Connecting to the web UI or CLI

To configure, maintain, and administer the FortiWeb appliance, you need to connect to it. There are two methods:

Web UI—A graphical user interface (GUI), from within a web browser. It can display reports and logs, but lacks many advanced diagnostic commands. For usage, see How to use the web UI.

Command line interface (CLI)—A text interface similar to DOS or UNIX commands, from a Secure Shell (SSH) or Telnet terminal, or from the JavaScript CLI Console widget in the web UI (System > Status > Status). It provides access to many advanced diagnostic commands as well as configuration, but lacks reports and logs. For usage, see FortiWeb CLI Reference.

Access to the CLI and/or web UI through your network is not yet configured if:

• you are connecting for the first time
• you have just reset the configuration to its default state
• you have just restored the firmware

In these cases, you must initially connect your computer directly to FortiWeb, using the default settings.

If you are installing a FortiWeb-VM virtual appliance, you should have already connected if you followed the instructions in the FortiWeb-VM deploy Guide (https://docs.fortinet.com/fortiweb/hardware). If so, you can skip this chapter and continue with Changing the “admin” account password.

Via the direct connection, you can use the web UI or CLI to configure FortiWeb’s basic network settings. Once this is done, you will be able to place FortiWeb on your network, and use FortiWeb through your network.

Until the FortiWeb appliance is configured with an IP address and connected to your network, you may prefer to connect the FortiWeb appliance directly to your management computer, or through a switch, in a peer network that is isolated from your overall network. This will improve security during setup. However, isolation is not required.

Connecting to the web UI

You can connect to the web UI using its default settings:

Network Interface	port1
URL	https://192.168.1.99/
Administrator Account	admin
Password

Requirements

• A computer with an RJ-45 Ethernet network port
• A web browser such as Microsoft Internet Explorer version 6.0 or greater, or Mozilla Firefox 3.5 or greater
• A crossover Ethernet cable

To connect to the web UI

1. On your management computer, configure the Ethernet port with the static IP address 192.168.1.2 with a netmask of 255.255.255.0.
2. Using the Ethernet cable, connect your computer’s Ethernet port to the FortiWeb appliance’s port1.
3. Start your browser and enter the following URL:

https://192.168.1.99

(Remember to include the “s” in https://.)

Your browser connects the appliance.

If you do not see the login page due to an SSL cipher error during the connection, and you are connecting to the trial license of FortiWeb-VM or a LENC version of FortiWeb, then your browser must be configured to accept encryption of 64-bit strength or less during the handshake. RC2 and DES with less than 64-bit strength is supported. AES and 3DES is not supported in these versions.

For example, in Mozilla Firefox, if you receive this error message:

ssl_error_no_cypher_overlap

To support HTTPS authentication, the FortiWeb appliance ships with a self-signed security certificate, which it presents to clients whenever they initiate an HTTPS connection to the FortiWeb appliance. When you connect, depending on your web browser and prior access of the FortiWeb appliance, your browser might display two security warnings related to this certificate:

• The certificate is not automatically trusted because it is self-signed, rather than being signed by a valid certificate authority (CA). Self-signed certificates cannot be verified with a proper CA, and therefore might be fraudulent. You must manually indicate whether or not to trust the certificate.
• The certificate might belong to another website. The common name (CN) field in the certificate, which usually contains the host name of the website, does not exactly match the URL you requested. This could indicate server identity theft, but could also simply indicate that the certificate contains a domain name while you have entered an IP address. You must manually indicate whether this mismatch is normal or not.

Both warnings are normal for the default certificate. TLS v1.0 is supported.

Verify and accept the certificate, either permanently (the web browser will not display the self-signing warning again) or temporarily. You cannot log in until you accept the certificate.

For details on accepting the certificate, see the documentation for your web browser.

In the Name field, type admin, then click Login. In its default state, there is no password for this account.

Login credentials entered are encrypted before they are sent to the FortiWeb appliance. If your login is successful, the web UI appears. To continue by updating the firmware, see Updating the firmware. Otherwise, to continue by setting an administrative password, see Changing the “admin” account password.

If 3 incorrect login or password attempts occur in a row, your IP address will be temporarily blocklisted from the GUI and CLI (network, not console). This is to protect the appliance from brute force login attacks. Wait 1 minute, then attempt the login again.

Connecting to the CLI

Using its default settings, you can access the CLI from your management computer in three ways via:

• the Web UI
• A local console connection
• An SSH connection, either local or through the network

Secure Shell (SSH) provides both secure authentication and secure communications to the CLI. Supported SSH protocol versions, ciphers, and bit strengths include SSH version 2 with AES-128, 3DES, Blowfish, and SHA-1.

The host key algorithms support rsa-sha2-512 and ED25519.

The key exchange algorithms support sntrup761x25519-sha512@openssh.com, curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, and diffie-hellman-group14-sha256.

These are the default settings to connect to the CLI via SSH:

Network Interface	port1
IP Address	192.168.1.99
SSH Port Number	22
Administrator Account	admin
Password

If you are not connecting for the first time, nor have you just reset the configuration to its default state or restored the firmware, administrative access settings may have already been configured. In this case, access the CLI using the IP address, administrative access protocol, administrator account and password already configured, instead of the default settings.

Alternatively, you can access the CLI via SSH and a public-private key pair. However, to use this option, you first access the CLI using the CLI Console widget (part of the web UI status dashboard) or via SSH and password to upload the public key. For details, see To connect to the CLI using an SSH connection and public-private key pair.

The following procedures describe connection using PuTTY software; steps may vary with other terminal emulators.

