Initial Deployment of FortiAuthenticator

0:00[AUDIO LOGO] Hello and welcome. My name is Keith Barker. And in the world of security today, a big component of that security is making sure that when an individual, whether using a banking system or you're logging on to a network, we need to make sure that person really is who they claim to be. Now, at the heart of this, the world of Fortinet, there is an appliance called FortiAuthenticator that can help us as a central clearinghouse for that proper and safe, secure authentication.

0:32So in the next video, we're going to take a big picture like, some of the high-level concepts of the FortiAuthenticator, and then I'm going to walk you through step by step the deployment of a FortiAuthenticator appliance on a network. So I'll see you, my friend, in the very next video.

0:00[AUDIO LOGO] In this video, you and I get to take a big picture look the logic and concept regarding a FortiAuthenticator. And to really appreciate this, let's talk about the concept of a centralized authentication server. Sometimes we may see these listed as a AAA server. AAA is an acronym for authentication, authorization, and accounting. But at the end of the day, the centralized server has a database. And in that database, it has information regarding users and their passwords. And if anybody wants to verify a user account, this centralized authentication server can be used to validate that user's information, including their password.

0:38So what types of devices might use this centralized authentication server? Well, we might have some firewalls, like a FortiGate, for example. So let's imagine this is FortiGate-1, and let's put FortiGate-2 and FortiGate-3. And they all have some network connectivity and so does our centralized AAA server. So these FortiGates connect as clients as they interact with the server. So FortiGate-1 is acting as a client when it talks to the server. FortiGate-2 is acting as a client when it communicates with the server. FortiGate-3 is acting as a client when it communicates with the server.

1:08So in the FortiGate needs to do some authentication of a user, whether it's a traditional end user, or it can be an administrator instead of having to configure that username and password locally on the FortiGate. It can leverage the centralized server, make the request and say, hey, is this person authorized? And one of the benefits of having a centralized authentication server is that if we have an administrator who may need to log on to FortiGate-1, and FortiGate-2, and FortiGate3, instead of having all that information for the admin configured locally on each of these FortiGates, if we configure here on the centralized server and have these FortiGates, clients, then any of these FortiGates, if the admin tries to log in, could check with the AAA server to validate whether or not the credentials match up and whether or not it's the actual admin user based on the credentials they supplied, for example, username and password.

1:53So a FortiGate-1 makes a request. There'll be a response here. And from the server's perspective, it would be acting to the server back to the FortiGate as a client. So the responses would come back from the server with a yes or no regarding is that user authorized. So one of the questions that might come up is OK, what is being used as this protocol here as we're communicating back and forth between these FortiGate? So this example as clients and the centralized AAA server that has the information and all the usernames and passwords. And the answer is, it depends. There's more than one option.

2:23We could use RADIUS as the language of love or the protocol between these FortiGates and the centralized AAA server. And that's assuming the FortiGates and the centralized AAA server support RADIUS as a communications protocol to use. Another option would be TACACS Plus, which is from Cisco Systems. So primarily, we're going to see that mostly in Cisco environments, but it can be used in other environments besides just Cisco as long as the clients who are communicating with the server support that protocol. Another option for communicating between these FortiGates acting as clients and the AAA server would be LDAP, Lightweight Directory Access Protocol.

2:57So in that case, perhaps, the centralized AAA server, it has connectivity over to Active Directory and the database there, and LDAP is simply used as the mechanism to communicate between the FortiGate and the AAA server, who has access to the backend database. And these aren't the only options that can be used. There are others as well, but this is a good sampling of some options that can be used for the purpose of a device acting as a AAA client, in this case, FortiGate-1, 2, and 3, communicating with a AAA server. So let me go ahead and clean that up a little bit, and let's chat about another scenario, where we move on to authenticate some users.

3:31Let's imagine we have a switch. So here's a switch, and here's some ports on that switch. And let's imagine we have a PC down here, a networking device, and that PC is about to plug into port number 1 here on the switch. Now, when that connection is made with that unshielded twisted pair cable coming from the network interface card on this PC going to port 1, the switch, by default, doesn't know or care who the user is or what that device is behind that port. All it knows is it has link and in a corporate environment, very likely spanning tree is going to take a few seconds until you say, yes, it's OK, it's safe, and then allow traffic to flow.

4:06However, another option we have is we can go ahead and train this port that before it allows all the traffic through that we should validate who this client is, who is this device hanging off of port 1. Another scenario is that we could have an access point for wireless clients hanging off of a port. So let's say, that's port number 6 here. And let's draw another client, and this client, instead of having a wired network interface card, has a network interface card that is wireless. So it's going to associate with an access point. And in both cases, we may want to find out who that user is and make them prove who they are before giving them access through the network, whether they're physically wired directly, or they're connecting via an access point who's then wired into the network.

4:46And we can accomplish that by using something called 802.1X. And with this IAAA standard 802.1X, we can train the switch to verify who the entity is behind port 1, or who this wireless client is coming in, before we allow them full access to the network. And once again, instead of having usernames and passwords I'll configured locally on the switch, we can make the switch a client over here of our AAA server so that it could check with the server for the validation of the users as they're trying to come in. And then when the server responds, yay or nay, based on the response that comes back from the AAA server.

