Creating a Notification Profile

First we’ll need to create a notification profile

1. Go to Profile > Notification > Notification. 
2. Select New.
3. Enter a descriptive name.
4. Select the type from the dropdown menu. Generic is used in antispam, antivirus, and content profiles to notify the sender or recipient. Sender Address Rate Control only notifies the senders and the original message 
5. Enable the individuals you want to send the notification to: sender, recipient, or others. If you choose “others” you’ll need to enter the email addresses in the email address section.
6. select an email template to use.
7. Select OK.

 Creating a Dictionary Profile

First we’ll need to create a dictionary profile

1. Go to Profile > Dictionary > Dictionary.
2. Select New to create a new profile or edit an existing profile by selecting a profile and selecting Edit.
3. Enter the name for the profile.
4. Double click an existing predefined pattern and then select Enable and then OK.
5. If you wish to create your own pattern, select New in the Dictionary Entries section.
6. Enable the pattern and enter a word or phrase that you want the dictionary to match. Matches are case insensitive.
7. Select Regex or Wildcard from the Pattern type dropdown menu.
8. Enter the pattern weight and maximum pattern weight.
9. Enable whether to match occurrences of the pattern when it is located in an email’s header or body. 
10. Select Create and Create once more.

Configuring Dictionary Options

With the dictionary profile created, we can now move on to configuring the dictionary scan options.

To configure dictionary scan options

1. Go to Profile > AntiSpam > AntiSpam.
2. Double-click an existing profile.
3. Expand the Scan Configuration section and then the Dictionary section.
4. Enable Dictionary.
5. Select the Action profile you want the FortiMail unit to use if the heuristic scan finds spam email.
6. Select the previously created profile from the dictionary profile dropdown menu.
7. Enter the minimum dictionary score. This is the number of dictionary term matches above which the email will be considered spam. 
8. Select OK. 

 Configuring a Content Profile and Scan Options

For this recipe we’ll need to briefly go over the content profile creation process. If you would like a more detailed explanation, see the content profile section in the FortiMail Administrator Guide.

To establish a content profie

1. Go to Profile > Content > Content.
2. Select New or edit an existing profile.
3. Select the appropriate domain from the Domain dropdown menu. Selecting “System” shows profiles from the entire FortiMail unit.
4. Enter a profile name.
5. Select “Reject” from the Action dropdown menu to make FortiMail reply to the SMTP client with SMTP reply code 550. All emails containing adult images will be rejected.
6. Enable video, audio, and image from the attachment scan rules. This will make sure that any attachments that contain adult images will be scanned for. 
7. Enable Adult image analysis under the Scan Options section.

Establishing Adult Image Analysis

With the content profile properly configured, we can now move on to configuring adult image analysis settings. 

1. Go to Security > Other > Adult Image Analysis. 
2. Enable the analysis.
3. Adjust the sensitivity of the ratting. Adjusting the sensitivity to the appropriate number will avoid false positives and false negatives.
4. Enter the minimum and maximum image size.
5. Select Apply.

 Configuring an AntiSpam Profile

To configure banned word scan options in FortiMail

1. Go to Profile > AntiSpam > AntiSpam
2. Select an existing profile and select Edit or create a new profile. For more information on creating an AntiSpam profile see the corresponding chapter in the FortiMail Administrator Guide.
3. Expand the Scan Configuration section
4. Enable Banned word and then select Configuration.
5. Select New.
6. Enter the word you wish to be banned in the Banned Word field.
7. Enable both Subject and Body to let FortiMail scan the subject line and the body of the email for the banned word.
8. Select OK.

Configuring Safelist Word Options

As an added bonus, you can also configure a safelist word section in your profile that tells your FortiMail unit to allow messages whose subject or body contains a particular word. So, for example, we could make it so the unit lets every email containing the word “meeting” through without scanning.

To configure safe list scan options

1. Go to Profile > AntiSpam > AntiSpam.
2. Edit an existing profile or create a new one.
3. Expand Scan Configurations.
4. Enable Safelist word and select Configuration.
5. Select New.
6. Enter the word you want to bypass scanning.
7. Enable both the Subject and Body selection.
8. Select OK and OK once more.

Importing a User List

To create and import user records

1. Go to Domain & User > User > User.
2. Select a user and then select Export .CSV.
3. Save the file and then open the CSV file in a spreadsheet editor, like Microsoft Excel.
4. Enter the user records in the columns to match the exported format.
5. Select Save As to save the file as a CSV file.
6. Select Import .CSV in FortiMail.
7. Find your file and select open and then OK.

All the users you created in Excel will be imported into FortiMail.

 Customizing the Administrative Portal

Only administrators can change the appearance of the interface.

To customize the GUI appearance

1. Go to System > Customization > Appearance.
2. Expand the Admin Portal.
3. Enter the name of the product. This name precedes the Administrator Login in the title on the login page.
4. Select Change to choose your own custom icon and logo. These images appear at the top of all pages on the web UI. 
5. Select your default language and theme.

 Customizing the Webmail Portal.

You can also change the appearance of the webmail page.

1. Go to System > Customization > Appearance.
2. Expand the Webmail Portal.
3. Enter the name that appears on the top of the webmail login page.
4. Enter a hint for the user name. For example, the hint could be “Your Email Address”.
5. Select a theme for the webmail GUI from the Login page dropdown menu.
6. Select your desired language from the Webmail language dropdown menu. You can create your own custom language. See the Administrator guide for more details.
7. Select Change from the custom logo section to add your own graphic.
8. Select Apply.

 Creating Variables

Before you create your custom message you’ll likely want to create new predefined variables to insert into your custom message. Typically, these variables represent messages that you will frequently use.

