Configuring Edge
In the Security Fabric, Edge is the root FortiGate. This FortiGate receives information from the other FortiGates in the Security Fabric.
In the example, the following interfaces on Edge connect to other network devices:
- Port 9 connects to the Internet (this interface was configured when Edge was installed)
- Port 10 connects to Accounting (IP address: 192.168.10.2)
- Port 11 connects to Marketing (IP address: 192.168.200.2)
- Port 16 connects to the FortiAnalyzer (IP address: 192.168.55.2)
-
To edit port 10 on Edge, go to Network > Interfaces. Set an IP/Network Mask for the interface (in the example, 192.168.10.2/255.255.255.0).
-
Set Administrative Access to allow FortiTelemetry, which is required so that FortiGate devices in the Security Fabric can communicate with each other.
-
Repeat the previous steps to configure the other interfaces with the appropriate IP addresses, as listed above.
-
To create a policy for traffic from Accounting to the Internet, go to Policy & Objects > IPv4 Policy and select Create New.
- Set Incoming Interface to port 10 and Outgoing Interface to port 9.
-
Enable NAT.
-
Repeat the previous steps to create a similar policy for Marketing.
-
On Edge, go to System > Feature Select. Under Additional Features, enable Multiple Interface Policies.
-
To create a policy that allows Accounting and Marketing to access the FortiAnalyzer, go to Policy & Objects > IPv4 Policy.
- To enable communication between the FortiGate devices in the Security Fabric, go to Security Fabric > Settings and enable FortiGate Telemetry. Set a Group name and Group password (the Group password option isn’t available isn’t available in FortiOS 6.0.3 and later).
-
FortiAnalyzer Logging is enabled by default. Set IP address to an internal address that will later be assigned to port 1 on the FortiAnalyzer (in the example, 192.168.65.10). Set Upload option to Real Time.
-
Select Test Connectivity. An error appears because the FortiGate isn’t yet authorized on the FortiAnalyzer. This authorization is configured in a later step.
