Fortinet FortiGate-7060E User manual

FortiOS™ Handbook - FortiGate-7000

VERSION 5.4.5

7000

FORTINET DOCUMENTLIBRARY

http://docs.fortinet.com

FORTINETVIDEOGUIDE

http://video.fortinet.com

FORTINETBLOG

https://blog.fortinet.com

CUSTOMERSERVICE&SUPPORT

https://support.fortinet.com

http://cookbook.fortinet.com/how-to-work-with-fortinet-support/

FORTIGATECOOKBOOK

http://cookbook.fortinet.com

FORTINETTRAININGSERVICES

http://www.fortinet.com/training

FORTIGUARDCENTER

http://www.fortiguard.com

FORTICAST

http://forticast.fortinet.com

ENDUSER LICENSE AGREEMENT

http://www.fortinet.com/doc/legal/EULA.pdf

FORTINET PRIVACY POLICY

https://www.fortinet.com/corporate/about-us/privacy.html

FEEDBACK

Email: techdocs@fortinet.com

December 20, 2017

FortiOS™ Handbook - FortiGate-7000

01-545-3966550-20171220

TABLEOFCONTENTS

Change Log 7

Introduction 8

What's new in for FortiGate-7000 v5.4.5 8

M1 and M2 interfaces can use different VLANs for heartbeat traffic (408386) 8

GTP load balancing 8

FSSO user authentication is synchronized 8

HA Link failure threshold changes (422264 ) 9

FortiGate-7000s running FortiOS v5.4.5 can be configured as dialup IPsec VPN servers 9

