1. Configuring the primary FortiGate

Connect to the primary FortiGate and locate the System Information Dashboard widget.

Change the unit’s Host name to identify it as the primary FortiGate.

You can also enter this CLI command:

 config system global
    set hostname External-Primary
 end

Enter this CLI command to set the HA mode to active-passive, set a group name and password, increase the device priority to a higher value (for example, 200) and enable override.

Enabling override and increasing the device priority means this unit should always become the primary unit.

This command also selects port3 and port4 to be the heartbeat interfaces and sets their priorities to 50.

 config system ha
    set mode a-p
    set group-name External-HA-Cluster
    set password
    set priority 200
    set override enable
    set hbdev port3 50 port4 50
 end

You can also use the GUI (System > HA) to configure most of these settings.

config system ha
    set override enable
end

The FortiGate unit negotiates to establish an HA cluster. When you select OK you may temporarily lose connectivity with the FortiGate unit as FGCP negotiation takes place and the MAC addresses of the FortiGate unit are changed to HA virtual MAC addresses. These virtual MAC addresses are used for failover. The actual virtual MAC address assigned to each FortiGate interface depends on the HA group ID. Since this example does not involve changing the HA group ID, the FortiGate unit’s interfaces will have the following MAC addresses: 00:09:0f:09:00:00, 00:09:0f:09:00:01, 00:09:0f:09:00:02 and so on.

To reconnect sooner, you can update the ARP table of your management PC by deleting the ARP table entry for the FortiGate unit (or just deleting all ARP table entries). You can usually delete the ARP table from a command prompt using a command similar to arp -d.

To confirm these MAC address changes, you can use the get hardware nic (or diagnose hardware deviceinfo nic) command to view the virtual MAC address of any FortiGate unit interface. Depending on the FortiGate model, the output from this command could include lines similar to the following:

Current_HWaddr:   00:09:0f:09:00:00
Permanent_HWaddr  02:09:0f:78:18:c9

2. Configuring the backup FortiGate

Enter this command to reset the new FortiGate that will become the backup FortiGate to factory default settings.

execute factoryreset

You can skip this step if the new FortiGate is fresh from the factory. But if its configuration has been changed at all it is recommended to set it back to factory defaults to reduce the chance of synchronization problems.

If required, change the firmware running on the new FortiGate to be the same version as is running on the primary unit.

Register and apply licenses to the new FortiGate unit before adding it to the cluster. This includes activation of FortiCloud and licenses for FortiGuard, FortiSandbox, FortiClient, and FortiToken, as well as entering a license key if you purchased more than 10 Virtual Domains (VDOMS).

the new FortiGate’s Host Name to identify it as the backup FortiGate.

config system global
    set hostname External-Backup
 end

Duplicate the primary unit HA settings, except set the Device Priority to a lower value (for example, 50) and do not enable override.

You can configure all of these settings from the GUI.

You can also enter this CLI command:

3. Connecting the cluster

Connect the HA cluster as shown in the network diagram. Making these connections will disrupt network traffic as you disconnect and re-connect cables.

If possible, make direct Ethernet connections between the heartbeat interfaces of the two FortiGate units.

Switches must be used between the cluster and the Internet and between the cluster and the internal networks as shown in the network diagram. You can use any good quality switches to make these connections. You can also use one switch for all of these connections as long as you configure the switch to separate traffic from the different networks.

When connected, the primary and backup FortiGates find each other and negotiate to form an HA cluster.  The Primary unit synchronizes its configuration with the backup FortiGate. Forming the cluster happens automatically with minimal or no disruption to network traffic.

4. Checking cluster operation and disabling override

Check the cluster synchronization status to make sure the primary and backup units have the same configuration. Log into the primary unit CLI and enter this command:

diag sys ha checksum cluster

The command output lists all cluster members’ configuration checksums. If both cluster units have identical checksums you can be sure that their configurations are synchronized. If the checksums are different, wait a short while and enter the command again. Repeat until the checksums are identical. It may take a while for some parts of the configuration to be synchronized. If the checksums never become identical contact Fortinet support to help troubleshoot the problem.

The System Information Dashboard widget also shows if the cluster units are synchronized. Mouse over each FortiGate in the cluster to verify that they both have the same checksum.

When the checksums are identical, disable override on the primary unit (recommended).

config system ha
    set override disable
end

The HA cluster dynamically responds to network conditions. If you keep override enabled the same FortiGate will always be the primary FortiGate. Because of this, however; the cluster may negotiate more often potentially increasing traffic disruptions.

If you disable override it is more likely that the new FortiGate unit could become the primary unit. Disabling override is recommended unless its important that the same FortiGate remains the primary unit.

From the System Information widget, select HA Status (or go to System > HA) to view the cluster status.

5. Results

1. Creating the SSL VPN user and user group

Go to User & Device > User Definition > Create New and create a new user via the Users/Groups Creation wizard.

Enable the user account and apply Two-factor Authentication if required.

Click Create.

2. Configuring and assigning the password policy

Enter the CLI Console and configure a password policy using the following commands:

config user password-policy
  edit "pwpolicy1"
    set expire-days 2
    set warn-days 1
  next
end

The password policy includes an expiration time and a warning time.

Next, assign the password policy to the newly created user using the following commands.

config user local
  edit "jsnow"
    set type password
    set passwd-policy "pwpolicy1"
  next
end

By default, the start time for the password is set to the time the user was created.

3. Configuring the SSL VPN web portal and settings

Go to VPN > SSL-VPN Portals and select full-access.

Disable Enable Split Tunneling. and select the Source IP Pools. In the example, the default SSLVPN_TUNNEL_ADDR1 pool will suffice.

Enable Tunnel Mode Client Options as required, ensure that you Enable Web Mode and click OK.

Go to VPN > SSL-VPN Settings.

Under Connection Settings, set Listen on Interface(s) to the Internet-facing interface and set Listen on Port to 10443.

Under Tunnel Mode Client Settings, set Address Range to Automatically assign addresses.

Under Authentication/Portal Mapping, assign the newly created user group (“TempVPNGroup“) to the full-access portal and Apply your changes.

4. Adding security policies for access to the internal network and the Internet

Go to Policy & Objects > IPv4 Policy and add a security policy allowing access to the internal network through the VPN tunnel interface.

Include the newly created user group and enable NAT.

Add a second security policy allowing access to the Internet through the VPN tunnel interface.

Include the newly created user group an enable NAT.

5. Results

When the warning time is reached (see Step 2), the user is prompted to enter a new password.

However, when the expiration time is reached, the user will not be able to enter a new password and must contact the administrator for assistance.

Go to Log & Report > VPN Events to see the SSL VPN alert labeled ssl-alert.

Highlight the alert message and click Details to see the log in greater detail, specifically under Action.

1. Connecting your ISPs to the FortiGate

2. Deleting security policies and routes that use WAN1 or WAN2

You will not be able to add an interface to the WAN link interface if it is already used in the FortiGate’s configuration, so you must delete any security policies or routes that use either WAN1 or WAN2. Traffic will not be able to reach WAN1 or WAN2 through the FortiGate after you delete the existing policies.

Many FortiGate models include a default Internet access policy that uses WAN1. This policy must also be deleted.

3. Creating a WAN link interface

Go to Network > WAN LLB (WAN Link Load Balancing).

Set the Interface State to Enable.

Under WAN LLB, select Create New to add an interface.

Add wan1 and enter the Gateway IP provided by your primary ISP. Do the same for wan2, but this time use the Gateway IP provided by your secondary ISP.

Under Load Balancing Algorithm, select Volume as the type. This will allow you to prioritize the wan1 interface so that more traffic uses it. For the weight, set wan1 to 3 and set wan2 to 1.

The weight settings will cause 75% of traffic to use WAN1, with the remaining 25% using WAN2.

4. Configuring Health Check (optional)

You can optionally configure Health Check to verify the health and status of the links that make up the virtual WAN link. Health Check is only available via the CLI. Go to Dashboard > CLI and enter the following commands:

config system virtual-wan-link
 set fail-detect [enable | disable]
 set fail-alert-interfaces (available only if fail-detect is enabled)
 config health-check
  edit [health check name]
  set server <string>
  set protocol [ping | tcp-echo | udp-echo | http | twamp ]
...
  set timeout <integer>
  set failtime [1-10]
  set recoverytime [1-10]
  set update-cascade-interface [enable | disable]
  set update-static-route [enable | disable ]
 end
end

5. Creating a default route for the WAN link interface

Go to Network > Static Routes and create a new default route.

Set Device to the WAN link interface.

6. Allowing traffic from the internal network to the WAN link interface

Go to Policy & Objects > IPv4 and create a new policy.

Set Incoming Interface to your internal network’s interface and set Outgoing Interface to the WAN link interface.

