Deploying FortiDeceptor in offline or air-gapped networks

This section shows how to deploy FortiDeceptor in an offline or air-gapped network with no internet access, using the following procedures.

• Applying the license in an offline or air-gapped network
• Importing deception VMs in an offline or air-gapped network
• Importing firmware in an offline or air-gapped network
• Importing an FDS package via FDC GUI in an offline or air-gapped network
• Importing FDS package and license file via FortiManager in an offline or air-gapped network

FortiDeceptor uses deception VMs to deploy decoys across the network. Deploying FortiDeceptor VMs in a closed network requires downloading the required images directly from the FortiDeceptor VM external repository and manually uploading the deception VMs. The FortiDeceptor hardware appliance already has deception VMs pre-configured and loaded. For new deception VMs, update the hardware appliance.

You can also use the Deception > Deception OS page or the fw-upgrade CLI command to download and import packages.

Because FortiDeceptor also uses FDS services (IPS/AV/WEB) in offline and air-gapped networks, you must also import these packages.

Deception VM security

You can download deception VMs via the HTTPS protocol. Each image is compressed, encrypted, and packed by the FDC tool separately. The metafile describes the MD5 of each VM image.

The security layers that protect deception images are:

• Download via HTTPS.
• Deception VMs do not have any Fortinet propriety software.
• We provide the file's MD5 so that you can confirm the MD5 checksum for the downloaded files.
• FortiDeceptor always verifies the VM image by encryption and multiple layer checksum inside the package before installing it.