Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiDeceptor 1.0.1 Administration Guide
    1.0.1
    6.0.1
    6.0.0
    5.3.2
    5.3.1
    5.3.0
    5.2.0
    5.1.0
    5.0.0
    4.3.0
    4.2.0
    4.1.1
    4.1.0
    4.0.2
    4.0.1
    4.0.0
    3.3.3
    3.3.2
    3.3.1
    3.3.0
    3.2.2
    3.2.1
    3.2.0
    3.1.1
    3.1.0
    3.0.2
    3.0.1
    3.0.0
    2.1.0
    2.0.0
    1.1.0
    1.0.1

    Deploy Deception VMs with the Deploy Wizard

    Deploy Deception VMs with the Deploy Wizard

    The Deploy Wizard allows you to create and deploy Deception VMs on your network. These Deception VMs appear as real endpoints to the hacker and can collect valuable information about attacks.

    To deploy Decoys on the network:
    1. Go to Deception > Deploy Wizard.
    2. Click + to add a Deception VM.
    3. Configure the following:

      Profile Name

      Specify the name of the deployment profile in 1-15 characters. A-Z, a-z, 0-9, dash or underscore allowed. Cannot be duplicate of the existing profile name.

      Available VMs

      Select one of the available VM Images. Windows or Ubuntu VM Images are available.

      Selected Services

      The selected services are shown. This field is not editable.

    4. Set SSH or SAMBA to ON for an Ubuntu VM. Set RDP or SMB to ON for Windows.
    5. Click Add Decoy for the respective service and configure the following:

      Username

      Specify the username for the decoy in 1-19 characters. A-Z, a-z, or 0-9, allowed.

      Password

      Specify the password for the decoy in 1-14 non-unicode characters.

      Sharename

      Specify a Sharename in 3-63 characters. A-Z, a-z, or 0-9, allowed. This option is for a SAMBA (Ubuntu) or SMB (Windows).

      Update or Cancel

      Click Update to save the username and password. Click Cancel to discard the username and password. Click Delete to delete an existing decoy.
    6. Repeat step 5 to add more decoys.
    7. Switch Launch Immediately to ON to launch the Deception VMs.
    8. Click Next.
    9. Specify the Hostname in 1-15 characters.The hostname can start with English characters/digits, and must not end with a hyphen. It may contain only the ASCII letters a through z (in a case-insensitive manner), the digits 0 through 9, and the hyphen ('-'). No other symbols, punctuation characters, or white space are permitted. Hostname cannot conflict with existing Decoy names.
    10. Click Add Interface.
    11. In the Add Interface for Deception VM screen, select the Deploy Interface. This is the VLAN or Subnet added in the following topic: Set up the Monitored Network
    12. Configure the following settings in the Add Interface for Deception VM screen:
      Addressing Mode Select Static or DHCP. Selecting Static will allow you to configure the IP address for all the decoys. Selecting DHCP will enable the decoys to receive IP address from the DHCP server.
      Network Mask The network mask is shown automatically.
      Gateway Specify the gateway.
      IP Count Specify the number of IP address to be assigned. The maximum per Deception VM is 16 IPs. IP count will automatically switch to 1 if the addressing mode is DHCP.
      Min The minimum IP address in the IP range.
      Max The maximum IP address in the IP range.
      IP Ranges Specify the IP range between Min and Max.
    13. Click Done.
    14. Click Template to save as a template. The template is visible with the Profile Name in Deception > Deploy Wizard.
    15. Click Deploy to deploy the decoys on the network.
    Previous
    Next

    Deploy Deception VMs with the Deploy Wizard

    Deploy Deception VMs with the Deploy Wizard

    The Deploy Wizard allows you to create and deploy Deception VMs on your network. These Deception VMs appear as real endpoints to the hacker and can collect valuable information about attacks.

    To deploy Decoys on the network:
    1. Go to Deception > Deploy Wizard.
    2. Click + to add a Deception VM.
    3. Configure the following:

      Profile Name

      Specify the name of the deployment profile in 1-15 characters. A-Z, a-z, 0-9, dash or underscore allowed. Cannot be duplicate of the existing profile name.

      Available VMs

      Select one of the available VM Images. Windows or Ubuntu VM Images are available.

      Selected Services

      The selected services are shown. This field is not editable.

    4. Set SSH or SAMBA to ON for an Ubuntu VM. Set RDP or SMB to ON for Windows.
    5. Click Add Decoy for the respective service and configure the following:

      Username

      Specify the username for the decoy in 1-19 characters. A-Z, a-z, or 0-9, allowed.

      Password

      Specify the password for the decoy in 1-14 non-unicode characters.

      Sharename

      Specify a Sharename in 3-63 characters. A-Z, a-z, or 0-9, allowed. This option is for a SAMBA (Ubuntu) or SMB (Windows).

      Update or Cancel

      Click Update to save the username and password. Click Cancel to discard the username and password. Click Delete to delete an existing decoy.
    6. Repeat step 5 to add more decoys.
    7. Switch Launch Immediately to ON to launch the Deception VMs.
    8. Click Next.
    9. Specify the Hostname in 1-15 characters.The hostname can start with English characters/digits, and must not end with a hyphen. It may contain only the ASCII letters a through z (in a case-insensitive manner), the digits 0 through 9, and the hyphen ('-'). No other symbols, punctuation characters, or white space are permitted. Hostname cannot conflict with existing Decoy names.
    10. Click Add Interface.
    11. In the Add Interface for Deception VM screen, select the Deploy Interface. This is the VLAN or Subnet added in the following topic: Set up the Monitored Network
    12. Configure the following settings in the Add Interface for Deception VM screen:
      Addressing Mode Select Static or DHCP. Selecting Static will allow you to configure the IP address for all the decoys. Selecting DHCP will enable the decoys to receive IP address from the DHCP server.
      Network Mask The network mask is shown automatically.
      Gateway Specify the gateway.
      IP Count Specify the number of IP address to be assigned. The maximum per Deception VM is 16 IPs. IP count will automatically switch to 1 if the addressing mode is DHCP.
      Min The minimum IP address in the IP range.
      Max The maximum IP address in the IP range.
      IP Ranges Specify the IP range between Min and Max.
    13. Click Done.
    14. Click Template to save as a template. The template is visible with the Profile Name in Deception > Deploy Wizard.
    15. Click Deploy to deploy the decoys on the network.
    Previous
    Next