1. Configuring the tunnel interfaces

In order for FortiTelemetry traffic to flow securely through the IPsec VPN, FortiTelemetry traffic must travel between the tunnel interfaces, with the interface on External listening for this traffic.

The tunnel interfaces require IP addresses. In this example, the External tunnel interface is assigned the IP address 1.1.1.1 and the Branch tunnel interface is assigned the IP address 1.1.1.2.

On External, go to Network > Interfaces and edit the tunnel interface.

Set IP to the local IP address for this interface (1.1.1.1) and Remote IP to the local IP address for the Branch tunnel interface (1.1.1.2).

Under Administrative Access, enable FortiTelemetry.

On Branch, go to Network > Interfaces and edit the tunnel interface.

Set IP to the local IP address for this interface (1.1.1.2) and Remote IP to the local IP address for the External tunnel interface (1.1.1.1). 

2. Adding the tunnel interfaces to the VPN

Create a second address for the Branch tunnel interface.

For this address, enable Static Route Configuration.

Go to VPN > IPsec Tunnels and edit the VPN tunnel. Select Convert To Custom Tunnel.

Under Phase 2 Selectors, create a second Phase 2 allowing traffic between the External tunnel interface to the Branch tunnel interface.

Go to Network > Static Routes and create a route to the Branch tunnel interface.

Set Destination to Named Address and select the firewall address. Set Device to the tunnel interface.

Go to Policy & Objects > IPv4 Policy and edit the policy allowing local VPN traffic.

Set Source to include the External tunnel interface and Destination to include the Branch tunnel interface.

On Branch, repeat this step to include the following:

• Addresses for both tunnel interfaces (the address for the Branch tunnel interface must have Static Route Configuration enabled)
• A Phase 2 allowing traffic between the Branch tunnel interface and the External tunnel interface
• A static route to the External tunnel interface
• Edited policies that allow traffic to flow between the tunnel interfaces

Go to Monitor > IPsec Monitor and restart the VPN tunnel, allowing the new phase 2 to take effect.

3. Adding Branch to the Security Fabric

On Branch, go to Security Fabric > Settings and enable FortiGate Telemetry. Set the Group name and Group password of the Security Fabric.

Enable Connect to upstream FortiGate and set FortiGate IP to the IP address of the External tunnel interface.

Add lan to the list of FortiTelemetry enabled interfaces.

4. Allowing Branch to access the FortiAnalyzer

On Branch, go to Policy & Objects > Addresses and create an address for the FortiAnalyzer.

Enable Static Route Configuration.

Go to VPN > IPsec Tunnels and create a Phase 2 allowing traffic between the Branch tunnel interface and the FortiAnalyzer.

Go to Network > Static Routes and create a route to the FortiAnalyzer.

Go to Policy & Objects > IPv4 Policy and create a policy allowing traffic from the VPN tunnel to the FortiAnalyzer.

Enable NAT for this policy.

5. Results

6. (Optional) Using local logging for Branch

If you would prefer to use local logging for Branch, rather than sending logs to a remote FortiAnalyzer, you can do so using the following CLI command:

config system csf
  set logging-mode local
end

You can then go to Log & Report > Log Settings and configure local logging as required.

This option is available for all FortiGates in the Security Fabric, except for the root FortiGate.

1. Configure the HQ IPsec VPN

On the HQ FortiGate, go to VPN > IPsec Wizard.

Select the Site to Site template, and select FortiGate.

In the Authentication step, set IP Address to the IP of the Branch FortiGate (in the example, 172.31.1.65). After you enter the gateway, an available interface will be assigned as the Outgoing Interface.  Set a secure Pre-shared Key.

In the Policy & Routing step, set the Local Interface. The Local Subnets will be added automatically. Set Remote Subnets to the Branch FortiGate’s local subnet (10.1.2.0/24)

A summary page shows the configuration created by the wizard.

2. Configure the Branch IPsec VPN

On the Branch FortiGate, go to VPN > IPsec Wizard.

Select the Site to Site template, and select FortiGate.

In the Authentication step, set IP Address to the IP of the HQ FortiGate (in the example, 172.31.1.64). After you enter the gateway, an available interface will be assigned as the Outgoing Interface.

Set the same Pre-shared Key that was used for HQ’s VPN.

In the Policy & Routing step, set the Local Interface. The Local Subnets will be added automatically. Set Remote Subnets to the HQ FortiGate’s local subnet (in the example, 10.1.1.0/24).

A summary page shows the configuration created by the wizard, including firewall addresses, firewall address groups, a static route, and security policies.

On either FortiGate, go to Monitor > IPsec Monitor to verify the status of the VPN tunnel. Right-click under Status and select Bring Up.

At this point in the configuration, the multicast server behind the HQ FortiGate should be able to ping the client at Branch.   If you need to generate traffic to test the connection, ping the Branch FortiGate’s internal interface from the HQ’s internal network.

3. Configure the HQ multicast policy and phase 2 settings

On the HQ FortiGate, go to Policy & Objects > Multicast Policy.  (If multicast policy is not available, go to System > Feature Visibility and enable the feature).

Create a new policy and allow the multicast traffic from the source interface to the tunnel.

Create another multicast policy that allows multicast traffic from the tunnel to the LAN interface of the multicast server.

Add a phase 2 selector to the VPN tunnel by going to VPN > IPsec Tunnels and editing the tunnel.  Add a phase 2 selector with 10.1.1.0/24 as the local address and 239.0.0.0/8 as the remote address.

Enable multicast forwarding

At the CLI prompt, enter:

config system settings
       set multicast-forward enable
end

4. Configure Branch multicast policy and phase 2 settings

On the Branch FortiGate, go to Policy & Objects > Multicast Policy.  (If multicast policy is not available, go to System > Feature Visibility and enable the feature).

Create a new policy and allow the multicast traffic from the source interface to the tunnel.

Create another multicast policy that allows multicast traffic from the tunnel to the LAN interface of the multicast server.

Add a phase 2 selector to the VPN tunnel by going to VPN > IPsec Tunnels and editing the tunnel.  Add a phase 2 selector with 239.0.0.0/8 as the local address and 10.1.1.0/24 as the remote address.

Enable multicast forwarding

At the CLI prompt, enter:

config system settings
    set multicast-forward enable
end

5. Results

Multicast traffic should now flow from the multicast server to the client.  Start the multicast stream and make note the of the address being used.  In this configuration, all multicast traffic that matches 239.0.0.0/8 should flow from the HQ to the Branch.

Multicast traffic flow can be verified by issuing the “diag sys mcast-session list” command on the branch Fortigate.

In the example above, we see the multicast group sourcing from the HQ server and transmitting on multicast group address 239.1.1.100:1234.  The multicast receiver application on the branch host should now be able to receive this multicast traffic.

WAN destination bubbles

• Shows traffic to interfaces that have the WAN role
• Does not require device detection on the interface

LAN device bubbles

• Shows any device detected on any FortiGate interfaces, regardless of interface role
• Requires device detection on the interfaces

 Enabling POP and IMAP

First we will need to enable POP and IMAP access in the Google Admin console.

1. Sign in to your Google Admin console
2. Go to  Apps > G Suite >Gmail > Advanced Settings.
3. Select the organization unit you want to configure in the Organization section.
4. Select or clear the check boxes for Disable POP and IMAP access for all users in the domain. This setting is enabled by default.

 Creating a SMTP Authentication Profile

Now you will need to create a new SMTP Authentication Profile on FortiMail (build 5.4.x).

1. Go to Profile > Authentication > SMTP.
2. Select New.
3. Enter “Gsuites-SMTP_Auth” in the Profile name section.
4. Enter “smtp.gmail.com” in the Server name/IP section.
5. Enter 587 in the Server port section.
6. Disable Use generic LDAP mail host if available.
7. Enable SSL/TLS and Server requires domain.
8. Select Create.

