Fortigate Vm Install 52 1y431f
This document was ed by and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this report form. Report l4457
Overview 6h3y3j
& View Fortigate Vm Install 52 as PDF for free.
More details h6z72
- Words: 7,743
- Pages: 65
FortiOS™ Handbook - VM Installation VERSION 5.2.0
FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://idoc-pub.mejorapp.org/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="067263656e6269657546606974726f6863722865696b">[email protected]
Wednesday, March 04, 2015
FortiOS™ Handbook - VM Installation 01-520-203906-20150304
TABLE OF CONTENTS Change troduction Document scope
FortiGate VM Overview FortiGate VM models and licensing FortiGate VM evaluation license ing FortiGate VM with Customer Service & ing the FortiGate VM deployment package Deployment package contents Citrix XenServer OpenXEN Microsoft Hyper-V KVM VMware ESX/ESXi Deploying the FortiGate VM appliance
Deployment example – VMware Open the FortiGate VM OVF file with the vSphere client Configure FortiGate VM hardware settings Transparent mode VMware configuration High Availability VMware configuration Power on your FortiGate VM
Deployment example – MS Hyper-V Create the FortiGate VM virtual machine Configure FortiGate VM hardware settings FortiGate VM virtual processors FortiGate VM network adapters FortiGate VM virtual hard disk High Availability Hyper-V configuration Start the FortiGate VM
Deployment example – KVM Create the FortiGate VM virtual machine Configure FortiGate VM hardware settings Start the FortiGate VM
5 6 6
7 7 7 8 8 9 9 10 10 10 10 11
12 12 18 19 20 20
21 21 28 30 31 32 39 40
41 41 43 44
Deployment example – OpenXen Create the FortiGate VM virtual machine (VMM)
Deployment example – Citrix XenServer Create the FortiGate VM virtual machine (XenCenter) Configure virtual hardware Configuring number of Us and memory size Configuring disk storage
FortiGate VM Initial Configuration Set FortiGate VM port1 IP address Connect to the FortiGate VM Web-based Manager the FortiGate VM license file Validate the FortiGate VM license with FortiManager Configure your FortiGate VM
45 45
51 51 55 55 56
58 58 60 61 62 64
Change Log Date
Change Description
4 March 2015
New format. New sections: High Availability VMware configuration on page 20 and High Availability Hyper-V configuration.
2014-01-24
Published.
2013-11-07
Conversion to FortiOS Handbook chapter which will include additional VM platforms.
2013-05-29
Minor document update.
2013-05-01
Initial Release.
Introduction FortiGate virtual appliances allow you to mitigate blind spots by implementing critical security controls within your virtual infrastructure. They also allow you to rapidly provision security infrastructure whenever and wherever it is needed. FortiGate virtual appliances feature all of the security and networking services common to traditional hardware-based FortiGate appliances. With the addition of virtual appliances from Fortinet, you can deploy a mix of hardware and virtual appliances, operating together and managed from a common centralized management platform.
Document scope This document describes how to deploy a FortiGate virtual appliance in several virtualization server environments. This includes how to configure the virtual hardware settings of the virtual appliance. This document assumes: l l
you have already successfully installed the virtualization server on the physical machine, you have installed appropriate VM management software on either the physical server or a computer to be used for VM management.
This document does not cover configuration and operation of the virtual appliance after it has been successfully installed and started. For these issues, see the FortiGate 5.2 Handbook. This document includes the following sections: l
FortiGate VM Overview
l
Deployment example – VMware
l
Deployment example – MS Hyper-V
l
Deployment example – KVM
l
Deployment example – OpenXen
l
Deployment example – Citrix XenServer
6
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview The following topics are included in this section: l
FortiGate VM models and licensing
l
ing FortiGate VM with Customer Service &
l
ing the FortiGate VM deployment package
l
Deployment package contents
l
Deploying the FortiGate VM appliance
FortiGate VM models and licensing Fortinet offers the FortiGate VM in five virtual appliance models determined by license. When configuring your FortiGate VM, be sure to configure hardware settings within the ranges outlined below. your Fortinet Authorized Reseller for more information.
FortiGate VM model information Technical Specification Virtual Us (min / max)
FG-VM00
FG-VM01
FG-VM02
FG-VM04
FG-VM08
1/1
1/1
1/2
1/4
1/8
1GB / 6GB
1GB /12GB
Virtual Network Interfaces (min / max) Virtual Memory (min / max)
2 / 10 1GB / 1GB
1GB / 2GB
Virtual Storage (min / max) Managed Wireless APs (tunnel mode / global) Virtual Domains (default / max)
1GB / 4GB 30GB / 2TB
32 / 32
32 / 64
256 / 512
256 / 512
1024 / 4096
1/1
10 / 10
10 / 25
10 / 50
10 / 250
After placing an order for FortiGate VM, a license registration code is sent to the email address used on the order form. Use the registration number provided to the FortiGate VM with Customer Service & and then the license file. Once the license file is ed to the FortiGate VM and validated, your FortiGate VM appliance is fully functional.
FortiGate VM evaluation license FortiGate VM includes a limited embedded 15-day trial license that s:
7
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
l
1 U maximum
l
1024 MB memory maximum
l
low encryption only (no HTTPS istrative access)
l
all features except FortiGuard updates
You cannot upgrade the firmware, doing so will lock the Web-based Manager until a license is ed. Technical is not included. The trial period begins the first time you start FortiGate VM. After the trial license expires, functionality is disabled until you a license file.
ing FortiGate VM with Customer Service & To obtain the FortiGate VM license file you must first your FortiGate VM with Customer Service & .
To your FortiGate VM: 1. to the Customer Service & portal using an existing or select Sign Up to create a new . 2. In the main page, under Asset, select /Renew. The Registration page opens. 3. Enter the registration code that was emailed to you and select . A registration form will display. 4. After completing the form, a registration acknowledgement page will appear. 5. Select the License File link. 6. You will be prompted to save the license file (.lic) to your local computer. See " the license file" for instructions on ing the license file to your FortiGate VM via the Web-based Manager.
ing the FortiGate VM deployment package FortiGate VM deployment packages are included with FortiGate firmware images on the Customer Service & site. First, see the following table to determine the appropriate VM deployment package for your VM platform.
Selecting the correct FortiGate VM deployment package for your VM platform VM Platform
FortiGate VM Deployment File
Citrix XenServer v5.6sp2, 6.0 and later
FGT_VM64-v500-buildnnnn-FORTINET. out.CitrixXen.zip FGT_VM64-v500-buildnnnn-FORTINET. out.OpenXen.zip
OpenXen v3.4.3, 4.1 Microsoft Hyper-V Server 2008R2 and 2012
FGT_VM64-v500-buildnnnn-FORTINET. out.hyperv.zip
8
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
VM Platform
FortiGate VM Deployment File
KVM (qemu 0.12.1)
FGT_VM64-v500-buildnnnn-FORTINET. out.kvm.zip
VMware ESX 4.0, 4.1 ESXi 4.0/4.1/5.0/5.1/5.5
FGT_VM32-v500-buildnnnn-FORTINET. out.ovf.zip (32-bit) FGT_VM64-v500-buildnnnn-FORTINET. out.ovf.zip
For more information see the FortiGate product datasheet available on the Fortinet web site, http://www.fortinet.com/products/fortigate/virtualappliances.html. The firmware images FTP directory is organized by firmware version, major release, and patch release. The firmware images in the directories follow a specific naming convention and each firmware image is specific to the device model. For example, the FGT_VM32-v500-build0151-FORTINET.out.ovf.zip image found in the v5.0 Patch Release 2 directory is specific to the FortiGate VM 32-bit environment.
You can also the FortiOS Release Notes, FORTINET-FORTIGATE MIB file, FSSO images, and SSL VPN client in this directory. The Fortinet Core MIB file is located in the main FortiGate v5.00 directory.
To the FortiGate VM deployment package: 1. In the main page of the Customer Service & site, select > Firmware Images. The Firmware Images page opens. 2. In the Firmware Images page, select FortiGate. 3. Browse to the appropriate directory on the FTP site for the version that you would like to . 4. the appropriate .zip file for your VM server platform. You can also the FortiGate Release Notes. 5. Extract the contents of the deployment package to a new file folder.
Deployment package contents Citrix XenServer The FORTINET.out.CitrixXen.zip file contains: l
fortios.vhd: the FortiGate VM system hard disk in VHD format
l
fortios.xva: binary file containing virtual hardware configuration settings
l
in the ovf folder: l
FortiGate-VM64.ovf: Open Virtualization Format (OVF) template file, containing virtual hardware settings for Xen
9
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
l
fortios.vmdk: the FortiGate VM system hard disk in VMDK format
l
datadrive.vmdk: the FortiGate VM log disk in VMDK format
The ovf folder and its contents is an alternative method of installation to the .xva and VHD disk image.
OpenXEN The FORTINET.out.OpenXen.zip file contains only fortios.qcow2, the FortiGate VM system hard disk in qcow2 format. You will need to manually: l
create a 30GB log disk
l
specify the virtual hardware settings
Microsoft Hyper-V The FORTINET.out.hyperv.zip file contains: l
l
in the Virtual Hard Disks folder: l
fortios.vhd: the FortiGate VM system hard disk in VHD format
l
DATADRIVE.vhd: the FortiGate VM log disk in VHD format
In the Virtual Machines folder: l
l
fortios.xml: XML file containing virtual hardware configuration settings for Hyper-V. This is compatible with Windows Server 2012.
