Initial Deployment of FortiAuthenticator

0:00[AUDIO LOGO]

0:09Hello and welcome.

0:10My name is Keith Barker.

0:12And in the world of security today,

0:13a big component of that security is making sure

0:15that when an individual, whether using a banking

0:18system or you're logging on to a network,

0:20we need to make sure that person really is who they claim to be.

0:23Now, at the heart of this, the world of Fortinet,

0:25there is an appliance called FortiAuthenticator

0:27that can help us as a central clearinghouse

0:30for that proper and safe, secure authentication.

0:32So in the next video, we're going

0:34to take a big picture like, some of the high-level concepts

0:36of the FortiAuthenticator, and then I'm

0:38going to walk you through step by step

0:39the deployment of a FortiAuthenticator appliance

0:42on a network.

0:43So I'll see you, my friend, in the very next video.

0:00[AUDIO LOGO]

0:06In this video, you and I get to take

0:08a big picture look the logic and concept regarding

0:10a FortiAuthenticator.

0:12And to really appreciate this, let's

0:13talk about the concept of a centralized authentication

0:16server.

0:17Sometimes we may see these listed as a AAA server.

0:20AAA is an acronym for authentication, authorization,

0:22and accounting.

0:23But at the end of the day, the centralized server

0:25has a database.

0:26And in that database, it has information regarding

0:29users and their passwords.

0:30And if anybody wants to verify a user account,

0:33this centralized authentication server

0:34can be used to validate that user's information, including

0:37their password.

0:38So what types of devices might use

0:40this centralized authentication server?

0:42Well, we might have some firewalls, like a FortiGate,

0:44for example.

0:45So let's imagine this is FortiGate-1,

0:47and let's put FortiGate-2 and FortiGate-3.

0:51And they all have some network connectivity

0:53and so does our centralized AAA server.

0:55So these FortiGates connect as clients

0:57as they interact with the server.

0:59So FortiGate-1 is acting as a client

1:01when it talks to the server.

1:02FortiGate-2 is acting as a client

1:04when it communicates with the server.

1:05FortiGate-3 is acting as a client

1:07when it communicates with the server.

1:08So in the FortiGate needs to do some authentication of a user,

1:11whether it's a traditional end user,

1:13or it can be an administrator instead

1:15of having to configure that username and password locally

1:17on the FortiGate.

1:18It can leverage the centralized server, make the request

1:21and say, hey, is this person authorized?

1:23And one of the benefits of having

1:24a centralized authentication server

1:25is that if we have an administrator who

1:27may need to log on to FortiGate-1, and FortiGate-2,

1:29and FortiGate3, instead of having all that information

1:32for the admin configured locally on each of these FortiGates,

1:34if we configure here on the centralized server

1:37and have these FortiGates, clients,

1:39then any of these FortiGates, if the admin tries to log in,

1:42could check with the AAA server to validate whether or not

1:45the credentials match up and whether or not

1:48it's the actual admin user based on the credentials they

1:51supplied, for example, username and password.

1:53So a FortiGate-1 makes a request.

1:54There'll be a response here.

1:56And from the server's perspective,

1:57it would be acting to the server back to the FortiGate

2:00as a client.

2:00So the responses would come back from the server

2:03with a yes or no regarding is that user authorized.

2:06So one of the questions that might come up

2:08is OK, what is being used as this protocol

2:10here as we're communicating back and forth

2:13between these FortiGate?

2:14So this example as clients and the centralized AAA

2:16server that has the information and all the usernames

2:18and passwords.

2:19And the answer is, it depends.

2:21There's more than one option.

2:23We could use RADIUS as the language of love

2:26or the protocol between these FortiGates

2:28and the centralized AAA server.

2:29And that's assuming the FortiGates

2:31and the centralized AAA server support

2:33RADIUS as a communications protocol to use.

2:35Another option would be TACACS Plus,

2:37which is from Cisco Systems.

2:39So primarily, we're going to see that mostly

2:41in Cisco environments, but it can

2:43be used in other environments besides just Cisco

2:45as long as the clients who are communicating with the server

2:48support that protocol.

2:50Another option for communicating between these FortiGates acting

2:53as clients and the AAA server would

2:55be LDAP, Lightweight Directory Access Protocol.

2:57So in that case, perhaps, the centralized AAA server,

2:59it has connectivity over to Active Directory

3:03and the database there, and LDAP is simply used as the mechanism

3:06to communicate between the FortiGate and the AAA

3:09server, who has access to the backend database.

3:11And these aren't the only options that can be used.

3:13There are others as well, but this

3:15is a good sampling of some options that

3:17can be used for the purpose of a device acting as a AAA client,

3:21in this case, FortiGate-1, 2, and 3, communicating with a AAA

3:25server.

3:25So let me go ahead and clean that up a little bit,

3:27and let's chat about another scenario,

3:29where we move on to authenticate some users.

3:31Let's imagine we have a switch.

3:33So here's a switch, and here's some ports on that switch.

3:36And let's imagine we have a PC down here, a networking device,

3:40and that PC is about to plug into port number

3:421 here on the switch.

3:44Now, when that connection is made

3:46with that unshielded twisted pair cable coming

3:48from the network interface card on this PC going to port 1,

3:51the switch, by default, doesn't know or care who the user is

3:55or what that device is behind that port.

3:58All it knows is it has link and in a corporate environment,

4:01very likely spanning tree is going

4:02to take a few seconds until you say, yes, it's OK,

4:04it's safe, and then allow traffic to flow.

4:06However, another option we have is we

4:08can go ahead and train this port that before it allows

4:11all the traffic through that we should validate

4:14who this client is, who is this device hanging off of port 1.

4:17Another scenario is that we could

4:19have an access point for wireless clients hanging off

4:22of a port.

4:23So let's say, that's port number 6 here.

4:25And let's draw another client, and this client,

4:27instead of having a wired network interface card,

4:29has a network interface card that is wireless.

4:31So it's going to associate with an access point.

4:33And in both cases, we may want to find out who that user is

4:37and make them prove who they are before giving them access

4:40through the network, whether they're physically

4:42wired directly, or they're connecting

4:44via an access point who's then wired into the network.

4:46And we can accomplish that by using something called 802.1X.

4:51And with this IAAA standard 802.1X,

4:53we can train the switch to verify who the entity is behind

4:57port 1, or who this wireless client is coming in, before we

5:01allow them full access to the network.

5:02And once again, instead of having usernames and passwords

5:05I'll configured locally on the switch,

5:07we can make the switch a client over here of our AAA server

5:10so that it could check with the server

5:12for the validation of the users as they're trying to come in.

