Understanding FortiADC and Initial Configuration

0:01(thoughtful music) Hello and welcome. My name is Keith Barker, and in this set of videos, you and I are going to focus our attention on two basic things. Number one is, what the heck is an application delivery controller? And more specifically, the offering from Fortinet called FortiADC, application delivery controller. And then secondly, we're going to take a look in this set of videos at how to deploy and do the initial, like the initial bootstrap configuration of placing this appliance in our network.

0:32So I'll see you, my friend, in the next video, we'll take a big picture look at the concepts of an ADC. I'll see you there in just a minute.

0:00(bright music) In this video, you and I are gonna take a high level look at the concepts behind an application delivery controller or ADC and the offering from Fortinet called FortiADC. So let's begin with the acronym for ADC, and that is application delivery controller. And the product that does this from Fortinet is referred to as the FortiADC. And so to really appreciate an application delivery controller, let's imagine this cloud over here represents the internet/ And our access to the internet is very likely through a router from a service provider, and our access to that service provider may be through DSL or ethernet or coax.

0:42And so our connectivity that comes from that service provider would very likely go at some point to a firewall. In the case of Fortinet, that'd be the FortiGate firewall. And then behind that firewall, we could have a demilitarized zone with public facing servers. We could have our internal users and their networks. So represent those as represent the network for our servers that are public facing, like DNS and web services. And this can represent our internal users and their networks. So I'll refer to this part right here as the DMZ and this orange part as our internal network. Then I'll put some hosts there as well.

1:13And again, this could represent multiple subnets and multiple computers on those subnets and that appear in the DMZ. We could have our servers. And just for fun, let's go ahead and put three servers up there. We'll put one that's a red server and we'll put a green server and a blue server, or server one and server two and server three. So if we have a customer out on the internet, I'll just call this guy a client, that needs to access one of those web servers, what the user at that computer would do or could do is put in a URL like www.thissite.com, which gets translated through DNS to an IP address.

1:49So that's the fully qualified domain name. So the client does a DNS lookup, finds out what the IP address is, and then makes their request to the IP address of the server. Now, if the client makes a request to the server, it's gonna go to server one or server two or server three based on the IP address it was going to. Now in DNS, there are some games that we can play there as well to help even the load across these three servers. One of those options is to round robin the responses. So let's imagine we have server one's address and server two's address and server three address in DNS that all mapped to the same exact name, say www.example.com.

2:24So if multiple clients are trying to access resolve www.example.com. DNS could respond with the first IP address and then next with the second IP address, and then to the third client, the third IP address in a round robin type of fashion. And that could help to sort of load balance the requests, assuming the content on these servers is all the same across the servers, and that we don't have one server like 90% utilization and the other two with the exact same content, for example, at like five or 10% utilization. However, there's a lot of caching that goes on in DNS. That's not a perfect scenario.

2:56So another option to help distribute the load across these servers would to go ahead and use something called an LB, which is an acronym for load balancer. And the most typical type of a load balancer is a layer for load balancer. So if we use a load balancer, here's how it would change. We would remove this link between the FortiGate or the firewall and the servers and we would insert an appliance. And that device would be either a load balancer or a more intelligent device called an application delivery controller, which is like a load balancer, but also has the ability to make intelligent and more intelligent decisions about forwarding traffic to a specific server based on a set of conditions.

3:32So the firewall would connect to this load balancer/application delivery controller, which would then connect to this network where the servers are. And then in DNS, instead of having three different IP addresses, we can have one IP address and that one IP address is being managed or mapped here at the application delivery controller. There's also some options we can play with at the firewall here regarding source and destination app. We'll take a closer look at that in our other sets of videos. But the basic concept regarding a load balancer/application delivery controller is that when users now resolve example.com to an IP address, they go to that specific IP address and that IP address lands them right here at the load balancer/application delivery controller.

4:10And then depending on what type of device this is, whether it's a simple load balancer or it's a more advanced application delivery controller, this device is then gonna forward traffic to the servers based on a set of rules and policies. So at this point you might be thinking, well, a load balancer/application delivery controller sound pretty similar. So let's just detail for a moment a few of the differences. With a load balancer, and I'll go ahead and just write the acronym here, LB, most of the time it's implemented as a layer four device looking at TCP or UDP or the layer four protocol that's in used and tracking and matching based on that. And one of the challenges with a traditional layer four load balancer is that it doesn't have visibility.

4:45It doesn't know, or care I should say about what's being carried in the actual payload. I mean, is it SSH traffic? Is it SSL/TLS traffic? Is it some kind of file transfer protocol? Is it streaming traffic? What is it? A basic layer for load balancer really isn't paying attention to any of the application layer service and as a result, it can't make decisions based on what type of application's being used. For example, HTTPS versus RDP, Remote Desktop Protocol. Another characteristic of a traditional layer four load balancer is that it can do some basic health checks.

5:17And here's what I mean by that. Assuming we have these three servers here, if one of these servers is not up, we probably don't wanna take the client's request coming in and forward that request to a server that isn't up and running. So a basic health check would be like a ping request or something very basic that the load balancer can send back and forth between it and each of the servers periodically just to verify that they're up and reachable. So basic health check, I'll finish that thought there. Another basic functional load balancer can do is that if we have a client that has made a request to example.com and the load balancer forward that request to server one, there's a concept called persistence.

5:54And the concept of persistence is pretty important because if we a user that's gone to www.example.com, that traffic was forwarded to the load balancer, the load balancer decided that server one based on the conditions that were in place, should be the server that gets the request. If the client is interacting with server one, we don't all of a sudden just outta blue, wanna have the load balancer on a next few packets, send those to server two or server three, because server two or server three may not have any clue about what was going on between the client and server one. So with persistence with a traditional load balancer, that persistence is gonna be based on the source IP address of the client coming in.

6:29So if this client's coming in from 24.9.8.17 and it was sent to server one, subsequent packets that are coming in would also be forwarded to that same server and the load balancer's tracking based on that source IP address. So I'm gonna call that basic persistence based on IP. So in a brand new client, it connects to www example.com and comes up to the load balancer. As far as which server is gonna be chosen by that load balancer, there are some basic algorithms. It can be used like how busy is each server and maybe we forwards the traffic to the least busy server at that moment.