Snapshots folder: optionally, Hyper-V stores snapshots of the FortiGate VM state here
KVM The FORTINET.out.kvm.zip contains only fortios.qcow2, the FortiGate VM system hard disk in qcow2 format. You will need to manually: l
create a 30GB log disk
l
specify the virtual hardware settings
VMware ESX/ESXi The FORTINET.out.ovf.zip file contains: l
fortios.vmdk: the FortiGate VM system hard disk in VMDK format
l
datadrive.vmdk: the FortiGate VM log disk in VMDK format
l
Open Virtualization Format (OVF) template files: l
FortiGate-VM64.ovf: OVF template based on Intel e1000 NIC driver
l
FortiGate-VM64.hw04.ovf: OVF template file for older (v3.5) VMware ESX server
l
FortiGate-VMxx.hw07_vmxnet2.ovf: OVF template file for VMware vmxnet2 driver
l
FortiGate-VMxx.hw07_vmxnet3.ovf: OVF template file for VMware vmxnet3 driver
10
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
Deploying the FortiGate VM appliance Prior to deploying the FortiGate VM appliance, the VM platform must be installed and configured so that it is ready to create virtual machines. The installation instructions for FortiGate VM assume that l l
You are familiar with the management software and terminology of your VM platform. An Internet connection is available for FortiGate VM to FortiGuard to validate its license or, for closed environments, a FortiManager can be ed to validate the FortiGate VM license. See "Validate the FortiGate VM license with FortiManager".
For assistance in deploying FortiGate VM, refer to the deployment chapter in this guide that corresponds to your VMware environment. You might also need to refer to the documentation provided with your VM server. The deployment chapters are presented as examples because for any particular VM server there are multiple ways to create a virtual machine. There are command line tools, APIs, and even alternative graphical interface tools. Before you start your FortiGate VM appliance for the first time, you might need to adjust virtual disk sizes and networking settings. The first time you start FortiGate VM, you will have access only through the console window of your VM server environment. After you configure one FortiGate network interface with an IP address and istrative access, you can access the FortiGate VM web-based manager. After deployment and license validation, you can upgrade your FortiGate VM appliance’s firmware by ing either FGT_VM32-v500-buildnnnn-FORTINET.out (32-bit) or FGT_VM64-v500-buildnnnnFORTINET.out (64-bit) firmware. Firmware upgrading on a VM is very similar to upgrading firmware on a hardware FortiGate unit.
11
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware Once you have ed the FGT_VMxx-v5-build0xxx-FORTINET.out.ovf.zip file from http://.fortinet.com and extracted the package contents to a folder on your local computer, you can use the vSphere client to create the virtual machine from the deployment package OVF template. The following topics are included in this section: l
Open the FortiGate VM OVF file with the vSphere client
l
Configure FortiGate VM hardware settings
l
Transparent mode VMware configuration
l
High Availability VMware configuration
l
Power on your FortiGate VM
Open the FortiGate VM OVF file with the vSphere client To deploy the FortiGate VM OVF template: 1. Launch the VMware vSphere client, enter the IP address or host name of your server, enter your name and and select .
12
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The vSphere client home page opens.
2. Select File > Deploy OVF Template to launch the OVF Template wizard. The OVF Template Source page opens. 3. Select the source location of the OVF file. Select Browse and locate the OVF file on your computer. Select Next to continue.
13
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template Details page opens.
4. the OVF template details. This page details the product name, size, size on disk, and description. Select Next to continue.
14
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template End License Agreement page opens.
5. Read the end license agreement for FortiGate VM. Select Accept and then select Next to continue.
15
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template Name and Location page opens.
6. Enter a name for this OVF template. The name can contain up to 80 characters and it must be unique within the inventory folder. Select Next to continue.
16
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template Disk Format page opens.
7. Select one of the following: l
l
l
Thick Provision Lazy Zeroed: Allocates the disk space statically (no other volumes can take the space), but does not write zeros to the blocks until the first write takes place to that block during runtime (which includes a full disk format). Thick Provision Eager Zeroed: Allocates the disk space statically (no other volumes can take the space), and writes zeros to all the blocks. Thin Provision: Allocates the disk space only when a write occurs to a block, but the total volume size is reported by VMFS to the OS. Other volumes can take the remaining space. This allows you to float space between your servers, and expand your storage when your size monitoring indicates there is a problem. Note that once a Thin Provisioned block is allocated, it remains on the volume regardless if you have deleted data, etc.
8. Select Next to continue. The OVF Template Network Mapping page opens.
17
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
9. Map the networks used in this OVF template to networks in your inventory. Network 1 maps to port1 of the FortiGate VM. You must set the destination network for this entry to access the device console. Select Next to continue. The OVF Template Ready to Complete page opens. 10. Review the template configuration. Make sure that Power on after deployment is not enabled. You might need to configure the FortiGate VM hardware settings prior to powering on the FortiGate VM. 11. Select Finish to deploy the OVF template. You will receive a Deployment Completed Successfully dialog box once the FortiGate VM OVF template wizard has finished.
Configure FortiGate VM hardware settings Before powering on your FortiGate VM you must configure the virtual memory, virtual U, and virtual disk configuration to match your FortiGate VM license.FortiGate VM models and licensing on page 7
18
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
Transparent mode VMware configuration If you want to use your FortiGate-VM in transparent mode, your VMware server’s virtual switches must operate in promiscuous mode. This permits these interfaces to receive traffic that will through the FortiGate unit but was not addressed to the FortiGate unit. In VMware, promiscuous mode must be explicitly enabled: 1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane. 2. In Hardware, select Networking. 3. Select Properties of vSwitch0. 4. In the Properties window left pane, select vSwitch and then select Edit. 5. Select the Security tab, set Promiscuous Mode to Accept, then select OK. 6. Select Close. 7. Repeat steps 3 through 6 for other vSwitches that your transparent mode FortiGate-VM uses.
19
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
High Availability VMware configuration If you want to combine two or more FortiGate-VM instances into a FortiGate Clustering Protocol (FG) High Availability (HA) cluster the VMware server’s virtual switches used to connect the heartbeat interfaces must operate in promiscuous mode. This permits HA heartbeat communication between the heartbeat interfaces. HA heartbeat packets are non-T packets that use Ethertype values 0x8890, 0x8891, and 0x8890. The FG uses link-local IP4 addresses in the 169.254.0.x range for HA heartbeat interface IP addresses. To enable promiscuous mode in VMware: 1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane. 2. In Hardware, select Networking. 3. Select Properties of a virtual switch used to connect heartbeat interfaces. 4. In the Properties window left pane, select vSwitch and then select Edit. 5. Select the Security tab, set Promiscuous Mode to Accept, then select OK. 6. Select Close.
You must also set the virtual switches connected to other FortiGate interfaces to allow MAC address changes and to accept forged transmits. This is required because the FG sets virtual MAC addresses for all FortiGate interfaces and the same interfaces on the different VM instances in the cluster will have the same virtual MAC addresses. To make the required changes in VMware: 1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane. 2. In Hardware, select Networking. 3. Select Properties of a virtual switch used to connect FortiGate VM interfaces. 4. Set MAC Address Changes to Accept. 5. Set Forged Transmits to Accept.
Power on your FortiGate VM You can now proceed to power on your FortiGate VM. There are several ways to do this: l
Select the name of the FortiGate VM you deployed in the inventory list and select Power on the virtual machine in the Getting Started tab.
l
In the inventory list, right-click the name of the FortiGate VM you deployed, and select Power > Power On.
l
Select the name of the FortiGate VM you deployed in the inventory list. Click the Power On button on the toolbar.
Select the Console tab to view the console. To enter text, you must click in the console pane. The mouse is then captured and cannot leave the console screen. As the FortiGate console is text-only, no mouse pointer is visible. To release the mouse, press Ctrl-Alt.
20
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V Once you have ed the FGT_VMxx_HV-v5-build0xxx-FORTINET.out.hyperv.zip file and extracted the package contents to a folder on your Microsoft server, you can deploy the VHD package to your Microsoft Hyper-V environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine
l
Configure FortiGate VM hardware settings
l
High Availability Hyper-V configuration
l
Start the FortiGate VM
Create the FortiGate VM virtual machine To create the FortiGate VM virtual machine: 1. Launch the Hyper-V Manager in your Microsoft server. The Hyper-V Manager home page opens.
21
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Select the server in the right-tree menu. The server details page is displayed.
3. Right-click the server and select New and select Virtual Machine from the menu. Optionally, in the Actions menu, select New and select Virtual Machine from the menu.
22
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The New Virtual Machine Wizard opens.
4. Select Next to create a virtual machine with a custom configuration. The Specify Name and Location page is displayed.
23
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
5. Enter a name for this virtual machine. The name is displayed in the Hyper-V Manager.
24
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Assign Memory page is displayed.
6. Specify the amount of memory to allocate to this virtual machine. The default memory for FortiGate VM is 1GB (1024MB).
25
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Configure Networking page is displayed.
7. Each new virtual machine includes a network adapter. You can configure the network adapter to use a virtual switch, or it can remain disconnected. FortiGate VM requires four network adapters. You must configure network adapters in the Settings page. Select Next to continue. The Connect Virtual Hard Disk page is displayed.
26
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
8. Select to use an existing virtual hard disk and browse for the fortios.vhd file that you ed from the Fortinet Customer Service & portal.
27
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Summary page is displayed.