5:15And then when the server responds,

5:16yay or nay, based on the response that

5:18comes back from the AAA server.

5:19This PC could then be allowed access into port number 1,

5:22and this PC with its wireless interface card

5:24could be allowed access in through the access point that's

5:27connected on port number 6.

5:28We also may have some third-party products

5:30that also may support RADIUS, and LDAP, and other protocols

5:34as well because not everything is made by one vendor.

5:37And once again, we'd want to have

5:39some interaction between our AAA server

5:42and those third-party solutions.

5:43And that way, if we don't have all the details

5:45right here on this local centralized AAA server,

5:47we could have information here on these third-party products

5:49and still communicate back and forth

5:51between our server and those third-party products.

5:54Another big aspect regarding security

5:56is the use of digital certificates.

5:58Let me quarantine a little space down here.

6:00And so on the public internet, we have PKI--

6:02the public key infrastructure-- with certificate

6:05authorities that issue certificates,

6:08and we have subordinate CAs.

6:09And then we can use digital certificates

6:11for lots of purposes-- for validating an entity

6:14to make sure they are who they say they are.

6:15We can use the public key that's kept in certificates

6:18as part of cryptography.

6:20And digital certificates are important as part

6:22of authentication processes.

6:23So we can use a digital certificate

6:25to authenticate and validate a server we're connecting to.

6:28We can have individual digital certificates

6:30for computers and people that can also be used

6:33as part of the authentication.

6:34So digital certificates are an important piece of the puzzle.

6:37So let me ask the million dollar question,

6:39and that is, why are we chatting about all these options

6:42with AAA servers, and digital certificates, and RADIUS,

6:46and LDAP, and authentication switches, and so forth?

6:49What does this got to do with the FortiAuthenticator?

6:51And here's the answer.

6:52This device right here at the hub of it all

6:55is our FortiAuthenticator that can do all of these things.

6:58If we need a CA server, it can do it.

7:00If we need to have a centralized authentication server that

7:04supports 802.1X, we can do it right here.

7:06If we need a device that supports RADIUS, or LDAP,

7:09or TACACS, it can do it.

7:11If we need to have integration with Active Directory,

7:14the FortiAuthenticator can do it.

7:16If we need integration with third-party RADIUS, and LDAP,

7:18and other servers, we can do that as well.

7:20So if we erase this and we didn't call it

7:22the centralized authentication server,

7:24we could name this the FortiAuthenticator,

7:27or as its friends call it F-A-C. That's

7:30the acronym for the FortiAuthenticator.

7:32And the other good news is that this FortiAuthenticator

7:34can be deployed on-prem either as a physical appliance

7:38or as a VM.

7:39There's also flavors for it up in the cloud

7:41as well with Amazon and Google and more.

7:44So this is the high-level overview

7:45of many of the functions that the FortiAuthenticator

7:48can bring to the table.

7:49And in the next video, what I propose we do is let's

7:51put a design together for a deployment

7:54of a FortiAuthenticator in a local network.

7:56And then with that plan in place,

7:57we'll walk through the next steps

7:59of the actual deployment of the FortiAuthenticator

8:02in a network.

8:02So I'll see you, my friend, in the very next video

8:04as we take a look at our design for our FortiAuthenticator

8:07implementation.

8:08Until then.

8:09I hope this has been informative,

8:10and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06In preparation for rolling out our FortiAuthenticator,

0:09I thought it'd be a pretty good idea to take a few moments

0:12and lay out a design and a topology,

0:14and then we can follow that as we implement

0:16the FortiAuthenticator.

0:17All right.

0:18So for our FortiAuthenticator, let's

0:19go ahead and start with a cloud that represents

0:22the internet right there.

0:24So off of the internet, let's imagine

0:26we have a little service provider router right there

0:29and that our gear is going to be a FortiGate firewall.

0:32We'll go ahead and call that firewall-1.

0:35And let's draw some network cabling.

0:37So this little network here, that'll

0:39represent the 23 network or the 24-bit mask.

0:43And I'm going to go ahead--

0:44I'm using that address space here in my lab environment

0:47even though it does really exist out on the internet as well.

0:50But for the purpose and intention of my labs,

0:51we'll just pretend that that's an outside network,

0:54and then our firewall is connected right there.

0:56And then we've got another network here

0:58with another connection here.

0:59And this is going to be my network 10.10.0.0 with a 24-bit

1:05mask.

1:06And for these two networks in my lab environment,

1:08this is VLAN 23.

1:09And down here, this is VLAN 10.

1:12Make a little note for ourselves there.

1:13And for IP addressing, the default gateway

1:16that leads up to the internet is at 23.1.2.1.

1:19And this firewall, all of its interfaces are dot 71,

1:23including this one on the 23.1.2 network and this one here

1:27on the 10.10 network.

1:28And let me also draw my management network, which

1:30is right here, and that is network

1:32192.168.1.0 with a 24-bit mask.

1:37So this firewall for its management network interface

1:40is dot 71.

1:41Then I've got a management PC that I'm currently sitting

1:43at on this 192.168.1 network.

1:46So I'll draw its connection to the network there,

1:48and its IP address is at dot 151 on this network.

1:53And then I've got this bad boy that we're going to deploy,

1:55and this is going to be our FortiAuthenticator, which

1:58I'll go ahead and call FAC for short.

2:01And we'll give that a physical connection here.

2:03And I'm going to put the FortiAuthenticator at dot 78

2:07on this management network.

2:08So it'd be 192.168.1.78.

2:11Now, also, on this management network,

2:13I also have another router.

2:15So I'm going to go ahead and draw that router right here.

2:17And this router also leads off to the internet.

2:20So I'm going to draw the internet once again down here

2:23and give it a connection right there.

2:25And this router is at dot 1.

2:27So for the FortiAuthenticator's perspective,

2:30we can get out to the internet if we set up the routing

2:32to go through firewall-1, assuming

2:34we set all the permissions up there for that to happen.

2:36And we can also set up a route that uses

2:38dot 1 on the 192.168.1 network that would also

2:41lead out to the internet.

2:43Also, in our design here with this FortiAuthenticator,

2:45we are not putting it on this user network.

2:48So this is an end user network.

2:50And as a general practice, you'd want to put your infrastructure

2:53devices, like servers, and FortiAuthenticators,

2:56and FortiAnalyzers, and FortiManagers

2:58on separate networks.

3:00So this will be our game plan as we

3:02deploy a local FortiAuthenticator

3:04into this network.