7:04But those algorithms that are deciding on which server, they're pretty basic as well. So now lemme go ahead and draw a line right here and let's talk about an ADC and what it can do. So effectively, an application delivery controller can do everything the load balancer can do, but a whole bunch more. I have a plus symbol here because everything here is gonna be what the load balancer can do and these additional features. It can also do application layer inspection and be aware of the application. So if we have a client coming in and they're using a specific application like HTTPS and we have a specific server or groups of servers that we wanna handle that specific type of application, the application delivery controller can steer and direct that traffic to the appropriate server and not just randomly pick a server based on availability.

7:50With the FortiADC, it also has the option of doing the application delivery controller based on layer two information as well. And again, these are in addition to what a traditional load balancer can do. So the ADC can do layer seven, layer two, as well as layer four. The application delivery controller also has a security component built into it to help protect against things like viruses and malware or malformed requests that are trying to reach the servers. Those can be stopped at the ADC. And because the ADC has visibility into what's happening at the application layer, they can do content based routing or forwarding to a specific server based on the type of content.

8:26So we could have two different clients, they're both going to example.com, and the ADC, depending on the type of request that was being made, the ADC could then forward it to one of the servers or one of the groups of servers that's managing and working with based on the application that's being used. Another addition would be advanced health checks. And here's an example, a traditional load balancer could send a ping message like every few seconds just to verify the server responds. But that doesn't really mean that the actual web service is running, even if it can respond to a ping. So an advanced health check could do something like connect and make an HTTP request or an HTTPS request and verify there's a proper response, or it could do an FTP request, look for a certain file and be very granular to verify that the servers not only reachable, that it also is functioning.

9:12Enable to provide the network services that are intended before forwarding a client over to it. So if a server goes belly up or has a problem or isn't responding, or a process dies that's supporting the web services, the application delivery controller could sense that based on the advanced health checks and say, "You know what, until you're better, I'm not gonna forward any new request to you." And then we can look into why that server isn't running or what's the problem. But meanwhile, we're still providing the content from the other remaining servers. Another feature on the application delivery controller is something called SSL offload.

9:42'Cause in the past, when a client is connecting with the server, that whole SSL/TLS set up and negotiation and the encryption decryption has to be done by the client at this end and the server at this end. But with SSL offload, we can have our application delivery controller actually terminate the SSL/TLS session, perform the actual CPU cycles for that process, And then it can go ahead and interact with the server on the back end here in the private data center using something like HTTP. And that way we're offloading the SSL/TLS work from the actual server itself so it can focus on the application and not the SSL/TLS.

10:17Now, a word of caution there too is that if we're implementing the application delivery controller on software as a VM, we'd wanna make sure we properly size that and make sure it has enough CPU and oomph to go ahead and pull that off. If it's a dedicated hardware appliance, we'd wanna make sure that we have the hardware model that's gonna support the volume of traffic we expect if we're use the SSL offload feature. So let me clean up a little space here and let's talk about a few basic options for actually deploying the ADC. All right, I'm almost cleaned up here.

10:48Let me clean up a little bit more. So our options for deploying this appliance, this application delivery controller from Fortinet, involves either hardware, a physical appliance that we'd place in our network, or we could do it with software as a virtual machine. And if we have servers that are in the cloud, we also have several cloud options as well. So if we're implementing the FortiADC locally on-prem as a VM, one of our options is VMware's hypervisor, which is ESXI. Or we could use Citrix or Microsoft's HyperV or KVM.

11:21And if we're implementing it locally on-prem, it's often best to have a bare metal or type one hypervisor to get the most CP resources available for the application delivery controller. If we're implementing the FortiADC in the cloud, there's support for AWS and Azure and Google Cloud and others. In environments that we can't afford downtime, there's also support for high availability. So we could have our ADC number one and ADC number two and then link them together, so if one fails, the other one can keep on going.

11:51And the most traditional way of implementing this application delivery controller, whether it's hardware or software, on-prem, is in a mode called routed mode. So an example of that, we would have one subnet here, for example, let's say it's the 10.10 network, and then another network over here, the 10.20 network, and maybe our application delivery controller has the IP address of .73, and we simply train all of our servers that their default gateway is .73. And that way when our client is trying to access our network resources over here, that traffic goes to the ADC, then the ADC can forward it to the appropriate server based on the rules and policies and the content that's being requested.

12:27And then whichever server gets that request, when it forwards the response, that also is going through the ADC, which can then be forwarded back to the client. And as we finish up this overview of the basic concepts of the logic behind a FortiADC and how it fits in the network, I also wanna point out the concept of a virtual server. And that virtual server is being supported and maintained here on the ADC, and that virtual server is gonna have an IP address. So when the customer is going to www.example.com, that can resolve to the IP address of the virtual server, which would cause the traffic then to be forwarded over the internet to the application delivery controller.

13:02And then the ADC can forward it to one of the real servers. So I'm gonna put over here real servers. And as far as the actual IP dressing goes, do these have to be private or public? We have lots of games that we can play both here at the application delivery controller and also at the firewall that's between the application delivery controller and the internet. And so as we proceed through other sets of videos together, on the same topic, we'll cover more details about that as well. In this video, we've taken a big picture look at the concept of an application delivery controller. Now, prior to putting one in the network and doing the basic installation, we probably should have a plan in place.

13:38So in the next video, let's put a basic plan regarding a topology where we're gonna put the application delivery controller, and then I'll walk you through in the subsequent videos and it set the basic configurations at the CLI and at the GUI that can put that application delivery controller in the network and provide basic connectivity as a framework for building on top of that and putting the ADC to use. So I'll see you in the next video for exactly that. Until then, I hope this has been informative and I'd like to thank you for viewing.