9. To create the virtual machine and close the wizard, select Finish.
Configure FortiGate VM hardware settings Before powering on your FortiGate VM you must configure the virtual memory, virtual U, and virtual disk configuration to match your FortiGate VM license.
To configure settings for FortiGate VM on the server: 1. In the Hyper-V Manager, locate the name of the virtual machine, right-click the entry, and select Settings from the menu. Optionally, you can select the virtual machine and select Settings in the Actions menu.
28
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The Settings page is displayed.
29
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Configure virtual processors, network adapters, and virtual hard drive settings. 3. Select Apply to save the settings and then select OK to close the settings page.
FortiGate VM virtual processors You must configure FortiGate VM virtual processors in the server settings page. The number of processors is dependent on your server environment.
Configure FortiGate VM virtual processors: 1. In the Settings page, select Processor from the Hardware menu. The Processor page is displayed.
30
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Configure the number of virtual processors for the FortiGate VM virtual machine. Optionally, you can use resource controls to balance resources among virtual machines. 3. Select Apply to save the settings.
FortiGate VM network adapters You must configure FortiGate VM network adapters in the server settings page. FortiGate VM s four network adapters.
Configure FortiGate VM network adapters: 1. In the Settings page, select Add Hardware from the Hardware menu, select Network Adapter in the device list, and select the Add button.
31
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The Network Adapter page is displayed.
1. You must manually configure four network adapters for FortiGate VM in the settings page. For each network adapter, select the virtual switch from the drop-down list. 2. Select Apply to save the settings.
FortiGate VM virtual hard disk You must configure the FortiGate VM virtual hard disk in the server settings page. If you know your environment will expand in the future, it is recommended to increase the hard disk size beyond 30GB. The VM license limit is 2TB.
Configure a FortiGate VM virtual hard drive: 1. In the Settings page, select IDE Controller 0 > Hard Drive from the Hardware menu. The Hard Drive page is displayed.
32
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Select New to create a new virtual hard disk.
33
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The New Virtual Hard Disk Wizard opens.
3. This wizard helps you to create a new virtual hard disk.
34
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Choose Disk Format page opens.
4. Select to use VHDX format virtual hard disks. This format s virtual disks up to 64TB and is resilient to consistency issues that might occur from power failures. This format is not ed in operating systems earlier than Windows Server 2012. Note that FortiGate-VM does not hard disks larger than 2TB.
35
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Choose Disk Type page opens.
5. Select the type of virtual disk you want to use. Select one of the following disk types: l
l
l
Fixed size: This type of disk provides better performance and is recommended for servers running applications with high levels of disk activity. The virtual hard disk file that is created initially uses the size of the virtual hard disk and does not change when data is deleted or added. Dynamic expanding: This type of disk provides better use of physical storage space and is recommended for servers running applications that are not disk intensive. The virtual disk file that is created is small initially and changes as data is added. Differencing: This type of disk is associated in a parent-child relationship with another disk that you want to leave intact. You can make changes to the data or operating system without affecting the parent disk, so that you can revert the changes easily. All children must have the same virtual hard disk format as the parent (VHD or VHDX).
Select Next to continue. The Specify Name and Location page opens.
36
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
6. Specify the name and location of the virtual hard disk file. Use the Browse button to select a specific file folder on your server. Select Next to continue. The Configure Disk page opens.
37
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
7. Select to Create a new blank virtual hard disk and enter the size of the disk in GB. The maximum size is dependent on your server environment.
38
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Summary page opens.
8. The summary page provides details of the virtual hard disk. Select Finish to create the virtual hard disk. 9. Select Apply to save the settings and select OK to exit the settings page.
High Availability Hyper-V configuration Promiscuous mode and for MAC address spoofing is required for FortiGate-VM for Hyper-V to FortiGate Clustering Protocol (FG) high availability (HA). By default the FortiGate-VM for Hyper-V has promiscuous mode enabled in the XML configuration file in the FortiGate-VM Hyper-V image. If you have problems with HA mode, confirm that this is still enabled. In addition, because the FG applies virtual MAC addresses to FortiGate data interfaces and because these virtual MAC addresses mean that matching interfaces of different FortiGate-VM instances will have the same virtual MAC addresses you have to configure Hyper-V to allow MAC spoofing. But you should only enable MAC spoofing for FortiGate-VM data interfaces. You should not enable MAC spoofing for FortiGate HA heartbeat interfaces. With promiscuous mode enabled and the correct MAC spoofing settings you should be able to configure HA between two or more FortiGate-VM for Hyper-V instances.
39
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Start the FortiGate VM You can now proceed to power on your FortiGate VM. Select the name of the FortiGate VM in the list of virtual machines, right-click, and select Start in the menu. Optionally, you can select the name of the FortiGate VM in the list of virtual machines and select Start in the Actions menu.
40
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM Once you have ed the FORTINET.out.kvm.zip file and extracted virtual hard drive image file fortios.qcow2, you can create the virtual machine in your KVM environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine
l
Configure FortiGate VM hardware settings
l
Start the FortiGate VM
Create the FortiGate VM virtual machine To create the FortiGate VM virtual machine: 1. Launch Virtual Machine Manager (virt-manager) on your KVM host server. The Virtual Machine Manager home page opens. 2. In the toolbar, select Create a new virtual machine.
3. Enter a Name for the VM, FGT-VM for example. 4. Ensure that Connection is localhost. (This is the default.) 5. Select Import existing disk image.
41
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM
6. Select Forward.
7. In OS Type select Linux. 8. In Version, select Generic 2.4.x.kernel.
42
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM
9. Select Browse.
10. If you copied the fortios.qcow2 file to /var/lib/libvirt/images, it will be visible on the right. If you saved it somewhere else on your server, select Browse Local and find it. 11. Choose Choose Volume. 12. Select Forward. 13. Specify the amount of memory and number of Us to allocate to this virtual machine. The amounts must not exceed your license limits. See FortiGate VM models and licensing on page 7. 14. Select Forward. 15. Expand Advanced options. A new virtual machine includes one network adapter by default. Select a network adapter on the host computer. Optionally, set a specific MAC address for the virtual network interface. Set Virt Type to virtio and Architecture to qcow2. 16. Select Finish.
Configure FortiGate VM hardware settings Before powering on your FortiGate VM you must add the log disk and configure the virtual hardware of your FortiGate VM.
To configure settings for FortiGate VM on the server: 1. In the Virtual Machine Manager, locate the name of the virtual machine and then select Open from the toolbar. 2. Select Add Hardware. In the Add Hardware window select Storage.
43
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM
3. Select Create a disk image on the computer’s harddrive and set the size to 30GB.
If you know your environment will expand in the future, it is recommended to increase the hard disk size beyond 30GB. The VM license limit is 2TB.
4. Enter: Device type
Virtio disk
Cache mode
Default
Storage format
raw
5. Select Network to configure add more the network interfaces. The Device type must be Virtio. A new virtual machine includes one network adapter by default. You can add more through the Add Hardware window. FortiGate VM requires four network adapters. You can configure network adapters to connect to a virtual switch or to network adapters on the host computer. 6. Select Finish.
Start the FortiGate VM You can now proceed to power on your FortiGate VM. Select the name of the FortiGate VM in the list of virtual machines. In the toolbar, select Console and then select Start.
44
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen Once you have ed the FORTINET.out.OpenXen.zip file and extracted virtual hard drive image file fortios.qcow2, you can create the virtual machine in your OpenXen environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine (VMM)
Create the FortiGate VM virtual machine (VMM) To create the FortiGate VM virtual machine: 1. Launch Virtual Machine Manager (virt-manager) on your OpenXen host server. The Virtual Machine Manager home page opens. 2. In the toolbar, select Create a new virtual machine.
3. Enter a Name for the VM, FGT-VM for example. 4. Ensure that Connection is localhost. (This is the default.) 5. Select Import existing disk image.
45
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
6. Select Forward.
7. In OS Type select Linux. 8. In Version, select Generic 2.4.x.kernel. 9. Select Browse. The Locate or create storage volume window opens. 10. Select Browse Local, find the fortios.qcow2 disk image file. 11. Select fortios.qcow2 and select Choose Volume.
46
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
12. Select Forward.
13. Specify the amount of memory and number of Us to allocate to this virtual machine. The amounts must not exceed your license limits.
47
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
14. Select Forward.
15. Select Customize configuration before install. This enables you to make some hardware configuration changes before VM creation is started. 16. Expand Advanced options. A new virtual machine includes one network adapter by default. Select Specify shared device name and enter the name of the bridge interface on the OpenXen host. Optionally, set a specific MAC address for the virtual network interface. Virt Type and Architecture are set by default and should be correct. 17. Select Finish. The virtual machine hardware configuration window opens.
48
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
You can use this window to add hardware such as network interfaces and disk drives. 18. Select Add Hardware. In the Add Hardware window select Storage. 19. Select Create a disk image on the computer’s harddrive and set the size to 30GB.
If you know your environment will expand in the future, it is recommended to increase the hard disk size beyond 30GB. The VM license limit is 2TB.
20. Enter: Device type
Virtio disk
Cache mode
Default
Storage format
raw
21. Select Network to configure add more the network interfaces. The Device type must be Virtio. A new virtual machine includes one network adapter by default. You can add more through the Add Hardware
49
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
window. FortiGate VM requires four network adapters. You can configure network adapters to connect to a virtual switch or to network adapters on the host computer. 22. Select Finish. 23. Select Begin Installation. After the installation completes successfully, the VM starts and the console window opens.