3:05And we'll place it right here on the management network,

3:07and we'll give the IP address of dot 78.

3:09So with this plan in place, our next step is to do it,

3:12and that's what we get to start doing in the very next video.

3:15So I'll see you there in just a moment

3:16for the actual deployment of this virtual machine that

3:19will be our FortiAuthenticator.

3:21Until then.

3:22I hope this has been informative,

3:23and I'd like to thank you for viewing.

0:06In the previous video, we put a topology together

0:08with a plan regarding where in our network

0:11we're going to place the FortiAuthenticator.

0:13So in this video, we need to get the software for the VM

0:16and deploy it.

0:17So again, here's our overall topology design

0:19from the previous video.

0:20And what we're going to need to do

0:22is we need to download the VM.

0:24And in my case, I've got behind me a rack of ESXi servers.

0:28That's a hypervisor, the bare metal hypervisor from VMware.

0:31And so we need to download the VM images

0:33appropriate for that platform.

0:35So I'll make a note for ESXi.

0:38So once we downloaded the image, we'll go ahead and deploy it.

0:41And then once it's deployed, we then

0:43take the next step of doing the initial configuration

0:46on that FortiAuthenticator with the appropriate IP address

0:49and all the additional details.

0:50So with that in mind, let's go to the Fortinet website

0:53at support.fortinet.com, we'll log in,

0:56and we'll download the VM.

0:58So here we are at support.fortinet.com.

1:00We'll click on Login.

1:02I just logged in with my user account and password.

1:04And we'll go to Support.

1:06And from the drop-down, we'll go down to VM Images.

1:09And I should say this is how we would normally

1:11download the images.

1:11I think we may have to make a slightly different approach.

1:14But let's just check it out.

1:15So here, under Download/VM Images,

1:18we'll go to Select Product.

1:20And sure enough, FortiADC, FortiAnalyzer, FortiGate,

1:22FortiManager, and we're going to go to Other.

1:25And it says, OK, To download other firmware images,

1:28please click here.

1:29So we'll click here.

1:30We'll follow the link.

1:31And now we'll use the drop-down, and we'll

1:33go ahead and select FortiAuthenticator,

1:35which is right here.

1:37So we'll click on FortiAuthenticator.

1:38And then we have this tab here for Release Notes.

1:41Fantastic.

1:42And then we have the option for download right here.

1:45So with Download selected, we'll scroll down,

1:47and we'll go to the 6.00 folder here, expand that,

1:50and then we'll expand 6.4.

1:53And then under that, we have 6.6.

1:55We'll expand that.

1:56And then we're going to download the image that's

1:58appropriate for our hypervisor.

2:00So my hypervisor is VMware's ESXi.

2:02So I'm going to scroll down.

2:04And survey says, this is the option we want right here.

2:08Also, in the Release Notes, we're getting Deploying a VM.

2:11It would identify that as well.

2:12So OVF, the Open Virtualization Format,

2:14is the format that we need for a VMware environment.

2:18And I see up here above, we have some for Azure, for Hyper-V,

2:21for KVM, and others.

2:23So I'm going to go ahead and get this one right here, build1043.

2:26So to download it, we'll just go over here

2:27to the right where it says HTTPS and click on HTTPS

2:31to begin the download.

2:32All right, and it is downloading as we speak,

2:35as shown down here in the bottom left-hand corner.

2:37And it looks like it's done, so I'm

2:38going to go ahead and right-click and say

2:40please show in folder on this Windows computer.

2:43So here it is, my Downloads folder.

2:44I'm going to go ahead and right-click,

2:46and I'm going to go ahead and copy that and then

2:48move it to a different drive where

2:50I keep images for Fortinet.

2:52So here on my D drive, I've got Images, Fortinet, VMware,

2:55FortiAuthenticator.

2:56And it looks like I had a previous version.

2:59What is the date today?

3:00It is the 4th.

3:01So yesterday [CHUCKLES] I downloaded the latest

3:04and greatest version.

3:05It was build1040.

3:06But if we do a paste here, the one we just downloaded

3:10is build1043.

3:11So I'm going to delete the old ones, and then let's go ahead

3:13and expand this right here.

3:15We'll right-click and we'll say Extract All

3:17and then click on Extract.

3:18And there they are.

3:19So these two are hard disk files for the VM,

3:23and then I have several different flavors regarding

3:25the hardware versions, which refers to the logical hardware

3:28versions for the VM in a VMware environment.

3:30So to go ahead and deploy these, we'll

3:32deploy the two hard drives along with the latest

3:35flavor of the hardware version, which is, in this case, hw13.

3:39So let me set this to side for a moment

3:41and let's bring out our hypervisor.

3:43So here is my hypervisor interface.

3:45This is logging in directly to the ESXi host.

3:48It's one option for managing and working with VMware ESXi host.

3:52The other option is to use vCenter,

3:53which is an enterprise management

3:55solution for managing one or more ESXi hosts.

3:57So, currently, they're going to be

3:59sorted by State so I'll see all the devices that

4:01are powered on.

4:02And from here, we'll simply right-click on Host.

4:04And from the drop-down, we'll select Create/Register VM,

4:08and then we'll deploy a virtual machine from an OVF or OVA

4:12file.

4:12And then when we download it and just extract it from Fortinet,

4:15it's in OVF format.

4:16So we'll go ahead and select that and then click on Next.

4:19I'll go ahead and name this Our_FAC for FortiAuthenticator,

4:22and that'll just be the name inside of the hypervisor.

4:25We can rename the actual virtual machine inside the VM anything

4:28we want.

4:28I'll click here to get the files.

4:30So here is the zip file and here is the folder

4:32with the unzipped contents.

4:34So we'll go to that subfolder, and we'll just

4:36hold down the Control key as we select the elements we want.

4:39So both hard drives and hardware 13 for the OVF, and we'll

4:43click on Open.

4:44All right, and then we'll click on Next.

4:46It's asking me in my ESXi environment

4:48where do I want to store the files for this VM.

4:51And I'm going to go ahead and let it choose the internal SSD

4:53drive right there.

4:54It's already selected, so we'll click on Next.

4:56I will carefully read the entire end user license agreement

5:00from Fortinet, click on I agree, click on Next.

5:03And by default, it has all four interfaces

5:05connected to my management network.

5:06And so I'm going to leave them there.

5:07I can come back later.

5:08We can change this if we need to.

5:10But I know at least we got port number 1 in our management

5:12network because that's the interface we're going to use.

5:14As far as Disk provisioning, I'm going to go ahead and leave it

5:16with the default of Thin.