Turn on NAT.

7. Results

Browse the Internet using a computer on the internal network and then go to FortiView > All Sessions.

Make sure that the Destination Interface column is shown. If it’s not, right-click on the top menu row to add it to the menu.

The log shows traffic flowing through both WAN1 and WAN2.

Go to Network > Interfaces and disable the wan1 port. Then browse the Internet from the internal network.

1. Enabling certificate management

Go to System > Feature Select and make sure that Certificates is enabled.

2. Installing the server certificate

Go to System > Certificates and select Import > Local Certificate.

Set Type to Certificate, choose the Certificate file and the Key file for your certificate, and enter the Password. You can also change the Certificate Name.

The server certificate now appears in the list of Certificates.

3. Installing the CA certificate

The CA certificate is the certificate that signed both the server certificate and the user certificate. In this example, it is used to authenticate SSL VPN users.

Go to System > Certificates and select Import > CA Certificate.

Select Local PC, then select the certificate file.

The CA certificate now appears in the list of External CA Certificates (CA_Cert_1).

4. Creating PKI users and a user group

To use certificate authentication, PKI users must be created in the CLI. Go to Dashboard and enter the following commands into the CLI Console widget:

config user peer
  edit rdiaz
    set ca CA_Cert_1
    set subject User01
  end

Make sure that subject matches the name of the user certificate (in this example, User01) 

Now that you have created a PKI user, a new menu has been added to the GUI. Go to User & Device > User group > PKI to see the new user listed.

Edit the user account and expand Two-factor authentication. Enable Require two-factor authentication and set a Password for the account.

5. Creating an SSL VPN portal

Go to VPN > SSL-VPN Portals.

Edit the full-access portal to confirm the default configuration.

Make sure that Enable Split Tunneling is disabled so that all SSL VPN traffic will go through the FortiGate unit.

6. Configuring the SSL VPN tunnel

Go to VPN > SSL-VPN Settings.

Under Connection Settings, set Listen on Interface(s) to wan1. To avoid admin port conflicts, set Listen on Port to 10443. 

Set Server Certificate to the authentication certificate and enable Require Client Certificate.

Under Authentication/Portal Mapping, assign the user group to the full-access portal. If necessary, assign a portal for All Other Users/Groups.

7. Adding security policies for access to the Internet and internal network

Go to Policy & Objects > IPv4 Policy. Create a security policy allowing SSL VPN users to access the internal network.

Set Incoming Interface to ssl.root. Set Source to all and include the new SSL VPN User’s group. Set Outgoing Interface to the local network interface so that the remote user can access the internal network.

Set Destination Address to all, enable NAT, and configure any remaining firewall and security options.

Add a second security policy allowing SSL VPN users to access the Internet.

For this policy, Incoming Interface is set to ssl.root and Outgoing Interface is set to wan1.

Make sure that NAT is enabled.

8. Installing the user certificate

 Every user should have a unique user certificate, so that you can distinguish each user and so that it is possible to revoke a user’s certificate when necessary.

Internet Explorer or Safari (on Windows or Mac OS):

If you are using Windows 7/8/10, open the certificate file and select Install Certificate. The Import Wizard appears.

 Import the certificate into the Personal store.

If you are using Mac OS X, open the certificate file. Keychain Access opens.

Double-click the certificate. Expand Trust and select Always Trust.

FortiClient (on Windows or Mac OS)

Open FortiClient and go to Remote Access > Configure VPN. Create a new SSL VPN connection.

Set the Connection Name, Remote Gateway, and Customize port. Enable Client Certificate and select the authentication certificate.

Firefox (on Windows or Mac OS)

Depending on the operating system, go to Menu > Options or Preferences > Advanced and find the Certificates tab.

Select View Certificates, then select the Your Certificates list. Import the certificate file.

9. Results

Using a web browser

Browse to the SSL VPN portal (https://172.20.120.184:10443).

When prompted,select the user certificate.

Enter  user credentials when requested.

You are able to connect to the SSL VPN web portal.

Using FortiClient

Open FortiClient, select the newly created VPN, enter user credentials and click Connect.

On the FortiGate, go to Monitor > SSL-VPN Monitor. You can see that the user is currently connected to the VPN.

The first instance correlates to the SSL VPN Web portal connection while the second entry relates to the FortiClient connection.