FortiGate-7000 overview 11

Licenses, Device Registration, and Support 11

FortiGate-7060E 12

FortiGate-7060E front panel 12

FortiGate-7060E schematic 13

FortiGate-7040E 14

FortiGate-7040E front panel 14

FortiGate-7040E schematic 15

FortiGate-7030E 15

FortiGate-7030E front panel 16

FortiGate-7030E schematic 16

FIM-7901E interface module 18

FIM-7901E schematic 19

FIM-7904E interface module 20

Splitting the FIM-7904E B1 to B8 interfaces 21

FIM-7904E hardware schematic 21

FIM-7910E interface module 22

Splitting the FIM-7910E C1 to C4 interfaces 23

FIM-7910E hardware schematic 24

FIM-7920E interface module 24

Changing the interface type and splitting the FIM-7920E C1 to C4 interfaces 25

Splitting the C1 to C4 interfaces 26

FIM-7920E hardware schematic 26

FPM-7620E processing module 27

NP6 network processors - offloading load balancing and network traffic 28

Accelerated IPS, SSL VPN, and IPsec VPN (CP9 content processors) 30

Getting started with FortiGate-7000 31

Managing individual modules 32

Managing individual modules from the CLI 33

Connecting to module CLIs using the management module 33

Connecting to the FortiOS CLI of the FIM module in slot 1 34

Default VDOM configuration 35

Default management VDOM 35

Firmware upgrades 35

Restarting the FortiGate-7000 35

Load balancing 36

Traffic that cannot be load balanced 36

Recommended configuration for traffic that cannot be load balanced 37

Configuration synchronization 39

Failover in a standalone FortiGate-7000 39

Replacing a failed FPMor FIMmodule 39

Replacing a failed module in a standalone FortiGate-7000 chassis 39

Replacing a failed module in a FortiGate-7000 chassis inan HAcluster 40

Installing firmware on an FIM or FPM module from the BIOS using a TFTP server 41

Uploading firmware from a TFTP server to an FIMmodule 41

Uploading firmware from a TFTP server to an FPMmodule 43

Operating a FortiGate-7000 45

Failover in a standalone FortiGate-7000 45

Replacing a failed FPMor FIMmodule 45

Replacing a failed module in a standalone FortiGate-7000 chassis 45

Replacing a failed module in a FortiGate-7000 chassis inan HAcluster 46

Installing firmware on an FIM or FPM module from the BIOS using a TFTP server 46

Uploading firmware from a TFTP server to an FIMmodule 47

Uploading firmware from a TFTP server to an FPMmodule 48

IPsec VPN 51

Adding source and destination subnets to IPsec VPN phase 2 configurations 51

Example basic IPsec VPN Phase 2 configuration 51

Example multiple subnet IPsec VPN Phase 2 configuration 52

Configuring the FortiGate-7000 as a dialup IPsec VPN server 53

Example dialup IPsec VPN configuration 53

Troubleshooting 54

High Availability 57

Before you begin configuring HA 57

Connect the M1 and M2 interfaces for HA heartbeat communication 58

HA configuration 60

Setting up HA on the FIM interface modules in the first FortiGate-7000 (chassis 1) 60

HA management configuration 62

Managing individual modules in HAmode 63

Firmware upgrade 64

Session failover (session-pickup) 64

Enabling session pickup for TCP and UDP 65

If session pickup is disabled 65

Primary unit selection and failover criteria 66

Verifying primary chassis selection 68

How link and module failures affect primary chassis selection 68

FIM module failures 70

Management link failures 70

Link failure threshold and board failover tolerance 70

Link failure threshold 70

Board failover tolerance 70

Priority and primary chassis selection 71

Override and primary chassis selection 71

FortiGate-7000 v5.4.5 special features and limitations 72

Managing the FortiGate-7000 72

Default management VDOM 72

Firewall 72

IP Multicast 72

HighAvailability 73

Shelf Manager Module 73

FortiOS features that are not supported by FortiGate-7000 v5.4.5 74

IPsec VPN tunnels terminated by the FortiGate-7000 74

SSL VPN 75

Traffic shaping and DDoS policies 75

Sniffer mode (one-arm sniffer) 75

FortiGuard Web Filtering 75

Log messages include a slot field 75

FortiOS Carrier 75

Special notice for new deployment connectivity testing 75

FortiGate-7000 v5.4.3 special features and limitations 77

Managing the FortiGate-7000 77

Default management VDOM 77

Firewall 77

Link monitoring and health checking 77

IP Multicast 78

HighAvailability 78

Shelf Manager Module 79

FortiOS features that are not supported by FortiGate-7000 v5.4.3 79

IPsec VPN tunnels terminated by the FortiGate-7000 79

More about IPsec VPN routing limitations 80

SSL VPN 80

Authentication 80

Traffic shaping and DDoS policies 81

Sniffer mode (one-arm sniffer) 81

FortiGuard Web Filtering 81

Log messages include a slot field 81

FortiOS Carrier 81

Special notice for new deployment connectivity testing 81

FortiGate-7000 Load balancing commands 82

config load-balance flow-rule 82

Syntax 82

status {disable | enable} 83

src-interface <interface-name> [interface-name>...} 83

vlan <vlan-id> 83

ether-type {any | arp | ip | ipv4 | ipv6} 83

{src-addr-ipv4 | dst-addr-ipv4 | src-addr-ipv6 | dst-addr-ipv6} <ip-address> <netmask> 83

protocol {any | icmp | tcp | udp | igmp | sctp | gre | esp | ah | ospf | pim | vrrp} 83

{src-l4port | dst-l4port} <start>[-<end>] 83

action {forward | mirror-ingress | mirror-egress | stats | drop} 83

set mirror-interface <interface-name> 84

forward-slot {master | all | load-balance | FPM3 | FPM4 | FPM5 | FPM6} 84

priority <number> 84

comment <text> 84

config load-balance setting 84

gtp-load-balance {disable | enable} 84

max-miss-heartbeats <heartbeats> 85

max-miss-mgmt-heartbeats <heartbeats> 85

weighted-load-balance {disable | enable} 85

dp-load-distribution-method {round-robin | src-ip | dst-ip | src-dst-ip | src-ip-sport | dst-

ip-dport | src-dst-ip-sport-dport} 85

config workers 85

Change Log

Date Change Description

December 20, 2017 Updated for FortiGate-7000 v5.4.5. New sections include What's new in for