 Establishing Authentication

Now we will need to edit an existing recipient policy.

1. Go to Policy > Recipient Policy > Inbound.
2. Select your existing policy and select Edit.
3. Expand the Authentication and Access section.
4. Select SMTP from the Authentication type dropdown menu.
5. Select “Gsuites-SMTP_AUTH” from the Authentication profile dropdown menu.
6. Select OK.

1. Registering and downloading your license

If you’re deploying a FortiAnalyzer-VM in the Microsoft Azure marketplace, you must obtain a license to activate it. FortiAnalyzer-VM for Microsoft Azure supports a bring-your-own-license (BYOL) licensing model.

Licenses can be obtained through any Fortinet partner. If you don’t have a partner, contact azure@fortinet.com for assistance in purchasing a license.

After you purchase a license or obtain an evaluation license (60-day term), you will receive a PDF with an activation code. 

Go to Asset > Register/Renew to start the registration process.

In the Specify Registration Code field, enter your license activation code and select Next to continue registering the product. Enter your details in the other fields.

At the end of the registration process, download the license (.lic) file for your FortiAnalyzer-VM.

After registering a license, Fortinet servers may take up to 30 minutes to fully recognize the new license. When you upload the license (.lic) file to activate the FortiAnalyzer-VM (in step 3), if you get an error that the license is invalid, wait 30 minutes and try again.

2. Creating a FortiAnalyzer-VM

In the Basics section, set a FortiAnalyzer-VM name in the FortiAnalyzer virtual appliance name field. 

Set a FortiAnalyzer administrative username. This name can’t be admin or root.

Choose a FortiAnalyzer password for the new account and confirm the password. For security reasons, it’s not possible to reset this password through the Microsoft Azure portal, so make sure that you remember the password.

Select the appropriate Subscription from the drop-down list. You may have only one option here.

Create a new Resource group. Currently, it’s not possible to select an existing resource group for a Microsoft Azure Marketplace template set.

Set a Location for the VM.

Select OK.

In the Network and Storage Settings section, select Virtual network. You can either create a new virtual network (VNet) or select an existing one.

In the Address space field, accept the default values or specify your own.

Select OK.

In the Subnet section, the Subnet name and Subnet address prefix are pre-defined and you shouldn’t need to change the default values. 

Select OK.

In the Virtual machine size section, select the appropriate VM size for your deployment. 

In the Microsoft Azure Marketplace, the FortiAnalyzer virtual machines come in a variety of sizes, from A0 Standard to D4 Standard. Each virtual machine size within each series has different limits for the amount of memory, number of network interface cards (NIC), maximum number of data disks, size of cache, and maximum input/output operations per second (IOPS) and bandwidth.

Select OK.

In the Storage account section, choose an existing storage account or create a new one. All resources should be in the same location. 

Set a Name for the storage account.

Under Performance, choose a storage account type.

Select the Replication option you want to use. The options are Locally redundant storage (LRS) or Geo-redundant storage (GRS). LRS is where all data in the Microsoft Azure storage account replicates synchronously to three different storage nodes within the primary region that was chosen when you created the Microsoft Azure storage account. GRS is where every entity is replicated into two data centers.

The data in the Microsoft Azure storage account is always replicated in order to ensure durability and high availability. Some settings can’t be changed after the storage account is created.

To accept the Network and Storage Settings values, select OK.

In the FortiAnalyzer IP address assignments section, select First public IP address resource name. In the Name field, set a name for the public IP address of the FortiAnalyzer. In the Assignment field, select Dynamic or Static. Select OK.

In the Public IP address type field, select Static or Dynamic. Select OK.

Select Purchase to buy the FortiAnalyzer-VM instance from Microsoft Azure. 

Once the FortiAnalyzer-VM is deployed, you will see a “Deployment succeeded” message.

3. Connecting to the FortiAnalyzer-VM

To connect to the FortiAnalyzer-VM, you must find its public IP address. There are a number of ways to do this. One way is to select Virtual machines on the left bar and select the FortiAnalyzer-VM you created. Under Essentials, you will see the public IP address of the FortiAnalyzer-VM in the Public IP address field. 

Connect to the FortiAnalyzer using your browser and the FortiAnalyzer-VM IP address. Log in to the FortiAnalyzer-VM with the FortiWeb administrative username and FortiAnalyzer password that you configured above. 

Upload your license (.lic) file to activate the FortiAnalyzer-VM. Restart the FortiAnalyzer-VM and log in again.

After you log in, you will see that the license has been uploaded. You need to wait for authentication with the registration servers. This can take up to 15 minutes.

Select Return.

 Configuring FortiVoice

First we’ll need to configure FortiVoice to connect to Alexa.

1. Go to Phone System > Advanced Settings > Miscellaneous.
2. Enable Amazon Alexa under the Internet of Things section and select Apply.
3. Go to Call Features > Internet of Things.
4. Select New.
5. Enter the user’s email address and create a password.
6. Select the applicable extension for the user.
7. Select the Amazon Alexa service for the extension. If you wish to use the phone to initiate requests to Alexa, enable FortiVoice Extension.
8. Select Create and then Yes.

 Configuring Amazon Alexa

With FortiVoice configured, we can now focus on setting up Amazon Alexa. First, we’ll need to access the user portal to authorize the Alexa extension.

1. Go to Internet of Things.
2. Select the Authorize my extension link.
3. Accept the terms and conditions.
4. Enter your Amazon username and password or create a new one.
5. Enter the user portal email and authorization code.
6. Add the FortiVoice skill through Amazon.

 Using Amazon Alexa

With Amazon Alexa now configured, you can now use the device in conjunction with FortiVoice.

To use Alexa, simply dial *91 before issuing a command. 

Here are a few examples of commands you can issue Alexa:

• You could ask Alexa to set FortiVoice to do not disturb by simply saying “Ask FortiVoice to turn on do not disturb”. 
• You could ask Alexa to call a person in your office by saying “Ask Fortivoice to call John”. Now, if there are multiple Johns, Alexa will respond asking you to clarify by providing the person’s last name.
• You could enable call forwarding by saying “Ask FortiVoice to turn on call forwarding <number>.

1. Creating a self-registration user group

Go to Authentication > User Management > User Groups and create a new user group for self-registering users.

Enter a Name and select OK. Users will be added to this group once they register through the self-registration portal.

2. Enabling self-registration 

Go to Authentication > Self-service Portal > General.

Enter a Site name, add an Email signature that you would like appended to the end of outgoing emails, and select OK.

3. Enabling self-registration  

Enable Require administrator approval and Enable email to freeform addresses, and enter the administrator’s email address in the field provided.

Enable Place registered users into a group, select the user group created earlier, and configure basic account information to be sent to the user by Email.

Open the Required Field Configuration dropdown and enable First name, Last name, and Email address.

4. Creating a new SMTP server

Enter a Name, the IP address of the FortiAuthenticator, and leave the default port value (25).

Enter the administrator’s email address, Account username, and Password.

Note that, for the purpose of this recipe, Secure connection will not be set to STARTTLS, as a signed CA certificate would be required.

Once created, highlight the new server and select Set as Default.

The new SMTP server will now be used for future user registration.

5. Results — Self-registration

When the user visits the login page, https://<FortiAuthenticator-IP>/auth/register/, they can click the Register button, where they will be prompted to enter their information.

They will need to enter and confirm a Username, Password, First name, Last name, and Email address. These are the only required fields, as configured in the FortiAuthenticator earlier.

Select Submit.

the user will receive an activation welcome email.

The user’s login information will be listed.

The user is now logged into their account where they can review their information.

As recommended in the user’s welcome email, the user may change their password. However, this is optional.

