Configuring network interfaces
Fortinet devices can be connected to any of the FortiManager unit's interfaces. The DNS servers must be on the networks to which the FortiManager unit connects, and should have two different IP addresses.
If the FortiManager unit is operating as part of an HA cluster, it is recommended to configure interfaces dedicated for the HA connection / synchronization. However, it is possible to use the same interfaces for both HA and device management. The HA interface will have /HA appended to its name.
The following port configuration is recommended:
- Use port 1 for device log traffic, and disable unneeded services on it, such as SSH, Web Service, and so on.
- Use a second port for administrator access, and enable HTTPS, Web Service, and SSH for this port. Leave other services disabled.
To configure port 1:
- Go to System Settings > Network.The Interface pane is displayed at the top of the page.
- In the Interface pane, double-click Port1. The Edit System Interface pane is displayed.
- Configure the following settings for port1, then click OK to apply your changes.
Name
Displays the name of the interface.
IP Address/Netmask
The IP address and netmask associated with this interface.
IPv6 Address
The IPv6 address associated with this interface.
Administrative Access
Select the allowed administrative service protocols from: HTTPS, HTTP, PING, SSH, SNMP, and Web Service.
IPv6 Administrative Access
Select the allowed IPv6 administrative service protocols from: HTTPS, HTTP, PING, SSH, SNMP, and Web Service.
Service Access
Select the Fortinet services that are allowed access on this interface. These include FortiGate Updates and Web Filtering. Service access is not enabled on any port by default.
Specify the Bind to IP Address:
- The IP address specified in Bind to IP Address address should be a unique address on the same subnet as the IP address of the interface. This IP address is used for update and rating requests to FortiManager over TCP/443.
FortiManager can only configure one interface with update and rating service using port 443.
When configuring FortiManager as a local FortiGuard server for FortiGate, you must use the Bind to IP addresses for the update and rating services over TCP/443.
The Bind to IP address does not need to be configured for update services if the default port was not changed to TCP/443. See the FortiGate Admin Guide for more information.
Status
Select Enable or Disable.
- Configure the DNS settings, and click Apply.
Primary DNS Server
The primary DNS server IP address.
Secondary DNS Server
The secondary DNS server IP address.
To configure additional ports:
- Go to System Settings > Network. The Interface pane is displayed at the top of the page.
- In the Interface pane, double-click on a port, right-click on a port then select Edit from the pop-up menu, or select a port then click Edit in the toolbar. The Edit System Interface pane is displayed.
- Configure the settings as required.
- Click OK to apply your changes.
|
The port name, default gateway, and DNS servers cannot be changed from the Edit System Interface pane. The port can be given an alias if needed. |