Deploying the Security Fabric

This topic provides an example of deploying Security Fabric with three downstream FortiGates connecting to one root FortiGate. To deploy Security Fabric, you need a FortiAnalyzer running firmware version 6.2 or later.

The following shows a sample network topology with three downstream FortiGates (Accounting, Marketing, and Sales) connected to the root FortiGate (Edge).

To configure the root FortiGate (Edge):

1. Configure interfaces:
   1. In the root FortiGate (Edge), go to Network > Interfaces.
   2. Edit port16:
      • Set Role to DMZ.
      • For the interface connected to FortiAnalyzer, set the IP/Network Mask to 192.168.65.2/255.255.255.0
   3. Edit port10:
      • Set Role to LAN.
      • For the interface connected to the downstream FortiGate (Accounting), set the IP/Network Mask to 192.168.10.2/255.255.255.0
   4. Edit port11:
      • Set Role to LAN.
      • For the interface connected to the downstream FortiGate (Marketing), set the IP/Network Mask to 192.168.200.2/255.255.255.0
2. Configure Security Fabric:
   1. In the root FortiGate (Edge), go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.
   2. For Status, click Enable.
   3. Set the Security Fabric role to Serve as Fabric Root. The FortiAnalyzer settings can be configured.
   4. Enter the FortiAnalyzer IP (192.168.65.10) and select and Upload option (the default is Real Time).
   5. Click Test Connectivity.

      A warning message indicates that the FortiGate is not authorized on the FortiAnalyzer. The authorization is configured in a later step on the FortiAnalyzer.

   6. Click OK. The FortiAnalyzer serial number is verified.
   7. Enter a Fabric name, such as Office-Security-Fabric.
   8. Ensure Allow other Security Fabric devices to join is enabled and add port10 and port11.
   9. Click OK.
3. Create a policy to allow the downstream FortiGate (Accounting) to access the FortiAnalyzer:
   1. In the root FortiGate (Edge), go to Policy & Objects > Addresses.
   2. Click Create New.
      • Set Name to FAZ-addr.
      • Set Type to Subnet.
      • Set Subnet/IP Range to 192.168.65.10/32.
      • Set Interface to any.
   3. Click OK.
   4. Click Create New.
      • Set Name to Accounting.
      • Set Type to Subnet.
      • Set Subnet/IP Range to 192.168.10.10/32.
      • Set Interface to any.
   5. Click OK.
   6. In the root FortiGate (Edge), go to Policy & Objects > Firewall Policy and click Create New.
      • Set Name to Accounting-to-FAZ.
      • Set srcintf to port10.
      • Set dstintf to port16.
      • Set srcaddr to Accounting-addr.
      • Set dstaddr to FAZ-addr.
      • Set Action to Accept.
      • Set Schedule to Always.
      • Set Service to All.
      • Enable NAT.
      • Set IP Pool Configuration to Use Outgoing Interface Address.
   7. Click OK.
4. Create a policy to allow the two downstream FortiGates (Marketing and Sales) to access the FortiAnalyzer:
   1. In the root FortiGate (Edge), go to Policy & Objects > Addresses and click Create New.
      • Set Name to Marketing-addr.
      • Set Type to Subnet.
      • Set Subnet/IP Range to 192.168.200.10/32.
      • Set Interface to any.
   2. Click OK.
   3. In the root FortiGate (Edge), go to Policy & Objects > Firewall Policy and click Create New.
      • Set Name to Marketing-to-FAZ.
      • Set srcintf to port11.
      • Set dstintf to port16.
      • Set srcaddr to Marketing-addr.
      • Set dstaddr to FAZ-addr.
      • Set Action to Accept.
      • Set Schedule to Always.
      • Set Service to All.
      • Enable NAT.
      • Set IP Pool Configuration to Use Outgoing Interface Address.
   4. Click OK.

To configure the downstream FortiGate (Accounting):

1. Configure interface:
   1. In the downstream FortiGate (Accounting), go to Network > Interfaces.
   2. Edit interface wan1:
      • Set Role to WAN.
      • For the interface connected to root, set the IP/Network Mask to 192.168.10.10/255.255.255.0
2. Configure the default static route to connect to the root FortiGate (Edge):
   1. In the downstream FortiGate (Accounting), go to Network > Static Routes and click Create New or Create New > IPv4 Static Route.
      • Set Destination to 0.0.0.0/0.0.0.0.
      • Set Interface to wan1.
      • Set Gateway Address to 192.168.10.2.
   2. Click OK.
3. Configure Security Fabric:
   1. In the downstream FortiGate (Accounting), go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.
   2. For Status, click Enable.

      FortiAnalyzer automatically enables logging. Settings for the FortiAnalyzer are retrieved from the root FortiGate (Edge) when FortiGate (Accounting) connects to the root FortiGate (Edge).