To create a new variable

1. Go to System > Customization > Custom Message
2. Select a replacement message or email template you want to edit and then select Edit Variable.
3. Select New.
4. Enter a name. The typical formal is as follows: %%EXAMPLE%%. So, if I wanted the name of the file that is infected to appear in the message, I would enter: %%FILE%%.
5. Enter a descriptive display name. This name appears in the variable list when you select Insert Variables.
6. Enter the variable’s content. Click Insert Variables to include any existing variables. For example, you could enter:
   The file %%FILE%% is infected with the virus %%VIRUS%% and has been deleted.
7. Select Create.

   There is a fairly large list of variables available at your disposal. Check the appropriate section in the administrator guide

 Creating a Custom Message

With your custom variable created, you can now customize the replacement message

1. Go to System > Customization > Custom Message.
2. Double click a message to edit the message.
3. Enter your replacement message in the content section. There is a 4000 character limitation.
4. Enter your custom variable by selecting Insert Variable.
5. Select your desired variable from the list and then select the close button.
6. Select OK

1. Planning the network topology and addressing scheme

Below is the network diagram that we will use for this cookbook recipe. It was created based on the requirements in the example scenario.

As noted above, a connection between root and VDOM-A, as well as root and VDOM-B, will be achieved with a VDOM Link. VDOM-A and VDOM-B will not be allowed to communicate with each other directly; any communication between VDOM-A and VDOM-B has to be allowed by the root VDOM.

2. Switching to VDOM mode and creating two VDOMs

Go to System > Settings and, under the Operations Settings section, enable Virtual Domains.

You will be required to re-login after enabling virtual domains because the GUI menu options change.

Certain FortiGate models will not show the above option under System > Settings. For these models, click the >_ icon in the top-right corner of the GUI and enter the following command in the CLI Console:

config system global
  set vdom-admin enable
end

Enter y when you are asked if you want to continue.

You will be required to re-login to the GUI after enabling virtual domains because the GUI menu options change.

Make sure that Global is selected from dropdown menu located in the top-left corner. This allows you to make changes to the global configuration.

Go to System > VDOM and select Create New.

Name the Virtual Domain VDOM-A, and leave the defaults for Inspection Mode and NGFW Mode. Select OK to create your first VDOM.

3. Adding interfaces to VDOM-A and VDOM-B

In this example, one hardware switch interface (comprised of 3 physical interfaces) will be added to VDOM-A and VDOM-B for use by the local network.

If an interface is used in an existing FortiGate configuration, the VDOM assignment cannot be changed. Because some FortiGate models have a default configuration, you may need to delete existing policies and routes in order to make changes to that particular interface.

From Global, go to Network > Interfaces and edit the internal interface. 

Remove all Interface Members except for internal1, and ensure the Virtual Domain is set to root. All other settings can stay their default values.

The interface members we just removed from the internal hardware switch will be listed separately as internal2, internal3, etc, but will belong to the root VDOM.

Edit internal2 and change the Virtual Domain to VDOM-A. Leave the other settings their defaults.

Repeat this step for internal3 and internal4 to make them a member of VDOM-A.

Edit internal5, internal6, and internal7 and change their Virtual Domain to VDOM-B.

Your interface overview should now show internal1 assigned to root, internal2-4 assigned to VDOM-A, and internal5-7 assigned to VDOM-B.

Go to Network > Interfaces and create a new interface.

Type LAN-A for the Interface Name, set the Type to Hardware Switch, and set the Virtual Domain to VDOM-A.

Select internal2-4 as the Interface Members, and set the Role to LAN.

Assign 10.1.1.1/24 as the IP/Network Mask, set Administrative Access to HTTPS, PING, and SSH, and enable DHCP Server.

Create another interface, this time setting Interface Name as LAN-B. Set the Type to Hardware Switch, and set the Virtual Domain to VDOM-B.

Select internal5-7 as the Interface Members, and set the Role to LAN.

Assign 10.2.2.1/24 as the IP/Network Mask, set Administrative Access to HTTPS, PING, and SSH, and enable DHCP Server.

Your interface list should now show internal assigned to root, LAN-A assigned to VDOM-A, and LAN-B assigned to VDOM-B.

4. Connecting VDOMs with Virtual Links

Virtual Links are used to virtually connect VDOMs that would otherwise not be able to communicate with each other. A VDOM Link consists of two sub-interfaces, called Interface 0 and Interface 1, where each sub-interface is a member of one of the VDOMs that is being connected together. This can be conceptualized as two ends of a point-to-point link.

From Global, go to Network > Interfaces and select Create New > VDOM Link. Give the new VDOM Link the name IVL-A.

For Interface 0, select the Virtual Domain of root. Give it an IP/Netmask of 172.16.1.1/30, and set the Administrative Access to PING only.

For Interface 1, select the Virtual Domain of VDOM-A. Give it an IP/Netmask of 172.16.1.2/30, and set the Administrative Access to PING only.

Select Create New > VDOM Link to begin creating a second VDOM Link. Give the new VDOM Link the name IVL-B.

For Interface 0, select the Virtual Domain of root. Give it an IP/Netmask of 172.16.1.5/30, and set the Administrative Access to PING only.

For Interface 1, select the Virtual Domain of VDOM-A. Give it an IP/Netmask of 172.16.1.6/30, and set the Administrative Access to PING only.

5. Creating static routes in the root VDOM

Go to Network > Static Routes and select Create New.

Enter the Destination of 10.1.1.0/24, which is the subnet for VDOM-A’s internal network.

For Interface, select IVL-A0 from the dropdown menu, and then enter 172.16.1.2 for the Gateway, which is VDOM-A’s VDOM Link IP address.

Create a second route.

