Connecting to the web UI or CLI
To configure, maintain, and administer the FortiWeb appliance, you need to connect to it. There are two methods:
Web UI—A graphical user interface (GUI), from within a web browser. It can display reports and logs, but lacks many advanced diagnostic commands. For usage, see How to use the web UI.
Command line interface (CLI)—A text interface similar to DOS or UNIX commands, from a Secure Shell (SSH) or Telnet terminal, or from the JavaScript CLI Console widget in the web UI (System > Status > Status). It provides access to many advanced diagnostic commands as well as configuration, but lacks reports and logs. For usage, see the FortiWeb CLI Reference:
http://docs.fortinet.com/fortiweb/reference
Access to the CLI and/or web UI through your network is not yet configured if:
- you are connecting for the first time
- you have just reset the configuration to its default state
- you have just restored the firmware
In these cases, you must initially connect your computer directly to FortiWeb, using the default settings.
|
If you are installing a FortiWeb-VM virtual appliance, you should have already connected if you followed the instructions in the FortiWeb-VM Install Guide (http://docs.fortinet.com/fortiweb/hardware). If so, you can skip this chapter and continue with Changing the “admin” account password. |
Via the direct connection, you can use the web UI or CLI to configure FortiWeb’s basic network settings. Once this is done, you will be able to place FortiWeb on your network, and use FortiWeb through your network.
|
Until the FortiWeb appliance is configured with an IP address and connected to your network, you may prefer to connect the FortiWeb appliance directly to your management computer, or through a switch, in a peer network that is isolated from your overall network. This will improve security during setup. However, isolation is not required. |
Connecting to the web UI
You can connect to the web UI using its default settings:
| Network Interface | port1 |
| URL | https://192.168.1.99/ |
| Administrator Account | admin |
| Password |
Requirements
- A computer with an RJ-45 Ethernet network port
- A web browser such as Microsoft Internet Explorer version 6.0 or greater, or Mozilla Firefox 3.5 or greater
- A crossover Ethernet cable
To connect to the web UI
- On your management computer, configure the Ethernet port with the static IP address 192.168.1.2 with a netmask of 256.256.256.0.
- Using the Ethernet cable, connect your computer’s Ethernet port to the FortiWeb appliance’s port1.
- Start your browser and enter the following URL:
https://192.168.1.99
(Remember to include the “s” in https://.)
Your browser connects the appliance.
If you do not see the login page due to an SSL cipher error during the connection, and you are connecting to the trial license of FortiWeb-VM or a LENC version of FortiWeb, then your browser must be configured to accept encryption of 64-bit strength or less during the handshake. RC2 and DES with less than 64-bit strength is supported. AES and 3DES is not supported in these versions.
For example, in Mozilla Firefox, if you receive this error message:
ssl_error_no_cypher_overlap
To support HTTPS authentication, the FortiWeb appliance ships with a self-signed security certificate, which it presents to clients whenever they initiate an HTTPS connection to the FortiWeb appliance. When you connect, depending on your web browser and prior access of the FortiWeb appliance, your browser might display two security warnings related to this certificate:
- The certificate is not automatically trusted because it is self-signed, rather than being signed by a valid certificate authority (CA). Self-signed certificates cannot be verified with a proper CA, and therefore might be fraudulent. You must manually indicate whether or not to trust the certificate.
- The certificate might belong to another website. The common name (CN) field in the certificate, which usually contains the host name of the website, does not exactly match the URL you requested. This could indicate server identity theft, but could also simply indicate that the certificate contains a domain name while you have entered an IP address. You must manually indicate whether this mismatch is normal or not.
Both warnings are normal for the default certificate. TLS v1.0 is supported.
For details on accepting the certificate, see the documentation for your web browser.
admin, then click Login. In its default state, there is no password for this account.Login credentials entered are encrypted before they are sent to the FortiWeb appliance. If your login is successful, the web UI appears. To continue by updating the firmware, see Updating the firmware. Otherwise, to continue by setting an administrative password, see Changing the “admin” account password.
|
|
If 3 incorrect login or password attempts occur in a row, your IP address will be temporarily blacklisted from the GUI and CLI (network, not console). This is to protect the appliance from brute force login attacks. Wait 1 minute, then attempt the login again. |
Connecting to the CLI
Using its default settings, you can access the CLI from your management computer in three ways via:
- the Web UI
- A local console connection
- An SSH connection, either local or through the network
Secure Shell (SSH) provides both secure authentication and secure communications to the CLI. Supported SSH protocol versions, ciphers, and bit strengths include SSH version 2 with AES-128, 3DES, Blowfish, and SHA-1.
These are the default settings to connect to the CLI via SSH:
| Network Interface | port1 |
| IP Address | 192.168.1.99 |
| SSH Port Number | 22 |
| Administrator Account | admin |
| Password |
|
|
If you are not connecting for the first time, nor have you just reset the configuration to its default state or restored the firmware, administrative access settings may have already been configured. In this case, access the CLI using the IP address, administrative access protocol, administrator account and password already configured, instead of the default settings. |
Alternatively, you can access the CLI via SSH and a public-private key pair. However, to use this option, you first access the CLI using the CLI Console widget (part of the web UI status dashboard) or via SSH and password to upload the public key. For details, see To connect to the CLI using an SSH connection and public-private key pair.
The following procedures describe connection using PuTTY software; steps may vary with other terminal emulators.
To use the CLI in the web UI
You must have already completed To connect to the web UI.
