Understanding FortiADC and Initial Configuration

0:01(thoughtful music)

0:07<v ->Hello and welcome.</v>

0:09My name is Keith Barker, and in this set of videos,

0:11you and I are going to focus our attention

0:13on two basic things.

0:14Number one is,

0:15what the heck is an application delivery controller?

0:18And more specifically,

0:19the offering from Fortinet called FortiADC,

0:22application delivery controller.

0:23And then secondly, we're going to take a look

0:25in this set of videos at how to deploy and do the initial,

0:28like the initial bootstrap configuration

0:30of placing this appliance in our network.

0:32So I'll see you, my friend, in the next video,

0:34we'll take a big picture look at the concepts of an ADC.

0:37I'll see you there in just a minute.

0:00(bright music)

0:07<v ->In this video, you and I are gonna take a high level look</v>

0:09at the concepts behind an application delivery controller

0:12or ADC and the offering from Fortinet called FortiADC.

0:16So let's begin with the acronym for ADC,

0:18and that is application delivery controller.

0:22And the product that does this from Fortinet

0:24is referred to as the FortiADC.

0:27And so to really appreciate

0:28an application delivery controller,

0:29let's imagine this cloud over here represents the internet/

0:31And our access to the internet

0:33is very likely through a router from a service provider,

0:36and our access to that service provider

0:37may be through DSL or ethernet or coax.

0:42And so our connectivity

0:42that comes from that service provider

0:44would very likely go at some point to a firewall.

0:46In the case of Fortinet, that'd be the FortiGate firewall.

0:49And then behind that firewall,

0:50we could have a demilitarized zone

0:52with public facing servers.

0:53We could have our internal users and their networks.

0:56So represent those as represent the network for our servers

0:59that are public facing, like DNS and web services.

1:02And this can represent our internal users

1:05and their networks.

1:06So I'll refer to this part right here as the DMZ

1:08and this orange part as our internal network.

1:11Then I'll put some hosts there as well.

1:13And again, this could represent multiple subnets

1:15and multiple computers on those subnets

1:17and that appear in the DMZ.

1:19We could have our servers.

1:21And just for fun, let's go ahead

1:22and put three servers up there.

1:24We'll put one that's a red server

1:26and we'll put a green server and a blue server,

1:29or server one and server two and server three.

1:33So if we have a customer out on the internet,

1:35I'll just call this guy a client,

1:37that needs to access one of those web servers,

1:39what the user at that computer would do or could do

1:41is put in a URL like www.thissite.com,

1:45which gets translated through DNS to an IP address.

1:49So that's the fully qualified domain name.

1:52So the client does a DNS lookup,

1:53finds out what the IP address is,

1:55and then makes their request

1:56to the IP address of the server.

1:58Now, if the client makes a request to the server,

2:00it's gonna go to server one or server two or server three

2:03based on the IP address it was going to.

2:04Now in DNS, there are some games

2:06that we can play there as well

2:07to help even the load across these three servers.

2:10One of those options is to round robin the responses.

2:12So let's imagine we have server one's address

2:15and server two's address and server three address in DNS

2:18that all mapped to the same exact name,

2:20say www.example.com.

2:24So if multiple clients

2:25are trying to access resolve www.example.com.

2:28DNS could respond with the first IP address

2:31and then next with the second IP address,

2:32and then to the third client, the third IP address

2:34in a round robin type of fashion.

2:36And that could help to sort of load balance the requests,

2:40assuming the content on these servers

2:42is all the same across the servers,

2:43and that we don't have one server like 90% utilization

2:46and the other two with the exact same content,

2:49for example, at like five or 10% utilization.

2:51However, there's a lot of caching that goes on in DNS.

2:54That's not a perfect scenario.

2:56So another option to help distribute the load

2:57across these servers would to go ahead

2:59and use something called an LB,

3:01which is an acronym for load balancer.

3:04And the most typical type of a load balancer

3:05is a layer for load balancer.

3:08So if we use a load balancer, here's how it would change.

3:11We would remove this link between the FortiGate

3:13or the firewall and the servers

3:15and we would insert an appliance.

3:17And that device would be either a load balancer

3:19or a more intelligent device

3:20called an application delivery controller,

3:23which is like a load balancer,

3:24but also has the ability to make intelligent

3:26and more intelligent decisions about forwarding traffic

3:29to a specific server based on a set of conditions.

3:32So the firewall would connect

3:33to this load balancer/application delivery controller,

3:36which would then connect to this network

3:37where the servers are.

3:39And then in DNS,

3:40instead of having three different IP addresses,

3:42we can have one IP address

3:43and that one IP address is being managed or mapped

3:45here at the application delivery controller.

3:48There's also some options we can play with

3:50at the firewall here regarding source and destination app.

3:53We'll take a closer look at that

3:54in our other sets of videos.

3:56But the basic concept

3:57regarding a load balancer/application delivery controller

3:59is that when users now resolve example.com to an IP address,

4:03they go to that specific IP address

4:04and that IP address lands them right here

4:07at the load balancer/application delivery controller.

4:10And then depending on what type of device this is,

4:12whether it's a simple load balancer

4:13or it's a more advanced application delivery controller,

4:16this device is then gonna forward traffic to the servers

4:19based on a set of rules and policies.

4:21So at this point you might be thinking,

4:22well, a load balancer/application delivery controller

4:25sound pretty similar.

4:26So let's just detail for a moment a few of the differences.

4:29With a load balancer, and I'll go ahead

4:30and just write the acronym here, LB,

4:32most of the time it's implemented

4:34as a layer four device looking at TCP or UDP

4:36or the layer four protocol that's in used

4:38and tracking and matching based on that.

4:40And one of the challenges

4:41with a traditional layer four load balancer

4:43is that it doesn't have visibility.

4:45It doesn't know, or care I should say

4:48about what's being carried in the actual payload.

4:50I mean, is it SSH traffic?

4:51Is it SSL/TLS traffic?

4:53Is it some kind of file transfer protocol?

4:56Is it streaming traffic?

4:57What is it?

4:57A basic layer for load balancer

4:59really isn't paying attention

5:00to any of the application layer service

5:02and as a result, it can't make decisions

5:04based on what type of application's being used.

5:06For example, HTTPS versus RDP, Remote Desktop Protocol.

5:11Another characteristic of a traditional

5:13layer four load balancer

5:15is that it can do some basic health checks.

5:17And here's what I mean by that.

5:18Assuming we have these three servers here,

5:20if one of these servers is not up,

5:22we probably don't wanna take the client's request coming in

5:25and forward that request to a server

5:27that isn't up and running.

5:28So a basic health check would be like a ping request

5:31or something very basic that the load balancer

5:33can send back and forth between it

5:35and each of the servers periodically

5:36just to verify that they're up and reachable.

5:39So basic health check, I'll finish that thought there.

5:42Another basic functional load balancer can do

5:44is that if we have a client that has made a request

5:47to example.com

5:48and the load balancer forward that request to server one,

5:52there's a concept called persistence.

5:54And the concept of persistence is pretty important

5:56because if we a user that's gone to www.example.com,

6:00that traffic was forwarded to the load balancer,

6:03the load balancer decided that server one

6:05based on the conditions that were in place,

6:07should be the server that gets the request.

6:08If the client is interacting with server one,

6:11we don't all of a sudden just outta blue,

6:13wanna have the load balancer on a next few packets,

6:16send those to server two or server three,

6:18because server two or server three may not have any clue

6:21about what was going on between the client and server one.

6:23So with persistence with a traditional load balancer,

6:26that persistence is gonna be based

6:27on the source IP address of the client coming in.

6:29So if this client's coming in from 24.9.8.17

6:35and it was sent to server one,

6:36subsequent packets that are coming in

6:38would also be forwarded to that same server

6:40and the load balancer's tracking

6:41based on that source IP address.

