Deploying FortiManager

0:00Hello and welcome. My name is Keith Barker and today one of two things is true and I'll let you decide number one I could be ready to go out on the street and direct traffic or secondly we can be here today this set of videos to take a look at why people are using for to manager how it works and also to deploy a for to manager inside of a network if you're thinking Keith I'll bet you this option too you'd be absolutely right so join me the next video and we'll start off by taking a big picture look at the wonderful world of for to manager I'll see you there in just a moment.

0:00Let's begin in this overview by taking a look at some of the really tangible benefits that Fortamandr brings to the table. And a great way of doing that is to consider managing individual firewalls and their associated things like access points and switches, managing them all independently. So here I'm going to make a column called one by one, meaning managing each Fortigate individually, and then I'll put a dividing line right here, and then I'll put in this column here using Fortamandr. And I'm going to rewrite one by one a little bit there to make it really look like one by one, fantastic. And then over here on the left, let me go ahead and make a list of tasks.

0:35So one of the tasks we're going to want to do for our Fortigates is manage policy. You know, policy like what's allowed, what's not allowed, which security profiles we're going to use, how Nats can be implemented, and so forth. And if we have all these firewalls that we're doing independently, I'm going to put a frowny face right here one by one, and without a frowny face, for now, that's just recognizing that if we're doing it one by one, we're going to have to, you know, it's more tedious. You have to go to each device to make those changes. And secondly, there's a higher probability of inconsistency. So if we want some policy that's uniform across our entire enterprise, if we're doing it firewall by firewall by firewall, there's more of a possibility and chance we're going to miss the step or not have the exact same policy. We're on the Florida manager. The cool thing is we can create and edit at the Florida manager and push that configuration and that policy out to multiple devices in a consistent manner. So basically here for the one by one, I'm just going to put a frowny face pretty much all the way down the list. And then for the Florida manager, we're going to have it in a better situation for us all the way down the list as we identify various tasks where a Florida manager is going to be super helpful. Okay, another element besides managing policy is let's say we have some other configuration change we need to make. Again, making that configuration change, maybe it's something as simple as changing the DNS servers are going to use or

1:52the network time protocol settings or something else. If we're doing it one by one, it's a pain in the rear. If we're using for the manager, we can push up those changes from a single pain of less from a single console. Another common task that happens periodically is firmware updates. And so if we're updating firmware, once again, if we're doing it firewall by firewall by firewall, it's going to take a lot more time compared to doing it from a centralized management console of 40 manager. And even if we have like a brand new firewall that we're provisioning and setting up, instead of doing that from scratch, we can use features like zero touch provisioning, where you basically boot up the firewall, it calls home and auto configures, which is a feature we can implement through Florida manager. Another important aspect is monitoring to find out what's going on. So if we're doing it firewall by firewall firewall, firewall, that's a lot of security events and a lot of log files to go through. So solutions that include the 40 analyzer, which we could use for a centralized single console for managing and working with all of our logs and events. And we have some separate courses here at CBT, regarding 40 analyzer. However, if we want to use 40 manager, we can use 40 manager in conjunction with 40 analyzer, or if we don't have a 40 analyzer, there's also centralized logging support at the for the manager itself. So with or without a separate 40 analyzer, it's another option for centralized managing and monitoring of our network. And

3:09that also ties into reporting, because if we're using the Florida manager, we can use centralized reporting regarding the state of our network. And that also can tie into the reporting features of 40 analyzer, if we happen to have one of those as well. Now another recall that I learned about probably about 30 plus years ago, was the concept of change control and change management. Because when there is a change made on a firewall or any component in our network as part of the infrastructure, it really needs to be approved by the change control board. We need to have backup plans in place. We need to set up change windows and make sure that we're not going to add risk or bring the system down based on some update or change we're making. So as part of for the manager, we can also set up workflows and revision comparison. So if we do have a firewall, for example, it 's been locally configured or modified, we'll be able to see that drift that change that's been made here from 40 manager. Another really cool feature is ADOMS, that's administrative domains.