0:00(upbeat bright music) Many years ago, back in the nineties, in fact, I worked at Paramount Pictures, had a great time there. And one of the jokes that was on the, it was a little cartoon on the wall, and it had a bunch of programmers and one of them said, "Hey, you guys start coding and I'll go find out what they want." We should have a plan in place before we start creating something. So prior to deploying this FortiADC in a network environment, let's go ahead and draw out a plan regarding IP addresses, where it's gonna go in the network, and then based on that plan, in the remaining videos, I'll walk you through step by step, the basic deployment of a FortiADC on a network.

0:39And one of the secrets behind a good recipe, for example, like for food, is having all the proper ingredients. So we also wanna make sure we're gonna take a minute here and make a list of those things we're gonna need to make this happen. So I'll label this as recipe. So first and foremost, I'm gonna be using the VM version of the FortiADC, and so the platform I'm gonna run that on is ESXi, and that is from VMware. So I currently have a few servers behind me and they're good to go. They're running ESXi version 7.x. So that'll be the type one hypervisor that'll be supporting our FortiADC VM.

1:14We'll also need the image, which we'll need to download from Fortinet. And one of the cool things is with the FortiADC, when you download the image for that and deploy it in an ESXi environment, they give you 15 days with all the bell, well with most of the bells and whistles. Not all of them, but most of the bells and whistles. So you can go ahead and practice and work with it, which is fantastic. And then within ESXi, I've also got carved out, I've got a VLAN number 10 that we can use. And also a VLAN number 20. And the way you carve out the VLANs on the hypervisor, it varies a little bit based on the hypervisor that you're using.

1:48And so if you have more interest in ESXi and VMware and vSphere, please feel free to check out our other courses here at CBT Nuggets on VMware's vSphere. But for now, I just wanna make a note that I have those available and ready to go in my ESXI virtualized network environment. All right, so let's draw our topology and I'm gonna go ahead and put the internet right here. There it is. I know. I thought it was bigger too. And then we're gonna have a service provider router here. I'll put R there, I'll put SP for service provider. And for my network topology, this is going to be the 23.1.2.0 network with a 24 bit mask.

2:25And truth be told, that 23.1.2 address space is not, (laughing) it's not mine, I just have it set up in my network. And then here, at this little router, which is emulating the service provider router, it actually has NAT a few times between it and the real internet for that connectivity. But for the purposes of our implementation, we'll just presume this is a reachable workable 23.1.2 address space that is reachable over the internet. And with the help of a little NAT and PAT, it is. And then here I've got a little firewall. It is firewall one and it is a FortiGate.

2:56This firewall has an IP address .71 on all its interfaces. Our next device in line is going to be the FortiADC, and I'm gonna use the .73 address on all of its interfaces. And then for the network between the firewall, the FortiGate and the FortiADC, as far as our plan goes, let's go ahead and use VLAN 10 right here. So that's VLAN 10, which we'll go ahead and map that to the 10.10.0.0 address space with a 24 minute mask. And so this firewall on that interface and that VLAN is gonna be a .71 and the FortiADC is gonna be a .73.

3:30And if we wanna set up high availability, I'll go ahead and simply put a little shadow here of a second FortiADC, and that could be like for example, .74 or some other available address. And then we can set them up as a HA pair. And that way if one of the FortiADCs has an issue or problem, the other could take over. So that little shadow represents a second FortiADC, in the event we wanna implement high availability. And then going to our actual servers, we're gonna go ahead and let's use the network of VLAN 20. And for our lab, I'm gonna go ahead and use the address space of 10.20.0.0, where the second octet here matches the VLAN number, just to clarify where stuff is.

4:06So this would be our network, where we could have our public facing servers. So let's put server one and server two and server three. So I'll label this up here as servers one and two and three. And they're all connected or will be logically once I have it all set up, they'll be all connected to this VLAN 20, which is the 10.20.0.0 network and the mask on that'll be a /24. And for IP addressing here, just for clarity, let's go ahead and label it here with .1, .2 and .3 And so the default gateway for these three devices would be .73 on the 10.20.0 network.

4:43Now also, while we're putting this plan together, let's also plan on which ports to go ahead and use over here on the FortiADC. So I'm gonna remove the little shadow here for the HA. And for the interface facing towards the firewall, let's go ahead and use port number one. And for the interface on the FortiADC that's facing the actual real servers, let's use port number two. And that also brings me to the question of which interface do I wanna use for managing that device? And let's use port number 10. So the VM has 10 logical interfaces by default.

5:15So let's go ahead and use port number 10 as the management interface. So I'll draw this down here and just put a little note that this is management. And then management network is 192.168.1.0 with a 24 bit mask. And so this device here on this port 10 would be .73 once we have it initially bootstrapped. So the management computer I'm gonna be sitting from is on this management network and that way I can get to and work with the FortiADC. I also can manage this FortiGate firewall, also from that same management network. So it also has a interface on the management network as well.

5:48So I'll put that right here. And the beautiful thing is that whether we're using physical appliances or virtual machines for either the FortiADC or the FortiGate, the logic is the same. So in my lab environment, this FortiGate is actually a physical firewall that's connected as shown here. And the FortiADC that we're gonna deploy here in a moment together, is going to be the virtual machine that we're gonna download from Fortinet. So I'm gonna take a screenshot of this so that we can refer back to it as we put all these components together. And if we look at our laundry list, I've got the ESXi host sitting behind me ready to go.

6:21And what we need is the image for the actual FortiADC. So in the next video, let's do this. In the next video, let me walk you through logging on to Fortinet's website and downloading from Fortinet the eval image that we can use to deploy in our sample network right here. So I'll see you in the next video for exactly that. Until then, I hope this has been informative and I'd like to thank you for viewing.

0:01(gentle music) One of the core pieces that we identified in the previous video was that if we want to deploy the FortiADC VM we have to have the image. So in this video, I'd like to walk you through obtaining that image from Fortinet. So let me go ahead and bring in a browser and we'll go to support.fortinet.com. And here we are at support.fortinet.com. And I'm gonna go ahead and log in. So I'll click here on Login.