To use the CLI in the web UI

You must have already completed To connect to the web UI.

1. In the top-right corner of the window from any location in the web UI, click the Console Access icon:



The console will open on top of the current window of the Web UI.

2. To detach the CLI Console from the Web UI, click the Detach icon in the toolbar of the CLI Console window:

The CLI Console will open in a new tab in your browser.

To connect to the CLI using a local console connection

You must have:

• A computer with an available serial communications (COM) port
• The RJ-45-to-DB-9 or null modem cable included in your FortiWeb package
• Terminal emulation software such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)

1. Using the RJ-45-to-DB-9 or null modem cable, connect your computer’s serial communications (COM) port to the FortiWeb appliance’s console port.
2. Verify that the FortiWeb appliance is powered on.
3. On your management computer, start a terminal emulation software such as PuTTY.
4. In the Category tree on the left, go to Connection > Serial and configure these settings:

Serial line to connect to	COM1 (or, if your computer has multiple serial ports, the name of the connected serial port)
Speed (baud)	9600
Data bits	8
Stop bits	1
Parity	None
Flow control	None

5. In the Category tree on the left, go to Session (not the sub-node, Logging) and from Connection type, select Serial.
6. Click Open.
7. Press the Enter key to initiate a connection.

The login prompt appears.

8. Type admin then press Enter twice. (In its default state, there is no password for the admin account.)

The CLI displays the following text, followed by a command line prompt:

Welcome!

You can now enter commands. To continue by updating the firmware, see Updating the firmware. Otherwise, to continue by setting an administrative password, see Changing the “admin” account password. For information about how to use the CLI, see FortiWeb CLI Reference.

To connect to the CLI using an SSH connection and password

You must have:

• a computer with an RJ-45 Ethernet port
• a crossover Ethernet cable (if connecting directly) or straight-through Ethernet cable (if connecting through a switch or router)
• a FortiWeb network interface configured to accept SSH connections (In its default state, port1 accepts SSH. You may need to connect directly first in order to configure a static route so that, later, you can connect through routers. For details, see Adding a gateway.)
• terminal emulation software such as PuTTY (http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html)

1. On your management computer, configure the Ethernet port with the static IP address 192.168.1.2 with a netmask of 255.255.255.0.
2. Using the Ethernet cable, connect your computer’s Ethernet port to the FortiWeb appliance’s port1.
3. Verify that the FortiWeb appliance is powered on.
4. On your management computer, start PuTTY.
   Initially, the Session category of settings is displayed.
5. In Host Name (or IP Address), type 192.168.1.99.
6. In Port, type 22.
7. From Connection type, select SSH.
8. Select Open.

The SSH client connects to the FortiWeb appliance.

The SSH client may display a warning if this is the first time you are connecting to the FortiWeb appliance and its SSH key is not yet recognized by your SSH client, or if you have previously connected to the FortiWeb appliance but it used a different IP address or SSH key. If your management computer is directly connected to the FortiWeb appliance with no network hosts between them, this is normal.

9. Click Yes to verify the fingerprint and accept the FortiWeb appliance’s SSH key. You cannot log in until you accept the key.

The CLI displays a login prompt.

10. Type admin and press Enter. by default, this account has no password.

If 3 incorrect login or password attempts occur in a row, your IP address will be temporarily blocklisted from the GUI and CLI (network, not console). This is to protect the appliance from brute force login attacks. Wait 1 minute, then attempt the login again.

The CLI displays a prompt, such as:

FortiWeb#

You can now enter commands. To continue by updating the firmware, see Updating the firmware. Otherwise, to continue by setting an administrative password, see Changing the “admin” account password.

For information about how to use the CLI, see FortiWeb CLI Reference.

To connect to the CLI using an SSH connection and public-private key pair

1. Create a public-private key pair using a key generator.
2. Save the private key to the location on your management computer where your SSH keys are stored.
3. Connect to the CLI using either the CLI Console widget on the web UI dashboard or via anSSH connection. For details, see To connect to the CLI using an SSH connection and password.
4. Use the following CLI command to copy the public key to FortiWeb using the CLI commands:

config system admin

edit admin

set sshkey <sshkey>

end


where <sshkey> is the public key data.

The following data is an example of an ssh public key:

“ssh-rsa

AAAAB3NzaC1yc2EAAAADAQABAAABAQDJWw9hWG6KC+RYViLmPVN283mNIwOVE9EyO+Rk SsQgqZzc/NkzWpR4A3f6egYUZ1TY3ERYJ350zpvtmVoM8sbtDyLjuj/OYqZWLr06jjd+ NBKNbl9crqGdcoi+5WYZ9qo8NKgW4yXrmcNzdM46c708mrKNc9cfVlCk2kJSNNEY8FRX fm3Ge7y0aNRuBBQ6n9LkYWSoW+AETwNt8ZS0/9tJ9gV6V6J4071Y8xSfM1VDJQwdneuX CpVrs3Fg1DijUdritp7W8ptxqgbLvdkRObaTvpEGSl6rBPZcsqQFCCgn1QHdE9UxoPA7 jpSrEZ/Gkh63kz5KC6dZgUg0G2IrIgXt”



5. To log in using the private key, open a connection to the CLI using SSH. For details, see To connect to the CLI using an SSH connection and password.
6. When FortiWeb displays the CLI prompt, use the following command to log in using the public key:

ssh -i <privatekey>

where <privatekey> is the name of the private key stored on your management computer.

For information about how to use the CLI, see FortiWeb CLI Reference.