network > Interfaces. 2. Select Create New. 3. Enter the following information and select OK: Name

VLAN_100_int

Interface

port2

VLAN ID

100

Virtual Domain

Company_A

4. Select Create New. 5. Enter the following information and select OK: Name

VLAN_100_ext

Interface

port1

VLAN ID

100

Virtual Domain

Company_A

To add the VLAN subinterfaces - CLI: config system interface

66

Compliance


edit VLAN_100_int set interface port2 set vlanid 100 set vdom Company_A next edit VLAN_100_ext set interface port1 set vlanid 100 set vdom Company_A end

Creating the Lunch schedule Both organizations have the same lunch schedule, but only Company A has relaxed its security policy to allow employees more freedom in accessing the Internet during lunch. Lunch schedule will be Monday to Friday from 11:45am to 2:00pm (14:00).

To create a recurring schedule for lunchtime - web-based manager: 1. In Company_A VDOM, go to Firewall Objects > Schedule > Recurring. 2. Select Create New. 3. Enter Lunch as the name for the schedule. 4. Select Mon, Tues, Wed, Thu, and Fri. 5. Set the Start time as 11:45 and set the Stop time as 14:00. 6. Select OK.

To create a recurring schedule for lunchtime - CLI: config vdom edit Company_A config firewall schedule recurring edit Lunch set day monday tuesday wednesday thursday friday set start 11:45 set end 14:00 end

Configuring Company_A firewall addresses For Company A, its networks are all on the 10.11.0.0 network, so restricting addresses to that domain provides added security.

To configure Company_A firewall addresses - web-based manager: 1. In the Company_A VDOM, go to Firewall Objects > Address > Address. 2. Select Create New. 3. Enter CompanyA in the Address Name field. 4. Type 10.11.0.0/255.255.0.0 in the Subnet / IP Range field. 5. Select OK.

To configure vdomA firewall addresses - CLI: config firewall address

67

Compliance


edit CompanyA set type ipmask set subnet 10.11.0.0 255.255.0.0 end

Creating Company_A security policies A security policy can include varying levels of security feature protection. This example only deals with web filtering. The following security policies use the custom security strict and relaxed profiles configured earlier. See Configuring common items. For these security policies, we assume that all protocols will be on their standard ports, such as port 80 for http traffic. If the ports are changed, such as using port 8080 for http traffic, you will have to create custom services for protocols with non-standard ports, and assign them different names. The firewalls configured in this section are: l

internal to external — always deny all

l

external to internal — always deny all

l

internal to external — always allow all, security features - web filtering: strict

l

internal to external — Lunch allow all, security features - web filtering:relaxed

Security policies allow packets to travel between the internal VLAN_100 interface to the external interface subject to the restrictions of the protection profile. Entering the policies in this order means the last one configured is at the top of the policy list, and will be checked first. This is important because the policies are arranged so if one does not apply the next is checked until the end of the list.

To configure Company_A security policies - web-based manager: 1. Go to Policy > Policy. 2. Select Create New. 3. Enter the following information and select OK: Source Interface/Zone

VLAN_100_int

Source Address

CompanyA


VLAN_100_ext

Destination Address

all

Schedule

always

Service

all

Action

DENY

This policy is a catch all for outgoing traffic to ensure that if it doesn’t match any of the other policies, it will not be allowed. This is standard procedure. 4. Select Create New. 5. Enter the following information and select OK:

68

Compliance


Source Interface/Zone

VLAN_100_ext

Source Address

all


VLAN_100_int

Destination Address

CompanyA

Schedule

always

Service

all

Action

DENY

This policy is a catch all for incoming traffic to ensure that if it doesn’t match any of the other policies, it will not be allowed. This is standard procedure. 6. Select Create New. 7. Enter the following information and select OK: Source Interface/Zone

VLAN_100_int

Source Address

CompanyA


VLAN_100_ext

Destination Address

all

Schedule

always

Service

all

Action

ACCEPT

Security Features

enable

Web Filtering

strict

This policy enforces strict scanning at all times, while allowing all traffic. It ensures company policies are met for network security. 8. Select Create New. 9. Enter the following information and select OK: Source Interface/Zone

VLAN_100_int

Source Address

CompanyA


VLAN_100_ext

Destination Address

all

Schedule

Lunch

69

Compliance


Service

all

Action

ACCEPT

Security Features

enable

Web Filtering

relaxed

This policy provides relaxed protection during lunch hours — going from strict down to scan for protocol options and web filtering. AntiVirus and Email Filtering remain at strict for security — relaxing them would not provide employees additional access to the Internet and it would make the company vulnerable. 10. that the policies entered appear in the list with the last policy (lunch) at the top, and the first policy (deny all) at the bottom. Otherwise traffic will not flow as expected.

To configure Company_A security policies - CLI: config vdom edit Company_A config firewall policy edit 1 set srcintf VLAN_100_int set dstintf VLAN_100_ext set srcaddr all set dstaddr all set action accept set schedule Lunch set webfiltering relaxed next edit 3 set srcintf VLAN_100_int set dstintf VLAN_100_ext set srcaddr all set dstaddr all set action accept set schedule BusinessDay set service HTTP set profile_status enable set profile BusinessOnly end

Configuring the Company_B VDOM This section describes how to add VLAN subinterfaces and configure security policies for the Company B VDOM. This section includes the following topics: l


l

Creating Company_B service groups

l

Configuring Company_B firewall addresses

l

Configuring Company_B security policies

70

Compliance


Adding VLAN subinterfaces You need to create a VLAN subinterface on the internal interface and another one on the external interface, both with the same VLAN ID.

To add VLAN subinterfaces - web-based manager: 1. Go to System > Network > Interfaces. 2. Select Create New. 3. Enter the following information and select OK: Name

VLAN_200_int

Interface

port2

VLAN ID

200

Virtual Domain

Company_B

4. Select Create New. 5. Enter the following information and select OK: Name

VLAN_200_ext

Interface

port1

VLAN ID

200

Virtual Domain

Company_B

To add the VLAN subinterfaces - CLI: config system interface edit VLAN_200_int set interface internal set vlanid 200 set vdom Company_B next edit VLAN_200_ext set interface external set vlanid 200 set vdom Company_B end

Creating Company_B service groups Company_B does not want its employees to use any online chat software except NetMeeting, which the company uses for net conferencing. To simplify the creation of a security policy for this purpose, you create a service group that contains all of the services you want to restrict. A security policy can manage only one service or one group.

71

Compliance


To create a chat service group - web-based manager: 1. Go to Firewall Objects > Service > Groups. 2. Select Create New. 3. Enter Chat in the Group Name field. 4. For each of IRC, AOL, SIP-MSNmessenger and TALK, select the service in the Available Services list and select the right arrow to add it to the list. If a particular service does not appear in the Available Services list, see the list in Firewall Objects > Service > Services. Some services do not appear by default unless edited. 5. Select OK.

To create a games and chat service group - CLI: config firewall service group edit Chat set member IRC SIP-MSNmessenger AOL TALK end

Configuring Company_B firewall addresses Company B’s network is all in the 10.12.0.0 network. Security can be improved by only allowing traffic from IP addresses on that network.

To configure Company_B firewall address - web-based manager: 1. In the Company_B VDOM, go to Firewall Objects > Address > Address. 2. Select Create New. 3. Enter new in the Address Name field. 4. Type 10.12.0.0/255.255.0.0 in the Subnet / IP Range field. 5. Select OK.

To configure Company_B firewall addresses - CLI: config vdom edit Company_B config firewall address edit all set type ipmask set subnet 10.12.0.0 255.255.0.0 end

Configuring Company_B security policies Security policies allow packets to travel between the internal and external VLAN_200 interfaces subject to the restrictions of the protection profile.

To configure Company_B security policies - web-based manager: 1. Go to Policy > Policy. 2. Select Create New.

72

Compliance


3. Enter the following information and select OK: Source Interface/Zone

VLAN_200_int

Source Address

all


VLAN_200_ext

Destination Address

all

Schedule

BusinessDay

Service

games-chat

Action

DENY

This policy prevents the use of network games or chat programs (except NetMeeting) during business hours. 4. Enter the following information and select OK: Source Interface/Zone

VLAN_200_int

Source Address

all


VLAN_200_ext

Destination Address

all

Schedule

Lunch

Service

HTTP

Action

ACCEPT

Protection Profile

Relaxed

This policy relaxes the web category filtering during lunch hour. 5. Select Create New. 6. Enter the following information and select OK: Source Interface/Zone

VLAN_200_int

Source Address

all


VLAN_200_ext

Destination Address

all

Schedule

BusinessDay

Service

HTTP

73

Compliance


Action

ACCEPT

Protection Profile

BusinessOnly

This policy provides rather strict web category filtering during business hours. 7. Select Create New. 8. Enter the following information and select OK: Source Interface/Zone

VLAN_200_int

Source Address

all


VLAN_200_ext

Destination Address

all

Schedule

always

Service

ANY

Action

ACCEPT

Protection Profile

Relaxed

Because it is last in the list, this policy applies to the times and services not covered in preceding policies. This means that outside of regular business hours, the Relaxed protection profile applies to email and web browsing, and online chat and games are permitted. Company B needs this policy because its employees sometimes work overtime. The other companies in this example maintain fixed hours and do not want any after-hours Internet access.