5:19This PC could then be allowed access into port number 1, and this PC with its wireless interface card could be allowed access in through the access point that's connected on port number 6. We also may have some third-party products that also may support RADIUS, and LDAP, and other protocols as well because not everything is made by one vendor. And once again, we'd want to have some interaction between our AAA server and those third-party solutions. And that way, if we don't have all the details right here on this local centralized AAA server, we could have information here on these third-party products and still communicate back and forth between our server and those third-party products.

5:54Another big aspect regarding security is the use of digital certificates. Let me quarantine a little space down here. And so on the public internet, we have PKI-- the public key infrastructure-- with certificate authorities that issue certificates, and we have subordinate CAs. And then we can use digital certificates for lots of purposes-- for validating an entity to make sure they are who they say they are. We can use the public key that's kept in certificates as part of cryptography. And digital certificates are important as part of authentication processes. So we can use a digital certificate to authenticate and validate a server we're connecting to.

6:28We can have individual digital certificates for computers and people that can also be used as part of the authentication. So digital certificates are an important piece of the puzzle. So let me ask the million dollar question, and that is, why are we chatting about all these options with AAA servers, and digital certificates, and RADIUS, and LDAP, and authentication switches, and so forth? What does this got to do with the FortiAuthenticator? And here's the answer. This device right here at the hub of it all is our FortiAuthenticator that can do all of these things.

6:58If we need a CA server, it can do it. If we need to have a centralized authentication server that supports 802.1X, we can do it right here. If we need a device that supports RADIUS, or LDAP, or TACACS, it can do it. If we need to have integration with Active Directory, the FortiAuthenticator can do it. If we need integration with third-party RADIUS, and LDAP, and other servers, we can do that as well. So if we erase this and we didn't call it the centralized authentication server, we could name this the FortiAuthenticator, or as its friends call it F-A-C. That's the acronym for the FortiAuthenticator.

7:32And the other good news is that this FortiAuthenticator can be deployed on-prem either as a physical appliance or as a VM. There's also flavors for it up in the cloud as well with Amazon and Google and more. So this is the high-level overview of many of the functions that the FortiAuthenticator can bring to the table. And in the next video, what I propose we do is let's put a design together for a deployment of a FortiAuthenticator in a local network. And then with that plan in place, we'll walk through the next steps of the actual deployment of the FortiAuthenticator in a network.

8:02So I'll see you, my friend, in the very next video as we take a look at our design for our FortiAuthenticator implementation. Until then. I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] In preparation for rolling out our FortiAuthenticator, I thought it'd be a pretty good idea to take a few moments and lay out a design and a topology, and then we can follow that as we implement the FortiAuthenticator. All right. So for our FortiAuthenticator, let's go ahead and start with a cloud that represents the internet right there. So off of the internet, let's imagine we have a little service provider router right there and that our gear is going to be a FortiGate firewall.

0:32We'll go ahead and call that firewall-1. And let's draw some network cabling. So this little network here, that'll represent the 23 network or the 24-bit mask. And I'm going to go ahead-- I'm using that address space here in my lab environment even though it does really exist out on the internet as well. But for the purpose and intention of my labs, we'll just pretend that that's an outside network, and then our firewall is connected right there. And then we've got another network here with another connection here. And this is going to be my network 10.10.0.0 with a 24-bit mask.

1:06And for these two networks in my lab environment, this is VLAN 23. And down here, this is VLAN 10. Make a little note for ourselves there. And for IP addressing, the default gateway that leads up to the internet is at 23.1.2.1. And this firewall, all of its interfaces are dot 71, including this one on the 23.1.2 network and this one here on the 10.10 network. And let me also draw my management network, which is right here, and that is network 192.168.1.0 with a 24-bit mask.

1:37So this firewall for its management network interface is dot 71. Then I've got a management PC that I'm currently sitting at on this 192.168.1 network. So I'll draw its connection to the network there, and its IP address is at dot 151 on this network. And then I've got this bad boy that we're going to deploy, and this is going to be our FortiAuthenticator, which I'll go ahead and call FAC for short. And we'll give that a physical connection here. And I'm going to put the FortiAuthenticator at dot 78 on this management network.

2:08So it'd be 192.168.1.78. Now, also, on this management network, I also have another router. So I'm going to go ahead and draw that router right here. And this router also leads off to the internet. So I'm going to draw the internet once again down here and give it a connection right there. And this router is at dot 1. So for the FortiAuthenticator's perspective, we can get out to the internet if we set up the routing to go through firewall-1, assuming we set all the permissions up there for that to happen. And we can also set up a route that uses dot 1 on the 192.168.1 network that would also lead out to the internet.

2:43Also, in our design here with this FortiAuthenticator, we are not putting it on this user network. So this is an end user network. And as a general practice, you'd want to put your infrastructure devices, like servers, and FortiAuthenticators, and FortiAnalyzers, and FortiManagers on separate networks. So this will be our game plan as we deploy a local FortiAuthenticator into this network. And we'll place it right here on the management network, and we'll give the IP address of dot 78. So with this plan in place, our next step is to do it, and that's what we get to start doing in the very next video.