4:04So an individual 40 gate, there is no such thing as administrative domains. Now there are V DOMS virtual domains that we can set up on the 40 gates. But as far as like, for example, putting one admin in charge of these three firewalls and another admin in charge of this firewall, if we're doing it individually without a Ford manager, we can't really control that. However, with Ford manager, very similar to 40 analyzer, we can set up administrative domains and then assign, for example, admin one responsible here, admin two responsible here. And that way they have the authority and the permissions to make those changes based on the administrative domain that they have the permissions in. Another thing about automation, although we do have some automation features in a security fabric with a 40 analyzer, we also with Ford manager, we can leverage scripts and automation on our 40 gate devices from Ford manager. So I'm going to hear it here, put automation compared to managing the automation, which is the stitches, including the triggers and the actions on individual 40 gates, we can do that essentially from Ford manager managing the automation. And one other big piece about Ford manager is scalability, because if we have like one or two 40 gates, we could probably pull that off with, you know, managing them independently. But once we start getting to the range of let's say 10 to 15 or more 40 gates, it's not reasonable to do an effective job of

5:21managing and monitoring those 40 gates without some type of centralized management tool like 40 manager . So another we've taken a look at a lot of the benefits of 40 manager in the next video, I 'd like to walk you through the process of a deployment of a for manager device in a network. So we 'll do that in the next video and I'll see you there in just a moment.

0:00In this video, I'd like to walk into one of the options for deploying the FMG. That's an acronym for the Florida Manager. Now, we could use Florida Manager Services up in the cloud. We could have an appliances providing the Florida Manager functionality, or we could deploy Florida Manager as a VM. So in this demonstration, here is my current topology here in my lab environment. So I've got these three firewalls that are part of the same security fabric. I've got this firewall over here at the branch office, which is in an H.A. pair , using the IP addresses as shown.

0:30And they're also implemented in a zone-based firewall deployment as far as the firewall policies. Also, at the moment, I currently have a 40 analyzer that all these 40 gates are reporting into. However, I don't yet. Actually, the truth be told, I do have a Florida Manager that is in place ready to go. But because I want to walk you through the process of downloading and deploying a Florida Manager, we're going to just imagine for a moment that I don't yet have a Florida Manager VM deployed in my environment and that we're going to go ahead and get the image and deploy it. Now, as far as the deployment goes for a virtual machine, Fortinet has a VM image from Florida Manager for most virtualized platforms, including VSphere, which we'll be using as part of the demo, and Microsoft's Hyper-V and many others.

1:15Also, when we download the image for the Florida Manager, it's going to require an account, a user account up at Fortinet. And if we want to, we can also download the Florida Manager and then use a trial license. It's good for like a few devices that we can manage. And it also has a time limitation as well. So I'd like to walk you through the deployment of the Florida Manager VM. Now, a couple of things to be aware of in my technology here, my management network is the 192.168.1 network. And that's where my management PC is. And that's where my 40 analyzer is at .81. Firewall 1's management IP address on that sub net is 51. And that's a slash 24. And firewall 2 is at .52, firewall 3 is at 53. And the branch firewall is at .71. So without further ado, let's open up a browser. We'll head up to support. Fortinet.com.

2:03And let's get to work in getting that image. All right. So here we go. So I've logged in as my user account at Fortinet. And although they may change the interface from time to time, if we want to download an image currently, we'd go to support. And then over here under downloads, we have firmware download, VM images, service updates, etc. What we want to do is we want to download the VM image for the platform where we're going to deploy for to manager the VM. So we'll click here on VM images, and then we'll select the product. So from the drop down here, we want to download for to manager. And then for the platform, we'll go ahead and use the drop down here. And we want to download the image and in my environment, because I'm using vSphere and the ESXi host, I want to download the VM appropriate for that platform. So I'll click here for VM where ESXi because I'm running vSphere. And then we can choose our version. So here, 763, you notice it's F as in feature. Now in a production environment, we don't want to run the feature version unless there's a really good and proven reason to because it's a feature version and there could be hiccups or problems along the way. So if we look at 747, here it is 747M, as in Mary, and that's the mature flavor. So for the demo, I am going to go with the feature version because it's a lab environment. And we'll go ahead and grab the correct image.

3:20Now, now there's two options to download. One says, do you want to download the image you need for an initial deployment of the VM, which we do, or do you want to upgrade from a previous version? So we'll go ahead and do the download here. It's only 410 megabytes as of right now. Here's the hashes associated with it. We'll go ahead and click here, and that started the download. So that's downloading right now to my management computer. All right, so that is downloaded. Let me go ahead and grab it. So here is that file in my downloads folder. Also, before we use it, if you want to verify that you weren't downloading this from another site, which maybe you could inject malware or some other malicious code as part of the image, we could also do a validation using the checksum. So this is currently my downloads folder and I'm on a Windows 11 computer.

4:06So I'm going to go ahead and copy all the checksums right click, copy and I'll put that in a notepad document. So I'll right click paste. And there it is. So I have a regular is probably MD5 and the SHA 512 and looks like that wrapped. So let me go ahead and yeah, sure enough. So I've got a SHA 512 hash right here, and we can generate our own hash value on that same file. And it should match the same value that's provided from the website. So let's do that. Let me just bring up a command prompt. And here is a command prompt on my local computer. Let me just cd downloads. And then DIR and sure enough, there is our file. And let's do a get dash file hash. And because we're in that folder, he just copy and paste that name right there and paste and press enter.