6:43So I'm gonna call that basic persistence based on IP.

6:47So in a brand new client, it connects to www example.com

6:51and comes up to the load balancer.

6:53As far as which server is gonna be chosen

6:55by that load balancer, there are some basic algorithms.

6:58It can be used like how busy is each server

7:00and maybe we forwards the traffic

7:02to the least busy server at that moment.

7:04But those algorithms that are deciding on which server,

7:06they're pretty basic as well.

7:08So now lemme go ahead and draw a line right here

7:10and let's talk about an ADC and what it can do.

7:13So effectively, an application delivery controller

7:16can do everything the load balancer can do,

7:18but a whole bunch more.

7:20I have a plus symbol here because everything here

7:22is gonna be what the load balancer can do

7:24and these additional features.

7:25It can also do application layer inspection

7:28and be aware of the application.

7:29So if we have a client coming in

7:32and they're using a specific application like HTTPS

7:36and we have a specific server or groups of servers

7:38that we wanna handle that specific type of application,

7:41the application delivery controller can steer

7:43and direct that traffic to the appropriate server

7:47and not just randomly pick a server based on availability.

7:50With the FortiADC, it also has the option

7:52of doing the application delivery controller

7:55based on layer two information as well.

7:57And again, these are in addition

7:58to what a traditional load balancer can do.

8:00So the ADC can do layer seven,

8:02layer two, as well as layer four.

8:04The application delivery controller

8:06also has a security component built into it

8:08to help protect against things like viruses and malware

8:12or malformed requests that are trying to reach the servers.

8:15Those can be stopped at the ADC.

8:17And because the ADC has visibility

8:19into what's happening at the application layer,

8:21they can do content based routing

8:22or forwarding to a specific server

8:25based on the type of content.

8:26So we could have two different clients,

8:28they're both going to example.com, and the ADC,

8:31depending on the type of request that was being made,

8:34the ADC could then forward it to one of the servers

8:36or one of the groups of servers that's managing

8:38and working with based on the application that's being used.

8:42Another addition would be advanced health checks.

8:45And here's an example, a traditional load balancer

8:46could send a ping message like every few seconds

8:49just to verify the server responds.

8:51But that doesn't really mean

8:52that the actual web service is running,

8:54even if it can respond to a ping.

8:56So an advanced health check could do something

8:57like connect and make an HTTP request or an HTTPS request

9:02and verify there's a proper response,

9:03or it could do an FTP request,

9:05look for a certain file and be very granular

9:08to verify that the servers not only reachable,

9:10that it also is functioning.

9:12Enable to provide the network services that are intended

9:14before forwarding a client over to it.

9:16So if a server goes belly up

9:18or has a problem or isn't responding,

9:20or a process dies that's supporting the web services,

9:23the application delivery controller could sense that

9:25based on the advanced health checks and say,

9:27"You know what, until you're better,

9:28I'm not gonna forward any new request to you."

9:30And then we can look into why that server isn't running

9:32or what's the problem.

9:33But meanwhile, we're still providing the content

9:36from the other remaining servers.

9:37Another feature on the application delivery controller

9:40is something called SSL offload.

9:42'Cause in the past,

9:43when a client is connecting with the server,

9:45that whole SSL/TLS set up and negotiation

9:49and the encryption decryption

9:50has to be done by the client at this end

9:52and the server at this end.

9:54But with SSL offload,

9:55we can have our application delivery controller

9:58actually terminate the SSL/TLS session,

10:00perform the actual CPU cycles for that process,

10:03And then it can go ahead and interact with the server

10:05on the back end here in the private data center

10:07using something like HTTP.

10:09And that way we're offloading the SSL/TLS work

10:13from the actual server itself

10:14so it can focus on the application and not the SSL/TLS.

10:17Now, a word of caution there too

10:19is that if we're implementing

10:20the application delivery controller on software as a VM,

10:24we'd wanna make sure we properly size that

10:26and make sure it has enough CPU and oomph

10:28to go ahead and pull that off.

10:29If it's a dedicated hardware appliance,

10:31we'd wanna make sure that we have the hardware model

10:34that's gonna support the volume of traffic we expect

10:37if we're use the SSL offload feature.

10:39So let me clean up a little space here

10:41and let's talk about a few basic options

10:43for actually deploying the ADC.

10:46All right, I'm almost cleaned up here.

10:48Let me clean up a little bit more.

10:49So our options for deploying this appliance,

10:51this application delivery controller from Fortinet,

10:54involves either hardware,

10:56a physical appliance that we'd place in our network,

10:58or we could do it with software as a virtual machine.

11:02And if we have servers that are in the cloud,

11:04we also have several cloud options as well.

11:07So if we're implementing the FortiADC

11:09locally on-prem as a VM,

11:11one of our options is VMware's hypervisor, which is ESXI.

11:16Or we could use Citrix or Microsoft's HyperV or KVM.

11:21And if we're implementing it locally on-prem,

11:23it's often best to have a bare metal or type one hypervisor

11:27to get the most CP resources available

11:29for the application delivery controller.

11:31If we're implementing the FortiADC in the cloud,

11:33there's support for AWS and Azure

11:36and Google Cloud and others.

11:39In environments that we can't afford downtime,

11:41there's also support for high availability.

11:43So we could have our ADC number one and ADC number two

11:47and then link them together,

11:48so if one fails, the other one can keep on going.

11:51And the most traditional way

11:52of implementing this application delivery controller,

11:54whether it's hardware or software, on-prem,

11:57is in a mode called routed mode.

11:59So an example of that, we would have one subnet here,

12:01for example, let's say it's the 10.10 network,

12:04and then another network over here, the 10.20 network,

12:07and maybe our application delivery controller

12:09has the IP address of .73,

12:11and we simply train all of our servers

12:12that their default gateway is .73.

12:15And that way when our client

12:16is trying to access our network resources over here,

12:19that traffic goes to the ADC,

12:21then the ADC can forward it to the appropriate server

12:23based on the rules and policies

12:24and the content that's being requested.

12:27And then whichever server gets that request,

12:28when it forwards the response,

12:30that also is going through the ADC,

12:32which can then be forwarded back to the client.

12:34And as we finish up this overview of the basic concepts

12:36of the logic behind a FortiADC

12:39and how it fits in the network,

12:40I also wanna point out the concept of a virtual server.

12:43And that virtual server is being supported

12:45and maintained here on the ADC,

12:46and that virtual server is gonna have an IP address.

12:49So when the customer is going to www.example.com,

12:53that can resolve to the IP address of the virtual server,

12:57which would cause the traffic

12:58then to be forwarded over the internet

13:00to the application delivery controller.

13:02And then the ADC can forward it to one of the real servers.

13:05So I'm gonna put over here real servers.

13:08And as far as the actual IP dressing goes,

13:10do these have to be private or public?

13:12We have lots of games that we can play

13:14both here at the application delivery controller

13:16and also at the firewall that's between

13:18the application delivery controller and the internet.

13:21And so as we proceed through other sets of videos together,

13:24on the same topic,

13:25we'll cover more details about that as well.

13:28In this video, we've taken a big picture look at the concept

13:30of an application delivery controller.

13:32Now, prior to putting one in the network

13:35and doing the basic installation,

13:36we probably should have a plan in place.

13:38So in the next video,

13:39let's put a basic plan regarding a topology

13:42where we're gonna put the application delivery controller,

13:44and then I'll walk you through in the subsequent videos

13:46and it set the basic configurations

13:48at the CLI and at the GUI

13:50that can put that application delivery controller

13:52in the network and provide basic connectivity as a framework

13:56for building on top of that and putting the ADC to use.

13:59So I'll see you in the next video for exactly that.

14:01Until then, I hope this has been informative

14:03and I'd like to thank you for viewing.