5:18That means it's not really going to tie up physical disk

5:20space unless it needs to.

5:22And then Power on automatically is set.

5:24Looks good to me.

5:24We'll click on Next.

5:25We'll go ahead and look at the details,

5:27confirm, and then click on Finish.

5:29And it is off to the races.

5:31So here in the Recent tasks, it shows us

5:33that it's now doing the work of deploying that virtual machine.

5:37So if I sort the VMs based on State,

5:39here is our FAC that is currently

5:42in the process of doing its initialization,

5:45and it should be ready in about two to three minutes

5:48and ready to go.

5:49And that's perfect for us because in about two or three

5:51minutes, we'll be ready to do some initial configuration.

5:54We're getting IP addresses and so forth

5:55on this virtual machine.

5:57So we'll do that in the very next video,

5:59and I'll see you there, my friend,

6:00in just a moment for that.

6:01Meanwhile, I hope this has been informative,

6:03and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06In the previous video, we went to fortinet.com.

0:09We downloaded the VM files for the FortiAuthenticator.

0:12We extracted them, and then we deployed the VM

0:15on server 3 in that rack of servers over here

0:17over my shoulder.

0:18So what's next?

0:19Well, what's next is now, we need

0:20to go ahead and do some basic configuration

0:23for that virtual machine to make it match with what we want

0:26it to look like in our environment,

0:27and that's what we're going to do in this video.

0:29So regarding the FortiAuthenticator

0:31that we just deployed, here are a few defaults

0:32that we should be aware of.

0:34It has a default IP address on port 1 of 192.168.1.99.

0:41Now, if the 192.168.1 network is not the management network

0:45that you're bringing it into, we may

0:47need to go to the CLI via the hypervisor directly

0:50to this machine and actually change it at the CLI.

0:53Also, when we initially log in, there is no password required,

0:57but it does force us to change the password immediately

0:59upon logging in.

1:00So the default user is admin, and the password

1:04is nothing or null.

1:05And as far as the basic network connectivity,

1:07we'd want to verify the default route,

1:10which looks like 0.0.0.0/0.

1:13And the default route is very similar to a default gateway

1:16on a PC, where a PC if it says, I don't know exactly

1:19how to forward to this remote network,

1:20it'll go ahead and use its default gateway.

1:22Well, if we have a default route,

1:24it's the same logic on the FortiAuthenticator.

1:26It'll say, I don't know how to reach,

1:27for example, the 23.1.2 network.

1:29I'll go ahead and use my default route to get there.

1:32So on this FortiAuthenticator, let's

1:34set up the default route with the next hop.

1:36I'll put here next hop NH of 192.168.1.1, which is going

1:43this direction right here.

1:44And then after we have this device set up in the network,

1:47we can also take a look at giving it another path out

1:50to get to the internet using 192.168.1.71, which

1:54would be this firewall, which leads up to the internet going

1:56this direction.

1:57Now, in this network topology because this happens

1:59to be the 192.168.1 network, we could actually just

2:02connect to that IP address with a GUI, meaning, a browser,

2:07or we could SSH to it as well, or we also

2:10could use the command line interface via the hypervisor

2:13that we also just use to deploy this virtual machine.

2:16And because many, many times, you're

2:17going to be connecting to a network that

2:19is not the 192.168.1 network.

2:21Let's start off by walking through going

2:23to the CLI via the hypervisor and walking through how

2:26we can set up and modify this IP address because either way,

2:29we want to change the dot 99 over to dot 78

2:33so that it'll match up with what we have planned here

2:35in our topology.

2:36So back here at the ESXi host, let's go ahead

2:38and we'll highlight our FortiAuthenticator.

2:41And I'm going to click on console

2:43and ask it to launch a remote console,

2:45so we can get close access to that virtual machine.

2:48So that is being brought up right here.

2:51And let me make that a little bit bigger.

2:53All right.

2:53So we are going to go ahead and log in as admin.

2:57So I'll type in admin.

2:58Press Enter.

2:58And there's no password by default, so I'll press Enter.

3:01And now, it's forcing me to go ahead and set a new password,

3:03which I will do.

3:04So I'm typing in a new password, pressing Enter.

3:07And then I'm going to confirm that password

3:08by typing it again and pressing Enter, and we are good to go.

3:12Change password for local user admin succeeded.

3:15So from here, let's do a show system interface

3:18and press Enter, and that's going to show us the current IP

3:21address.

3:22So here on port 1, there is our current IP address

3:25192.168.1.99.

3:27Also, by default on this platform,

3:29it's allowing SSH access and also HTTPS,

3:33whether it's through a browser with a GUI or via an API.

3:36So let's set the IP address and change it

3:38from dot 99 over to do 78.

3:41So to do that, we'll type in config system interface.

3:44Press Enter.

3:46And I left off the f there.

3:47So config system interface.

3:49That's a little better.

3:50And we'll do a show just to verify what we have,

3:52and then we'll type in edit port 1 and press Enter.

3:56And then we'll do a set IP, and we'll

3:59put in 192.168.1.78, based on our plan, with a 24-bit mask,

4:05just like that.

4:06Then we'll do a show.

4:07Oh, I'm in edit mode so that's not going to work.

4:09So we'll go ahead and type in end.

4:10And then let me do a show system interface and press Enter.

4:15And there's our IP address ending in the dot 78.

4:17Also, here, we could edit and set up the default route

4:20if we wanted to as well.

4:21So I'm going to show router static and look at that.

4:26On this FortiAuthenticator, we do not need to set up

4:29the default route because it has a default route 0.0.0.0/0 with

4:35the next hop of 192.168.1.1, which happens to be the perfect

4:39next hop on that local network.

4:41So in the event that it wasn't the correct IP

4:43address for the default gateway, we could go ahead and modify

4:46that as well with the similar logic

4:48we just did for the IP address by typing

4:50in config router static edit 1 and then

4:53specifying the gateway with whatever

4:55next hop we needed it to be.

4:56So now that we have the IP address on the management

4:58interface on port 1 set, let's use a browser and the GUI

5:02and verify that works as well.

5:03So I'll take this console window,

5:05courtesy of the hypervisor.

5:06And I'm going to go ahead and minimize it

5:08in the event we need it again.

5:09And I'm opening a browser over to HTTPS

5:11called wack, wack 192.168.1.78.

5:15It currently says it's unsafe, and that's

5:16because it's a certificate authority that

5:18is not trusted by this browser.

5:20So I'm going to go ahead and scroll down, say,

5:22proceed anyway--

5:23very normal with a self-signed certificate.