4:47And there's a SHA 256 hash. So that gave us the SHA 256 hash, I need a SHA 512 hash. So I need to tell it that I want the SHA 512 hash. So hit the up arrow key, and we use the dash algorithm space and then type in SHA 512, and press enter. And that should generate the SHA 512 hash. And that does not match up. So if we go back to the website, oh, unless I grabbed the wrong hash, I did I grabbed the hash for the upgrade, not for the actual new deployment.

5:21Let me grab that correct hash, right click copy my bad, go back to our notepad document. And let me get rid of all that and do a paste. And that is the SHA 512 hash for the zip for the new deployment. Let's bring back my command line. So now we compare the hash, DDC seven FF2, etc. That exactly matches right here, which implies that we have an untainted file directly from Fortnite and no one's tampered with it. Fantastic. So now that we have the file, I go ahead and close my not epad document.

5:53So now that we have the file, we can go ahead and extract it. So here my downloads folder, I'll right click and we'll go ahead and say extract all and pop up window, ask me where I want to extract it to. So I'll go ahead and click on extract. And there it goes, made a folder. And then it's putting those files in that folder. So the VMD case in this VMware environment, those are hard drives effectively. And then the OVFs are the instructions for the VM. So if you're deploying it in a current vSphere environment, we can use this one right here, VM 64, HW 14, that's hardware version 14, V opt out OVF. If you're deploying it on older flavor of vSphere, for example, six or seven, you might want to use one of the other options here.

6:35So to deploy the new VM based on these files, let me bring over my vSphere environment. So here 's my vSphere environment. I've got a couple hosts that are up and running to ESXi host. And let's go ahead and deploy this on ESXi one as a demonstration. Now also, just so you know, behind the scenes, I've also got this VM right here called FMG 2025, which is already deployed. But I wanted to walk you through the process of deploying a new VM for Ford manager. So we're just gonna let that one sit for a while. We'll come back to it a little later. So to create a new VM, I'm going to go right here, my Fortinet folder, right click and say deploy OVF template, which is a fancy way of saying I wanted to play a new virtual machine from a template. And that's what we downloaded from Fortinet a few minutes ago. So we'll click here on deploy OVF template. In fact, let me make this font a little bit bigger so we can see a little bit better.

7:23Fantastic. So I'll right click here on this folder, deploy OVF template, and then I want to pull from a local file or files in this case. So I'll click here on upload files. And then here my downloads folder, I'll go to that folder for the extracted files and use my control key and grab FMG.vmdk. It's one hard drive data drive dot VMB case, the second hard drive. And then because I want a fairly current version of vSphere, I'm going to go ahead and use the hardware 14 VF dot OVF. And with those three selected, I'll click on open, then we'll go ahead and click on next . And then I'm going to call this FMG demo. And this FMG demo VM is going to be placed in the Fortinet folder, although we can move it if we want to either now or later, I'll leave it there for now. We can also say we want to customize the virtual machines hardware. So I'll go ahead and check that as well, and we'll click on next. And as far as which ESXi host we're going to run this on, I'm going to go ahead and put it on ESXi one and click on next. So ESXi one is one of the several rack servers I have behind me. And ESXi one has plenty of space and CPU and RAM to support the ford manager.

8:28All right, I'm reviewing details. It's going to go ahead and do thick provision ing, but I can change that as I go forward. Thick provisioning basically says, hey, I'm going to tie up 504 gigabytes right off the bat where thin provisioning would only use as much physical space as that VM needs to use. And it could grow dynamically up to the max. So I'll update that here as we continue. So I'll click on next, I'll agree by scrolling down and clicking on I accept all license agreements, click on next. And it's asking me effectively, where do you want to store this virtual machines files? So I've got a ice guzzi network attached storage. It's called ice guzzi three, grade five.

9:03Its capacity is 48 terabytes. And I have provisioned 18. So I have about 45 ter abytes of free space. That'll be great. Plenty. And then here I'm also going to specify that I want to do thin provisioning just to not tie up, for example, all the disk space that that VM needs, unless it really is using that disk space. So that's a way in a lab environment to not waste a bunch of space. And we'll click on next. Now it's asking me about the four network interface cards. So in the interface, whether it's the CLI or the GUI on the port of manager, this would show up as port one, port two, port three, port four. So I'm going to put port one, I'm going to browse and put it on my production 192 network with no tag. That means for me anyway, no 802.1 queue tag.

