Bootstrap a New Firewall

0:00Hello and welcome. My name is Keith Barker, and it's a pretty common fact that most people know that if we have a firewall, like a Fortigate firewall that's properly configured and in our network, that goes a long, long way towards improving our security on that network. However, it's also pretty common. Now is it if we get a brand new firewall and we never take it out of the box, or if it's a virtual machine, we never deploy in our network, those firewalls are not doing too much to help. So to that end of getting a firewall deployed and put into our network, in this set of videos, I like to walk you through the bootstrap process for a brand new firewall, which will involve wiping the config and then walking through each and every step of getting that firewall placed in our network and setting up what's known as the management plane so you and I can connect to that firewall for further configuration.

0:00In this video, we're going to take a big picture look at what we intend to accomplish in this set of videos. And I just want to talk about a few prerequisites that are presumed as part of this course. So as far as the prerequisites go, there are a few topics that are presumed to be known by an individual like yourself who is taking this course. One of those items would be an understanding of the TCPIP protocol stack or protocol suite or the IP suite, whatever you want to call it, regarding IPV4 and IPV6, at least the basics of how IP addressing works. So if the IP protocol and IP addressing is a brand new topic, you've never seen it or taken a look at it before, I would encourage you to make a note and take a peek at some other associated or entry level courses regarding those fundamentals. Another topic you should already be basically familiar with is the concept of a virtual local area network or as its friends call it, AVLAN, which is a layer two broadcast domain. And most of the time we have one VLAN, which is a layer two construct, we're also going to normally associate with that VLAN, a single IP subnet or IP network. So VLANs are there too. And the actual IP addressing involved is layer three. And normally this is a one-to-one correlation. So if we have a layer two VLAN, that's called VLAN 10, for example , it's also very common. We'd have a subnet such as 10 dot 10 dot zero dot zero, they slash 24-

1:15bit mask associated and being used in that VLAN. Again, this is layer two, this is layer three. It 's also presumed at this level of training at the professional level that you have a basic understanding of how a firewall operates and more specifically how a 48 firewall operates. So in this topology, I have four firewalls, I got one here and here, one here and one here. And as I mentioned, it's already presumed that you have a basic understanding of what a firewall does and how it operates. And once again, if you don't yet have that knowledge regarding any firewalls or a 48 firewall, there is other more entry level courses you can take to help provide that basic understanding of what the firewall does. So now that housekeeping is out of the way, let me clear off the screen here and let's chat about what we're going to accomplish in this set of videos. Number one, I want to do a factory reset on the firewalls. We'll start off with this one right here. This is going to be our headquarters firewall one. Let's imagine this is our headquarters site right here. And we're going to take this firewall right here and just do a factory reset. Now, there are several different options for a factory reset. And one of those will simply wipe out the entire configuration. Now, even if we do a factory reset, if this firewall has already been registered with Fortinet and has an active license, the license will still remain, even though the entire configuration based on the factory reset we do, will be wiped out. And I want to walk through that with you because I want to

2:32take this firewall and walk you through every single step involved in getting this up and put on the network so we can manage and work with it. So as far as getting the management working, we're going to set up the management plane. And a good question might be, well, what exactly is the management plane key? And that's a good question. So let's imagine we have this firewall right here already configured. And let's also imagine we have this little PC right here that's connected to this network. So on a good day, when this user is going up to the internet, for example, so they forward traffic to their default gateway, which this case would be our firewall, which would then route it out to an internet service provider like ISP or ISPB. And that would lead out to, for example, the rest of the internet, let's say this client right here is going to server one. So behind the scenes, this client makes a DNS request to resolve the IP address behind server one, then forwards the packet to the firewall, who then makes a routing decision, forwards it to the ISP, who then forwards it in the direction of that server, is how it finally reaches that server. Well , that flow of traffic from this user going up to that server, that's referred to as the data plane.

3:31So think of the data plane as the user data plane, we're carrying user traffic, basically normal functionality for a network from a client, out to a server, and the return path. And that is the data plane. However, when we manage a firewall, for example, if you and I are sitting, let's put another computer out here, I'll straw one right here, and let's say this is our management PC, and you and I want to connect to a firewall for the purpose of managing that device, that concept, that idea of us connecting to this firewall for the benefit of managing it, we are using the management plane. So we could be using the same exact networks involved for the data plane, for example, over this 10.120 network for the data plane, as well as the management plane. And the reason I mentioned the management plane is because in this set of videos, that's what we want to get to, we want to make sure we have this firewall, where you and I can sit at a device on the network, and remotely connect to it via IP, and that connectivity once again would be logically over the management plane. So we need the management plane up and running an active. So for this firewall right here, which is going to be called HQ firewall one once we configure it, we're going to have our management plane address on this firewall of 192 168 dot one dot, and let's use 51. So every IP address we configure on this firewall is going to end in dot 51 based on this design here. So this firewall