3:15So I'll see you there in just a moment for the actual deployment of this virtual machine that will be our FortiAuthenticator. Until then. I hope this has been informative, and I'd like to thank you for viewing.

0:06In the previous video, we put a topology together with a plan regarding where in our network we're going to place the FortiAuthenticator. So in this video, we need to get the software for the VM and deploy it. So again, here's our overall topology design from the previous video. And what we're going to need to do is we need to download the VM. And in my case, I've got behind me a rack of ESXi servers. That's a hypervisor, the bare metal hypervisor from VMware. And so we need to download the VM images appropriate for that platform. So I'll make a note for ESXi.

0:38So once we downloaded the image, we'll go ahead and deploy it. And then once it's deployed, we then take the next step of doing the initial configuration on that FortiAuthenticator with the appropriate IP address and all the additional details. So with that in mind, let's go to the Fortinet website at support.fortinet.com, we'll log in, and we'll download the VM. So here we are at support.fortinet.com. We'll click on Login. I just logged in with my user account and password. And we'll go to Support. And from the drop-down, we'll go down to VM Images.

1:09And I should say this is how we would normally download the images. I think we may have to make a slightly different approach. But let's just check it out. So here, under Download/VM Images, we'll go to Select Product. And sure enough, FortiADC, FortiAnalyzer, FortiGate, FortiManager, and we're going to go to Other. And it says, OK, To download other firmware images, please click here. So we'll click here. We'll follow the link. And now we'll use the drop-down, and we'll go ahead and select FortiAuthenticator, which is right here. So we'll click on FortiAuthenticator. And then we have this tab here for Release Notes.

1:41Fantastic. And then we have the option for download right here. So with Download selected, we'll scroll down, and we'll go to the 6.00 folder here, expand that, and then we'll expand 6.4. And then under that, we have 6.6. We'll expand that. And then we're going to download the image that's appropriate for our hypervisor. So my hypervisor is VMware's ESXi. So I'm going to scroll down. And survey says, this is the option we want right here. Also, in the Release Notes, we're getting Deploying a VM.

2:11It would identify that as well. So OVF, the Open Virtualization Format, is the format that we need for a VMware environment. And I see up here above, we have some for Azure, for Hyper-V, for KVM, and others. So I'm going to go ahead and get this one right here, build1043. So to download it, we'll just go over here to the right where it says HTTPS and click on HTTPS to begin the download. All right, and it is downloading as we speak, as shown down here in the bottom left-hand corner. And it looks like it's done, so I'm going to go ahead and right-click and say please show in folder on this Windows computer.

2:43So here it is, my Downloads folder. I'm going to go ahead and right-click, and I'm going to go ahead and copy that and then move it to a different drive where I keep images for Fortinet. So here on my D drive, I've got Images, Fortinet, VMware, FortiAuthenticator. And it looks like I had a previous version. What is the date today? It is the 4th. So yesterday [CHUCKLES] I downloaded the latest and greatest version. It was build1040. But if we do a paste here, the one we just downloaded is build1043. So I'm going to delete the old ones, and then let's go ahead and expand this right here.

3:15We'll right-click and we'll say Extract All and then click on Extract. And there they are. So these two are hard disk files for the VM, and then I have several different flavors regarding the hardware versions, which refers to the logical hardware versions for the VM in a VMware environment. So to go ahead and deploy these, we'll deploy the two hard drives along with the latest flavor of the hardware version, which is, in this case, hw13. So let me set this to side for a moment and let's bring out our hypervisor. So here is my hypervisor interface.

3:45This is logging in directly to the ESXi host. It's one option for managing and working with VMware ESXi host. The other option is to use vCenter, which is an enterprise management solution for managing one or more ESXi hosts. So, currently, they're going to be sorted by State so I'll see all the devices that are powered on. And from here, we'll simply right-click on Host. And from the drop-down, we'll select Create/Register VM, and then we'll deploy a virtual machine from an OVF or OVA file. And then when we download it and just extract it from Fortinet, it's in OVF format.

4:16So we'll go ahead and select that and then click on Next. I'll go ahead and name this Our_FAC for FortiAuthenticator, and that'll just be the name inside of the hypervisor. We can rename the actual virtual machine inside the VM anything we want. I'll click here to get the files. So here is the zip file and here is the folder with the unzipped contents. So we'll go to that subfolder, and we'll just hold down the Control key as we select the elements we want. So both hard drives and hardware 13 for the OVF, and we'll click on Open. All right, and then we'll click on Next.

4:46It's asking me in my ESXi environment where do I want to store the files for this VM. And I'm going to go ahead and let it choose the internal SSD drive right there. It's already selected, so we'll click on Next. I will carefully read the entire end user license agreement from Fortinet, click on I agree, click on Next. And by default, it has all four interfaces connected to my management network. And so I'm going to leave them there. I can come back later. We can change this if we need to. But I know at least we got port number 1 in our management network because that's the interface we're going to use. As far as Disk provisioning, I'm going to go ahead and leave it with the default of Thin.