50
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer Once you have ed the FORTINET.out.CitrixXen.zip file and extracted the files, you can create the virtual machine in your Citrix Xen environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine (XenCenter)
l
Configure virtual hardware
Create the FortiGate VM virtual machine (XenCenter) To create the FortiGate VM virtual machine from the OVF file 1. Launch XenCenter on your management computer. The management computer can be any computer that can run Citrix XenCenter, a Windows application. 2. If you have not already done so, select ADD a server. Enter your Citrix XenServer IP address and the root logon credentials required to manage that server. Your Citrix XenServer is added to the list in the left pane. The Virtual Machine Manager home page opens. 3. Go to File > Import. An import dialog will appear.
51
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
4. Click the Browse button, find the FortiGate-VM64-Xen.ovf template file, then click Open.
5. Select Next.
52
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
6. Accept the FortiGate Virtual Appliance EULA, then select Next.
7. Choose the pool or standalone server that will host the VM, then select Next. 8. Select the storage location for FortiGate VM disk drives or accept the default. Select Next.
53
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
9. Configure how each vNIC (virtual network adapter) in FortiGate VM will be mapped to each vNetwork on the Citrix XenServer, then click Next.
10. Click Next to skip OS fixup. 11. Select Next to use the default network settings for transferring the VM to the host. 12. Select Finish. The Citrix XenServer imports the FortiGate VM files and configures the VM as specified in the OVF template. Depending on your computer’s hardware speed and resource load, and also on the file size and speed of the network connection, this might take several minutes to complete.
When VM import is complete, the XenCenter left pane includes the FortiGate VM in the list of deployed VMs for your Citrix XenServer.
54
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
Configure virtual hardware Before you start your FortiGate-VM for the first time, you need to adjust your virtual machine’s virtual hardware settings to meet your network requirements.
Configuring number of Us and memory size Your FortiGate-VM license limits the number Us and amount of memory that you can use. The amounts you allocate must not exceed your license limits.
To access virtual machine settings 1. Open XenCenter. 2. Select your FortiGate VM in the left pane. The tabs in the right pane provide access to the virtual hardware configuration. The Console tab provides access to the FortiGate console. 1. To set the number of Us 2. In the XenCenter left pane, right-click the FortiGate VM and select Properties. The Properties window opens. 3. In the left pane, select U.
4. Adjust Number of Us and then select OK.
55
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
XenCenter will warn if you select more Us than the Xen host computer contains. Such a configuration might reduce performance.
To set memory size 1. In the XenCenter left pane, select the FortiGate VM. 2. In the right pane, select the Memory tab. 3. Select Edit, modify the value in the Set a fixed memory of field and select OK.
Configuring disk storage By default the FortiGate VM data disk 30GB. You will probably want to increase this. Disk resizing must be done before you start the VM for the first time.
To resize the FortiGate data disk 1. In the XenCenter left pane, select the FortiGate VM. 2. Select the Storage tab. Select Hard disk 2 (the 30GB drive), then select Properties. The ‘Hard disk 2’ Properties window opens.
56
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
3. Select Size and Location. Adjust Size and select OK.
57
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration Before you can connect to the FortiGate VM web-based manager you must configure a network interface in the FortiGate VM console. Once an interface with istrative access is configured, you can connect to the FortiGate VM web-based Manager and the FortiGate VM license file that you ed from the Customer Service & website. The following topics are included in this section: l
Set FortiGate VM port1 IP address
l
Connect to the FortiGate VM Web-based Manager
l
the FortiGate VM license file
l
Validate the FortiGate VM license with FortiManager
l
Configure your FortiGate VM
Set FortiGate VM port1 IP address Hypervisor management environments include a guest console window. On the FortiGate VM, this provides access to the FortiGate console, equivalent to the console port on a hardware FortiGate unit. Before you can access the Web-based manager, you must configure FortiGate VM port1 with an IP address and istrative access.
To configure the port1 IP address: 1. In your hypervisor manager, start the FortiGate VM and access the console window. You might need to press Return to see a prompt.
Example of FortiGate VM console access:
58
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
2. At the FortiGate VM prompt enter the name . By default there is no . Just press Return. 3. Using CLI commands, configure the port1 IP address and netmask. Also, HTTP access must be enabled because until it is licensed the FortiGate VM s only low-strength encryption. HTTPS access will not work. For example: config system interface edit port1 set ip 192.168.0.100 255.255.255.0 append allowaccess http end
You can also use the append allowaccess CLI command to enable other access protocols, such as auto-ipsec, http, probe-response, radius-acct, snmp, and telnet. The ping, https, ssh, and fgfm protocols are enabled on the port1 interface by default.
4. To configure the default gateway, enter the following CLI commands: config router static edit 1 set device port1 set gateway
end
59
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
You must configure the default gateway with an IPv4 address. FortiGate VM needs to access the Internet to the FortiGuard Distribution Network (FDN) to validate its license.
5. To configure your DNS servers, enter the following CLI commands: config system dns set primary
set secondary <Secondary DNS server> end
The default DNS servers are 208.91.112.53 and 208.91.112.52.
6. To the FortiGate VM license from an FTP or TFTP server, use the following CLI command: execute restore vmlicense {ftp | tftp}
<Server IP or FQDN> [:server port]
You can also the license in the FortiGate VM Web-based Manager. See the FortiGate VM license file on page 61.
Connect to the FortiGate VM Web-based Manager When you have configured the port1 IP address and netmask, launch a web browser and enter the IP address that you configured for port1. At the page, enter the name and field and select . The default is no . The Web-based Manager will appear with an Evaluation License dialog box.
60
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
Web-based Manager and Evaluation License dialog box
the FortiGate VM license file Every Fortinet VM includes a 15-day trial license. During this time the FortiGate VM operates in evaluation mode. Before using the FortiGate VM you must enter the license file that you ed from the Customer Service & website upon registration.
To the FortiGate VM licence file: 1. In the Evaluation License dialog box, select Enter License. You can also the license file via the CLI using the following CLI command: execute restore vmlicense [ftp | tftp]
[:ftp port] The license page opens.
License page:
61
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
2. Select Browse and locate the license file (.lic) on your computer. Select OK to the license file. 3. Refresh the browser to . 4. Enter in the Name field and select . The VM registration status appears as valid in the License Information widget once the license has been validated by the FortiGuard Distribution Network (FDN) or FortiManager for closed networks.
Validate the FortiGate VM license with FortiManager You can validate your FortiGate VM license with some models of FortiManager. To determine whether your FortiManager unit has the VM Activation feature, see Features section of the FortiManager Product Data sheet.
62
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
To validate your FortiGate VM with your FortiManager: 1. To configure your FortiManager as a closed network, enter the following CLI command on your FortiManager: config fmupdate publicnetwork set status disable end
2. To configure FortiGate VM to use FortiManager as its override server, enter the following CLI commands on your FortiGate VM: config set set set set
system central-management mode normal type fortimanager fmg
fmg-source-ip <Source IPv4 address when connecting to the FortiManager device> set fortimanager-fds-override enable set vdom <Enter the name of the VDOM to use when communicating with the FortiManager device> end
3. Load the FortiGate VM license file in the Web-based Manager. Go to System > Dashboard > Status. In the License Information widget, in the Registration Status field, select Update. Browse for the .lic license file and select OK. 4. To activate the FortiGate VM license, enter the following CLI command on your FortiGate VM: execute update-now
5. To check the FortiGate VM license status, enter the following CLI commands on your FortiGate VM: get system status
The following output is displayed: Version: Fortigate-VM v5.0,build0099,120910 (Interim) Virus-DB: 15.00361(2011-08-24 17:17) Extended DB: 15.00000(2011-08-24 17:09) Extreme DB: 14.00000(2011-08-24 17:10) IPS-DB: 3.00224(2011-10-28 16:39) FortiClient application signature package: 1.456(2012-01-17 18:27) Serial-Number: FGVM02Q105060000
License Status: Valid BIOS version: 04000002 Log hard disk: Available Hostname: Fortigate-VM Operation Mode: NAT Current virtual domain: root Max number of virtual domains: 10 Virtual domains status: 1 in NAT mode, 0 in TP mode Virtual domain configuration: disable FIPS-CC mode: disable Current HA mode: standalone Distribution: International Branch point: 511 Release Version Information: MR3 Patch 4 System time: Wed Jan 18 11:24:34 2012 diagnose hardware sysinfo vm full
63
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
The following output is displayed: UUID: 564db33a29519f6b1025bf8539a41e92 valid: 1 status: 1
code: 200 (If the license is a duplicate, code 401 will be displayed) warn: 0 copy: 0 received: 45438 warning: 0 recv: 201201201918 dup:
Configure your FortiGate VM Once the FortiGate VM license has been validated you can begin to configure your device. You can use the Wizard located in the top toolbar for basic configuration including enabling central management, setting the , setting the time zone, and port configuration. For more information on configuring your FortiGate VM see the FortiOS Handbook at http://docs.fortinet.com.