6. Results — Administrator approval

In the administrator’s email account, open the user’s Approval Required email. The user’s full name will appear in the email’s subject, along with their username in the emai’s body.

Select the link to approve or deny the user.

The link will take you to the New User Approval page, where you can review the user’s information and either approve or deny the user’s full registration.

Select Approve.

The user has now been approved and activated by the administrator.

This can be confirmed by going back to Authentication > User Management > Local Users. The user’s Status has changed to Enabled.

7. Verifying the results  

1. Enable Web Filtering and Application Control

Go to System > Feature Visibility to enable the Web Filter and Application Control features.

2. Edit the default Web Filter profile

Go to Security Profiles > Web Filter and edit the default profile.

To block Facebook, go to Static URL filter, enable URL Filter, and then click + Create.

Set URL to *facebook.com. Set Type to Wildcard, set Action to Block, and set Status to Enable.

3. Edit the default Application Control profile

Go to Security Profiles > Application Control and edit the default profile.

To block Facebook, go to Application Overrides and click on + Add Signatures.

4. Create the security policy

Go to Policy & Objects > IPv4 Policy, and click + Create New. Give the policy an identifying name. In this example, blocking-facebook.

Set Incoming Interface to the internal network and set Outgoing Interface to the Internet-facing interface.

Enable NAT.

Under Security Profiles, enable Web Filter and Application Control. Select the default web filter and application control profiles.

Once you select those profiles, SSL/SSH Inspection is enabled by default. If you are using proxy-based inspection mode, then Proxy Options will also be enabled by default.

To inspect all traffic, SSL/SSH inspection must be set to deep-inspection profile.

The new policy must be first on the list in order to be applied to Internet traffic. Confirm this by viewing policies By Sequence.

To move a policy up or down, click and drag the far-left column of the policy.

If your FortiAP is configured in tunnel mode, you will need to edit the wireless policy and apply the web filter and application control security profiles to that policy.

5. Results

Visit facebook.com.

HTTPS is automatically applied to facebook.com, even if it is not entered in the address bar. A Web Page Blocked! message appears. 

A FortiGuard warning message will appear, stating that the application was blocked.

Visit a subdomain of Facebook, for example, attachments.facebook.com.

A Web Page Blocked! message appears, blocking the subdomain.  

Using a mobile device, or any device that has the Facebook app installed, ensure that you are connected to the Internet. Open the Facebook app and login. You should not be able to connect.

Go to Log & Report > Web Filter. You will see that facebook.com and attachments.facebook.com are blocked by the FortiGate.

1. Acquiring the MAC address

Acquire the MAC address of a particular device as follows:

• Windows device:
  Open the command prompt and type ipconfig /all.
  The MAC address of your Windows device is the Physical Address, under information about the wireless adapter.
• Mac OS X device:
  Open Terminal and type ifconfig en1 | grep ether.
  Take note of the displayed MAC address.
  
• iOS device:
  Open Settings > General > About.
  The Wi-Fi Address  is the MAC address of your iOS device.
  
• Android device:
  Open Settings > About Device > Status.
  Take note of the Wi-Fi MAC address of your Android device.

2. Creating the FortiAP interface

Go to Network > Interfaces and create an internal FortiAP interface.

Set Addressing Mode to Manual and set an IP/Network Mask.

Under Administrative Access, enable CAPWAP.

Enable DHCP Server and set the Starting IP and End IP.

Enable Device Detection and click OK.

3. Defining a device using its MAC address

Go to User & Device > Custom Devices & Groups and create a new device definition.

Set MAC Address to the device’s address obtained in Step 1 and set the other fields as required.

4. Creating the new SSID

Go to WiFi & Switch Controller > SSID and create a new SSID.

Set Traffic Mode to Tunnel.

Select an IP/Network Mask for the wireless interface and enable DHCP Server.

Enable Device Detection.

Under WiFi Settings, name the SSID (in the example, MySecureWiFi).

Set the Security Mode as required and enter a secure Pre-shared Key.

Enable Broadcast SSID.

Under Filter clients by MAC Address, enable Local and select Add from device list.

Add the device you configured in Step 3 and set its Action to Accept. Set the Action for Unknown MAC Addresses to Deny.

If you haven’t already, connect the FortiAP unit to the interface created in Step 2.

5. Managing the FortiAP

Go to WiFi & Switch Controller > Managed FortiAPs.

If the FortiAP is not listed you may need to wait a few minutes. If the device still does not appear, select Create New > Managed AP.

Once you enter the Serial Number, the default FortiAP Profile for that model is selected. Click OK.

6. Authorizing the managed FortiAP

7. Editing the default FortiAP Profile

Go to WiFi & Switch Controller > FortiAP Profiles and Edit the default profile for your particular FortiAP model.

For all radios you wish to use, set the SSID to Manual and select the SSID created in Step 4.

8. Allowing wireless access to the Internet

Go to Policy & Objects > IPv4 Policy and create a new policy.

Set Incoming Interface to the SSID and Outgoing Interface to your Internet-facing interface.

Enable NAT.

9. Results

Using the authorized device, connect to the broadcast SSID (in the example, MySecureWifi).

Go to Log & Report > WiFi Events and verify the authorized connection.

On the FortiWLC, go to Configuration > Security > RADIUS and click the ADD botton and create two profiles. One to be used for Authentication and one to be used for Accounting.

RADIUS Profile name: Enter a name for the profile. TIP: Use a name that will indicate if the profile is used for Authentication or Accounting.
RADIUS IP: IP address of the FortiAuthenticator.
RADIUS Secret: Shared Secret between WLC and FortiAuthenticator.
RADIUS Port: use 1812 for Authentication profile and 1813 when creating an Accounting Profile.

On the FortiWLC, go to Configuration > Security > Captive Portal, select the Captive Portal Profiles tab, and ADD a new profile.

CP Name: Enter a name for the profile.
Authentication Type: RADIUS.
Primary Authentication: Your Authentication profile.
Primary Accounting: Your Accounting profile.
External Server: FortinetConnect.
External Portal URL: https://<fortiauthenticator-ip>/guests
Public IP of Controller: IP address of the FortiWLC.

On the FortiWLC, go to Configuration > Security > Profile, and ADD a new profile.

Profile Name: Enter a name for the profile.
Security mode: Open.
Captive Portal: Webauth.
Captive Portal Profile: Select the profile created earlier.
Captive Portal Authentication Method: external.
Passthrough Firewall Filter ID: Your choice, will be used to allow access to the portal before authentication using QoS rules.

On the FortiWLC, go to Configuration > Policies > QoS and select the QoS and Firewall Rules tab.
Use the ADD button to create two profiles.

For the first rule, allow the wireless client to access FortiAuthenticator’s guest portal.

ID: Rule number.
Destination IP: IP address of the FortiAuthenticator, and enable Match
Destination Netmask: 255.255.255.255
Destination Port: 443, and enable Match
Network Protocol: 6, and enable Match
Firewall Filter ID: Use the “Passthrough Firewall Filter ID” string from the Security Profile, and enable Match
QoS Protocol: Other.

For the second rule, allow FortiAuthenticator to reach the clients.

ID: Rule number.
Source IP: IP address of the FortiAuthenticator, and enable Match
Source Netmask: 255.255.255.255
Source Port: 443, and enable Match
Network Protocol: 6, and enable Match
Firewall Filter ID: Use the “Passthrough Firewall Filter ID” string from the Security Profile, and enable Match
QoS Protocol: Other.

On the FortiWLC, go to Configuration > Wireless > ESS and ADD an ESS profile.

Configure the profile with an appropriate ESS Profile and SSID. Then select the Security Profile that contains the Captive Portal settings.

Primary RADIUS Accounting Server: Your RADIUS Accounting profile.

On the FortiAuthenticator, go to Authentication > RADIUS Service > Clients and create a new client.

