FortiOS : configuration de base d'un FortiGate
·3 min read·532 words
FortiOS est le système d'exploitation unifié of FortiGate. Configuration via GUI web or CLI similaire to Cisco (mais with of spécificités). Guide of commandes de base for firewall NGFW : interfaces, policies, VPN IPsec, SD-WAN, troubleshooting.
Accès and modes
- GUI HTTPS : https://192.168.1.99 (par défaut)
- SSH CLI : ssh admin@192.168.1.99 (password reset obligatoire au 1er login)
- Console port (RJ45 or USB-C selon modèle, 9600 baud 8-N-1)
- get system status : vue d'ensemble
- execute ping 8.8.8.8 : ping depuis firewall
Configuration interfaces
- config system interface ; edit "port1" ; set mode static ; set ip 192.168.1.99/24 ; end
- set allowaccess ping https ssh : servithese autorisés sur l'interface
- set role lan : rôle (lan/wan/dmz) for display GUI
- set alias "WAN-FAI1" : nom display personnalisé
- show system interface port1 : vérifier config
Zones and adressage
- config system zone ; edit "LAN" ; set interface "port1" "port2" ; end : zone multi-interfaces
- config firewall address ; edit "NET-LAN" ; set subnet 192.168.1.0/24 ; end
- config firewall addrgrp ; edit "GRP-INTERNAL" ; set member "NET-LAN" "NET-DMZ" ; end
Policies firewall
- config firewall policy
- edit 1
- set name "LAN-to-WAN"
- set srcintf "port1"
- set dstintf "port10"
- set srcaddr "all"
- set dstaddr "all"
- set action accept
- set schedule "always"
- set service "ALL"
- set nat enable
- set utm-status enable ; set ssl-ssh-profile "certificate-inspection" ; set av-profile "default"
- end
VPN IPsec site-à-site
- config vpn ipsec phase1-interface ; edit "VPN-PARIS-LYON" ; set interface "port10" ; set remote-gw 203.0.113.2 ; set psksecret MySharedKey ; end
- config vpn ipsec phase2-interface ; edit "VPN-PARIS-LYON-P2" ; set phase1name "VPN-PARIS-LYON" ; set src-subnet 192.168.1.0/24 ; set dst-subnet 10.10.1.0/24 ; end
- config firewall policy : créer policy autorisant le trafic entre LAN and tunnel
- diagnose vpn ike gateway list : voir état phase 1
- diagnose vpn tunnel list : voir état phase 2
SD-WAN
- config system sdwan ; set status enable ; config members ; edit 1 ; set interface "port10" ; set gateway 203.0.113.1 ; end
- config health-check ; edit "HTTP-probe" ; set server "8.8.8.8" ; set protocol ping ; end
- config service ; edit 1 ; set name "Internet" ; set mode sla ; set sla 1 ; end
Routing
- config router static ; edit 1 ; set dst 0.0.0.0 0.0.0.0 ; set gateway 203.0.113.1 ; set device "port10" ; end
- config router bgp ; set as 65001 ; config neighbor ; edit "203.0.113.2" ; set remote-as 65002 ; end
- get router info routing-table all : table de routing
Troubleshooting essentiel
- diagnose debug flow filter saddr 192.168.1.50 ; diagnose debug flow show function-name enable ; diagnose debug flow trace start 100 : tracer paquet
- diagnose debug enable : activer debugs
- diagnose debug disable : stopper
- get hardware status : CPU/RAM/sessions
- diagnose sys top : process top
- execute log filter field srcip 192.168.1.50 ; execute log display : voir logs
HA (High Availability)
- config system ha ; set mode a-p ; set group-name HA-OPTINOC ; set password MyHAPass ; set priority 150 ; set hbdev "port9" 50 "port10" 50 ; end
- get system ha status : état HA
- execute ha synchronize all : forcer sync
Commander chez OPTINOC
FortiGate pré-configuré with VPN, SD-WAN, HA selon your besoins. Support 24×7 expert francophone included. Form factorion FortiOS for clients.