0:00(upbeat bright music)

0:07<v ->Many years ago, back in the nineties, in fact,</v>

0:09I worked at Paramount Pictures, had a great time there.

0:11And one of the jokes that was on the,

0:12it was a little cartoon on the wall,

0:14and it had a bunch of programmers

0:16and one of them said, "Hey, you guys start coding

0:18and I'll go find out what they want."

0:20We should have a plan in place

0:21before we start creating something.

0:24So prior to deploying this FortiADC

0:26in a network environment,

0:28let's go ahead and draw out a plan regarding IP addresses,

0:30where it's gonna go in the network,

0:32and then based on that plan, in the remaining videos,

0:34I'll walk you through step by step,

0:35the basic deployment of a FortiADC on a network.

0:39And one of the secrets behind a good recipe, for example,

0:41like for food, is having all the proper ingredients.

0:44So we also wanna make sure we're gonna take a minute here

0:46and make a list of those things

0:48we're gonna need to make this happen.

0:49So I'll label this as recipe.

0:51So first and foremost, I'm gonna be using the VM version

0:55of the FortiADC,

0:56and so the platform I'm gonna run that on is ESXi,

1:00and that is from VMware.

1:01So I currently have a few servers behind me

1:04and they're good to go.

1:05They're running ESXi version 7.x.

1:08So that'll be the type one hypervisor

1:10that'll be supporting our FortiADC VM.

1:14We'll also need the image,

1:15which we'll need to download from Fortinet.

1:18And one of the cool things is with the FortiADC,

1:20when you download the image for that

1:22and deploy it in an ESXi environment,

1:23they give you 15 days with all the bell,

1:26well with most of the bells and whistles.

1:27Not all of them, but most of the bells and whistles.

1:29So you can go ahead and practice and work with it,

1:32which is fantastic.

1:33And then within ESXi, I've also got carved out,

1:36I've got a VLAN number 10 that we can use.

1:40And also a VLAN number 20.

1:43And the way you carve out the VLANs on the hypervisor,

1:45it varies a little bit

1:46based on the hypervisor that you're using.

1:48And so if you have more interest in ESXi and VMware

1:51and vSphere, please feel free to check out

1:53our other courses here at CBT Nuggets

1:56on VMware's vSphere.

1:58But for now, I just wanna make a note

1:59that I have those available

2:00and ready to go in my ESXI virtualized network environment.

2:04All right, so let's draw our topology

2:06and I'm gonna go ahead and put the internet right here.

2:09There it is. I know. I thought it was bigger too.

2:12And then we're gonna have a service provider router here.

2:14I'll put R there,

2:15I'll put SP for service provider.

2:18And for my network topology,

2:19this is going to be the 23.1.2.0 network

2:24with a 24 bit mask.

2:25And truth be told,

2:27that 23.1.2 address space is not, (laughing)

2:29it's not mine, I just have it set up in my network.

2:31And then here, at this little router,

2:33which is emulating the service provider router,

2:35it actually has NAT a few times between it

2:37and the real internet for that connectivity.

2:39But for the purposes of our implementation,

2:42we'll just presume this is a reachable workable 23.1.2

2:45address space that is reachable over the internet.

2:48And with the help of a little NAT and PAT, it is.

2:50And then here I've got a little firewall.

2:52It is firewall one and it is a FortiGate.

2:56This firewall has an IP address .71 on all its interfaces.

3:00Our next device in line is going to be the FortiADC,

3:04and I'm gonna use the .73 address on all of its interfaces.

3:08And then for the network between the firewall,

3:09the FortiGate and the FortiADC, as far as our plan goes,

3:13let's go ahead and use VLAN 10 right here.

3:16So that's VLAN 10,

3:18which we'll go ahead and map that

3:19to the 10.10.0.0 address space with a 24 minute mask.

3:24And so this firewall on that interface

3:25and that VLAN is gonna be a .71

3:28and the FortiADC is gonna be a .73.

3:30And if we wanna set up high availability,

3:32I'll go ahead and simply put a little shadow here

3:34of a second FortiADC,

3:36and that could be like for example,

3:37.74 or some other available address.

3:39And then we can set them up as a HA pair.

3:41And that way if one of the FortiADCs has an issue

3:43or problem, the other could take over.

3:45So that little shadow represents a second FortiADC,

3:48in the event we wanna implement high availability.

3:50And then going to our actual servers,

3:52we're gonna go ahead and let's use the network of VLAN 20.

3:56And for our lab,

3:57I'm gonna go ahead and use the address space of 10.20.0.0,

4:01where the second octet here matches the VLAN number,

4:04just to clarify where stuff is.

4:06So this would be our network,

4:08where we could have our public facing servers.

4:10So let's put server one and server two and server three.

4:15So I'll label this up here as servers one and two and three.

4:20And they're all connected or will be logically

4:22once I have it all set up,

4:23they'll be all connected to this VLAN 20,

4:26which is the 10.20.0.0 network

4:28and the mask on that'll be a /24.

4:31And for IP addressing here, just for clarity,

4:33let's go ahead and label it here

4:34with .1, .2 and .3

4:37And so the default gateway for these three devices

4:40would be .73 on the 10.20.0 network.

4:43Now also, while we're putting this plan together,

4:45let's also plan on which ports

4:47to go ahead and use over here on the FortiADC.

4:50So I'm gonna remove the little shadow here for the HA.

4:53And for the interface facing towards the firewall,

4:55let's go ahead and use port number one.

4:58And for the interface on the FortiADC

5:00that's facing the actual real servers,

5:01let's use port number two.

5:03And that also brings me to the question

5:05of which interface do I wanna use for managing that device?

5:08And let's use port number 10.

5:11So the VM has 10 logical interfaces by default.

5:15So let's go ahead and use port number 10

5:17as the management interface.

5:18So I'll draw this down here

5:19and just put a little note that this is management.

5:22And then management network is 192.168.1.0

5:27with a 24 bit mask.

5:28And so this device here on this port 10

5:31would be .73 once we have it initially bootstrapped.

5:34So the management computer

5:35I'm gonna be sitting from is on this management network

5:37and that way I can get to and work with the FortiADC.

5:40I also can manage this FortiGate firewall,

5:42also from that same management network.

5:44So it also has a interface

5:46on the management network as well.

5:48So I'll put that right here.

5:49And the beautiful thing is that

5:50whether we're using physical appliances

5:52or virtual machines for either the FortiADC

5:55or the FortiGate, the logic is the same.

5:57So in my lab environment,

5:59this FortiGate is actually a physical firewall

6:01that's connected as shown here.

6:03And the FortiADC that we're gonna deploy here

6:06in a moment together,

6:07is going to be the virtual machine

6:09that we're gonna download from Fortinet.

6:11So I'm gonna take a screenshot of this

6:13so that we can refer back to it

6:15as we put all these components together.

6:17And if we look at our laundry list,

6:18I've got the ESXi host sitting behind me ready to go.

6:21And what we need is the image for the actual FortiADC.

6:24So in the next video, let's do this.

6:26In the next video, let me walk you through

6:28logging on to Fortinet's website

6:30and downloading from Fortinet the eval image

6:33that we can use to deploy in our sample network right here.

6:36So I'll see you in the next video for exactly that.

6:39Until then, I hope this has been informative

6:41and I'd like to thank you for viewing.

0:01(gentle music)

0:07<v Keith>One of the core pieces</v>

0:08that we identified in the previous video

0:09was that if we want to deploy the FortiADC VM

0:13we have to have the image.

0:14So in this video, I'd like to walk you through

0:16obtaining that image from Fortinet.

0:19So let me go ahead and bring in a browser

0:21and we'll go to support.fortinet.com.

0:24And here we are at support.fortinet.com.

0:27And I'm gonna go ahead and log in.

0:30So I'll click here on Login.

0:31So I supplied my username and password.

0:33I've now logged in at support.fortinet.com.

