Category Archives: FortiManager

FGFM – FortiGate to FortiManager protocol

FGFM – FortiGate to FortiManager protocol

The FortiGate to FortiManager (FGFM) protocol is designed for FortiGate and FortiManager deployment scenarios, especially where NAT is used. These scenarios include the FortiManager on public internet while the FortiGate unit is behind NAT, FortiGate unit is on public internet while FortiManager is behind NAT, or both FortiManager and FortiGate unit have routable IP addresses.

The FortiManager unit’s Device Manager uses FGFM to create new device groups, provision and add devices, and install policy packages and device settings.

Port 541 is the default port used for FortiManager traffic on the internal management network.

Adding a FortiGate to the FortiManager

Adding a FortiGate unit to a FortiManager requires configuration on both devices. This section describes the basics to configure management using a FortiManager device.

FortiGate configuration

Adding a FortiGate unit to FortiManager will ensure that the unit will be able to receive antivirus and IPS updates and allow remote management through the FortiManager system, or FortiCloud service. The FortiGate unit can be in either NAT or transparent mode. The FortiManager unit provides remote management of a FortiGate unit over TCP port 541.

You must first enable Central Management on the FortiGate so management updates to firmware and FortiGuard services are available:

  1. Go to System > Settings.
  2. Set Central Management to FortiManager.
  3. Enter the FortiManager’s IP/Domain Name in the field provided, and select Send Request.

You can also select Registration Password and enter a password to connect to the FortiManager.

To configure the previous steps in the CLI, enter the following:

config system central-management set fmg <ip_address>

end

To use the registration password, enter the following:

execute central-mgmt register-device <fmg-serial-no><fmg-registerpassword><fgtusrname><fgt-password>

Configuring an SSL connection

The default encryption automatically sets high and medium encryption algorithms. Algorithms used for High, Medium, and Low follow the openssl definitions below:

FGFM                   to FortiManager protocol

Encryption level Key strength Algorithms used
High Key lengths larger than 128 bits, and some cipher suites with 128-bit keys. DHE-RSA-AES256-SHA:AES256-SHA: EDH-RSA-

DES-CBC3-SHA: DES-CBC3-SHA:DES-CBC3-

MD5:DHE-RSA-AES128-SHA:AES128-SHA

Medium Key strengths of 128 bit encryption. RC4-SHA:RC4-MD5:RC4-MD
Low Key strengths of 64 or 56 bit encryption algorithms but excluding export cipher suites. EDH-RSA-DES-CDBC-SHA; DES-CBC-SHA; DESCBC-MD5

An SSL connection can be configured between the two devices and an encryption level selected. To configure the connection in the CLI, Enter the following:

config system central-management set status enable

set enc-algorithm (default | high | low) – default automatically sets high and medium encryption algorithms. end

FortiManager configuration

Use the Device Manager pane to add, configure, and manage devices.

You can add existing operational devices, unregistered devices, provision new devices, and add multiple devices at a time.

Adding an operating FortiGate HA cluster to the Device Manager pane is similar to adding a standalone device. Type the IP address of the master device. The FortiManager will handle the cluster as a single managed device.

To confirm that a device model or firmware version is supported by current firmware version running on FortiManager, enter the following CLI command: diagnose dvm supported-platforms list

See the FortiManager Administration Guide for full details on adding devices, under Device Manager.

FGFM is also used in ADOMs (Administrative Domains) set to Normal Mode. Normal Mode has Read/Write privileges, where the administrator is able to make changes to the ADOM and manage devices from the FortiManager. FortiGate units in the ADOM will query their own configuration every five seconds. If there has been a configuration change, the FortiGate unit will send a revision on the change to the FortiManager using the FGFM protocol.

To configure central management on the FortiGate unit, enter the following on the FortiGate:

config system central-management set mode backup set fortimanager-fds-override enable set fmg <FortiManager_IP_address> end

FGFM – FortiGate to FortiManager protocol

Replacing a FortiGate in a FortiManager configuration

FGFM can be used in order to re-establish a connection between a FortiGate unit and a FortiManager configuration. This is useful for if you need a FortiGate unit replaced following an RMA hardware replacement. This applies to a FortiGate running in HA as the primary units; it does not apply to subordinate units.