Enter the Destination of 10.2.2.0/24, which is the subnet for VDOM-B’s internal network.

For Interface, select IVL-B0 from the dropdown menu, and then enter 172.16.1.6 for the Gateway, which is VDOM-B’s VDOM Link IP address.

If your WAN interface receives a default route via DHCP or PPPoE, then it is not required to statically configure a default route.

However, if your WAN interface has been statically configured with an IP address, then you will need to add a static default route, shown below.

Create another route, which will be the static default route.

Leave the Destination of 0.0.0.0/0.0.0.0, which indicates this is the default route.

For Interface, select wan1 from the dropdown menu, and then enter your ISP-provided gateway IP for the Gateway field, which in this example is 172.25.176.41.

6. Creating firewall policies to allow Internet access through the root VDOM

Go to Policy & Objects > IPv4 Policy and select Create New.

Enter MGMT to Internet for the policy Name. Select internal for Incoming Interface and wan1 for Outgoing Interface.

Select all for the Source, all for the Destination, and ALL for the Service fields.

Leave NAT enabled and enable the Security Profiles desired to meet business requirements and best practices.

Create another policy.

Enter VDOM-A to Internet for the policy Name. Select IVL-A0 for Incoming Interface and wan1 for Outgoing Interface.

Select all for the Source, all for the Destination, and ALL for the Service fields.

Leave NAT enabled, and enable the Security Profiles desired to meet business requirements and best practices.

Create another policy.

Enter VDOM-B to Internet for the policy Name. Select IVL-B0 for Incoming Interface and wan1 for Outgoing Interface.

Select all for the Source, all for the Destination, and ALL for the Service fields.

Leave NAT enabled, and enable the Security Profiles desired to meet business requirements and best practices.

7. [Optional] Creating firewall policies in the root VDOM to allow VDOM-A and VDOM-B to communicate

If your business needs require VDOM-A to be able to communicate with VDOM-B, two additional policies will be needed.

Select Create New under Policy & Objects > IPv4 Policy and set Name to VDOM-A to VDOM-B. Select IVL-A0 for Incoming Interface and IVL-B0 for Outgoing Interface.

Select all for the Source, all for the Destination, ALL for the Service fields, and disable NAT.

Enable the Security Profiles desired to meet business requirements and best practices.

Create another policy and set Name to VDOM-B to VDOM-A. Select IVL-B0 for Incoming Interface and IVL-A0 for Outgoing Interface.

Select all for the Source, all for the Destination, ALL for the Service fields, and disable NAT.

Enable the Security Profiles desired to meet business requirements and best practices.

8. Creating firewall policies and static routes in VDOM-A

Select VDOM-A from the dropdown menu located in the top-left corner. This allows you to make changes to VDOM-A.

Go to Network > Static Routes and select Create New.

Leave the Destination of 0.0.0.0/0.0.0.0, which indicates this will be the default route.

For Interface, select IVL-A1 from the dropdown menu, and then enter 172.16.1.1 for the Gateway, which is root’s VDOM Link IP address on IVL-A.

Go to Policy & Objects > IPv4 Policies and Create New. Give the policy a Name of VDOM-A to root.

Select LAN-A for Incoming Interface and IVL-A1 for Outgoing Interface.

Select all for the Source, all for the Destination, and ALL for the Service fields. Disable NAT.

Company-A can enable the Security Profiles desired to meet their business requirements and best practices.

9. Creating firewall policies and static routes in VDOM-B

Go to Network > Static Routes and select Create New.

Leave the Destination of 0.0.0.0/0.0.0.0, which indicates this will be the default route.

For Interface, select IVL-B1 from the dropdown menu, and then enter 172.16.1.5 for the Gateway, which is root’s VDOM Link IP address on IVL-B.

Go to Policy & Objects > IPv4 Policies and Create New. Give the policy a Name of VDOM-B to root.

Select LAN-B for Incoming Interface and IVL-B1 for Outgoing Interface.

Select all for the Source, all for the Destination, and ALL for the Service fields. Disable NAT.

Company-B can enable the Security Profiles desired to meet their business requirements and best practices.

10. Results

Using a PC located on VDOM-A’s internal network, generate Internet traffic.

On the management PC, select VDOM-A from the top-left dropdown, and navigate to FortiView > Policies. You can see traffic flowing through the VDOM-A to root policy.

Right-click the policy, then select Drill Down to Details. You can see more information about the traffic.

Using a PC located on VDOM-B’s internal network, generate Internet traffic.

On the management PC, select VDOM-B from the top-left dropdown, and navigate to FortiView > Policies. You can see traffic flowing through the VDOM-B to root policy.

Select root from the dropdown on the top-left, and navigate to FortiView > Policies. You can see traffic flowing through the VDOM-A to Internet and VDOM-B to Internet policies.

If you completed the optional Step 7, using a PC connected to VDOM-A’s internal network, initiate traffic to a device on VDOM-B’s internal network.

Select root from the dropdown on the top-left, and navigate to FortiView > Policies. You will see traffic flowing through the VDOM-A to VDOM-B and/or the VDOM-B to VDOM-A policies.

 Ensuring Best Results

There are a few steps you should take to ensure the best possible results for a face match 

1. Make sure the individual at eye-level with the camera and is facing forward and looking into the camera.
2. Keep the area well lit to avoid harsh shadows.
3. Do not pose the subject of the picture against a bright background, since this will darken their faces and make facial recognition difficult.
4. Keep the subject relatively still to reduce motion blur.