- In the top-right corner of the window from any location in the web UI, click the Console Access icon:
- To detach the CLI Console from the Web UI, click the Detach icon in the toolbar of the CLI Console window:
The console will open on top of the current window of the Web UI.
The CLI Console will open in a new tab in your browser.
To connect to the CLI using a local console connection
You must have:
- A computer with an available serial communications (COM) port
- The RJ-45-to-DB-9 or null modem cable included in your FortiWeb package
- Terminal emulation software such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)
- Using the RJ-45-to-DB-9 or null modem cable, connect your computer’s serial communications (COM) port to the FortiWeb appliance’s console port.
- Verify that the FortiWeb appliance is powered on.
- On your management computer, start a terminal emulation software such as PuTTY.
- In the Category tree on the left, go to Connection > Serial and configure these settings:
- In the Category tree on the left, go to Session (not the sub-node, Logging) and from Connection type, select Serial.
- Click Open.
- Press the Enter key to initiate a connection.
- Type
adminthen press Enter twice. (In its default state, there is no password for theadminaccount.)
| Serial line to connect to | COM1 (or, if your computer has multiple serial ports, the name of the connected serial port) |
| Speed (baud) | 9600 |
| Data bits | 8 |
| Stop bits | 1 |
| Parity | None |
| Flow control | None |
The login prompt appears.
The CLI displays the following text, followed by a command line prompt:
Welcome!
You can now enter commands. To continue by updating the firmware, see Updating the firmware. Otherwise, to continue by setting an administrative password, see Changing the “admin” account password. For information about how to use the CLI, see the FortiWeb CLI Reference:
http://docs.fortinet.com/fortiweb/reference
To connect to the CLI using an SSH connection and password
You must have:
- a computer with an RJ-45 Ethernet port
- a crossover Ethernet cable (if connecting directly) or straight-through Ethernet cable (if connecting through a switch or router)
- a FortiWeb network interface configured to accept SSH connections (In its default state, port1 accepts SSH. You may need to connect directly first in order to configure a static route so that, later, you can connect through routers. For details, see Adding a gateway.)
- terminal emulation software such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)
- On your management computer, configure the Ethernet port with the static IP address 192.168.1.2 with a netmask of 256.256.256.0.
- Using the Ethernet cable, connect your computer’s Ethernet port to the FortiWeb appliance’s port1.
- Verify that the FortiWeb appliance is powered on.
- On your management computer, start PuTTY.
Initially, the Session category of settings is displayed. - In Host Name (or IP Address), type
192.168.1.99. - In Port, type
22. - From Connection type, select SSH.
- Select Open.
- Click Yes to verify the fingerprint and accept the FortiWeb appliance’s SSH key. You cannot log in until you accept the key.
- Type
adminand press Enter. by default, this account has no password.
The SSH client connects to the FortiWeb appliance.
The SSH client may display a warning if this is the first time you are connecting to the FortiWeb appliance and its SSH key is not yet recognized by your SSH client, or if you have previously connected to the FortiWeb appliance but it used a different IP address or SSH key. If your management computer is directly connected to the FortiWeb appliance with no network hosts between them, this is normal.
The CLI displays a login prompt.
|
|
If 3 incorrect login or password attempts occur in a row, your IP address will be temporarily blacklisted from the GUI and CLI (network, not console). This is to protect the appliance from brute force login attacks. Wait 1 minute, then attempt the login again. |
The CLI displays a prompt, such as:
FortiWeb#
You can now enter commands. To continue by updating the firmware, see Updating the firmware. Otherwise, to continue by setting an administrative password, see Changing the “admin” account password.
For information about how to use the CLI, see the FortiWeb CLI Reference:
http://docs.fortinet.com/fortiweb/reference
To connect to the CLI using an SSH connection and public-private key pair
- Create a public-private key pair using a key generator.
- Save the private key to the location on your management computer where your SSH keys are stored.
- Connect to the CLI using either the CLI Console widget on the web UI dashboard or via anSSH connection. For details, see To connect to the CLI using an SSH connection and password.
- Use the following CLI command to copy the public key to FortiWeb using the CLI commands:
- To log in using the private key, open a connection to the CLI using SSH. For details, see To connect to the CLI using an SSH connection and password.
- When FortiWeb displays the CLI prompt, use the following command to log in using the public key:
config system admin
edit admin
set sshkey <sshkey>
end
where <sshkey> is the public key data.
The following data is an example of an ssh public key:
“ssh-rsa
AAAAB3NzaC1yc2EAAAADAQABAAABAQDJWw9hWG6KC+RYViLmPVN283mNIwOVE9EyO+Rk SsQgqZzc/NkzWpR4A3f6egYUZ1TY3ERYJ350zpvtmVoM8sbtDyLjuj/OYqZWLr06jjd+ NBKNbl9crqGdcoi+5WYZ9qo8NKgW4yXrmcNzdM46c708mrKNc9cfVlCk2kJSNNEY8FRX fm3Ge7y0aNRuBBQ6n9LkYWSoW+AETwNt8ZS0/9tJ9gV6V6J4071Y8xSfM1VDJQwdneuX CpVrs3Fg1DijUdritp7W8ptxqgbLvdkRObaTvpEGSl6rBPZcsqQFCCgn1QHdE9UxoPA7 jpSrEZ/Gkh63kz5KC6dZgUg0G2IrIgXt”
ssh -i <privatekey>
where <privatekey> is the name of the private key stored on your management computer.
For information about how to use the CLI, see the FortiWeb CLI Reference: