Automate FGT Deployment

0:00hello and welcome my name is Keith Barker and if you and I were asked to deploy

0:05let's say a few

0:06hundred forty eights we'd want to have some tools in place that can help us

0:09automate that

0:10process and in this set of videos we're going to take a look at some of those

0:12options including

0:13low touch and zero touch provisioning along with templates and scripts that we

0:18can use

0:18to automatically push out to a device when it comes online so join me in the

0:22next video as we

0:22take a look at some of our options for automating the deployment of forty e

0:25ights and then we'll

0:26follow it up with a game plan and then do some demonstrations of doing exactly

0:29that so I'll see

0:30you my friend in the very next video in just a moment.

0:00In our topology after this point, we've implemented most of these V-doms and

0:04devices, except for

0:05this one right here, which is going to represent a brand new Fortigate that we

0:09want to add to our

0:10environment. Now, if we just want to add one Fortigate, it's pretty easy to do.

0:13You set up a basic

0:14management IP address, you carve out V-doms if you want it, or you use the

0:17physical device as a whole,

0:18register it with Fort Manager, and away you go. However, if we are rolling out

0:22dozens or hundreds

0:23of Fortigates, we want to have some options for automating that process. And so

0:27some of the options

0:28for automating that include LTP and ZTP, which stands for Low Touch Provision

0:34ing and Zero Touch

0:36Provisioning. And here's the basic idea. Let's imagine this is going to go into

0:39a branch environment,

0:40we can take the firewall, and without any pre-configuration whatsoever on the

0:44firewall itself,

0:45ship it out to that site, have them plug it in, and once it plugs in and gets

0:50an IP address,

0:51it can reach out, connect to Fort Manager, automatically register itself with

0:55Fort

0:55Manager, and then have all the configuration want pushed to it done

0:58automatically. And that's Zero

1:00Touch Provisioning. Now, Low Touch Provisioning is very similar to that.

1:03However, the Low Touch

1:04involves implementing a few basic commands initially on the Fortigate firewall,

1:08and then the rest of

1:09it's done with automation after it's registered with Fort Manager. Now, to

1:13implement the Zero Touch

1:14Provisioning, we'd have to have this device somehow learn where the Fort

1:18Manager is so it can connect

1:20and register with that Fort Manager on its own. And there's a few options for

1:23doing that with Zero

1:24Touch Provisioning. One is to use Fort Cloud or Forted Deploy. And without the

1:28device would plug in,

1:30we'd plug in with an interface that's using DHCP. So depending on the model you

1:34have, that may be,

1:34for example, the WAN-1 interface or the WAN-2 interface or some other interface

1:38that's supporting

1:38DHCP, it gets an IP address via DHCP, including a default gateway it can use,

1:43and via Forte Cloud

1:44it contains the location or the IP address of Fort Manager from Forte Cloud, so

1:48it can connect with

1:49Forte Manager and get the ball rolling. Another option is to use DHCP services

1:53with DHCP options

1:54240 and 241. And by using a DHCP server option, we don't have to involve Forte

1:59Cloud or Forte

1:59Deploy, because we get out of the DHCP server setup with these options, and

2:03part of those options

2:04are going to point to the IP address for Forte Manager. So it boots up, it

2:07looks at those options,

2:08identifies where Forte Manager is, and then they can go ahead based on that

2:11information,

2:12connect to Forte Manager to get the ball rolling. Another option for Zero Touch

2:15Provisioning would be

2:16to use a USB drive, where it gets its initial configuration from that USB drive

2:21, including how

2:22to connect to the Forte Manager to get the ball rolling. Another option is LTP

2:26Low Touch Provisioning,

2:27and that means you do have to do something at the Forte Gate initially to get

2:31the ball rolling,

2:32it doesn't just happen automatically, like ZTP is using one of these above

2:36options. So with low

2:37touch provisioning, we may have a simple script, for example, it says, "Hey,

2:40here's how to get to

2:41the Forte Manager," and we apply that to the Forte Gate, and then as a result

2:44of our minimal

2:44configuration, it can then reach out to the Forte Manager, register with Forte

2:48Manager,

2:49and then we can push out all the configuration from Forte Manager to that newly

2:53deployed firewall.

2:53So let's chat about some options. Once the device does connect to Forte Manager

2:58for pushing out

2:59configurations to a new 48. One option would be we could go ahead and push

3:04scripts to that device.

3:05Now with scripts, there's an option for a pre-run script. So a pre-run script,

3:08think of it like

3:08running a one-time script on a device to get some of the things you want set on

3:12that device.

3:13We could also set scripts as part of a provisioning template that are

3:16associated with that device,

3:17which are persistent, meaning that provisioning template, the CLI template, is

3:21linked or associated

3:22with that device persistently or forever until you remove it. Also with scripts

3:25, there's scripts

3:26that we can run directly against the device itself. There's also scripts that

3:29we can run

3:30against the device database in Forte Manager, which would then require an

3:33additional push

3:34of the device database out to the firewall. So we can run scripts at the device

3:39itself,

3:39or at the device database in Forte Manager. And one cool thing about a script

3:44that you run against

3:44the device is that once you issue those script commands, because you issued

3:48them from Forte

3:49Manager, it doesn't auto update a Forte Manager regarding the new configuration

3:53. Very similar to

3:54an auto update after the new configuration is been pushed out to the device.

3:58Another option for

3:59automating the deployment is we can go ahead and pre-register a Forte Gate

4:03based on a password or

4:04the Forte Gate serial number so that when it checks in with Forte Manager, we

4:08don't have to actually

4:10authorize it. It becomes authorized automatically if we prepared Forte Manager

4:14that this device is

4:15coming online. So in Forte Manager, we can add the device ahead of time. And as

4:18part of adding that

4:19device, we can also associate with that device scripts that we want to run

4:23against that device,

4:24or provisioning templates we want to use in conjunction with that device. And

4:27there's also

4:27another cool option called a device blueprint. And a blueprint can contain a

4:31lot of details we

4:32want associated with that device. So we could actually add the device and refer

4:36to a blueprint

4:37or specify all those individual details as part of that device directly in Fort

4:41e Manager. Now,

4:42another tool that we've talked about in previous sets of videos that we could

4:45also leverage here

4:47is metadata. So if we have a script or some configuration, we want to push out

4:51to new Forte

4:51Gates, but there's slightly different interfaces or different zones or other

4:56options that vary

4:57based on the device. Like for example, a router ID that needs to be unique, we

5:00can use metadata

5:01and normalized interfaces, normalized zones, and metadata as variables. So we

5:06can have a script that

5:07uses those variables and then push them out over and over again to new devices

5:10as they come up.

5:11And many of these options we've seen in previous sets of videos, including

5:14using variables and

5:14metadata, including using normalized zones and interfaces, we've run some

5:18scripts. But what we

5:19haven't done is we haven't told Forte Manager about a device that we have not

5:23yet onboarded.

5:24So we're going to go ahead and use these options right here. And we can also

5:27leverage our other

5:28tools as part of the overall automation process. Now, I also want to give you a

5:32word of caution,

5:32because there are lots of things that we could push out to a new firewall. For

5:38example, we could

5:38push out new VLAN interfaces. We could create zones and interfaces that belong

5:43to those zones,

5:44and we could push out firewall policies and we could push out system templates

5:47and we could

5:48push out, you know, CLI scripts. It's important to not try to push everything

5:52all at once to a

5:53brand new Fortigate. What we'd want to do in a test environment is make sure

5:57individual components

5:58work on the model we're going to push to test them individually. And then after

6:02we know they work,

6:03then go ahead and you can put all of them together. Because with all the

6:07variables with scripts and

6:08metadata and normalized zones and interfaces, if we try to push out a few

6:12hundred changes

6:13using all these options to a new Fortigate, if one of those elements fails, it

6:18makes it hard to

6:18troubleshoot. So I'd encourage you to practice with individual small components

6:23as you're rolling

6:24on a new Fortigate, test them first. And then once we have a tuned up and ready

6:28to go set up for

6:29pulling new Fortigates, and we've tested it and know it works, then we can

6:32start rolling that out

6:33at scale to multiple firewalls. But again, as you begin with the automating and

6:38the rolling out of

6:39new Fortigates using zero touch or low touch provisioning, it'd be a great idea

6:43to do piece by

6:44piece, make sure the individual parts work before you put it all together. All

6:47right, so with that in

6:48mind, in the next video, let's put a game plan together for how we're going to

6:52onboard this brand

6:53new 60F firewall. So I'll see you in the next video for the game plan.

0:00Let's put our game plan together for rolling out a new FortiGate. Now, I currently, I used to have,

0:05for the edges, I used to have an HA pair, and that was being supported by the 60F1 and 60F2,

0:10and I removed that HA configuration, so I had another FortiGate to play with, and I have the new

0:1660F2, which we're going to use to deploy as a new device. What we want to have is this V23,

0:22a VLAN 23 interface connected to the service provider here on the 23.1.2 network, and a

0:28subnet 10.130.0, supported by VLAN 130, and for this device, I want to use .59 as its last octet,

0:34aka the last number of its IPv4 address on those respective networks. I also want to go ahead and

0:39have this on a management network of 192.168.1.0 with a 24-bit mask, again, using the .59 for that

0:47last octet right there, and that's my management network I'm using across the board here in my lab

0:51environment. As far as the game plan, we're going to use 60F-2. We'll do a factory reset on that,

0:57so there's nothing there, and then once that factory reset is done in FortiManager, we'll go

1:01ahead and create an entry for the new FortiGate that we're about to bring on board with the details

1:07of what we want to push out to that device, so I'll say prep for 60F. Now, part of that, when

1:14we configure that on FortiManager, we're going to need to tell FortiManager what the serial number

1:18is or we have to specify the passcode, so I'm going to use the serial number for that 60F2.

1:23I've got that written down, and we'll use that as we prepare the FortiManager for the new 60F2

1:28here that's going to be coming on board. Now, as I mentioned, we could all at once push policies

1:32and push tons of configuration down, but I want to do it piecemeal step-by-step, so if you want

1:37to replicate this, you also can do it step-by-step without having 15 different things being pushed

1:42all at once, and then at that firewall, the 60F2, I'm going to go ahead and do a little teeny bit

1:47of configuration just to tell the firewall where FortiManager is, so I'll refer to that as LTP,

1:52Low Touch Provisioning, on 60F, and then once the 60F2 has registered with FortiManager,

1:58let's go ahead and run some scripts, and I've got several sets of scripts I want to go ahead and run

2:03against the 60F2, so we'll launch all of them from FortiManager. Some will clean up the interfaces

2:08that are currently tied up with the internal switch on the 60F2. I've got another script

2:12that'll change the IP address on the management interface here to .59 instead of the default of

2:1699. I've got another script that'll create the VLAN interfaces. I've got another script that'll go

2:21ahead and create a static default route leading to 23.1.2.1 as the next hop through the service

2:27provider, service provider A, and then once we do our scripts, let's go ahead and push out

2:32a firewall policy, and there's a few different ways of pushing out a policy to the firewall,

2:36so when we get to that point, we'll go ahead and look at our options, choose one, and then push

2:41out a policy list traffic from the internal network here, be routed out to the public internet,

2:46including using that, and then once we've done that, we'll go ahead and test it to make sure

2:50it all works. We'll put a client on this VLAN, the 1030.0 network, and verify that client can

2:55actually go through the firewall and get access to the public internet. So although we're doing

2:59this piece by piece here with the scripts and the policies and so forth, once we test everything,

3:04we know it all works, we can then combine that into an overall push in one fell swoop that can

3:09be done by FortiManager, but again, I'm doing it in smaller chunks so we can see each and every

3:12piece. So with this game plan in mind, in the next video, let's begin the configuration that

3:17we need to set up in order to do onboarding with low-touch provisioning for this brand

3:22new firewall. So I'll see you in the next video in just a moment.

0:00So before we do the 60F reset, let's go ahead over to Ford manager and let's

0:04tell it to prepare

0:06for this 60F model that's going to be coming online. So let's go to Ford

0:10manager and do the

0:11prep for onboarding that new 60F2. So we'll log into Ford manager by putting in

0:15our credentials

0:16and clicking login. We'll go into our eight on where all of our 40 gates

0:19currently are. Currently

0:20we have green across the board. That's great. So let's go to device manager and

0:24let's begin

0:25preparing for the new 40 gate that's going to join. And again, we're going to

0:29be using 60F-2. So

0:31a couple of ways of doing this. Number one, we can click on add device. And

0:34then here we just click

0:35on add model device right there to add a device that is not yet online. And

0:39then we can put in

0:40all the details here. So we can put in the name 60F-2. That's the firewall that

0:44's going to be joining us.

0:45I do have the serial number. Let me go ahead and copy paste that in. So there's

0:49the serial number.

0:50And then we have all these options we could specify, including automatically

0:54linked to real device.

0:54So once it reports in, we don't have to do an extra step of authorizing it at

0:59Florida manager.

0:59It's going to be automatically authorized. We could force the specific firmware

1:02version.

1:03I'm not going to require that. We can enforce device configuration. Now this is

1:06a little bit

1:06scary because if we are pushing out something like a configuration that's going

1:11to cause

1:12our 40 gate to lose connectivity with Florida manager, if we say enforced

1:15device configuration,

1:17any kind of misconfiguration that we have that would cause that loss of

1:20connectivity,

1:20it's going to be able to go ahead and still be implemented, which means we're

1:23going to lose

1:23connectivity. So another great reason to make sure that our configurations and

1:28our pushes are going

1:28to be correct and make sure that the device being managed can still communicate

1:32with Florida manager

1:33after the configuration is done. So I'm going to go ahead and say, yeah, let's

1:36enforce device

1:36configuration. If we want to add the device to a group, we could. So if you

1:40have groups set up,

1:41you can add it. I'm not going to add this one. We could put it in a specific

1:44folder. So I'm going

1:45to choose, for example, the root folder. We could assign a fabric authorization

1:48template. We can

1:49launch a pre run CLI template that's going to run initially. So if we have them

1:53created, we could go

1:54ahead and select one. If you don't have one made, we click on the plus symbol

1:56and we could create one

1:58right here that we run as a pre run CLI template. So I'll click on cancel. I'm

2:03not going to run a

2:03pre CLI template. We can also sign a policy package. If we add a policy package

2:08ready and waiting to

2:08go for that device, or maybe it's using a policy package that's very similar to

2:12the other firewalls

2:13you have. So you could go ahead and copy one and assign it here. So if you want

2:16to grab a policy

2:16package that was appropriate, we could grab it from here. For the demo, I'm

2:19going to say no,

2:20let's not initially assign a policy package. And then we also can assign

2:23provisioning templates.

2:24So we played with provisioning templates in the past in previous sets of videos

2:28. So if we want to

2:29sign a system template, we can pick it, for example, how about change theme to

2:33Eclipse. We have also

2:34options for assigning an IPsec template. And these are IPsec templates from

2:38earlier in the course.

2:39If we have a static route template, we could assign that. Now, one of the

2:42things too is that if our

2:43static route template in this case is using some variables, we'd want to make

2:48sure that our device

2:49that we're configuring has those variables set up. So we can also go here to

2:53the edit used metadata

2:55variables. So currently, the static route template that we just assigned is

2:59using these two variables.

3:00So we'd want to make sure that we're also going to set up those variables for

3:03this new device as

3:04well. So to do that, we could go ahead and click on this icon for edit right

3:08here and set the mapping

3:09or we could click right here on the variable name. And that would take us to

3:13the variable itself.

3:14Then we can simply do a create new and add the mapping here as well. And that

3:17way, if we're rolling

3:18on a new device, we have five or six variables to set, we can easily do it

3:21right here. So I'm going

3:22to click on cancel. I'm also not going to do the default route right now. And

3:26the reason for that

3:26is I want to set up some VLAN interfaces, which I don't have set up yet. And we

3:29need those before

3:30we can actually do the static default route. But that's how we could go ahead

3:34and assign the

3:34templates. Now, if we didn't want to go ahead and do all the details here, I'm

3:38going to go ahead and

3:38click on cancel. Another option is to create a blueprint. And then as part of

3:42adding device,

3:43we can just refer to the blueprint. So to add a blueprint that we want to use

3:47as part of adding

3:48a new device, we go to this little down arrow key right here. So this is the

3:52add device button.

3:53And just to the right, there's a down arrow. And from there, we can do a device

3:56blueprint.

3:57So there aren't any by default. So we can create a new device blueprint. And

4:00let's call it a 60 f

4:01dash to blueprint. And then it's going to ask us for the device model. Now here

4:05, it's pretty

4:05important because not all Fortigate devices have the same type of interfaces

4:10and so forth. So

4:11we want to choose a 60 f and let me go ahead and grab it right there. And from

4:15here, we can now

4:16specify a lot of the same details that we did at the device level itself,

4:20except it'll be

4:21associated with this blueprint. So for example, we go down here to provisioning

4:24templates. Let's

4:25choose something safe for a system template. Let's go ahead and do change theme

4:29to Eclipse.

4:30And once again, we could choose any of the provisioning templates that we

4:33wanted to here. But I also

4:35want to make sure that they work individually before we start pushing out five

4:38or six templates,

4:39we need to make sure we have all the variables in place. So as a simple test, I

4:42'm going to do a

4:43system template for change theme to Eclipse, and then leave all the others

4:46empty, click on okay.

4:48And then here we could also in this blueprint, we could send a policy package

4:51by selecting one,

4:52if we had one ready to go for this new device, we could do a pre run CLI

4:57template.

4:57And most of the other options that we had, we're configuring that device

5:00directly. Now,

5:01if we had like 20 or 30 60 Fs to hand out, and we wanted all of them to have

5:05this one provisioning

5:06template signed home, we could create this blueprint, I'll click on okay to

5:09save it. And now that we

5:10have it saved, I'll click on close. Now what we could do is we could go to add

5:14device. And once

5:15again, to add model device, but this time specify that we want to go ahead and

5:20use a blueprint. So

5:21use device blueprint, we'll go ahead and slide that over, then select the

5:24blueprint we want to

5:25use. That's when we just created. And then all those values that we just put in

5:29are going to be

5:30applicable to this new device. So it says that the blueprint platform 48 60 F

5:34doesn't match the serial

5:35number. That's because they haven't put it in yet. So this is going to be the

5:37new 60 F dash two.

5:39And then for the serial number, I'll copy paste that from my notes. There it is

5:42right there.

5:43And now it's no longer complaining about the serial number. Also right here, I

5:46can edit my

5:47variable mappings. So I click here on edit, and then currently I'm not using

5:51any scripts or any

5:52commands that require variables. But if I were, they would show up here, and

5:56then I could edit

5:56them, or if we want to go ahead and say, all, this is going to show us all the

5:59variables. And then

6:00once again, we could hear edit each of them and add the variables appropriate

6:04for the new 40 gate

6:05we're about to push out. So because I'm not using any in any of the scripts

6:08that I'm applying with

6:09the initial push, I'll go ahead and click on cancel there, and then click on

6:13next. So now it says 60

6:15F dash two device is successfully added. So we click on finish there. Here is

6:20that 60 F two

6:21right there, it's showing that auto link status is enabled, meaning that if

6:25everything goes well,

6:26and this 60 F connects in with the right serial number, that it's going to be

6:30automatically

6:30authorized, we don't have to go in manually and manually authorize this new 40

6:34gate. Now currently

6:35it's showing that the config status is modified. And let me go ahead and clean

6:39up the interface here

6:40a little bit so I can see the policy package as well. So I'll click on the gear

6:44, and let's remove

6:45a few that we don't need SD Wan manager, we don't need. I do want to see

6:48provisioning templates.

6:50I do want to see policy package status. I don't need to see upgrades status or

6:53firmware version

6:54or HA status or description or platform. And let's see how that looks. All

6:59right, that looks

7:00better. And actually, let me go ahead, and let me just cut you this over a

7:03little bit. So we can

7:04see over here in the provisioning template that we have a scroll over to the

7:07right. So we've got

7:08the change theme to eclipse provisioning template assigned to it because that

7:11was part of the blueprint.

7:13So now that we have 40 manager that's expecting this 60 F two with that serial

7:17number to show up

7:18the next video, we'll begin the low touch provisioning over at the 40 gate

7:22itself.

7:23So I'll see you in the next video in just a moment.

0:00So as far as our game plan goes we have configured Forda Manager to be aware of

0:04a new Fortigate that's

0:05going to be coming on board. We had some minimal templates we're going to push

0:08out to it initially.

0:10So now let's go to our 60F2. I've recently done a factory reset, so let's go in

0:15and just give it

0:16enough information so it knows how to reach Forda Manager. Which would be an

0:19example of a low touch

0:20provisioning. So the rest of the configuration, once this device checks in and

0:24registers with Forda

0:25Manager, the rest of the config we can do from Forda Manager itself, including

0:29using scripts,

0:30and anything else that's already associated to be run when that new Fortigate

0:33checks in.

0:34And here we go. So at the CLI I'm connected via the console. I did an execute

0:39factory reset,

0:40it rebooted, and now I'll go ahead and log in as admin. I'll press enter

0:43because there's no

0:44password by default. I'll specify a new password, then I'll confirm that

0:47password and away we go.

0:49So I'm going to use a copy paste option here for my minimal configuration on

0:53the

0:54Fortigate. Effectively I'm doing config, system, central dash management, set

0:58type forda manager,

0:59set the IP address for that forda manager, and also I'm specifying what the

1:03serial number is

1:04for that forda manager. So I'll go ahead and paste that in. And that's done. I

1:07'm also going

1:08to go ahead and put on some debugging here, so we can see the play by play as

1:13the forda manager

1:14interacts with this forda gate. So I'm going to right click here and paste in

1:19these commands,

1:20which are basically a debug of the forda manager communications. So it is the

1:25fact that this is

1:27showing up here means that we have communication actively going on between this

1:31forda gate and

1:32the forda manager. So I'm going to go ahead and minimize this and let's bring

1:36back forda manager.

1:37So here's forda manager. So currently here showing modified for the config

1:42status. I'm going to go

1:43ahead and do a refresh of this page. And so now it shows conflict, but in the

1:49background, it is

1:50still cranking away. It's forda manager and this new onboard device getting to

1:53know each other

1:55and sharing information, including pushing this provisioning template change

1:59theme to

2:00Eclipse. So it looks like it's done. It says synchronized. We didn't push out a

2:04policy package.

2:05That's why it's showing it's never installed. But if we were to go to 192.168.1

2:10.99, we should see

2:12the Eclipse thing being used on that device. So let's do that. Let's test that

2:16out real quick.

2:16So I'm going to go ahead and connect in. Now it's using its self sign

2:19certificate. I'll click on

2:20proceed. And so here just on the login screen is showing us that that's not the

2:24default j color scheme.

2:26It's the one that we specified as part of the onboarding of this new forda gate

2:30. So I just want

2:31to verify that the system template that we assigned was actually pushed. And

2:34this is visual confirmation

2:36of that. So we go back to forda manager. Here we have synchronized for the 60 F

2:392 and its IP addresses

2:41dot 99. And there's the template right there that changed that theme to Eclipse

2:45. Also, if we want to

2:46remove that, it's pretty easy to do as well. We just go to provisioning

2:49templates and we go to our

2:51system templates. And currently right here, the 60 F2 is associated with that

2:55provisioning template.

2:56So we can go ahead and click on the pencil there, just double click on it to

3:00remove it,

3:00click OK. And now that's not linked in or latched on to that forda gate anymore

3:05. However, the settings

3:06that it pushed, including the theme as part of that system template, if we go

3:09to the install wizard

3:11and we click on next, it's not going to try to push anything else. Not going to

3:13try to remove

3:14that system template theme change. So I'll click on cancel there. And let's go

3:18back to device and

3:19groups. So now that we've verified that we've onboarded the 60 F2 and it

3:22appears to be responding,

3:23we can right click there and do a refresh. And it's looking great. We'll click

3:27on finish.

3:27Also knows here because we removed the provisioning template from it that it's

3:30not showing here

3:31anymore. So in the next video, let's walk through some additional options we

3:35have regarding pushing

3:36configurations out to this newly onboarded device. So see you in the next video

3:40in just a moment.

0:00So, we've prepared forda manager to onboard the new 40gate, we also did the

0:05load touch

0:05provisioning on the 60F to effectively just tell the 40gate where forda manager

0:09was.

0:09Then the 60F2 was onboarded, one of the templates we pushed out was the system

0:13template with

0:14the theme change we verified that it took.

0:16And so, next, I'd like to walk through just using some scripts to do additional

0:20configuration

0:21on the 60F2.

0:22Now, when we are using scripts, we could also include these as part of the

0:26initial provisioning.

0:27But as I mentioned in the overview, it's often wise to do a little piece by

0:30piece until we

0:31know everything works and then we can put them all together.

0:34So, in this video, I'd like to demonstrate working with some scripts to make

0:37several

0:37changes to the 60F2, including changing the IP address from .99, where it

0:42currently is

0:43to .59 for the benefit of managing this firewall.

0:46So, back here in forda manager, as we take a look at our policy package status,

0:50we've

0:50got one there, if we click on the hyperlink, it'll take us over there, where we

0:54have a

0:55policy package never installed, I'll click on that for a filter, and this is

0:58our 60F2

0:59right there.

1:00And that's because we didn't assign a policy package when we onboarded it as

1:04part of the

1:05blueprint or part of the onboarding.

1:06And so, that's why it still shows us not having a policy package yet.

1:10But before we do a policy package, let's take care of a couple other little

1:12things I want

1:13to on this device.

1:14And there's a few ways that we could accomplish that.

1:16One way is we could go in and go to the device itself, there's a 60F2, go to

1:20network and

1:20interfaces and specify the details here manually, or we get excited by things

1:24by using some

1:25scripts.

1:26So, what I'd like to do is make some scripts.

1:28So, under device manager scripts, let's click on create new and select script

1:32from the

1:33dropdown.

1:34So, for the first script, I want to do some switch cleanup and also specify an

1:37IP address.

1:38So, on a 60F, the first five interfaces, internal 1, 2, 3, 4, and 5 are all

1:43locked in

1:44and associated with an internal switch logically called internal.

1:47And I want to remove all that because I want to use some of those interfaces

1:49for other

1:49purposes.

1:50So, we could have some comments here, which are a great idea for yourself.

1:53So, in the comments, let's say remove internal 1 through 4 from switch and

1:56assign IP address

1:57.59.

1:58And then the type of script, we have CLI, Arginja.

2:00So, if you are a programmer, I want to use a lot of variable things, there's

2:03other options

2:04besides just CLI.

2:05But I'm going to use the CLI script.

2:07And then, where do we want to run this?

2:08Do we want to run this script against the actual device database, which would

2:11then require

2:12us to push out the config to the Fortigate or do you want to go ahead and run

2:16it directly

2:17against the device via CLI?

2:19And that's what I want to do with all these.

2:21I want to run them directly against the CLI on that Fortigate.

2:24So, with that set, I'll then go ahead and take my script and paste it in here.

2:29So, I'll go ahead and do a control V to paste it in and let's take a look at

2:32the detail.

2:33So, effectively, this is going into the virtual switch, editing internal, and

2:37removing ports

2:381, 2, 3, 4 from that logical internal switch.

2:42Then I'm removing the IP address from the internal interface, the logical

2:46internal interface.

2:47And then I'm going to internal 1, that physical interface, and setting up the

2:50IP address of

2:51.59.

2:52I'm also allowing Ping, HTTP, HTTPS, SSH, and access by Forte Manager.

2:57So, to help us in making sure the script is correct, we can go ahead and select

3:02the platform

3:02that's going to be run on.

3:03So, this is going to be run on a 60F.

3:05So, I'll search for 60F, select it.

3:07And then, in just a moment here, I'll have the option for Validate show up.

3:11So, I'll click on Validate, and that will go through, and it says Script Val

3:14idate with

3:15no errors.

3:16So, I'll click right here on Format, and that will format it for us to make it

3:19just a tiny

3:20bit easier to read.

3:21So, we'll go ahead and click on OK, and now that's saved.

3:24So, we can now use that.

3:25In fact, let's run these as we create them.

3:27So, I'm going to right-click on this script.

3:29We'll go ahead and click on Run Script, and then I'll select the 60F2 to

3:33running it.

3:34So, currently, it's at .99, and that's going to change once the script is done.

3:37So, we'll click on Run Now, it's asking us to confirm, we'll click on OK, and

3:40now it's

3:41running the script.

3:42So, if there's an error with the script, it's going to report it right here.

3:45If it runs successfully, that's fantastic.

3:47That's what we're hoping for.

3:48But again, if there's a problem or an issue, the logs are going to give you

3:51information

3:52on what went wrong.

3:53So, we'll let that complete, and it's done.

3:55So, if we click on View Details, and then click on the log information here,

3:59here's

4:00what happened, and there was no errors.

4:02So, this is the same place we go, by the way, if there were errors, it could

4:04show us what

4:05went wrong.

4:06So, we'll close that, and close that, and now, if we go to Device and Groups,

4:10and we

4:10go to our 60F2, and go to Network Interfaces, these four interfaces are no

4:14longer associated

4:16with that logical internal switch, right here.

4:19Also, we look at internal one there, and scroll to the right there, it has the

4:22IP address

4:23of .59.

4:24Fantastic.

4:25So, let's continue on with our scripts.

4:26Again, these are building blocks that we could employ together for the initial

4:31deployment

4:31to a brand new 40gate.

4:33And to make the same scripts work with lots of devices, we would just

4:35incorporate the

4:36use of the metadata and the variables.

4:38For the next script, I'd like to go ahead and create VLAN interfaces, so if we

4:41go back

4:42to this firewall, so that a device in groups, 60F2, network interfaces, now

4:46currently, it

4:47has no VLAN interfaces, but what I want to do is create two of them.

4:51I want a VLAN interface, V23, and a VLAN interface, V130, connected to those

4:57respective

4:58VLANs, and then have the IP addresses of 23.1.2.59 for this one, and the IP

5:03address 10.130.0.59

5:06for this interface, I also want to enable DHCP services on this interface.

5:11So let's put a script in place that'll do that for us.

5:13So back here for the manager, we'll go back to scripts, and let's click on

5:16Create New,

5:17Script from the dropdown, and I'll just name this script VLAN interfaces.

5:21And in the comments, I'll put VLAN 23, VLAN 130, and DHCP.

5:25I want to be able to run this directly against the CLI of the device, and then

5:28I'll go ahead

5:29and paste in my script.

5:30So I'll go ahead and do a right click and a paste, and then I'm going to go

5:32ahead and

5:33choose the platform this is going to go on so I can do a test, 60F, and select

5:37that.

5:38And then in a moment here, I'll have the validate option, so I'll click on

5:41validate,

5:42and wow, where are my errors starting?

5:44So I'm starting right here, and it's because the config there is an uppercase.

5:47All right, let me go ahead and do a lowercase C, excuse me, and then let's go

5:50ahead and

5:51do a validate again, and that was it.

5:53So the initial config was uppercase C, it didn't like that.

5:56And this is the script checker here inside of for the manager.

6:00So on the physical device, if we're running a config with uppercase C, it may

6:03work, but

6:03here the validation checking, it didn't like the capital C.

6:06All right, so let's click on format here.

6:08So if we click on validate one more time, it validated with no errors.

6:11And just as a check here, we're creating this new logical interface, this VLAN

6:15interface.

6:16Here's the IP address, here's the VLAN it's associated with, we scroll down, we

6:20're then

6:21creating a VLAN 130 interface supporting VLAN 130, there's the IP address there

6:26.

6:26We're also on that VLAN 130 interface, enabling DHCP services in this section

6:30right here,

6:31with the range of dot 101 through dot 254.

6:35And I'm not sure I need this wireless controller with profile delete default,

6:39because I'm not

6:40using wireless at all on that device, but I'm going to leave it in there.

6:43All right, so the big part here is configuring two new VLAN interfaces and

6:47configuring a

6:48DHCP server.

6:49So click on okay, and let's run that as well.

6:51So there's our VLAN interface script, we'll right click run script, and we'll

6:55double click

6:55on 60F2, there it is right there, and the selected entries, and click on run

7:00now.

7:00So then we're going to go ahead and confirm, we'll click on okay, and away it

7:03goes.

7:03So if there's a problem or an issue, we'll simply look at the logs, clean it up

7:07the way

7:08we need to, and then run it again.

7:10So that's really a good idea to make sure that our scripts or any other

7:12components that

7:13we're pushing out, make sure the individual parts and pieces work.

7:16And also, if you're doing a bunch of scripts or a bunch of templates that you

7:19're pushing

7:20out all at once, make sure they all work together as well.

7:23So this script ran, so click on close, fantastic, and let's go back to device

7:27and groups, we're

7:28on our 60F2, and now it's got the two VLAN interfaces right there.

7:32And if we go into VLAN 130 there, that interface, and we scroll down, we also

7:37have DHCP services

7:38enabled, fantastic.

7:39So even though we ran that script directly on that device, because we ran it

7:43from four

7:43to manager, it automatically retrieved the updated information and synchronized

7:47it.

7:48So also just to help verify that the interfaces are correct in the right VLANs,

7:51let me right

7:51click, and go to remote access, and let's connect over to 60F2, login as admin,

7:57specify

7:58the password, click login, and, and, oops, I wonder if I bumbled the password

8:06twice when

8:07I initially set it up.

8:09So let's do this, let's reset the password using for to manager.

8:12So we'll go back to for to manager, and for the 60F2, we'll select it here, and

8:15then

8:15we'll go to system administrators, admin, double click on that, and let's reset

8:19the

8:19password, and I'll confirm the password, and then click on OK, and then we'll

8:22push it

8:23out with the install wizard, and next, and next, and install.

8:27If this works, I should be able to log back in to that Fortigate using the

8:30password I

8:31just set up for that Fortigate.

8:33All right, it's about done, survey says, it's a win, yay.

8:37All right, we'll click on finish, then we'll right click on the 60F2, and click

8:41on remote

8:41access, and now that I have a password that'll work, we should be able to log

8:44in locally.

8:45So we'll put in the username and the password, and click login, and I'm going

8:48to log in as

8:48read-only, that we don't accidentally make any changes, this is being managed

8:51by Fort

8:52manager.

8:53All right, it says unable to connect to Fortigate servers, that's because this

8:57bad boy does

8:58not yet have a default route, so that's a big part of the reason for that.

9:02So what I wanted to do is verify I can ping my service provider, and that's

9:04going to be

9:05at 23.1.2.1, oh fantastic, and also if we try to ping somewhere out on the

9:10internet, for

9:11example, ping out to 8.8.8 to 8, that's going to fail because we do not have a

9:17default route

9:17yet.

9:18So let's go back to Fort manager and continue our configuration.

9:21So let's create another script that will push out a default route, and again,

9:24there's lots

9:25of options, we have provisioning templates where we could include a static

9:29route.

9:29So a provisioning templates for static routes, for system templates, for BGP,

9:33IPsec, etc.,

9:34that we could also use an initial deployment of a Fortigate.

9:38So I didn't use these options as we deployed it, but we can do it right now by

9:41going to

9:41scripts, and let's create a new script, so we'll click on create new script.

9:45So I'm going to call this one static default route, and I want to apply this

9:47directly to

9:48the Fortigate as well, and then we'll go ahead and paste in my syntax there,

9:52config router

9:52static, edit one, set gateway 23.1.2.1, we just verified we could ping that,

9:57and use

9:57the egress route by the interface of v2360F-2, and that looks great.

10:02So we'll click on OK, and then I'll go ahead and push it out.

10:04So we'll right click on the static default route, click on run script, select

10:08the 60F2,

10:09and then click on run now, and then we'll click on OK, and while that's running

10:13, let's

10:13go back over here and do a ping again.

10:16So we still can't get there, I pressed enter, but now that it pushed out the

10:20default route,

10:21we know how our route out to the public internet, and we are now able to get

10:25there.

10:25So we do an execute tracer out to 8888, it's showing us now the path, and it's

10:30taking

10:30a little longer because it's trying to do reverse lookups for each hop in the

10:33path.

10:33Let's want to verify that we have reachability to the outside world, now that

10:37we have a default

10:37route.

10:38So back at Forte Manager, that script completed, we'll click on close, and

10:41again these are

10:42building blocks and examples of what we can use to automate the process of

10:45bringing up

10:46the device.

10:47So instead of having to do these manually, once we had perfected our scripts

10:50and we perfected

10:50our provisioning templates, we could collect them together inside of a

10:54blueprint and then

10:55push everything all at once out to a device.

10:58But again, because each device may have different interfaces or different zones

11:03, we'd also

11:03want to have the variable setup and the normalized interfaces so that our

11:07scripts and our provision

11:08templates can be used across multiple devices.

11:10So now that we've run some scripts to create our VLAN interfaces and also sign

11:14the correct

11:14IP address, and also to go ahead and set up a static default route.

11:18In the next video, I'd like to walk through configuring some policy on this

11:22firewall so

11:22that clients on the 10-130 network can get access to the public internet going

11:27through

11:27our newly deployed firewall too.

11:29So I'll see you in the next video for exactly that.

0:00So it's now our opportunity to push policy out to this device.

0:03Now, as part of the preparation for that new 60F,

0:07we also could have included the details regarding VLAN interfaces

0:12and the default route and the policy in one fell swoop,

0:15as we pushed out our configuration to this device.

0:18And the benefit of doing this in smaller parts,

0:20especially on a brand new deployment,

0:22is that we can test each and every part first before we have them all together

0:26being pushed out simultaneously, because there's a lot that can go wrong.

0:30So by testing these individually,

0:31we can make sure step by step that they are working.

0:34And if there's problems, we can troubleshoot them as we go.

0:36So let's focus on getting a policy implemented here on the 60F2.

0:40So currently here in Device Manager, if we go here,

0:43there's a one device that's been auto updated.

0:45If we click on that, it'll hyperlink us over to device

0:48and groups to the actual FortiGate here, 60F2.

0:51And if we click on Manage FortiGates, this is our FortiGate right there.

0:54So the policy package has never been installed because we never assigned one.

0:57So if we had a policy package that was all set up and perfect for that device,

1:02we could have pushed it out when that device came online and registered with FortiManager.

1:07So if we go over to policy and objects and policy packages,

1:11currently we don't have a perfect policy package that we could have assigned.

1:14That's one of the reasons I didn't.

1:15So we have a couple of options.

1:16One is we could create a brand new policy package here or find a policy package

1:20that is very close to what we need and copy it and then assign it.

1:24Or we could just import the existing

1:26policy package that the firewall has and then modify it.

1:30It doesn't really matter which way we do it at this point.

1:33So let's go back to device manager, device and groups.

1:36Here is our 60F2.

1:38I'm going to right click on it and I want

1:40to go ahead and import the configuration, which will pull in whatever it currently

1:44has as its policy package.

1:46So click on import configuration and import policy package.

1:49It has no AP profiles or force which

1:51templates, but I'll check that anyway just so that we can confirm that as we import.

1:55We'll click on next.

1:56It's going to create a policy package name called 60F2.

2:00It's going to put it in the root folder.

2:02It's going to import all policies.

2:04Here's the normalized interface names based on the type of platform it is.

2:07We're also adding mappings for all unused

2:09device interfaces as well by leaving that enabled.

2:11And we'll click on next.

2:12It's going to do some checks and then we'll go ahead and click on next.

2:16So it imported some policies and objects.

2:18We'll click on next and it has no access point or force which templates.

2:22So there's nothing to select there.

2:23We'll click on finish and boom.

2:25We now have that policy package that has now been imported.

2:28So currently here we have a policy package which has been imported.

2:32That's what we did right here on 60F2.

2:34And we also have that same device that did an auto update.

2:37So now if we go over to policy and objects

2:39and policy packages and we go to the correct policy package here for 60F2,

2:43here it is, we've had this from internal to WAN1.

2:48We don't need that. I'm going to right click and delete that.

2:50Now we have the implicit deny.

2:52Now it's funny because it says implicit deny, but there it is.

2:56Looks pretty explicit to me.

2:57Anyway, let's go ahead and create a firewall policy that we can use.

3:00Actually, before we start modifying it, let's go ahead to the install wizard

3:04and push out the change that we just made, removing that first rule.

3:08So we'll go ahead after the checks are done

3:10and click on install and then we'll create our own rule.

3:12So we'll click on install and away it goes.

3:14We'll let that finish in the background.

3:16So let's go ahead and create some rules here for 60F2.

3:20So we'll click on create new and create new rule.

3:23And let's call this in to out, meaning traffic coming in on its internal

3:28interface as the V130 and going out of the V23 interface.

3:32So we want to say accept or permit and the incoming interface.

3:36We'll go ahead and let's look for V130.

3:40And there I have one right there.

3:42That's the V130 60F2 as a mapped interface.

3:45We can go and check on that real quick.

3:47So that interface name right there maps to this right here.

3:49So we can go ahead and use that.

3:50That's why I confirmed the mapping was correct.

3:52So we'll go ahead and select that as the incoming interface.

3:55And then for the outgoing interface, let's go ahead and look for V23.

3:58And there that one is right there.

4:00So effectively, this rule may go ahead and check the previous install.

4:03Great. That completed.

4:04I'll click on finish and close that.

4:06So this is the traffic coming in on the V130 interface and being routed out

4:10of the V23 interface, go ahead and accept it.

4:13Then we can put the criteria here, including the source address,

4:15destination address, the layer four protocols and ports.

4:18And for the demo, I'm going to leave all

4:19this wide open and go ahead and click on OK.

4:22I'll add my change note and click on OK.

4:24So then we can go ahead and push this out

4:25with the install wizard and click on next.

4:27And if we want to install preview,

4:29it's not a bad idea just to confirm what's about to be pushed out.

4:32So we should have a brand new firewall

4:35rule that says into out traffic coming in on the V130 interface

4:40and going out of the V23 interface, go ahead and permit it.

4:44And there it is right there.

4:45It looks great.

4:45I'll close that and we'll click on install.

4:47And that looks like it is good to go.

4:49All right. Status OK.

4:51Click on finish.

4:52So now if we go back to device manager and take a look at 60F-2 right here,

4:56it should show that the device database is synchronized with what the FortiGate has

5:01there and also the policy packages shown right here is also synchronized.

5:05So our next step then is to go ahead and test this.

5:08And I propose we test it by putting a client right here

5:10on this 10.130.0 network in VLAN 130, make sure it gets an IP address

5:15and then make sure that device can actually get out to the public Internet

5:18using the rules that we set up here on the FortiGate.

5:21So we'll do our testing and troubleshooting in the next video.

5:24So I'll see you there in just a moment.

0:00For our testing as I mentioned in the previous video, let's put a client right

0:03here in v9-130,

0:04make it a DHCP client, and make sure that it can get out to the public internet

0:09. Because if it can,

0:09everything works, that means our configuration is good to go here on the 60F2.

0:13If not, if there's a

0:14problem, we'll troubleshoot it together. So here is a client that I just

0:20powered up. It's a DHCP

0:22client that should be on the 10-130 network, and let's just verify it got an IP

0:26address,

0:26and we can do that with the command on this Linux computer, the command iF

0:30config. So we'll open up

0:31a command prompt, we'll type in iFconfig, and sure enough, 10.130.0.101,

0:37fantastic. We know DHCP is

0:39working, let's do a ping out to, how about 8.8.8.8. All right, so a ping out to

0:48a resource like

0:488888 by IP address, and I know that's available because that's an anycast

0:52address for Google DNS

0:54servers, it's not working. And so the fact that it's not working means that we

0:58have some problem or

0:59issue with our 4-to-gate right here, which is preventing the client here from

1:03getting out. So,

1:04using 4-to-manager, let's begin our troubleshooting. We already verified that

1:08the client was able to

1:09get an IP address, we saw that on the client, so DHCP is working. Also, what we

1:14could do is just

1:15verify, and then do a control C here, let's verify that we can ping our default

1:19gateway. So our default

1:21gateway would be 10.130.0.59. We can verify that with a route, space dash, and

1:26which says don't bother

1:27doing name resolution. So there's our default gateway 10.130.59. So a ping to

1:3310.130.0.59. And

1:36sure enough, we can ping our default gateway. That's a good start. So something

1:41in the configuration

1:42of 60F2 is not correct, let's troubleshoot. So back to 4-to-manager we go, and

1:48what's the first

1:48thing we should take a look at. Well, we know that the 60F2 can ping the

1:53internet itself.

1:55We also know the client can ping the VLAN 130 interface. So let's take a look

1:58at our firewall

1:59policy. So we go to policy and objects, policy packages. We'll go to the one

2:03that 60F2 is using,

2:05so that's this policy right here. And there's our policy into out, let's take a

2:10closer look.

2:10So traffic coming in on this interface, and being routed out of this interface,

2:15regardless of source or destination IP address or protocol, please allow that

2:20to go. That's

2:20the acceptors right there. If we scroll down, it's flow-based, that's fine.

2:24This is a 60F,

2:26which has like around two gigs of RAM, so it really can't support proxy-based.

2:29So flow-based

2:30is no problem. If we scroll down, I'm using all the defaults here. And what are

2:35we missing?

2:36Oh, I know. How about this little thing right here? Going back to my discussion

2:40about troubleshooting

2:41next generation firewalls. It's often based on some issue with wrap. The R is

2:46for routing. We

2:47already have a default route, so we know the firewall itself can route out to

2:50the public internet.

2:51Permissions, as far as this firewall policy goes, are wide open, but we don't

2:56have address

2:57translation because this is currently not enabled. So let's enable address

3:01translation as part of

3:02this firewall policy rule. Another option is we could go back and configure

3:06this to be using

3:07centralized source net. And then we could create a separate source net policy.

3:11However, because we're

3:12using the net as part of the firewall rules, let's go ahead and simply enable

3:16net, take the defaults

3:17there and click on OK. So for our change note, we'll say enable net on the

3:21firewall policy rule,

3:22click on OK, and then we'll go ahead and push it out. So go to install wizard.

3:25There's our

3:26policy package name, 60F-2. Click on next. It'll do some checks. We can also go

3:31ahead and preview

3:32before we push out the change, which I think is a good idea occasionally, just

3:36to make sure

3:36that if we're pushing out incorrect information, we can be aware of that before

3:40we do the final

3:40install. So here's our preview of what's about to be pushed out. And sure

3:44enough, here it is.

3:46That net enabled. Okay. All right, so we'll click on close there and click on

3:50install. All right,

3:51so as that's being pushed out, let's go back to our client and our client here.

3:55If we do a ping

3:56out to 8888, this is going to be a continuous ping here. And now they're

4:00working because

4:01it just kicked in with the net. And the net was at least one of our missing

4:04pieces. So do a

4:06control C there. Fantastic. And let's open up a browser just as a final test.

4:10So open up a browser

4:12and let's go out to fast.com, which simulate which simulates Netflix traffic.

4:18Let's go to YouTube.

4:19Oh, it can't do it. Why is that? We can get to the internet. Let's go back to

4:25the command prompt

4:26here real quick and let's do a ping out to 8888. Yep, that's working. And let's

4:31do a ping out to

4:33www.fordnet.com and that all name resolutions failing. That's a bummer. We can

4:39fix it though.

4:40Let's also do an NS lookup, www.fordnet.com press center and sure enough, yeah,

4:45DNS is failing.

4:47So the way that this device is learning about its DNS servers is via DHCP. So

4:52let's go back

4:52to the configuration here for the 60F2. So back to device manager, device and

4:56groups. Let's grab

4:5860F2. And with it selected, let's go to network and the DHCP services are

5:03implemented on the VLAN

5:04interface. So we'll click on interfaces. There's our V130 interface. We'll

5:08double click on it and

5:09let's scroll down and take a look at the DHCP. So DHCP is enabled. And that's

5:13working. We're

5:14getting an IP address. Oh, look at this DNS server. Specify. And so we said

5:20same as system DNS. That

5:22would work or who had to specify a DNS server. Let's go ahead and do that. Let

5:25's put in a Google

5:26server of 8.8.8.8.8. And click on OK. And that we made that slight change. Let

5:31's go ahead

5:32and do the install wizard and do device settings only. Click on next. And once

5:36it does its checks,

5:37let's also do a preview of the install just to confirm it's going to the DNS

5:42server information.

5:43And there it is right there. Fantastic. So click on close and we'll click on

5:47install

5:48and let's bring back our client. So back at our client, let's set the up arrow

5:51key for an

5:52honest look up still failing. So we'll go ahead and give that a moment more.

5:56But once it finally

5:56gets pushed out. Oh, also, I might have to tell the client to re get the IP

6:00address via DHCP.

6:02So let's do that as well. So doing I have config to see the information. So

6:05this is the interface

6:07ENS 33 on this little VM. So I'm going to do a pseudo I have config for that

6:11interface. I'll go

6:12ahead and copy and paste that so I don't have a typo space and I'm going to say

6:17down. It's going

6:17to ask me for my password, which I'll put in. And then I'll go ahead and bring

6:21it back up with a

6:23pseudo I have config ENS 33 up. And that will renew the IP address as well as

6:29any new information

6:30regarding a DNS server. So now if we hit the up arrow key a few times, then it

6:33's look up for

6:34www.fordnet.com. Sure enough, we're now getting IPv4 information, a records and

6:40also quad a records

6:41regarding that URL. Fantastic. So now that we have corrected that problem, let

6:46's go back to our

6:46browser. I'll close the browser. Nice fresh start. Go ahead and open the

6:49browser again.