   3. Set the Security Fabric role to Join Existing Fabric.
   4. Upstream FortiGate IP is filled in automatically with the default static route Gateway Address of 192.168.10.2 set in the previous step.
   5. Disable Allow other FortiGates to join, because there is no downstream FortiGate connecting to it.
   6. Click OK.

To configure the downstream FortiGate (Marketing):

1. Configure interface:
   1. In the downstream FortiGate (Marketing), go to Network > Interfaces.
   2. Edit port12:
      • Set Role to LAN.
      • For the interface connected to the downstream FortiGate (Sales), set the IP/Network Mask to 192.168.135.11/255.255.255.0.
   3. Edit wan1:
      • Set Role to WAN.
      • For the interface connected to the root FortiGate (Edge), set the IP/Network Mask to 192.168.200.10/255.255.255.0.
2. Configure the default static route to connect to the root FortiGate (Edge):
   1. In the downstream FortiGate (Marketing), go to Network > Static Routes and click Create New or Create New > IPv4 Static Route.
      • Set Destination to 0.0.0.0/0.0.0.0.
      • Set Interface to wan1.
      • Set Gateway Address to 192.168.200.2.
   2. Click OK.
3. Configure Security Fabric:
   1. In the downstream FortiGate (Marketing), go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.
   2. For Status, click Enable.

      FortiAnalyzer automatically enables logging. Settings for the FortiAnalyzer are retrieved from the root FortiGate (Edge) when FortiGate (Marketing) connects to the root FortiGate (Edge).

   3. Set the Security Fabric role to Join Existing Fabric.
   4. Upstream FortiGate IP is filled in automatically with the default static route Gateway Address of 192.168.200.2 set in the previous step.
   5. Enable Allow other FortiGates to join and add port12.
   6. Click OK.
4. Create a policy to allow another downstream FortiGate (Sales) going through FortiGate (Marketing) to access the FortiAnalyzer:
   1. In the downstream FortiGate (Marketing), go to Policy & Objects > Addresses and click Create New.
      • Set Name to FAZ-addr.
      • Set Type to Subnet.
      • Set Subnet/IP Range to 192.168.65.10/32.
      • Set Interface to any.
   2. Click OK.
   3. Click Create New.
      • Set Name to Sales-addr.
      • Set Type to Subnet.
      • Set Subnet/IP Range to 192.168.135.10/32.
      • Set Interface to any.
   4. Click OK.
   5. In the downstream FortiGate (Marketing), go to Policy & Objects > Firewall Policy and click Create New.
      • Set Name to Sales-to-FAZ.
      • Set srcintf to port12.
      • Set dstintf to wan1.
      • Set srcaddr to Sales-addr.
      • Set dstaddr to FAZ-addr.
      • Set Action to Accept.
      • Set Schedule to Always.
      • Set Service to All.
      • Enable NAT.
      • Set IP Pool Configuration to Use Outgoing Interface Address.
   6. Click OK.

To configure the downstream FortiGate (Accounting):

1. Configure interface:
   1. In the downstream FortiGate (Accounting), go to Network > Interfaces.
   2. Edit interface wan1:
      • Set Role to WAN.
      • For the interface connected to root, set the IP/Network Mask to 192.168.10.10/255.255.255.0
2. Configure the default static route to connect to the root FortiGate (Edge):
   1. In the downstream FortiGate (Accounting), go to Network > Static Routes and click Create New or Create New > IPv4 Static Route.
      • Set Destination to 0.0.0.0/0.0.0.0.
      • Set Interface to wan1.
      • Set Gateway Address to 192.168.10.2.
   2. Click OK.
3. Configure Security Fabric:
   1. In the downstream FortiGate (Accounting), go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.
   2. For Status, click Enable.

      FortiAnalyzer automatically enables logging. Settings for the FortiAnalyzer are retrieved from the root FortiGate (Edge) when FortiGate (Accounting) connects to the root FortiGate (Edge).

   3. Set the Security Fabric role to Join Existing Fabric.
   4. Upstream FortiGate IP is filled in automatically with the default static route Gateway Address of 192.168.10.2 set in the previous step.
   5. Disable Allow other FortiGates to join, because there is no downstream FortiGate connecting to it.
   6. Click OK.

To configure the downstream FortiGate (Sales):

1. Configure interface:
   1. In the downstream FortiGate (Sales), go to Network > Interfaces.
   2. Edit wan2:
      • Set Role to WAN.
      • For the interface connected to the upstream FortiGate (Marketing), set the IP/Network Mask to 192.168.135.10/255.255.255.0.
2. Configure the default static route to connect to the upstream FortiGate (Marketing):
   1. In the downstream FortiGate (Sales), go to Network > Static Routes and click Create New or Create New > IPv4 Static Route.
      • Set Destination to 0.0.0.0/0.0.0.0.
      • Set Interface to wan2.
      • Set Gateway Address to 192.168.135.11.
   2. Click OK.
3. Configure Security Fabric:
   1. In the downstream FortiGate (Sales), go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.
   2. For Status, click Enable.