When the FortiGate unit is replaced, perform a Device Manager Connectivity check or Refresh on teh FortiManager to establish the FGFM management tunnel to the FortiGate. If it fails, to establish, you can force the tunnel by executing the following command on the FortiManager:

exec fgfm reclaim-dev-tunnel <device_name>

Debugging FGFM on FortiManager

  • To display diagnostic information for troubleshooting (Set the debug level of FGFM daemon. Enter a device name to only show messages related to that device): diag debug application fgfmsd <integer> <device_name>
  • To view installation session, object, and session lists:

diag fgfm install-session diag fgfm object-list diag fgfm session-list <device_ID> l To reclaim a management tunnel (device name is optional): execute fgfm reclaim-dev-tunnnel <device_name> l To view the link-local address assigned to the FortiManager: diag fmnetwork interface list

Debugging FGFM on FortiGate

  • To view information about the Central Management System configuration: get system central-management l To produce realtime debugging information: diag debug application fgfmd -1
  • To view the link-local address assigned to the FortiManager:

diag fmnetwork interface list

 

FortiManager Open Ports

FortiManager Open Ports

Incoming Ports

Purpose

Protocol/Port
FortiClient FortiGuard Queries UDP/53, UDP/8888
FortiGate Management TCP/541
IPv6 TCP/542
Log & Report TCP or UDP/514
Secure SNMP UDP/161, UDP/162
FortiGuard Queries TCP/8890, UDP/53
FortiGuard AV/IPS UDP/9443
FortiMail Reg, Config Backup, Config/Firmware

Pull

TCP/443
SNMP Traps UDP/162
FortiManager FortiClient Manager TCP/6028

FortiManager Open Ports

Incoming Ports

Purpose

Protocol/Port
Others SSH CLI Management TCP/22
Telnet CLI Management TCP/23
SNMP Traps UDP/162
Web Admin TCP/80, TCP/443
Outgoing Ports

Purpose

Protocol/Port
FortiAnalyzer Syslog & OFTP TCP/514, UDP/514
Registration TCP/541
FortiGate AV/IPS Push UDP/9443
SSH CLI Management TCP/22
Management TCP/541
SNMP Poll UDP/161, UDP/162
FortiGuard Queries TCP/443
FortiGuard AV/IPS Updates, URL/AS Update,

Firmware, SMS, FTM, Licensing, Policy

Override Authentication

TCP/443
Registration TCP/80
FortiMail Config/Firmware Push TCP/22
SNMP Poll UDP/161
FortiManager FortiClient Manager TCP/6028
3rd-Party Servers DNS UDP/53
NTP UDP/123
SNMP Traps UDP/162
Proxied HTTPS Traffic TCP/443
RADIUS UDP/1812

 

FortiManager

Administrative domains

Administrative domains

FortiManager administrative domains enable the super_admin to create groupings of devices for configured administrators to monitor and manage. FortiManager can manage a large number of Fortinet appliances. This enables administrators to maintain managed devices specific to their geographic location or business division. This also includes FortiGate units with multiple configured VDOMs.

Each administrator is tied to an administrative domain (ADOM). When that particular administrator logs in, they see only those devices or VDOMs configured for that administrator and ADOM. The one exception is the super_ admin account that can see and maintain all administrative domains and the devices within those domains.

Administrative domains are not enabled by default and enabling and configuring the domains can only be performed by the super_admin.

The maximum number of administrative domains you can add depends on the FortiManager system model. See the FortiManager Administration Guide for information on the maximums for each model.

Backup and restore configurations

Backup and restore configurations

A FortiManager unit stores configuration files for backup and restore purposes. A FortiManager also enables you to save revisions of configuration files. Configuration backups occur automatically when the administrator logs out or the administrator login session expires.

FortiManager also enables you to view differences between different configurations to view where changes have been made.

Central Management FortiGuard

FortiGuard

FortiManager can also connect to the FortiGuard Distribution Network (FDN) to receive push updates for IPS signatures and antivirus definitions. These updates can then be used to update multiple FortiGate units throughout an organization. By using the FortiManager as the host for updates, bandwidth use is minimized as updates are downloaded to one source instead of many.

To receive IPS and antivirus updates from FortiManager, indicate an alternate IP address on the FortiGate unit.

 

To configure updates from FortiManager

1. Go to System > Config > FortiGuard.

2. Select AntiVirus and IPS Options to expand the options.

3. Enable both Allow Push Update and Use override push IP.

4. Enter the IP address of the FortiManager unit.

5. Select Apply.

Central Management Firmware Updates

Firmware updates

A FortiManager unit can also perform firmware updates for multiple FortiGate units, saving time rather than upgrading each FortiGate unit individually.

The FortiManager unit stores local copies of firmware images, either by downloading images from the Fortinet Distribution Network (FDN) or by accepting firmware images that are uploaded from the management computer.

If you are using the FortiManager unit to download firmware images, the FDN first validates device licenses and support contracts and then provides a list of currently available firmware images. For devices with valid Fortinet Technical Support contracts, you can download new firmware images from the FDN and the firmware release notes.

After firmware images have been either downloaded from the FDN or imported to the firmware list, you can either schedule or immediately upgrade/downgrade a device or group of device’s firmware.

See the FortiManager Administration Guide for more information on updating the FortiGate firmware using the FortiManager central management.