FortiGate-7000 v5.4.5 on page 8,FortiGate-7000 v5.4.5 special features and

limitations on page 72,IPsec VPN on page 51,gtp-load-balance {disable | enable} on

page 84, and Operating a FortiGate-7000 on page 45. Also, changes to High

Availability on page 57. New section Recommended configuration for traffic that

cannot be load balanced on page 37.Additional changes and fixes throughout the

document.

November 7, 2017

Changes to Installing firmware on an FIM or FPM module from the BIOS using a

TFTP server on page 41. Also added a note about the MGMT interface being a static

aggregate and not an LACP aggregate.

November 2, 2017 Updated with new information throughout the document including a new HA chapter.

August 30, 2017 Updated with new information throughout the document.

December 1, 2016 Initial Release

7 FortiGate-7000

Fortinet Technologies Inc.

Introduction What's new in for FortiGate-7000 v5.4.5

Introduction

This document describes what you need to know to get started using a FortiGate-7000 product. Also included are

details about CLI commands that are specific to FortiGate-7000 products.

This FortiOS Handbook chapter contains the following sections:

FortiGate-7000 overview provides a quick overview of FortiGate-7000 components.

Getting started with FortiGate-7000 describes how to get started with managing and configuring your FortiGate-

7000 product.

FortiGate-7000 Load balancing commands describes FortiGate-7000 load balancing CLI commands.

What's new in for FortiGate-7000 v5.4.5

The following new features have been added to FortiGate-7000 v5.4.5.

M1 and M2 interfaces can use different VLANs for heartbeat traffic (408386)

The M1 and M2 interfaces can be configured to use different VLANs for HA heartbeat traffic.

The following command now configures the VLAN used by the M1 interface (default 999):

config system ha

set hbdev-vlan-id 999

end

The following new command configures the VLAN used by the M2 interface (default 1999):

config system ha

set hbdev-second-vlan-id 1999

end

GTP load balancing

GTP load balancing is supported for FortiGate-7000 configurations licensed for FortiOSCarrier. You can use the

following command to enable GTP load balancing. This command is only available after you have licensed the

FortiGate-7000 for FortiOSCarrier.

config load-balance setting

set gtp-load-balance enable

end

FSSO user authentication is synchronized

FSSO user authentication is synchronized to all FIM and FPMmodules. FSSO users are no longer required to re-

authenticate when sessions are processed by a different FIM or FPM module.

FortiGate-7000

Fortinet Technologies Inc.

What's new in for FortiGate-7000 v5.4.5 Introduction

HA Link failure threshold changes (422264 )

The link failure threshold is now determined based on the all FIM modules in a chassis. This means that the

chassis with the fewest active links will become the backup chassis.

FortiGate-7000s running FortiOS v5.4.5 can be configured as dialup IPsec VPN servers

The following shows how to setup a dialup IPsec VPN configuration where the FortiGate-7000 running v5.4.5 acts

as a dialup IPsec VPN server.

Configure the phase1, set type to dynamic.

config vpn ipsec phase1-interface

edit dialup-server

set type dynamic

set interface "v0020"

set peertype any

set psksecret <password>

end

Configure the phase 2, to support dialup IPsec VPN, set the destination subnet to 0.0.0.0 0.0.0.0.

config vpn ipsec phase2-interface

edit dialup-server

set phase1name dialup-server

set src-subnet 4.2.0.0 255.255.0.0

set dst-subnet 0.0.0.0 0.0.0.0

end

To configure the remote FortiGate as a dialup IPsec VPN client

The dialup IPsec VPN client should advertise its local subnet(s) using the phase 2 src-subnet option.

