Offline Install and Upgrade

This document describes the steps needed to install and upgrade FortiSIEM in a closed environment without internet access. In some cases, FortiSIEM communicates with a repository to download the latest updates. This can be eliminated by setting up a local repository.

• Fresh Installation

  • FIPS Disabled

  • FIPS Enabled

• 5.3.x or 5.4.0 to 6.1.x Migration

  • Enabling FIPS after Migration

• 6.5.2 Upgrade

  • Supervisor/Worker Upgrade

  • Collector Upgrade

• Configuring an Existing FSM Install to use Local Repository Mirror

• Local RockyLinux Repository Mirror Installation

  • Repository Mirror Deployment and Apache Staging

  • Configuring the Network Adapter

  • Installing the Yum-Utils Package

  • Preparing the Disk for the Local Repository Mirror

  • Configuring Apache to Publish the Local Repository Mirror

  • Verifying Remote Connectivity to the Local Repository Mirror

  • Syncing the Local Repository Mirror

Fresh Installation

There are two options for fresh installation, FIPS disabled, or FIPS enabled.

• FIPS Disabled Installation

• FIPS Enabled Installation

FIPS Disabled Installation

With FIPS disabled, a fresh installation does not require internet access and can be performed in a closed environment. Run the following command:
# configFSM.sh
and select 1 install_without_fips.

FIPS Enabled Installation

A FIPS enabled fresh installation requires internet access to Fortinet's RockyLinux repository. This can be re-routed to an offline repository by taking the following steps.

Note: For hardware appliance users, make sure to skip step 2.

1. Complete the Local RockyLinux Repository Mirror Installation.

2. Deploy your FortiSIEM VA onto your hypervisor.

3. Log into the FortiSIEM local console through your hypervisor.
   Default login:
   

   User = root

   Password = ProspectHills

4. Immediately change the root password.

5. Modify the Yum Repository Files to use the local repository by running the following commands.
   

   # cd /etc/yum.repos.d
   # sed -i 's/baseurl=https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/baseurl=https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' *.repo
   # sed -i 's/https\:\/\/os-pkgs-r8.fortisiem.fortinet.com.*//g' *.repo
   # sed -i 's/enabled=1/enabled=1\nsslverify=false/g' *.repo
   # dnf clean all
   

6. Use the appropriate Installation Guide from 6.5 Installation Guides to continue.
   You will need to run the following command, and then select 2 install_with_fips.
   # configFSM.sh
   

5.3.x or 5.4.0 to 6.1.x Migration

FortiSIEM Migration does not require internet access and can be performed in a closed environment. However, if you want to enable FIPS after migrating to 6.1.x, then internet access is required. Follow the steps below to enable FIPS without requiring Internet access.

Enabling FIPS After Migration

Take the following steps to enable FIPS after migration.

1. Complete the 6.1.x Upgrade and below Local CentOS Repository Mirror Installation.

2. Log into FortiSIEM via SSH.

   # ssh root@<FortISIEM Super/Worker/Collector>
   

3. Modify the Yum Repository Files to use the Local Repository by running the following commands.
   

   # cd /etc/yum.repos.d

   # sed -i 's/baseurl=https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/centos8/baseurl=https\:\/\/<REPOSITORY MIRROR IP>\/repos\/centos\/84/g' *.repo
   

   # sed -i 's/https\:\/\/os-pkgs-c8.fortisiem.fortinet.com.*//g' *.repo

   # sed -i 's/enabled=1/enabled=1\nsslverify=false/g' *.repo

   # dnf clean all
   

4. Run the following command and select 3 enable_fips.
   # configFSM.sh
   
   

   

6.5.2 Upgrade

The 6.5.2 upgrade is comprised of two parts, the supervisor/worker upgrade and collector upgrade.

Pre-requisite:

Upgrading with a FortiSIEM build earlier than 6.4.0 requires a CentOS 8.5 repository. This is required for migration, as Rocky Linux scripts will reach out to the CentOS repository to pick up any remaining packages to be updated to the latest, prior to transitioning to Rocky Linux.

• Supervisor/Worker Upgrade

• Collector Upgrade

Supervisor/Worker Upgrade

Take the following steps to prepare an offline upgrade from 6.3.3 or earlier 6.x to 6.5.2 for your supervisor and worker(s). If upgrading from FortiSIEM 6.4.0, start with step 1, otherwise continue with the following instructions.