To configure Company_B security policies - CLI: config firewall policy edit 1 set srcintf VLAN_200_int set srcaddr all set dstintf VLAN_200_ext set dstaddr all set schedule BusinessDay set service Games set action deny next edit 2 set srcintf VLAN_200_int set srcaddr all set dstintf VLAN_200_ext set dstaddr all set action accept set schedule Lunch set service HTTP set profile_status enable set profile Relaxed next edit 3

74

Compliance


set set set set set set set set set next edit 4 set set set set set set set set set end

srcintf VLAN_200_int srcaddr all dstintf VLAN_200_ext dstaddr all action accept schedule BusinessDay service HTTP profile_status enable profile BusinessOnly

srcintf VLAN_200_int srcaddr all dstintf VLAN_200_ext dstaddr all action accept schedule always service ANY profile_status enable profile Relaxed

Testing the configuration Use diagnostic commands, such as tracert, to test traffic routed through the network. You should test traffic between the internal VLANs as well as from the internal VLANs to the Internet to ensure connectivity. For additional troubleshooting, see Troubleshooting Virtual Domains. This section includes the following topics: l

Testing traffic from VLAN_100 to the Internet

l

Testing traffic from VLAN_100 to VLAN_200

Testing traffic from VLAN_100 to the Internet In this example, a route is traced from VLANs to a host on the Internet. The route target is www.example.com. From a host on VLAN_100, access a command prompt and enter this command: C:\>tracert www.example.com Tracing route to www.example.com [208.77.188.166] over a maximum of 30 hops: 1 <10 ms <10 ms <10 ms 10.100.0.1 ... 14 172 ms 141 ms 140 ms 208.77.188.166 Trace complete.

The number of steps between the first and the last hop, as well as their IP addresses, will vary depending on your location and ISP. However, all successful tracerts to www.example.com will start and end with these lines. Repeat the tracert for VLAN_200. The tracert for each VLAN will include the gateway for that VLAN as the first step. Otherwise, the tracert should be the same for each VLAN.

75

Compliance


Testing traffic from VLAN_100 to VLAN_200 In this example, a route is traced between two internal networks. The route target is a host on VLAN_200. The Windows traceroute command tracert is used. From VLAN_100, access a Windows command prompt and enter this command: C:\>tracert 10.12.0.2 Tracing route to 10.12.0.2 over a maximum of 30 hops: 1 <10 ms <10 ms <10 ms 10.100.0.1 2 <10 ms <10 ms <10 ms 10.12.0.2 Trace complete.

You can repeat this for different routes in the topology. In each case the IP addresses will be the gateway for the starting VLAN, and the end point at the ending VLAN.

76

Compliance

Inter-VDOM routing In the past, virtual domains (VDOMs) were separate from each other—there was no internal communication. Any communication between VDOMs involved traffic leaving on a physical interface belonging to one VDOM and reentering the FortiGate unit on another physical interface belonging to another VDOM to be inspected by firewall policies in both directions. Inter-VDOM routing changes this. With VDOM links, VDOMs can communicate internally without using additional physical interfaces. Inter-VDOM routing is the communication between VDOMs. VDOM links are virtual interfaces that connect VDOMs. A VDOM link contains a pair of interfaces with each one connected to a VDOM, and forming either end of the inter-VDOM connection. This chapter contains the following sections: l

Benefits of inter-VDOM routing

l

Getting started with VDOM links

l

Dynamic routing over inter-VDOM links

l

HA virtual clusters and VDOM links

l

Example of inter-VDOM routing

Benefits of inter-VDOM routing Inter-VDOM routing has a number of advantages over independent VDOM routing. These benefits include: l

Freed-up physical interfaces

l

More speed than physical interfaces

l

Continued for secure firewall policies

l

Configuration flexibility

Freed-up physical interfaces Tying up physical interfaces on the FortiGate unit presents a problem. With a limited number of interfaces available, configuration options for the old style of communication between VDOMs are very limited. VLANs can be an answer to this, but they have some limitations. For example, the FortiGate-800 has 8 physical ethernet ports. If they are assigned 2 per VDOM (one each for external and internal traffic) there can only be 4 VDOMs at most configured, not the 10 VDOMs the license will allow. Adding even one additional interface per VDOM to be used to communicate between VDOMs leaves only 2 VDOMs for that configuration, since it would required 9 interfaces for 3 VDOMs. Even using one physical interface for both external traffic and inter-VDOM communication would severely lower the available bandwidth for external traffic on that interface. With the introduction of inter-VDOM routing, traffic can travel between VDOMs internally, freeing up physical interfaces for external traffic. Using the above example we can use the 4 VDOM configuration and all the interfaces will have their full bandwidth.

77

Compliance

Inter-VDOM routing

More speed than physical interfaces Internal interfaces are faster than physical interfaces. Their speed depends on the FortiGate unit U and its load. That means that an inter-VDOM link interface will be faster than a outbound physical interface connected to another inbound physical interface. Inter-VDOM links are U bound, and cannot be part of an accelerated pair of interfaces. However, while one virtual interface with normal traffic would be considerably faster than on a physical interface, the more traffic and more internal interfaces you configure, the slower they will become until they are slower than the physical interfaces. U load can come from other sources such as AV or content scanning. This produces the same effect—internal interfaces such as inter-VDOM links will be slower.

Continued for secure firewall policies VDOMs help to separate traffic based on your needs. This is an important step in satisfying regulations that require proof of secure data handling. This is especially important to health, law, ing, and other businesses that handle sensitive data every day. By keeping things separate, traffic has to leave the FortiGate unit and re-enter to change VDOMs. This forces traffic to go through the firewall when leaving and enter through another firewall, keeping traffic secure. With inter-VDOM routing, the need for the physical interfaces is greatly reduced. However, firewall policies still need to be in place for traffic to through any interface, physical or virtual, and thus provide the same level of security both internally and externally. Configuration of firewall policies is the same for inter-VDOM links as for any other interface, and your data will continue to have the high level of security.

Configuration flexibility A typical VDOM uses at least two interfaces, typically physical interfaces, one for internal and one for external traffic. Depending on the configuration, more interfaces may be required. This means that the maximum number of VDOMs configurable on a FortiGate unit using physical interfaces is the number of interfaces available divided by two. VLANs can increase the number by providing multiple virtual interfaces over a single physical interface, but VLANs have some limitations. Using physical interfaces for inter-VDOM communication therefore limits the number of possible configurations on your FortiGate unit. To overcome this limitation, inter-VDOM links can be created within the FortiGate unit. Using virtual interfaces, inter-VDOM links free up the physical interfaces for external traffic. Using VDOM links on a FortiGate unit with 8 physical interfaces, you can have 4 VDOMs communicating with each other (meshed configuration) and continue to have 2 physical interfaces each for internal and external connections. This configuration would have required 20 physical interfaces without inter-VDOM routing. With inter-VDOM routing it only requires 8 physical interfaces, with the other 12 interfaces being internal VDOM links. Inter-VDOM routing allows you to make use of Standalone VDOM configuration, Management VDOM configuration, and Meshed VDOM configuration without being limited by the number of physical interfaces on your FortiGate unit.

78

Compliance

Inter-VDOM routing

Getting started with VDOM links Once VDOMs are configured on your FortiGate unit, configuring inter-VDOM routing and VDOM-links is very much like creating a VLAN interface. VDOM-links are managed through the web-based manager or CLI. In the web-based manager, VDOM link interfaces are managed in the network interface list. This section includes the following topics: l

Viewing VDOM links

l

Creating VDOM links

l

Deleting VDOM links

l

NAT to Transparent VDOM links

Viewing VDOM links VDOM links are displayed on the network interface list in the web-based manager. You can view VDOM links only if you are using a super_ and in global configuration. To view the network interface list, in the Global menu go to System > Network > Interfaces.

Interface list displaying interface names and information

Create New

Select the arrow to create a new interface or VDOM link. Interface options include VLAN, Aggregate, Redundant, or loopback interfaces. For more information, see Creating VDOM links.

79

Compliance

Inter-VDOM routing

Select to change interface configuration for the selected interface. Edit This option not available if no interfaces or multiple interfaces are selected. Delete

Select to remove an interface from the list. One or more interfaces must be selected for this option to be available. You cannot delete permanent physical interfaces, or any interfaces that have configuration referring to them. See Deleting VDOM links or see Deleting an interface.

Column Settings

Select to change which information is displayed about the interfaces, and in which order the columns appear. Use to display VDOM, VLAN, and other information.

Checkbox

Select the checkbox for an interface to edit or delete that interface. Select multiple interfaces to delete those interfaces. Optionally select the check box at the top of the column to select or unselect all checkboxes. The name of the interface.

Name

The name of the VDOM link (vlink1) has an expand arrow to display or hide the pair of VDOM link interfaces. For more information, see Viewing VDOM links.

IP/Netmask

The IP address and netmask assigned to this interface.