64
FortiGate-VM Install Guide for FortiOS 5.2
Copyright© 2015 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are ed trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be ed and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://idoc-pub.mejorapp.org/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="067263656e6269657546606974726f6863722865696b">[email protected]
Wednesday, March 04, 2015
FortiOS™ Handbook - VM Installation 01-520-203906-20150304
TABLE OF CONTENTS Change troduction Document scope
FortiGate VM Overview FortiGate VM models and licensing FortiGate VM evaluation license ing FortiGate VM with Customer Service & ing the FortiGate VM deployment package Deployment package contents Citrix XenServer OpenXEN Microsoft Hyper-V KVM VMware ESX/ESXi Deploying the FortiGate VM appliance
Deployment example – VMware Open the FortiGate VM OVF file with the vSphere client Configure FortiGate VM hardware settings Transparent mode VMware configuration High Availability VMware configuration Power on your FortiGate VM
Deployment example – MS Hyper-V Create the FortiGate VM virtual machine Configure FortiGate VM hardware settings FortiGate VM virtual processors FortiGate VM network adapters FortiGate VM virtual hard disk High Availability Hyper-V configuration Start the FortiGate VM
Deployment example – KVM Create the FortiGate VM virtual machine Configure FortiGate VM hardware settings Start the FortiGate VM
5 6 6
7 7 7 8 8 9 9 10 10 10 10 11
12 12 18 19 20 20
21 21 28 30 31 32 39 40
41 41 43 44
Deployment example – OpenXen Create the FortiGate VM virtual machine (VMM)
Deployment example – Citrix XenServer Create the FortiGate VM virtual machine (XenCenter) Configure virtual hardware Configuring number of Us and memory size Configuring disk storage
FortiGate VM Initial Configuration Set FortiGate VM port1 IP address Connect to the FortiGate VM Web-based Manager the FortiGate VM license file Validate the FortiGate VM license with FortiManager Configure your FortiGate VM
45 45
51 51 55 55 56
58 58 60 61 62 64
Change Log Date
Change Description
4 March 2015
New format. New sections: High Availability VMware configuration on page 20 and High Availability Hyper-V configuration.
2014-01-24
Published.
2013-11-07
Conversion to FortiOS Handbook chapter which will include additional VM platforms.
2013-05-29
Minor document update.
2013-05-01
Initial Release.
Introduction FortiGate virtual appliances allow you to mitigate blind spots by implementing critical security controls within your virtual infrastructure. They also allow you to rapidly provision security infrastructure whenever and wherever it is needed. FortiGate virtual appliances feature all of the security and networking services common to traditional hardware-based FortiGate appliances. With the addition of virtual appliances from Fortinet, you can deploy a mix of hardware and virtual appliances, operating together and managed from a common centralized management platform.
Document scope This document describes how to deploy a FortiGate virtual appliance in several virtualization server environments. This includes how to configure the virtual hardware settings of the virtual appliance. This document assumes: l l
you have already successfully installed the virtualization server on the physical machine, you have installed appropriate VM management software on either the physical server or a computer to be used for VM management.
This document does not cover configuration and operation of the virtual appliance after it has been successfully installed and started. For these issues, see the FortiGate 5.2 Handbook. This document includes the following sections: l
FortiGate VM Overview
l
Deployment example – VMware
l
Deployment example – MS Hyper-V
l
Deployment example – KVM
l
Deployment example – OpenXen
l
Deployment example – Citrix XenServer
6
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview The following topics are included in this section: l
FortiGate VM models and licensing
l
ing FortiGate VM with Customer Service &
l
ing the FortiGate VM deployment package
l
Deployment package contents
l
Deploying the FortiGate VM appliance
FortiGate VM models and licensing Fortinet offers the FortiGate VM in five virtual appliance models determined by license. When configuring your FortiGate VM, be sure to configure hardware settings within the ranges outlined below. your Fortinet Authorized Reseller for more information.
FortiGate VM model information Technical Specification Virtual Us (min / max)
FG-VM00
FG-VM01
FG-VM02
FG-VM04
FG-VM08
1/1
1/1
1/2
1/4
1/8
1GB / 6GB
1GB /12GB
Virtual Network Interfaces (min / max) Virtual Memory (min / max)
2 / 10 1GB / 1GB
1GB / 2GB
Virtual Storage (min / max) Managed Wireless APs (tunnel mode / global) Virtual Domains (default / max)
1GB / 4GB 30GB / 2TB
32 / 32
32 / 64
256 / 512
256 / 512
1024 / 4096
1/1
10 / 10
10 / 25
10 / 50
10 / 250
After placing an order for FortiGate VM, a license registration code is sent to the email address used on the order form. Use the registration number provided to the FortiGate VM with Customer Service & and then the license file. Once the license file is ed to the FortiGate VM and validated, your FortiGate VM appliance is fully functional.
FortiGate VM evaluation license FortiGate VM includes a limited embedded 15-day trial license that s:
7
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
l
1 U maximum
l
1024 MB memory maximum
l
low encryption only (no HTTPS istrative access)
l
all features except FortiGuard updates
You cannot upgrade the firmware, doing so will lock the Web-based Manager until a license is ed. Technical is not included. The trial period begins the first time you start FortiGate VM. After the trial license expires, functionality is disabled until you a license file.
ing FortiGate VM with Customer Service & To obtain the FortiGate VM license file you must first your FortiGate VM with Customer Service & .
To your FortiGate VM: 1. to the Customer Service & portal using an existing or select Sign Up to create a new . 2. In the main page, under Asset, select /Renew. The Registration page opens. 3. Enter the registration code that was emailed to you and select . A registration form will display. 4. After completing the form, a registration acknowledgement page will appear. 5. Select the License File link. 6. You will be prompted to save the license file (.lic) to your local computer. See " the license file" for instructions on ing the license file to your FortiGate VM via the Web-based Manager.
ing the FortiGate VM deployment package FortiGate VM deployment packages are included with FortiGate firmware images on the Customer Service & site. First, see the following table to determine the appropriate VM deployment package for your VM platform.
Selecting the correct FortiGate VM deployment package for your VM platform VM Platform
FortiGate VM Deployment File
Citrix XenServer v5.6sp2, 6.0 and later
FGT_VM64-v500-buildnnnn-FORTINET. out.CitrixXen.zip FGT_VM64-v500-buildnnnn-FORTINET. out.OpenXen.zip
OpenXen v3.4.3, 4.1 Microsoft Hyper-V Server 2008R2 and 2012
FGT_VM64-v500-buildnnnn-FORTINET. out.hyperv.zip
8
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
VM Platform
FortiGate VM Deployment File
KVM (qemu 0.12.1)
FGT_VM64-v500-buildnnnn-FORTINET. out.kvm.zip
VMware ESX 4.0, 4.1 ESXi 4.0/4.1/5.0/5.1/5.5
FGT_VM32-v500-buildnnnn-FORTINET. out.ovf.zip (32-bit) FGT_VM64-v500-buildnnnn-FORTINET. out.ovf.zip
For more information see the FortiGate product datasheet available on the Fortinet web site, http://www.fortinet.com/products/fortigate/virtualappliances.html. The firmware images FTP directory is organized by firmware version, major release, and patch release. The firmware images in the directories follow a specific naming convention and each firmware image is specific to the device model. For example, the FGT_VM32-v500-build0151-FORTINET.out.ovf.zip image found in the v5.0 Patch Release 2 directory is specific to the FortiGate VM 32-bit environment.
You can also the FortiOS Release Notes, FORTINET-FORTIGATE MIB file, FSSO images, and SSL VPN client in this directory. The Fortinet Core MIB file is located in the main FortiGate v5.00 directory.
To the FortiGate VM deployment package: 1. In the main page of the Customer Service & site, select > Firmware Images. The Firmware Images page opens. 2. In the Firmware Images page, select FortiGate. 3. Browse to the appropriate directory on the FTP site for the version that you would like to . 4. the appropriate .zip file for your VM server platform. You can also the FortiGate Release Notes. 5. Extract the contents of the deployment package to a new file folder.
Deployment package contents Citrix XenServer The FORTINET.out.CitrixXen.zip file contains: l
fortios.vhd: the FortiGate VM system hard disk in VHD format
l
fortios.xva: binary file containing virtual hardware configuration settings
l
in the ovf folder: l
FortiGate-VM64.ovf: Open Virtualization Format (OVF) template file, containing virtual hardware settings for Xen
9
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
l
fortios.vmdk: the FortiGate VM system hard disk in VMDK format
l
datadrive.vmdk: the FortiGate VM log disk in VMDK format
The ovf folder and its contents is an alternative method of installation to the .xva and VHD disk image.
OpenXEN The FORTINET.out.OpenXen.zip file contains only fortios.qcow2, the FortiGate VM system hard disk in qcow2 format. You will need to manually: l
create a 30GB log disk
l
specify the virtual hardware settings
Microsoft Hyper-V The FORTINET.out.hyperv.zip file contains: l
l
in the Virtual Hard Disks folder: l
fortios.vhd: the FortiGate VM system hard disk in VHD format
l
DATADRIVE.vhd: the FortiGate VM log disk in VHD format
In the Virtual Machines folder: l
l
fortios.xml: XML file containing virtual hardware configuration settings for Hyper-V. This is compatible with Windows Server 2012.