Set Client address as IP/Hostname and enter the FortiWLC management IP as the IP address. Set the same Secret that was entered during the RADIUS configuration on the FortiWLC.
At the Profiles section set a new Profile name, and choose EAP types.
At the Realms section choose the Realms that are allowed.

On the FortiAuthenticator, go to Authentication > Guest Portals > Portals and create a new portal.

For the Profile Configuration select the RADIUS profile created earlier.

On the FortiAuthenticator, go to Authentication > Guest Portal > Rules and create a new rule.

For Action choose Go to portal, and select the portal created earlier.

You can choose different HTTP parameters to determine which portal to show (used for instances with multiple portals from different FortiWLC’s and or Client IP subnets)

Connect a client to the SSID created on the FortiWLC, then login to the portal with the correct username and password.

You can use Authentication > User Management > Local Users to create local user accounts for the FortiAuthenticator.

To confirm the successful login, on  FortiAuthenticator go to Logging > Log Access > Logs

Find the line showing User Portal at Sub Category

To confirm the successful login, on FortiWLC go to Monitor > Devices > All Stations and find the device showing the authenticated user.

1. Determining your licensing model

FortiGate-VM for AWS supports both on-demand (PAYG) and bring-your-own-license (BYOL) licensing models.

On-demand users don’t need to register from the FortiGate GUI console. If you’re using an on-demand licensing model, once you create the FortiGate-VM instance in AWS, contact Fortinet Customer Support (http://www.fortinet.com/support/contact_support.html) with the following information:

• The serial number of your FortiGate-VM instance
• The email ID of your Fortinet account. If you don’t have a Fortinet account, you can create one at https://support.fortinet.com/login/CreateAccount.aspx.

If you’re deploying a FortiGate-VM in the AWS Marketplace with BYOL, you must obtain a license to activate it.

2. Registering and downloading your license (BYOL)

Licenses for the BYOL licensing model can be obtained through any Fortinet partner. If you don’t have a partner, contact aws@fortinet.com for assistance in purchasing a license.

After you purchase a license or obtain an evaluation license (60-day term), you will receive a PDF with an activation code.

Go to https://support.fortinet.com/ and either create a new account or log in with an existing account.

Go to Asset > Register/Renew to start the registration process.

In the Specify Registration Code field, enter your license activation code and select Next to continue registering the product. Enter your details in the other fields.

At the end of the registration process, download the license (.lic) file to your computer. You will upload this license later (in step 6) to activate the FortiGate-VM.

After registering a license, Fortinet servers may take up to 30 minutes to fully recognize the new license. When you upload the license (.lic) file to activate the FortiGate-VM, if you get an error that the license is invalid, wait 30 minutes and try again.

3. Creating an AWS VPC

This section shows you how to create an AWS VPC and create two subnets in it. For many of the steps, you will have a choice to make that can be specific to your own environment.

Log in to the AWS Management Console.

In the Networking & Content Delivery section, select VPC.

In the Virtual Private Cloud menu, select Your VPCs, then select Create VPC.

In the Name tag field, set a name for your VPC.

In the CIDR block field, specify an IPv4 address range for your VPC.

In the Tenancy field, select Default.

Select Yes, Create.

In the Virtual Private Cloud menu, select Subnets, then select Create Subnet. Create a public subnet (in this example, Subnet1) and a private subnet (Subnet2), as shown in this example.

Both subnets belong to the VPC that you created.

4. Connect the new VPC to the Internet gateway

This section shows you how to connect the new VPC to the Internet gateway. Note that if you’re using the default VPC, the Internet gateway should already exist.

In the Virtual Private Cloud menu, select Internet Gateways, then select Create Internet Gateway.

In the Name tag field, set a name for the Internet gateway, then select Yes, Create.

Select the Internet gateway, then select Attach to VPC.

Select the VPC that you created and select Yes, Attach.

The state of the Internet gateway will change from detached to attached.

5.   Subscribing to the FortiGate-VM

This section shows you how to subscribe to and configure the FortiGate-VM. 

In the Network field, select the VPC that you created.

In the Subnet field, select the public subnet.

In the Network interfaces section, you will see the entry for eth0 that was created for the public subnet. Select Add Device to add another network interface (in this example, eth1), and select the private subnet. It is recommended that you assign static IP addresses.

When you have two network interfaces, a global IP address isn’t assigned automatically. You must manually assign a global IP address later.

Select Review and Launch, then select Launch.

To easily identify the instance, set a name for it in the Name field.

In the Network & Security menu, select Elastic IPs, then select a global IP address that is available for you to use. Select Actions > Associate Address.

If you don’t have a global IP address available to use, create one.

In the Resource type section, select Network Interface. 

In the Network interface field, select the Interface ID of the network interface that you created for the public subnet (in this example, eth0). In the Private IP field, select the IP address that belongs to the public subnet. To find these values, go to the EC2 Management Console, select Instances, and select the interface in the Network interfaces section in the lower pane of the page (Interface ID and Private IP Address fields). Select Associate.

A message is displayed indicating the address association was successful. Note that if the Internet Gateway isn’t associated with a VPC, the elastic IP assignment will fail.

Next, configure the routing tables. Since the FortiGate has two interfaces, one for the public subnet and one for the private subnet, you must configure two routing tables.

To configure the routing table for the public subnet, select VPC in the Networking & Content Delivery section of the AWS Management Console. In the VPC Dashboard, select Your VPCs, and select the VPC you created. In the Summary tab in the lower pane, select the route table ID located in the Route table field. To easily identify the route table, set a name for it in the Name field.

In the Routes tab, select Edit, then select Add another route. In the Destination field, type 0.0.0.0/0. In the Target field, type ig and select the Internet Gateway from the auto-complete suggestions. Select Save. 

The default route on the public interface in this VPC is now the Internet Gateway.

In the Subnet Associations tab, select Edit, and select the public subnet to associate it with this routing table. Select Save.

To configure the routing table for the private subnet, select Create Route Table. To easily identify the route table, set a name for it in the Name field. Select the VPC you created. Select Yes, Create.

In the Routes tab, select Edit, then select Add another route. In the Destination field, type 0.0.0.0/0. In the Target field, enter the interface ID of the private network interface. To find the interface ID, go to the EC2 Management Console, select Instances, and select the interface in the Network interfaces section in the lower pane of the page (Interface ID field). Select Save.

The default route on the private subnet in this VPC is now the private network interface of the FortiGate.

In the Subnet Associations tab, select Edit, select the private subnet to associate it with this routing table. Select Save.

Two routing tables, one for the public segment and one for the private segment, have now been created with default routes.

In the EC2 Management Console, select Instances, and select the network interface that you created for the private subnet (in this example, eth1) in the Network interfaces section in the lower pane. Select the interface ID.

Select the network interface, select the Actions drop-down menu, select Change Source/Dest. Check. Select Disabled. Select Save.

6. Connecting to the FortiGate-VM  

To connect to the FortiGate-VM, you need your login credentials and its public DNS address.

The default username is admin and the default password is the instance ID.

You can find the public DNS address in the EC2 Management Console. Select Instances and look at the Public DNS (IPv4) field in the lower pane. If you don’t see the DNS address, you may need to enable DNS host assignment on your VPC. In this case, go back to the VPC Management Console, select Your VPCs, and select your VPC. Select the Action drop-down menu, and select Edit DNS Hostnames. Select Yes. Select Save.

Open an HTTPS session using the public DNS address of the FortiGate-VM.

Use your credentials to log in to the FortiGate-VM.

If you’re using a BYOL license, upload your license (.lic) file to activate the FortiGate-VM. 

The FortiGate-VM will automatically restart. After it restarts, log in again.

You will now see the FortiGate-VM dashboard.

Depending on your license type, the information in the license widget on the dashboard may vary.