0:37And to get the VM image for FortiADC,

0:40we'd click right here on Support.

0:42And from the dropdown menu here,

0:44we'd go to VM Images right here.

0:46So we'll click on VM Images.

0:48Over here on the left, it's asking us to select our product.

0:51So we wanna select the FortiADC.

0:53And then I'm gonna select the platform.

0:55So I'm gonna deploy this on VMWare's ESXI.

0:58So I'll choose that from that dropdown on the platform,

1:00VMWare ESXI.

1:02And then I want to download the latest version.

1:04And as of right now, it is this version right here, 7.1.

1:08So with that selected, over here on the right,

1:10I have a couple of options.

1:11Now, this first one here, the FORTINET.out,

1:14that is if we want to upgrade, for example,

1:16the firmware from one version to another,

1:18but for a brand new deployment on a VMWare platform,

1:21we want the one that has OVF in the title.

1:24So here's FORTINET.out.ovf.zip,

1:27and that's the one we want.

1:29So I'm gonna go ahead and click on Download right here.

1:31And as we speak, it's now downloading to my,

1:33in my case, to my Downloads folder.

1:35And we'll take a look at that once it's done.

1:37All right, the download is complete. Didn't take long.

1:39Let's go take a look at that folder.

1:41So I'll right-click, it'll say, please Show in Folder.

1:44And here is that folder, my Downloads folder.

1:47And I'm just gonna go ahead and unzip it right here.

1:50So I'll right-click and, from the dropdown,

1:52click right here on Extract All.

1:54It's gonna create a new folder, the same name as the zip,

1:56and then put all the extracted files in that folder.

1:59I'll click on Extract and it is done.

2:01So there's my downloads folder,

2:03there's the new folder just built.

2:05Here's this additional folder under that, we'll open it up.

2:07And then I've got two VMDKs, those are hard disk files,

2:10and I have three OVFs

2:11and those are four various versions of the hardware.

2:13So in a VMWare environment,

2:15a larger number after the letters HW

2:18implies a newer or more current version

2:21of virtualized hardware.

2:22So I'm gonna go ahead and we're gonna deploy hw13

2:25from this file along with the two disks.

2:28So now that we've downloaded the FortiADC VMWare files,

2:32our next step is to go ahead and deploy it.

2:34And that's exactly what we'll do in the next video.

2:36So I'll see you there in just a moment.

2:38Until then, I hope this has been informative

2:40and I'd like to thank you for viewing.

0:00(inspiring uplifting music)

0:07<v ->In the previous video,</v>

0:08we took a road trip up to fortinet.com,

0:10and we downloaded the 40 ADC image,

0:13and it's now, in this video,

0:14that we're gonna deploy that as a brand new VM

0:17in VMware's ESXI.

0:18So just as a quick reminder, mostly to myself,

0:20of where ports are gonna go on this brand new FortiADC

0:24that we're about to deploy.

0:25Port number one we're gonna place in VLAN 10,

0:28port number two, we're gonna place in VLAN 20

0:31in my ESXI environment, and port number 10,

0:34I'm gonna place in my management network.

0:36So we could make those changes after the fact,

0:38after we deploy it, but if we do it while we're deploying

0:41it, they'll already be in the right places.

0:43So let's go to the console for the ESXI for the hypervisor,

0:46and let's do the implementation

0:48of this 40 ADC virtual machine.

0:50Alright, so this is the console

0:52for managing an individual ESXI host.

0:55Another option would be

0:56to use the vCenter server if we're managing multiple hosts,

1:00but in either case, the logic is the same.

1:02We're gonna deploy a brand new VM.

1:04So I'm gonna go down here to virtual machines,

1:06and take a look at currently what's powered on.

1:09Fantastic, and let's go ahead

1:10and click here on create/register a VM.

1:13Then it's asking me how I'd like to do it.

1:16And since we have the format,

1:17OVF is the Open Virtualization Format, since

1:19that's the format that Fortinet provided for us,

1:22it's gonna be super easy.

1:24We'll simply select that, deploy a virtual machine from,

1:26an OVF Open Virtualization Format, and then click on Next.

1:29And it's asking what do we wanna call this?

1:31And this is the name, it's just gonna be recognized

1:33as in ESXI.

1:35So I'm gonna call it 40, ADC, and dash one.

1:39Then I can click here to go ahead

1:41and find those files, or I could drag and drop 'em.

1:43In fact, lemme just go ahead and click here.

1:45And that brings up this little explorer window.

1:46So I'm gonna go ahead and select Hardware 13 for the OVF.

1:51And then with my Control key,

1:53press down on my Windows computer,

1:54I'm gonna grab this first disk

1:56and the second disk, so all three are selected,

1:58and click on Open.

1:59So basically it's gonna create

2:00this brand new virtual machine

2:02from these two hard disk files,

2:03and the configuration file here in this OVF.

2:06And then we can just click on Next to continue.

2:08Next it's asking about what disk space do we want to use?

2:11And so I've got some network attached storage here,

2:14and it looks like I have some additional local storage

2:17I'm gonna use; oh look at this.

2:20I've got almost a terabyte right there and it is SSD.

2:23So I'm gonna go ahead and use that plenty of space there,

2:26and click on Next.

2:28I'm going to agree to the license agreement.

2:30Click on Next, and now

2:31is where I'm gonna specify the network mapping.

2:33So based on our plan, port number one,

2:36lemme take a look at our plan real quick.

2:38I need to confirm.

2:39So port number one will be VLAN 10,

2:41port number two, VLAN 20,

2:43and port 10 will be my management network.

2:45Alright, got it.

2:46So currently, VM Network 10 is already there,

2:49so that's fantastic,

2:50and I'm gonna put the others in a parking lot.

2:53Effectively it goes nowhere

2:54just to make sure they're not accidentally being used.

2:57So parking lot is a port group here on my ESXI host

3:00that effectively has no interfaces going anywhere else.

3:02Alright, and then for port number one, I want that

3:05to be in VLAN 10

3:07and port number two, I want it to be in VLAN 20,

3:11which is right here.

3:12So in the VMware environment, these are just names

3:14for port groups that are associated

3:17with those respective VLANs.

3:18The actual IP dresses won't become a real thing

3:20until we actually configure IP dresses

3:22on the interfaces on this VM.

3:24All right, then for disk provisioning, I'm gonna go ahead

3:26and leave it as thin.

3:27That way it only ties up

3:29as much physical resources on the disk, on the host,

3:32that it is actually using.

3:33So if it creates this huge hard drive,

3:35it won't really take up all

3:37that space if it's not using all that space.

3:39And then I'm gonna have it power on automatically.

3:41I'll click on Next.

3:42It's asking me to confirm

3:45and that looks good, and I'll click on Finish.

3:47Alright, it is off to the races

3:49and right there is our bad boy, 40 ADC-1,

3:53so it's powering up.

3:54It may take just a few moments to fully initialize,

3:57and it looks like it is done.

3:59I got a little thumbnail here

4:00of what the screen looks like for that bad boy.

4:02And this puts us in perfect position for our very next step.

4:05And that is to take a look at the first contact

4:08with this device at either the CLI or the GUI.

4:11So let's start with the command line interface, the CLI,

4:14and we'll do that in the very next video.

4:16So I'll see you there in just a moment.

4:18Until then, I hope this has been informative

4:20and I'd like to thank you for viewing.

0:00(gentle music)

0:07<v ->Now that our FortiADC is a living, breathing VM,</v>

0:10if they live and breathe, but it's actually running inside

0:12of our ESXI environment,

0:13our next step is to make initial contact with it,

0:16how you do it and configure it,

0:17and one of the first steps of doing that

0:19is using these CLI, the command line interface,

0:22and in this video I'd like

0:23to walk you through options for that

0:25and the demonstration of doing exactly that.

0:27So let's imagine this is our FortiADC right here,

0:30which in our topology is sitting right there.

