Cookbook

• Getting started
  • Installing a FortiGate in NAT mode
    • Connecting network devices
    • Configuring interfaces
    • Adding a default route
    • Selecting DNS servers (optional)
    • Creating a policy
    • Results
  • Fortinet Security Fabric installation
    • Configuring Edge
    • Installing Accounting and Marketing
    • Installing Sales
    • Configuring the FortiAnalyzer
    • Adding security profiles (optional)
    • Results
  • VDOM configuration
    • Enabling and creating VDOMs
    • Configuring a management interface
    • Assigning interfaces
    • Creating per-VDOM administrators
    • Configuring the VDOMs
    • Configuring global security profiles
    • Results
  • FortiGate registration and basic settings
    • Registering your FortiGate
    • Setting system time
    • Creating administrators
    • Using a trusted host (optional)
    • Results
  • Verifying FortiGuard licenses and troubleshooting
    • Viewing your licenses
    • Troubleshooting
    • Results
  • Logging FortiGate traffic and using FortiView
    • Configuring log settings
    • Enabling logging
    • Results
  • Creating security policies for different users
    • Creating the Employee user and policy
    • Creating the Accounting user and policy
    • Creating the Admin user, device, and policy
    • Ordering the policy table
    • Results
  • Upgrading FortiGate firmware
    • Checking the current FortiOS firmware
    • Upgrading to the latest version
    • Results
  • Tags in the Fortinet Security Fabric
    • Creating tag categories and tags
    • Applying tags
    • Results
  • Port forwarding
    • Creating virtual IP addresses
    • Creating a virtual IP group
    • Creating a security policy
    • Results
  • Security Rating
    • Checking the Security Rating widget
    • Checking your Security Rating
    • Results
  • Automation stitches
    • Creating the Automation stitches
    • Testing the Automation stitches
    • Results
  • FortiSandbox in the Fortinet Security Fabric
    • Checking your Security Rating
    • Connecting the FortiSandbox
    • Allowing VM Internet access
    • Adding FortiSandbox to the Security Fabric
    • Adding sandbox inspection to security profiles
    • Results
  • FortiManager in the Fortinet Security Fabric
    • Connecting the FortiManager
    • Allowing Internet access
    • Configuring central management
    • Results
  • Redundant Internet with SD-WAN
  • Blocking malicious domains using threat feeds
• Authentication
  • Agent-based FSSO for Windows AD
    • Installing the FSSO agent
    • Configuring the FSSO agent
    • Setting up your FortiGate for FSSO
    • Results
  • FSSO in polling mode for Windows AD
    • Creating a Fabric Connector
    • Creating a user group
    • Creating a policy
    • Results
• High availability
  • High availability with two FortiGates
    • Setting up registration and licensing
    • Configuring the primary FortiGate for HA
    • Connecting the backup FortiGate
    • Configuring the backup FortiGate
    • Viewing the status of the HA cluster
    • Results
    • (Optional) Upgrading the firmware for the HA cluster
  • High Availability with FGCP (expert)
    • Configuring the primary FortiGate
    • Configuring the backup FortiGate
    • Connecting the primary and backup FortiGates
    • Checking cluster operation
    • Disabling override (recommended)
    • Results
  • Adding a third FortiGate to an FGCP cluster (expert)
    • Enabling override on the primary FortiGate (optional)
    • Configuring the new FortiGate
    • Connecting the new FortiGate to the cluster
    • Checking cluster operation
    • Disabling override (recommended)
    • Converting to an active-active cluster
    • Results
  • FGCP Virtual Clustering with two FortiGates (expert)
    • Preparing the FortiGates
    • Configuring clustering
    • Connecting and verifying cluster operation
    • Adding VDOMs and setting up virtual clustering
    • Checking virtual cluster operation
    • Results
  • FGCP Virtual Clustering with four FortiGates (expert)
    • Preparing the FortiGates
    • Configuring clustering
    • Connecting and verifying cluster operation
    • Adding VDOMs and setting up virtual clustering
    • Checking virtual cluster operation
    • Results
  • SD-WAN with FGCP HA (expert)
    • Connecting the FortiGate to your ISPs
    • Removing existing configuration references to interfaces
    • Creating the SD-WAN interface
    • Configuring SD-WAN load balancing
    • Creating a static route for the SD-WAN interface
    • Configuring a security policy for SD-WAN
    • Configuring the FortiGate for HA
    • Configuring the backup FortiGate