7. Setting up the Windows server

In the AWS Management Console, select EC2. Select Launch Instance, then select the Microsoft Windows Server 2012 R2 that applies to your environment.

You will use this to test connectivity with Remote Desktop access.

In the Configure Security Group step, configure a security group for the Windows server so that it allows Internet access. In this example, we use Remote Desktop TCP port 3389, and other ports are optional. Select Review and Launch.

8. Configuring FortiGate firewall policies

In the FortiGate-VM console, select Policy & Objects > IPv4 Policy and create two new policies, as shown in this example. 

Create one policy for outgoing traffic from the private subnet, through the public subnet, to the Internet. Create another policy for incoming traffic from the Internet, through the public subnet, to the private subnet.

9. Results

Open a web browser and try to access the following site: metal.fortiguard.com/tests

Scroll down the page and select one of the test virus files that are listed as infected.

You should see a blocked page alert because your Internet access is now protected by FortiGate.

1. Configuring MAC Authentication Bypass on the FortiAuthenticator

2. Configuring the user group

Go to Authentication > User Management > User Groups and create a new user group.

No members are required; MAC-based authentication devices are automatically linked with this group.

Click OK.

Edit the group you just created and add RADIUS Attributes as shown.

3. Configuring the RADIUS client

Go to Authentication > RADIUS Service > Clients and create a new RADIUS client. Configure the Switch IP and Shared Secret.

Use the Local realm.

Allow MAC-based authentication and link the group created in Step 2.

4. Configuring the 3rd-party switch

The switch configuration provided below is intended for demonstration only. Your switch configuration is likely to differ significantly.

set system services dhcp pool 10.1.2.0/24 address-range low 10.1.2.220
set system services dhcp pool 10.1.2.0/24 address-range high 10.1.2.230
set system services dhcp pool 10.1.2.0/24 domain-name fortiad.net
set system services dhcp pool 10.1.2.0/24 name-server 10.1.2.122
set system services dhcp pool 10.1.2.0/24 router 10.1.2.1
set system services dhcp pool 10.1.2.0/24 server-identifier 10.1.2.27
set interfaces ge-0/0/0 unit 0 family ethernet-switching #no vlan assigned to printer port, this will be allocated based on Group attributes
set interfaces ge-0/0/11 unit 0 family ethernet-switching vlan members engineering #interface used to communicate with FortiAuthenticator
set interfaces vlan unit 10 family inet address 10.1.2.27/24
set protocols dot1x authenticator authentication-profile-name profile1
set protocols dot1x authenticator interface ge-0/0/0.0 mac-radius restrict #forces mac address as username over RADIUS
set access radius-server 10.1.2.29 secret "$9$kmfzIRSlvLhSLNVYZGk.Pf39"
set access profile profile1 authentication-order radius
set access profile profile1 radius authentication-server 10.1.2.29
set vlans engineering vlan-id 10
set vlans engineering l3-interface vlan.10

No configuration is required on the endpoint.

5. Results

Using tcpdump, FortiAuthenticator shows receipt of an Incoming Authentication Request (tcpdump host 10.1.2.27 -nnvvXs):

tcpdump: listening on port1, link-type EN10MB (Ethernet), capture size 262144 bytes
17:36:19.110399 IP (tos 0x0, ttl 64, id 18417, offset 0, flags [none], proto UDP (17), length 185)
  10.1.2.27.60114 > 10.1.2.29.1812: [udp sum ok] RADIUS, length: 157
    Access-Request (1), id: 0x08, Authenticator: b77fe0657747891fc8d53ae0ad2b0e7a
      User-Name Attribute (1), length: 14, Value: 0022681af1a0 #Switch forces username to be endpoint MAC address, no configuration needed on endpoint
        0x0000:  3030 3232 3638 3161 6631 6130
      NAS-Port Attribute (5), length: 6, Value: 70
        0x0000:  0000 0046
      EAP-Message Attribute (79), length: 19, Value: .
        0x0000:  0200 0011 0130 3032 3236 3831 6166 3161
        0x0010:  30
      Message-Authenticator Attribute (80), length: 18, Value: .y{.j.%..9|es.'x 
        0x0000: a679 7b82 6344 2593 f639 7c65 73eb 2778 
      Acct-Session-Id Attribute (44), length: 24, value: 802.1x81fa002500078442 
        0x0000: 384f 322e 3178 3831 6661 3030 3235 3030 
        0x0010: 3037 3834 3432
      NAS-Port-rd Attribute (87), length: 12, Value: ge-0/0/0.0 
        0x0000: 6765 2430 2f30 2f30 2e30 
      Calling-Station-Id Attribute (31), length: 19, value: 00-22-68-1a-fl-a0 
        0x0000: 3030 2032 3220 3638 2031 6120 6631 2461 
        0x0010: 30 
      Called-Station-Id Attribute (30), length: 19, Value: a8-40-e5-b0-21-80 
        0x0000: 6138 2464 3024 6535 2d62 302d 3231 2d38 
        0x0010: 30 
      NAS-Port-Type Attribute (61), length: 6, value: Ethernet 
        0x0000: 0000 000f 

Go to Logging > Log Access > Logs to verify the device authentication.

The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

Continuing with tcpdump, authentication is accepted from FortiAuthenticator and authorization attributes returned to the switch:

17:36:19.115264 IP (tos Ox0, ttl 64, id 49111, offset 0, flags [none], proto UDP (17), length 73) 
  10.1.2.29.1812 > 10.1.2.27.60114: (bad udp cksum 0x1880 -> 0x5ccel] RADIUS, length: 45 
    Access-Accept (2), id: 0x08, Authenticator: b5c7b1bb5a316fb483a622eaae58ccc2 
      Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13 
        0x0000: 0000 000d 
      Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802 
        Ox0000: 0000 0006 
      Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering
        Ox0000: 656e 6769 6e65 6572 696e 67
    Ox0000: 4500 0049 bfd7 0000 4011 a293 0a01 021d E..I....@ .......
    0x0010: Oa01 021b 0714 ead2 0035 1880 0208 002d 5 
    0x0020: b5c7 blbb 5a31 6fb4 83a6 22ea ae58 ccc2 ....21o..."..X.. 
    0x0030: 4006 0000 0000 4106 0000 0006 510d 656e @ A Q en 
    0x0040: 6769 6e65 6572 696e 67                  gineering 

Post-authentication DHCP transaction is picked up by FortiAuthenticator (tcpdump continued):

17:36:22.955537 IP (tos Ox0, ttl 1, id 18546, offset 0, flags [none], proto UDP (17), length 328)
  10.1.2.27.67 > 255.255.255.255.68: judo sum ok] BOOTP/DHCP, Reply, length 300, xid Ox9fc8f40c, Flags (Broadcast] (0x8000)
    Your-IP 10.1.2.224
    Client-Ethernet-Address 00:22:68:1a:fl:a0
    Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
  DHCP-Message Option 53, length 1: ACK
  Server-ID Option 54, length 4: 10.1.2.27
  Lease-Time Option 51, length 4: 86400
  Subnet-Mask Option 1, length 4: 255.255.255.0
  Default-Gateway Option 3, length 4: 10.1.2.1
  Domain-Name-Server Option 6, length 4: 10.1.2.122
  Domain-Name Option 15, length 11: "fortiad.net" 

The switch logs show a successful dot1x session:

root# run show dotlx interface ge-0/0/0.0
802.1X Information:
Interface    Role             State            MAC address          User
ge-0/0/0.0   Authenticator    Authenticated    00:22:68:1A:F1:A0    0022681af1a0

The MAC address interface has been dynamically placed into correct VLAN:

root# run show vlans engineering
Name          Tag           Interfaces
engineering   10
                            ge-0/0/0.0*, ge-0/0/11.0*