0:32If this was a physical appliance,

0:35we could connect to it via

0:36a serial cable to its console port.

0:39And if that was the case, we'd set our terminal emulator

0:42to be 9,600 bits per second, no parity, eight data bits,

0:46one stop bit, and boom, away we go.

0:48Putty, Terra Term, SecureCRT, MobaXterm, et cetera.

0:52Whatever we wanna use,

0:53that's how we can initially get to the CLI.

0:55And the default username on the FortiADC is admin,

0:58and the password is blank,

1:01meaning we just don't have to put anything in initially

1:03to go ahead and connect.

1:04So when we log in the first time,

1:05it's gonna ask us to set a password,

1:07at which point, once we set the password,

1:09we then go ahead and use that going forward.

1:11But again, the default is,

1:13username of admin and no password at all.

1:15Now in the event we are dealing with

1:18a FortiADC that is a VM, like the one we have here,

1:21we don't have a physical console port.

1:23So another option of getting

1:24to the command lane interface

1:25would be through the hypervisor.

1:27In our case, we're using ESXI.

1:29And so, the hypervisor could provide us a window

1:32to the actual console for this device.

1:34So again, depending on the FortiADC model,

1:35we have an option A console port, if it's a physical device,

1:38we have option B, if it's a virtual machine.

1:42Another option though, is we could connect

1:44to an IP address on one of these interfaces.

1:46And port1, by default, has the default IP address

1:50of 192.168.1.99,

1:55and it has available on that HTTPS,

1:57so we could use a browser to connect there.

2:00It also has SSH setup, so we could log in via SSH

2:03to go ahead and connect to that.

2:04Now, the problem, I did this to myself. Oh, ouch.

2:08The challenge here is that port1, this guy right here,

2:13we have placed that in VLAN 10,

2:15and my management computer is out here in a different VLAN

2:18at the 192.168 address,

2:20so initially, if we wanna get this thing

2:22up and running and manageable over an IP address,

2:25I need to use a console option.

2:26So I can't use this, 'cause it's a virtual machine,

2:29but I can use the hypervisor console to go to this device

2:32and use a few basic commands at the CLI

2:35to go ahead and change the IP address on port10

2:38to be 192.168.1.,

2:40and I'm gonna go ahead and set it to our plan of 73

2:44and then I can manage it from that point.

2:46But until I get the right IP address on the right interface,

2:49I can't use this default on port1

2:50because I have no access at the moment

2:53from my management computer and my management network

2:55over here to this address space.

2:57I will eventually, but at very moment I don't.

3:00So, let's go ahead and use the hypervisor console option

3:03and we'll go to the CLI here on this FortiADC

3:06and we'll set up port number 10

3:08to have the IP address of 192.168.1.73.

3:12Alright, so to the hypervisor we go

3:13and they sort these based on their state.

3:16There is our FortiADC,

3:18and I'm gonna right click here on this little thumbnail

3:21and hover over console,

3:23I'm gonna ask it to open up a remote console to that VM,

3:27and that is coming up right here.

3:29And it's pretty tiny font right here.

3:31let me zoom in a little bit

3:32to make it a little bit more readable.

3:33Alright, so I'm gonna log in as admin, the default username,

3:36and there is no password.

3:37It's forcing me to set a password,

3:39so I'll set the password.

3:40I'll confirm the password, and we are in.

3:43So here if we did a show system interface,

3:46it'll tell us the story of what's actually going on here.

3:48So this command here, show system interface,

3:50is gonna show port.

3:51So there's port1 with

3:53the default IP address of 192.168.1.99,

3:56Then we've got port2 and port3,

3:58and we can press the enter key

3:59to go one line down at a time,

4:01or we can hit the space bar to go one page down at a time.

4:04And then there's port10 right there at the bottom.

4:07And one of the challenges is, too,

4:08because all these interfaces are in the same virtual domain,

4:12if I try to use the IP adressing space

4:13of 192.168.1.73 on port10,

4:16that's gonna mean an overlapping IP address,

4:18so I need to go into the configuration for port1

4:21and remove the IP address

4:22so I can go ahead and put the right IP address on port10

4:25and that way we can manage it.

4:26And that way we can manage it over the network.

4:28So I'm gonna type in config system interface, press enter,

4:33and let's do a edit port number 1,

4:36and I'll do a show,

4:38and this is showing me the configuration for that interface.

4:41So for the IP address here on port1,

4:42instead of having it set to that 192.168.1,

4:46I'm gonna go ahead and do an unset.

4:47IP, press enter, and do a show, and it is gone.

4:51Alright, so it no longer has that IP address there.

4:53So I'm gonna type in end.

4:54So now we'll do a config system interface,

4:57and we'll do a show real quick just to verify

4:59that port1 no longer has an IP address,

5:01fantastic, hit the space bar.

5:03And what we wanna do is type in edit and port10.

5:06And what we're gonna do in this interface,

5:08we wanna set the IP address

5:09to 192.168.1.73 is our game plan,

5:14with a 24 bit mask.

5:15Boom.

5:16Also, if we do a show here,

5:18what we also need to do here is allow access,

5:20if we wanna access this and manage it via HTTPS, or SSH,

5:23we also need to tell if that's...

5:24So we'll do a set allowaccess.

5:26And I'm gonna add https and http and ping and snmp and ssh,

5:33and not Telnet, because Telnet and just HTTP

5:37all by itself are plain text.

5:39Although if we do connect via HTTP,

5:41it'll redirect us over to HTTPS,

5:43so I'm gonna leave Telnet off the list, press enter,

5:45we'll do quick show just to verify that it's set

5:48and we'll do end, and boom, we are now good to go.

5:51So we should now be able to access

5:54that management interface,

5:55which is port10 at the IP address of 192.168.1.73.

6:00So lemme bring back a bigger view here.

6:02So lemme go ahead and minimize

6:04the hypervisor console window here,

6:07and lemme bring in a terminal emulator,

6:08this happens to be SecureCRT,

6:11and lemme make a new connection,

6:12and it'll be SSH going to 192.168.1.73.

6:17Username is gonna be admin, and we'll click on connect.

6:21So this is the first time connecting to this VM with SSH,

6:24so I'm gonna go ahead and accept and save.

6:26We're getting the host key,

6:27and I'm gonna supply my password here,

6:29which is the password I set

6:30at the CLI just a few minutes ago.

6:32And I'm gonna tell my terminal emulator

6:34to go ahead and save this password for future access

6:36and click on okay.

6:38And there we go. Lemme bring this full screen.

6:40So here if we did a get system status and pressed enter,

6:44this is showing us the version of software, which is 7.1,

6:48shows us that we're using a trial license.

6:50It's indicating here when this trial license expires

6:53and because we just installed it a little bit ago,

6:55that's why expires in just less than 15 days.

6:58Also, there's some limits on the trial license

7:00regarding how many CPUs, so if you deploy this

7:02and then you try to modify the number of CPUs

7:04in the virtualized environment this VM has,

7:06it's not gonna like it.

7:08Alright, and here's the name of this VM,

7:10it's called FortiADC-VM.

7:12If we wanna look at the routing table on this device,

7:14we can do a command like get router info routing-table all.

7:19So port10 that we just configured is on the 192.168.1

7:23network based on the .73 address we just gave it.

7:26It also has an IP address on this haport0,

7:29which looks like it's coming from APIPA,

7:31the automatic private IP addressing range.

7:34But what I noticed here is that

7:35we don't have a default gateway,

7:36but don't worry we'll take care of that as well.

7:38So from here, we can do a show system interface

7:42and scroll down to the bottom

7:43and confirm our IP address

7:44that we're currently connected on.

7:46Or we can do a show system interface for port10

7:50and that's a way to go directly to it.

7:52Also, we do a

7:53show full-configuration system interface port10.