If there are multiple local subnets create a phase 2 for each one. Each phase 2 only

advertises one local subnet to the dialup IPsec VPN server. If more than one local

subnet is added to the phase 2, only the first one is advertised to the server.

Dialup client configuration:

config vpn ipsec phase1-interface

9 FortiGate-7000

Fortinet Technologies Inc.

Introduction What's new in for FortiGate-7000 v5.4.5

edit "to-fgt7k"

set interface "v0020"

set peertype any

set remote-gw 1.2.0.1

set psksecret <password>

end

config vpn ipsec phase2-interface

edit "to-fgt7k"

set phase1name "to-fgt7k"

set src-subnet 4.2.6.0 255.255.255.0

set dst-subnet 4.2.0.0 255.255.0.0

edit "to-fgt7k-2"

set phase1name "to-fgt7k"

set src-subnet 4.2.7.0 255.255.255.0

set dst-subnet 4.2.0.0 255.255.0.0

end

FortiGate-7000

Fortinet Technologies Inc.

Other manuals for FortiGate-7060E

This manual suits for next models

Table of contents

Other Fortinet Firewall manuals

Fortinet

Fortinet FortiGate FortiGate-5001FA2 User guide

Fortinet

Fortinet FortiScan-1000C User manual

Fortinet

Fortinet FortiGate-400A Instruction Manual

Fortinet

Fortinet FortiGate 3600A User manual

Fortinet

Fortinet Fortiwifi fortiwifi-60 Operator's manual

Fortinet

Fortinet FortiGate FortiGate-50 Operator's manual

Fortinet

Fortinet FortiGate FortiGate-60M Instruction Manual

Fortinet

Fortinet FortiGate FortiGate-5005-DIST User manual

Fortinet

Fortinet FortiGate-300C User manual

Fortinet

Fortinet FortiGate FortiGate-1000 Instruction Manual

Fortinet

Fortinet FortiGate ASM-FX2 User manual

Fortinet

Fortinet FortiWiFi FortiWiFi-60B User manual

Fortinet

Fortinet FortiGate-100 User manual

Fortinet

Fortinet FortiGate 300 User manual

Fortinet

Fortinet FortiGate-51B User manual

Fortinet

Fortinet FortiGate-200A User manual

Fortinet

Fortinet FortiMail-3000C User manual

Fortinet

Fortinet FortiWiFi FortiWiFi-60B User manual

Fortinet

Fortinet FortiGate FortiGate-800 User manual

Fortinet

Fortinet FortiGate FortiGate-5001A User guide

Fortinet

Fortinet FortiGate FortiGate-30B User manual

Fortinet

Fortinet FortiMail-4000 User manual

Fortinet

Fortinet FortiGate-100 Instruction Manual

Fortinet

Fortinet FortiDB 3000D User manual

Popular Firewall manuals by other brands

Cisco

Cisco S190 quick start guide

ADTRAN

ADTRAN NetVanta 2300 Specifications

SecureLogix

SecureLogix ETM System installation guide

NETGEAR

NETGEAR ProSafe FVX538 Reference manual

Lanner

Lanner FW-8877 user manual

Huawei

Huawei USG6000 Series Upgrade guide

H3C

H3C SecPath F5000-AI-15 installation guide

Nexcom

Nexcom DNA 1150 user manual

Cisco

Cisco 3110 Hardware installation guide

Draytek

Draytek Vigor2860 Series user guide

Lanner electronics

Lanner electronics FW-7650 Series user manual

Swisscom

Swisscom Internet Backup manual

SonicWALL

SonicWALL NSa 5700 quick start guide

DPtech

DPtech FW1000 SERIES Maintenance manual

FEITIAN

FEITIAN MultiPass FIDO product manual

EBLOCKER

EBLOCKER PRO user manual

GTA

GTA GB-200 Product guide

Trend Micro

Trend Micro Deep Edge quick start guide