9:44This is my basic management network, no tagging needed. So I'll select that with the radio button right there. And once it's selected, I'll click on OK. And then I'm not going to use the other three interfaces. So I can have them park wherever. And we'll click on next. Now it's asking us to customize some of these settings. I'm going to leave all the defaults and we'll customize that once we get the VM up and running, we'll click on next. And here it's showing us the details for the hardware, because I said I wanted to customize the hardware. So it's going to have four CPUs, 16 gigs of RAM. And these two are based on the new hard disk from the VMD K files. Now also here, if we scroll down, you know, it's just one network that we're here, which is going to be port one is too bad. It's not in the right order. However, anyway, that's going to be port one, based on what we said we wanted to have happen. And currently it's not showing us connected because the VM is not running. And there's a video card associated with it. So sometimes on the VM that you deploy, there's limits in place based on the license you're using regarding how much RAM and how much CPU it can support. So just be aware that initially, you may want to just deploy it without tweaking these values. And then based on your license, if you want to go back with the VM powered off, you can upgrade the number of CPUs, the amount of memory, if your license supports it. And so I'm going to go ahead and take all these settings that are currently in place and

11:00click on next. Here's a summary. The VM is going to be called fmg demo. It's coming from this template is going to be in this folder. There's the ESXi host providing the hypervisor services. It's going to do thin provisioning fantastic on that data store. And then the network one, which is port one, is coming map to that port group called prod 192 effectively placing it on my management network. And we'll go ahead and click on finish. All right, so if we go to recent tasks here, it is now importing and deploying that VM. I forget whether or not I said it should automatically power it up.

11:34But in any case, we'll see what happens and then we can power it up manually if we need to. So if we go down the folder here, once it's deployed, we see that VM here as well. And it's sort by name. And there it is right there. There's fmg demo. And it's currently not ready. It's still being deployed. So we'll give that a another minute or two to complete. Also, if you're interested in training while this is deploying, if you're interested in training on other for net products, for example, 40 analyzer or for to gate administration, we have separate courses on all those independently as well. So feel free to check out our entire library regarding for net products, if you have more specific training on any of those specific products. All right, so the import's done, the deployment's done. And if we click here, let me go ahead and close the recent tasks. There's our fmg demo. And here's summary. And currently it is powered off. So we could right click on this VM and go to power and then do power on here or with it selected, we could go ahead and simply click on this icon for the power on, which we're going to do right now. And that will power on that virtual machine. And then we'll go ahead and click on launch remote console.

12:41And that way we can have a little window, if you will, like sitting at the console of an appliance, we can logically sit at the console of this VM as it powers up. And this may take a few minutes. So we 'll give it a minute or two to complete its power on. And then in the next video, I'd like to walk you through what the defaults are in place on this VM. And then I'd also like to walk you through changing those to meet your needs in your environment. So I'll see you in the next video as we continue the configuration of this newly deployed for the manager.

0:00In the previous video, we deployed the brand new 40-manager VM. However, we haven't configured any of the details on it yet for things like the IP address and mask it should use, the default gateway it's going to need so it can communicate with the outside world, and also making sure it has the ability to do name resolution. Now, the reason that's so important is because a 40-manager just being deployed without any licensing, including not even a trial license, it's not going to be too functional until it gets some licensing enabled on it.

0:30And to do that, it needs to talk out to the services at Fortinet, which is out on the internet. So regarding a game plan for configuration, here's like to do on this newly deployed 40- manager. We placed the Port 1 interface, we placed that on the management network. So it's logically in that same VLAN, that is Port 1. And currently by default, it's going to have an IP address of . 99 at 192.168.1.99. And so that happens by default on many Fortinet products. However, and I get to take a look at what actually happened, if we have DHCP services in place, it's possible that that 40-manager is acting as a DHCP client. And if it is, that means it would have pulled an IP address if there was a DHCP server available on the network. We'll take a closer look in a moment just to confirm exactly what happened with its IP address. Now, secondly, we don't want to use either the default of .99 or a default DHCP assigned IP address. What we want to use is 192.168.1.82 based on our plan right there.

1:34And we want to use a 24-bit network mask. And that basically means this part of the IP address is the network. And this last octet, this last number here in the IPV4 address is the host portion. Think of this like street 192.168.1 and house number 82. And this we want to have configured. For the gateway, we want to have .1 as the default gateway, because I have another 40-gate firewall acting as default gateway at .1 on that management network that's doing address translation and other services to get that traffic out to the internet. And then for DNS, we could use the DNS servers that are built into Fortamanager, which very likely are going to include the Fortinet DNS servers, or we could use Google. So we could use 888 or Cloud Flare at 1.1.1.1 or another one at Google like 884.4, whatever we want to do. So for a game plan, let's go ahead and statically configure this information. And we'll do it from the command-lane interface at the Fortamanager. So with that in mind, it looks like our Fortamanager is currently running. Let's bring up the console and sure enough. And the first time we log in, the username is admin and there's no password. So that's a tough password to crack actually if you think there is a password, but it's just press enter. It's going to say, okay, great, you're forced to change the password. So I'll put