7:57So if we do this command here, show full-configuration

8:00for that interface, it'll show us these details

8:02which are set, plus

8:03all the other defaults that are in place.

8:05So we'll press enter and I'll hit space bar,

8:08scroll up a little bit.

8:09So here is all the configuration that's active

8:12for this port10 at the moment,

8:13including the specifics that we put in,

8:15like its IP address, and what kind

8:17of access we'd like to allow.

8:19But all these others that didn't show up

8:21with the simple show command

8:22are defaults for that interface.

8:24And to compare and contrast that,

8:26if we do this show system interface port10,

8:28it just shows us the specific configured elements.

8:31So in this video we've made initial contact

8:33via the CLI to the FortiADC.

8:35And so what we had to do,

8:37we used the hypervisor console access

8:40because port1 with its default IP address

8:43of .99 on the 192.168.1 network,

8:45wasn't reachable by my management computer.

8:48So we used the console,

8:49but now that we have the management interface, port10,

8:51with the correct IP address

8:53and we've also verified it by SSHing to it,

8:55we can now access device as well

8:57using a GUI with a browser to that same IP address.

9:00And that's what you and I get to do in the very next video.

9:03So I'll see you there in just a moment.

9:05Until then, I hope this has been informative

9:07and I'd like to thank you for viewing.

0:01(gentle music)

0:07<v ->In the previous video, we did some initial access</v>

0:10and configuration of the command line interface, the CLI.

0:13And in this video, we're gonna go ahead

0:14and now connect to that management IP address,

0:16which is now reachable, by the way,

0:17and we're gonna use it with a browser

0:19to get the GUI interface, the GUI access, to the FortiADC.

0:23So just as a reminder about where we are in context here,

0:26we are at a management computer on the 192.168.1 network

0:30and we want to manage and work with this FortiADC

0:34over its port10,

0:35which is configured with the IP address of 10.168.1.73.

0:40All right, so I've connected with the browser

0:41to 192.168.1.73.

0:44I simply put in the IP address

0:46and it redirected me over to HTTPS.

0:48And so, let's go ahead and log in as admin

0:51and the password we set at the command line,

0:54which I still remember, (chuckles) so I'll put that in.

0:56Fantastic. And we'll click on Login.

0:58So now, it's asking me if I wanna do a few steps,

1:00including specify the Hostname.

1:02Sure. We'll say Begin.

1:03And let's go ahead and call this FortiADC-1

1:09and we'll click on OK.

1:10And now, what it's gonna do

1:11it's gonna walk us through the Getting Started wizard.

1:14So it's asking me to confirm

1:15the System Time right here and my Time Zone.

1:18I'm also gonna use NTP,

1:19so I'll click that slider to put on NTP.

1:21It's gonna use one of the servers from pool.ntp.org.

1:25And the Synchronizing Interval, every 60 minutes.

1:27That's fine. And we'll click on Next.

1:29So now it's asking us about the management interface

1:32that we wanna use and Interface 1, Interface 2.

1:35So we already specified an IP address for port10.

1:39And so, what I'm gonna do here

1:41is I'm gonna go ahead and I'm gonna say, "You know what,

1:43"I'm not gonna play with that through this wizard."

1:45But if we wanted to, we could set up the IP address here

1:48for Interface 1 and for Interface 2

1:51right here in this wizard.

1:52I'm gonna go ahead and say Cancel.

1:54And that's taking us over here to our System Settings,

1:57what we're seeing right here.

1:57But let's start off with the Dashboard.

1:59So up at the left, I'm gonna click on Dashboard,

2:01click on Main, and that takes you to the main Dashboard.

2:03So here is the information regarding the system.

2:06Here's our widget regarding our licensing information.

2:09If we click here on these little three dots,

2:10it'll give us the option to see more detail,

2:12so we'll click on that.

2:13So we can scroll down, take a look at the details there.

2:16If we wanna go back to the main Dashboard,

2:17we can do that as well.

2:19It shows we have 10 interfaces.

2:20If we wanna take a look at the details,

2:21we click here on See Detail.

2:23So here is port10 that we're using for management

2:26and we haven't yet configured the details

2:27for port1 and port2, but we will.

2:29If we go back to the Dashboard,

2:31there's also an option here, in the upper right here,

2:34to go to a CLI right from the GUI.

2:36So if you're connected via browser

2:38and you wanna go to a CLI real quick,

2:40you just click on this icon here

2:41for the command line interface,

2:42and that brings up the command line interface

2:45right here within the GUI.

2:47Now in the event that we canceled the wizard

2:49or we wanted to change the information we put in the wizard,

2:51all that can be done right here through the GUI interface.

2:54So for example, if we go to System

2:56and we go to System Settings,

2:58if we wanted to change the Hostname,

2:59we could just change it right here.

3:01Here's the Idle Timeout of 30 minutes for demos and stuff.

3:04I'm gonna change that to 400 minutes,

3:06and that way, it won't time out on me quite as much.

3:08Here's the default port for SSH of 22, which is being used.

3:11That's fantastic.

3:13Here's the Primary and Secondary DNS servers.

3:16So that way, if the Primary DNS server doesn't respond,

3:18times out, it can use the Secondary DNS server

3:21for name resolution.

3:22Also, right here by default,

3:24it's enabling redirections to HTTPS.

3:26And that's why when I connected initially,

3:28I connected just to 192.168.1.73,

3:32and 'cause of this option here,

3:34it automatically redirected me over to HTTPS.

3:37So if we scroll up, if we click here on the Maintenance tab,

3:40under System Settings, so the breadcrumbs is System,

3:44Settings, and on the Maintenance tab,

3:46here it has the System Time.

3:48And regarding NTP,

3:48I thought I configured that with the wizard.

3:50Maybe I canceled all of it.

3:51Anyway, if you wanna enable NTP,

3:53we can do it right here under System, Settings, Maintenance,

3:56and just enable NTP,

3:58and then specify the interval and click on Save.

4:00So I think I canceled the wizard earlier

4:01so it didn't save any of my changes.

4:03Another important aspect for troubleshooting

4:05and working with the system is logging.

4:06So over here on the left,

4:08let me collapse the System Settings here.

4:10If we go down to Log &amp; Report over here on the left

4:12and we go to Log Settings down here near the bottom.

4:15So click here on Log Settings.

4:16Here, we can configure what we want to collect.

4:19So if we want to enable or disable certain type of logs

4:22or we wanna specify the log level, we can do it right here.

4:25So for this system,

4:26I'm gonna enable everything for Event Category.

4:29I'm gonna go ahead and enable all

4:30regarding Traffic Categories, for Security,

4:33and enable all there, and also for Script Category.

4:37And I'll click on Save.

4:38So now, I'm just logging like crazy.

4:40And that's regarding the Local Log.

4:42If we're logging to Syslog Servers or FortiAnalyzer,

4:45we can specify the details there as well.

4:47Also, while we're here in the GUI, the default user account,

4:51the admin account, is called admin.

4:52But if we wanted to create additional accounts, we could.

4:54Now, you can't delete the admin account,

4:57but you can create additional accounts.

4:58So if we go back up to System and under System,

5:01we click here on Administrator,

5:03this is where we could go to go ahead

5:04and create additional administrators.

5:06So if we wanted to create a new administrator,

5:07we'd click here on Create New, specify administrator,

5:10and put in the details.

5:11Also, before we actually create a new administrator,

5:13let me show you one other thing.

5:14Let's imagine we wanna create a new administrator,

5:17but we don't want that new administrator

5:19to have full access to everything.

5:20What we could do is we could create an Access Profile

5:23by going here to System, Administrator, Access Profile,

5:27and we can create a new profile

5:28that controls what they can do.

5:30So if we wanted to create a profile here

5:32that had the ability to read everything,

5:34but not to make changes,

5:35let's go ahead and call this Read-Only_Access-Profile,

5:41and click on Save.