 FortiCentral Configuration

1. Select the settings cog.
2. Select Settings. 
3. Select Analytics.
4. Select the recorder receiving teh results of the face analytics from the Face Recognition Database dropdown menu. 
5. Enable “Face Recognition in a snapshot” to allow FortiRecorder to receive an image individual pictures of individuals for later identification.
6. Enable “Display EBC/GPC Demos” to electronically welcome guests based on recognition.
7. Enable “Show Analytics Alarms” to start a playback loop of the moment a person triggered an alarm.
8. Select OK.

 Facial Analytics Configuration

Face Analytics is the first implementation of a video analytics engine for FortiCentral. Setting it up is simple

1. Select a camera stream on a pane.
2. Select the pane’s settings gear menu.
3. Select Face Recognition from the Algorithm dropdown menu to activate analytics on the camera’s stream.
4. Enable Visualize to enable the overlay of facial landmarks on a live video. This could help determine if the processing is functional. The displayed overlay has four different colors:
   White: Face detected but the quality is too low to generate a representation.
   Yellow: First frame taken as a snapshot and to generate facial representation.
   Magenta: The individual being tracked after initial detection.
   Cyan/Green: The individual track continued from face matching.
5. Enable Show Snapshots to enable the display of the best snapshots associated with each track in a gallery.
6. Enable Look For Names to activate a search for detected faces in the face database. If an enrolled person resembles someone in the database, their name is added to the bottom of the facial landmark.
7. Select OK.

1. Connecting and authorizing the FortiAP

To edit the interface that will connect to the FortiAP (in the example, port 22), go to Network > Interfaces.

Set Role to LAN and Addressing Mode to Manual. Set IP/Network Mask to a private IP address (in the example 10.10.200.1/255.255.255.0).

Under Administrative Access, enable CAPWAP.

Enable DHCP Server.

Under Networked Devices, enable Device Detection.

Connect the FortiAP unit to the interface.

To view the list of managed FortiAPs, go to WiFi & Switch Controller > Managed FortiAPs. The newFortiAP appears in the list but it is greyed out because it is not authorized.

Select the FortiAP, and select Authorize.

After a few minutes, select Refresh. The FortiGate shows the FortiAP as authorized.

2. Creating an SSID

To create a new SSID to be broadcast for WiFi users, go to WiFi & Switch Controller > SSID.

Set Traffic Mode to Tunnel and set IP/Network Mask to a private IP address (in the example 10.10.201.1/255.255.255.0).

Enable DHCP Server and Device Detection.

Under WiFi Settings, name the SSID (in the example, Office-WiFi) and set a secure Pre-shared Key.

Enable Broadcast SSID.

3. Creating a custom FortiAP profile

To create a new FortiAP profile, go to WiFi & Switch Controller > FortiAP Profiles.

Set Platform to the FortiAP model you are using (in the example, FAP221C) and Country/Region to the appropriate location.

Set an AP Login Password to secure the FortiAP.

Under Radio 1, set Mode to Access Point and SSIDs to Manual. Add your new SSID.

To assign the new profile, go to WiFi & Switch Controller > Managed FortiAPs and right-click the FortiAP. Select Assign Profile and set the FortiAP to use the new profile.

4. Allowing wireless access to the Internet

To create a new policy for wireless Internet access, go to Policy & Objects > IPv4 Policy.

Set Incoming Interface to the SSID and Outgoing Interface to your Internet-facing interface.

Enable NAT.

5. Results

Connect to the SSID with a wireless device. After a connection is established, browse the Internet to generate traffic.

1. Setting the system inspection mode

2. Testing FortiSandbox connectivity

On the FortiGate, go to Security Fabric > Settings and enable Sandbox Inspection.

Select your FortiSandbox type and Server address.

Confirm that the service is available by selecting Test connectivity.

The Status should read “Service is online.”

3. Enabling Content Disarm and Reconstruction

Go to Security Profiles > AntiVirus.

Under APT Protection Options, enable Content Disarm and Reconstruction and select the Original File Destination.

If you enable FortiSandbox as the file destination, original files caught by the AntiVirus profile are archived on the FortiSandbox. The FortiSandbox administrator can retrieve the original files, but only for a short time.

If you enable either File Quarantine or Discard as the file destination, original files caught by the AntiVirus profile are lost. Only the disarmed content is made available.

4. Configuring the Internet access policy

Go to Policy & Objects > IPv4 Policy and Edit the Internet access policy.

Under Security Profiles, enable the default AntiVirus profile. Proxy Options and SSL Inspection are automatically enabled.

5. Results

As the AntiVirus profile scans files using CDR, it replaces content that is deemed malicious or unsafe with content that will allow the traffic to continue but not put the recipient at risk.

If you wish to disable the cover page, enter the following commands in the CLI Console:

config antivirus profile
  edit default
    config content-disarm
      set cover-page disable
  end
end

6. Troubleshooting

The feature is not visible in the GUI

Confirm that the Inspection Mode is set to Proxy under System > Settings.

Also check that the AntiVirus profile inspection mode is set to proxy using the CLI Console:

config antivirus profile
  edit default
    set inspection-mode proxy
  next
end

Error messages and/or conflicts

If you receive an error message when attempting to enable Content Disarm and Reconstruction on the AntiVirus profile, check the Proxy Options settings in the CLI Console and disable splice and clientcomfort on CDR-supported protocols:

config firewall profile-protocol-options
  edit default
    config smtp
      unset options splice
    next
    config http
      unset options clientcomfort
    next
  end
end

You should also confirm the AntiVirus profile’s protocol settings under config antivirus profile:

• ensure that set options scan is enabled on CDR-supported protocols
• if set options av-monitor is configured on a CDR-supported protocol , it overrides the config content-disarm detect-only setting (and CDR will not occur)

The FortiSandbox service is unreachable

If testing the FortiSandbox connectivity returns a “Service is unreachable” error message, then you may need to authorize the FortiGate on the FortiSandbox.

