This document describes what you need to know to get started using a FortiGate-7000 product. Also included are details about CLI commands that are specific to FortiGate-7000 products.
This FortiOS Handbook chapter contains the following sections:
FortiGate-7000 overview provides a quick overview of FortiGate-7000 components.
Getting started with FortiGate-7000 describes how to get started with managing and configuring your FortiGate7000 product.
FortiGate-7000 Load balancing commands describes FortiGate-7000 load balancing CLI commands.
What’s new in for FortiGate-7000 v5.4.5
The following new features have been added to FortiGate-7000 v5.4.5.
M1 and M2 interfaces can use different VLANs for heartbeat traffic (408386)
The M1 and M2 interfaces can be configured to use different VLANs for HA heartbeat traffic.
The following command now configures the VLAN used by the M1 interface (default 999):
config system ha set hbdev-vlan-id 999
The following new command configures the VLAN used by the M2 interface (default 1999):
config system ha set hbdev-second-vlan-id 1999
GTP load balancing
GTP load balancing is supported for FortiGate-7000 configurations licensed for FortiOS Carrier. You can use the following command to enable GTP load balancing. This command is only available after you have licensed the FortiGate-7000 for FortiOS Carrier.
config load-balance setting set gtp-load-balance enable
FSSO user authentication is synchronized
FSSO user authentication is synchronized to all FIM and FPM modules. FSSO users are no longer required to reauthenticate when sessions are processed by a different FIM or FPM module.
What’s new in for FortiGate-7000 v5.4.5 Introduction
HA Link failure threshold changes (422264 )
The link failure threshold is now determined based on the all FIM modules in a chassis. This means that the chassis with the fewest active links will become the backup chassis.
FortiGate-7000s running FortiOS v5.4.5 can be configured as dialup IPsec VPN servers
The following shows how to setup a dialup IPsec VPN configuration where the FortiGate-7000 running v5.4.5 acts as a dialup IPsec VPN server.
Configure the phase1, set type to dynamic.
config vpn ipsec phase1-interface edit dialup-server set type dynamic set interface “v0020” set peertype any set psksecret < password>
Configure the phase 2, to support dialup IPsec VPN, set the destination subnet to 0.0.0.0 0.0.0.0.
config vpn ipsec phase2-interface edit dialup-server set phase1name dialup-server set src-subnet 126.96.36.199 255.255.0.0 set dst-subnet 0.0.0.0 0.0.0.0
To configure the remote FortiGate as a dialup IPsec VPN client
The dialup IPsec VPN client should advertise its local subnet(s) using the phase 2 src-subnet option.
If there are multiple local subnets create a phase 2 for each one. Each phase 2 only advertises one local subnet to the dialup IPsec VPN server. If more than one local subnet is added to the phase 2, only the first one is advertised to the server.
Dialup client configuration:
config vpn ipsec phase1-interface
Introduction What’s new in for FortiGate-7000 v5.4.5
edit “to-fgt7k” set interface “v0020” set peertype any set remote-gw 188.8.131.52 set psksecret <password>
config vpn ipsec phase2-interface edit “to-fgt7k” set phase1name “to-fgt7k” set src-subnet 184.108.40.206 255.255.255.0 set dst-subnet 220.127.116.11 255.255.0.0
next edit “to-fgt7k-2” set phase1name “to-fgt7k” set src-subnet 18.104.22.168 255.255.255.0 set dst-subnet 22.214.171.124 255.255.0.0 end
Licenses, Device Registration, and Support FortiGate-7000 overview
Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!
Don't Forget To Buy Your Fortinet Hardware From The Fortinet GURU