5:42Then we could go ahead and create a new admin.

5:44I'll go back to the Admin tab, Create New, Admin,

5:48and let's call this Jr_Admin.

5:50And for the comments, I'll say Read-only Rights.

5:52And then for the Admin Profile,

5:54specify that Read-Only_Access-Profile that we created,

5:57and that's what implements the read-only permissions.

5:59And I'll put in a password and confirm the password.

6:02And if we have admin accounts that we wanna protect,

6:04it'd be wise to do two-factor authentication as well.

6:07So we'll click on Save here.

6:09Another option here

6:10is we can also lock this Jr_Admin account

6:12from only being able to log in from certain IP addresses,

6:15or ranges of addresses,

6:16by modifying this Trusted Hosts column.

6:19So we click on the pencil right here

6:20and we say Restrict to hosts.

6:22We could say we only want Tim

6:24to be able to log in as Jr_Admin

6:26if he's coming in from the 192.168.1 network, like that.

6:31Click on Save.

6:32And now, if he tries to log in from some other subnet,

6:35it won't be allowed.

6:36They'll have to have the right password

6:38and also coming in from that specific subnet.

6:40So now, we have basic GUI access via a browser

6:43to our FortiADC.

6:45But one of the challenges is we only have one IP address

6:48on this system that's functional

6:49and that's on the management interface.

6:51We don't have IP addresses on port1 or port2

6:54that are needed for our topology.

6:56And this FortiADC, at the moment,

6:58does not have a default gateway.

7:00So we're gonna fix all of that in the next video

7:02with network connectivity in just a moment.

7:04So I'll see you there soon.

7:05Until then, I hope this has been informative

7:07and I'd like to thank you for viewing.

0:07<v ->Now that we have IP network management access</v>

0:09to the FortiADC,

0:10we've also verified that via SSH over to the device

0:14as well as using a browser with a GUI interface.

0:16Our next step is to make sure we have

0:17full network functionality

0:19with IP addresses on its two interfaces

0:22that are gonna be used to forward user traffic.

0:23And we also wanna make sure that this device

0:25has DNS support and a default gateway.

0:28So for our task list, we wanna make sure

0:30that port number one and port number two

0:34have their appropriate IP addresses.

0:35And just for a moment, let's confirm what they are.

0:37So port number one is right there

0:39and it should be 10.10.0.73.

0:44And port number two,

0:45here on the left facing the real servers,

0:47it should have the IP address of 10.20.0.73.

0:51We also wanna take a moment just to confirm

0:53that the DNS that the FortiADC is using for name resolution

0:57is or are the ones that we want to use.

0:59And then also we wanna make sure

1:01that we have a default route.

1:04Think of a default route very much like a PC or a server

1:07with their default gateway.

1:09Effectively, if the device doesn't have

1:11a more specific route in its routing table,

1:13the default route's gonna be used to forward traffic.

1:16So what we wanna do is train the FortiADC

1:18that its default route,

1:19which is represented 0.0.0.0, with a zero mask,

1:23that for that default route

1:24the next top should be our FortiGate firewall,

1:27which is at 10.10.0.71.

1:31And also while I'm at it,

1:32let me just jot down the IP addresses here

1:33for port one and port two.

1:35So port one is gonna be 10.10.0.73,

1:40and port two is gonna be 10.20.0.73

1:45and all of that with 24 bit masks.

1:47Alright, so with that game plan in place,

1:48let's go back to the interface here at the FortiADC.

1:51And let's go ahead and tackle port one and port two first

1:55for network connectivity.

1:56So we'll go down here to the network settings,

1:58and under network we'll click on interface, and here we go.

2:02So we'll scroll down, and we have port one.

2:05And currently it does not have an IP address,

2:07so we'll go ahead and click on edit.

2:09And currently it's gonna allow

2:10HTTPS and Ping and SSH and HTTP.

2:13And that's because of the settings

2:14that were there by default.

2:15So I'm gonna leave those as they are.

2:17And then for it's IPv4 address,

2:19we wanna go ahead and use 10,

2:20I'm gonna look at my notes here.

2:22Has 10.10.0.73 with a 24 bit mask, just like that.

2:28And I'm not gonna give it an IPv6 address.

2:30And we'll scroll down, and we'll click on save.

2:33Alright, there's port one.

2:34Let's go to port two.

2:35So we'll select port two, click on the pencil to edit it.

2:38And this one should be 10.20.0.73

2:42with a 24 bit mask, just like that.

2:45Now this is the interface that's facing

2:46our real servers on the left of our topology.

2:48So I'm gonna allow Ping at a bare minimum.

2:50That way if I'm at a server

2:52and I wanna verify basic connectivity,

2:54I could ping the IP address of .73, and I'd get a response.

2:58Also just for convenience,

2:59I'm going to allow HTTP and SSH as well here.

3:02In the event I'm on that subnet

3:05and I wanna use those protocols to manage this device,

3:08by allowing access to those protocols,

3:10I'll be able to use them as I connect

3:12from that subnet to the interface.

3:14And generally speaking,

3:15less is more from a security perspective.

3:17That way if we have a device,

3:18one of our servers gets compromised,

3:20and we have a hacker or attacker there

3:22who's now trying to use one of those servers to connect

3:24and start to manage our FortiADC,

3:27if we aren't allowing HTTPS and so forth,

3:29they won't have success in accessing the FortiADC

3:32via those protocols.

3:33But for my lab environment, that's gonna be perfectly fine.

3:36Alright, so let's scroll down and we'll click on save.

3:39Alright, so let's take a look.

3:40We have port one at 10.10.0.73, port two at 10.20.0.73,

3:46and then we have our management interface

3:47down here at 192.168.1.73.

3:50Alright, that looks good.

3:51The next thing we wanna do also is

3:52make sure that we have a default route set up.

3:55So if we go to routing... (laughs)

3:58Yep, no default gateway, no default route.

4:00So let's add a static default route.

4:03So if this device needs to forward a packet

4:06off of its local networks, it knows where to forward it to.

4:09So with network selected and routing selected under that

4:12and the static tab selected,

4:14we're gonna create a brand new static route.

4:16So we'll click here on create new.

4:18And the destination is 0.0.0.0/0.

4:20That's the representation of a default route.

4:23And the gateway, let's take a look

4:24at our topology for a moment.

4:26Our gateway is gonna be the FortiGate firewall

4:28at 10.10.0.71.

4:31So that's what we're gonna specify

4:32for the next top for the default route.

4:35So we'll specify, say 10.10.0.71.

4:38And then we have the concept of distance,

4:40and here's where that could come into play.

4:41If we have our FortiADC right here,

4:44and it has two default routes...

4:46Let's say we have a default route

4:47that goes to the next router of A,

4:49and another default route with the next router of B.

4:52The question is, which one should we choose?

4:54And it's a lot like walking.

4:56And you might think, "Keith, how is distance like walking?"

4:58Well, if somebody said,

5:00"To go to the store, you have to walk 10 miles,"

5:02or "To go to the store, you have to walk 15 miles," (laughs)

5:05which one are you gonna choose?

5:06Well, most people are gonna choose

5:08the one with a lower number of miles.

5:10And that's how distance works in the world

5:12of making a decision on which route to use.

5:15If we have one route that has a distance of 10

5:18and the other route has a distance of 15,

5:20this is the route, with a lower distance,

5:22that's gonna go in the routing table.

5:24And then if this route went away at some point,

5:26we then go ahead and put this route in our routing table.

5:28So that's where distance can come into play

5:30when having the FortiADC decide

5:33on which route to use when we have two identical routes.

5:35So we'll go ahead and click save here.

5:37So there's our default route.

5:40And let's also create another one, just for grins.

5:42And we'll say this one has the next top

5:44of 10.10.0., let's say 78, I'm gonna make that up.