4:47right here has a dedicated port, it actually is labeled mgmt. And what we can do is take that interface that port and assign it the IP address 181.51. And then that allows you and I to connect to that management plane IP address for management of that box. So we can connect via HTTPS, or we can connect via SH or another protocol, if we allow it, I'll walk you through that as well as part of the bootstrap process. So we want to verify we can get to the address via the command line interface or CLI, as well as through a browser interface, which is known and loved as a graphical user interface, or interacting with and managing the firewall. So we want to make sure they both work as part of the management plane access to this device. Now there's one other wrinkle. And that is this, if we assign this IP address 181.51 to the management interface on this firewall, the firewall is not going to know by default, how to route out to the internet. And the reason that 's important is because as far as setting up the licensing and registering this firewall and getting it activated, it needs to talk to the Fortinet servers in the cloud. So that also is going to involve setting up a default route. So a default route, I call it the Obi-Wan Kenobi route. And it basically goes like this, this firewall, which is routing packets, then forwarding packets based on the policy, as it makes its routing decisions, as it looks at its routing table, if there isn't a

6:05more exact match based on the destinations IP address we're trying to go to, it'll fall back and use the default route as a last ditch effort. So like, help us Obi-Wan, you're our only hope or something similar to that. So here on the internet in my lab environment here, I have two service providers, ISP A and ISP B, and the IP address of the service providers, it can be .1 for each of those. So off of the WAN one interface and WAN two interfaces, it wants to be the firewall all set up, including the data plane. So it has the ability to route and forward traffic for users.

6:36And we'll do that part in the next set of videos. We'll also need to set up default routes. So this firewall knows how to forward traffic in the correct direction. However, until we get the data plane up and running, we also need a default route for the management plane. And that's so this firewall, even without its data plane interface is set up and running, we can still have this firewall connect out to the cloud. So in my topology here, the management network is 192.168.1 with a 24 bit mask and the management IP address, as we just discussed a few moments ago, is going to be 192.168.1.51.

7:07So I'll put .51 is the last octet there. And the default route that we want to set up that allows this firewall from its management interface to connect up to the internet. In my topology, that default route is at .1 on the 192.168.1 network. So as we set up the actual management plane, so we can manage this device. We're also considered a default route that says the next top is 192.168.1.1. So that device there, 192.168.1.1 is doing that or pat effectively address translation to allow the traffic from this firewall to go out to the internet. So as we clean up our objectives here, our objectives are simple. And that's this. We want to do the factory reset. We want to set the management interface with this IP address, verify we can reach it from the CLI with SSH, for example, as well as with the browser using HTTPS and then set up a default route so that this firewall via its management interface has the ability to reach out to the cloud . So with that in mind, join me in the next video as we take a look at what the physical hardware looks like for this firewall, which we will be calling HQ-FW1. And then we'll proceed to do a factory reset and continue down the list. So when you're ready, I'll see my friend in the very next video.

0:00So our first step is to perform a factory reset. Now this step would not be required if we just open up the firewall from its box and placed in our rack. However, because I have done some initial configuration here on this firewall, I want to do a factory reset so you can see what it looks like from square one. Also, before we do the factory reset, let me give you a physical look at what this firewall actually looks like. So for that, let's use the datasheet for this firewall. This is a 4 to 8 100 F series. So I've got one of these bad boys which can do all the bells and whistles and all the features, has the licensing ready to go.

0:31And I also have some smaller firewalls like 60 apps that we'll be using as we proceed through this course together to build our full-blown network. Also, let me show you the actual interfaces and ports we're using initially for the initial bootstrap and initial management plan configuration on this firewall. So here's the initial ports we're going to be using as we set up the management plan. There is a literal interface here called MGMT on this model. Now other models may not have a dedicated port. We can just allocate another interface and use it for that. But here we have a dedicated interface that we can use for management access.

1:04And as I mentioned, it is literally called MGMT for management. Now the other port that we're going to be using in the initial bootstrap here is this port right here, the console port. So for my management PC, I have a literal console cable that goes from a USB port here to that console port. And then we can use a terminal emulator like Secure CRT or Putty or something similar to that to interact with the command line interface for the Fortigate. And one of the benefits of having that console access is that if we wipe out the entire configuration, for example, of existing IP addresses and everything else is there, we're still going to have access to that console port via that serial cable connecting us over there.

1:42So one of the key points here is you'd want to, on your model of firewall, identify what the default speed is. For example, is it 9600 bits per second because that's what we want to set the terminal emulator for on the serial port. Another single Fortnet firewall, aka the Fortigate Firewalls, are going to have the exact same speed by default. So look at the documentation for the model you have and then use that appropriate speed set up for your terminal emulation on your serial port or on modern computers on your USB. So as far as the physical connections, including the console cable there, let me draw those out.

2:13So behind the scenes, I have a multi-layer switch and for our purposes here, we 're just going to go ahead and use layer two forwarding. So this is our switch and I'll put a few ports on this switch here, then I'll draw our management computer right here. So there's our management PC that you and I are sitting at and I'm going to connect us to one of the ports. So that is a port on VLAN 1 and that is going to be my management network. So my management PC is connected to one of these ports and this port is assigned to VLAN number one. So I'm going to color code that as pink, which is VLAN number one and then associate with VLAN number one in my lab network is also the IP network of 182.