0:31So I supplied my username and password. I've now logged in at support.fortinet.com. And to get the VM image for FortiADC, we'd click right here on Support. And from the dropdown menu here, we'd go to VM Images right here. So we'll click on VM Images. Over here on the left, it's asking us to select our product. So we wanna select the FortiADC. And then I'm gonna select the platform. So I'm gonna deploy this on VMWare's ESXI. So I'll choose that from that dropdown on the platform, VMWare ESXI.

1:02And then I want to download the latest version. And as of right now, it is this version right here, 7.1. So with that selected, over here on the right, I have a couple of options. Now, this first one here, the FORTINET.out, that is if we want to upgrade, for example, the firmware from one version to another, but for a brand new deployment on a VMWare platform, we want the one that has OVF in the title. So here's FORTINET.out.ovf.zip, and that's the one we want. So I'm gonna go ahead and click on Download right here. And as we speak, it's now downloading to my, in my case, to my Downloads folder.

1:35And we'll take a look at that once it's done. All right, the download is complete. Didn't take long. Let's go take a look at that folder. So I'll right-click, it'll say, please Show in Folder. And here is that folder, my Downloads folder. And I'm just gonna go ahead and unzip it right here. So I'll right-click and, from the dropdown, click right here on Extract All. It's gonna create a new folder, the same name as the zip, and then put all the extracted files in that folder. I'll click on Extract and it is done. So there's my downloads folder, there's the new folder just built. Here's this additional folder under that, we'll open it up.

2:07And then I've got two VMDKs, those are hard disk files, and I have three OVFs and those are four various versions of the hardware. So in a VMWare environment, a larger number after the letters HW implies a newer or more current version of virtualized hardware. So I'm gonna go ahead and we're gonna deploy hw13 from this file along with the two disks. So now that we've downloaded the FortiADC VMWare files, our next step is to go ahead and deploy it. And that's exactly what we'll do in the next video. So I'll see you there in just a moment.

2:38Until then, I hope this has been informative and I'd like to thank you for viewing.

0:00(inspiring uplifting music) In the previous video, we took a road trip up to fortinet.com, and we downloaded the 40 ADC image, and it's now, in this video, that we're gonna deploy that as a brand new VM in VMware's ESXI. So just as a quick reminder, mostly to myself, of where ports are gonna go on this brand new FortiADC that we're about to deploy. Port number one we're gonna place in VLAN 10, port number two, we're gonna place in VLAN 20 in my ESXI environment, and port number 10, I'm gonna place in my management network.

0:36So we could make those changes after the fact, after we deploy it, but if we do it while we're deploying it, they'll already be in the right places. So let's go to the console for the ESXI for the hypervisor, and let's do the implementation of this 40 ADC virtual machine. Alright, so this is the console for managing an individual ESXI host. Another option would be to use the vCenter server if we're managing multiple hosts, but in either case, the logic is the same. We're gonna deploy a brand new VM. So I'm gonna go down here to virtual machines, and take a look at currently what's powered on.

1:09Fantastic, and let's go ahead and click here on create/register a VM. Then it's asking me how I'd like to do it. And since we have the format, OVF is the Open Virtualization Format, since that's the format that Fortinet provided for us, it's gonna be super easy. We'll simply select that, deploy a virtual machine from, an OVF Open Virtualization Format, and then click on Next. And it's asking what do we wanna call this? And this is the name, it's just gonna be recognized as in ESXI. So I'm gonna call it 40, ADC, and dash one.

1:39Then I can click here to go ahead and find those files, or I could drag and drop 'em. In fact, lemme just go ahead and click here. And that brings up this little explorer window. So I'm gonna go ahead and select Hardware 13 for the OVF. And then with my Control key, press down on my Windows computer, I'm gonna grab this first disk and the second disk, so all three are selected, and click on Open. So basically it's gonna create this brand new virtual machine from these two hard disk files, and the configuration file here in this OVF. And then we can just click on Next to continue. Next it's asking about what disk space do we want to use?

2:11And so I've got some network attached storage here, and it looks like I have some additional local storage I'm gonna use; oh look at this. I've got almost a terabyte right there and it is SSD. So I'm gonna go ahead and use that plenty of space there, and click on Next. I'm going to agree to the license agreement. Click on Next, and now is where I'm gonna specify the network mapping. So based on our plan, port number one, lemme take a look at our plan real quick. I need to confirm. So port number one will be VLAN 10, port number two, VLAN 20, and port 10 will be my management network.

2:45Alright, got it. So currently, VM Network 10 is already there, so that's fantastic, and I'm gonna put the others in a parking lot. Effectively it goes nowhere just to make sure they're not accidentally being used. So parking lot is a port group here on my ESXI host that effectively has no interfaces going anywhere else. Alright, and then for port number one, I want that to be in VLAN 10 and port number two, I want it to be in VLAN 20, which is right here. So in the VMware environment, these are just names for port groups that are associated with those respective VLANs.

3:18The actual IP dresses won't become a real thing until we actually configure IP dresses on the interfaces on this VM. All right, then for disk provisioning, I'm gonna go ahead and leave it as thin. That way it only ties up as much physical resources on the disk, on the host, that it is actually using. So if it creates this huge hard drive, it won't really take up all that space if it's not using all that space. And then I'm gonna have it power on automatically. I'll click on Next. It's asking me to confirm and that looks good, and I'll click on Finish. Alright, it is off to the races and right there is our bad boy, 40 ADC-1, so it's powering up.

3:54It may take just a few moments to fully initialize, and it looks like it is done. I got a little thumbnail here of what the screen looks like for that bad boy. And this puts us in perfect position for our very next step. And that is to take a look at the first contact with this device at either the CLI or the GUI. So let's start with the command line interface, the CLI, and we'll do that in the very next video. So I'll see you there in just a moment. Until then, I hope this has been informative and I'd like to thank you for viewing.

0:00(gentle music) Now that our FortiADC is a living, breathing VM, if they live and breathe, but it's actually running inside of our ESXI environment, our next step is to make initial contact with it, how you do it and configure it, and one of the first steps of doing that is using these CLI, the command line interface, and in this video I'd like to walk you through options for that and the demonstration of doing exactly that. So let's imagine this is our FortiADC right here, which in our topology is sitting right there.