Snapshots folder: optionally, Hyper-V stores snapshots of the FortiGate VM state here
KVM The FORTINET.out.kvm.zip contains only fortios.qcow2, the FortiGate VM system hard disk in qcow2 format. You will need to manually: l
create a 30GB log disk
l
specify the virtual hardware settings
VMware ESX/ESXi The FORTINET.out.ovf.zip file contains: l
fortios.vmdk: the FortiGate VM system hard disk in VMDK format
l
datadrive.vmdk: the FortiGate VM log disk in VMDK format
l
Open Virtualization Format (OVF) template files: l
FortiGate-VM64.ovf: OVF template based on Intel e1000 NIC driver
l
FortiGate-VM64.hw04.ovf: OVF template file for older (v3.5) VMware ESX server
l
FortiGate-VMxx.hw07_vmxnet2.ovf: OVF template file for VMware vmxnet2 driver
l
FortiGate-VMxx.hw07_vmxnet3.ovf: OVF template file for VMware vmxnet3 driver
10
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Overview
Deploying the FortiGate VM appliance Prior to deploying the FortiGate VM appliance, the VM platform must be installed and configured so that it is ready to create virtual machines. The installation instructions for FortiGate VM assume that l l
You are familiar with the management software and terminology of your VM platform. An Internet connection is available for FortiGate VM to FortiGuard to validate its license or, for closed environments, a FortiManager can be ed to validate the FortiGate VM license. See "Validate the FortiGate VM license with FortiManager".
For assistance in deploying FortiGate VM, refer to the deployment chapter in this guide that corresponds to your VMware environment. You might also need to refer to the documentation provided with your VM server. The deployment chapters are presented as examples because for any particular VM server there are multiple ways to create a virtual machine. There are command line tools, APIs, and even alternative graphical interface tools. Before you start your FortiGate VM appliance for the first time, you might need to adjust virtual disk sizes and networking settings. The first time you start FortiGate VM, you will have access only through the console window of your VM server environment. After you configure one FortiGate network interface with an IP address and istrative access, you can access the FortiGate VM web-based manager. After deployment and license validation, you can upgrade your FortiGate VM appliance’s firmware by ing either FGT_VM32-v500-buildnnnn-FORTINET.out (32-bit) or FGT_VM64-v500-buildnnnnFORTINET.out (64-bit) firmware. Firmware upgrading on a VM is very similar to upgrading firmware on a hardware FortiGate unit.
11
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware Once you have ed the FGT_VMxx-v5-build0xxx-FORTINET.out.ovf.zip file from http://.fortinet.com and extracted the package contents to a folder on your local computer, you can use the vSphere client to create the virtual machine from the deployment package OVF template. The following topics are included in this section: l
Open the FortiGate VM OVF file with the vSphere client
l
Configure FortiGate VM hardware settings
l
Transparent mode VMware configuration
l
High Availability VMware configuration
l
Power on your FortiGate VM
Open the FortiGate VM OVF file with the vSphere client To deploy the FortiGate VM OVF template: 1. Launch the VMware vSphere client, enter the IP address or host name of your server, enter your name and and select .
12
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The vSphere client home page opens.
2. Select File > Deploy OVF Template to launch the OVF Template wizard. The OVF Template Source page opens. 3. Select the source location of the OVF file. Select Browse and locate the OVF file on your computer. Select Next to continue.
13
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template Details page opens.
4. the OVF template details. This page details the product name, size, size on disk, and description. Select Next to continue.
14
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template End License Agreement page opens.
5. Read the end license agreement for FortiGate VM. Select Accept and then select Next to continue.
15
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template Name and Location page opens.
6. Enter a name for this OVF template. The name can contain up to 80 characters and it must be unique within the inventory folder. Select Next to continue.
16
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
The OVF Template Disk Format page opens.
7. Select one of the following: l
l
l
Thick Provision Lazy Zeroed: Allocates the disk space statically (no other volumes can take the space), but does not write zeros to the blocks until the first write takes place to that block during runtime (which includes a full disk format). Thick Provision Eager Zeroed: Allocates the disk space statically (no other volumes can take the space), and writes zeros to all the blocks. Thin Provision: Allocates the disk space only when a write occurs to a block, but the total volume size is reported by VMFS to the OS. Other volumes can take the remaining space. This allows you to float space between your servers, and expand your storage when your size monitoring indicates there is a problem. Note that once a Thin Provisioned block is allocated, it remains on the volume regardless if you have deleted data, etc.
8. Select Next to continue. The OVF Template Network Mapping page opens.
17
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
9. Map the networks used in this OVF template to networks in your inventory. Network 1 maps to port1 of the FortiGate VM. You must set the destination network for this entry to access the device console. Select Next to continue. The OVF Template Ready to Complete page opens. 10. Review the template configuration. Make sure that Power on after deployment is not enabled. You might need to configure the FortiGate VM hardware settings prior to powering on the FortiGate VM. 11. Select Finish to deploy the OVF template. You will receive a Deployment Completed Successfully dialog box once the FortiGate VM OVF template wizard has finished.
Configure FortiGate VM hardware settings Before powering on your FortiGate VM you must configure the virtual memory, virtual U, and virtual disk configuration to match your FortiGate VM license.FortiGate VM models and licensing on page 7
18
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
Transparent mode VMware configuration If you want to use your FortiGate-VM in transparent mode, your VMware server’s virtual switches must operate in promiscuous mode. This permits these interfaces to receive traffic that will through the FortiGate unit but was not addressed to the FortiGate unit. In VMware, promiscuous mode must be explicitly enabled: 1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane. 2. In Hardware, select Networking. 3. Select Properties of vSwitch0. 4. In the Properties window left pane, select vSwitch and then select Edit. 5. Select the Security tab, set Promiscuous Mode to Accept, then select OK. 6. Select Close. 7. Repeat steps 3 through 6 for other vSwitches that your transparent mode FortiGate-VM uses.
19
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – VMware
High Availability VMware configuration If you want to combine two or more FortiGate-VM instances into a FortiGate Clustering Protocol (FG) High Availability (HA) cluster the VMware server’s virtual switches used to connect the heartbeat interfaces must operate in promiscuous mode. This permits HA heartbeat communication between the heartbeat interfaces. HA heartbeat packets are non-T packets that use Ethertype values 0x8890, 0x8891, and 0x8890. The FG uses link-local IP4 addresses in the 169.254.0.x range for HA heartbeat interface IP addresses. To enable promiscuous mode in VMware: 1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane. 2. In Hardware, select Networking. 3. Select Properties of a virtual switch used to connect heartbeat interfaces. 4. In the Properties window left pane, select vSwitch and then select Edit. 5. Select the Security tab, set Promiscuous Mode to Accept, then select OK. 6. Select Close.
You must also set the virtual switches connected to other FortiGate interfaces to allow MAC address changes and to accept forged transmits. This is required because the FG sets virtual MAC addresses for all FortiGate interfaces and the same interfaces on the different VM instances in the cluster will have the same virtual MAC addresses. To make the required changes in VMware: 1. In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane. 2. In Hardware, select Networking. 3. Select Properties of a virtual switch used to connect FortiGate VM interfaces. 4. Set MAC Address Changes to Accept. 5. Set Forged Transmits to Accept.
Power on your FortiGate VM You can now proceed to power on your FortiGate VM. There are several ways to do this: l
Select the name of the FortiGate VM you deployed in the inventory list and select Power on the virtual machine in the Getting Started tab.
l
In the inventory list, right-click the name of the FortiGate VM you deployed, and select Power > Power On.
l
Select the name of the FortiGate VM you deployed in the inventory list. Click the Power On button on the toolbar.
Select the Console tab to view the console. To enter text, you must click in the console pane. The mouse is then captured and cannot leave the console screen. As the FortiGate console is text-only, no mouse pointer is visible. To release the mouse, press Ctrl-Alt.
20
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V Once you have ed the FGT_VMxx_HV-v5-build0xxx-FORTINET.out.hyperv.zip file and extracted the package contents to a folder on your Microsoft server, you can deploy the VHD package to your Microsoft Hyper-V environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine
l
Configure FortiGate VM hardware settings
l
High Availability Hyper-V configuration
l
Start the FortiGate VM
Create the FortiGate VM virtual machine To create the FortiGate VM virtual machine: 1. Launch the Hyper-V Manager in your Microsoft server. The Hyper-V Manager home page opens.
21
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Select the server in the right-tree menu. The server details page is displayed.
3. Right-click the server and select New and select Virtual Machine from the menu. Optionally, in the Actions menu, select New and select Virtual Machine from the menu.
22
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The New Virtual Machine Wizard opens.
4. Select Next to create a virtual machine with a custom configuration. The Specify Name and Location page is displayed.
23
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
5. Enter a name for this virtual machine. The name is displayed in the Hyper-V Manager.
24
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Assign Memory page is displayed.
6. Specify the amount of memory to allocate to this virtual machine. The default memory for FortiGate VM is 1GB (1024MB).
25
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Configure Networking page is displayed.
7. Each new virtual machine includes a network adapter. You can configure the network adapter to use a virtual switch, or it can remain disconnected. FortiGate VM requires four network adapters. You must configure network adapters in the Settings page. Select Next to continue. The Connect Virtual Hard Disk page is displayed.
26
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
8. Select to use an existing virtual hard disk and browse for the fortios.vhd file that you ed from the Fortinet Customer Service & portal.
27
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Summary page is displayed.
9. To create the virtual machine and close the wizard, select Finish.
Configure FortiGate VM hardware settings Before powering on your FortiGate VM you must configure the virtual memory, virtual U, and virtual disk configuration to match your FortiGate VM license.
To configure settings for FortiGate VM on the server: 1. In the Hyper-V Manager, locate the name of the virtual machine, right-click the entry, and select Settings from the menu. Optionally, you can select the virtual machine and select Settings in the Actions menu.
28
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The Settings page is displayed.
29
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Configure virtual processors, network adapters, and virtual hard drive settings. 3. Select Apply to save the settings and then select OK to close the settings page.