Adding a Remote Extension

To add and configure a remote extension

1. Go to Extensions > Extensions > Remote Extensions.
2. Select New.
3. Enter the local extension number from which calls are transferred to a remote extension.
4. Enter the remote phone number to which a call to the local extension is transferred.
5. Select Enabled.
6. Enter the Display name and External caller ID.
7. Enter the password for the user to access voicemail in the User PIN section.
8. Select the appropriate Authentication type from the dropdown menu. LDAP requires and LDAP profile and authentication ID.
9. Expand the Voice Mailbox tab and configure accordingly if you want other users or groups to share the voice mailbox. For example, you may others to access your mailbox when you’re away.
10. Select Create.

Follow Me Configuration

To configure follow me settings.

1. Go to Extensions > Extensions > Preferences
2. Double click an existing number.
3. Select New in the Follow Me section.
4. Enter a Name for the setting.
5. Under Follow Me Numbers, select New.
6. Enter a phone number to which the call to your extension can be transferred.
7. Enter the duration in which the phone will ring until it is sent to voicemail or the next number is dialed in the sequence.
8. Select Create.

You can repeat these procedures to add additional numbers. Numbers are dialed according to their sequence in the follow me setting.

Handling a Normal Call

To handle a normal call

1. Go to Extensions > Extensions > Preferences.
2. Double click an existing number.
3. Go to the Call Handling section and select Normal call handling.
4. Select one of the call status tabs (No answer, Busy, Do not disturb, Unavailable, or Voicemail).
5. Select User defined.
6. Select New to define a call process according to a schedule.
7. Select a preconfigured schedule from the Schedule dropdown menu.
8. Select the action you want the unit to take when the call reaches the unit during the designated schedule.
9. Select Create and then select OK.

1. Connecting the External FortiGate and the FortiAnalyzer

In this example, the External FortiGate’s port 16 will connect to port 2 on the FortiAnalyzer.

On the External FortiGate, go to Network > Interfaces and edit port 16. Set an IP/Network Mask for the interface (in the example, 192.168.55.2).

Configure Administrative Access to allow FortiTelemetry, required for communication between devices in the CSF. Configure other services as required.

2. Configuring OSPF routing to the FortiAnalyzer

3. Allowing internal FortiGates to access the FortiAnalyzer

Go to Policy & Objects > IPv4 Policy and create a policy allowing the internal FortiGates (Accounting and Marketing) to access the FortiAnalyzer.

Do not enable NAT.

4. Sending log information to the FortiAnalyzer

On the FortiAnalyzer, go to Device Manager and add a device.

Enter all information about the External FortiGate, then select Next.

The FortiAnalyzer will now add the device.

On the External FortiGate, go to Log & Report > Log Settings. Under Remote Logging and Archiving, enable Send Logs to FortiAnalyzer/FortiManager. Enter the IP Address of the FortiAnalyzer.

In this example, logs will be uploaded in Realtime because there is no bandwidth limitations. Also, since log traffic is occurring within the CSF, encryption is not enabled.

Select Test Connectivity to view information about the connection.

Under GUI Preferences, select Display Logs From FortiAnalyzer.

5. Results 

Configuring FortiRecorder

To configure FortiRecorder

1. Go to System > Network > Interface and edit port 1.
2. Set a manual IP for the interface that is on the same subnet as the FortiGate interface.
3. Set Access to allow HTTPS, FRC-Central, and any other required protocols.
4. Select OK.
5. Go to System > Network > Routing and select new to add a default route that uses the IP address of the FortiGate’s interface. Set the interface to port1.

Configuring Remote Camera Deployment

To configure remote camera deployment

1. In the FortiRecorder UI, go to Camera > Configuration > Camera.
2. Select
3. Enter the Name and Location of the camera and select ONVIF from the Camera dropdown menu.
4. Enter the username and password of the remote camera you are accessing.
5. Since the camera is on a remote network, select VIP from the Address Mode dropdown menu.
6. Enter the required virtual IP address in the Address section. Entering a static IP address will allow FortiGate to forward connections to the camera’s private network address. Enter port 443.
7. Select UDP from the Transport type dropdown menu and enter port 554.

1. Registering the FortiGate as a RADIUS client on NPS

2. Creating a Connection Request Policy

3. Creating a Network Policy

4. Configuring FortiGate to use the RADIUS server

5. Configuring a user group on the FortiGate

6. Creating an SSID with RADIUS authentication

7. Creating a security policy

8. Results

Creating a Ring Group

To create a ring group

1. Go to Extensions > Groups > Ring Group.
2. Select New.
3. Enter a descriptive name for the ring group and a number.
4. Enable the ring group by selecting the Enabled checkbox.
5. Select whether you want all extensions in the group to ring when dialed or if you want individuals to be contacts one at a time.
6. Select the available extensions or user groups that you want to include in the ring group and select the right arrow button to move them into the selected field.
7. Select New in the External numbers section to add an external phone number to the ring group. For example, you can add the number of a remote employee to an established ring group.
8. Select Create.