0:32If this was a physical appliance, we could connect to it via a serial cable to its console port. And if that was the case, we'd set our terminal emulator to be 9,600 bits per second, no parity, eight data bits, one stop bit, and boom, away we go. Putty, Terra Term, SecureCRT, MobaXterm, et cetera. Whatever we wanna use, that's how we can initially get to the CLI. And the default username on the FortiADC is admin, and the password is blank, meaning we just don't have to put anything in initially to go ahead and connect.

1:04So when we log in the first time, it's gonna ask us to set a password, at which point, once we set the password, we then go ahead and use that going forward. But again, the default is, username of admin and no password at all. Now in the event we are dealing with a FortiADC that is a VM, like the one we have here, we don't have a physical console port. So another option of getting to the command lane interface would be through the hypervisor. In our case, we're using ESXI. And so, the hypervisor could provide us a window to the actual console for this device. So again, depending on the FortiADC model, we have an option A console port, if it's a physical device, we have option B, if it's a virtual machine.

1:42Another option though, is we could connect to an IP address on one of these interfaces. And port1, by default, has the default IP address of 192.168.1.99, and it has available on that HTTPS, so we could use a browser to connect there. It also has SSH setup, so we could log in via SSH to go ahead and connect to that. Now, the problem, I did this to myself. Oh, ouch. The challenge here is that port1, this guy right here, we have placed that in VLAN 10, and my management computer is out here in a different VLAN at the 192.168 address, so initially, if we wanna get this thing up and running and manageable over an IP address, I need to use a console option.

2:26So I can't use this, 'cause it's a virtual machine, but I can use the hypervisor console to go to this device and use a few basic commands at the CLI to go ahead and change the IP address on port10 to be 192.168.1., and I'm gonna go ahead and set it to our plan of 73 and then I can manage it from that point. But until I get the right IP address on the right interface, I can't use this default on port1 because I have no access at the moment from my management computer and my management network over here to this address space.

2:57I will eventually, but at very moment I don't. So, let's go ahead and use the hypervisor console option and we'll go to the CLI here on this FortiADC and we'll set up port number 10 to have the IP address of 192.168.1.73. Alright, so to the hypervisor we go and they sort these based on their state. There is our FortiADC, and I'm gonna right click here on this little thumbnail and hover over console, I'm gonna ask it to open up a remote console to that VM, and that is coming up right here.

3:29And it's pretty tiny font right here. let me zoom in a little bit to make it a little bit more readable. Alright, so I'm gonna log in as admin, the default username, and there is no password. It's forcing me to set a password, so I'll set the password. I'll confirm the password, and we are in. So here if we did a show system interface, it'll tell us the story of what's actually going on here. So this command here, show system interface, is gonna show port. So there's port1 with the default IP address of 192.168.1.99, Then we've got port2 and port3, and we can press the enter key to go one line down at a time, or we can hit the space bar to go one page down at a time.

4:04And then there's port10 right there at the bottom. And one of the challenges is, too, because all these interfaces are in the same virtual domain, if I try to use the IP adressing space of 192.168.1.73 on port10, that's gonna mean an overlapping IP address, so I need to go into the configuration for port1 and remove the IP address so I can go ahead and put the right IP address on port10 and that way we can manage it. And that way we can manage it over the network. So I'm gonna type in config system interface, press enter, and let's do a edit port number 1, and I'll do a show, and this is showing me the configuration for that interface.

4:41So for the IP address here on port1, instead of having it set to that 192.168.1, I'm gonna go ahead and do an unset. IP, press enter, and do a show, and it is gone. Alright, so it no longer has that IP address there. So I'm gonna type in end. So now we'll do a config system interface, and we'll do a show real quick just to verify that port1 no longer has an IP address, fantastic, hit the space bar. And what we wanna do is type in edit and port10. And what we're gonna do in this interface, we wanna set the IP address to 192.168.1.73 is our game plan, with a 24 bit mask.

5:15Boom. Also, if we do a show here, what we also need to do here is allow access, if we wanna access this and manage it via HTTPS, or SSH, we also need to tell if that's... So we'll do a set allowaccess. And I'm gonna add https and http and ping and snmp and ssh, and not Telnet, because Telnet and just HTTP all by itself are plain text. Although if we do connect via HTTP, it'll redirect us over to HTTPS, so I'm gonna leave Telnet off the list, press enter, we'll do quick show just to verify that it's set and we'll do end, and boom, we are now good to go.

5:51So we should now be able to access that management interface, which is port10 at the IP address of 192.168.1.73. So lemme bring back a bigger view here. So lemme go ahead and minimize the hypervisor console window here, and lemme bring in a terminal emulator, this happens to be SecureCRT, and lemme make a new connection, and it'll be SSH going to 192.168.1.73. Username is gonna be admin, and we'll click on connect. So this is the first time connecting to this VM with SSH, so I'm gonna go ahead and accept and save.

6:26We're getting the host key, and I'm gonna supply my password here, which is the password I set at the CLI just a few minutes ago. And I'm gonna tell my terminal emulator to go ahead and save this password for future access and click on okay. And there we go. Lemme bring this full screen. So here if we did a get system status and pressed enter, this is showing us the version of software, which is 7.1, shows us that we're using a trial license. It's indicating here when this trial license expires and because we just installed it a little bit ago, that's why expires in just less than 15 days.

6:58Also, there's some limits on the trial license regarding how many CPUs, so if you deploy this and then you try to modify the number of CPUs in the virtualized environment this VM has, it's not gonna like it. Alright, and here's the name of this VM, it's called FortiADC-VM. If we wanna look at the routing table on this device, we can do a command like get router info routing-table all. So port10 that we just configured is on the 192.168.1 network based on the .73 address we just gave it. It also has an IP address on this haport0, which looks like it's coming from APIPA, the automatic private IP addressing range.

7:34But what I noticed here is that we don't have a default gateway, but don't worry we'll take care of that as well. So from here, we can do a show system interface and scroll down to the bottom and confirm our IP address that we're currently connected on. Or we can do a show system interface for port10 and that's a way to go directly to it. Also, we do a show full-configuration system interface port10. So if we do this command here, show full-configuration for that interface, it'll show us these details which are set, plus all the other defaults that are in place.

