The interface name and description, where applicable.

Failover IP will be listed under this field with the following descriptor:(cluster external port).

port1 is hard-coded as the administration interface. You can select to enable or disable HTTP, SSH, Telnet access rights on port1. HTTPS is enabled by default. port1 can be used for Device mode, although a different, dedicated port is recommended.

port2 can be used for Sniffer mode, Device mode, and inter-node communication within a cluster.

port3 is reserved for outgoing communication triggered by the execution of the files under analysis. It is recommended to put this interface on an isolated network behind a firewall.

One special type of outgoing communication from a guest VM is used to connect to the Microsoft Windows activation server to activate the Windows Sandbox VM product keys. You must enable Allow Virtual Machines to access external network through outgoing port and setup the next hop gateway and DNS server to allow files running inside VMs to access the external network. Office licenses are verified through the VM machines, so internet access via port3 is required to contact Microsoft for the license activation.

If the VM cannot access the outside network, a simulated network (SIMNET) will start by default. SIMNET provides responses of popular network services, like http where certain malware is expected. If the VM internet access is down, beside the down icon, SIMNET status is displayed. Clicking it will enter the VM network configuration page. Note: SIMNET is not a real internet. This can affect catch rate. Do not to have an IP from the production IP pool for the IP assignment on port3 because there is a chance it will get blacklisted.

FortiSandbox VM accesses external network through port3. The next-hop gateway and DNS settings can be configured in Scan Policy > General > Allow Virtual Machines to access external network through outgoing port3.

Note: It is not recommended to have an IP from the production IP pool for the IP assignment on port3, since there is a chance it will get blacklisted.

port4 can be used for Sniffer mode, Device mode, and inter-node communication within a cluster.

port5 and port 6 can be used for Sniffer mode, Device mode, and inter-node communication within a cluster. On FortiSandbox 2000E, 3000E and 3500D devices, port5 and port6 are 10G fiber ports. It is recommended that they be used on a master node/primary slave as communications ports with the cluster slaves.

port7 and port8 can be used for Sniffer mode, Device mode, and inter-node communication within a cluster.

On FortiSandbox 3000D devices, port7 and port8 are 10G fiber ports. It is therefore recommended that they be used on a master node/primary slave as communications ports with the cluster slaves.

The IPv4 IP address and subnet mask of the interface.

The IPv6 IP address and subnet mask of the interface.

• Interface is up
• Interface is down
• Interface is being used by sniffer

• Link up
• Link down

The access rights associated with the interface. HTTPS is enabled by default on port1 or any other administrative port set through the CLI command set admin-port. You can select to enable HTTP, SSH, and Telnet access on the administrative port.

Click the PCAP icon to sniff the traffic of an interface for up to 60 seconds then download the PCAP file in a ZIP format (maximum 100MB file size).

Users can define the tcpdump filter to use, such as host 172.10.1.1 and TCP port 443.

Only one capture is allowed to run at a time for each port. Sniffing ports are combined and treated as a single port.