Type

The type of interface such as physical, VLAN, or VDOM link pair.

Access

The protocols allowed for s to connect to the FortiGate unit.

istrative Status

The status of this interface, either set to up (active) or down (disabled).

Virtual Domain

The virtual domain this interface belongs to. For more information on VDOMs, see Virtual Domains in NAT/Route mode.

Creating VDOM links VDOM links connect VDOMs together to allow traffic to between VDOMs as per firewall policies. InterVDOM links are virtual interfaces that are very similar to VPN tunnel interfaces except inter-VDOM links do not require IP addresses. See IP addresses and inter-VDOM links. To create a VDOM link, you first create the point-to-point interface, and then bind the two interface objects associated with it to the virtual domains. In creating the point-to-point interface, you also create two additional interface objects by default. They are called vlink10 and vlink11 - the interface name you chose with a 1 or a 0 to designate the two ends of the link.

80

Compliance

Inter-VDOM routing

Once the interface objects are bound, they are treated like normal FortiGate interfaces and need to be configured just like regular interfaces. The assumptions for this example are as follows: l

l

Your FortiGate unit has VDOMs enabled and you have 2 VDOMs called customer1 and customer2 already configured. For more information on configuring VDOMs see Configuring Virtual Domains. You are using a super_

To configure an inter-VDOM link - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select Create New > VDOM link, enter the following information, and select OK. Name

vlink1 (The name can be up to 11 characters long. Valid characters are letters, numbers, “-”, and “_”. No spaces are allowed.)

Interface #0 Virtual Domain

customer1

IP/Netmask

10.11.12.13/255.255.255.0

istrative Access

HTTPS, SSL


customer2

IP/Netmask

172.120.100.13/255.255.255.0

istrative Access

HTTPS, SSL

To configure an inter-VDOM link - CLI: config global config system vdom-link edit vlink1 end config system interface edit vlink10 set vdom customer1 next edit vlink11 set vdom customer2 end

Once you have created and bound the interface ends to VDOMs, configure the appropriate firewall policies and other settings that you require. To confirm the inter-VDOM link was created, find the VDOM link pair and use the expand arrow to view the two VDOM link interfaces. You can select edit to change any information.

81

Compliance

Inter-VDOM routing

IP addresses and inter-VDOM links Besides being virtual interfaces, here is one main difference between inter-VDOM links and regular interfaces— default inter-VDOM links do not require IP addresses. IP addresses are not required by default because an interVDOM link is an internal connection that can be referred to by the interface name in firewall policies, and other system references. This introduces three possible situations with inter-VDOM links that are: l

unnumbered - an inter-VDOM link with no IP addresses for either end of the tunnel

l

half numbered - an inter-VDOM link with one IP address for one end and none for the other end

l

full numbered - an inter-VDOM link with two IP addresses, one for each end.

Not using an IP address in the configuration can speed up and simplify configuration for you Also you will not use up all the IP addresses in your subnets if you have many inter-VDOM links. Half or full numbered interfaces are required if you are doing NAT, either SNAT or DNAT as you need an IP number on both ends to translate between. You can use unnumbered interfaces in static routing, by naming the interface and using 0.0.0.0 for the gateway. Running traceroute will not show the interface in the list of hops. However you can see the interface when you are sniffing packets, which is useful for troubleshooting.

Deleting VDOM links When you delete the VDOM link, the two link objects associated with it will also be deleted. You cannot delete the objects by themselves. The example uses a VDOM routing connection called “vlink1”. Removing vlink1 will also remove its two link objects vlink10 and vlink11.

Before deleting the VDOM link, ensure all policies, firewalls, and other configurations that include the VDOM link are deleted, removed, or changed to no longer include the VDOM link.

To remove a VDOM link - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select Delete for the VDOM link vlink1.

To remove a VDOM link - CLI: config global config system vdom-link delete vlink1 end

For more information, see the FortiGate CLI Reference.

NAT to Transparent VDOM links Inter-VDOM links can be created between VDOMs in NAT mode and VDOMs in Transparent mode, but it must be done through the CLI, as the VDOM link type must be changed from the default PPP to Ethernet for the two VDOMs to communicate. The below example assumes one vdom is in NAT mode and one is Transparent.

82

Compliance

Inter-VDOM routing

An IP address must be assigned to the NAT VDOM’s interface, but no IP address should be assigned to the Transparent VDOM’s interface.

To configure a NAT to Transparent VDOM link - CLI: config global config system vdom-link edit vlink1 set type ethernet end config system interface edit vlink10 set vdom (interface 1 name) set ip (interface 1 ip) next edit vlink11 set vdom (interface 2 name) end

Ethernet-type is not recommended for standard NAT to NAT inter-VDOM links, as the default PPP-type link does not require the VDOM links to have addresses, while Ethernet-type does. VDOM link addresses are explained in IP addresses and inter-VDOM links.

Inter-VDOM configurations By using fewer physical interfaces to inter-connect VDOMs, inter-VDOM links provide you with more configuration options. None of these configurations use VLANs to reduce the number of physical interfaces. It is generally assumed that an internal or client network will have its own internal interface and an external interface to connect to its ISP and the Internet. These inter-VDOM configurations can use any FortiGate model with possible limitations based on the number of physical interfaces. VLANs can be used to work around these limitations. In the following inter-VDOM diagrams, red indicates the physical FortiGate unit, grey indicate network connections external to the FortiGate unit, and black is used for inter-VDOM links and VDOMs. This section includes the following topics: l

Standalone VDOM configuration

l

Independent VDOMs configuration

l

Management VDOM configuration

l

Meshed VDOM configuration

Standalone VDOM configuration The standalone VDOM configuration uses a single VDOM on your FortiGate unit — the root VDOM that all FortiGate units have by default. This is the VDOM configuration you are likely familiar with. It is the default configuration for FortiGate units before you create additional VDOMs.

83

Compliance

Inter-VDOM routing

Standalone VDOM

The configuration shown above has no VDOM inter-connections and requires no special configurations or settings. The standalone VDOM configuration can be used for simple network configurations that only have one department or one company istering the connections, firewalls and other VDOM-dependent settings. However, with this configuration, keeping client networks separate requires many interfaces, considerable firewall design and maintenance, and can quickly become time consuming and complex. Also, configuration errors for one client network can easily affect other client networks, causing unnecessary network downtime.

Independent VDOMs configuration The independent VDOMs configuration uses multiple VDOMs that are completely separate from each other. This is another common VDOM configuration.

84

Compliance

Inter-VDOM routing

Independent VDOMs

This configuration has no communication between VDOMs and apart from initially setting up each VDOM, it requires no special configurations or settings. Any communication between VDOMs is treated as if communication is between separate physical devices. The independent inter-VDOM configuration can be used where more than one department or one company is sharing the FortiGate unit. Each can ister the connections, firewalls and other VDOM-dependent settings for only its own VDOM. To each company or department, it appears as if it has its own FortiGate unit. This configuration reduces the amount of firewall configuration and maintenance required by dividing up the work. However, this configuration lacks a management VDOM for VDOMs 1, 2, and 3. This is illustrated in Figure 50. This management VDOM would enable an extra level of control for the FortiGate unit , while still allowing each company or department to ister its own VDOM.

Management VDOM configuration In the management VDOM configuration, the root VDOM is the management VDOM. The other VDOMs are connected to the management VDOM with inter-VDOM links. There are no other inter-VDOM connections.

85

Compliance

Inter-VDOM routing

Management VDOM configuration

The inter-VDOM links connect the management VDOM to the other VDOMs. This does not require any physical interfaces, and the bandwidth of inter-VDOM links can be faster than physical interfaces, depending on the U workload. Only the management VDOM is connected to the Internet. The other VDOMs are connected to internal networks. All external traffic is routed through the management VDOM using inter-VDOM links and firewall policies between the management VDOM and each VDOM. This ensures the management VDOM has full control over access to the Internet, including what types of traffic are allowed in both directions. There is no communication directly between the non-root VDOMs. Security is greatly increased with only one point of entry and exit. Only the management VDOM needs to be fully managed to ensure network security in this case. Each client network can manage its own configuration without compromising security or bringing down another client network. The management VDOM configuration is ideally suited for a service provider business. The service provider isters the management VDOM with the other VDOMs as customers. These customers do not require a dedicated IT person to manage their network. The service provider controls the traffic and can prevent the customers from using banned services and prevent Internet connections from initiating those same banned services. One example of a banned service might be Instant Messaging (IM) at a company concerned about intellectual property. Another example could be to limit bandwidth used by file-sharing applications without banning that application completely. Firewall policies control the traffic between the customer VDOM and the management VDOM and can be customized for each customer. The management VDOM configuration is limited in that the customer VDOMs have no inter-connections. In many situations this limitation is ideal because it maintains proper security. However, some configurations may require customers to communicate with each other, which would be easier if the customer VDOMs were interconnected.

Meshed VDOM configuration The meshed VDOMs configuration, including partial and full mesh, has VDOMs inter-connected with other VDOMs. There is no special feature to accomplish this—they are just complex VDOM configurations.