On the FortiSandbox, go to Scan Input > Device and edit the entry for the FortiGate.

Under Permissions & Policy, enable Authorized.

1. Feature visibility

If DNS Filter is not listed under Security Profiles, go to System > Feature Visibility, and enable DNS Filter under Security Features.

2. Creating a DNS web filter profile

Go to Security Profiles > DNS Filter, and edit the default profile.

Enable FortiGuard category based filter, right-click Bandwidth Consuming, and set it to Block.

3. Enabling DNS filtering in a security policy

All traffic that matches this policy will be redirected to the FortiDNS server.

Go to Policy & Objects > IPv4 Policy, and edit the outgoing policy that allows Internet access.

Under Security Profiles, enable DNS Filter and set it to default.

Proxy Options and SSL Inspection profiles are automatically enabled.

4. Results

Open a browser using a computer on the internal network and navigate to dailymotion.co.uk. The page will be blocked.

Enter the following CLI command to sniff packets with a destination URL that does not belong to the bandwidth consuming category:

diagnose sniffer packet any 'port 53' and 'host 194.153.110.160' 4

The resulting output should indicate that the IP (in this example, paris.fr) was allowed by FortiGuard:

interfaces=[any]
filters=[port 53]
2.851628 172.20.121.56.59046 -> 208.91.112.52.53: udp 43
2.916281 208.91.112.52.53 -> 172.20.121.56.59046: udp 436
3.336945 10.1.2.102.51755 -> 208.91.112.53.53: udp 37
3.338611 208.91.112.53.53 -> 10.1.2.102.51755: udp 37

5. (Optional) Changing the FortiDNS server and port

You can use the default FortiDNS server located in Sunnyvale, USA (IP address 208.91.112.220), or you can switch to the server in London, UK (IP address 80.85.69.54).

Communication between your FortiGate and the FortiDNS server uses Fortinet’s proprietary DNS communication protocol.

config system fortiguard
   set sdns-server-ip 208.91.112.220
end

The North American server should work in most cases, however you can switch to the European server to see if it improves latency.

You can also change the port used to communicate with the FortiDNS server using the following command:

config system fortiguard
   set sdns-server-port <value>
end

6. Troubleshooting

The Security Profiles > DNS Filter menu is missing

Go to System > Feature Visibility and enable DNS Filter.

You configured DNS Filtering, but it is not working

Verify that DNS Filter is enabled in a policy and SSL Inspection has been applied as needed (SSL inspection is required in order to block traffic to sites that use HTTPS).

If both settings are enabled, verify that the policy is being used for the correct traffic and that traffic is flowing by going to the policy list and viewing the Sessions column. 

If the above settings are correct, verify that DNS requests are going through the policy, rather than to an internal DNS server. Also verify that proxy options and SSL/SSH inspection settings have both HTTP and HTTPS enabled and use the correct ports.

Communication with the FortiDNS server fails

Verify that the correct FortiDNS server is configured using the following diagnose command:

diag test application dnsproxy 3

The resulting output should indicate that communication with the correct FortiDNS server was established. For example:

FWF60D4615016384 # diag test application dnsproxy 3
vdom: root, index=0, is master, vdom dns is enabled, mip-169.254.0.1 dns_log=1
dns64 is disabled
dns-server:208.91.112.53:53 tz=0 req=919160 to=545900 res=117880 rt=1800 secure=0 ready=1 
dns-server:208.91.112.52:53 tz=0 req=913029 to=520111 res=134810 rt=6 secure=0 ready=1 
dns-server:208.91.112.220:53 tz=-480 req=0 to=0 res=0 rt=0 secure=1 ready=1
dns-server:80.85.69.54:53 tz=0 req=0 to=0 res=0 rt=0 secure=1 ready=1
vfid=0, interface=wan1, ifindex=6, recursive, dns
DNS_CACHE: hash-size=2048, ttl=1800, min-ttl=60, max-num=5000
DNS FD: udp_s=12 udp_c=14:15 ha_c=18 unix_s=19, unix_nb_s=20, unix_nc_s=21, v6_udp_s=11, v6_udp_c=16:17
DNS FD: tcp_s=24, tcp_s6=23
FQDN: hash_size=1024, current_query=1024
DNS_DB: response_buf_sz=131072
LICENSE: expiry=2016-08-15, expired=0, type=2
FDG_SERVER:208.91.112.220:53
SERVER_LDB: gid=6d61, tz=-480
FGD_REDIR:208.91.112.55 

This CLI result shows that the DNS server IP is set to the North American server, and is being accessed through port 53 (208.91.112.220:53).

Next, verify that bandwidth consuming sites are blocked, while other URLs are allowed.

Go to the CLI Console and enter the following:

diagnose sniffer packet any 'port 53' and 'host 195.8.215.138' 4

The resulting output should indicate that the IP (in this example, dailymotion.co.uk) was blocked by the FortiDNS server:

interfaces=[any]
filters=[port 53]
2.026733 172.20.121.56.59046 -> 208.91.112.220.53: udp 117
2.027316 172.20.121.56.59046 -> 80.85.69.54.53: udp 112
2.028480 172.20.121.56.59046 -> 208.91.112.220.53: udp 116
2.029591 172.20.121.56.59046 -> 208.91.112.220.53: udp 117

FortiGuard has the wrong categorization for a website

If you believe a website has been placed in the wrong category by FortiGuard, you can submit the URL for re-classification by going to the FortiGuard website.

1. Enabling OCVPN

On FGT_1, go to VPN > One-Click VPN Settings.

Set Status to Enabled and confirm Cloud Status. This may take a minute or two.

As indicated, a green checkmark appears along with the message Connected to the cloud service.

Finally, add the required Subnets from FGT_1.