5:18That means it's not really going to tie up physical disk space unless it needs to. And then Power on automatically is set. Looks good to me. We'll click on Next. We'll go ahead and look at the details, confirm, and then click on Finish. And it is off to the races. So here in the Recent tasks, it shows us that it's now doing the work of deploying that virtual machine. So if I sort the VMs based on State, here is our FAC that is currently in the process of doing its initialization, and it should be ready in about two to three minutes and ready to go.

5:49And that's perfect for us because in about two or three minutes, we'll be ready to do some initial configuration. We're getting IP addresses and so forth on this virtual machine. So we'll do that in the very next video, and I'll see you there, my friend, in just a moment for that. Meanwhile, I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] In the previous video, we went to fortinet.com. We downloaded the VM files for the FortiAuthenticator. We extracted them, and then we deployed the VM on server 3 in that rack of servers over here over my shoulder. So what's next? Well, what's next is now, we need to go ahead and do some basic configuration for that virtual machine to make it match with what we want it to look like in our environment, and that's what we're going to do in this video. So regarding the FortiAuthenticator that we just deployed, here are a few defaults that we should be aware of.

0:34It has a default IP address on port 1 of 192.168.1.99. Now, if the 192.168.1 network is not the management network that you're bringing it into, we may need to go to the CLI via the hypervisor directly to this machine and actually change it at the CLI. Also, when we initially log in, there is no password required, but it does force us to change the password immediately upon logging in. So the default user is admin, and the password is nothing or null.

1:05And as far as the basic network connectivity, we'd want to verify the default route, which looks like 0.0.0.0/0. And the default route is very similar to a default gateway on a PC, where a PC if it says, I don't know exactly how to forward to this remote network, it'll go ahead and use its default gateway. Well, if we have a default route, it's the same logic on the FortiAuthenticator. It'll say, I don't know how to reach, for example, the 23.1.2 network. I'll go ahead and use my default route to get there. So on this FortiAuthenticator, let's set up the default route with the next hop.

1:36I'll put here next hop NH of 192.168.1.1, which is going this direction right here. And then after we have this device set up in the network, we can also take a look at giving it another path out to get to the internet using 192.168.1.71, which would be this firewall, which leads up to the internet going this direction. Now, in this network topology because this happens to be the 192.168.1 network, we could actually just connect to that IP address with a GUI, meaning, a browser, or we could SSH to it as well, or we also could use the command line interface via the hypervisor that we also just use to deploy this virtual machine.

2:16And because many, many times, you're going to be connecting to a network that is not the 192.168.1 network. Let's start off by walking through going to the CLI via the hypervisor and walking through how we can set up and modify this IP address because either way, we want to change the dot 99 over to dot 78 so that it'll match up with what we have planned here in our topology. So back here at the ESXi host, let's go ahead and we'll highlight our FortiAuthenticator. And I'm going to click on console and ask it to launch a remote console, so we can get close access to that virtual machine.

2:48So that is being brought up right here. And let me make that a little bit bigger. All right. So we are going to go ahead and log in as admin. So I'll type in admin. Press Enter. And there's no password by default, so I'll press Enter. And now, it's forcing me to go ahead and set a new password, which I will do. So I'm typing in a new password, pressing Enter. And then I'm going to confirm that password by typing it again and pressing Enter, and we are good to go. Change password for local user admin succeeded. So from here, let's do a show system interface and press Enter, and that's going to show us the current IP address.

3:22So here on port 1, there is our current IP address 192.168.1.99. Also, by default on this platform, it's allowing SSH access and also HTTPS, whether it's through a browser with a GUI or via an API. So let's set the IP address and change it from dot 99 over to do 78. So to do that, we'll type in config system interface. Press Enter. And I left off the f there. So config system interface. That's a little better. And we'll do a show just to verify what we have, and then we'll type in edit port 1 and press Enter.

3:56And then we'll do a set IP, and we'll put in 192.168.1.78, based on our plan, with a 24-bit mask, just like that. Then we'll do a show. Oh, I'm in edit mode so that's not going to work. So we'll go ahead and type in end. And then let me do a show system interface and press Enter. And there's our IP address ending in the dot 78. Also, here, we could edit and set up the default route if we wanted to as well. So I'm going to show router static and look at that.

4:26On this FortiAuthenticator, we do not need to set up the default route because it has a default route 0.0.0.0/0 with the next hop of 192.168.1.1, which happens to be the perfect next hop on that local network. So in the event that it wasn't the correct IP address for the default gateway, we could go ahead and modify that as well with the similar logic we just did for the IP address by typing in config router static edit 1 and then specifying the gateway with whatever next hop we needed it to be. So now that we have the IP address on the management interface on port 1 set, let's use a browser and the GUI and verify that works as well.

5:03So I'll take this console window, courtesy of the hypervisor. And I'm going to go ahead and minimize it in the event we need it again. And I'm opening a browser over to HTTPS called wack, wack 192.168.1.78. It currently says it's unsafe, and that's because it's a certificate authority that is not trusted by this browser. So I'm going to go ahead and scroll down, say, proceed anyway-- very normal with a self-signed certificate. I'll go ahead and log in as admin. I'll put in a new password that I just set and click on Login. So here in this widget for system information, the little pencils give us an indication that we can edit that information.