86

Compliance

Inter-VDOM routing

Partial mesh means only some VDOMs are inter-connected. In a full mesh configuration, all VDOMs are interconnected to all other VDOMs. This can be useful when you want to provide full access between VDOMs but handle traffic differently depending on which VDOM it originates from or is going to.

Meshed VDOMs

With full access between all VDOMs being possible, it is extra important to ensure proper security. You can achieve this level of security by establishing extensive firewall policies and ensuring secure access for all s and s. Meshed VDOM configurations can become complex very quickly, with full mesh VDOMs being the most complex. Ensure this is the proper solution for your situation before using this configuration. Generally, these configurations are seen as theoretical and are rarely deployed in the field.

Dynamic routing over inter-VDOM links BGP is ed over inter-VDOM links. Unless otherwise indicated, routing works as expected over inter-VDOM links. If an inter-VDOM link has no assigned IP addresses to it, it may be difficult to use that interface in dynamic routing configurations. For example BGP requires an IP address to define any BGP router added to the network. In OSPF, you can configure a router using a router ID and not its IP address. In fact, having no IP address avoids possible confusing between which value is the router ID and which is the IP address. However for that router to become adjacent with another OSPF router it will have to share the same subnet, which is technically impossible without an IP address. For this reason, while you can configure an OSPF router using an IP-less inter-VDOM link, it will likely be of limited value to you. In RIP the metric used is hop count. If the inter-VDOM link can reach other nodes on the network, such as through a default route, then it may be possible to configure a RIP router on an inter-VDOM link. However, once again it may be of limited value due to limitations.

87

Compliance

Inter-VDOM routing

As stated earlier, BGP requires an IP address to define a router — an IP-less inter-VDOM link will not work with BGP. In Multicast, you can configure an interface without using an IP address. However that interface will be unable to become an RP candidate. This limits the roles available to such an interface.

HA virtual clusters and VDOM links FortiGate HA is implemented by configuring two or more FortiGate units to operate as an HA cluster. To the network, the HA cluster appears to function as a single FortiGate unit, processing network traffic and providing normal security services such as firewall, VPN, IPS, virus scanning, web filtering, and spam filtering. Virtual clustering extends HA features to provide failover protection and load balancing for a FortiGate unit operating with virtual domains. A virtual cluster consists of a cluster of two FortiGate units operating with virtual domains. Traffic on different virtual domains can be load balanced between the cluster units. With virtual clusters (vclusters) configured, inter-VDOM links must be entirely within one vcluster. You cannot create links between vclusters, and you cannot move a VDOM that is linked into another virtual cluster. If your FortiGate units are operating in HA mode, with multiple vclusters when you create the vdom-link, the CLI command config system vdom-link includes an option to set which vcluster the link will be in.

What is virtual clustering? Virtual clustering is an extension of the FG for FortiGate units operating with multiple VDOMS enabled. Virtual clustering operates in active-ive mode to provide failover protection between two instances of a VDOM operating on two different cluster units. You can also operate virtual clustering in active-active mode to use HA load balancing to load balance sessions between cluster units. Alternatively, by distributing VDOM processing between the two cluster units you can also configure virtual clustering to provide load balancing by distributing sessions for different VDOMs to each cluster unit.

Virtual clustering and failover protection Virtual clustering operates on a cluster of two (and only two) FortiGate units with VDOMs enabled. Each VDOM creates a cluster between instances of the VDOMs on the two FortiGate units in the virtual cluster. All traffic to and from the VDOM stays within the VDOM and is processed by the VDOM. One cluster unit is the primary unit for each VDOM and one cluster unit is the subordinate unit for each VDOM. The primary unit processes all traffic for the VDOM. The subordinate unit does not process traffic for the VDOM. If a cluster unit fails, all traffic fails over to the cluster unit that is still operating.

Virtual clustering and heartbeat interfaces The HA heartbeat provides the same HA services in a virtual clustering configuration as in a standard HA configuration. One set of HA heartbeat interfaces provides HA heartbeat services for all of the VDOMs in the cluster. You do not have to add a heartbeat interface for each VDOM.

Virtual clustering and HA override For a virtual cluster configuration, override is enabled by default for both virtual clusters when you: l

Enable VDOM portioning from the web-based manager by moving virtual domains to virtual cluster 2

l

Enter set vcluster2 enable from the CLI config system ha command to enable virtual cluster 2.

88

Compliance

Inter-VDOM routing

Usually you would enable virtual cluster 2 and expect one cluster unit to be the primary unit for virtual cluster 1 and the other cluster unit to be the primary unit for virtual cluster 2. For this distribution to occur override must be enabled for both virtual clusters. Otherwise you will need to restart the cluster to force it to renegotiate.

Virtual clustering and load balancing or VDOM partitioning There are two ways to configure load balancing for virtual clustering. The first is to set the HA mode to activeactive. The second is to configure VDOM partitioning. For virtual clustering, setting the HA Mode to active-active has the same result as active-active HA for a cluster without virtual domains. The primary unit receives all sessions and load balances them among the cluster units according to the load balancing schedule. All cluster units process traffic for all virtual domains. Note: If override is enabled the cluster may renegotiate too often. You can choose to disable override at any time. If you decide to disable override, for best results, you should disable it for both cluster units. In a VDOM partitioning virtual clustering configuration, the HA mode is set to active-ive. Even though virtual clustering operates in active-ive mode you can configure a form of load balancing by using VDOM partitioning to distribute traffic between both cluster units. To configure VDOM partitioning you set one cluster unit as the primary unit for some virtual domains and you set the other cluster unit as the primary unit for other virtual domains. All traffic for a virtual domain is processed by the primary unit for that virtual domain. You can control the distribution of traffic between the cluster units by adjusting which cluster unit is the primary unit for each virtual domain. For example, you could have 4 VDOMs, two of which have a high traffic volume and two of which have a low traffic volume. You can configure each cluster unit to be the primary unit for one of the high volume VDOMs and one of the low volume VDOMs. As a result each cluster unit will be processing traffic for a high volume VDOM and a low volume VDOM, resulting in an even distribution of traffic between the cluster units. You can adjust the distribution at any time. For example, if a low volume VDOM becomes a high volume VDOM you can move it from one cluster unit to another until the best balance is achieved. From the web-based manager you configure VDOM partitioning by setting the HA mode to active-ive and distributing virtual domains between Virtual Cluster 1 and Virtual Cluster 2. You can also configure different device priorities, port monitoring, and remote link failover, for Virtual Cluster 1 and Virtual Cluster 2. From the CLI you configure VDOM partitioning by setting the HA mode to a-p. Then you configure device priority, port monitoring, and remote link failover and specify the VDOMs to include in virtual cluster 1. You do the same for virtual cluster 2 by entering the config secondary-vcluster command. Failover protection does not change. If one cluster unit fails, all sessions are processed by the remaining cluster unit. No traffic interruption occurs for the virtual domains for which the still functioning cluster unit was the primary unit. Traffic may be interrupted temporarily for virtual domains for which the failed unit was the primary unit while processing fails over to the still functioning cluster unit. If the failed cluster unit restarts and res the virtual cluster, VDOM partitioning load balancing is restored.

Example of inter-VDOM routing This example shows how to configure a FortiGate unit to use inter-VDOM routing. This section contains the follow topics: l


l

Creating the VDOMs

l

Configuring the physical interfaces

89

Compliance

Inter-VDOM routing

l

Configuring the VDOM links

l

Configuring the firewall and Security Profile settings

l


Network topology and assumptions Two departments of a company, ing and Sales, are connected to one FortiGate-800 unit. To do its work, the Sales department receives a lot of email from advertising companies that would appear to be spam if the ing department received it. For this reason, each department has its own VDOM to keep firewall policies and other configurations separate. A management VDOM makes sense to ensure company policies are followed for traffic content. The traffic between ing and Sales will be email and HTTPS only. It could use a VDOM link for a meshed configuration, but we will keep from getting too complex. With the configuration, inter-VDOM traffic will have a slightly longer path to follow than normal—from one department VDOM, through the management VDOM, and back to the other department VDOM. Since inter-VDOM links are faster than physical interfaces, this longer path should not be noticed. Firewall policies will be in place. For added security, firewall policies will allow only valid office services such as email, web browsing, and FTP between either department and the Internet. Any additional services that are required can be added in the future. The company uses a single ISP to connect to the Internet. The ISP uses DH to provide an IP address to the FortiGate unit. Both departments use the same ISP to reach the Internet. Other assumptions for this example are as follows: l

Your FortiGate unit has interfaces labelled port1 through port4 and VDOMs are not enabled.

l

You are using the super_ .

l

You have the FortiClient application installed.

l

You are familiar with configuring interfaces, firewalls, and other common features on your FortiGate unit.

90

Compliance

Inter-VDOM routing

Management VDOM for two departments

General configuration steps This example includes the following general steps. For best results, follow the steps in the order given. Also, note that if you perform any additional actions between procedures, your configuration may have different results. 1. Creating the VDOMs 2. Configuring the physical interfaces 3. Configuring the VDOM links 4. Configuring the firewall and Security Profile settings 5. Testing the configuration

Creating the VDOMs This procedure enables VDOMs and creates the Sales and ing VDOMs.