And the printer shows as available on the network:

root# run show arp interface vlan.10 
MAC Address         Address       Name          Interface   Flags 
00:0c:29:5b:90:68   10.1.2.29     10.1.2.29     vlan.10     none 
6c:70:9f:d6:ae:al   10.1.2.220    10.1.2.220    vlan.10     none 
b8:53:ac:4a:d5:f5   10.1.2.221    10.1.2.221    vlan.10     none
00:22:68:1a:fl:a0   10.1.2.224    10.1.2.224    vlan.10     none
a4:c3:61:24:b9:07   10.1.2.228    10.1.2.228    vlan.10     none
Total entries: 5

{master:0}[edit] 
root* run ping 10.1.2.224 
PING 10.1.2.224 (10.1.2.224): 56 data bytes 
64 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=2.068 ms 
64 bytes from 10.1.2.224: icmp_seq=1 tt1=128 time=2.236 ms 
64 bytes from 10.1.2.224: icmp_seq=2 tt1=128 time=2.699 ms 
 
--- 10.1.2.224 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss 
round-trip min/avg/max/stddev = 2.068/2.334/2.699/0.267 ms

1. Active Directory prerequisites

Key considerations:

• computers must exist in AD Groups that correspond with their VLAN
• dNSHostName attribute for the username

2. Configuring the certificates

Go to RADIUS Service > EAP and set up the EAP configuration.

If client certificates were not created by FortiAuthenticator, the 3rd-party server certificate would be uploaded on to FortiAuthenticator as a Trusted CA.

In this example, FortiAuthenticator creates the client certificates.

Go to Certificate Management > End Entities > Users and create a client certificate. The CN must match the full DNS name of the intended computer.

Export the PKCS#12 file and passphrase protect it.

The client certificate can be pushed out using GPO (Group Policy Object). Otherwise, it can be imported manually.

3. Manually importing the client certificate – Windows 7

Manual import can be completed using MMC as shown.

Open Command Prompt and type mmc and hit Enter.

On the File menu, click Add/Remove Snap In.

Once imported, the certificate should show up under Local Computer and not Current User.

Export the FortiAuthenticator Certificate and Import that under Trusted Root Certification Authorities (again under Certificates (Local Computer)).

4. Configuring the FortiAuthenticator AD Server

Go to Authentication > Remote Auth. Servers > LDAP and create a new AD server.

Ensure that Username attribute matches the entry in the AD configuration in Step 1.

5. Configuring the user group

6. Configuring remote user sync rules

Go to Authentication > User Management > Remote User Sync Rules and configure a new Remote LDAP User Synchronization Rule.

Go to Authentication > User Management > Remote Users and check to see if the sync rule worked.

7. Configuring the FortiAuthenticator RADIUS client

8. Configuring the switch

The switch configuration provided below is intended for demonstration only. Your switch configuration is likely to differ significantly.

set system services dhcp pool 10.1.2.0/24 address-range low 10.1.2.220
set system services dhcp pool 10.1.2.0/24 address-range high 10.1.2.230
set system services dhcp pool 10.1.2.0/24 domain-name fortiad.net
set system services dhcp pool 10.1.2.0/24 name-server 10.1.2.122
set system services dhcp pool 10.1.2.0/24 router 10.1.2.1
set system services dhcp pool 10.1.2.0/24 server-identifier 10.1.2.27
set interfaces ge-0/0/1 unit 0 family ethernet-switching #windows 7 machine port, no VLAN assigned, will be allocated dynamically
set interfaces ge-0/0/11 unit 0 family ethernet-switching vlan members engineering #interface used to communicate with FortiAuthenticator
set interfaces me0 unit 0 family inet address 10.1.1.1/24
set interfaces vlan unit 10 family inet address 10.1.2.27/24
set protocols dot1x authenticator authentication-profile-name profile1
set protocols dot1x authenticator interface ge-0/0/1.0 supplicant single #802.1x configuration requiring supplicant
set access radius-server 10.1.2.29 secret "$9$kmfzIRSlvLhSLNVYZGk.Pf39"
set access profile profile1 authentication-order radius
set access profile profile1 radius authentication-server 10.1.2.29
set vlans engineering vlan-id 10
set vlans engineering l3-interface vlan.10

9. Results

The authentication flow should initiate as soon as the wired computer starts up (while connected to the domain).

Using tcpdump, FortiAuthenticator shows receipt of an Incoming Authentication Request (tcpdump host 10.1.2.27 -nnvvXs):

02:18:48.572998 IP (tos 0x0, ttl 64, id 32483, offset 0, flags [none], proto UDP (17), length 203) 
  10.1.2.27.60114 > 10.1.2.29.1812: ludo sum okl RADIUS. length: 175 
    Access-Request (1), id: 0x4d, Authenticator: 27e45f0edbfa7026318d583ccf915776 
      User-Name Attribute (11. length: 23. Value: host/leno.fortiad.net 
        0x0000: 686f 7374 2f6c 656e 6f2e 666f 7274 6961 
        0x0010: 642e 6e65 74 
      NAS-Port Attribute (5), length: 6, Value: 71 
        0x0000: 0000 0047 
      EAP-Message Attribute (79), length: 28, Value: . 
        0x0000: 0200 001a 0168 6f73 742f 6c65 6e6f 2e66 
        0x0010: 6f72 7469 6164 2e6e 6574 
      Message-Authenticator Attribute (80), length: 18, Value: ...0S2 ....... .M
        0x0000: b60f 874f 5332 c9a7 e2f5 d90e 8c20 e64d 
      Acct-Session-Id Attribute (44), length: 24, Value: 802.1x81fa00370003dd64 
        0x0000: 384f 322e 3178 3831 6661 3030 3337 3030 
        0x0010: 3033 6464 3634 
      NAS-Port-Id Attribute (87), length: 12, Value: ge-0/0/1.0 
        0x0000: 6765 2d30 2f30 2f31 2e30 
      Calling-Station-Id Attribute (31), length: 19, Value: 00-22-68-1a-ft-a0 
        0x0000: 3030 2d32 322d 3638 2d31 612d 6631 2d61 
        0x0010: 30 
      Called-Station-Id Attribute (30), length: 19, Value: a8-d0-e5-b0-21-80 
        0x0000: 6138 2d64 302d 6535 2d62 302d 3231 2d38 
        0x0010: 30 
      NAS-Port-Type Attribute (61), length: 6, Value: Ethernet 
        0x0000: 0000 000f 

Continuing with tcpdump, Access-Challenge is issued from FortiAuthenticator to the Switch:

02:18:48.578465 IP (tos 0x0, ttl 64, id 29725, offset 0, flags [none], proto UDP (17), length 108)
  10.1.2.29.1812 > 10.1.2.27.60114: [bad udp cksum 0x18a3 -> 0x7f96!] RADIUS, length: 80 
    Access-Challenge (11), id: 0x4d, Authenticator: 8140836b0192a5ef12630d4d049d05e6 
      EAP-Message Attribute (79), length: 24, Value: .. 
        0x0000: 0101 0016 0410 bc6b 992d bbfc 141f 3bbl 
        0x0010: 1908 2978 2030 
      Message-Authenticator Attribute (80), length: 18, Value: .#...:&%N.z.7...
        0x0000: dc23 d299 Of3a 2625 4eed 7a9c 37d9 ef97 
      State Attribute (24), length: 18, Value: ........ ...m.q. 
        0x0000: c2lb 819c c2la 85b8 20c3 b2b7 6dla 71d6 

Access-Accept message with RADIUS attributes are returned to the Switch:

02:18:48.919099 IP (tos Ox0, ttl 64, id 29732, offset 0, flags [none], proto UDP (17), length 236) 
  10.1.2.29.1812 > 10.1.2.27.60114: [bad udp cksum 0x1923 -> Oxae5a!] RADIUS, length: 208 
    Access-Accept (2), id: 0x54, Authenticator: 668c7cbb00d96161c278906918ce2291 
      Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311) 
        Vendor Attribute: 17, Length: 50, Value: .p<.6..A [y)..E)......Y..(..P...Xd@..aB.k. 
        0x0000: 0000 0137 1134 f270 3cbf 360b 1d41 f5e5 
        0x0010: c87f e8eb b9e9 955b 7929 0915 4529 fa92
        0x0020: 8c02 Ofec 59a0 e528 889e 50b9 f506 5864 
        0x0030: 4018 ff61 429a 6bb8 
      Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
        Vendor Attribute: 16, Length: 50, Value: ..G......Q...............x.=xA/......i.r..a.%R.^.. 
        0x0000: 0000 0137 1034 ff86 47fc 00f1 99d9 cc51 
        0x0010: fclf 1ae2 b9e3 00a7 1ec9 baf4 031d fa78 
        0x0020: 8d3d 7841 2114 0313 a2e8 9e69 dc72 efed 
        0x0030: 61b2 2552 995e fbf4 
      EAP-Message Attribute (79), length: 6, Value: .. 
        0x0000: 0307 0004 
      Message-Authenticator Attribute (80), length: 18, Value: .8............30 
        0x0000: 0438 c613 8719 caa2 eaf0 a106 ffb4 3330 
      User-Name Attribute (1), length: 23, Value: host/leno.fortiad.net 
        0x0000: 686f 7374 2f6c 656e 6f2e 666f 7274 6961 
        0x0010: 642e 6e65 74 
      Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13 
        0x0000: 0000 000d 
      Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802 
        0x0000: 0000 0006 
      Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering 
        0x0000: 656e 6769 6e65 6572 696e 67

Post-authentication DHCP transaction is picked up by FortiAuthenticator (tcpdump continued):

02:18:52.384838 IP (tos Ox0, ttl 1, id 32640, offset 0, flags [none], proto UDP (17), length 328) 
  10.1.2.27.67 > 255.255.255.255.68: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid Oxf79d54fa, Flags [Broadcast] (0x8000)
    Your-IP 10.1.2.224 
    Client-Ethernet-Address 00:22:68:1a:fl:a0 
    Vendor-rfc1048 Extensions 
      Magic Cookie 0x63825363 
      DHCP-Message Option 53, length 1: ACK 
      Server-ID Option 54, length 4: 10.1.2.27 
      Lease-Time Option 51, length 4: 86400 
      Subnet-Mask Option 1, length 4: 255.255.255.0 
      Default-Gateway Option 3, length 4: 10.1.2.1 
      Domain-Name-Server Option 6, length 4: 10.1.2.122 
      Domain-Name Option 15, length 11: "fortiad.net" 

Go to Logging > Log Access > Logs to verify the device authentication.

The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

The switch logs show a successful dot1x session:

root# run show dotlx interface ge-0/0/1.0
802.1X Information:
Interface    Role             State            MAC address          User
ge-0/0/1.0   Authenticator    Authenticated    00:22:68:1A:F1:A0    host/leno.fortiad.net

The Domain Computer interface is dynamically placed into the correct VLAN:

root# run show vlans
Name          Tag           Interfaces
default
                            ge-0/0/0.0, ge-0/0/2.0, ge-0/0/3.0, ge-0/0/4.0, ge-0/0/5.0, ge-0/0/6.0, ge-0/0/7.0, ge-0/0/8.0, ge-0/0/9.0, ge-0/0/10.0, 
engineering   10
                            ge-0/0/1.0*, ge-0/0/11.0*

And the domain computer shows as available on the network:

root# run show arp interface vlan.10 
MAC Address        Address        Name         Interface    Flags
00:0c:29:5b:90:68  10.1.2.29      10.1.2.29    vlan.10      none
98:b8:e3:a0:c6:lb  10.1.2.220     10.1.2.220   vlan.10      none
b8:78:2e:38:3e:28  10.1.2.222     10.1.2.222   vlan.10      none
00:22:68:1a:f1:a0  10.1.2.224     10.1.2.224   vlan.10      none
54:e4:3a:d5:16:a0  10.1.2.226     10.1.2.226   vian.l0      none 
Total entries: 5 

{master:0}[edit]
root# run ping 10.1.2.224
PING 10.1.2.224 (10.1.2.224): 56 data bytes
54 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=4.651 ms
54 bytes from 10.1.2.224: icmp_seq-1 ttl-128 time-2.385 ms

--- 10.1.2.224 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.385/3.518/4.651/1.133 ms 

1. Configuring the certificates

Go to RADIUS Service > EAP and set up the EAP configuration.

If client certificates were not created by FortiAuthenticator, the 3rd-party server certificate would be uploaded on to FortiAuthenticator as a Trusted CA.

In this example, FortiAuthenticator creates the client certificates.

Go to Certificate Management > End Entities > Users and create a client certificate. The CN must match the user sAMAccountName.

Export the PKCS#12 file and passphrase protect it.

The client certificate can be pushed out using GPO (Group Policy Object). Otherwise, it can be imported manually.

2. Manually importing the client certificate – Windows 7

Manual import can be completed using MMC as shown.

Open Command Prompt and type mmc and hit Enter.

On the File menu, click Add/Remove Snap In.

Once imported, the certificate should show up under Local Computer and not Current User.

Export the FortiAuthenticator Certificate and Import that under Trusted Root Certification Authorities (again under Certificates (Local Computer)).

3. Configuring the FortiAuthenticator AD Server

Go to Authentication > Remote Auth. Servers > LDAP and create a new AD server.

Ensure that Username attribute matches the entry in the AD configuration (sAMAccountName).

4. Configuring the user group

Go to Authentication > User Management > User Groups and create a new user group with the RADIUS attributes shown.

The group will automatically populate with the Remote Sync Rule configured below.

5. Configuring remote user sync rules

Go to Authentication > User Management > Remote User Sync Rules and configure a new Remote LDAP User Synchronization Rule.

Go to Authentication > User Management > Remote Users and check to see if the sync rule worked.

6. Configuring the FortiAuthenticator RADIUS client

7. Configuring the switch

The switch configuration provided below is intended for demonstration only. Your switch configuration is likely to differ significantly.

set system services dhcp pool 10.1.2.0/24 address-range low 10.1.2.220
set system services dhcp pool 10.1.2.0/24 address-range high 10.1.2.230
set system services dhcp pool 10.1.2.0/24 domain-name fortiad.net
set system services dhcp pool 10.1.2.0/24 name-server 10.1.2.122
set system services dhcp pool 10.1.2.0/24 router 10.1.2.1
set system services dhcp pool 10.1.2.0/24 server-identifier 10.1.2.27
set interfaces ge-0/0/1 unit 0 family ethernet-switching #odyssey machine port, no VLAN assigned, will be allocated dynamically
set interfaces ge-0/0/11 unit 0 family ethernet-switching vlan members engineering #interface used to communicate with FortiAuthenticator
set interfaces me0 unit 0 family inet address 10.1.1.1/24
set interfaces vlan unit 10 family inet address 10.1.2.27/24
set protocols dot1x authenticator authentication-profile-name profile1
set protocols dot1x authenticator interface ge-0/0/1.0 supplicant single #802.1x configuration requiring supplicant
set access radius-server 10.1.2.29 secret "$9$kmfzIRSlvLhSLNVYZGk.Pf39"
set access profile profile1 authentication-order radius
set access profile profile1 radius authentication-server 10.1.2.29
set vlans engineering vlan-id 10
set vlans engineering l3-interface vlan.10

8. Results

In the Odyssey Access Client Manager, click Connect to the network. Once connected, the Status should read open and authenticated.

The authentication flow should initiate as soon as the supplicant makes a connection attempt (while connected to the domain).