2:48168.1.0 with a 24-bit mask and that is my management network. So this management PC has the IP address I think of .2 or something else inside that IP address range and it's in VLAN 1, the management network. Let's say we have a few more ports that are also in VLAN 1. I'll go ahead and label those as VLAN 1 and VLAN 1 and VLAN 1. So we'd also want to take this management port right here and connect a patch cable from this port, the management port and connect it with the patch cable over to a port on the switch, which is also in VLAN 1. That way the management PC is on the 192.168.1 network and after we configure this management interface, it'll also be on that 192.168.1 network.

3:24And for its IP address, we decide we're going to use .51 for the management plane of this 48 firewall. And over here, it's showing the 100F series, this is showing a 101F. I think the model I have is literally a 100F. But in either case, these port layouts are the same. And as I mentioned before, for my management PC, I've got a console cable that goes directly to the console port here on the 100F. So if we lose all IP connectivity, I'll still be able to access this firewall via the console port. And then once we have everything set up, we're able to manage this firewall.

3:55In a second set of videos, we'll walk through setting up the data plane, which will involve physically connecting the ports for WAN1 and WAN2 to the service provider networks. So that'll be WAN1 and WAN2. As well as based on our topology, we're also using port 4 here for connectivity within our network. But we'll save those ports and their configuration and the connecting to the network. We'll save those for a second set of videos. Because now we're focused on just the initial bootstrap and initial configuration of getting this firewall in the network and being able to manage it via IP. So from this management PC, once it's all set up for managing this firewall, we could use SSH with a terminal emulator, or we could use HTTPS with a browser for interacting with and working with this firewall.

4:35So now that we've seen the physical interfaces and the ports here, I've already placed this physical firewall in my rack behind me. And I've already made the connections to the console port here and also for the management port connected to WAN1 on my local switch here in my lab. So with that in mind, let's go ahead and do our factory reset of this Fortigate firewall. And do that relaxes the connectivity I have from my management PC or the console port. In that way, we don't even have to worry about what current IP addresses are there. We'll just use the console connection and we'll tell it to do a factory reset on the firewall via that console port.

5:09So without further ado, let's head over to my terminal emulator. Let's confirm we have connectivity there via the console port and then we'll give it a fresh clean reset. So here I'm going to be using secure CRT as my preferred terminal emulator of choice. And I've got two entries regarding console access. They're both serial ones at 9600 bits per second. The other is 115,200 bits per second. And for this firewall, the default is 9600. So I'm going to go ahead and double click on that. That's going out my com three port logically on my computer. I'll press enter and boom.

5:39There we have it. So I currently configure this firewall in doing some testing and initial setup. So I'm going to go ahead and log in as admin and I'll supply the password I set earlier. So that we're logged in. We're going to execute a factory reset. So we used literally the command execute space and it will type in FA and a question mark and we have a few options here, including this option right here, which is resetting everything to their factory default and do it right now. There's also options of keeping some basic information such as management IP addresses and so forth. But what we want to do is a complete wipe. So go ahead and use that option factory reset a space.

6:12I'll press enter and it's asking me, are you sure and I'm going to hit Y for yes and it is on its way to a complete factory reset. So while it does that, let's also chat about some of the defaults that are going to happen when this thing comes back up. So on this platform, the management port is going to have a statically assigned IP address of 192.168.1.99. Now the reason that's important to know is that if you're bringing this up on a network and you have a device at 99, that's going to be a challenge. That'd be a duplicate IP address.

6:43So one option could be taking our PC and specifying that our network interface card, we have the IP address of 192.168.1.something other than .99. And then what we can do is connect directly to the management port to interact with it over IP or another option is we could take our blue cable and that's where we're currently connected and have that connected to the console port. And that's what we're seeing right here because we did the factory reset and it 's now starting to boot. So a couple of pieces of information, this .48100F has 8 GB of RAM. There's its serial number, which is used as part of the registration for this device.

7:15And if you have a firewall like this that's already registered with Fortinet to confirm its licensing and all the rest, after you do a factory reset, it's not going to reset that licensing info. It still will remember what licenses it has and you won't have to go through the registration process again. So on this firewall, even though we're doing the reset, it won't be required to do the initial registration because I did that previously. All right, so we clean off some of this ink. It's now asking us to log in. So we'll clean some of this up just like that. And the default login is admin and it has one of the toughest default passwords on the planet and that is nothing.

7:47So when it has for a password, you simply press enter and then it's going to force you to set a new password. So currently this machine is at .99 on the 192.168 network via its management port. So from this computer that we're sitting at, we could either connect over via SSH to the .99 address. On the 192.168.1 network or just continue as we are with the console port and the console access. So just before we actually continue here with some initial configuration, let me also bring up a command prompt from this computer right here just to verify our IP address on this management PC and also verify that we can actually ping and reach that .99 address that is currently being used by default on this Fort igate.

8:28So here's a command prompt on my management machine and let's do a quick ping to 192.168.1.99 and sure enough, it is responding. So assuming I don't have another device at .99 on my local network, we are actually pinging the firewall with this default IP address on its management interface which is connected to VLAN 1. Another option for verifying connectivity is from right here, I could launch an SSH session over to 192.168.1.99 which is configured on this entry.