2:49in a new password instead of a blank password. I'll confirm that password and press enter. And if everything went well, we are now logged in as admin. Also from here, I'm going to do a show this to interface and press enter. And I can't even scroll. So let me do a show system interface port one. And sure enough, it is actually set for DHCP. So let's do a get system interface and a question mark. And you know, it does the information right there. So we've got an IP address of 1.8 to 1 state 1.119, which is a DHCP assigned address. So we could, you know, remotely connect over there with a browser and start changing it. Or we could just do it right here from the command line, which is what I'd like to do. So I'm going to bring up a terminal emulator and just connect directly to 192.168.1.119 so that we have a bigger interface to play with. So this is the secure CRT terminal emulator. Let me just create a new session that goes to 119 , even if it's temporarily. So click on the plus symbol there. SSH is great. Next, I'll call this demo fmg, port 22, username is going to be admin, click on next. And next, oh, you know what, I need to go back and put the IP address in right there. So for the host name, because I don 't have DNS for that 192.168.1.119 fantastic. Next. And then the name can be demo fmg, click on finish. And then we'll go ahead and double click on that to connect. It wants to be know if I

4:06want to trust the host key, I do I'll accept and save that. And that wants the password, which I'll put in. This is my terminal emulator help me out here. I'll click on save password, even though we 're going to change this IP address in a minute and click on OK. And then we are connected to this 40 manager with a bigger font. So we can actually see better. All right, so I want to change three things. I don't want to be a DHCP assigned IP address. So we're going to do a config system interface. And let's go ahead and edit port one and press enter. And then we'll do a show to see the current settings. I'm going to do a set phone static as opposed to DHCP. And then we'll do a set IP. And we want to be 192.168.1. And let's take a look at our notes more more specifically, let's look at our topology. So we want it to be at dot 82. So I'll configure dot 82 for this 40 manager VM. So I'll put 82. And this can be a slash 24 mask and press enter. We'll do a show.

4:55I also want to allow ping just so I can do a ping test if I need to. So I'm going to a set allowed access HTTPS, SSH, and also ping. If you also wanted to enable HTTP, it would automatically redirect over to HTTPS. So I'm going to leave HTTP off, I'll press enter, I'll type in next and because I configured a new IP address, I now have lost connectivity. So I need to go to dot 82. And I don't know if I have an entry for that. So I'm going to just update my terminal emulator here, right click, get a properties for the entry. And I'm going to call it FMG . And for the actual connection for SSH, it's now going to go to dot 82. So I'll add that and click on OK. And then we'll go ahead and double click to connect there. We'll accept and save. We'll go ahead and get rid of the demo FMG connection. And now we're at the Ford manager at its new IP address. So we did a show, just a interface, press enter. Now we can scroll up fantastic. There's port one with our settings fantastic. And next, let's go ahead and make sure we have routing set up because we're no longer a DHCP client. We want to make sure we have a default gateway set up.

6:04So we'll type in config system route, do a show. Currently, we have no routing configured. So we 'll do an edit one, and it'll say set gateway. And we want 192 dot 168 dot 1 dot 1. We'll do a show just to confirm fantastic. We'll type in end. Oh, I didn't like that. Oh, I probably should have typed in next. Let's do that again. System route. Yep, didn't take it. So we'll edit one. So we'll edit one and set gateway. And a question mark. And the gateway is at 192 dot 168 dot 1 dot 1. And let's type in next. And it does not like that. Why doesn't it like that? All right, what we'll do is we'll go to the GUI. And we can do it that way as well. We can also set the DNS at the GUI as well.

6:41So let's open up a browser and let's go to the GUI to this device. If we scroll up here, it should be available at 192.168.1.82. So as a precursor, let me go ahead and do a quick ping to 192 dot 168 dot 1 dot 82 to make sure we have reachability. Great, great, great. And we'll open for browser. And we'll go there through a browser. All right, so I've opened up a browser to HTTPS colon slash slash 192 dot 168 dot 1 to 82. My browser does not trust the issuer of the certificate, which is normal. So we'll click on advanced and click on proceed. Now at the moment, I'm a little bit in a bit of a pickle, because if we did try to specify, for example, our account and then log in with Forta Cloud, we can't get there because the default gateway isn't set.