To create the VDOMs - web-based manager: 1. as the super_ . 2. Go to System > Dashboard > Status > System Information > Virtual Domain, and select Enable. 3. again. 4. Go to System > VDOM > VDOM. 5. Select Create New, enter ing for the VDOM Name, and select OK. 6. Select Create New, enter Sales for the VDOM Name, and select OK.

91

Compliance

Inter-VDOM routing

To create the VDOMs - CLI: config system global set vdom enable end config system vdom edit ing next edit Sales next end

Configuring the physical interfaces Next, the physical interfaces must be configured. This example uses three interfaces on the FortiGate unit - port2 (internal), port3(dmz), and port1(external). port2 and port3 interfaces each have a department’s network connected. port1 is for all traffic to or from the Internet and will use DH to configure its IP address, which is common with many ISPs.

To configure the physical interfaces - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select Edit for the port2 interface, enter the following information, and select OK. Alias

ingLocal

Virtual Domain

ing

Addressing mode

Manual

IP/Netmask

172.100.1.1/255.255.0.0

istrative Access

HTTPS, PING, SSH

Description

This is the ing department internal interface.

3. Select Edit for the port3 interface, enter the following information, and select OK. Alias

SalesLocal

Virtual Domain

Sales

Addressing mode

Manual

IP/Netmask

192.168.1.1/255.255.0.0

istrative Access

HTTPS, PING, SSH

Description

This is the sales department internal interface.

4. Select Edit for the port1 interface, enter the following information, and select OK.

92

Compliance

Inter-VDOM routing

Alias

ManagementExternal

Virtual Domain

root

Addressing Mode

DH

Distance

5

Retrieve default gateway from server

Enable

Override internal DNS

Enable

istrative Access

HTTPS, SSH, SNMP

Description

This is the ing department internal interface.

When the mode is set to DH or PPoE on an interface you can set the distance field. This is the istrative distance for any routes learned through the gateway for this interface. The gateway is added to the static route table with these values. A lower distance indicates a preferred route.

To configure the physical interfaces - CLI: config global config system interface edit port2 set alias ingLocal set vdom ing set mode static set ip 172.100.1.1 255.255.0.0 set allowaccess https ping ssh set description "The ing dept internal interface" next edit port3 set alias SalesLocal set vdom Sales set mode static set ip 192.168.1.1 255.255.0.0 set allowaccess https ping ssh set description "The sales dept. internal interface" next edit port1 set alias ManagementExternal set vdom root set mode DH set distance 5 set gwdetect enable set dns-server-override enable set allowaccess https ssh snmp set description “The systemwide management interface.” end

93

Compliance

Inter-VDOM routing

Configuring the VDOM links To complete the connection between each VDOM and the management VDOM, you need to add the two VDOM links; one pair is the ing - management link and the other is for Sales - management link. When configuring inter-VDOM links, you do not have to assign IP addresses to the links unless you are using advanced features such as dynamic routing that require them. Not asg IP addresses results in faster configuration, and more available IP addresses on your networks. If you require them, or if you simply want to assign IP addresses for clarity can do so.

To configure the ing and management VDOM link - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select the expand arrow to select Create New > VDOM link. 3. Enter the following information, and select OK. Name

Vlnk


ing

IP/Netmask

0.0.0.0/0.0.0.0

istrative Access

HTTPS, PING, SSH

Description

The ing VDOM side of the link.


root

IP/Netmask

0.0.0.0/0.0.0.0

istrative Access

HTTPS, PING, SSH

Description

The Management VDOM side of the link.

To configure the ing and management VDOM link - CLI: config global config system vdom-link edit Vlnk next end config system interface edit Vlnk0 set vdom ing set ip 0.0.0.0 0.0.0.0 set allowaccess https ping ssh set description “ing side of the VDOM link“

94

Compliance

Inter-VDOM routing

next edit Vlnk1 set vdom root set ip 0.0.0.0 0.0.0.0 set allowaccess https ping ssh set description “Management side of the VDOM link“ end

To configure the Sales and management VDOM link - web-based manager: 1. Go to Global > Network > Interfaces. 2. Select the expand arrow and select Create New > VDOM link. 3. Enter the following information, and select OK. Name

SalesVlnk


Sales

IP/Netmask

0.0.0.0/0.0.0.0

istrative Access

HTTPS, PING, SSH

Description

The Sales VDOM side of the link.


root

IP/Netmask

0.0.0.0/0.0.0.0

istrative Access

HTTPS, PING, SSH

Description

The Management VDOM side of the link.

To configure the Sales and management VDOM link - CLI: config global config system vdom-link edit SalesVlnk end config system interface edit SalesVlnk0 set vdom ing set ip 0.0.0.0 0.0.0.0 set allowaccess https ping ssh set description "Sales side of the VDOM link" next edit SalesVlnk1 set vdom root set ip 0.0.0.0 0.0.0.0 set allowaccess https ping ssh set description "Management side of the VDOM link"

95

Compliance

Inter-VDOM routing

end end

Configuring the firewall and Security Profile settings With the VDOMs, physical interfaces, and VDOM links configured the firewall must now be configured to allow the proper traffic. Firewalls are configured per-VDOM, and firewall objects must be created for each VDOM separately. For this example, the firewall group of services allowed between the internal networks and the Internet are the basic services for web browsing, file transfer, and email. These include: HTTP, HTTPS, SSL, FTP, DNS, NTP, POP3, and SMTP. The only services allowed between Sales and ing are secure web browsing (HTTPS) and email (POP3 and SMTP).

The limited number of services ensures security between departments. The list of services can be expanded in the future if needed.

Security profile settings will block all non-essential business websites while logging all web traffic, scan and file filter all web and email protocols, and block game and peer-to-peer applications using application control. For added security, FortiClient is required on internal computers with AntiVirus scanning configured. This is enforced by Endpoint NAC in firewall policies. Using firewall addresses makes the firewall policies easier to read. Also if any changes need to be made in the future, you can simply update the addresses without changing the firewall policies. The addresses required are: l

ingLocal - all traffic from the internal ing network

l

ingVlnk - all traffic from the VDOM link between ing and management VDOMs

l

SalesLocal - all traffic from the internal sales network

l

SalesVlnk - all traffic from the VDOM link between sales and management VDOM.

The ing VDOM requires ingLocal, ingVlnk, and SalesLocal. The Sales VDOM requires SalesLocal, SalesVlnk, and ingLocal. The firewall policies required on the ing VDOM are: l

ingLocal to Internet

l

Internet to ingLocal

l

SalesLocal to ingLocal

l

ingLocal to SalesLocal

The firewall policies required on the Sales VDOM are: l

SalesLocal to Internet

l

Internet to SalesLocal

l

SalesLocal to ingLocal

l

ingLocal to SalesLocal

This section includes the following topics:

96

Compliance

Inter-VDOM routing

l

Configuring firewall service groups

l

Configuring Security Profile settings for the ing VDOM

l

Configuring firewall settings for the ing VDOM

l

Configuring Security Profile settings for the Sales VDOM

l

Configuring firewall settings for the Sales VDOM

l

Configuring firewall settings between the ing and Sales VDOMs

Configuring firewall service groups Service groups are an easy way to manage multiple services, especially if the same services are used on different networks. The two service groups used here are intended for normal office traffic to the Internet, and for restricted traffic between departments. In both cases network traffic will be limited to the services listed to prevent any potential security risks or bandwidth-robbing applications. These service groups can be changed as needed to either include additional valid services that are being used on the network, or to exclude services that are not required. Also, custom services can be created as needed for applications that are not listed.

To configure two firewall service groups - web-based manager: 1. Open the ing VDOM. 2. Go to Firewall Objects > Service > Group. 3. Select Create New, enter the following information, and select OK. Group Name

OfficeServices

HTTP, HTTPS, SSL, FTP, DNS, NTP, POP3, PING, SMTP

4. Select Create New, enter the following information, and select OK. Group Name

ingSalesServices

HTTPS, POP3, PING, SMTP

To configure two firewall service groups - CLI: config vdom edit ing config firewall service group edit OfficeServices set member HTTP HTTPS SSL FTP DNS NTP POP3 PING SMTP next edit ingSalesServices set member HTTPS POP3 PING SMTP end end

97

Compliance

Inter-VDOM routing

Configuring Security Profile settings for the ing VDOM Security Profile settings include web filtering, antivirus, application control, and other features. This example just uses those three features to ensure that l

the business environment is free from viruses

l

employees do not surf grossly inappropriate websites, and

l

employees do not use games or peer-to-peer applications at work.

To configure web filtering for the ing VDOM - web-based manager: 1. Open the ing VDOM. 2. Go to Security Profiles > Web Filter > Profile. 3. Select Create New. 4. Enter webStrict for the Name. 5. Select the arrow to expand the FortiGuard Web Filtering section. 6. Block all Categories except Business Oriented, Other, and Unrated. 7. Block all Classifications except Image Search.. 8. Log all Categories and Classifications. 9. Select OK.