8:58So if we double click that, that also looks really good. So I'm going to accept and save the host key and then we can go ahead and log in. And again, the username is admin and by default, there is no password. So this is connectivity via SSH. I'm going to click on cancel there and go back to the other tab. And here we are connected via the console port. So I'm going to go ahead and log in with the username admin. And then the password is enter, press nothing. And now it forces you to set a new password which I'll do and now press enter. And now it's going to ask me to confirm that password so I know exactly what that is. So I'll repeat that new password I'm setting, press enter and we are in. So if we went back and connected via IP to the 192.168.1.99 address, we'll go ahead and do that.

9:36I'll log in as admin. I'm going to say please save that username, click on OK, press enter and I'll supply the password as well. No, it didn't actually prompt me for a password. That's because in this entry at .99, I already have my lab password already set. Otherwise, it would have prompt me for the password as well. In fact, let me just verify that real quick with you by closing that session. I'll go ahead and create a new session using SSH, click on next. For the host name, I'm going to put in the IP address, port 22 for SSH. The username, I'm going to leave that blank, click on next and next. And for the session name, I'll call this F G at 99.

10:09That way we can see it differently in the entry there. We'll click on finish and then we'll go ahead and double click on F G at 99 and we'll put in our username. I won't say save that username, click OK and now it's asking for the password. So I'll go ahead and put the password in to be the password I just set a moment ago. And I can say save that for future use for that entry and I can automatically put that in for me for future connections. So click on OK and boom, we are now logged in as admin. So here on this tab, which is labeled 9600, we are connected via a serial connection to the console port of this 40 gate.

10:40And this session right here called F G at 99, we are connected over the IP network using SSH. So we don't need two consoles open. So I'm going to go ahead and close one that 's using SSH. So we'll click on yes there to close it and then we'll just continue on here with our console connection. So as far as getting some of the basic information from this 40 gate, we could do a command like get, system, interface, physical, and press enter. And then it's going to go ahead and give us one page at a time regarding all of its interfaces and also shows the IP addresses. They're so I'm going to hit space and space for one page at a time and then we can scroll up to see any information that we needed.

11:13So that's all that's interfaces here. So if we scroll up, what I'm looking for is the interface called management and here it is right here. So the management interface has a static IP address configured. It is 192.1 state 1.99. That's the default and it shows the current status of up, which implies that we have a cable connected from that management port or to a switch. It's operating at 1000 megabits or one gig duplex full. We verified that connectivity using a separate entry using SSH. So that's how we can see the IP addresses that are currently involved.

11:45If we want to change them because we do, let's take a look at our game plan. What we want to do is use a management plan address of 192.1 state 1.51 instead of the default dot 99. So let's use the CLI and let's change that. Now we also could connect via the GUI to the current IP address of dot 99 and change it from there as well. In fact, before we make the change, this also just verified from the GUI, we can get to the IP address of dot 99, which is currently in place. So I've opened up a browser. I've connected to 192.168.1.99 and I have a certificate warning because my browser doesn't trust the issuer.

12:17So we'll click on advanced and that's getting normal for a brand new firewall. And then we'll go ahead and click on proceed and then we'll log in as admin and open the password that I set up the CLI. And once I've supplied those, I'll click on login. So here it's going to give us the little wizard to begin some configuration. So I'm going to click on begin. So as far as migrating the config, I don't need to because it's brand new firewall. So we'll click on later for that. And then as far as do I want to do automatic patch upgrades, I'm going to save for now, disable that. We'll do that later. We'll click on save and continue. And then click on the little boxes as I acknowledge that there will not be automatic updates.

12:48Click on OK. And then as far as the dashboard, I'm going to click the optimal option here. Click OK. And then as far as the opportunity to watch the 40 OS 7.6 video, I'm going to say don't show this again. But you can go back and look at that later if you'd like. Click on OK. And boom, it drops right here under the dashboard to the status page. Now from here, we could use the navigation over here on the left and we could go to network and go to interfaces. And we could change the IP address here. So there's our management interface and it's current IP address. Also by default, it's allowing ping, HTTPS and SSH.

13:20And that's how we're connected right now. So we currently have a connection via HTTPS. And that's how we're currently accessing this page that we see right here via our browser. And we also have access via SSH. And we tested that from secure CRT. So if we wanted to change that management interface IP address right here, we could just double click on that management interface. And then change the IP address right here from .99 to .51. So since we're here at the GUI, I'll go ahead and change that to .51. So now the management IP address once we confirm this will be set to 192.168.1.

13:5151 based on our plan and. And because this is my management network, I do not want at this moment this firewall to be acting as a DHCP server on my management network. So I'm going to disable the DHCP server function on this interface. So it's not going to be acting as a DHCP server. And then we'll go ahead and click on OK. And then I have a warning and it basically says, Hey, dear Keith or dear administrator, dear us. You are currently connected to this firewall with this GUI on its management interface, which is currently at .99. And you're about to change the IP address.

14:23So when you do that and you confirm it, when you reconnect, make sure you reconnect to the correct IP address of .51 because the old address of .99 is about to go away. So I'll click on OK. I understand. And this screen is effectively no longer valid because we are now connecting to .99 and it's not going to respond because we don't have our firewall running at .99 anymore. So I'm going to go ahead and close this browser and I'll open up a new tab and this time will go to 192.168.1.51. I still have a certificate warning error because my browser doesn't trust the issue of this certificate, which is normal on a brand new firewall.