5:36So let's click on the host name, and I'm going to name this fac, short for FortiAuthenticator. Click OK. And then for the device fully qualified domain name, I'm going to go ahead and click on the pencil there and edit that. And let's go ahead and call this fac.ogit.local. I have a little DNS system already set up with that structure, so I'll click on OK. And now, it's complaining a little bit because the default server certificate it's using doesn't include ogit.local, but we'll address that in subsequent videos. So it's restarting the web server, and it's applying the fully qualified domain name.

6:09We can also verify it right here. This serial number is what's shown up when you don't apply a license. So the serial number is for small deployments, supports up to five users. In fact, the details are right over here. So for users, there's one that's used. That's the admin account. And there's five total for groups. There's three available. It's not going to support FortiToken Hardware or a FortiToken Mobile with the EVL license, but it will support Fortinet's single sign-on with five users and FortiClient workstations with five users.

6:41So there's still quite a bit of functionality even with the EVL license. And then for system time, let me also click on that, and let's make sure that NTP is enabled, which it is by default. And it happens to be in my time zone. I'm in Nevada, so I'm in the Pacific time zone. That's great so no changes there. We can click on Cancel. And also, here, under System, let's go down to Network, and let's take a peek at our interfaces. So we have our ports, interfaces ports 1, 2, 3, and 4. Currently, we have 192.168.1.78 with a 24-bit mask being used on port 1.

7:12And if we click on port 1 to ahead and edit it, check it out. Here, it has the IPv4 and IPv6 address information listed. So currently, we don't have an IPv6 address, so it's just IPv4. And then it's showing the access rights. So Telnet is disabled by default, a good idea to leave that disabled because Telnet is not secure. And SSH, and GUI TCP in port 443, and the REST API, those are both enabled. And as far as services, virtually everything is enabled by default, including HTTP, and HTTPS, and RADIUS, and TACACS, and LDAP, and the list goes on.

7:48Also, under Networking, let's take a peek at DNS. So DNS servers have been pre-populated by Fortinet. They're both pointing to the same exact DNS server. So I'm going to go ahead and use a Google DNS server as an alternate there and click on OK. And if we get a static routing, it should have our static route that we saw at the CLI. So we double-click on that. Here shows off of a port 1, the default route with the next hop of 192.168.1.1. So I'll click on Cancel. No changes there. And if we scroll to the right, that will give us a chance to see anything that was off the screen because of the sizing for the interface.

8:21And in addition to Dashboard status and the system information, which includes the license, another way to see the license information is to go to System and then down to Administration. And under Administration, there's a separate section right here for licensing. So by default, we don't have a license applied and apply when we go ahead and download our license from support.fortinet.com, and then we can go ahead and upload it right here by clicking on Upload File, grabbing the license file, clicking on Open. And that's how we could apply a license for the FortiAuthenticator. Now, one of the best practices that we should start following early, including on the FortiAuthenticator, is the process of backing it up, and there's a few different ways of doing that.

8:57So in the next video, let me walk you through the process of making sure that we have a current backup and setting up a schedule for routine backups as well regarding the FortiAuthenticator. So we'll do that the next video, and I'll see you there in just a moment. Until then, I hope this has been informative, and I'd like to Thank you for viewing.

0:06In my experience, there's only two types of users-- people who have lost data and people who will lose data. And that goes for systems and their configs as well. So we want to be in a good practice of making backups and knowing where we can find those backups. So in this video, I'd like to walk you through the options for doing an immediate backup and scheduled backups on the FortiAuthenticator. So the backups would go something like this. If we wanted to do an immediate backup, what we do is go up here where we're logged in. So we're currently logged in as the admin user. We'll click on that user.

0:36And then right from the drop-down, we have an option for Restore/Backup right there. So we'll click on Restore/Backup, and then we have an option for encrypting our backups. So I'm going to go ahead and select that. We can specify a password. And it's really a good idea to put a password on your backup because if there sensitive information in your configuration regarding IP addresses or policies or anything else and you don't want that all to fall in the wrong hands, by putting a password on your backup, even if somebody gets the backup, they shouldn't be able to go ahead and look at it because it's encrypted, and they won't have the key or the password to unlock it.

1:09I would also encourage you to use a password manager of some type and then include this as an entry in your password manager so it's safe and you can get at it. All right, so with the password supplied, I'll click on Download Backup File. That's going to back it up locally to my local computer. Down here in the bottom left, we can see that. And then we'd want to move that over and keep it somewhere safe. We're backing it up in the cloud. I'd also encourage you regarding that backup to document what that backup is. And that way, if you have good documentation regarding your backups and you need to go back to a certain point in time before some major change or before some minor change, hopefully, you have enough documentation regarding your backups so you can go to the right backup and restore it.