Note: Upgrading with a FortiSIEM build 6.x build earlier than 6.4.0 requires a CentOS 8.5 repository. Please refer to the 6.3.3 Offline Upgrade Guide - Local CentOS Repository Mirror Installation for information on how to configure a CentOS 8.5 repository.

PDF of guide also available from the following page: https://docs.fortinet.com/document/fortisiem/6.3.3/offline-upgrade-guide/131018/offline-install-and-upgrade

If upgrading to 6.5.0 from a FortiSIEM build earlier than 6.4.0, please run the following commands in order to redirect the current yum.repos.d to an offline CentOS 8.5 repository before proceeding with step 1:

<REPOSITORY MIRROR IP> is a place holder and should be replaced by the address of your locally configured offline repository. For example: 192.168.1.100

# cd /etc/yum.repos.d/

# sed -i 's/baseurl=https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/centos85/baseurl=https\:\/\/<REPOSITORY MIRROR IP> \/repos\/centos\/85/g' *.repo

# sed -i 's/https\:\/\/os-pkgs-c8.fortisiem.fortinet.com.*//g' *.repo

# sed -i 's/enabled=1/enabled=1\nsslverify=false/g' *.repo

1. Upload the FSM_Upgrade_All_6.5.2_build1528.zip onto the 6.x Supervisor/Worker under the /tmp/ folder.

2. Log in and unzip the upgrade package by running the following commands.
   

   # ssh root@<Super/Worker>

   # mkdir -p /opt/upgrade/

   # mv /tmp/FSM_Upgrade_All_6.5.2_build1528.zip /opt/upgrade/

   # unzip FSM_Upgrade_All_6.5.2_build1528.zip

3. Update the migration script migrate_centos_to_rocky.sh:
   

   # cd /opt/upgrade/FSM_Upgrade_All_6.5.2_build1528/install/files/
   
   # sed -i 's/https\:\/\/os-pkgs-r8.fortisiem.fortinet.com\/rockylinux8/https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' migrate_centos_to_rocky.sh
   
   # sed -i 's/https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' migrate_centos_to_rocky.sh
   
   # sed -i 's/curl \-o \/etc\/pki\/rpm\-gpg\/RPM\-GPG\-KEY\-PGDG /curl \-k \-o \/etc\/pki\/rpm\-gpg\/RPM\-GPG\-KEY\-PGDG /g' migrate_centos_to_rocky.sh
   
   # sed -i 's/curl \-o \/etc\/pki\/rpm\-gpg\/RPM\-GPG\-KEY\-rockyofficial /curl \-k \-o \/etc\/pki\/rpm\-gpg\/RPM\-GPG\-KEY\-rockyofficial /g' migrate_centos_to_rocky.sh
   
   # sed -i 's/curl \-o /curl \-k \-o /g' migrate_centos_to_rocky.sh
   
   

4. Edit the migrate_centos_to_rocky.sh script and go to line 697. You can use vi.

   # vi migrate_centos_to_rocky.sh
   

5. Add the following on the line right above “# Distrosync”
   

   # sed -i 's/baseurl=https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/baseurl=https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' /etc/yum.repos.d/Rocky*.repo
   

   # sed -i 's/https\:\/\/os-pkgs-r8.fortisiem.fortinet.com.*//g' /etc/yum.repos.d/Rocky*.repo
   

   # sed -i 's/enabled=1/enabled=1\nsslverify=false/g' /etc/yum.repos.d/Rocky*.repo
   

6. Modify the necessary repository files by running the following set of commands.
   

   Update the Repos Files
   

   # cd /opt/upgrade/FSM_Upgrade_All_6.5.2_build1528/install/files/repos/

   # sed -i 's/baseurl=https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/baseurl=https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' *.repo

   # sed -i 's/https\:\/\/os-pkgs-r8.fortisiem.fortinet.com.*//g' *.repo

   # sed -i 's/enabled=1/enabled=1\nsslverify=false/g' *.repo

   Update PSQL DB Repo

   # cd /opt/upgrade/FSM_Upgrade_All_6.5.2_build1528/install/roles/upgrade-db-server/files

   # sed -i 's/baseurl=https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/baseurl=https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' *.repo