14:58So we'll click on advanced and then click on proceed to continue. Then we'll log in as admin. I'll put in the password that I set at the CLI previously and click on login. And it's once again asking me if I want to continue with the wizard here and because I've done everything except for the migration, which I don't need to do because it's new firewall. I'll simply click on later and boom. Here is our graphical user interface. You make that a little bit bigger. So now here on the left, if we go to the network and we click on the interfaces option under network and we go to management, we can now see that the IP address is .51.

15:28Also, we can see here as far as what's allowed on this interface is ping H, TBS and SSH. Also, if you wanted to make these changes from the CLI, you could and let me show you that as well. So we're going to go back to secure CRT. So currently I'm still connected via the console port and I timed out. So the default timeout is five minutes of inactivity. It's going to cancel your session. So the old session timed out. So the default timeout is five minutes. So there's been no interaction after five minutes. It's simply going to log you out. So we log back in as admin press enter put in the password that I said earlier and it's logging us in.

16:01So now if we do the command get system interface and it's abbreviated sys there and physical and press enter. So we can hit space bar to go one page at a time or just enter to go one line at a time. So here for the management interface is showing us now .51. And as far as what is allowed as far as management protocols, if you wanted to view or modify that, we can type in config system interface and press enter. And then one of my favorite commands is show and that will show us the interfaces there. So here is showing us the management interface and also showing the IP address and here is showing what is being allowed for management access, including ping , HTTPS for GUI access and SSH for CLI access and all these represent access over an IP network to the management port.

16:43So if we wanted to modify the IP address or the allowed protocols here on this management interface, we can just type in edit management and press enter or use the quotes as well with edit quote management end quote. And then from here we do a show which will confirm our settings here and then we could modify the IP address with the set command for example set IP to and whatever we want the IP address to be or if we want to allow different protocols or less protocols. As far as management access, we do a set allow access and then a space question mark so we can include ping HTTPS SSH and what we would probably not want to include our insecure protocols like HTTP or telnet which are plain text.

17:20But in a pinch if you had to for some reason, you can enable those as well. So I'm going to enable ping and HTTPS and also SSH space. Let me also just for grins, let me enable telnet. So then we do a show. Now we have those four protocols being allowed on this interface called management. So because I don't want telnet, I'm actually going to take off the telnet, send it back to SSH and then we'll do a show to confirm. And now it's just those three protocols are allowed on this interface. And then to save the config we're going to type an end. So if you made changes to the protocols the IP addresses once we exit out, those changes are now active and running on the firewall.

17:55So let's do a progress check. We did our factory reset. We then verified that we get to the default IP address of dot 99 via the CLI and also with the GUI. And then we changed the management IP address to dot 51. And once again verified, we get there via the CLI using SSH. We also verified we can open up a browser to that same IP address and verified that also worked. We also verified that on this management interface, it's allowing and supporting ping so we can ping it and get a response. It's also supporting SH, which is for the CLI access over the IP network. It's also supporting HTTPS, which allows us to use a browser using some form of SSL slash TLS. However, what's not yet in place is the ability for this firewall from its management interface to actually reach the Internet.

18:38And to do that, we need to also add a default route, which is exactly what you and I get to do in the very next video. So I'll see you there in just a moment.

0:00So we just our factory reset. We reconfigure the management plane interface address on the management interface itself to .51 and we also verified CLI access with SSH. We verified the GUI access via a browser via HTTPS. So those are both done. So our next step is to configure a default route. And the reason that's needed is because by itself this firewall does not know how to reach out to the cloud which is super important for connecting with Fortinet services , including registration if that hasn't already been done. And also doing updates regarding its definitions and firmware that can all be done online. So as part of this depth let's confirm the current routing in place. And then what we'll do is we'll add a default route. And then if you need to get access to the internet go ahead and use the IP address of 192 1.1 as the next hop for the default route. And here my lab network that .1 address is all set up with routing and address translation to allow traffic from this firewall to get out to the public internet. So without further ado let's head over to the firewall. Let's confirm our routing and then we'll add our default route. So here at the firewall I have timed out because five minutes have gone by so I'll log back in as admin and I'll put in the new password and we are now logged in. So I don 't need to migrate so I'll click on later and this takes us back to where we left off and that was the interfaces pane here in the left navigation under network. So here's our management interface. There

1:17's its IP address. And there's the three protocols that are being allowed ping HTTPS and SSH and we're currently connected via HTTPS. So to view the current routing that is in place on this firewall if we go to the dashboard and then under dashboard go to network this is a great way to see what's in place. So here's a widget for static and dynamic routing and this firewall is playing us here that it knows about two networks. So if we click here on this widget to expand it is showing us here we have two directly connected networks and one of those is right here that's our management network the 192 1 state 1 network and then it also has for us configured an IP address on a logical interface called LAN and it's using 192 1 state 100. So another set of videos we'll take care of this LAN logical interface because we're not going to be using the 192 1 state 100 network but for now what we need is we need an additional default route because at this moment this firewall only knows about those two directly connected networks and has no idea about forwarding to the next top of dot one as a default route. So to add a default route they can be done at the command line but since we're here in the GUI it's a lot easier right here to configure a default route we'd go to network so here with the network section expanded we then go to static routes right here and with static routes selected we'd click right here on create new and then we simply