      FortiAnalyzer automatically enables logging. Settings for the FortiAnalyzer are retrieved from the root FortiGate (Edge) when FortiGate (Sales) connects to the root FortiGate (Edge).

   3. Set the Security Fabric role to Join Existing Fabric.
   4. Upstream FortiGate IP is filled in automatically with the default static route Gateway Address of 192.168.135.11 set in the previous step.
   5. Disable Allow other FortiGates to join, because there is no downstream FortiGate connecting to it.
   6. Click OK.

To authorize downstream FortiGates (Accounting, Marketing, and Sales) on the root FortiGate (Edge):

1. In the root FortiGate (Edge), go to Security Fabric > Fabric Connectors and double-click the Security Fabric Setup card.

   The Topology tree highlights two connected FortiGates with their serial numbers and asks you to authorize the highlighted devices.

2. Select the highlighted FortiGates and select Authorize.

   After they are authorized, the two downstream FortiGates (Accounting and Marketing) appear in the Topology tree in the Security Fabric > Fabric Connectors > Security Fabric Setup page. This means that the two downstream FortiGates (Accounting and Marketing) have successfully joined the Security Fabric.

3. The Topology tree now highlights the FortiGate with the serial number that is connected to the downstream FortiGate (Marketing) and asks you to authorize the highlighted device.
4. Select the highlighted FortiGates and select Authorize.

   After it is authorized, the downstream FortiGate ( Sales) appears in the Topology tree in the Security Fabric > Fabric Connectors > Security Fabric Setup page. This means that the downstream FortiGates (Sales) has successfully joined the Security Fabric.

To use FortiAnalyzer to authorize all the Security Fabric FortiGates:

1. Authorize all the Security Fabric FortiGates on the FortiAnalyzer side:
   1. On the FortiAnalyzer, go to System Settings > Network > All Interfaces.
   2. Edit port1 and set IP Address/Netmask to 192.168.65.10/255.255.255.0.

   3. Go to Device Manager > Unauthorized. All of the FortiGates are listed as unauthorized.

      1. Select all the FortiGates and select Authorize. The FortiGates are now listed as authorized.

         After a moment, a warning icon appears beside the root FortiGate (Edge) because the FortiAnalyzer needs administrative access to the root FortiGate (Edge) in the Security Fabric.

      2. Click the warning icon and enter the admin username and password of the root FortiGate (Edge).
2. Check FortiAnalyzer status on all the Security Fabric FortiGates:
   1. On each FortiGate, go to Security Fabric > Fabric Connectors and double-click the FortiAnalyzer Logging card.
   2. Check that Storage usage information is shown.

To check Security Fabric deployment result:

1. On FortiGate (Edge), go to Dashboard > Status.

   The Security Fabric widget displays all the FortiGates in the Security Fabric.

   

2. On FortiGate (Edge), go to Security Fabric > Physical Topology.

   This page shows a visualization of access layer devices in the Security Fabric.

   

3. On FortiGate (Edge), go to Security Fabric > Physical Topology.

   This dashboard shows information about the interfaces of each device in the Security Fabric.

   

To run diagnose commands:

1. Run the diagnose sys csf authorization pending-list command in the root FortiGate to show the downstream FortiGate pending for root FortiGate authorization:

   Edge # diagnose sys csf authorization pending-list
   Serial                  IP Address      HA-Members    Path
   ------------------------------------------------------------------------------------
   FG201ETK18902514        0.0.0.0                       FG3H1E5818900718:FG201ETK18902514

2. Run the diagnose sys csf downstream command in the root or middle FortiGate to show the downstream FortiGates after they join Security Fabric:

   Edge # diagnose sys csf downstream
   1:     FG201ETK18902514 (192.168.200.10) Management-IP: 0.0.0.0 Management-port:0 parent: FG3H1E5818900718
           path:FG3H1E5818900718:FG201ETK18902514
           data received: Y downstream intf:wan1 upstream intf:port11 admin-port:443
           authorizer:FG3H1E5818900718
   2:     FGT81ETK18002246 (192.168.10.10) Management-IP: 0.0.0.0 Management-port:0 parent: FG3H1E5818900718
           path:FG3H1E5818900718:FGT81ETK18002246
           data received: Y downstream intf:wan1 upstream intf:port10 admin-port:443
           authorizer:FG3H1E5818900718
   3:     FG101ETK18002187 (192.168.135.10) Management-IP: 0.0.0.0 Management-port:0 parent: FG201ETK18902514
           path:FG3H1E5818900718:FG201ETK18902514:FG101ETK18002187
           data received: Y downstream intf:wan2 upstream intf:port12 admin-port:443
           authorizer:FG3H1E5818900718

3. Run the diagnose sys csf upstream command in any downstream FortiGate to show the upstream FortiGate after downstream FortiGate joins Security Fabric:

   Marketing # diagnose sys csf upstream
   Upstream Information:
   Serial Number:FG3H1E5818900718
   IP:192.168.200.2
   Connecting interface:wan1
   Connection status:Authorized