6:50And let's try going to fast.com. And that seems to be working. And let's test

6:56one other side as

6:56well. It's got a YouTube and that's working as well. Fantastic. So I go ahead

7:01and close that,

7:02minimize the client, click on finish there. And so as we push out devices, we

7:07have lots of tools

7:07that we can use. We can use provisioning templates, which includes static

7:10routes, system templates,

7:12IP sectanels and more. We could use scripts. And we could also go ahead and use

7:17blueprints.

7:17So to get to blueprints, again, use that little drop down next to add device

7:20blueprint. And then

7:22specify the details you want for a new onboarded device, including which

7:25templates to use and so

7:26forth. Apply that here. And then as we create the new device, for example, add

7:31device and add

7:32model device. And I'll call this one ZTP or LTP FGT 9, because with zero touch

7:37provisioning,

7:38it'll automatically find out where Ford manager is through cloud services, or

7:42its light touch

7:42provisioning. And then from here, we can put in the serial number for that new

7:46device,

7:46or if when he's a pre shared key, we can do that two, three, four, five, six,

7:49seven, eight, nine,

7:50just make sure you use that same pre shared key on the device that's being

7:53onboarded. And then

7:54we could choose that blueprint that we just created. So we say use device

7:57blueprint here,

7:58then select that blueprint. And hopefully that's the right blueprint that we

8:01want to use. And then

8:02we get edit the variable mappings as well as part of that to make sure we have

8:05variable mappings for

8:06any variables included in any of the scripts or the provisioning templates we

8:09're about to push out.

8:10And if we have a specific dashboard that we want to copy over and have for that

8:14device,

8:15we can grab a dashboard from one of our existing devices and use it there as

8:18well. So I'll go ahead

8:19and grab that dashboard that's being used here, click on next and then click on

8:22finish. And then

8:23we have this device right here with this crazy name ZTP or LTP FGT 9 and Ford

8:28manager is waiting

8:29for that device to show up and check in so it can push out the configuration

8:33and settings to that

8:34device. So because I don't have that FGT 9 coming in, I'm going to right click

8:38and say delete that.

8:40And okay. And now it's removed. And for the 48 that we did do, that was this 40

8:44gate right

8:45here, the 60 F dash two, which now has a configuration also has a policy

8:49package associated with it.

8:51And based on the testing that we just did from the client is able to

8:53successfully forward

8:54traffic from that client out to the internet and allow that client to get a

8:58response.

0:00As we wrap up this set of videos regarding zero and low touch provisioning for a FortiGate

0:04firewall, I'd like you to list the following. I'd like you to list the components that can

0:09be used at the FortiManager to automatically configure a FortiGate when it does come online

0:13and connects to the FortiManager. So take a moment right now, pause the video,

0:18think about the various options and components we can use to automatically configure a FortiGate

0:23that comes online. Then when you've had a chance to think about that and remember a few of the

0:26components, go ahead and click on resume and we'll discuss a few of those components together.

0:32And welcome back. So let's discuss a few of the components that we can use for deploying a

0:37FortiGate with a lot of automation. One of those is to use a blueprint. And that blueprint is going

0:41to be model specific. So you may have a blueprint, for example, for 60Fs. You may have a blueprint

0:46for 100Fs or other models that you're going to roll out. And as part of that blueprint,

0:50you can include a lot of details that you want to have set up for a new device. So in our example,

0:55we used a 60F for the blueprint. And one of those items that we can include as part of the blueprint

1:00is to specify a pre-run CLI template. And think of a pre-run CLI template as one time only. So it

1:07runs initially, and then it's no longer linked or associated like other provisioning templates

1:12with that firewall. But at the same time, you can have that pre-run CLI template run

1:16and anything you want to set, you can run as part of that CLI template. We can also,

1:19as part of the blueprint, associate any provisioning templates that we have created.

1:23And as far as provisioning templates go, we've had experience in previous videos

1:27with many of those, including IPsec Tunnel and BGP and system templates. In our demo,

1:33we used a system template that included changing the actual theme for the interface on the FortiGate.

1:39We also have static route templates, there are CLI templates, and more. So any of those that

1:44we have set up, we can associate with the blueprint, and then we can tie that blueprint

1:49to a new device that's going to be onboarded. So if we have a blueprint, the way we use that

1:52is we go into device manager, we click on add device, and then under add device, we choose the

1:57option of add model device. And as part of that configuration, we can refer to this blueprint

2:02that will pull in all these values that we have specified for the new device that we're adding.

2:05And as you add that new device, we're going to include the serial number of that device,

2:08or the other options to use a password. And if we enable auto-link for it, when that device comes up

2:14and registers with FortiManager, it'll automatically be authorized, and we won't have to go in

2:18separately and manually authorize it if we use that auto-link option. Another component we can

2:23use, in addition to CLI templates, is we could also use scripts. And we may have scripts for

2:28specific models, like for 60Fs, or for branch offices, and so forth. And that way, if we have

2:33our scripts set up, we can include those scripts as part of our deployment, and then use them over

2:37and over again. And one of the tools that lets us use a same script over and over again is the

2:41option of using metadata and variables. Another option that's going to help us use scripts

2:46across multiple devices is normalization. So we can have normalized interfaces and normalized

2:52zones. And that way, we can have a script that calls upon a normalized interface or a normalized

2:56zone. And then when the actual deployment comes down to that specific device, it'll use the

3:00variable there. And then when FortiManager is deploying it, if we're deploying it to

3:04firewall X, for example, and we have these values set up with per-device mappings,

3:08when it comes out to pushing that device, let's say it's device X, it'll use the per-device

3:12mappings for interfaces and zones associated with device X. Also, as part of adding our devices,

3:18there's an option for setting those variables right there. So you can go ahead and look at

3:21all the variables and then set those variables that you need to that are specific for this new

3:26FortiGate we're pushing out. And one other element, if we have a policy package that's perfect and

3:30ready to go for this device right here, we can also push out as part of the onboarding, we can

3:35also push out a policy package. And that policy package can be included as part of a blueprint,

3:40or we can actually include it as part when we do the add device. But just be aware, if we're

3:43pushing out a policy package and we haven't yet configured the interfaces or the zones or

3:49other dependencies that that policy package needs, it's going to fail. So we want to make sure that

3:53when we're pushing our configurations out, that we are doing it in the correct order. Because it's

3:57hard, for example, to set up a static default route with an egress interface of VLAN 23,

4:03if we don't yet have the interface VLAN 23 set and configured on that device. And the most direct

4:08way of finding out what those orders are, making sure they all work is to do individual pieces,

4:12step-by-step in a test environment, making sure that for a certain platform, you have all the

4:16pieces you need. And then once it's perfect, quote unquote, you can then set up your variables and

4:20start pushing everything out at once to new FortiGates as they come online. So thanks for

4:25joining me in this set of videos regarding automating the process of deploying a new FortiGate.

4:29And I look forward to seeing you, my friend, in another set of videos very, very soon. Until then,

4:34I hope this has been informative and I'd like to thank you for viewing.