2:33put the details so here's a syntax for a default route and for the gateway address which is the next top address for that default route we're going to use 192.168.1.1 which in my lab network here in my home office that is the IP address of the default gateway who is going to use as part of the default route here on the 40 gate so check this out I'm going to hit the tab key when I do it automatically says oh we'll use the management interface so if we hover over the management interface the reason it's going to use that interface in combination with the default route is because that management interface is on the same network 192.168.1. So the firewall knows that to reach the next top address for the default route that the management interface is the interface is going to use so it automatically populated that for us and then we'll take the defaults for administrative distance and we'll talk more about administrative distance and different types of routing in a separate set of videos but for now we now have a default route or we will once we click on okay and unlike some firewalls we don't have to go through another step so there's no second commit statement or anything else we have to do that default route is now in play so to verify that we could go to the dashboard and in a dashboard we click on network and here we go back to the routing widget and now it's showing us that we have two directly connected networks and one static route and that's the default static route we just configured so if we click on that here is that default route that

3:51says if you don't have a more specific route in your routing table go ahead and forward to the next IP address of 192.168.1.1 which is my default router here in the office and it's this job to make a further routing decision towards the internet including doing things like address translations that are needed for this firewall to get to the internet so there's a few options for verifying now that this firewall can actually reach the internet using the default route and one would be just doing a simple ping to ping something out on the internet like a google DNS server at 888 or some of the resource or we could go ahead and do our registration at the firewall and if the registration is working where it connects to the fordnet servers and updates the registration that would also be a good indication that it works where we could also verify that DNS is working from the firewall so let's do some tests just to verify that this firewall has access now to the internet using the default route so one way of doing the ping would be to use this option right here so in the upper right hand corner there is a shortcut for a command line so effectively this gives us a command line interface for using the GUI a command line interface to the firewall so here we have the firewall prompt we are logged into the GUI so we're already logged in here so we dive in execute ping and then we can specify an IP address like 888 and if that works which it looks like it is that implies connectivity using our default route and if we did an execute ping

5:10to www. let's go ahead and go to fordnet.com and press center that is a great sign that implies that DNS is also working because it resolved the name www.fournette.com over to an IP address and then proceeded to do the ping let me go ahead and close that CLI another way to test would be to go to the networking section here and go to DNS and here it has two default porta-guard servers for DNS it's also indicating here that we have reachability to those DNS servers which is a great sign or if we went to system and went to firmware and registration right here because they already registered this firewall it's showing us registered so on a brand new firewall where we hadn't yet had internet access to that initial registration here we could go ahead and attempt that registration and if we have routing in place for the management plane the firewall should be able to reach out to the internet to the four net servers online and to the registration and sometimes that registration may take somewhere between five and fifteen minutes depending on how busy the servers are so once you've had connectivity after the internet you verify that for example with a ping and then you've come here just be aware it may take a few minutes for that registration to be completed also another step right here regarding firmware and registration in their system is that if you have an older version of software for example 7.2 or 7 something then you want to upgrade you could also do the

6:26upgrade right here so as we proceed to this course together I'll walk you to one of the updates on one of the other firewalls this one is currently up to date also right here i'd like to mention this option right here which is F4 feature so if you have a firmware version that says feature right here that is not a great idea for production so i'm using it because i want to use the latest and greatest version of software but in a production environment we want to have a m version which is mature it's so the same mature there which implies that the m version the mature version has been tested and verified and there's not as many surprise bugs or updates that will need to be done for full functionality so in the labs i'm going to be using the feature option because i want the latest and greatest version but in a production environment we'd want to stick with the m flavor because it's gonna be more stable we'll have less surprises but once again here in the lab environment i'm going to be using the feature version because i want you to use the latest and greatest for the demonstrations

0:00One of the things I've discovered over the years is that as we're learning something new or studying something It's important to do a little pause once in a while just to confirm that we get it So here's what I love to do regarding this bootstrap scenario I'd like you to imagine that you and I have been asked to redeploy a 48 firewall in the network and the initial steps They want us to do is get the management plane up and running effectively allowing us to manage and work with that firewall So as part of the scenario, I'd like you to answer the following questions regarding how would you accomplish the following number one For an existing firewall that's already in place for example this one right here How do we gain initial access to the CLI of an existing 48 firewall?

0:41So there's a couple different options there I'd like you to think about two different ways you can get to the CLI the command lane interface of an existing Fortigate and secondly, how do we perform a full factory reset? So any of the configurations? We're getting IP addresses or how the ports are configured How do we do a full factory reset? And then third once that reset has been completed How do we then gain access to the CLI or the GUI of a freshly reset 48 firewall ? And let's also presume that we have our physical cables already in place for the management port So that management port is already connected in to the 192.168.1 network So on a freshly reset firewall, how do we gain access to the CLI and the GUI and then fourth How do we go about changing the management interface IP address?