To configure web filtering for the ing VDOM - CLI: config vdom edit ing config webfilter profile edit webStrict config ftgd-wf set allow g07 g08 g21 g22 c01 c03 set deny g01 g02 g03 g04 g05 g06 c02 c04 c05 c06 c07 end set web-ftgd-err-log enable end end

To configure AntiVirus for the ing VDOM - web-based manager: 1. Open the ing VDOM. 2. Go to Security Profiles > AntiVirus > Profile. 3. Select Create New. 4. Enter avStrict for the Name. 5. Enable Scan for all protocols. 6. Enable File filter for all protocols, and select built-in-patterns for Option. 7. Enable logging for both Scan and File Filter. 8. Select OK.

To configure AntiVirus for the ing VDOM - CLI: config vdom edit ing

98

Compliance

Inter-VDOM routing

config antivirus profile edit avStrict config http set options scan file-filter end config ftp set options scan file-filter end config imap set options scan file-filter end config pop3 set options scan file-filter end config smtp set options scan file-filter end config nntp set options scan file-filter end config im set options scan file-filter end set filepattable 1 set av-virus-log enable set av-block-log enable end end

To configure application control for the ing VDOM - web-based manager: 1. Open the ing VDOM. 2. Go to Security Profiles > Application Control > Application Sensor. 3. Select Create New (+ button at top right of page). 4. Enter appStrict for Name and select OK. 5. Select Create New. 6. In Filters, set Category to game. 7. In Applications/Settings, enter the following, and select OK. Action

Block

Packet Logging

Enable

8. Select Create New. 9. In Filters, set Category to p2p. 10. In Applications/Settings, enter the following, and select OK. Action

Block

Packet Logging

Enable

11. Select Apply.

99

Compliance

Inter-VDOM routing

To configure application control for the ing VDOM - CLI: config vdom edit ing config application list edit appStrict config entries edit 1 set category 2 next edit 2 set category 8 end end end

Configuring firewall settings for the ing VDOM This configuration includes two firewall addresses and two firewall policies for the ing VDOM - one for the internal network, and one for the VDOM link with the management VDOM (root). For added security, all traffic allowed will be scanned. Only valid office traffic will be allowed using the service group OfficeServices. The FortiClient application must be used to ensure additional protection for the sensitive ing information. All sales and ing computers have the FortiClient application installed, so the firewall policies check that FortiClient is installed and that antivirus scanning is enabled. Note the spelling of Vlnk which is due to the eleven character limit on VDOM link names.

To configure firewall addresses - web-based manager: 1. Open the ing VDOM. 2. Select Firewall Objects > Address > Address 3. Select Create New, enter the following information, and select OK. Address Name

ingLocal

Type

Subnet/ IP Range

Subnet / IP Range

172.100.0.0

Interface

port1

4. Select Create New, enter the following information, and select OK. Address Name

Management

Type

Subnet/ IP Range

Subnet / IP Range

10.0.1.0

Interface

Vlnk

100

Compliance

Inter-VDOM routing

To configure firewall addresses - CLI: config vdom edit ing config firewall address edit ingLocal set type iprange set subnet 172.100.0.0 set associated-interface port1 next edit Management set type iprange set subnet 10.0.1.0 set associated-interface Vlnk end end

To configure protocol options for ing VDOM - web-based manager: 1. Open the ing VDOM. 2. Select Policy > Policy > Protocol Options. 3. Select Create New. 4. Enter default for the Name. 5. Select OK.

To configure the firewall policies from ingLocal to the Internet - web-based manager: 1. Open the ing VDOM. 2. Go to Policy > Policy. 3. Select Create New, enter the following information, and then select OK. Source Interface/Zone

port2

Source Address

ingLocal


Vlnk

Destination Address

Management

Schedule

always

Service

OfficeServices

Action

ACCEPT

Enable NAT

enable

Security Features

enabled

Protocol Option

default

Web Filtering

webStrict

101

Compliance

Inter-VDOM routing

AntiVirus Filtering

avStrict

Application Control

appStrict

Enable Endpoint NAC

Enforce_FortiClient_AV

4. Open the root VDOM. 5. Go to Policy > Policy. 6. Select Create New, enter the following information, and then select OK. Source Interface/Zone

Vlnk

Source Address

Management


port2

Destination Address

all

Schedule

always

Service

OfficeServices

Action

ACCEPT

Enable NAT

enable

Security Features

enabled

Protocol Option

default

Web Filtering

webStrict

AntiVirus Filtering

avStrict

Application Control

appStrict

Enable Endpoint NAC

disabled

To configure the firewall policies from ingLocal to Internet - CLI: config vdom edit ing config firewall policy edit 1 set srcintf "port2" set dstintf "Vlnk" set srcaddr "ingLocal" set dstaddr "Management" set action accept set schedule "always" set service "OfficeServices"

102

Compliance

Inter-VDOM routing

set set set set set set set end

nat enable av-profile avStrict webfilter-profile webStrict application-list appStrict profile-protocol-options default endpoint-check enable endpoint-profile "FortiClient_installed"

end config vdom edit root config firewall policy edit 2 set srcintf Vlnk set dstintf port1 set srcaddr Management set dstaddr all set action accept set schedule always set service OfficeServices set nat enable set av-profile "scan" set webfilter-profile "scan" set application-list "AppControlList" set profile-protocol-options default set endpoint-check disable end end

To configure the firewall policies from Internet to ingLocal - web-based manager: 1. Open the root VDOM. 2. Go to Policy > Policy. 3. Select Create New, enter the following information, and select OK. Source Interface/Zone

port1

Source Address

all


Vlnk

Destination Address

Management

Schedule

always

Service

OfficeServices

Action

ACCEPT

Enable NAT

enable

Security Features

enabled

Protocol Option

default

103

Compliance

Inter-VDOM routing

Web Filtering

webStrict

AntiVirus Filtering

avStrict

Application Control

appStrict

Enable Endpoint NAC

disabled

4. Open the ing VDOM. 5. Go to Policy > Policy. 6. Select Create New, enter the following information, and select OK. Source Interface/Zone

Vlnk

Source Address

Management


port2

Destination Address

ingLocal

Schedule

always

Service

OfficeServices

Action

ACCEPT

Enable NAT

enable

Security Features

enabled

Protocol Option

default

Web Filtering

webStrict

AntiVirus Filtering

avStrict

Application Control

appStrict

Enable Endpoint NAC

disabled

To configure the firewall policies from Internet to ingLocal - CLI: config vdom edit root config firewall policy edit 3 set srcintf port1 set dstintf Vlnk set srcaddr all set dstaddr Management set action accept

104

Compliance

Inter-VDOM routing

set set set set set set set set end

schedule always service OfficeServices nat enable av-profile avStrict webfilter-profile webStrict application-list appstrict profile-protocol-options default endpoint-check disable

end config vdom edit ing config firewall policy edit 4 set srcintf Vlnk set dstintf port2 set srcaddr Management set dstaddr ingLocal set action accept set schedule always set service OfficeServices set nat enable set av-profile avStrict set webfilter-profile webStrict set application-list appstrict set profile-protocol-options default set endpoint-check disable end end

Configuring Security Profile settings for the Sales VDOM Security profile settings include web filtering, antivirus, application control, and other features. This example just uses those three features to ensure that l

the business environment is free from viruses

l

employees do not surf grossly inappropriate websites, and

l

employees do not use games or peer-to-peer applications at work.

Note that Sales web traffic is different from ing, and web filtering is different to for this.

To configure web filtering for the Sales VDOM - web-based manager: 1. Open the Sales VDOM. 2. Go to Security Profiles > Web Filter > Profile. 3. Select Create New. 4. Enter webStrict for the Name. 5. In FortiGuard Categories, select all of the categories except Bandwidth Consuming, General Interest Business and Unrated. 6. In Change Action for Selected Categories select Block. 7. Select Apply.

To configure web filtering for the Sales VDOM - CLI: config vdom

105

Compliance

Inter-VDOM routing

edit Sales config webfilter profile edit webStrict config ftgd-wf set allow g07 g08 g21 g22 c01 c03 set deny g01 g02 g03 g04 g05 g06 c02 c04 c05 c06 c07 end set web-ftgd-err-log enable end end

To configure AntiVirus for the Sales VDOM - web-based manager: 1. Open the Sales VDOM. 2. Go to Security Profiles > AntiVirus > Profile. 3. Select Create New. 4. Enter avStrict for the Name. 5. Enable virus scan for all protocols. 6. Select Apply.