On FGT_2, repeat the steps above.

Enable and confirm connection to the cloud service, and then add the required subnets from FGT_2.

2. Confirming cloud membership

In the Cloud Members table on FGT_1, click Refresh and confirm the entries.

The remote gateway and corresponding subnets for each device should populate the list.

You can perform the step above on any FortiGate that is a member of the OCVPN cloud.

FGT_2 should return the same results as above.

3. Results

As the Cloud Members table populates, the OCVPN cloud updates each member automatically.

You can now verify that the remainder of the configuration has also been created, and proceed to test the tunnel.

Using Command Prompt/Terminal, attempt a ping from one internal network to the other. Ping should be successful:

ping 192.168.177.99

Pinging 192.168.177.99 with 32 bytes of data:
Reply from 192.168.177.99: bytes=32 time=5ms TTL=254
Reply from 192.168.177.99: bytes=32 time=1ms TTL=254
Reply from 192.168.177.99: bytes=32 time<1ms TTL=254
Reply from 192.168.177.99: bytes=32 time<1ms TTL=254

Ping statistics for 192.168.177.99:
 Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
 Minimum = 0ms, Maximum = 5ms, Average = 1ms

Now, disable OCVPN (VPN > One-Click VPN Settings) and repeat the ping attempt to confirm that OCVPN was indeed responsible for the successful ping above:

ping 192.168.177.99

Pinging 192.168.177.99 with 32 bytes of data:
Reply from 192.168.176.99: Destination net unreachable.
Reply from 192.168.176.99: Destination net unreachable.
Reply from 192.168.176.99: Destination net unreachable.
Reply from 192.168.176.99: Destination net unreachable.

Ping statistics for 192.168.177.99:
 Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Re-enable OCVPN.

4. Troubleshooting

The following diagnose commands may prove useful.

To verify OCVPN status, use the following command:

FGT_1 # diag vpn ocvpn status
Current State : registered
OCVPN Status : OK (200)

To view device states, use the following command:

FGT_1 # diag vpn ocvpn device-state
FGT_1 wan1 172.25.176.56 0 6 0 2 200 2 0x3 0x3

To print a log report, use the following command:

FGT_1 # diag vpn ocvpn log
OCVPN Polling: state = undefined
cvpn_save_state: FGT_1 <null> 0.0.0.0 -1 0 0 0 0 0 0x0 0x0
OCVPN Polling: state = undefined
cvpn_save_state: FGT_1 <null> 0.0.0.0 -1 0 0 0 0 0 0x0 0x0
OCVPN Polling: state = undefined
cvpn_save_state: FGT_1 <null> 0.0.0.0 -1 0 0 0 0 0 0x0 0x0

========================

Thurs Mar 29 09:00:00 2018

========================

cvpn_load_state: FGT_1 <null> 0.0.0.0 -1 0 0 0 0 0 0x0 0x0
OCVPN Register: sn=x, num_subnets=0
Current State: undefined -> registering
cvpn_save_state: FGT_1 <null> 0.0.0.0 -1 2 0 0 0 0 0x0 0x0
WAN intf wan1, IP 172.25.176.56/255.255.255.0
WAN intf changed from <null> to wan1
WAN IP changed from 0.0.0.0 to 172.25.176.56

Local Subnets:
192.168.176.0/255.255.255.0
JSON Update request = '{ "SN": "x", "IPv4": "172.25.176.56", "port": "500", "Name": "FGT_1", "subnets": [ "192.168.176.0\/255.255.255.0" ] }'
Sending OCVPN request: method=Update, data='{ "SN": "x", "IPv4": "172.25.176.56", "port": "500", "Name": "FGT_1", "subnets": [ "192.168.176.0\/255.255.255.0" ] }'
Received OCVPN response: method=Update, res=0, http_resp=200
JSON Response: '{"key":"","rev":1,"members":[{"IPv4":"172.25.176.56","port":"500","slot":0,"subnets":["192.168.176.0/255.255.255.0"],"Name":"FGT_1"}]}'
Member table size = 1
Member: { "IPv4": "172.25.176.56", "port": "500", "slot": 0, "subnets": [ "192.168.176.0\/255.255.255.0" ], "Name": "FGT_1" }
Subnet 192.168.176.0/255.255.255.0
cvpn_config_install: prev mask 0x1, new mask 0x1
Update response code = 200
Current State: updating -> registered
cvpn_save_state: FGT_1 wan1 172.25.176.56 0 6 0 1 200 1 0x1 0x1
JSON Response: '{"key":"8TVdIwG2xS400jMOxyNN9WKOYWZEsaJDIV8JUGVK2FaHoEVqQPw2qDgt5RLHlZXAuInpCHwl9t8WpZ7jWD+6xg==",
"rev":1,"members":[{"IPv4":"172.25.176.56","port":"500","slot":0,"subnets":["192.168.176.0/255.255.255.0"],"Name":"FGT_1"}]}'
Member table size = 1
Member: { "IPv4": "172.25.176.56", "port": "500", "slot": 0, "subnets": [ "192.168.176.0\/255.255.255.0" ], "Name": "FGT_1" }
Subnet 192.168.176.0/255.255.255.0
cvpn_config_install: prev mask 0x0, new mask 0x1
New members table, revision = 1
Register response code = 200
Current State: registering -> registered
cvpn_save_state: FGT_1 wan1 172.25.176.56 0 6 0 1 200 1 0x1 0x0
Current State: registered -> acknowledging
cvpn_save_state: FGT_1 wan1 172.25.176.56 0 5 6 1 200 1 0x1 0x0
JSON regack request = '{ "SN": "x", "rev": 1 }'
Sending OCVPN request: method=RegAck, data='{ "SN": "x", "rev": 1 }'
Received OCVPN response: method=RegAck, res=0, http_resp=200
JSON Response: '{"message":"Device successfully acknowledged"}'
Message='Device successfully acknowledged'
RegAck response code = 200
Current State: acknowledging -> registered
cvpn_save_state: FGT_1 wan1 172.25.176.56 0 6 6 1 200 1 0x1 0x0
OCVPN Update: sn=x, num_subnets=0
Current State: registered -> updating
cvpn_save_state: FGT_1 wan1 172.25.176.56 0 3 0 1 200 1 0x1 0x0
WAN intf wan1, IP 172.25.176.56/255.255.255.0