1:26Now there's a couple different ways that we looked at in this set of videos regarding how to change that IP address So what I'd like you to do is list both of those options How do we change the management IP address on the management interface of this 48 firewall? And then finally how do we go about adding a default route? So thinking through these options will help us remember the steps involved for doing exactly that So what I'd love for you to do is take a few minutes, think through these on your own And then once you're comfortable with the answers to these questions If you'd like to join me in the next video and we'll do a quick walkthrough of these steps and these options So have some fun with this scenario and I'll see you when you're ready in the very next video [BLANK_AUDIO]

0:00In this video, we get to do a walkthrough of the tasks asked about in this scenario. So the first question is, how do we gain access to the CLI of an existing 40- gate? And it wants, what are the two options there? And the two primary options will be using SSH. Let's presume we know the IP address on the management interface of the firewall. We get SSH to that and then log in. Or if we have console access to that firewall, we could use a serial connection and connect to the console port. So those are two different ways of connecting to that 40-gate. So currently, this firewall right here is at .51. We set that up previously.

0:32So if this was our existing firewall and we wanted to connect, let's go ahead and verify those two options of connecting over to this firewall. So for the first option, I'm going to use secure CRT and open up a connection over the COM3 port on my local computer , press enter, and boom, there's our login. There's our CLI access. So that's how we get there from the console port. And for SSH, we could go ahead and use an IP connection to get over there. So here, based on this entry that's connecting via SH over to .51, if we double click on that, accept and save the host key for the first time we're connecting. And then it would prompt us for the username and password. And because it's entry right here, .51, I already had pre-configured and secure CRT to save the username and save the password, secure CRT, put that in the background form. So that's two different ways through the console port or through SH that we can connect initially to the existing 40-gate firewall. So the next question asks, how do we perform a full factory reset? And the command for that is execute factory reset and press enter and then hit Y to continue.

1:29So here at the CLI, it doesn't matter too much if we do this through the console connection or here through the SSH connection. So once we're logged in, we'll type in execute space, FAC, and we'll do a question mark. And we want to do a factory reset all by itself. And that way, you can wipe it completely clean, except for the registration. If that's already done, that's not a problem. And it's already been licensed. That part doesn't get wiped away. So you can do this as many times as you need to, and your licensing on the firewall will stay in place. So the next cute factory reset press enter will hit Y to continue, and it's off to La La Land. So it'll do the factory reset and the reboot. And when it comes back, it'll ask us to authenticate again, using the default username of admin and the default password of nothing just by pressing enter.

2:09And at that point, it'll ask us to go ahead and set up a new password. So that 's the factory reset. And then to gain access via the CLI and GUI of a freshly reset 40-gate for CLI access, we can once again use the console port. Or if we want to use SSH, and we want to go to the default IP address of dot 99, we could use SSH. So those are two options for command line interface access to our 40 gate. And if we use the SHB to dot 99 on the 192 West State One network, because that is the default IP address that's going to be using on its management interface.

2:40Or if we connect via GUI, we open for browser to dot 99. So even if we just type in 192 West State one dot 99, only HTTPS services are enabled by default. And so we're going to be using secure HTTPS to connect for that GUI interface access. So to verify that, we already know that the console cable isn't moving. That's going to work. So let's verify SSH to dot 99 and also HTTPS to dot 99 to this newly reset 40 gate. So I just attempted to go to 192 West State one dot 99. But I think that the 40 gate hasn't completely done with its reboot. So as a quick test, I'm going to bring up a command prompt.

3:16And let's just do a quick ping over to 192 dot one state dot one dot 99. And that is responding. So let me go ahead and close that. I probably just did this a little bit too soon. So now it's been another minute or two, I'll click on reload. And sure, now I have the certificate warning, I'll click on advanced and proceed. And then we'll log in as admin. And there's no password. So we'll just leave that empty, click on login. At this point, it wants the old password, which is empty. There's no password there. And then we'll set up our new password and it will confirm the new password. So in the demonstrations earlier in the videos, we changed our setup, the initial password at the CLI. Here's an example of doing it through the GUI. We'll click on OK, and now it's asking us to log in. So we'll type in admin, and then we'll put in the password that we just set. So I'll supply that password. And then we'll click on login. And then it's walking us through the wizard here.

4:02So I'll click on begin. I'll say don't bother migrating because we just wiped it out. I'll disable automatic patch upgrades for the lab environment here. Click on save and continue acknowledge it's not going to do automatic updates. Click OK. And then I'll take the default option for the dashboard. Click OK. And I'll say please don't show this in the future as far as the prompt for the video. Click OK. And boom, here we are on the status section of the dashboard for this firewall. So to gain access to the CLI or GUI of this freshly reset 40 gate, if we're using SSH for CLI access, we'd go to the default IP address of .99 on the 192.168.1 network. Or if we have a console cable going to the console port, we can use it as well. And for the GUI, simply open up a browser to that IP address, the default IP address of .99. And then the next step says, how would you change the management interface IP address? So we could do that via the CLI, or we could do it via the GUI.