7:26So what I'm going to do is I'm going to go ahead and say activate license. Oh, it's still asking me. Okay, let's go back to the CLI. And this will be the part of the troubleshooting portion of the skill is that it's getting this device online. We need to make sure it has correct routing and also correct DNS that it can use. So let's go back to the CLI. And let's do it from there. And let's go back and do that one more time. Big system route, do a show, yeah, didn't save any of that. And let's do edit one. And let's just take a look at what I forgot. I must have forgot to do something. So we'll do a question mark. Oh, I know. I need to set the destination. That's part of a default route is the destination is supposed to a set and a question mark and DST space question mark. And the destination is going to be the default routes syntax, which is 0.0 0 0 0, slash zero press center. Great. That's what I missed last time. And then we'll do a set gateway. And that's going to be 192.168.1.1 press center. I just got a little ahead of myself. Then we'll type in and and I forgot one other thing I also need to tell it which interface, which is going to be port one. So what's really interesting is that, you know, once you do this a few times, it's easy to do it again. But if you haven't done it for a minute, sometimes you have errors that come up. And that 's what we're doing right now is we're troubleshooting those. So let's go back in and we'll do a

8:44config system route. Then we'll do an edit one. And then we'll set the destination again for the default route. Then we'll set the actual next top address. And then we're also going to go ahead and specify the interface with a set space question mark. And I need to do device to specify the interface that default route should use. So do a set device space question mark. And we want port one press center. And then we'll type an end. Yeah, you know what? Fourth time's the charm. So if we go back now and take a look at the details of that, what I can config system route that can show. And there are the elements that we needed.

9:23So the parts that needed was the set device and Z gateway. And the destination is not required because it's not showing up here. It's a default. So if we did an execute ping, for example, to 8888, that could verify for us that the default gateway is perfectly fine on the system and functioning. And to verify DNS, we could go ahead and execute a ping to www .fordnet.com. And if that resolves, it also means that name resolution is working. And we want to configure the DNS we could prepare with a config system DNS press center with a show. And currently, these are the DNS servers it's using. So if we want to use other ones, we can with a set primary, and let's go ahead and use 8888. And let's set the secondary to 1111, little show, fantastic, well, they've been and now we're using those DNS servers. So once again, we can do a name resolution, a ping based on name, just a ping to www.fordnet.

10:15com. And that is still working fantastic. So back at the GUI of this newly deployed port manager, we could either activate a license, or we could ask for a free trial. At that point, we put in our username and password that we're going to be using up at Fortinet, and then click on login with Forta Cloud. Or if you're activating a license, and let's say a month ago or two months ago, your management IP address was one address, and now you want to use a different address, like you're rede ploying it in a different location. You'd also want to go up to support.fordnet.com and go to the details where your license is and specify what the management address is, give that a minute to settle, and then you could go ahead and use it here. So I'm just like free trial, putting my username and password and click on login with Forta Cloud. Well, I've got a free trial license agreement. I will accept that, scroll all the way to the end, click on accept, and now it's going out because it can. It can do name resolution. It can go out to the cloud services. So now it's going to restart to apply that trial license. And there's also limits on how many trial licenses you can have. So if you had a trial license, for example, five or six months ago, they may or may not let you have another trial license going forward. So we'll find out together in a minute or two what the status of a new trial license attempt is here, because I have had a trial license in the past. And as we go forward, for the actual Fortam manager we're going to be using, I've actually got a

11:33license that supports I think up to 13 devices. And so we'll be using a license copy going forward. But I did want to show you the process for deploying and getting a new Fortam manager up and running. So I still have the console open for this virtual machine. So it rebooted. And it actually applied this new serial number and it's doing an upgrade of sample reports and how it says it's ready to login. So for this page back here, I'm going to go ahead and hit F5 to refresh it, click on advanced and proceed and let's log in again. All right, so it's less than you to log in locally. Now this is the admin account and the password I set up at the CLI at the Fortam manager. So I 'll log in as admin, I'll supply the password, and then we'll click on login. It says VM license is invalid, because system cannot find the matched management IP address. And that may be because I already had a previous license, they don't want to give you another eval license. In any case, at this point, I could just drag and drop my license file here, it would check that to make sure it's valid and then be up and running. So let me go ahead and I'm going to go ahead and log out. And let me show you here from the Fortam manager administrator guide for this version of Fortam manager. Let me show you what the wizard would look like in the event did continue. So if you did qualify for an eval license or you have a license file that you supplied, it would then walk you through this automated setup where make sure that you're registered with FortaCare, you