    • Connecting the primary and backup FortiGates
    • Checking cluster operation
    • Disabling override (recommended)
    • Results
    • Testing HA failover
    • Testing ISP failover
• Security profiles
  • Blocking Facebook while allowing Workplace by Facebook
    • Creating a web filter profile
    • Applying the security profiles
    • Results
  • Antivirus scanning using flow-based inspection
    • Verifying the inspection mode
    • Configuring the AntiVirus profile
    • Enabling antivirus in a policy
    • Results
  • FortiSandbox in the Fortinet Security Fabric
    • Checking the Security Rating
    • Connecting the FortiSandbox and Edge
    • Allowing VM Internet access
    • Adding the FortiSandbox to the Security Fabric
    • Adding sandbox inspection to security profiles
    • Results
  • DNS Filtering
    • Creating a DNS web filter profile
    • Enabling DNS filtering in a security policy
    • Results
    • (Optional) Changing the FortiDNS server and port
    • Troubleshooting
  • Content Disarm and Reconstruction (CDR)
    • Setting the system inspection mode
    • Testing FortiSandbox connectivity
    • Enabling Content Disarm and Reconstruction
    • Configuring the Internet access policy
    • Results
    • Troubleshooting
  • Preventing certificate warnings (CA-signed certificate)
    • Using a CA-signed certificate
    • Generating a CSR on a FortiGate
    • Getting the certificate signed by a CA
    • Importing the signed certificate to your FortiGate
    • Editing the SSL inspection profile
    • Importing the certificate into web browsers
    • Results
  • Preventing certificate warnings (default certificate)
    • Using the default certificate
    • Generating a unique certificate
    • Downloading the certificate
    • Applying SSL inspection to a policy
    • Importing the certificate into web browsers
    • Results
  • Preventing certificate warnings (self-signed)
    • Creating a certificate with OpenSSL
    • Importing the self-signed certificate
    • Editing the SSL inspection profile
    • Applying SSL inspection to a policy
    • Importing the certificate into web browsers
    • Results
  • Why you should use SSL inspection
• VPNs
  • SSL VPN using web and tunnel mode
    • Editing the SSL VPN portal
    • Configuring the SSL VPN tunnel
    • Adding security policies
    • Verifying remote user OS and software
    • Results
  • SSL VPN with RADIUS and FortiToken
    • Creating a user and a user group
    • Creating the RADIUS client
    • Connecting the FortiGate to FortiAuthenticator
    • Allowing users to connect to the VPN
    • Results
  • FortiToken Mobile Push for SSL VPN
    • Adding FortiToken to FortiAuthenticator
    • Adding user to FortiAuthenticator
    • Creating the RADIUS client on FortiAuthenticator
    • Connecting the FortiGate to the RADIUS server
    • Configuring the SSL VPN
    • Results
  • IPsec VPN with FortiClient
    • Adding a firewall address
    • Configuring the IPsec VPN
    • Creating a security policy
    • Configuring FortiClient
    • Results
  • One-Click VPN (OCVPN)
    • Enabling OCVPN
    • Confirming cloud membership
    • Results
    • Troubleshooting
  • Site-to-site IPsec VPN with two FortiGate devices
    • Configuring IPsec VPN on HQ
    • Configuring IPsec VPN on Branch
    • Results
  • Fortinet Security Fabric over IPsec VPN
    • Configuring tunnel interfaces
    • Adding tunnel interfaces to the VPN
    • Authorizing Branch for the Security Fabric
    • Allowing Branch to access the FortiAnalyzer
    • Results
    • Desynchronizing settings for Branch (optional)
  • Site-to-site IPsec VPN with overlapping subnets
    • Planning the new addressing scheme
    • Configuring the IPsec VPN on HQ
    • Configuring static routes on HQ
    • Configuring address objects on HQ
    • Configuring firewall policies on HQ
    • Configuring IPsec VPN on Branch
    • Configuring static routes on Branch
    • Configuring address objects on Branch
    • Configuring firewall policies on Branch
    • Results
    • Explanation
  • IPsec VPN to Alibaba Cloud (AliCloud)
    • Configuring the Alibaba Cloud (AliCloud) VPN gateway
    • Configuring the FortiGate
• WiFi
  • Setting up WiFi with FortiAP
    • Connecting FortiAP
    • Creating an SSID
    • Creating a custom FortiAP profile
    • Creating a security policy
    • Results
  • Replacing the Fortinet_Wifi certificate
  • Guest WiFi accounts
    • Creating a guest user group
    • Creating an SSID
    • Creating a security policy
    • Creating a guest user management account
    • Creating a guest user account
    • Results
• Change log