MBCDN

Virtuelle Domänen (VDOMs) werden verwendet, um ein FortiGate in zwei oder mehr virtuelle Einheiten zu unterteilen, die unabhängig voneinander funktionieren. VDOMs können separate Sicherheitsrichtlinien und im NAT-Modus völlig separate Konfigurationen für Routing und VPN-Dienste für jedes verbundene Netzwerk bereitstellen. Ähnlich wie Context auf ASA.

Fortigate VM CLI

// initial setup
config system global
hostname FG1 
end

// testen
show system global

// other commands
show system interface
show system dhcp server
show system dns
show full-configuration 
execute factoryreset
get router info routing-table <all,details,vrf,ospf,bgp,rip,..>

show firewall address vie-p-srv-wsy02

config system interface
show
edit Server_Lan
get | grep address
show | grep address
set vlanid 1

edit next # erstellt ein objekt mit der nächst verfügbaren ID

config system interface
    edit port1
        set ip 100.0.0.2 255.255.255.0
        set role wan
        set alias WAN
        set allowaccess ping
    next
    edit port2
        set ip 192.168.0.1 255.255.255.0
        set role lan
        set alias LAN
        set allowaccess fgfm http https ping snmp ssh telnet
    next
end
show system interface // check config

config system dns
    set primary 8.8.8.8
    set secondary 8.8.4.4
    next
end

config system dhcp server
    edit 1
        config ip-range
            edit 1
            set start-ip 192.168.0.10
            set end-ip 192.168.0.20
            set default-gateway 192.168.0.1
            set dns-server1 8.8.8.8
            set dns-server2 8.8.4.4
            set enable enable
            set interface port1
            set server-type regular
            set netmask 255.255.255.0
        next
    next
end

config router static
    edit 1
        set gateway 192.168.0.1
        set device port1
    next
end

FGT # config router policy
FGT (policy) # edit 1
        set input-device   <----- Incoming interface name.
        set input-device-negate <----- Enable/disable negation of input device match.
        set src    <----- Source IP and mask (x.x.x.x/x).
        set srcaddr   <----- Source address name.
        set src-negate <----- Enable/disable negating source address match.
        set dst   <----- Destination IP and mask (x.x.x.x/x).
        set dstaddr <----- Destination address name.
        set dst-negate <----- Enable/disable negating destination address match.
        set action <----- Action of the policy route.
        set protocol <----- Protocol number (0 - 255).
        set gateway <----- IP address of the gateway.
        set output-device <----- Outgoing interface name.
        set tos <----- Type of service bit pattern.
        set tos-mask <----- Type of service evaluated bits.
        set status <----- Enable/disable this policy route.
        set comments <----- Optional comments.
        set internet-service-id <----- Destination Internet Service ID.
        set internet-service-custom <----- Custom Destination Internet Service name.
next
end

config firewall address
    edit "subnet_192.168.1.0_24"
        set subnet 192.168.1.0 255.255.255.0
    next
    edit "subnet_192.168.2.0_24"
        set subnet 192.168.2.0 255.255.255.0
    next
end

config firewall policy
    edit 1
        set name "INTERNET ACCESS"
        set srcintf port2
        set dstintf port3
        set srcaddr "subnet_192.168.1.0_24"
        set dstaddr "subnet_192.168.2.0_24"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

Move policy

config firewall policy
    move 15 before 10
end

Um den Clients Zugriff auf das Internet zu geben kann man eine einfache Firewall Policy erstellen und dabei den Haken bei NAT (als Adresse das Interface) setzen.

config firewall policy
    edit 1
        set name "INTERNET ACCESS"
        set srcintf "port2"
        set dstintf "port1"
        set srcaddr "LOCALSUBNET"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

Um einen Server zu exposen erstellt man eine virtuelle IP und eine Firewall Policy (WAN → LAN) dazu. (Bei der Firewall Policy nicht die IP selbst angeben oder als Objekt erstellen sondern das Objekt der virtuellen IP verlinken).

config firewall policy
    edit 4
        set name "test"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "all"
        set dstaddr "server"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

config system gre-tunnel
    edit "GRE-Tunnel"
        set interface "port1"
        set local-gw 100.0.0.2
        set remote-gw 200.0.0.2
    next
end

# Alternativ (untested)
config system interface
    edit "GRE-Tunnel"
        set vdom "root"
        set ip 192.168.0.2 255.255.255.255 # muss /32 sein!
        set allowaccess ping
        set type tunnel
        set remote-ip 192.168.0.1 255.255.255.0 
        set interface "port1" # Lokaler Tunnel Endpoint
    next
end

Firewall Regeln für den Tunnel.

config firewall policy
    edit 2
        set name "TO-GRE"
        set srcintf "port2"
        set dstintf "GRE-Tunnel"
        set srcaddr "LOCALSUBNET"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 3
        set name "FROM-GRE"
        set srcintf "GRE-Tunnel"
        set dstintf "port2"
        set srcaddr "all"
        set dstaddr "LOCALSUBNET"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

Siehe Configure SD WAN Interface

Siehe Fortigate Performance SLA.

#Example
config system link-monitor
    edit 0
        set addr-mode ipv4
        set srcintf "wan1"
        set server "8.8.8.8"
        set protocol ping
        set gateway-ip <wan1-gateway|0.0.0.0>
        set source-ip <wan1-ip|0.0.0.0>
        set interval 2
        set failtime 5
        set recoverytime 10
        set ha-priority 1
        set update-cascade-interface disable
        set update-static-route enable
        set status enable
    next
end

config router ospf
    set router-id 10.11.101.1
    config area
        edit 0.0.0.0
        next
    end
    config ospf-interface
        edit "Router1-Internal-DR"
            set interface "port1"
            set priority 255
            set dead-interval 40
            set hello-interval 10
        next
        edit "Router1-External"
            set interface "port2"
            set dead-interval 40
            set hello-interval 10
        next
    end
    config network
        edit 1
            set prefix 10.11.0.0 255.255.0.0
        next
        edit 2
            set prefix 192.168.102.0 255.255.255.0
        next
    end
end

Auth via User/Pass oder API Token.

API Admin erstellen; System → Administrators → new with API key

curl -k -L "https://10.5.1.1/api/v2/my/path?access_token=xxxxxxxxx"

In Postman die Auth auf „API Key“ stellen.

• Key: access_token
• Value: API-Token
• Add-to: Header

Ausgabe formatieren.

https://<fw>/api/v2/cmdb/firewall/address?format=name|type|obj-type|associated-interface
https://<fw>/api/v2/cmdb/firewall/policy?format=policyid|srcintf|dstintf|srcaddr|dstaddr|service

Ausgabe filtern

https://<fw>/api/v2/cmdb/firewall/address?filter=name=@Acticon_Controller
https://<fw>/api/v2/cmdb/firewall/address?format=name&filter=name=@Acticon_Controller

# Interfaces
cmdb/system/interface
 
# Router
cmdb/router/static
cmdb/router/policy
cmdb/router/rip
cmdb/router/ospf
cmdb/router/bgp
 
# Firewall
cmdb/firewall/policy
cmdb/firewall/address
 
# User
cmdb/user/local
cmdb/user/ldap
cmdb/user/group

• Homepage
• Documentation
• Download
• FGT_VM64_KVM-v5-build1449-FORTINET.out.kvm.zip (GNS3)
• Fortigate Firewall Training for Beginners 4h
• Fortigate 60E - Initial setup, WAN, Dual-WAN, LAN, LACP, VLAN, SDWAN on a FortiGate 60E
• Fortigate Firewall Troubleshooting