1:46So then to restore, you go to the same place. You go to admin, or whoever you're logged in as, go to Restore/Backup, and then click here on Upload of file to restore. Currently, it's in my Downloads folder, so right here. So I'll go ahead and select it. And then I'll put in the password and then click on Restore. And here, it's giving us a friendly warning saying, By performing a system restore, all your current data will be replaced with the backup. And are you sure you want to continue? Click on OK and then proceed with the restore. So in my case, I haven't changed anything. So this is the backup, so I'm going to go ahead and cancel that restore.

2:17So the technique of clicking up here on your username up in the upper right and then going to Restore/Backup is good for a manual process. But what about a persistent or ongoing routine process for backups? How do we do that? Well, the answer is we're going to go over here on the left to System. And then under System, we're going to go to Administration. And beneath Administration, we have an option for auto-backup. So we're going to click here on Config Auto-backup. We then say Yes. We definitely want to do the auto-backup. And then you can specify how often-- hourly, daily, or weekly, and then what time.

2:49Then you can specify the FTP server that you want to use. In fact, we should have done that first. It's right over here under FTP Servers. And then if we want to do encryption, we select Encryption So let's pause there just for a moment. Let's go to FTP Servers and let's create a new FTP server. And let's call it Our_FTP, and the server is at 192.168.1.151, which happens to be my management computer, which I'm doubling up as an FTP server. And we'll allow Anonymous FTP, and we'll click on OK. So now, if we went back under System Administration and to Config Auto-backup, we enable auto-backup, specify the time that we want it to happen, then we can specify a specific directory.

3:27And we can also specify our server, so we'll specify our server at 151. We'll enable Encryption, I'll put in a password, and then we'll click on OK. And then for my little FTP server, just as a demo, I'm going to go ahead and use MobaXterm, which is a fantastic little terminal emulator. And from the menu up here, I'm going to click on Servers, and I'm going to start a little FTP server. First of all, I'll configure the FTP server, allow anonymous connections, then I'll go ahead and click on the little arrow to go ahead and start it. So it is now going to be running for a few minutes.

3:57And if we went back to our interface here, we could wait for our Backup time, which is weekly at midnight, or we click on Now and put in the current time there. So I'm going to say Daily and Now and then I change that to 16:11 and 40 seconds and then click on OK. So when it is 4:11 PM and 40 seconds, this FTP backup should kick off. So I've clicked on OK. And now we're just going to wait a few minutes until that time arrives, and then it should do its backup. And I don't see it.

4:28[CHUCKLES] So I'm going to go ahead and do this one more time and set it for 14:00 and click on OK. Let me save that and make sure on the backend that my FTP server is still running. And let me go ahead and I'm going to stop it and start it just to make sure it is. And let me bring in my clock. So it's 4:13 on my local clock. So in just less than a minute, there you go. It ticked off. There's our authentication attempt. So I'll try to log in as Anonymous. And I had a pop-up. I had a pop-up that was asking me to authorize that.

4:59So let me go ahead and do this one more time. And I set for 15:00 and 10 seconds and click on OK. Make sure my FTP server is running by stopping it and restarting it. So it's good for 360 seconds. And there we go. All right, so I was able to go ahead and log in to this backup, and then the connection was closed. So if we go to my File System, there is the backup right there. And then we can then go ahead and restore it should we need to. All right, so I'm going to go ahead and move that out of the way.

5:30And in a production environment, you want to make sure your FTP server is up and available every time this guy tries to backup. And that's why they also have an option for a secondary FTP server in the event the first one isn't reachable or there's a problem with it. So for now I'm going to go ahead and say disable the configuration of auto-backup, click OK. So in this video, we've taken a look at how to do a manual immediate backup with the option here in the upper right-hand corner or schedule a backup by going to System, Administration, and Configure Auto-backup. And even if we intend to use the graphical user interface or browser to work with the FortiAuthenticator all the time, it's important to have backup plans, like using a console from the hypervisor or using an SSH session to connect and get CLI access.

6:12So we'll take a closer look at how to set that up and confirm it works in the next video. So I'll see you there in just a moment. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] In the event that we need CLI command line interface access to the FortiAuthenticator, at the moment we desperately need it, that's not the time to find out whether it works or not. So in this video, I'd like to chat with you about the two main ways of getting CLI access to the FortiAuthenticator in a virtualized environment and verify that they work. So if our FortiAuthenticator is running in a virtual environment as a VM, most of our hypervisors are going to have an option for CLI access with some kind of a terminal that we can launch from the hypervisor, whether it's Hyper-V or VMware's ESXi, but that's certainly not our only option regarding CLI access, command line interface access to the FortiAuthenticator.

0:46We could also use SSH, which we're going to set up and test in this video. We could also use Telnet, actually. Now that I write that out, we would never want to use Telnet because it is plain text. Anybody who's eavesdropping on any of our sessions is going to see everything that's going on. So if it's a VM, it's really going to be CLI access via the terminal or SSH access over the network. So because we have an IP address of dot 78 on a 192.168.1.1 network and our management computer is right here as well, let's go ahead and open up a terminal emulator and launch an SSH session over to the FortiAuthenticator just to verify that it works.