Local Subnets:
cvpn_build_json_reg_upd: internal error, line 1187
cvpn_build_json_reg_upd: res = -1
sys_ocvpn_update: res=-1
WAN intf wan1, IP 172.25.176.56/255.255.255.0
OCVPN Update: sn=x, num_subnets=1
Current State: updating
WAN intf wan1, IP 172.25.176.56/255.255.255.0

Local Subnets:

192.168.176.0/255.255.255.0
JSON Update request = '{ "SN": "x", "IPv4": "172.25.176.56", "port": "500", "Name": "FGT_1", "subnets": [ "192.168.176.0\/255.255.255.0" ] }'
Sending OCVPN request: method=Update, data='{ "SN": "IPv4": "172.25.176.56", "port": "500", "Name": "FGT_1", "subnets": [ "192.168.176.0\/255.255.255.0" ] }'
Received OCVPN response: method=Update, res=0, http_resp=200
JSON Response: '{"key":"","rev":1,"members":[{"IPv4":"172.25.176.56","port":"500","slot":0,"subnets":["192.168.176.0/255.255.255.0"],"Name":"FGT_1"}]}'
Member table size = 1
Member: { "IPv4": "172.25.176.56", "port": "500", "slot": 0, "subnets": [ "192.168.176.0\/255.255.255.0" ], "Name": "FGT_1" }
Subnet 192.168.176.0/255.255.255.0
cvpn_config_install: prev mask 0x1, new mask 0x1
Update response code = 200
Current State: updating -> registered
cvpn_save_state: FGT_1 wan1 172.25.176.56 0 6 0 1 200 1 0x1 0x1

To view a list of OCVPN cloud members, use the following command:

FGT_1 # diag vpn ocvpn print-members
Member: { "IPv4": "172.25.176.56", "port": "500", "slot": 0, "subnets": [ "192.168.176.0\/255.255.255.0" ], "Name": "FGT_1" }
Member: { "IPv4": "172.25.177.56", "port": "500", "slot": 1, "subnets": [ "192.168.177.0\/255.255.255.0" ], "Name": "FGT_2" }

1. Setting up registration and licensing

Make sure both FortiGates are running the same FortiOS firmware version. Register and apply licenses to the new FortiGate unit before adding it to the HA cluster.

This includes licensing for FortiCare Support, IPS, AntiVirus, Web Filtering, Mobile Malware, FortiClient, FortiCloud, and additional virtual domains (VDOMs).

All FortiGates in the cluster must have the same level of licensing for FortiGuard, FortiCloud, FortiClient, and VDOMs. FortiToken licenses can be added at any time because they are synchronized to all cluster members.

You can also install any third-party certificates on the primary FortiGate before forming the cluster. Once the cluster is formed, third-party certificates are synchronized to the backup FortiGate.

2. Configuring the primary FortiGate for HA

On the primary FortiGate, go to System > Settings and change the Host name to identify this as the primary FortiGate in the HA cluster.

Go to System > HA and set the Mode to Active-Passive. Set the Device priority to a higher value than the default (in the example, 250) to make sure this FortiGate will always be the primary FortiGate. Also, set a Group name and Password.

Make sure that two Heartbeat interfaces (in the example, port3 and port4) are selected and the Heartbeat Interface Priority for each is set to 50.

Since the backup FortiGate is not available, when you save the HA configuration, the primary FortiGate will form a cluster of one FortiGate but will keep operating normally.

If there are other FortiOS HA clusters on your network, you may need to change the cluster group ID using this CLI command.

config system ha
    set group-id 25
end

3. Connecting the backup FortiGate

Connect the backup FortiGate to the primary FortiGate and the network, as shown in the network diagram at the top of the recipe.

Making these network connections will disrupt traffic so you should do this when the network is not processing much traffic. If possible, make direct Ethernet connections between the heartbeat interfaces of the two FortiGate units.

Switches must be used between the cluster and the Internet, and between the cluster and the internal networks, as shown in the network diagram. You can use any good quality switches to make these connections. You can also use one switch for all of these connections, as long as you configure the switch to separate traffic from the different networks.

4. Configuring the backup FortiGate for HA

Connect to the backup FortiGate GUI and go to System > Settings and change the Host name to identify this as the backup FortiGate.

Go to System > HA and duplicate the HA configuration of the primary FortiGate (except for the Device priority): set Mode to Active-Passive, and set the Device Priority to a lower value than the default to make sure this FortiGate will always be the backup FortiGate. Also, set the same Group name and Password as the primary FortiGate.

Make sure that the same two Heartbeat interfaces (port3 and port4) are selected and the Heartbeat Interface Priority for each is set to 50.

If you changed the cluster group id of the primary FortiGate, change the cluster group ID for the backup FortiGate to match, using this CLI command.

config system ha
    set group-id 25
end

When you save the HA configuration of the backup FortiGate, if the heartbeat interfaces are connected, the FortiGates will find each other and form an HA cluster. Network traffic may be disrupted for a few seconds while the cluster is negotiating.