8:05So we'll press enter and I'll hit space bar, scroll up a little bit. So here is all the configuration that's active for this port10 at the moment, including the specifics that we put in, like its IP address, and what kind of access we'd like to allow. But all these others that didn't show up with the simple show command are defaults for that interface. And to compare and contrast that, if we do this show system interface port10, it just shows us the specific configured elements. So in this video we've made initial contact via the CLI to the FortiADC.

8:35And so what we had to do, we used the hypervisor console access because port1 with its default IP address of .99 on the 192.168.1 network, wasn't reachable by my management computer. So we used the console, but now that we have the management interface, port10, with the correct IP address and we've also verified it by SSHing to it, we can now access device as well using a GUI with a browser to that same IP address. And that's what you and I get to do in the very next video. So I'll see you there in just a moment. Until then, I hope this has been informative and I'd like to thank you for viewing.

0:01(gentle music) In the previous video, we did some initial access and configuration of the command line interface, the CLI. And in this video, we're gonna go ahead and now connect to that management IP address, which is now reachable, by the way, and we're gonna use it with a browser to get the GUI interface, the GUI access, to the FortiADC. So just as a reminder about where we are in context here, we are at a management computer on the 192.168.1 network and we want to manage and work with this FortiADC over its port10, which is configured with the IP address of 10.168.1.73.

0:40All right, so I've connected with the browser to 192.168.1.73. I simply put in the IP address and it redirected me over to HTTPS. And so, let's go ahead and log in as admin and the password we set at the command line, which I still remember, (chuckles) so I'll put that in. Fantastic. And we'll click on Login. So now, it's asking me if I wanna do a few steps, including specify the Hostname. Sure. We'll say Begin. And let's go ahead and call this FortiADC-1 and we'll click on OK.

1:10And now, what it's gonna do it's gonna walk us through the Getting Started wizard. So it's asking me to confirm the System Time right here and my Time Zone. I'm also gonna use NTP, so I'll click that slider to put on NTP. It's gonna use one of the servers from pool.ntp.org. And the Synchronizing Interval, every 60 minutes. That's fine. And we'll click on Next. So now it's asking us about the management interface that we wanna use and Interface 1, Interface 2. So we already specified an IP address for port10. And so, what I'm gonna do here is I'm gonna go ahead and I'm gonna say, "You know what, "I'm not gonna play with that through this wizard."

1:45But if we wanted to, we could set up the IP address here for Interface 1 and for Interface 2 right here in this wizard. I'm gonna go ahead and say Cancel. And that's taking us over here to our System Settings, what we're seeing right here. But let's start off with the Dashboard. So up at the left, I'm gonna click on Dashboard, click on Main, and that takes you to the main Dashboard. So here is the information regarding the system. Here's our widget regarding our licensing information. If we click here on these little three dots, it'll give us the option to see more detail, so we'll click on that. So we can scroll down, take a look at the details there.

2:16If we wanna go back to the main Dashboard, we can do that as well. It shows we have 10 interfaces. If we wanna take a look at the details, we click here on See Detail. So here is port10 that we're using for management and we haven't yet configured the details for port1 and port2, but we will. If we go back to the Dashboard, there's also an option here, in the upper right here, to go to a CLI right from the GUI. So if you're connected via browser and you wanna go to a CLI real quick, you just click on this icon here for the command line interface, and that brings up the command line interface right here within the GUI.

2:47Now in the event that we canceled the wizard or we wanted to change the information we put in the wizard, all that can be done right here through the GUI interface. So for example, if we go to System and we go to System Settings, if we wanted to change the Hostname, we could just change it right here. Here's the Idle Timeout of 30 minutes for demos and stuff. I'm gonna change that to 400 minutes, and that way, it won't time out on me quite as much. Here's the default port for SSH of 22, which is being used. That's fantastic. Here's the Primary and Secondary DNS servers. So that way, if the Primary DNS server doesn't respond, times out, it can use the Secondary DNS server for name resolution.

3:22Also, right here by default, it's enabling redirections to HTTPS. And that's why when I connected initially, I connected just to 192.168.1.73, and 'cause of this option here, it automatically redirected me over to HTTPS. So if we scroll up, if we click here on the Maintenance tab, under System Settings, so the breadcrumbs is System, Settings, and on the Maintenance tab, here it has the System Time. And regarding NTP, I thought I configured that with the wizard. Maybe I canceled all of it. Anyway, if you wanna enable NTP, we can do it right here under System, Settings, Maintenance, and just enable NTP, and then specify the interval and click on Save.

4:00So I think I canceled the wizard earlier so it didn't save any of my changes. Another important aspect for troubleshooting and working with the system is logging. So over here on the left, let me collapse the System Settings here. If we go down to Log & Report over here on the left and we go to Log Settings down here near the bottom. So click here on Log Settings. Here, we can configure what we want to collect. So if we want to enable or disable certain type of logs or we wanna specify the log level, we can do it right here. So for this system, I'm gonna enable everything for Event Category. I'm gonna go ahead and enable all regarding Traffic Categories, for Security, and enable all there, and also for Script Category.

4:37And I'll click on Save. So now, I'm just logging like crazy. And that's regarding the Local Log. If we're logging to Syslog Servers or FortiAnalyzer, we can specify the details there as well. Also, while we're here in the GUI, the default user account, the admin account, is called admin. But if we wanted to create additional accounts, we could. Now, you can't delete the admin account, but you can create additional accounts. So if we go back up to System and under System, we click here on Administrator, this is where we could go to go ahead and create additional administrators. So if we wanted to create a new administrator, we'd click here on Create New, specify administrator, and put in the details.

5:11Also, before we actually create a new administrator, let me show you one other thing. Let's imagine we wanna create a new administrator, but we don't want that new administrator to have full access to everything. What we could do is we could create an Access Profile by going here to System, Administrator, Access Profile, and we can create a new profile that controls what they can do. So if we wanted to create a profile here that had the ability to read everything, but not to make changes, let's go ahead and call this Read-Only_Access-Profile, and click on Save.

