Deploying SDN Connector with FortiManager

Deploying SDN Connector when using FortiManager consists of the following steps:

1. Configure a Fabric SDN Connector.
2. Create or import address objects.
3. Map the web and app interfaces.
4. Create policies leveraging the address objects.
5. Push the configuration to the FortiGate.

To configure a Fabric SDN Connector:

1. In FortiManager, go to Policy & Objects > Security Fabric > Fabric Connectors.
2. Click Create New.

   

3. Configure the SDN Connector. The default port is 5671.

   

To create or import address objects:

To import address objects, do the following:

1. Go to Policy & Objects > Security Fabric > Fabric Connectors.
2. Right-click the newly created SDN Connector and select Import from the context menu.

   

3. In the Import SDN Connector dialog, select the EPGs to import. In this example, the AP|app and AP|web EPGs are imported.

   

To manually create address objects, do the following:

1. Go to Policy & Objects > Firewall Objects > Addresses.
2. Click Create New > Address.

   

3. Configure a dynamic address for the web EPG. Ensure that the format for the endpoint group name is entered as "Application Profile name|EPG name". This is case-sensitive. In Cisco ACI deployment, the application profile was named "AP", and the EPGs were named "app" and "web". Therefore, the correct format is AP|app and AP|web, as shown below.

   

4. Repeat steps 2 and 3 to configure a dynamic address for the app EPG.

To map the web and app interfaces:

1. Go to Policy & Objects > Zone/Interface > Interface.
2. Click Create New > Dynamic Interface.

   

3. Create an interface for the web EPG that maps to the correct port and VLAN.

   

4. Repeat step 3 for the app EPG.

   

To create policies leveraging the address objects:

1. Go to Policy & Objects > Policy Packages > default > Installation Targets.
2. Click Add.

   

3. In the Add Installation Targets dialog, select the managed FortiGate. Click OK.

   

4. Go to Policy & Objects > Policy Packages > default > IPv4 Policy.
5. Click Create New.

   

6. Create a policy that allows communication from the web EPG to the app EPG as shown:

   

7. Create a policy that allows communication from the app EPG to the web EPG as shown:

   

To push the configuration to the FortiGate:

1. Go to Policy & Objects > Policy Packages > default > IPv4 Policy.
2. Click Install > Install Wizard.

   

3. In the Install Wizard, ensure that the default policy package is selected. Click Next.
4. Select the managed FortiGate. Click Next.
5. Ensure that the summary is correct, then click Install.
6. When installation is complete, click Finish.
7. In FortiOS, go to Policy & Objects > IPv4 Policy to ensure that the policies were pushed and are configured as desired.

   

8. Ensure that an endpoint in the web EPG and an endpoint in the app EPG can ping each other.