4:52So last time in the demos, we did it via the GUI. So if you want to see that again, please check out that video in the set. And for this example, let me walk you through config uring the measurement IP address on this firewall from the default of .99. But we'll use the CLI, the command line interface to do it. So we'll go back to our terminal emulator. Once again, I'm using secure CRT here. And we'll go to our serial connection that's going over to the console port. And we'll go ahead and log in as admin. And I'll put in the password that I changed at the GUI. And if that works correctly, we are now logged in. Fantastic. So to change the management interface IP address, we type in config space, the word system space, the word interface, press enter. And now we're in interface configuration. So here we can do a show, it's going to go through all the interfaces. It's going to confirm our current settings for the management interface. So that is right here. And then we're going to edit the management interface and simply going to copy and paste edit space management. So because it's one word with no spaces, you don't actually need the quotes, but you can use the quotes if you want. So it's like going to paste in edit space, quote, management, quote. However, you can just type it in without the quotes as well.

5:51Either way is great, press enter. And now we're in interface configuration effectively for that management interface. So here we do a show to see what we currently have. If we want to change this IP address, we simply use this command right here. I'm just going to copy paste it. And then we're going to change the address from dot 99 to go ahead and set it to our intended IP address of 51 and press enter. Then we'll do a show just to verify that we don't have a typo that looks good. It's allowing ping HTTPS and SSH by default. That's great. So we'll type in and as giving us a warning, indicated we have one admin session. So the admin session that we're connected to on the management interface is our GUI interface that we have currently connected. And this warning is saying if you change this IP address, it could negatively impact that connection, which it will because we're changing the IP address from dot 99 to dot 51. So I 'll say yes, go ahead. And then at the GUI, we can just re log in to the correct address now of 192.168.1.51.

6:45And if we use the command get system interface physical, press enter and hit spacebar for one page of time, then another key like queue to quit the scrolling. Here's our management interface. And there is its new IP address of dot 51. So to verify connectivity via SSH, I 'm going to go ahead and make a new entry. So here my terminal image, I created a new session using SSH. And we're going to go to 192.168.1.51, our new IP address. We'll go ahead and supply the username here as admin, click on next. And then I'll call this fg dash three at dot 51. That way , when we see it in the entries here, we'll know which one it is, click on finish, and then we 'll go ahead and launch it. And there we have a message saying do you want to accept and save the host key, we'll say yes.

7:27And now it's prompting us for the password. So we'll put in the password. And then if I want secure CRT to remember the username and password with this entry, I'll put a check there in the checkbox and click on okay. And it should log us in via SSH to our 48 firewall. And there it is. All right, so I'm going to close secure CRT. And our last step is to add a default route. So the easiest way to do that is do it through the GUI from the graphical user interface. So let's open up a graphical user interface over to the new management IP address of 192.168.1.51. So here we are attempting to connect to this IP address. We have once again a certificate warning because our browser and this computer doesn't trust that issue of the certificate. So we'll click on advanced and proceed, then we'll log in as admin. And then put in the password that we set up, I'll say later regarding the migration tool. And then from here, if we want to set up a default route, what we could do is go in our network and then our network go to static routes.

8:19And currently we don't have any static routes, we'll simply click here and create new and we'll create our new static route. So that's the syntax for a default route. We could also go ahead and use 0, 0, 0, 0, slash and 1, 0 means the same thing to the firewall. And then for the next hop, we're going to specify my default gateway here in my home office, which is 192. 168.1.1. And let the tab key automatically sorts out which interface it's going to use to forward to that next hop, which is the management interface. And showing us the IP address there, if we hover over it, 192.168.1.51. And then we'll click on OK. And then to verify we have the static route here and also figure out the dashboard on the left and then go to network, it's also going to reflect that here under the static and dynamic routing widget. So here if we click on that widget and showing us that default route and then to test it, one quick way is to go to the shortcut here for a command line interface from the GUI. So I'm going to click on CLI console. And then from here we'll type in ping, or rather execute ping. And we'll go ahead and ping eight dot eight dot eight to date just for basic IP connectivity. And then if we want to verify services such as DNS, we can do a execute ping and then go to a name like www dot cbtenegis.com, which we'll have to do name resolution in the background before it can execute the ping. And that looks good as well.

9:33So now we've verified that we have a new IP address on our management interface . So if we go to network and interfaces, here's our management interface, the little green indicates that we have a link coming in from our switch, what we're currently plugged into with the patch cable. There's its IP address. And for the routing, if we go to dashboard and network in here, the routing widget, we have our default route that we're using to actually reach the internet. So if you take a look at our bootstrap scenario about getting this device online and having access via the management plane, we looked at the options for connecting initially. We looked at the option for doing a factory reset and how to gain access to the CLI and the GUI.

10:09We also change the management IP address. And in the videos earlier, we did that change of the IP address in the GUI. And here in this walkthrough, we did it via the CLI. They are both good options . And then we added a default route with the proper next top. So that way, this firewall, well, just this management interface setup has access using the default route to actually get out to the internet. So now that we have bootstrap the firewall, when we set up the management plane, effectively the ability for us to connect to and manage the firewall, and we set up a default route so the firewall can get out to the internet. The next big challenge that we need to face is configuring the data plane.

10:43Remember, the data plane is the flow of traffic, for example, from users on our network to get to other networks, including the internet. And so those next steps of setting up the actual data plane, so the actual firewall can forward traffic from users, for example, out to the internet, that configuration we're going to do in the very next set of videos. So I look forward to seeing you there when you're ready. Meanwhile, I hope this has been informative and I'd like to thank you for viewing.