Using tcpdump, FortiAuthenticator shows receipt of an Incoming Authentication Request (tcpdump host 10.1.2.27 -nnvvXs):

16:10:25.051118 IP (tos 0x0, ttl 64, id 22102, offset 0, flags [none], proto UDP (17), length 169) 
  10.1.2.27.51296 > 10.1.2.29.1812: [udp sum ok] RADIUS. length: 141 
    Access-Request (1), id: 0x18, Authenticator: 4c69f617666fcdaadbcdb14700c57551 
      User-Name Attribute (1), length: 6, Value: kash 
        0x0000: 6b61 7368 
      NAS-Port Attribute (5), length: 6, Value: 71 
        0x0000: 0000 0047 
  EAP-Message Attribute (79), length: 11, Value: .A 
        0x0000: 0241 0009 016b 6173 68 
  Message-Authenticator Attribute (80), length: 18, value: ..C....- .....o.> 
        0x0000: 8a86 43bf a7d9 8a2d 8cef e0bf 036f 9f3e 
  Acct-Session-Id Attribute (44), length: 24, Value: 802.1x81fb00610008e3c1 
        0x0000: 384f 322e 3178 3831 6662 3030 3631 3030 
        0x0010: 3038 6533 6331 
  NAS-Port-Id Attribute (87), length: 12, Value: ge-0/0/1.0 
        0x0000: 6765 2d30 2f30 2f31 2e30 
  Calling-Station-Id Attribute (31), length: 19, Value: 00-22-68-1a-ft-a0 
        0x0000: 3030 2d32 322d 3638 2d31 612d 6631 2d61 
        0x0010: 30 
  Called-Station-Id Attribute (30), length: 19, Value: a8-d0-e5-b0-21-80 
        0x0000: 6138 2d64 302d 6535 2d62 302d 3231 2d38 
        0x0010: 30 
  NAS-Port-Type Attribute (61), length: 6, Value: Ethernet 
        0x0000: 0000 000f 

Continuing with tcpdump, Access-Challenge is issued from FortiAuthenticator to the Switch:

16:10:25.057286 IP (tos 0x0, ttl 64, id 50545, offset 0, flags [none], proto UDP (17), length 108) 
  10.1.2.29.1812 > 10.1.2.27.51296: [bad udp cksum 0x18a3 -> 0x0722!] RADIUS, length: 80 
    Access-Challenge (11), id: 0x18, Authenticator: f0a3636e1b2ddf8b76f96239feece6bb 
      EAP-Message Attribute (79), length: 24, Value: .B 
        0x0000: 0142 0016 0410 87a4 a938 54dd 43b6 9ff4 
        0x0010: 7ddc b515 1591 
      Message-Authenticator Attribute (80), length: 18, Value: ..mu.l..0..o.ht. 
        0x0000: 0f09 6d75 e76c 87c3 30f3 b76f f368 74e3 
      State Attribute (24), length: 18, Value: s...s...L@..._K. 
        0x0000: 73de c494 739c c0lf 4c40 c6ce 815f 4bd5 

The next 14 messages are Challenge->Request EAP transactions between the FortiAuthenticator and the Switch

Access-Accept message with RADIUS attributes are returned to the Switch:

16:10:25.479480 IP (tos Ox0, ttl 64, id 50552, offset 0, flags [none], proto UDP (17), length 219)
  10.1.2.29.1812 > 10.1.2.27.51296: [bad udp cksum 0x1912 -> 0xef88I] RADIUS, length: 191
    Access-Accept (2), id: Oxlf, Authenticator: Sb463667865b7dacf8a742aea5424f20
      Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
        Vendor Attribute: 17, Length: 50, Value: ......3.y.3..T.1z..[m..W. .c. Zv a rpa.z
        0x0000: 0000 0137 1134 831d 27be +0af 4aae 7990
        0x0010: 33da 0954 b631 7ad7 e15b 6dd4 8557 83cb
        0x0020: a83c f4e0 155a 76fd dd61 c7f5 fd0a d8d1
        0x0030: 08e8 eb72 7061 b27a
      Vendor-Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
        Vendor Attribute: 16, Length: 50, Value: ..^D0b...z..9:e+....]+2X • / WF ..... 4..K...Pt.
        0x0000: 0000 0137 1034 8f91 Se44 4f62 9d7f f513
        0x0010: 7abb 942a 213a 652b 0fc5 b488 5d2b 3258
        0x0020: ce3a ded5 dd2f d757 4698 9a94 b205 34a2
        0x0030: ed4b 83bb a250 74f6
      EAP-Message Attribute (79), length: 6, Value: .H
        0x0000: 0348 0004
      Message-Authenticator Attribute (80), length: 18, Value: .".Z.T..X....@.
        0x0000: ca22 aasa f354 17bc 58dc ccd7 cf40 7fb4
      User-Name Attribute (1), length: 6, Value: kash
        0x0000: 6b61 7368
      Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13
        0x0000: 0000 000d
      Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802
        0x0000: 0000 0006
      Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering
        0x0000: 656e 6769 6e65 6572 696e 67 

Post-authentication DHCP transaction is picked up by FortiAuthenticator (tcpdump continued):

16:10:25.569855 IP (tos Ox0, ttl 1, id 22153, offset 0, flags [none], proto UDP (17), length 328)
  10.1.2.27.67 > 255.255.255.255.68: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid Ox91fced0e, Flags [Broadcast] (0x8000)
    Your-IP 10.1.2.224
    Client-Ethernet-Address 00:22:68:1a:f1:a0
    Vendor-rfc1048 Extensions
      Magic Cookie 0x63825363
      DHCP-Message Option 53, length 1: ACK
      Server-ID Option 54, length 4: 10.1.2.27
      Lease-Time Option 51, length 4: 86400
      Subnet-Mask Option 1, length 4: 255.255.255.0
      Default-Gateway Option 3, length 4: 10.1.2.1
      Domain-Name-Server Option 6, length 4: 10.1.2.122
      Domain-Name Option 15, length 11: "fortiad.net" 

Go to Logging > Log Access > Logs to verify the device authentication.

The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

The Switch CLI shows a successful dot1x session:

root# run show dotlx interface ge-0/0/1.0
802.1X Information:
Interface    Role             State            MAC address          User
ge-0/0/1.0   Authenticator    Authenticated    00:22:68:1A:F1:A0    kash

The Domain Computer interface is dynamically placed into the correct VLAN:

root# run show vlans
Name          Tag           Interfaces
default
                            ge-0/0/0.0, ge-0/0/2.0, ge-0/0/3.0, ge-0/0/4.0, ge-0/0/5.0, ge-0/0/6.0, ge-0/0/7.0, ge-0/0/8.0, ge-0/0/9.0, ge-0/0/10.0, 
engineering   10
                            ge-0/0/1.0*, ge-0/0/11.0*

And the domain computer shows as available on the network:

root# run show arp interface vlan.10 
MAC Address        Address        Name         Interface    Flags
00:0c:29:5b:90:68  10.1.2.29      10.1.2.29    vlan.10      none
98:b8:e3:a0:c6:lb  10.1.2.220     10.1.2.220   vlan.10      none
b8:78:2e:38:3e:28  10.1.2.222     10.1.2.222   vlan.10      none
00:22:68:1a:f1:a0  10.1.2.224     10.1.2.224   vlan.10      none
54:e4:3a:d5:16:a0  10.1.2.226     10.1.2.226   vian.l0      none 
Total entries: 5 

{master:0}[edit]
root# run ping 10.1.2.224
PING 10.1.2.224 (10.1.2.224): 56 data bytes
54 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=4.651 ms
54 bytes from 10.1.2.224: icmp_seq-1 ttl-128 time-2.385 ms

--- 10.1.2.224 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.385/3.518/4.651/1.133 ms