To configure AntiVirus for the Sales VDOM - CLI: config vdom edit Sales config antivirus profile edit "avStrict" config http set options scan file-filter end config ftp set options scan file-filter end config imap set options scan file-filter end config pop3 set options scan file-filter end config smtp set options scan file-filter end config nntp set options scan file-filter end config im set options scan file-filter end set filepattable 1 set av-virus-log enable set av-block-log enable end end

106

Compliance

Inter-VDOM routing

To configure application control for the Sales VDOM - web-based manager: 1. Open the ing VDOM. 2. Go to Security Profiles > Application Control > Application Sensor. 3. Select Create New (+ button at top right of page). 4. Enter appStrict for Name and select OK. 5. Select Create New. 6. In Filters, set Category to game. 7. In Applications/Settings, enter the following, and select OK. Action

Block

Packet Logging

Enable

8. Select Create New. 9. In Filters, set Category to p2p. 10. In Applications/Settings, enter the following, and select OK. Action

Block

Packet Logging

Enable

11. Select Apply.

To configure application control for the Sales VDOM - CLI: config vdom edit Sales config application list edit "appStrict" config entries edit 1 set category 2 next edit 2 set category 8 end end end

Configuring firewall settings for the Sales VDOM Like the ing firewall settings, this configuration includes two firewall addresses and two firewall policies for the sales VDOM: one for the internal network, and one for the VDOM link with the management VDOM. When entering the CLI commands, the number of the firewall policies must be high enough to be a new policy. Depending on the number of firewall policies on your FortiGate unit, this may require starting at a higher number than the 6 required for the default configuration. This number is added automatically when you configure firewall policies using the web manager interface.

107

Compliance

Inter-VDOM routing

The FortiClient application must be used on Sales network computers to ensure additional protection for the sensitive information and for protection against spam.

To configure firewall addresses - web-based manager: 1. Open the Sales VDOM. 2. Go to Firewall Objects > Address > Address. 3. Select Create New, enter the following information, and select OK. Address Name

SalesLocal

Type

Subnet / IP Range

Subnet / IP Range

172.100.0.0

Interface

port3

4. Go to Firewall Objects > Addresses. 5. Select Create New, enter the following information, and select OK. Address Name

SalesManagement

Type

Subnet / IP Range

Subnet / IP Range

10.0.1.0

Interface

SalesVlnk

To configure the firewall addresses - CLI: config vdom edit Sales config fireall address edit SalesLocal set type iprange set subnet 172.100.0.0 set associated-interface port2 next edit SalesManagement set type iprange set subnet 10.0.1.0 set associated-interface SalesVlnk end end

To configure the firewall policies from SalesLocal to the Internet - web-based manager: 1. Open the Sales VDOM. 2. Go to Policy > Policy. 3. Select Create New, enter the following information, and select OK.

108

Compliance

Inter-VDOM routing

Source Interface/Zone

port3

Source Address

SalesLocal


SalesVlnk

Destination Address

SalesManagement

Schedule

always

Service

OfficeServices

Action

ACCEPT

Log Allowed Traffic

enabled

Enable Endpoint Control Check

disabled

Redirect Non-conforming Clients to Portal

enabled

4. Open the root VDOM. 5. Go to Policy > Policy. 6. Select Create New, enter the following information, and select OK. Source Interface/Zone

SalesVlnk

Source Address

SalesManagement


external

Destination Address

all

Schedule

always

Service

OfficeServices

Action

ACCEPT

Protection Profile

scan

Log Allowed Traffic

enabled


disabled

To configure the firewall policies from SalesLocal to the Internet - CLI: config vdom edit root config firewall policy edit 6 set srcintf port2 set srcaddr SalesLocal set dstintf SalesVlnk

109

Compliance

Inter-VDOM routing

set set set set set set set set set end

dstaddr SalesManagement schedule always service OfficeServices action accept profile-status enable profile scan logtraffic enable endpoint-check enable endpoint-redir-portal enable

end config vdom edit Sales config firewall policy edit 7 set srcintf SalesVlnk set srcaddr SalesManagement set dstintf external set dstaddr all set schedule always set service OfficeServices set action accept set profile-status enable set profile scan set logtraffic enable set endpoint-check enable end end

To configure the firewall policies from the Internet to SalesLocal - web-based manager: 1. Open the root VDOM. 2. Go to Policy > Policy. 3. Select Create New, enter the following information, and select OK. Source Interface/Zone

external

Source Address

all


SalesVlnk

Destination Address

SalesManagement

Schedule

always

Service

OfficeServices

Action

ACCEPT

Protection Profile

scan

Log Allowed Traffic

enabled


disabled

110

Compliance

Inter-VDOM routing

4. Open the Sales VDOM. 5. Go to Policy > Policy. 6. Select Create New, enter the following information, and select OK. Source Interface/Zone

SalesVlnk

Source Address

SalesManagement


port2

Destination Address

SalesLocal

Schedule

always

Service

OfficeServices

Action

ACCEPT

Protection Profile

scan

Log Allowed Traffic

enabled


disabled


enabled

To configure the firewall policies from the Internet to SalesLocal - CLI: config vdom edit root config firewall policy edit 8 set srcintf external set srcaddr all set dstintf SalesVlnk set dstaddr SalesManagement set schedule always set service OfficeServices set action accept set profile-status enable set profile scan set logtraffic enable set endpoint-check enable set endpoint-redir-portal enable end end config vdom edit Sales config firewall policy edit 9 set srcintf SalesVlnk set srcaddr SalesManagement set dstintf port2 set dstaddr SalesLocal

111

Compliance

Inter-VDOM routing

set set set set set set set set end

schedule always service OfficeServices action accept profile-status enable profile scan logtraffic enable endpoint-check enable endpoint-redir-portal enable

end

Configuring firewall settings between the ing and Sales VDOMs Firewall policies are required for any communication between each internal network and the Internet. Policies are also required for the two internal networks to communicate with each other through the management VDOM. The more limited ingSalesServices group of services will be used between Sales and ing to ensure the traffic is necessary business traffic only. These policies will result in a partially meshed VDOM configuration. The FortiClient application must be used to ensure additional protection for the sensitive ing information. Two firewall policies are required to allow traffic in both directions between Sales and ing.

To configure the firewall policy between Sales and ing on the management VDOM - web-based manager: 1. Open the root VDOM. 2. Go to Policy > Policy. 3. Select Create New, enter the following information, and select OK. Source Interface/Zone

SalesVlnk

Source Address

SalesManagement


Vlnk

Destination Address

ingManagement

Schedule

always

Service

ingSalesServices

Action

ACCEPT

Protection Profile

scan

Log Allowed Traffic

enabled


disabled


enabled

112

Compliance

Inter-VDOM routing

4. Go to Policy > Policy. 5. Select Create New, enter the following information, and select OK. Source Interface/Zone

Vlnk

Source Address

ingManagement


SalesVlnk

Destination Address

SalesManagement

Schedule

always

Service

ingSalesServices

Action

ACCEPT

Protection Profile

scan

Log Allowed Traffic

enabled


disabled


enabled

To configure the firewall policy between Sales and ing on the management VDOM - CLI: config vdom edit root config system firewall policy edit 9 set srcintf SalesVlnk set srcaddr SalesManagement set dstintf Vlnk set dstaddr Management set schedule always set service ingSalesServices set action accept set profile-status enable set profile scan set logtraffic enable set endpoint-check enable set endpoint-redir-portal enable next edit 10 set srcintf Vlnk set srcaddr Management set dstintf SalesVlnk set dstaddr SalesManagement set schedule always set service ingSalesServices set action accept set profile-status enable set profile scan

113

Compliance

Inter-VDOM routing

set logtraffic enable set endpoint-check enable set endpoint-redir-portal enable end end

Testing the configuration Once the inter-VDOM routing has been configured, tests must be conducted to confirm proper operation. If there are any problems, use the troubleshooting tips to resolve them. This section includes the following topics: l

Testing connectivity

l

Troubleshooting Tips

Testing connectivity Testing connectivity ensures that physical networking connections as well as FortiGate unit interface configurations, including firewall policies, are properly configured. The easiest way to test connectivity is to use the ping and traceroute commands to confirm the connectivity of different routes on the network. Include testing: l

from ingLocal to Internet

l

from Internet to ingLocal

l

from SalesLocal to Internet

l

from Internet to SalesLocal

l

from ingLocal to SalesLocal.

When using the commands on a Windows computer, go to a command line prompt and enter either ping or tracert . When using the commands on a FortiGate unit, go to the CLI and enter either exec ping or exec traceroute .

Troubleshooting Tips When there are problems with connectivity, the following troubleshooting tips will help resolve the issues. l

l

l

l

If a multiple hop test, such as traceroute, is not successful then reduce it to a single hop to simplify the test. Test each link of the path to see which hop is down. If all hops are up, check the FortiGate unit policies to ensure they allow basic traffic to flow as expected. If ping does not work, confirm that the FortiGate unit interfaces have Ping enabled and also ensure Ping is enabled in the firewall policies. Otherwise the Ping traffic will be blocked. If one protocol does not work but others do work, check the FortiGate unit firewall policies for that one protocol to ensure it is allowed. If there are unexplained connectivity problems, check the local computer to ensure it does not have a software firewall running that may be blocking traffic. MS Windows computers have a firewall running by default that can cause problems.

For additional troubleshooting, see Troubleshooting Virtual Domains.

114

Compliance

Troubleshooting Virtual Domains When you are configuring VDOMs you may run into some issues, with your VDOM configuration, your network configuration, or your device setup. This section addresses common problems and specific concerns that an of a VDOM network may have. This section includes: l

VDOM having problems gaining access

l

FortiGate unit running very slowly

l

General VDOM tips and troubleshooting

VDOM having problems gaining access With VDOMs configured, s have an extra layer of permissions and may have problems accessing their information.