5. Viewing the status of the HA cluster

Connect to the GUI of the primary FortiGate. The HA Status widget shows the cluster mode (Mode) and group name (Group).

It also shows the host name of the primary FortiGate (Master), which you can hover over to verify that the cluster is synchronized and operating normally. You can click on the widget to change the HA configuration or view a list of recently recorded cluster events, such as members joining or leaving the cluster.

6. Results

Traffic is now passing through the primary FortiGate. However, if the primary FortiGate becomes unavailable, traffic should fail over and the backup FortiGate will process traffic.

A failover also causes the primary and backup FortiGate to reverse roles, even when both FortiGates are available again.

To test HA failover, from a PC on the internal network, ping an IP address on the Internet (in the example, 8.8.8.8).

After a moment, power off the primary FortiGate. You will see a momentary pause in the ping results, until traffic fails over to the backup FortiGate, allowing the ping traffic to continue.

7. (Optional) Upgrading the firmware for the HA cluster

Upgrading the firmware on the primary FortiGate automatically upgrades the firmware on the backup FortiGate. Both FortiGates are updated with minimal traffic disruption.

Always review the Release Notes and Supported Upgrade Paths before installing new firmware.

1. Checking the Security Rating results before installing the FortiSandbox

On Edge (the root FortiGate in the Security Fabric), go to Security Fabric > Security Rating.

Since you haven’t yet installed a FortiSandbox in your network, the Security Fabric fails the Advanced Threat Protection check.

In the example, the Security Rating Score decreases by 30 points for each of the four FortiGates in the Security Fabric.

2. Connecting the FortiSandbox and Edge

Connect to the FortiSandbox.

To edit port1, which is used for communication between the FortiSandbox and the rest of the Security Fabric, go to Network > Interfaces.

Set IP Address/Netmask to an internal IP address. In this example, the FortiSandbox connects to the same subnet as the FortiAnalyzer that you installed previously, using the IP address 192.168.65.20.

Edit port3. This port is used for outgoing communication by the virtual machines (VMs) running on the FortiSandbox. It’s recommended that you connect this port to a dedicated interface on your FortiGate to protect the rest of the network from threats that the FortiSandbox is currently investigating.

Set IP Address/Netmask to an internal IP address (in the example, 192.168.179.10/255.255.255.0).

To add a static route, go to Network > System Routing. Set Gateway to the IP address of the FortiGate interface that port 1 connects to (in the example, 192.168.65.2).

Connect to Edge.

To configure the port that connects to port3 on the FortiSandbox (in the example, port13), go to Network > Interfaces. Set IP/Network Mask to an address on the same subnet as port 3 on the FortiSandbox (in the example, 192.168.179.2/255.255.255.0)

Connect the FortiSandbox to the Security Fabric.

3. Allowing VM Internet access

Connect to Edge.

To create a policy that allows connections from the FortiSandbox to the Internet, go to Policy & Objects > IPv4 Policy.

Connect to FortiSandbox.

Go to Scan Policy > General and select Allow Virtual Machines to access external network through outgoing port3. Set Gateway to the IP address of port 13 on the FortiGate.

Go to the Dashboard and locate the System Information widget. Verify that VM Internet Access has a green checkmark beside it.

4. Adding the FortiSandbox to the Security Fabric

Connect to Edge.

To add FortiSandbox to the Security Fabric, go to Security Fabric > Settings. Enable Sandbox Inspection.

Make sure FortiSandbox Appliance is selected and set Server to the IP address of port 1 on the FortiSandbox.

Edge, as the root FortiGate, pushes FortiSandbox settings to the other FortiGates in the Security Fabric. To verify this, connect to Accounting and go to Security Fabric > Settings.

Select and edit Edge. Under Permissions & Policies, select Authorized.

Repeat this for the other FortiGates.

5. Adding sandbox inspection to Antivirus, Web Filter, and FortiClient profiles

You can apply sandbox inspection with three types of security inspection: antivirus, web filter, and FortiClient compliance profiles. In this step, you add sandbox to all FortiGate devices in the Security Fabric individually, using the profiles that each FortiGate applies to network traffic.

In order to pass the Advanced Threat Protection check, you must add sandbox inspection to antivirus profiles for all FortiGate devices in the Security Fabric.

Go to Security Profiles > AntiVirus and edit the default profile.

Under Inspection Options, set Send Files to FortiSandbox Appliance for Inspection to All Supported Files.

Enable Use FortiSandbox Database, so that if the FortiSandbox discovers a threat, it adds a signature for that file to the antivirus signature database on the FortiGate.

Go to Security Profiles > Web Filter and edit the default profile.

Under Static URL Filter, enable Block malicious URLs discovered by FortiSandbox.

If the FortiSandbox discovers a threat, the URL that threat came from is added to the list of URLs that are blocked by the FortiGate.

Go to Security Profiles > FortiClient Compliance Profiles and edit the default profile. Enable Security Posture Check.

Enable Realtime Protection and Scan with FortiSandbox.

6. Results

If a FortiGate in the Security Fabric discovers a suspicious file, it sends the file to the FortiSandbox.

You can view information about scanned files on either the FortiGate that sent the file or the FortiSandbox.

On one of the FortiGate devices, go to the Dashboard and locate the Advanced Threat Protection Statistics widget. This widget shows files that both the FortiGate and FortiSandbox scan.

On the FortiSandbox, go to System > Status and view the Scanning Statistics widget for a summary of scanned files.

You can also view a timeline of scanning in the File Scanning Activity widget.

On Edge, go to Security Fabric > Security Rating and run a rating. When it is finished, select the All Results view.

In the example, all four FortiGate devices in the Security Fabric pass the Advanced Threat Protection check and the Security Rating Score increases by 9.7 points for each FortiGate.