FortiGate VM virtual processors You must configure FortiGate VM virtual processors in the server settings page. The number of processors is dependent on your server environment.
Configure FortiGate VM virtual processors: 1. In the Settings page, select Processor from the Hardware menu. The Processor page is displayed.
30
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Configure the number of virtual processors for the FortiGate VM virtual machine. Optionally, you can use resource controls to balance resources among virtual machines. 3. Select Apply to save the settings.
FortiGate VM network adapters You must configure FortiGate VM network adapters in the server settings page. FortiGate VM s four network adapters.
Configure FortiGate VM network adapters: 1. In the Settings page, select Add Hardware from the Hardware menu, select Network Adapter in the device list, and select the Add button.
31
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The Network Adapter page is displayed.
1. You must manually configure four network adapters for FortiGate VM in the settings page. For each network adapter, select the virtual switch from the drop-down list. 2. Select Apply to save the settings.
FortiGate VM virtual hard disk You must configure the FortiGate VM virtual hard disk in the server settings page. If you know your environment will expand in the future, it is recommended to increase the hard disk size beyond 30GB. The VM license limit is 2TB.
Configure a FortiGate VM virtual hard drive: 1. In the Settings page, select IDE Controller 0 > Hard Drive from the Hardware menu. The Hard Drive page is displayed.
32
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
2. Select New to create a new virtual hard disk.
33
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
The New Virtual Hard Disk Wizard opens.
3. This wizard helps you to create a new virtual hard disk.
34
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Choose Disk Format page opens.
4. Select to use VHDX format virtual hard disks. This format s virtual disks up to 64TB and is resilient to consistency issues that might occur from power failures. This format is not ed in operating systems earlier than Windows Server 2012. Note that FortiGate-VM does not hard disks larger than 2TB.
35
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Choose Disk Type page opens.
5. Select the type of virtual disk you want to use. Select one of the following disk types: l
l
l
Fixed size: This type of disk provides better performance and is recommended for servers running applications with high levels of disk activity. The virtual hard disk file that is created initially uses the size of the virtual hard disk and does not change when data is deleted or added. Dynamic expanding: This type of disk provides better use of physical storage space and is recommended for servers running applications that are not disk intensive. The virtual disk file that is created is small initially and changes as data is added. Differencing: This type of disk is associated in a parent-child relationship with another disk that you want to leave intact. You can make changes to the data or operating system without affecting the parent disk, so that you can revert the changes easily. All children must have the same virtual hard disk format as the parent (VHD or VHDX).
Select Next to continue. The Specify Name and Location page opens.
36
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
6. Specify the name and location of the virtual hard disk file. Use the Browse button to select a specific file folder on your server. Select Next to continue. The Configure Disk page opens.
37
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
7. Select to Create a new blank virtual hard disk and enter the size of the disk in GB. The maximum size is dependent on your server environment.
38
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Select Next to continue. The Summary page opens.
8. The summary page provides details of the virtual hard disk. Select Finish to create the virtual hard disk. 9. Select Apply to save the settings and select OK to exit the settings page.
High Availability Hyper-V configuration Promiscuous mode and for MAC address spoofing is required for FortiGate-VM for Hyper-V to FortiGate Clustering Protocol (FG) high availability (HA). By default the FortiGate-VM for Hyper-V has promiscuous mode enabled in the XML configuration file in the FortiGate-VM Hyper-V image. If you have problems with HA mode, confirm that this is still enabled. In addition, because the FG applies virtual MAC addresses to FortiGate data interfaces and because these virtual MAC addresses mean that matching interfaces of different FortiGate-VM instances will have the same virtual MAC addresses you have to configure Hyper-V to allow MAC spoofing. But you should only enable MAC spoofing for FortiGate-VM data interfaces. You should not enable MAC spoofing for FortiGate HA heartbeat interfaces. With promiscuous mode enabled and the correct MAC spoofing settings you should be able to configure HA between two or more FortiGate-VM for Hyper-V instances.
39
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – MS Hyper-V
Start the FortiGate VM You can now proceed to power on your FortiGate VM. Select the name of the FortiGate VM in the list of virtual machines, right-click, and select Start in the menu. Optionally, you can select the name of the FortiGate VM in the list of virtual machines and select Start in the Actions menu.
40
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM Once you have ed the FORTINET.out.kvm.zip file and extracted virtual hard drive image file fortios.qcow2, you can create the virtual machine in your KVM environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine
l
Configure FortiGate VM hardware settings
l
Start the FortiGate VM
Create the FortiGate VM virtual machine To create the FortiGate VM virtual machine: 1. Launch Virtual Machine Manager (virt-manager) on your KVM host server. The Virtual Machine Manager home page opens. 2. In the toolbar, select Create a new virtual machine.
3. Enter a Name for the VM, FGT-VM for example. 4. Ensure that Connection is localhost. (This is the default.) 5. Select Import existing disk image.
41
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM
6. Select Forward.
7. In OS Type select Linux. 8. In Version, select Generic 2.4.x.kernel.
42
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM
9. Select Browse.
10. If you copied the fortios.qcow2 file to /var/lib/libvirt/images, it will be visible on the right. If you saved it somewhere else on your server, select Browse Local and find it. 11. Choose Choose Volume. 12. Select Forward. 13. Specify the amount of memory and number of Us to allocate to this virtual machine. The amounts must not exceed your license limits. See FortiGate VM models and licensing on page 7. 14. Select Forward. 15. Expand Advanced options. A new virtual machine includes one network adapter by default. Select a network adapter on the host computer. Optionally, set a specific MAC address for the virtual network interface. Set Virt Type to virtio and Architecture to qcow2. 16. Select Finish.
Configure FortiGate VM hardware settings Before powering on your FortiGate VM you must add the log disk and configure the virtual hardware of your FortiGate VM.
To configure settings for FortiGate VM on the server: 1. In the Virtual Machine Manager, locate the name of the virtual machine and then select Open from the toolbar. 2. Select Add Hardware. In the Add Hardware window select Storage.
43
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – KVM
3. Select Create a disk image on the computer’s harddrive and set the size to 30GB.
If you know your environment will expand in the future, it is recommended to increase the hard disk size beyond 30GB. The VM license limit is 2TB.
4. Enter: Device type
Virtio disk
Cache mode
Default
Storage format
raw
5. Select Network to configure add more the network interfaces. The Device type must be Virtio. A new virtual machine includes one network adapter by default. You can add more through the Add Hardware window. FortiGate VM requires four network adapters. You can configure network adapters to connect to a virtual switch or to network adapters on the host computer. 6. Select Finish.
Start the FortiGate VM You can now proceed to power on your FortiGate VM. Select the name of the FortiGate VM in the list of virtual machines. In the toolbar, select Console and then select Start.
44
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen Once you have ed the FORTINET.out.OpenXen.zip file and extracted virtual hard drive image file fortios.qcow2, you can create the virtual machine in your OpenXen environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine (VMM)
Create the FortiGate VM virtual machine (VMM) To create the FortiGate VM virtual machine: 1. Launch Virtual Machine Manager (virt-manager) on your OpenXen host server. The Virtual Machine Manager home page opens. 2. In the toolbar, select Create a new virtual machine.
3. Enter a Name for the VM, FGT-VM for example. 4. Ensure that Connection is localhost. (This is the default.) 5. Select Import existing disk image.
45
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
6. Select Forward.
7. In OS Type select Linux. 8. In Version, select Generic 2.4.x.kernel. 9. Select Browse. The Locate or create storage volume window opens. 10. Select Browse Local, find the fortios.qcow2 disk image file. 11. Select fortios.qcow2 and select Choose Volume.
46
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
12. Select Forward.
13. Specify the amount of memory and number of Us to allocate to this virtual machine. The amounts must not exceed your license limits.
47
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
14. Select Forward.
15. Select Customize configuration before install. This enables you to make some hardware configuration changes before VM creation is started. 16. Expand Advanced options. A new virtual machine includes one network adapter by default. Select Specify shared device name and enter the name of the bridge interface on the OpenXen host. Optionally, set a specific MAC address for the virtual network interface. Virt Type and Architecture are set by default and should be correct. 17. Select Finish. The virtual machine hardware configuration window opens.
48
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
You can use this window to add hardware such as network interfaces and disk drives. 18. Select Add Hardware. In the Add Hardware window select Storage. 19. Select Create a disk image on the computer’s harddrive and set the size to 30GB.
If you know your environment will expand in the future, it is recommended to increase the hard disk size beyond 30GB. The VM license limit is 2TB.
20. Enter: Device type
Virtio disk
Cache mode
Default
Storage format
raw
21. Select Network to configure add more the network interfaces. The Device type must be Virtio. A new virtual machine includes one network adapter by default. You can add more through the Add Hardware
49
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – OpenXen
window. FortiGate VM requires four network adapters. You can configure network adapters to connect to a virtual switch or to network adapters on the host computer. 22. Select Finish. 23. Select Begin Installation. After the installation completes successfully, the VM starts and the console window opens.
50
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer Once you have ed the FORTINET.out.CitrixXen.zip file and extracted the files, you can create the virtual machine in your Citrix Xen environment. The following topics are included in this section: l
Create the FortiGate VM virtual machine (XenCenter)
l
Configure virtual hardware
Create the FortiGate VM virtual machine (XenCenter) To create the FortiGate VM virtual machine from the OVF file 1. Launch XenCenter on your management computer. The management computer can be any computer that can run Citrix XenCenter, a Windows application. 2. If you have not already done so, select ADD a server. Enter your Citrix XenServer IP address and the root logon credentials required to manage that server. Your Citrix XenServer is added to the list in the left pane. The Virtual Machine Manager home page opens. 3. Go to File > Import. An import dialog will appear.