Confirm the ’s VDOM Each , other than the super_ , is tied to one specific VDOM. That is not able to access any other VDOM. It may be possible they are trying to access the wrong VDOM.

Confirm the VDOM’s interfaces An can only access their VDOM through interfaces that are assigned to that VDOM. If interfaces on that VDOM are disabled or unavailable there will be no method of accessing that VDOM by its local . The super_ will be required to either bring up the interfaces, fix the interfaces, or move another interface to that VDOM to restore access.

Confirm the VDOMs access As with all FortiGate units, istration access on the VDOM’s interfaces must be enabled for that VDOM’s s to gain access. For example if SSH is not enabled, that is not available to s. To enable access, the super_ will go to the Global > Network > Interfaces page, and for the interface in question enable the access.

FortiGate unit running very slowly You may experience a number of problems resulting from your FortiGate unit being overloaded. These problems may appear as: l

U and memory threshold limits exceeded on a continual basis

l

AV failopen happening on a regular basis

115

Compliance

Troubleshooting Virtual Domains

l

dropped traffic or sessions due to lack of resources

These problems are caused by a lack of system resources. There are a number of possible reasons for this.

Too many VDOMs If you have configured many VDOMs on your system, past the default ten VDOMs, this could easily be your problem. Each VDOM you create on your FortiGate unit requires system resources to function - U cycles, memory, and disk space. When there are too many VDOMs configured there are not enough resources for operation. This may be a lack of memory in the session table, or no U cycles for processing incoming IPS traffic, or even a full disk drive. Go to System > VDOM and see the number of configured VDOMs on your system. If you are running 500 or more VDOMs, you must have a FortiGate 5000 chassis. Otherwise you need to reduce the number of VDOMs on your system to fix the problem. Even if you have the proper hardware, you may encounter noticeably slow throughput if you are using advanced features such as security profiles or deep content inspection with many configured VDOMs.

One or more VDOMs are consuming all the resources If you have sufficient hardware to the number of VDOMs you are running, check the global resources on your FortiGate unit. At a glance it will tell you if you are running out of a particular resource such as sessions, or s. If this is the case, you can then check your VDOMs to see if one particular VDOM is using more than its share of resources. If that is the case you can change the resource settings to allow that VDOM (or those VDOMs) fewer resources and in turn allow the other VDOMs access to those resources.

Too many Security Features in use It is likely that reducing the Security Features in use regardless of number of VDOMs will greatly improve overall system performance and should be considered as an option. Finally it is possible that your FortiGate unit configuration is incorrect in some other area, which is u all your resources. For example, forgetting that you are running a network sniffer on an interface will create significant amounts of traffic that may prevent normal operation.

General VDOM tips and troubleshooting Besides ping and traceroute, there are additional tools for troubleshooting your VDOM configurations. These include packet sniffing and debugging the packet flow.

Perform a sniffer trace When troubleshooting networks, it helps to look inside the headers of packets to determine if they are traveling along the route you expect that they are. Packet sniffing can also be called a network tap, packet capture, or logic analyzing.

116

Compliance


If your FortiGate unit has NP interfaces that are offloading traffic, this will change the sniffer trace. Before performing a trace on any NP interfaces, you should disable offloading on those interfaces.

What sniffing packets can tell you If you are running a constant traffic application such as ping, packet sniffing can tell you if the traffic is reaching the destination, what the port of entry is on the FortiGate unit, if the ARP resolution is correct, and if the traffic is being sent back to the source as expected. Sniffing packets can also tell you if the Fortigate unit is silently dropping packets for reasons such as RPF (Reverse Path Forwarding), also called Anti Spoofing, which prevents an IP packet from being forwarded if its Source IP does not either belong to a locally attached subnet (local interface), or be part of the routing between the FortiGate and another source (static route, RIP, OSPF, BGP). Note that RPF can be disabled by turning on asymmetric routing in the CLI (config system setting, set asymmetric enable), however this will disable stateful inspection on the FortiGate unit and cause many features to be turned off. If you configure virtual IP addresses on your Fortigate unit, it will use those addresses in preference to the physical IP addresses. You will notice this when you are sniffing packets because all the traffic will be using the virtual IP addresses. This is due to the ARP update that is sent out when the VIP address is configured.

How to sniff packets When you are using VDOMs, you must be in a VDOM to access the diag sniffer command. At the global level, the command is not available. This is limit the packets only to the ones on your VDOM, and protects the privacy of other VDOM clients. The general form of the internal FortiOS packet sniffer command is: diag sniffer packet <‘filter’>

To stop the sniffer, type CTRL+C.

117

Compliance


<‘filter’>

The name of the interface to sniff, such as “port1” or “internal”. This can also be “any” to sniff all interfaces. What to look for in the information the sniffer reads. “none” indicates no filtering, and all packets will be displayed as the other arguments indicate. The filter must be inside single quotes (‘).

The level of verbosity as one of: 1 - print header of packets 2 - print header and data from IP of packets 3 - print header and data from Ethernet of packets

The number of packets the sniffer reads before stopping. If you don’t put a number here, the sniffer will run forever unit you stop it with .

For a simple sniffing example, enter the CLI command diag sniffer packet port1 none 1 3. This will display the next 3 packets on the port1 interface using no filtering, and using verbose level 1. At this verbosity level you can see the source IP and port, the destination IP and port, action (such as ack), and sequence numbers. In the output below, port 443 indicates these are HTTPS packets, and 172.20.120.17 is both sending and receiving traffic. Head_Office_620b # diag sniffer packet port1 none 1 3 interfaces=[port1] filters=[none] 0.545306 172.20.120.17.52989 -> 172.20.120.141.443: psh 3177924955 ack 1854307757 0.545963 172.20.120.141.443 -> 172.20.120.17.52989: psh 1854307757 ack 3177925808 0.562409 172.20.120.17.52988 -> 172.20.120.141.443: psh 4225311614 ack 3314279933

For a more advanced example of packet sniffing, the following commands will report packets on any interface travelling between a computer with the host name of PC1 and the computer with the host name of PC2. With verbosity 4 and above, the sniffer trace will display the interface names where traffic enters or leaves the FortiGate unit. to stop the sniffer, type CTRL+C. Note that PC1 and PC2 may be VDOMs. FGT# diagnose sniffer packet any "host or host " 4

or FGT# diagnose sniffer packet any "(host or host ) and icmp" 4

The following sniffer CLI command includes the ARP protocol in the filter which may be useful to troubleshoot a failure in the ARP resolution (for instance PC2 may be down and not responding to the FortiGate ARP requests). FGT# diagnose sniffer packet any "host or host or arp" 4

118

Compliance


Debugging the packet flow Traffic should come in and leave the VDOM. If you have determined that network traffic is not entering and leaving the VDOM as expected, debug the packet flow. Debugging can only be performed using CLI commands. Debugging the packet flow requires a number of debug commands to be entered as each one configures part of the debug action, with the final command starting the debug.

If your FortiGate unit has NP interfaces that are offloading traffic, this will change the packet flow. Before performing the debug on any NP interfaces, you should disable offloading on those interfaces.

The following configuration assumes that PC1 is connected to the internal interface of the FortiGate unit and has an IP address of 10.11.101.200. PC1 is the host name of the computer. To debug the packet flow in the CLI, enter the following commands: FGT# FGT# FGT# FGT# FGT#

diag diag diag diag diag

debug debug debug debug debug

enable flow filter add flow show console enable flow trace start 100 enable

The start 100 argument in the above list of commands will limit the output to 100 packets from the flow. This is useful for looking at the flow without flooding your log or your display with too much information. To stop all other debug activities, enter the command: FGT# diag debug flow trace stop

The following is an example of debug flow output for traffic that has no matching Firewall Policy, and is in turn blocked by the FortiGate unit. The denied message indicates the traffic was blocked. Note that even with VDOMs not enabled, vd-root is still shown. id=20085 trace_id=319 func=resolve_ip_tuple_fast line=2825 msg="vd-root received a packet(proto=6, 192.168.129.136:2854->192.168.96.153:1863) from port3." id=20085 trace_id=319 func=resolve_ip_tuple line=2924 msg="allocate a new session013004ac" id=20085 trace_id=319 func=vf_ip4_route_input line=1597 msg="find a route: gw192.168.150.129 via port1" id=20085 trace_id=319 func=fw_forward_handler line=248 msg=" Denied by forward policy check"

119

Compliance

Copyright© 2015 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are ed trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be ed and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.

Fortigate-vdom 1y4e6n

Overview 6h3y3j

More details h6z72

More Documents from "Mauricio Torres" 2245

Fortigate-vdom 1y4e6n

Tuberia De Pvc Y Concreto 6r546w

Beuchot Mauricio - Hermeneutica Lenguaje E Inconsciente(ocr Y Opt).pdf 1f2o3p

Fortigate Load Balance 521 4q4v2y

Fortigate Vm Install 52 1y431f

Microsoft Advanced For Partners Fact Sheet (1) 4tg5z