The Central Management console lets you manage remote FortiDeceptor appliances including Decoy VMs deployment, system configuration, and incident alert monitoring.
You can configure a FortiDeceptor hardware or VM appliance to be manager or client (remote appliance). The FortiDeceptor manager or client is a configuration setting for the same FortiDeceptor appliance and software.
The FortiDeceptor manager has deception capabilities. You can use it to deploy deception (decoy and lures) in its network environment.
When a central manager manages a remote client, the remote client admin GUI tree menu is limited to Network, System, and Log. Configure trusted hosts in System > Administrators to avoid any remote client access outside the management or other trusted IP addresses.
Most admin GUI menu items update to reflect manager and remote client. When you deploy decoy or network, select local or remote client/appliance name. Use the local configuration to deploy decoys and lures from the manager appliance.
Before configuring FortiDeceptor as a client, do a
factory reset and basic network configuration to avoid data incompatibility between manager and client. For more information on manager and client configuration, see the CLI Reference.
This example configures the following topology scenario:
- 1 Central Manager with IP address 172.16.130.12
- 1 remote appliance (client) with IP address 172.16.130.13
- On the manager side, use this CLI command:
cm -sc -mM -nManager -a1234567890
- On the client side, use this CLI command:
cm –sc –mC –nAppliance1 –a1234567890 -i172.16.130.12
- In the FortiDeceptor manager GUI, go to Central Management > Appliances.
In the manager, the remote client (appliance) shows its Status as On-Hold, that is, waiting for approval.
- Use the buttons in the Central Management Appliances pane to manage clients (remote appliances).
Allow the selected clients to participate in Central Management.
Pause the selected clients’ participation in Central Management.
Pause the selected clients and then permanently delete related data in the manager’s local database, including OS, network settings, decoys, and lures.
This action does not delete or change any data in clients; and this action does not delete or change incident and campaign data generated in the past.
Force re-sync all data between manager and selected clients.
Send signal to selected clients to reboot.
- Select the appliance and click Approve.
When the client is approved, its The Status changes to Approved.
- In the FortiDeceptor client GUI, go to Central Management > Appliances.
- In the Action column, click Config.
- Use the tabs to configure the client (remote appliance) from the Central Manager console.
Push FortiDeceptor firmware updates and upgrades to the remote client. Synchronization can be immediate or scheduled.
Push deception VM images from the manager to the remote client. Synchronization can be immediate or scheduled.
Configure the remote client network routing table.
Configure the remote client DNS configuration.
Configure the remote client FortiGuard configuration.
- Click the Deception OS tab to view deception OS details.
The deception OS table is a hybrid list that shows:
- OS initialized on client.
- OS initialized on manager but not yet on client.
Current status of deception OS image on client.
Name of deception OS.
Type of this deception OS.
Category of this deception OS.
Lure services can be provided by this deception OS.
- For an OS initialized on manager but not yet on client, you can select to synchronize immediately or set a date and time for synchronization.
- On the client (remote appliance), run this CLI command:
cm -sc -mN
After a client leaves Central Management, its status on the manager changes to Wait.
- On the manager, select that client and click Delete.
- On the manager, run this CLI command:
cm -sc -mN