5:25I'll go ahead and log in as admin.

5:27I'll put in a new password that I just set and click on Login.

5:30So here in this widget for system information,

5:32the little pencils give us an indication

5:34that we can edit that information.

5:36So let's click on the host name, and I'm

5:38going to name this fac, short for FortiAuthenticator.

5:41Click OK.

5:42And then for the device fully qualified domain name,

5:44I'm going to go ahead and click on the pencil

5:46there and edit that.

5:47And let's go ahead and call this fac.ogit.local.

5:50I have a little DNS system already

5:52set up with that structure, so I'll click on OK.

5:55And now, it's complaining a little bit

5:57because the default server certificate it's using

6:00doesn't include ogit.local, but we'll address

6:03that in subsequent videos.

6:05So it's restarting the web server,

6:07and it's applying the fully qualified domain name.

6:09We can also verify it right here.

6:11This serial number is what's shown up

6:13when you don't apply a license.

6:16So the serial number is for small deployments, supports up

6:19to five users.

6:21In fact, the details are right over here.

6:23So for users, there's one that's used.

6:25That's the admin account.

6:26And there's five total for groups.

6:28There's three available.

6:30It's not going to support FortiToken Hardware

6:32or a FortiToken Mobile with the EVL license,

6:35but it will support Fortinet's single sign-on

6:38with five users and FortiClient workstations with five users.

6:41So there's still quite a bit of functionality

6:43even with the EVL license.

6:45And then for system time, let me also click on that,

6:47and let's make sure that NTP is enabled,

6:49which it is by default. And it happens to be in my time zone.

6:53I'm in Nevada, so I'm in the Pacific time zone.

6:55That's great so no changes there.

6:57We can click on Cancel.

6:58And also, here, under System, let's go down to Network,

7:02and let's take a peek at our interfaces.

7:04So we have our ports, interfaces ports 1, 2, 3, and 4.

7:07Currently, we have 192.168.1.78 with a 24-bit mask

7:11being used on port 1.

7:12And if we click on port 1 to ahead and edit it,

7:15check it out.

7:16Here, it has the IPv4 and IPv6 address information listed.

7:20So currently, we don't have an IPv6 address,

7:22so it's just IPv4.

7:23And then it's showing the access rights.

7:25So Telnet is disabled by default, a good idea

7:28to leave that disabled because Telnet is not secure.

7:31And SSH, and GUI TCP in port 443, and the REST API, those

7:38are both enabled.

7:39And as far as services, virtually everything

7:41is enabled by default, including HTTP,

7:44and HTTPS, and RADIUS, and TACACS, and LDAP,

7:47and the list goes on.

7:48Also, under Networking, let's take a peek at DNS.

7:51So DNS servers have been pre-populated by Fortinet.

7:54They're both pointing to the same exact DNS server.

7:57So I'm going to go ahead and use a Google DNS

7:59server as an alternate there and click on OK.

8:02And if we get a static routing, it

8:03should have our static route that we saw at the CLI.

8:06So we double-click on that.

8:07Here shows off of a port 1, the default route with the next hop

8:10of 192.168.1.1.

8:12So I'll click on Cancel.

8:13No changes there.

8:14And if we scroll to the right, that

8:16will give us a chance to see anything

8:18that was off the screen because of the sizing

8:20for the interface.

8:21And in addition to Dashboard status

8:23and the system information, which includes the license,

8:25another way to see the license information is to go to System

8:28and then down to Administration.

8:30And under Administration, there's a separate section

8:32right here for licensing.

8:33So by default, we don't have a license applied

8:35and apply when we go ahead and download our license

8:38from support.fortinet.com, and then we

8:40can go ahead and upload it right here

8:42by clicking on Upload File, grabbing the license file,

8:45clicking on Open.

8:46And that's how we could apply a license

8:47for the FortiAuthenticator.

8:48Now, one of the best practices that we

8:50should start following early, including

8:52on the FortiAuthenticator, is the process of backing it up,

8:55and there's a few different ways of doing that.

8:57So in the next video, let me walk you

8:59through the process of making sure

9:01that we have a current backup and setting up

9:03a schedule for routine backups as well regarding

9:06the FortiAuthenticator.

9:07So we'll do that the next video, and I'll see you there

9:10in just a moment.

9:10Until then, I hope this has been informative,

9:12and I'd like to Thank you for viewing.

0:06In my experience, there's only two types of users--

0:09people who have lost data and people who will lose data.

0:12And that goes for systems and their configs as well.

0:15So we want to be in a good practice

0:17of making backups and knowing where

0:19we can find those backups.

0:21So in this video, I'd like to walk you through the options

0:23for doing an immediate backup and scheduled backups

0:25on the FortiAuthenticator.

0:27So the backups would go something like this.

0:29If we wanted to do an immediate backup, what we do

0:31is go up here where we're logged in.

0:33So we're currently logged in as the admin user.

0:35We'll click on that user.

0:36And then right from the drop-down,

0:38we have an option for Restore/Backup right there.

0:41So we'll click on Restore/Backup,

0:43and then we have an option for encrypting our backups.

0:45So I'm going to go ahead and select that.

0:47We can specify a password.

0:48And it's really a good idea to put a password on your backup

0:51because if there sensitive information

0:53in your configuration regarding IP addresses

0:56or policies or anything else and you don't want that all to fall

0:59in the wrong hands, by putting a password on your backup,

1:02even if somebody gets the backup,

1:03they shouldn't be able to go ahead and look at it

1:05because it's encrypted, and they won't

1:06have the key or the password to unlock it.

1:09I would also encourage you to use a password

1:10manager of some type and then include this

1:13as an entry in your password manager so it's safe

1:16and you can get at it.

1:17All right, so with the password supplied,

1:19I'll click on Download Backup File.

1:21That's going to back it up locally to my local computer.

1:23Down here in the bottom left, we can see that.

1:25And then we'd want to move that over and keep it

1:27somewhere safe.

1:28We're backing it up in the cloud.

1:29I'd also encourage you regarding that backup

1:32to document what that backup is.

1:34And that way, if you have good documentation regarding

1:36your backups and you need to go back

1:38to a certain point in time before some major change

1:40or before some minor change, hopefully, you

1:42have enough documentation regarding your backups

1:44so you can go to the right backup and restore it.

1:46So then to restore, you go to the same place.

1:48You go to admin, or whoever you're logged in as,

1:51go to Restore/Backup, and then click here on Upload of file

1:55to restore.

1:56Currently, it's in my Downloads folder, so right here.

1:58So I'll go ahead and select it.