   # sed -i 's/https\:\/\/os-pkgs-r8.fortisiem.fortinet.com.*//g' *.repo

   # sed -i 's/enabled=1/enabled=1\nsslverify=false/g' *.repo

   Update Files that Pick Up the GPG Key for PSQL

   # cd /opt/upgrade/FSM_Upgrade_All_6.5.2_build1528/install/roles/upgrade/tasks/

   # sed -i 's/https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' main.yml

   # sed -i 's/curl \-o /curl \-k \-o /g' main.yml

   # cd /opt/upgrade/FSM_Upgrade_All_6.5.2_build1528/install/roles/upgrade-db-server/tasks/

   # sed -i 's/https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' main.yml

   # sed -i 's/curl \-o /curl \-k \-o /g' main.yml

   Update Clickhouse and Zookeeper Package Files

   # cd /opt/upgrade/FSM_Upgrade_All_6.5.2_build1528/install/group_vars/all

   # sed -i 's/https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/\-k\ https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' setup-zookeeper.yml.j2

   # sed -i 's/https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\/rockylinux8/\-k\ https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' setup-clickhouse.yml.j2

   Perform Clean Up
   # dnf clean all
   

   Prepare yum.conf to Ignore SSL Verification

   # echo sslverify=false >> /etc/yum.conf
   

7. Use the Upgrade Guide located in 6.5 Reference Manuals to continue with your upgrade for the supervisor and worker(s).

Collector Upgrade

For FortiSIEM version 6.5.2, the collector offline upgrade is unsupported at this time. If an offline upgrade is required for the collector, the recommended approach is to re-deploy a new collector on 6.5.2, and update the entry. Please reference Known Issues in the 6.5.2 Release Notes from the FortiSIEM Documentation Library for any possible additional information.

Link for 6.5.2 Collector Deployment Guide: https://docs.fortinet.com/document/fortisiem/6.5.2/esx-installation-guide/131018/fresh-installation#Install_Collectors

Link for 6.5.2 Collector Registration: https://docs.fortinet.com/document/fortisiem/6.5.2/esx-installation-guide/131018/fresh-installation#Register_Collectors

Configuring Existing FSM on RockyLinux Install to use Local Repository Mirror

Sometimes you may want to run a "yum update" on an existing FortiSIEM installation to get the latest patches. Follow these steps to avoid internet access during this step.

Note: This configuration is needed to run Yum updates without needing to go to the internet.

1. Log into all FortiSIEM Supervisor/Worker(s)/Collector(s) that will pull from the new repository by running the following commands.
   

   # ssh root@<Super/Worker/Collector IP>

   # cd /etc/yum.repos.d
   

2. Modify necessary repository files by running the following commands.
   

   # sed -i 's/baseurl=https\:\/\/os-pkgs-cdn.fortisiem.fortinet.com\rockylinux8/baseurl=https\:\/\/<REPOSITORY MIRROR IP>\/repos\/rockylinux8/g' *.repo

   # sed -i 's/https\:\/\/os-pkgs-r8.fortisiem.fortinet.com.*//g' *.repo

   # sed -i 's/enabled=1/enabled=1\nsslverify=false/g' *.repo

   # dnf clean all
   

3. Connect and update from the local repository mirror by running the following the following command.

   # dnf update -y / # yum update -y

   Rocky Linux 8 - AppStream                                                                                                                                                                                    90 MB/s | 9.5 MB     00:00
   Rocky Linux 8 - BaseOS                                                                                                                                                                                      103 MB/s | 8.6 MB     00:00    
   Rocky Linux 8 - Extras                                                                                                                                                                                      289 kB/s |  12 kB     00:00    
   Rocky Linux 8 - PowerTools                                                                                                                                                                                   42 MB/s | 2.3 MB     00:00    
   ELRepo.org Community Enterprise Linux Repository - el8                                                                                                                                                      8.9 MB/s | 293 kB     00:00    
   Extra Packages for Enterprise Linux 8 - x86_64                                                                                                                                                               17 MB/s | 955 kB     00:00    
   Extra Packages for Enterprise Linux 8 - x86_64                                                                                                                                                               97 MB/s |  11 MB     00:00    
   PostgreSQL common RPMs for RHEL/CentOS 8 - x86_64                                                                                                                                                            17 MB/s | 545 kB     00:00    
   PostgreSQL 13 for RHEL/CentOS 8 - x86_64                                                                                                                                                                     12 MB/s | 440 kB     00:00    
   Dependencies resolved.
   Nothing to do.
   Complete! 
   