5:42Then we could go ahead and create a new admin. I'll go back to the Admin tab, Create New, Admin, and let's call this Jr_Admin. And for the comments, I'll say Read-only Rights. And then for the Admin Profile, specify that Read-Only_Access-Profile that we created, and that's what implements the read-only permissions. And I'll put in a password and confirm the password. And if we have admin accounts that we wanna protect, it'd be wise to do two-factor authentication as well. So we'll click on Save here. Another option here is we can also lock this Jr_Admin account from only being able to log in from certain IP addresses, or ranges of addresses, by modifying this Trusted Hosts column.

6:19So we click on the pencil right here and we say Restrict to hosts. We could say we only want Tim to be able to log in as Jr_Admin if he's coming in from the 192.168.1 network, like that. Click on Save. And now, if he tries to log in from some other subnet, it won't be allowed. They'll have to have the right password and also coming in from that specific subnet. So now, we have basic GUI access via a browser to our FortiADC. But one of the challenges is we only have one IP address on this system that's functional and that's on the management interface.

6:51We don't have IP addresses on port1 or port2 that are needed for our topology. And this FortiADC, at the moment, does not have a default gateway. So we're gonna fix all of that in the next video with network connectivity in just a moment. So I'll see you there soon. Until then, I hope this has been informative and I'd like to thank you for viewing.

0:07Now that we have IP network management access to the FortiADC, we've also verified that via SSH over to the device as well as using a browser with a GUI interface. Our next step is to make sure we have full network functionality with IP addresses on its two interfaces that are gonna be used to forward user traffic. And we also wanna make sure that this device has DNS support and a default gateway. So for our task list, we wanna make sure that port number one and port number two have their appropriate IP addresses. And just for a moment, let's confirm what they are.

0:37So port number one is right there and it should be 10.10.0.73. And port number two, here on the left facing the real servers, it should have the IP address of 10.20.0.73. We also wanna take a moment just to confirm that the DNS that the FortiADC is using for name resolution is or are the ones that we want to use. And then also we wanna make sure that we have a default route. Think of a default route very much like a PC or a server with their default gateway.

1:09Effectively, if the device doesn't have a more specific route in its routing table, the default route's gonna be used to forward traffic. So what we wanna do is train the FortiADC that its default route, which is represented 0.0.0.0, with a zero mask, that for that default route the next top should be our FortiGate firewall, which is at 10.10.0.71. And also while I'm at it, let me just jot down the IP addresses here for port one and port two. So port one is gonna be 10.10.0.73, and port two is gonna be 10.20.0.73 and all of that with 24 bit masks.

1:47Alright, so with that game plan in place, let's go back to the interface here at the FortiADC. And let's go ahead and tackle port one and port two first for network connectivity. So we'll go down here to the network settings, and under network we'll click on interface, and here we go. So we'll scroll down, and we have port one. And currently it does not have an IP address, so we'll go ahead and click on edit. And currently it's gonna allow HTTPS and Ping and SSH and HTTP. And that's because of the settings that were there by default. So I'm gonna leave those as they are.

2:17And then for it's IPv4 address, we wanna go ahead and use 10, I'm gonna look at my notes here. Has 10.10.0.73 with a 24 bit mask, just like that. And I'm not gonna give it an IPv6 address. And we'll scroll down, and we'll click on save. Alright, there's port one. Let's go to port two. So we'll select port two, click on the pencil to edit it. And this one should be 10.20.0.73 with a 24 bit mask, just like that. Now this is the interface that's facing our real servers on the left of our topology.

2:48So I'm gonna allow Ping at a bare minimum. That way if I'm at a server and I wanna verify basic connectivity, I could ping the IP address of .73, and I'd get a response. Also just for convenience, I'm going to allow HTTP and SSH as well here. In the event I'm on that subnet and I wanna use those protocols to manage this device, by allowing access to those protocols, I'll be able to use them as I connect from that subnet to the interface. And generally speaking, less is more from a security perspective. That way if we have a device, one of our servers gets compromised, and we have a hacker or attacker there who's now trying to use one of those servers to connect and start to manage our FortiADC, if we aren't allowing HTTPS and so forth, they won't have success in accessing the FortiADC via those protocols.

3:33But for my lab environment, that's gonna be perfectly fine. Alright, so let's scroll down and we'll click on save. Alright, so let's take a look. We have port one at 10.10.0.73, port two at 10.20.0.73, and then we have our management interface down here at 192.168.1.73. Alright, that looks good. The next thing we wanna do also is make sure that we have a default route set up. So if we go to routing... (laughs) Yep, no default gateway, no default route. So let's add a static default route.

4:03So if this device needs to forward a packet off of its local networks, it knows where to forward it to. So with network selected and routing selected under that and the static tab selected, we're gonna create a brand new static route. So we'll click here on create new. And the destination is 0.0.0.0/0. That's the representation of a default route. And the gateway, let's take a look at our topology for a moment. Our gateway is gonna be the FortiGate firewall at 10.10.0.71. So that's what we're gonna specify for the next top for the default route.

4:35So we'll specify, say 10.10.0.71. And then we have the concept of distance, and here's where that could come into play. If we have our FortiADC right here, and it has two default routes... Let's say we have a default route that goes to the next router of A, and another default route with the next router of B. The question is, which one should we choose? And it's a lot like walking. And you might think, "Keith, how is distance like walking?" Well, if somebody said, "To go to the store, you have to walk 10 miles," or "To go to the store, you have to walk 15 miles," (laughs) which one are you gonna choose?

5:06Well, most people are gonna choose the one with a lower number of miles. And that's how distance works in the world of making a decision on which route to use. If we have one route that has a distance of 10 and the other route has a distance of 15, this is the route, with a lower distance, that's gonna go in the routing table. And then if this route went away at some point, we then go ahead and put this route in our routing table. So that's where distance can come into play when having the FortiADC decide on which route to use when we have two identical routes. So we'll go ahead and click save here.