1:59And then I'll put in the password

2:00and then click on Restore.

2:01And here, it's giving us a friendly warning saying,

2:03By performing a system restore, all your current data will

2:06be replaced with the backup.

2:07And are you sure you want to continue?

2:09Click on OK and then proceed with the restore.

2:11So in my case, I haven't changed anything.

2:13So this is the backup, so I'm going to go ahead and cancel

2:16that restore.

2:17So the technique of clicking up here on your username

2:19up in the upper right and then going to Restore/Backup

2:22is good for a manual process.

2:24But what about a persistent or ongoing routine

2:28process for backups?

2:29How do we do that?

2:30Well, the answer is we're going to go over here on the left

2:32to System.

2:33And then under System, we're going to go to Administration.

2:35And beneath Administration, we have an option for auto-backup.

2:39So we're going to click here on Config Auto-backup.

2:42We then say Yes.

2:43We definitely want to do the auto-backup.

2:45And then you can specify how often-- hourly, daily,

2:47or weekly, and then what time.

2:49Then you can specify the FTP server that you want to use.

2:52In fact, we should have done that first.

2:53It's right over here under FTP Servers.

2:54And then if we want to do encryption,

2:56we select Encryption So let's pause there just for a moment.

2:58Let's go to FTP Servers and let's create a new FTP server.

3:02And let's call it Our_FTP, and the server

3:06is at 192.168.1.151, which happens

3:09to be my management computer, which I'm

3:11doubling up as an FTP server.

3:13And we'll allow Anonymous FTP, and we'll click on OK.

3:16So now, if we went back under System Administration

3:20and to Config Auto-backup, we enable auto-backup,

3:23specify the time that we want it to happen,

3:25then we can specify a specific directory.

3:27And we can also specify our server,

3:29so we'll specify our server at 151.

3:32We'll enable Encryption, I'll put in a password,

3:35and then we'll click on OK.

3:36And then for my little FTP server, just as a demo,

3:39I'm going to go ahead and use MobaXterm,

3:41which is a fantastic little terminal emulator.

3:43And from the menu up here, I'm going to click on Servers,

3:45and I'm going to start a little FTP server.

3:48First of all, I'll configure the FTP server,

3:50allow anonymous connections, then

3:51I'll go ahead and click on the little arrow

3:53to go ahead and start it.

3:54So it is now going to be running for a few minutes.

3:57And if we went back to our interface here,

3:59we could wait for our Backup time, which is weekly

4:02at midnight, or we click on Now and put in the current time

4:05there.

4:05So I'm going to say Daily and Now

4:07and then I change that to 16:11 and 40 seconds

4:13and then click on OK.

4:15So when it is 4:11 PM and 40 seconds,

4:18this FTP backup should kick off.

4:20So I've clicked on OK.

4:22And now we're just going to wait a few minutes

4:24until that time arrives, and then it should do its backup.

4:26And I don't see it.

4:28[CHUCKLES] So I'm going to go ahead and do this one more time

4:31and set it for 14:00 and click on OK.

4:37Let me save that and make sure on the backend

4:39that my FTP server is still running.

4:41And let me go ahead and I'm going

4:43to stop it and start it just to make sure it is.

4:46And let me bring in my clock.

4:47So it's 4:13 on my local clock.

4:49So in just less than a minute, there you go.

4:51It ticked off.

4:52There's our authentication attempt.

4:53So I'll try to log in as Anonymous.

4:55And I had a pop-up.

4:57I had a pop-up that was asking me to authorize that.

4:59So let me go ahead and do this one more time.

5:02And I set for 15:00 and 10 seconds and click on OK.

5:08Make sure my FTP server is running

5:11by stopping it and restarting it.

5:13So it's good for 360 seconds.

5:15And there we go.

5:17All right, so I was able to go ahead and log

5:18in to this backup, and then the connection was closed.

5:22So if we go to my File System, there

5:24is the backup right there.

5:25And then we can then go ahead and restore it

5:27should we need to.

5:28All right, so I'm going to go ahead and move that out

5:29of the way.

5:30And in a production environment, you

5:32want to make sure your FTP server is up and available

5:34every time this guy tries to backup.

5:35And that's why they also have an option for a secondary FTP

5:38server in the event the first one isn't reachable

5:41or there's a problem with it.

5:42So for now I'm going to go ahead and say

5:44disable the configuration of auto-backup, click OK.

5:47So in this video, we've taken a look

5:48at how to do a manual immediate backup with the option

5:52here in the upper right-hand corner

5:53or schedule a backup by going to System, Administration,

5:56and Configure Auto-backup.

5:58And even if we intend to use the graphical user

6:01interface or browser to work with the FortiAuthenticator

6:03all the time, it's important to have backup plans,

6:05like using a console from the hypervisor

6:08or using an SSH session to connect and get CLI access.

6:12So we'll take a closer look at how to set that up and confirm

6:14it works in the next video.

6:16So I'll see you there in just a moment.

6:17Until then, I hope this has been informative,

6:19and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06In the event that we need CLI command line interface access

0:09to the FortiAuthenticator, at the moment we desperately

0:12need it, that's not the time to find out

0:14whether it works or not.

0:15So in this video, I'd like to chat with you about the two

0:18main ways of getting CLI access to the FortiAuthenticator

0:21in a virtualized environment and verify that they work.

0:25So if our FortiAuthenticator is running

0:27in a virtual environment as a VM, most of our hypervisors

0:31are going to have an option for CLI access

0:33with some kind of a terminal that we can launch

0:36from the hypervisor, whether it's Hyper-V or VMware's ESXi,

0:40but that's certainly not our only option

0:42regarding CLI access, command line interface access

0:45to the FortiAuthenticator.

0:46We could also use SSH, which we're

0:48going to set up and test in this video.

0:50We could also use Telnet, actually.

0:52Now that I write that out, we would never

0:54want to use Telnet because it is plain text.

0:56Anybody who's eavesdropping on any of our sessions

0:58is going to see everything that's going on.

1:00So if it's a VM, it's really going

1:02to be CLI access via the terminal or SSH

1:04access over the network.

1:06So because we have an IP address of dot 78 on a 192.168.1.1

1:09network and our management computer is right here as well,

1:13let's go ahead and open up a terminal emulator

1:15and launch an SSH session over to the FortiAuthenticator just

1:18to verify that it works.

1:20So here is a terminal emulator.

1:22This one happens to be secure CRT.

1:24And we'll go ahead and use the lightning bolt,

1:26and we'll just set up a quick SSH session.