5:49And let's give it a distance of 15.

5:51We'll click on save.

5:52So now it has two default routes,

5:54one with the next top of 71, that's our FortiGate,

5:57and one of .78, which doesn't exist at the moment.

6:00And they have these distances involved.

6:02So if we were to go to the command line,

6:04and this is a quick way of doing that right there,

6:05with a little shortcut to the command line,

6:07and we did a get router info routing-table all

6:11and pressed enter.

6:12So notice here we have two static default routes.

6:16So the code here, the S represents is a static route.

6:19The little greater than symbol here

6:20represents is the selected route.

6:22That's effectively the winner,

6:23the route that's gonna be used.

6:25And the little asterisk represents

6:26it's in the forwarding information base,

6:28which means it's cached and ready to go.

6:30So we could ask the question,

6:31"Well why did it choose this one as the winner

6:34and why is it using that route

6:35and not using the other static route?"

6:37And the answer is the distance right here.

6:39One was at 10, one was at 15,

6:41so it chose one with the lower distance value.

6:43Now, because I don't actually have

6:45the next top at .78 in my topology,

6:47I'm gonna remove that from the routing table.

6:49So I'm gonna go ahead and close the console here,

6:52and I'm gonna take this route to .78,

6:54and I'm gonna click on

6:55the little trashcan here to delete it.

6:57Click on okay.

6:58And now we have one default route

7:00using the next top of .71.

7:02And one last thing before we check

7:03our connectivity to the internet, let's also verify DNS.

7:07And that is under system, and settings.

7:10And on the basic tab here,

7:12there's our primary and secondary DNS servers.

7:14So this FortiADC should be able to do name resolution

7:18using one of these publicly available DNS servers,

7:21and it should be able to ping an internet resource.

7:23So if we go back to the command line,

7:24let's execute command ping out to www.google.com.

7:29And if that flies, that's great.

7:31And that is not flying, that is not going.

7:34I'm gonna do a control C there.

7:36Why?

7:37Oh, (laughs) I know why. (laughs)

7:39Let's take a look at what the challenge is.

7:41The problem is this firewall right here is saying,

7:44"I don't think I wanna forward that for you."

7:46So this FortiGate, as it sees traffic trying

7:48to come from this FortiADC

7:50needs to have network address translation set up

7:53to allow that traffic to go out

7:54to the internet and be translated,

7:55and security policy set up to permit the traffic to flow.

8:00So this is the FortiGate.

8:01And before we set this up,

8:02let me make sure I have the right interfaces in place.

8:04And if I go down to internal,

8:08I don't have an interface for VLAN 10.

8:11So let's do this,

8:12because I don't want this single video to be too long,

8:14in the next video,

8:15let's walk through the quick implementation

8:17of the appropriate interfaces here on the FortiGate

8:19and also the NAT and security policies

8:21to allow the traffic go through.

8:22And then we can verify the FortiADC connection

8:26to the internet.

8:26So I'll see you in the next video for exactly that.

8:28Until then, I hope this has been informative,

8:31and I'd like to thank you for viewing.

0:00(orchestral music)

0:06<v ->In order for the FortiADC to get out to the internet,</v>

0:09it has to go through the FortiGate.

0:11And that's what we're gonna do in this video,

0:12is a few little tweaks at the FortiGate

0:14to allow that traffic to go through

0:16as part of our initial deployment of the FortiADC.

0:20So here at this FortiGate,

0:22I need to make sure I have an interface on VLAN 10

0:24that ends in .71, which I don't think I currently have.

0:28So we'll put that in place real quick.

0:30I also need to set up some address translation rules

0:31so that traffic from the FortiADC as it goes through

0:34is translated to a globally readable address.

0:37And then third, I need to set up permissions

0:40that allow that flow of traffic.

0:42So once we get this guy all dialed in

0:44and we start setting it up

0:45as an application delivery controller,

0:47we'll set up additional rules and policies

0:49for different flows of traffic.

0:51But just for a basic internet connectivity test,

0:53we'll make those changes right now here at the FortiGate

0:55to allow that connectivity from this FortiADC

0:58out to the internet.

0:59Alright, so here is the FortiGate,

1:01and I need a interface in VLAN 10,

1:04which I will create right here, create new interface.

1:07I'm gonna name it VLAN 10, just to be creative.

1:10And let's go ahead

1:12and we're gonna use the parent interface of internal one.

1:15And this is gonna be VLAN 10,

1:18and its IP address is gonna be 10.10.0.71

1:21with a 24-bit mask.

1:23And we'll allow ping, that way the FortiADC can do a ping

1:26to the default gateway and verify it works.

1:29And we don't need a DACP server at the moment,

1:30so click on Okay.

1:32Alright, so now we've got our VLAN 10 interface.

1:36That's a good start.

1:37Next, let's go ahead and set up some NAT rules.

1:39So under policy and objects,

1:41we'll go to essential source net and create new.

1:44And this be traffic that's coming in

1:46on the VLAN 10 interface that's going out

1:49either WAN A or WAN B,

1:53'cause I've got some load balancing out there.

1:55And for the source address,

1:56I'm gonna say all, because I'm gonna have

1:58eventually multiple IP address coming in.

2:00And for the destination address I'm gonna say all as well.

2:02And it's gonna use NAT

2:04with overloading on the outgoing interface of the firewall

2:06and click on Okay.

2:08Alright, so NAT's in place,

2:10and let's also set up some permissions.

2:12So we we'll go to firewall policy, click on create new,

2:14I'll call this VLAN 22 outside, just like that.

2:19And the incoming interface is gonna be VLAN 10.

2:22Outgoing interface is gonna be our SD WAN zone,

2:26which includes either WAN A or WAN B,

2:28and the source, I'm gonna say any source IP address,

2:31and destination, any destination IP address,

2:34just for now for a test, and for service,

2:36anything they want.

2:38And we'll set them to accept, and we'll click on Okay.

2:41So now we have the permissions

2:41right here in this policy.

2:43We have the NAT policy set up right here,

2:47and we also created the interface.

2:49So let's go ahead back to the FortiADC

2:51and let's do a few tests.

2:53And just as a reminder of where we're at,

2:55we should be able to, from the FortiADC,

2:57we should be able to ping 10.10.0.71.

3:01That's our default gateway.

3:02And we also should be able to reach resources

3:04out on the internet as well

3:06now that the FortiGate is cooperating.

3:08So back at the FortiADC, let's bring up a command prompt.

3:11In fact, lemme bring up my terminal emulator secure CRT,

3:14and that's gonna be a little bit bigger font.

3:17Let's do a get router info routing table all,

3:21just to confirm our default static route right there.

3:25Let's execute a ping.

3:27We'll take baby steps here.

3:28We'll ping to 10.10.0.71.

3:31(laughing)

3:33It's always good when it works.

3:35And let's do a ping out to www.google.com,

3:38press enter, and it says, Keith, what are you doing?

3:42Type in execute ping www.google.com.

3:45And survey says, name resolution's working.

3:48And our ping out to the internet is working as well.

3:51We could also do an execute of trace route

3:53out to www.cbtnuggets.com,

3:59press enter, and that's showing us the path.

4:02It's also doing the reverse lookup along the way

4:03where that's possible.

4:05Alright, lemme do a control C there.

4:07So in this set of videos, we've done three basic things.

4:10Number one, we identified the basic idea or concept

4:12behind an application delivery controller.

4:15Secondly, we actually deployed an ADC

4:18as a VM in our lab environment.

4:20And then third, we also verified basic connectivity

4:22between that FortiADC and the outside world.

4:26And that puts us in a great starting position

4:28as we continue our journey together

4:30through the world of the FortiADC.

4:32So I'll see you in the next set of videos

4:33as we'll continue this discussion together.

4:36Until then, I hope this has been informative,

4:38and I'd like to thank you for viewing.