Local RockyLinux 8 Repository Mirror Installation

Follow these steps to setup a local RockyLinux repository mirror in your internal network. FortiSIEM will only communicate with this local RockyLinux repository mirror whenever needed, thereby avoiding internet access.

You will be going through these general steps:

1. Deploying the base VM to state and setup access to the repository
2. Replicating the remote repository into your new internal mirror
3. Testing the internal mirror for accessibility
4. A walk through for all the FSM nodes in order to reach the internal mirror

Instructions are broken down into the following sections.

• Repository Mirror Deployment and Apache Staging

• Configuring the Network Adapter

• Installing the Yum-Utils Package

• Preparing the Disk for the Local Repository Mirror

• Configuring Apache to Publish the Local Repository Mirror

• Verifying Remote Connectivity to the Local Repository Mirror

• Syncing the Local Repository Mirror

Repository Mirror Deployment and Apache Staging

This server is required to have internet access and be able to resolve [os-pkgs-cdn.fortisiem.fortinet.com] or [os-pkgs-r8.fortisiem.fortinet.com] in order to prepare the repository mirror. Once the Repository Mirror is completed, the internet connection can then be cut off from this repository mirror until the next time the mirror needs to be updated.

When the above conditions are met, take the following steps:

1. Download the 6.5.2.1528 FortiSIEM image and create a VM on your preferred hypervisor.
2. Add an 100GB disk to the FortiSIEM image that was deployed by taking the following steps:
   Note: Instructions to add a disk is based off of vSphere 6.7. Your hypervisor may differ in instructions, but the concept is the same.
   
   1. Right click the FortiSIEM VM > Editing Settings.
   2. In the pop-up, click "Add New Device".
   3. Find "Hard Disk" and select it.
   4. Configure it for 100GB.
   5. Click "OK" to save the configuration.
   6. Boot the FortiSIEM image.

Configuring the Network Adapter

To complete the configuration, take the following steps:

1. Log into the FortiSIEM console through your hypervisor.
   Default login:
   User = root
   Password = ProspectHills
   
2. Immediately change the root password.
3. Enter the IP address configuration utility by running the following command:
   # nmtui-edit eth0
4. Go to IPv4 CONFIGURATION, toggle Automatic, and select Manual from the menu.
5. Toggle Show to expand the configuraion.
6. In the Addresses field, add an IP address/netmask (CIDR).
   Example: 192.168.1.1/24
   Note: Use the tool at this URL to convert netmask to CIDR.
   https://www.xarg.org/tools/subnet-calculator/
7. In the Gateway field, enter the Gateway IP address.
   Example: 192.168.1.254
8. In the DNS Servers field, toggle Add, and select IP of DNS.
   Example: 1.1.1.1
9. In the DNS Servers field, Toggle Add, and add the IP of the second DNS.
   Example: 1.0.0.1
10. Toggle the Automatically connect setting to enable.
11. Toggle the Available to all users setting to enable.
12. Toggle to OK.
    
    
    
13. Restart the network adapter.
    # ifdown eth0
# ifup eth0
14. Check if the IP address is assigned to the network adapter.
    # ifconfig eth0
    The IP address will be assigned to eth0.
15. Ping an external address to verify network connectivity.
    # ping <ip address>
    or
    # ping google.com
    

Installing the Yum-Utils Package

Take the following steps to install the yum-utils package.

1. Clean the current respository from the VM.
   # dnf clean all
2. Install the yum-utils package.
   # dnf install yum-utils -y

Preparing the Disk for the Local Repository Mirror

Take the following steps to prepare your disk for the local repository mirror.