1:29So for the host name, I don't have

1:31DNS for that FortiAuthenticator yet, but what we'll do

1:33is we'll see if the host name is just going to be 192.168.1.78.

1:38We'll go directly to it, and the user account is admin.

1:40And then we'll go ahead and click right here on Connect.

1:43So the first time we're connecting is saying,

1:44hey, I've got this host key, and it's

1:47different from the last one.

1:49And the reason for that is my fault.

1:51I had previously set up a FortiAuthenticator

1:53and connected to it at that IP address.

1:55And so now, I'm connecting again,

1:57and it has a different host key.

1:59So my terminal emulator is warning me saying,

2:01you know what?

2:01That's not the same host key.

2:02Do you want to continue?

2:03So I'm going to say, accept and save,

2:05and it's asking me for the password, which

2:07is the password we set during the deployment.

2:09I'll click on Save that password,

2:10make it easier in the future, and click on OK.

2:13So there we go.

2:14There's our SSH prompt right there

2:16at the FortiAuthenticator.

2:18So what can we do here?

2:20Well, we can do a show config, and that

2:22will show us our configuration on this device.

2:23In fact, let me make this a little bit wider,

2:25so it doesn't wrap.

2:26So if we scroll up, here is our static route.

2:29Here is our interface configuration for port 1.

2:32Here's our DNS information right here.

2:34High availability is not currently set up,

2:36so it's disabled.

2:37There's the device name, and there's the fully qualified

2:40domain name that we set up.

2:41All right, that all looks fantastic.

2:43What else can we do here from the command line?

2:45Well, on most Fortinet products, we can use the execute command,

2:48and we'll do a question mark.

2:49And there's a ton of options here that we can execute.

2:52So let's go ahead, and let's execute a ping out to 8.8.8.8.

2:56This will help verify internet connectivity, and that's great.

2:59So some Fortinet products, they will ping five times,

3:02and they'll stop.

3:03And this one is more like a Linux box,

3:05so it's just pings until you do a Control+C. So that works.

3:08Then we want to try DNS.

3:09We can do a ping to www.fortinet.com.

3:14Says, Keith, where's the execute command?

3:16I forgot.

3:17E-X-E-C-U-T-E ping.

3:20That's better.

3:21So name resolution is working using the DNS

3:23servers that are configured.

3:24And we could also use some additional DNS tools

3:26like execute nslookup, looking for www.fortinet.com

3:32So that's fantastic.

3:33The nslookup tool, we could also do an execute dig

3:37for www.fortinet.com.

3:39Also great.

3:40And we can also do execute, and let's do a question mark.

3:44And there's traceroute.

3:45So let's go ahead and issue traceroute to www.fortinet.com.

3:49Then I'm going to do a Control+C to stop that.

3:52So this is showing us each of the routers in the path.

3:54So the first router is the default gateway at dot 1,

3:57and then it went off to 10.72.96.1, which

3:59is my service provider network.

4:01And then it went off to 100.127 et cetera,

4:03et cetera, et cetera, on its way towards 54.177.212.176.

4:09And if we do a show status and press Enter,

4:12that shows status command that we just issued right here.

4:15It looks and feels a lot like the output that we

4:17did earlier of show config.

4:19So the main point here is to verify and confirm

4:22that our SSH is working from our management computer.

4:25And that way, in the event we need to go and do

4:27something really quick and easy at the CLI,

4:29we'll have access to it.

4:31And also, it may or may not be part of company policy

4:33to allow your terminal emulator to store passwords for logging

4:37in.

4:37So in the event that you are allowed to do that

4:39and you have your password stored in your terminal

4:41emulator, it'd be very important,

4:43of course, always, to lock your console on your computer,

4:47especially your management computer whenever you're not

4:49directly right in front of it.

4:50And in the next video, I'd like to chat with you

4:52about setting up an alternative path to the internet

4:55instead of just this 192.168.1.1, which is currently

4:59the next hop for the default route

5:01on the FortiAuthenticator.

5:02So we'll take a closer look at that in the very next video.

5:05Until then.

5:06I hope this has been informative,

5:07and I'd like to Thank you for viewing.

0:00[AUDIO LOGO]

0:06In this video, I'd like to walk you

0:07through the logic and the steps of modifying the default route

0:11on the FortiAuthenticator.

0:12So currently, the FortiAuthenticator

0:14has a default route of this that says, use 192.168.1.1, which

0:21is this router right here.

0:22Now, on some platforms there is a concept called distance.

0:26And here's how the idea of distance works.

0:28On the route that uses the next hop of 71,

0:30we say the distance is 10.

0:31And for the default route with the next hop dot 1,

0:35the distance is 15, and it's like value shopping.

0:37It's going to use the one with the lowest

0:39administrative distance first.

0:41And if that's not available, it'll

0:43then go and use the other.

0:44And using a concept like distance

0:45and then probes to validate those next hops are available,

0:48you could then have some fault tolerance

0:50built in to your default route.

0:51Now, that is if the device supported

0:53the concept of distance, which the FortiAuthenticator does

0:56not.

0:57So for this video, let's do this as a plan.

1:00Let's imagine this firewall up here as part of an HA pair.

1:03So there's actually a couple there.

1:05They also could have multiple egress or outbound interfaces

1:08going to the internet with SD-WAN.

1:10And if they do, they would be a better choice

1:12as far as the next hop for a default route.

1:14So here's what I propose we do.

1:15Instead of using dot 1 down here,

1:18which is a single router, let's go ahead

1:20and modify the default route with the next hop

1:22of 192.168.1.71, which represents this HA pair here

1:27in our imaginary scenario, where it is HA and fault tolerant.

1:31And then we'll make sure that the firewalls

1:33are allowing the FortiAuthenticator

1:36to access the internet.

1:37So that's going to involve some network address translation

1:39and also some permissions so that the FortiAuthenticator can

1:42reach out to the internet for things

1:44like DNS, time synchronization, port guard, and more.

1:47So with that in mind, let's go to the FortiAuthenticator

1:49and change the next hop for its default route over to dot 71.

1:54So here's our 40 FortiAuthenticator,

1:55and let's also bring up a command line.

1:57And before we start changing the next hop for the default route,

2:00let's just verify with the execute

2:02that we can ping www.fortinet.com.

2:06And that works like a champ.

2:08So we'll do a Control+C. And let's go to Network.

2:10And under Network, we'll go to static routing,

2:13and let's change our next hop by double-clicking on the default

2:16route and changing the next hop to dot 71, which is the IP

2:20address of the FortiGate.