1:20So here is a terminal emulator. This one happens to be secure CRT. And we'll go ahead and use the lightning bolt, and we'll just set up a quick SSH session. So for the host name, I don't have DNS for that FortiAuthenticator yet, but what we'll do is we'll see if the host name is just going to be 192.168.1.78. We'll go directly to it, and the user account is admin. And then we'll go ahead and click right here on Connect. So the first time we're connecting is saying, hey, I've got this host key, and it's different from the last one. And the reason for that is my fault.

1:51I had previously set up a FortiAuthenticator and connected to it at that IP address. And so now, I'm connecting again, and it has a different host key. So my terminal emulator is warning me saying, you know what? That's not the same host key. Do you want to continue? So I'm going to say, accept and save, and it's asking me for the password, which is the password we set during the deployment. I'll click on Save that password, make it easier in the future, and click on OK. So there we go. There's our SSH prompt right there at the FortiAuthenticator. So what can we do here? Well, we can do a show config, and that will show us our configuration on this device.

2:23In fact, let me make this a little bit wider, so it doesn't wrap. So if we scroll up, here is our static route. Here is our interface configuration for port 1. Here's our DNS information right here. High availability is not currently set up, so it's disabled. There's the device name, and there's the fully qualified domain name that we set up. All right, that all looks fantastic. What else can we do here from the command line? Well, on most Fortinet products, we can use the execute command, and we'll do a question mark. And there's a ton of options here that we can execute. So let's go ahead, and let's execute a ping out to 8.8.8.8.

2:56This will help verify internet connectivity, and that's great. So some Fortinet products, they will ping five times, and they'll stop. And this one is more like a Linux box, so it's just pings until you do a Control+C. So that works. Then we want to try DNS. We can do a ping to www.fortinet.com. Says, Keith, where's the execute command? I forgot. E-X-E-C-U-T-E ping. That's better. So name resolution is working using the DNS servers that are configured. And we could also use some additional DNS tools like execute nslookup, looking for www.fortinet.com So that's fantastic.

3:33The nslookup tool, we could also do an execute dig for www.fortinet.com. Also great. And we can also do execute, and let's do a question mark. And there's traceroute. So let's go ahead and issue traceroute to www.fortinet.com. Then I'm going to do a Control+C to stop that. So this is showing us each of the routers in the path. So the first router is the default gateway at dot 1, and then it went off to 10.72.96.1, which is my service provider network. And then it went off to 100.127 et cetera, et cetera, et cetera, on its way towards 54.177.212.176.

4:09And if we do a show status and press Enter, that shows status command that we just issued right here. It looks and feels a lot like the output that we did earlier of show config. So the main point here is to verify and confirm that our SSH is working from our management computer. And that way, in the event we need to go and do something really quick and easy at the CLI, we'll have access to it. And also, it may or may not be part of company policy to allow your terminal emulator to store passwords for logging in. So in the event that you are allowed to do that and you have your password stored in your terminal emulator, it'd be very important, of course, always, to lock your console on your computer, especially your management computer whenever you're not directly right in front of it.

4:50And in the next video, I'd like to chat with you about setting up an alternative path to the internet instead of just this 192.168.1.1, which is currently the next hop for the default route on the FortiAuthenticator. So we'll take a closer look at that in the very next video. Until then. I hope this has been informative, and I'd like to Thank you for viewing.

0:00[AUDIO LOGO] In this video, I'd like to walk you through the logic and the steps of modifying the default route on the FortiAuthenticator. So currently, the FortiAuthenticator has a default route of this that says, use 192.168.1.1, which is this router right here. Now, on some platforms there is a concept called distance. And here's how the idea of distance works. On the route that uses the next hop of 71, we say the distance is 10.

0:31And for the default route with the next hop dot 1, the distance is 15, and it's like value shopping. It's going to use the one with the lowest administrative distance first. And if that's not available, it'll then go and use the other. And using a concept like distance and then probes to validate those next hops are available, you could then have some fault tolerance built in to your default route. Now, that is if the device supported the concept of distance, which the FortiAuthenticator does not. So for this video, let's do this as a plan. Let's imagine this firewall up here as part of an HA pair.

1:03So there's actually a couple there. They also could have multiple egress or outbound interfaces going to the internet with SD-WAN. And if they do, they would be a better choice as far as the next hop for a default route. So here's what I propose we do. Instead of using dot 1 down here, which is a single router, let's go ahead and modify the default route with the next hop of 192.168.1.71, which represents this HA pair here in our imaginary scenario, where it is HA and fault tolerant. And then we'll make sure that the firewalls are allowing the FortiAuthenticator to access the internet.

1:37So that's going to involve some network address translation and also some permissions so that the FortiAuthenticator can reach out to the internet for things like DNS, time synchronization, port guard, and more. So with that in mind, let's go to the FortiAuthenticator and change the next hop for its default route over to dot 71. So here's our 40 FortiAuthenticator, and let's also bring up a command line. And before we start changing the next hop for the default route, let's just verify with the execute that we can ping www.fortinet.com. And that works like a champ.