1. Look for the 100GB disk created when the ova was deployed.
   

   # lsblk

   NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT

   sda           8:0    0   25G  0 disk

   ├─sda1        8:1    0    1G  0 part /boot

   └─sda2        8:2    0   24G  0 part

   ├─cl-swap 253:0    0  2.5G  0 lvm  [SWAP]

   └─cl-root 253:1    0 21.5G  0 lvm  /

   sdb           8:16   0   100G  0 disk 			<< New disk

2. Format the disk using xfs file system.
   

   # mkfs.xfs /dev/sdb
   

3. Create a new mount point for the new disk.
   

   # mkdir /repos
   

4. Mount the disk.
   

   # mount -t xfs /dev/sdb /repos

   # chmod 755 /repos
   

5. Edit /etc/fstab and add the mount entry permanently.
   

   # vi /etc/fstab

   /dev/sdb /repos                   xfs     defaults        0 0
   

6. Test /etc/fstab to verify configuration.
   

   # mount -a

Configuring Apache to Publish the Local Repository Mirror

Take the following steps to configure Apache to publish the local repository mirror.

1. Create the link to the repository path.
   

   # cd /var/www/html/
   

   # ln -sf /repos repos
   

   # ls -l /var/www/html/

   result: lrwxrwxrwx. 1 root root 6 Mar 26 16:18 repos -> /repos
   

2. Restart Apache.
   

   # systemctl restart httpd

Verifying Remote Connectivity to the Local Repository Mirror

Take the following step to verify remote connectivity with the repository mirror.

1. From the local network workstation's browser, go to: https://<Repository Mirror IP Address>/
   

Syncing the Local Repository Mirror

Take the following steps to sync the local repository mirror.

1. Sync the FSM Mirror to the repository mirror.

   # mkdir -p /repos/rockylinux8/gpg-keys

   # cd /repos/rockylinux8/gpg-keys

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/gpg-keys/RPM-GPG-KEY-EPEL-8

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/gpg-keys/RPM-GPG-KEY-PGDG

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/gpg-keys/RPM-GPG-KEY-elrepo.org

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/gpg-keys/RPM-GPG-KEY-rockyofficial

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/gpg-keys/RPM-GPG-KEY-rockytesting

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/gpg-keys/CLICKHOUSE-KEY.GPG

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/gpg-keys/RPM-GPG-KEY-FortiSIEM-rocky

   # cd /repos/rockylinux8

   
   

   Note: Reposync will take a longer period of time as it's replicating the entire mirror.

   # reposync --newest-only --download-meta --downloadcomps

   # reposync --repoid=epel-testing

   # reposync --repoid=plus

   Note: Zookeeper has a single file and will not utilize reposync.

   # mkdir –p /repos/rockylinux8/zookeeper

   # cd zookeeper

   # wget https://os-pkgs-cdn.fortisiem.fortinet.com/rockylinux8/zookeeper/apache-zookeeper-3.7.0-bin.tar.gz

2. Verify repository mirror's folder paths.

   # ls -la
   total 96 
   drwxrwxr-x.  4 root root    73 Mar 23 17:29 appstream
   drwxrwxr-x.  4 root root    73 Mar 23 17:34 baseos
   drwxr-xr-x.  3 root root  4096 Mar 23 18:40 clickhouse
   drwxrwxr-x.  4 root root    52 Mar 23 17:19 elrepo
   drwxr-xr-x.  4 root root    52 Mar 23 17:18 elrepo-testing
   drwxrwxr-x.  4 root root    55 Jan 19 15:31 epel
   drwxrwxr-x.  4 root root    38 Jan 19 15:30 epel-modular
   drwxr-xr-x.  4 root root    75 Dec 14 18:38 epel-testing
   drwxrwxr-x.  4 root root    38 Mar 23 17:36 extras
   drwxrwxr-x.  2 root root   177 Jan 19 17:08 gpg-keys
   drwxrwxr-x.  3 root root 32768 Jan 19 15:35 pgdg13
   drwxrwxr-x.  3 root root 32768 Jan 19 15:35 pgdg-common
   drwxr-xr-x.  4 root root    56 Dec 14 18:38 plus
   drwxrwxr-x.  4 root root    73 Mar 23 17:36 powertools
   drwxr-xr-x.  2 root root    47 Jan 19 18:12 zookeeper
   
   

3. Modify Permissions and Restart Apache on the repository mirror.
   # chmod -R 755 /repos
# systemctl restart httpd
   

4. Check repository mirror.
   Locally, run the following command:
   # curl -k https://localhost/repos/rockylinux8/
   Remotely:
   Open a browser, and go to: https://<Repository Mirror IP>/repos/rockylinux8/