12:50specify the host name, you've changed your password, you've upgraded the firmware, and also it's going to encourage you to do a backup. And that's going to be presented after we do the initial login once it's called home, the Fortam manager is called home, and is validated the license that you have. So in our case, what I'm going to do is I'm going to take this Fortam manager demo, which we're no longer going to need. I'm going to right click and go to power, and I'm going to go ahead and I'm just going to power it off. Now that's not a graceful power off, that's just turning off the power like pulling the plug, but we're not going to be using it anymore. So it's going to turn off very quick, and I'll right click on that FMG demo, and then scroll down and just to delete from disk, and just remove it from my vSphere environment. Another is gone, we can go back up here, go to the FMG 2025, and it is in the state where I've just brought it up. I've configured the IP addresses, it's licensed, and it's ready to rock, but nothing else has been done on it. Let me go ahead and power this up. While it's powering up, let's launch a remote console, just take a look at its progress as it powers up. And then once it's up, I sort of log in and confirm we can log in via the GUI to this Fortam manager. And this is going to be the one we're going to be using going forward for the downloads and the integration with 40 analyzer and the onboard ing of 40 gates and the centralized management of those 40 gates. So we're just going to give

14:06it a minute until we have a prompt here indicating it's ready for us to log in. Also, even if the command line, like the console view says, you know, go ahead and log in, it may take a few extra seconds or two for all the back end stuff that supports the web interface to fully initialize. So if it does say log in here, you may want to give it a moment or two before logging into the GUI, just to make sure that it's ready. All right, says upgrading sample reports is done. And in a moment, we should have a prompt and once that shows up, we'll then try the GUI once again. All right, there's our FMG 2025 login, and let's go to another window and try logging in. All right, so I've connected to HTTPS colon slash one 92 dot 168 dot one dot 82. This is a good sign is asking me to log in a log down is the local admin account will supply the password and we'll click login. All right, fantastic. So it's registered. I've got a license that'll support up to 13 managed devices, which is also going to include V doms virtual domains if we have those set up, and it's been up for about three minutes and seven seconds, because we just powered it up and it's running version seven dot six three.

15:14So now that we have this 40 manager set up, and is currently connected to the internet, in the next video, I'd like to give you a high level tour of the graphical user interface here on 40 manager. So see you in the next video for exactly that.

0:00So in the previous video, we took our newly deployed Port-a-Manager, we then with some troubleshooting, set up and made sure it had a default gateway that was functioning, also the IP address that we wanted to use, and we also verified that we could log in to the GUI. So now that it is up and running and available, in this video, I'd like to give you a high-level tour of the graphical user interface here on the 40-Manager. So here in the 40- Manager, they have changed the interface a little bit over the years. So instead of having the tiles that they had previously, they simply have the options here on the left. So here's the dashboard. Much like other Fortnite products, you can toggle the widgets you want to see or not see based on what you want to have available here on the dashboard. So here's the system information, I'll make that bigger, it has the host name, serial number, the HA status, the firmware version, whether or not administrative domains are enabled or not, and also whether or not 40-analyzer features are enabled. So just as it heads up, 40-analyzer features allows some of those same functions, not quite the elaborateness of 40- Analyzer, but if you don't have a dedicated 40- Analyzer appliance or device, you can tell the 40-Manager that you want some of those features here, and it'll give you like a subset of 40- Analyzer features built in as part of 40-Manager.

1:15But because we already have a separate 40- Analyzer, we don't need to enable that. So go ahead and close that. And there's license information, system resource information, the ports involved under unit operation, also right here, we can click on restart or shut down if you want to restart or shut down the 40-Manager. And there's other widgets as well. As we go down, there's device manager, this is how you'd manage your devices. For example, like 40-gate firewalls, then we have policy and objects, including packages that we can use with those 40-gate firewalls. There's an SD-WAN manager, there's an AP manager, a Fortnite switch manager, an extended manager, a fabric view section, and one for 40-AI, which is a separate license product. So if you want to use 40-AI, you have to purchase that license as well, a section for Fortiguard, and then a final section for system settings. So under system settings, if you scroll down and we go to network, this is where we can see the network from the GUI.

2:05So here's port number one, there's the IP address 192.1.82 with a 24-bit mask. If we scroll down, here's the DNS that we configured for IPv4, and here's our default route with the default gateway being 192.168.1.1. And here, under settings, we can control the default HTTP port and HTTPS port. Should you need those changed? We're going to redirect from HTTP over to HTTPS. And if you want to change the look and feel here, we can. So currently, I have 40-analyzer with a cat theme. So for Fortiguard, let's go ahead and how about a summer theme. And that way, when we see it, we'll know exactly where we're at. We'll click on apply, and that's going to refresh this page. And now that that's done, let's go back to the dashboard page, which is right here.