51
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
4. Click the Browse button, find the FortiGate-VM64-Xen.ovf template file, then click Open.
5. Select Next.
52
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
6. Accept the FortiGate Virtual Appliance EULA, then select Next.
7. Choose the pool or standalone server that will host the VM, then select Next. 8. Select the storage location for FortiGate VM disk drives or accept the default. Select Next.
53
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
9. Configure how each vNIC (virtual network adapter) in FortiGate VM will be mapped to each vNetwork on the Citrix XenServer, then click Next.
10. Click Next to skip OS fixup. 11. Select Next to use the default network settings for transferring the VM to the host. 12. Select Finish. The Citrix XenServer imports the FortiGate VM files and configures the VM as specified in the OVF template. Depending on your computer’s hardware speed and resource load, and also on the file size and speed of the network connection, this might take several minutes to complete.
When VM import is complete, the XenCenter left pane includes the FortiGate VM in the list of deployed VMs for your Citrix XenServer.
54
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
Configure virtual hardware Before you start your FortiGate-VM for the first time, you need to adjust your virtual machine’s virtual hardware settings to meet your network requirements.
Configuring number of Us and memory size Your FortiGate-VM license limits the number Us and amount of memory that you can use. The amounts you allocate must not exceed your license limits.
To access virtual machine settings 1. Open XenCenter. 2. Select your FortiGate VM in the left pane. The tabs in the right pane provide access to the virtual hardware configuration. The Console tab provides access to the FortiGate console. 1. To set the number of Us 2. In the XenCenter left pane, right-click the FortiGate VM and select Properties. The Properties window opens. 3. In the left pane, select U.
4. Adjust Number of Us and then select OK.
55
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
XenCenter will warn if you select more Us than the Xen host computer contains. Such a configuration might reduce performance.
To set memory size 1. In the XenCenter left pane, select the FortiGate VM. 2. In the right pane, select the Memory tab. 3. Select Edit, modify the value in the Set a fixed memory of field and select OK.
Configuring disk storage By default the FortiGate VM data disk 30GB. You will probably want to increase this. Disk resizing must be done before you start the VM for the first time.
To resize the FortiGate data disk 1. In the XenCenter left pane, select the FortiGate VM. 2. Select the Storage tab. Select Hard disk 2 (the 30GB drive), then select Properties. The ‘Hard disk 2’ Properties window opens.
56
FortiGate-VM Install Guide for FortiOS 5.2
Deployment example – Citrix XenServer
3. Select Size and Location. Adjust Size and select OK.
57
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration Before you can connect to the FortiGate VM web-based manager you must configure a network interface in the FortiGate VM console. Once an interface with istrative access is configured, you can connect to the FortiGate VM web-based Manager and the FortiGate VM license file that you ed from the Customer Service & website. The following topics are included in this section: l
Set FortiGate VM port1 IP address
l
Connect to the FortiGate VM Web-based Manager
l
the FortiGate VM license file
l
Validate the FortiGate VM license with FortiManager
l
Configure your FortiGate VM
Set FortiGate VM port1 IP address Hypervisor management environments include a guest console window. On the FortiGate VM, this provides access to the FortiGate console, equivalent to the console port on a hardware FortiGate unit. Before you can access the Web-based manager, you must configure FortiGate VM port1 with an IP address and istrative access.
To configure the port1 IP address: 1. In your hypervisor manager, start the FortiGate VM and access the console window. You might need to press Return to see a prompt.
Example of FortiGate VM console access:
58
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
2. At the FortiGate VM prompt enter the name . By default there is no . Just press Return. 3. Using CLI commands, configure the port1 IP address and netmask. Also, HTTP access must be enabled because until it is licensed the FortiGate VM s only low-strength encryption. HTTPS access will not work. For example: config system interface edit port1 set ip 192.168.0.100 255.255.255.0 append allowaccess http end
You can also use the append allowaccess CLI command to enable other access protocols, such as auto-ipsec, http, probe-response, radius-acct, snmp, and telnet. The ping, https, ssh, and fgfm protocols are enabled on the port1 interface by default.
4. To configure the default gateway, enter the following CLI commands: config router static edit 1 set device port1 set gateway
59
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
You must configure the default gateway with an IPv4 address. FortiGate VM needs to access the Internet to the FortiGuard Distribution Network (FDN) to validate its license.
5. To configure your DNS servers, enter the following CLI commands: config system dns set primary
The default DNS servers are 208.91.112.53 and 208.91.112.52.
6. To the FortiGate VM license from an FTP or TFTP server, use the following CLI command: execute restore vmlicense {ftp | tftp}
You can also the license in the FortiGate VM Web-based Manager. See the FortiGate VM license file on page 61.
Connect to the FortiGate VM Web-based Manager When you have configured the port1 IP address and netmask, launch a web browser and enter the IP address that you configured for port1. At the page, enter the name and field and select . The default is no . The Web-based Manager will appear with an Evaluation License dialog box.
60
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
Web-based Manager and Evaluation License dialog box
the FortiGate VM license file Every Fortinet VM includes a 15-day trial license. During this time the FortiGate VM operates in evaluation mode. Before using the FortiGate VM you must enter the license file that you ed from the Customer Service & website upon registration.
To the FortiGate VM licence file: 1. In the Evaluation License dialog box, select Enter License. You can also the license file via the CLI using the following CLI command: execute restore vmlicense [ftp | tftp]
License page:
61
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
2. Select Browse and locate the license file (.lic) on your computer. Select OK to the license file. 3. Refresh the browser to . 4. Enter in the Name field and select . The VM registration status appears as valid in the License Information widget once the license has been validated by the FortiGuard Distribution Network (FDN) or FortiManager for closed networks.
Validate the FortiGate VM license with FortiManager You can validate your FortiGate VM license with some models of FortiManager. To determine whether your FortiManager unit has the VM Activation feature, see Features section of the FortiManager Product Data sheet.
62
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
To validate your FortiGate VM with your FortiManager: 1. To configure your FortiManager as a closed network, enter the following CLI command on your FortiManager: config fmupdate publicnetwork set status disable end
2. To configure FortiGate VM to use FortiManager as its override server, enter the following CLI commands on your FortiGate VM: config set set set set
system central-management mode normal type fortimanager fmg
3. Load the FortiGate VM license file in the Web-based Manager. Go to System > Dashboard > Status. In the License Information widget, in the Registration Status field, select Update. Browse for the .lic license file and select OK. 4. To activate the FortiGate VM license, enter the following CLI command on your FortiGate VM: execute update-now
5. To check the FortiGate VM license status, enter the following CLI commands on your FortiGate VM: get system status
The following output is displayed: Version: Fortigate-VM v5.0,build0099,120910 (Interim) Virus-DB: 15.00361(2011-08-24 17:17) Extended DB: 15.00000(2011-08-24 17:09) Extreme DB: 14.00000(2011-08-24 17:10) IPS-DB: 3.00224(2011-10-28 16:39) FortiClient application signature package: 1.456(2012-01-17 18:27) Serial-Number: FGVM02Q105060000
License Status: Valid BIOS version: 04000002 Log hard disk: Available Hostname: Fortigate-VM Operation Mode: NAT Current virtual domain: root Max number of virtual domains: 10 Virtual domains status: 1 in NAT mode, 0 in TP mode Virtual domain configuration: disable FIPS-CC mode: disable Current HA mode: standalone Distribution: International Branch point: 511 Release Version Information: MR3 Patch 4 System time: Wed Jan 18 11:24:34 2012 diagnose hardware sysinfo vm full
63
FortiGate-VM Install Guide for FortiOS 5.2
FortiGate VM Initial Configuration
The following output is displayed: UUID: 564db33a29519f6b1025bf8539a41e92 valid: 1 status: 1
code: 200 (If the license is a duplicate, code 401 will be displayed) warn: 0 copy: 0 received: 45438 warning: 0 recv: 201201201918 dup:
Configure your FortiGate VM Once the FortiGate VM license has been validated you can begin to configure your device. You can use the Wizard located in the top toolbar for basic configuration including enabling central management, setting the , setting the time zone, and port configuration. For more information on configuring your FortiGate VM see the FortiOS Handbook at http://docs.fortinet.com.
64
FortiGate-VM Install Guide for FortiOS 5.2
Copyright© 2015 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are ed trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be ed and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
Related Documents 543cg
Fortigate Vm Install 52 1y431f
August 2021 0
Fortigate Vm Install 50 731a3d
March 2023 0
Fortigate-vm 1a1ou
November 2019 47
Fortigate Vm Install Guide 40 Mr3 5213i
December 2019 43
Fortigate Vm Install Guide 40 Mr2 3x36e
December 2019 37
Fortigate-cookbook-52.pdf 643d3h
June 2022 0More Documents from "Mauricio Torres" 2245
Fortigate-vdom 1y4e6n
December 2019 43
Tuberia De Pvc Y Concreto 6r546w
November 2020 0
Beuchot Mauricio - Hermeneutica Lenguaje E Inconsciente(ocr Y Opt).pdf 1f2o3p
April 2020 60
Fortigate Load Balance 521 4q4v2y
November 2019 42
Fortigate Vm Install 52 1y431f
August 2021 0