2:08So we'll do a Control+C. And let's go to Network. And under Network, we'll go to static routing, and let's change our next hop by double-clicking on the default route and changing the next hop to dot 71, which is the IP address of the FortiGate. And as I look back over my shoulder right there, that is a physical FortiGate, and it's not powered on. So give me a moment. Let me go ahead and power it on right now. All right. So it is powering on. It'll take just a few moments for it to initialize. And then once it's up, I also want to verify from the FortiAuthenticator that we can actually ping that IP address of 192.168.1.71.

2:44And while that continues to initialize, let me go ahead and save this change right here. We'll click on OK. So now, our default route has a next hop of 192.168.1.71. And let's go to the CLI. So this is the CLI for the FortiAuthenticator. Still show config. Press Enter. This also confirms that our next hop for the default route is set to dot 71. So here, let's go ahead and do an execute ping to 192.168.1.71. Press Enter. And the firewall is still powering on, so I'll give that in just a moment.

3:17And when the ping start coming in-- there we go. Now that the pings are coming in, we know we have reachability. Let's do a Control+C, and let's hit the up arrow key a few times and do a ping two for fortinet.com. And the problem now is that we don't have the permissions and the address translation set up at the FortiGate to allow the FortiAuthenticator to reach the internet. So let me do a Control+C. Let's take a look at our topology, and let's finish the config. So what we need to do here at the firewall is we need to specify that we want to do address translation for traffic coming from this FortiAuthenticator, which is a dot 78.

3:49And we also need to set up permissions at the FortiGate to specify that traffic from the FortiAuthenticator is allowed to go out to the internet. So let's go to this firewall, which is firewall 1, and we'll add those configs. All right. So this is firewall 1. It says, I can't connect to the FortiGuard servers because it just powered up. We'll give it a few minutes, and it'll be able to connect to them. So to start off, we'll go down to Network as well verify interfaces that I've got the appropriate interfaces set up and what they are. So I've got internal1. That's the physical interface. They have a VLAN10 logical interface, and that's the one right here at 10.10.0.71.

4:20That's when we pinged just a few moments ago from the FortiAuthenticator. And then the outbound interfaces are WAN-A and WAN-B, which are part of an SD-WAN zone. And if we go down to System and Settings-- I just want to confirm how this firewall set up. So it's currently set up with centralized source NAT and also next generation firewall mode of profile-based. All right. So let's go to pulsing objects, and we'll go to Central Source NAT, and let's do the NAT first. So we don't have any NAT rules here that deal with these source address space of 192.168.

4:51So let's go ahead and create new, and the incoming interface would be internal1. If we hover over that, there's the IP address. Fantastic. And the outgoing interface would be-- no. It could be WAN-A or WAN-B because those are both part of the SD-WAN zone. So we'll go ahead and grab both of them. And I want to lock this down just to the FortiAuthenticator. So we're going to click here on Create. And we'll create a new address object, and we'll call it FAC. And its IP address is 192.168.1.78, and we'll put a slash 32 to match on exactly that specific IP address.

5:25And the interface is internal1. We can verify that by looking at the IP address. And we'll click on OK. And then we'll go ahead and add that as the source address. And for the destination, if it's going anywhere, meaning, anywhere on the internet, we want to go ahead and do overloading on the outgoing or egress interface on the FortiGate. So we'll click on OK. And now, we have our NAT rule set up. Next, let's set up permissions by going to Policy and Objects, clicking here on Firewall Policy. And we'll create a new policy that lets the FortiAuthenticator go out. So we'll say, FAC_to_Outside, and the incoming interface is going to be internal1.

6:00And the outgoing interface is going to be any interface in our SD-WAN zone. If we hover over that, that's WAN-A or WAN-B. And the source, fortunately, we have an address object we just created. So we'll hover over FAC, and that's it right there. And the destination is going anywhere on the internet. And for the service, we'll allow any type of service or protocol, and the action is to go ahead and allow it. And we'll click on OK. All right. So now, that we have our centralized source NAT setup for the benefit of our FortiAuthenticator and we have a firewall policy that's permitting that traffic, let's go back to the FortiAuthenticator and verify that we can get out to the internet.

6:38So back to the FortiAuthenticator we go. We'll go ahead and log back in, and I'm also going to take a moment. And go under System and Administration and System Access. And I'm going to change the GUI idle timeout to something longer than five minutes. I'm going to make it 200 minutes and click on OK. And that way, it won't time me out quite as often. We'll go back to Dashboard, Status, and let's go back to Network Interfaces. So we have the IP address of dot 78. Under static routing, our next hop is 192.168.1.71, which is the FortiGate.

7:08So back at the FortiAuthenticator, if we do the ping, again, out to fortinet.com, so name resolution is working. Connectivity is working. And that is now going through the FortiGate, which with its probes and its fault tolerance, very likely has a better option of being up and available compared to our next hop at 192.168.1.1. So the great news is that we now have our FortiAuthenticator deployed as a VM. It's got an IP address. It can be reached via SSH and the GUI. It's got a default route using the next hop as the FortiGate, with some fault tolerance up there as well.

7:42And that puts us into perfect striking position to start putting this FortiAuthenticator to work to see what it can do. And we'll continue that journey in our next set of videos. And I look forward to seeing you, my friend, in those next videos very, very soon. Until then, I hope this has been informative, and I'd like to thank you for viewing.