2:52Fantastic. And let's confirm what we've done. We deployed the Fortiguard as a VM on-prem. We also configured its IP address, the DNS information and the default gateway. So we could go ahead and reach out to Fortinet services on the cloud, which is critical if we want to have either the e-Vell license or our actual license we're using be applied to this Fortin Manager. Now, there are some of the corner cases where if we have a Fortin Manager that's air-gapped and you can't get to the internet, there's also options for applying a license there. However, for most companies, they're going to want Fortin Manager with access to the internet, not only for licensing, but also for updates and care and feeding from Fortiguard. And so now that this Fortin Manager is in place in our network, in subsequent sets of videos and subsequent skills, we can take a look at doing the next logical steps, which could include things such as setting up administrative domains, configuring additional administrators, and making sure that our Fortigate firew alls as well as our Forti Analyzer are tightly integrated and onboarded here at the Fortin Manager.

3:53So all that more will cover in subsequent sets of skills.

0:00To wrap up this set of videos regarding Ford manager and the deployment of the Ford manager, I'd like to propose a customer scenario. Let's say that you and I are consulting for a company and they're not sure whether or not a Ford manager is a justifiable expense that they should add to their network. So what are the things that we could say to them that would help identify whether or not it would be valuable and worth the expense? Because the licensing is not free, that's for sure. So how do we approach this? So what I'd like you to do is this, pause the video right now, take a moment, consider some of the factors that might be a good business case for using a Ford manager and then when you're done, click on resume and then we can collaborate in preparation for meaning with that customer. So I'll see you in a few moments after you have a chance to consider this.

0:48So I'm curious what are some of the items or ideas that we should bring up to the customer that you thought of? So I have a few of my own and let's just chat about that for a moment. Number one, if they have like one 40 gate firewall and maybe a switch and an access point, they probably don't need for the manager. However, if they've got five or more 40 gate firewalls, the centralized management that Ford manager brings to the table is going to save them a lot of configuration mistakes. And it's also going to make sure they have more consistency in their deployment and have a better view of what's happening on the network, whether they use the internal logging here at the Ford manager or if they're integrating a 40 analyzer. So I'm going to say the first major benefit is centralized management. The second big thing is going to be saving time. So if they do have multiple firewalls and they want to push out or update configs or the policies, the actual time to do that is going to be a lot less time if they're using templates and pushing out those policies to all the 40 gate firewalls or two groups of firewalls based on what configurations need to go where. So as far as time savings, they're going to save time with configurations of any type on the 40 gates and also going to save time with updates. So if they're updating

2:06firmware, those firmware updates after they get through change control and testing, those are going to take a lot less time as opposed to doing it firewall by firewall by firewall, we have all that pushed out via Ford manager. Also, because we're doing centralized management, we're also going to have centralized reporting and monitoring. And that's also important to have centralized because if there's like a virus that's out breaking on the network or a worm or something else that's happening or malware and it's going from machine to machine to machine across different parts of our network, it'd be good to have a bird's eye view of exactly what's happening. So 40 analy zer can certainly help with that. And the 40 manager in conjunction with 40 analyzer can help with that as well. Because instead of just wondering if the firewalls are all in sync as far as their policies and configurations, or if we're wondering, I wonder if somebody logged in locally made a change here, Ford manager can track all of that and give us reports and identify exactly what change, for example, when it shouldn't, sometimes this referred to as configuration drift, where, you know, configuration change over time, but they're not authorized. So the 40 manager can help us be aware of that and also help lock that down. And if this customer wants to set up separate management domains, for example, maybe having one group of admins in charge of this, set a firewall, and another admin over here responsible for this one, or maybe they have some customers were using virtual domains inside of the firewalls, and we're

3:24splitting up the firewalls, and we want to give individual customers access into certain portions of those firewalls. Another really good benefit of Ford manager is that we can literally set up those separate administrative domains that can contain individual firewalls or individual V-dombs from specific firewalls, and that way they can give management access and visibility to the right admins , whether those admins are all in-house or whether those admins are individual customers leveraging some of the services provided by the service provider, and a really quick way of identifying whether or not Ford manager would be valuable for a company is if they have multiple firewalls . So if they've got, like, five or six 40 gates, plus they have four to switch behind that and 40 AP s and so forth, it's very likely they're going to benefit with all these options by using Ford manager. For a company that has a single 40 gate, no, because if they have a single 40 gate, it's a one-stop shop regarding all the stuff that's going on, and they really don't need to have a centralized ability to manage all their 40 gate firewalls if they just have one. So thanks for joining me. In this set of videos regarding getting a Ford manager deployed on a network, and we're going to use this infrastructure as we go forward in our subsequent set of skills regarding Ford manager. So I look forward to seeing you, my friend, in those sets of videos in the very near future. Until then, I

4:42hope this has been informative, and I'd like to thank you for viewing.