2:22And as I look back over my shoulder right there,

2:25that is a physical FortiGate, and it's not powered on.

2:28So give me a moment.

2:28Let me go ahead and power it on right now.

2:30All right.

2:31So it is powering on.

2:32It'll take just a few moments for it to initialize.

2:34And then once it's up, I also want

2:36to verify from the FortiAuthenticator

2:38that we can actually ping that IP address of 192.168.1.71.

2:44And while that continues to initialize,

2:46let me go ahead and save this change right here.

2:48We'll click on OK.

2:49So now, our default route has a next hop of 192.168.1.71.

2:53And let's go to the CLI.

2:55So this is the CLI for the FortiAuthenticator.

2:58Still show config.

3:00Press Enter.

3:00This also confirms that our next hop for the default route

3:03is set to dot 71.

3:04So here, let's go ahead and do an execute ping

3:07to 192.168.1.71.

3:11Press Enter.

3:12And the firewall is still powering on,

3:15so I'll give that in just a moment.

3:17And when the ping start coming in-- there we go.

3:19Now that the pings are coming in,

3:20we know we have reachability.

3:21Let's do a Control+C, and let's hit the up arrow key a few

3:24times and do a ping two for fortinet.com.

3:26And the problem now is that we don't

3:28have the permissions and the address translation set up

3:31at the FortiGate to allow the FortiAuthenticator to reach

3:34the internet.

3:35So let me do a Control+C. Let's take a look at our topology,

3:38and let's finish the config.

3:39So what we need to do here at the firewall

3:41is we need to specify that we want

3:43to do address translation for traffic

3:45coming from this FortiAuthenticator, which

3:48is a dot 78.

3:49And we also need to set up permissions at the FortiGate

3:51to specify that traffic from the FortiAuthenticator

3:54is allowed to go out to the internet.

3:56So let's go to this firewall, which is firewall 1,

3:58and we'll add those configs.

3:59All right.

4:00So this is firewall 1.

4:01It says, I can't connect to the FortiGuard servers

4:03because it just powered up.

4:04We'll give it a few minutes, and it'll

4:05be able to connect to them.

4:07So to start off, we'll go down to Network

4:09as well verify interfaces that I've

4:11got the appropriate interfaces set up and what they are.

4:13So I've got internal1.

4:15That's the physical interface.

4:16They have a VLAN10 logical interface,

4:18and that's the one right here at 10.10.0.71.

4:20That's when we pinged just a few moments ago

4:22from the FortiAuthenticator.

4:24And then the outbound interfaces are WAN-A and WAN-B, which

4:27are part of an SD-WAN zone.

4:29And if we go down to System and Settings--

4:32I just want to confirm how this firewall set up.

4:34So it's currently set up with centralized source NAT

4:36and also next generation firewall mode of profile-based.

4:40All right.

4:40So let's go to pulsing objects, and we'll

4:42go to Central Source NAT, and let's do the NAT first.

4:46So we don't have any NAT rules here that deal

4:48with these source address space of 192.168.

4:51So let's go ahead and create new,

4:53and the incoming interface would be internal1.

4:56If we hover over that, there's the IP address.

4:58Fantastic.

4:59And the outgoing interface would be--

5:02no.

5:02It could be WAN-A or WAN-B because those are

5:06both part of the SD-WAN zone.

5:07So we'll go ahead and grab both of them.

5:09And I want to lock this down just to the FortiAuthenticator.

5:11So we're going to click here on Create.

5:13And we'll create a new address object, and we'll call it FAC.

5:16And its IP address is 192.168.1.78,

5:21and we'll put a slash 32 to match on exactly

5:24that specific IP address.

5:25And the interface is internal1.

5:27We can verify that by looking at the IP address.

5:29And we'll click on OK.

5:30And then we'll go ahead and add that as the source address.

5:33And for the destination, if it's going anywhere,

5:36meaning, anywhere on the internet,

5:37we want to go ahead and do overloading

5:39on the outgoing or egress interface on the FortiGate.

5:42So we'll click on OK.

5:44And now, we have our NAT rule set up.

5:46Next, let's set up permissions by going to Policy and Objects,

5:49clicking here on Firewall Policy.

5:51And we'll create a new policy that lets

5:52the FortiAuthenticator go out.

5:54So we'll say, FAC_to_Outside, and the incoming interface

5:58is going to be internal1.

6:00And the outgoing interface is going

6:02to be any interface in our SD-WAN zone.

6:05If we hover over that, that's WAN-A or WAN-B.

6:07And the source, fortunately, we have an address

6:10object we just created.

6:11So we'll hover over FAC, and that's it right there.

6:14And the destination is going anywhere on the internet.

6:18And for the service, we'll allow any type

6:20of service or protocol, and the action

6:22is to go ahead and allow it.

6:23And we'll click on OK.

6:25All right.

6:25So now, that we have our centralized source NAT

6:28setup for the benefit of our FortiAuthenticator

6:31and we have a firewall policy that's permitting that traffic,

6:34let's go back to the FortiAuthenticator

6:36and verify that we can get out to the internet.

6:38So back to the FortiAuthenticator we go.

6:40We'll go ahead and log back in, and I'm also

6:42going to take a moment.

6:43And go under System and Administration

6:47and System Access.

6:48And I'm going to change the GUI idle timeout to something

6:51longer than five minutes.

6:52I'm going to make it 200 minutes and click on OK.

6:56And that way, it won't time me out quite as often.

6:58We'll go back to Dashboard, Status,

7:00and let's go back to Network Interfaces.

7:02So we have the IP address of dot 78.

7:04Under static routing, our next hop

7:05is 192.168.1.71, which is the FortiGate.

7:08So back at the FortiAuthenticator,

7:11if we do the ping, again, out to fortinet.com,

7:14so name resolution is working.

7:15Connectivity is working.

7:16And that is now going through the FortiGate, which

7:19with its probes and its fault tolerance, very likely

7:22has a better option of being up and available

7:24compared to our next hop at 192.168.1.1.

7:28So the great news is that we now have our FortiAuthenticator

7:31deployed as a VM.

7:32It's got an IP address.

7:34It can be reached via SSH and the GUI.

7:36It's got a default route using the next hop as the FortiGate,

7:40with some fault tolerance up there as well.

7:42And that puts us into perfect striking position

7:44to start putting this FortiAuthenticator to work

7:47to see what it can do.

7:48And we'll continue that journey in our next set of videos.

7:51And I look forward to seeing you, my friend,

7:52in those next videos very, very soon.

7:54Until then, I hope this has been informative,

7:56and I'd like to thank you for viewing.