5:37So there's our default route. And let's also create another one, just for grins. And we'll say this one has the next top of 10.10.0., let's say 78, I'm gonna make that up. And let's give it a distance of 15. We'll click on save. So now it has two default routes, one with the next top of 71, that's our FortiGate, and one of .78, which doesn't exist at the moment. And they have these distances involved. So if we were to go to the command line, and this is a quick way of doing that right there, with a little shortcut to the command line, and we did a get router info routing-table all and pressed enter.

6:12So notice here we have two static default routes. So the code here, the S represents is a static route. The little greater than symbol here represents is the selected route. That's effectively the winner, the route that's gonna be used. And the little asterisk represents it's in the forwarding information base, which means it's cached and ready to go. So we could ask the question, "Well why did it choose this one as the winner and why is it using that route and not using the other static route?" And the answer is the distance right here. One was at 10, one was at 15, so it chose one with the lower distance value.

6:43Now, because I don't actually have the next top at .78 in my topology, I'm gonna remove that from the routing table. So I'm gonna go ahead and close the console here, and I'm gonna take this route to .78, and I'm gonna click on the little trashcan here to delete it. Click on okay. And now we have one default route using the next top of .71. And one last thing before we check our connectivity to the internet, let's also verify DNS. And that is under system, and settings. And on the basic tab here, there's our primary and secondary DNS servers.

7:14So this FortiADC should be able to do name resolution using one of these publicly available DNS servers, and it should be able to ping an internet resource. So if we go back to the command line, let's execute command ping out to www.google.com. And if that flies, that's great. And that is not flying, that is not going. I'm gonna do a control C there. Why? Oh, (laughs) I know why. (laughs) Let's take a look at what the challenge is. The problem is this firewall right here is saying, "I don't think I wanna forward that for you."

7:46So this FortiGate, as it sees traffic trying to come from this FortiADC needs to have network address translation set up to allow that traffic to go out to the internet and be translated, and security policy set up to permit the traffic to flow. So this is the FortiGate. And before we set this up, let me make sure I have the right interfaces in place. And if I go down to internal, I don't have an interface for VLAN 10. So let's do this, because I don't want this single video to be too long, in the next video, let's walk through the quick implementation of the appropriate interfaces here on the FortiGate and also the NAT and security policies to allow the traffic go through.

8:22And then we can verify the FortiADC connection to the internet. So I'll see you in the next video for exactly that. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:00(orchestral music) In order for the FortiADC to get out to the internet, it has to go through the FortiGate. And that's what we're gonna do in this video, is a few little tweaks at the FortiGate to allow that traffic to go through as part of our initial deployment of the FortiADC. So here at this FortiGate, I need to make sure I have an interface on VLAN 10 that ends in .71, which I don't think I currently have. So we'll put that in place real quick. I also need to set up some address translation rules so that traffic from the FortiADC as it goes through is translated to a globally readable address.

0:37And then third, I need to set up permissions that allow that flow of traffic. So once we get this guy all dialed in and we start setting it up as an application delivery controller, we'll set up additional rules and policies for different flows of traffic. But just for a basic internet connectivity test, we'll make those changes right now here at the FortiGate to allow that connectivity from this FortiADC out to the internet. Alright, so here is the FortiGate, and I need a interface in VLAN 10, which I will create right here, create new interface.

1:07I'm gonna name it VLAN 10, just to be creative. And let's go ahead and we're gonna use the parent interface of internal one. And this is gonna be VLAN 10, and its IP address is gonna be 10.10.0.71 with a 24-bit mask. And we'll allow ping, that way the FortiADC can do a ping to the default gateway and verify it works. And we don't need a DACP server at the moment, so click on Okay. Alright, so now we've got our VLAN 10 interface. That's a good start. Next, let's go ahead and set up some NAT rules.

1:39So under policy and objects, we'll go to essential source net and create new. And this be traffic that's coming in on the VLAN 10 interface that's going out either WAN A or WAN B, 'cause I've got some load balancing out there. And for the source address, I'm gonna say all, because I'm gonna have eventually multiple IP address coming in. And for the destination address I'm gonna say all as well. And it's gonna use NAT with overloading on the outgoing interface of the firewall and click on Okay. Alright, so NAT's in place, and let's also set up some permissions.

2:12So we we'll go to firewall policy, click on create new, I'll call this VLAN 22 outside, just like that. And the incoming interface is gonna be VLAN 10. Outgoing interface is gonna be our SD WAN zone, which includes either WAN A or WAN B, and the source, I'm gonna say any source IP address, and destination, any destination IP address, just for now for a test, and for service, anything they want. And we'll set them to accept, and we'll click on Okay. So now we have the permissions right here in this policy.

2:43We have the NAT policy set up right here, and we also created the interface. So let's go ahead back to the FortiADC and let's do a few tests. And just as a reminder of where we're at, we should be able to, from the FortiADC, we should be able to ping 10.10.0.71. That's our default gateway. And we also should be able to reach resources out on the internet as well now that the FortiGate is cooperating. So back at the FortiADC, let's bring up a command prompt. In fact, lemme bring up my terminal emulator secure CRT, and that's gonna be a little bit bigger font.

3:17Let's do a get router info routing table all, just to confirm our default static route right there. Let's execute a ping. We'll take baby steps here. We'll ping to 10.10.0.71. (laughing) It's always good when it works. And let's do a ping out to www.google.com, press enter, and it says, Keith, what are you doing? Type in execute ping www.google.com. And survey says, name resolution's working.

3:48And our ping out to the internet is working as well. We could also do an execute of trace route out to www.cbtnuggets.com, press enter, and that's showing us the path. It's also doing the reverse lookup along the way where that's possible. Alright, lemme do a control C there. So in this set of videos, we've done three basic things. Number one, we identified the basic idea or concept behind an application delivery controller. Secondly, we actually deployed an ADC as a VM in our lab environment.

4:20And then third, we also verified basic connectivity between that FortiADC and the outside world. And that puts us in a great starting position as we continue our journey together through the world of the FortiADC. So I'll see you in the next set of videos as we'll continue this discussion together. Until then, I hope this has been informative, and I'd like to thank you for viewing.