You can expand the Advanced setting section to configure options such as when to send a call to voicemail and call waiting. You can also edit call handling options, which we will cover in the next section.

Configuring Ring Group Call Handling

Call Handling establishes how the unit will handle each individual call that contacts a specific ring group. For example, a client may call a number and the unit will forward the call to another number depending on the time of day. 

To configure the call process in the Ring Group section

1. Select the available option in the Call Handling section. It should say “Normal call handling”.
2. Select a desire call status tab (No answer, Busy, or Unavailable). Each status can only be used for one call management configuration.
3. Select either User defined or System default action in the Call process section. The System default action changes depending on the status section.
4. If you select User defined, select New.
5. Select a pre-configured schedule for the Schedule section  or create your own. For more information on how to create and configure a schedule, see “Scheduling the FortiVoice unit” in the Administrator Guide.

   Voicemai: Enter the extension number
   Play Announcement: Select the sound file.
   Auto Attendant: Select the auto attendant profile or create one. For more information on creating an auto attendant, see “Configuring auto attendants” in the FortiVoice Admin Guide.
   Forward: Enter the number to which you want the call forwarded.

6. Select Create and then OK.

1. Configuring the IPsec VPN using the IPsec VPN Wizard

On the FortiGate, go to VPN > IPsec Wizard.

Name the VPN connection (iPhoneVPN).

Select the Remote Access template, select the iOS Native device type, and select Next.

Set the Incoming Interface to the Internet-facing interface (wan1).

Select the Pre-shared Key authentication method and enter a pre-shared key.

Select the iphone-users user group and select Next.

Set Local Interface to the internal interface and set Local Address to all.

Enter an IP address range for VPN users in the Client Address Range field, enter a Subnet Mask, and select Create.

Make sure no other interfaces on the FortiGate are using the same address range.

A summary page shows the wizard’s configuration, including a remote-to-local access security policy.

2. Connecting to the IPsec VPN from iPhone

Set Type to IPsec and enter a Description (required).

Set Server to the FortiGate’s Internet-facing interface, and enter the user’s name in Account.

Enter the user’s password, the pre-shared IPsec VPN secret, and select Done.

Make sure the IPsec VPN configuration is highlighted (indicated by the ✓ icon), and select the button next to Not Connected.

The IPsec VPN will connect with the user’s credentials and secret. The status will change to Connected, and a VPN icon will appear at the top of the screen.

3. Results

1. Enabling Web Application Firewall

Go to System > Features and enable Web Application Firewall. Select Show More and enable Multiple Security Profiles.

Apply your changes.

2. Editing the default Web Application Firewall profile

Web Application Firewall profiles are created with a variety of options, called Signatures and Constraints. Once these options are enabled, Action can be set to Allow, Monitor, or Block, and Severity can be set to High, Medium, or Low.

You can also use a Web Application Firewall profile to enforce an HTTP method policy, which controls the HTTP method allowed when accessing websites that match the specified pattern.

Go to Security Profiles > Web Application Firewall and edit the default profile.

In this example, the signatures for SQL Injection (Extended) and Generic Attacks (Extended) have been enabled, with the Action set to Block and Severity set to High.

Trojans and Known Exploits are also blocked by default.

3. Applying the profile to a security policy

Go to Policy & Objects > IPv4 Policies and edit the policy that allows access to the web server.

Under Security Profiles, enable Web Application Firewall and set it to use the default profile. Set the appropriate Proxy Option and set SSL/SSH Inspection to use the deep-inspection profile.

4. Results

Use the following URL to simulate an attack on your web server, substituting the IP address of your server:

http:///<server IP>/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20=%20'1

5. Offloading to a FortiWeb

If you have a FortiWeb, you may be able to offload the functions of the Web Application Control to your FortiWeb. To find out if this option is available, refer to the FortiOS or FortiWeb Release Notes for information about device compatibility.

Go to System > External Security Devices and enable HTTP Service. Enter your FortiWeb’s IP address.

If necessary, enable Authentication and enter the FortiWeb’s password.