Fortinet black logo

Overview

7.2.0
Copy Link
Copy Doc ID fd810e5f-6143-11ed-96f0-fa163e15d75b:236144
Download PDF

Overview

This document provides the steps necessary for installing FortiNAC appliance(s). It is intended to be used in conjunction with the FortiNAC Deployment Guide in the Fortinet Document Library.

Virtual Appliance (VM) Part Numbers

Part Number

Description

FNC-MX-VM

Control Manager

FNC-CAX-VM

Control and Application Server (CA)

Requirements

  • Hyper-V Server 2012, Windows 2012, 2016 or 2019 Server with Hyper-V.
    Note
    : Remote management must be enabled in Hyper-V Server 2012 to use Hyper-V Manager

  • Hyper-V Server Hardware

    • The requirements for the Hyper-V server used to host your FortiNAC Virtual Machine will vary greatly depending on many different factors. Factors include:

      • The number of other Virtual Machines that are running on the same server

      • The load those VMs place on the server

      • The number of devices, hosts and users on your network that are to be managed by FortiNAC

  • Virtual appliance settings will vary depending on the underlying hardware being used for the hosting server. The ideal result is to yield a virtual environment where the average load does not exceed the Total GHz Rating of CPU Resources Allocated.

    • Determine the appropriate parameters for the virtual environment. It is recommended they be comparable to those of hardware-based FortiNAC appliances. Refer to the following tables in the FortiNAC Data Sheet:

      • Hardware Server Sizing - Hardware server part number most appropriate for the target environment

      • Specifications - Details regarding the applicable part number

      • VM Server Resource Sizing - Suggested values for memory and CPU to allocate for the virtual appliance

  • Virtual Machine Generation: Generation 1 (for VHD) with IDE must be used. Generation 2 (for VHDX) with SCSI and UEFI is not supported at this time.

  • VLAN Tagging and Trunking are supported with CentOS-7 and Hyper-V on Windows Server version 2016, 2012 R2, 2012, or 2008 R2. When configuring adapters for Layer 2 VLAN Tagging/Trunking, see VLAN Tagging in Appendix.

Considerations

In versions 7.x and greater, FortiNAC doesn't have any ports open by default. In previous versions, this was not the case. As features are configured, ports must also be added to the allowaccess list in order for the feature to work.

Operating System and Open Ports

FortiNAC-F series appliances use the FortiNAC-OS operating system. Limited TCP/UDP ports are open by default for security purposes. This was not the case for FortiNAC appliances using the CentOS operating system.

Virtual appliances do not have any TCP/UDP ports listening by default. Opening additional ports requires the use of the "set allowaccess" command in the appliance CLI.

The configuration steps provided include opening ports for the applicable features and functions covered in this guide. As more features are configured, additional access must be enabled using the "set allowaccess" command via the appliance CLI. For details, see Open Ports in the FortiNAC Administration Guide.

The best practice is to keep the number of open ports to a minimum, and block all other ports. If there is a need to provide users access to network resources through a static port (e.g., from outside a firewall), the best option is to allow users to connect by VPN.

Overview

This document provides the steps necessary for installing FortiNAC appliance(s). It is intended to be used in conjunction with the FortiNAC Deployment Guide in the Fortinet Document Library.

Virtual Appliance (VM) Part Numbers

Part Number

Description

FNC-MX-VM

Control Manager

FNC-CAX-VM

Control and Application Server (CA)

Requirements

  • Hyper-V Server 2012, Windows 2012, 2016 or 2019 Server with Hyper-V.
    Note
    : Remote management must be enabled in Hyper-V Server 2012 to use Hyper-V Manager

  • Hyper-V Server Hardware

    • The requirements for the Hyper-V server used to host your FortiNAC Virtual Machine will vary greatly depending on many different factors. Factors include:

      • The number of other Virtual Machines that are running on the same server

      • The load those VMs place on the server

      • The number of devices, hosts and users on your network that are to be managed by FortiNAC

  • Virtual appliance settings will vary depending on the underlying hardware being used for the hosting server. The ideal result is to yield a virtual environment where the average load does not exceed the Total GHz Rating of CPU Resources Allocated.

    • Determine the appropriate parameters for the virtual environment. It is recommended they be comparable to those of hardware-based FortiNAC appliances. Refer to the following tables in the FortiNAC Data Sheet:

      • Hardware Server Sizing - Hardware server part number most appropriate for the target environment

      • Specifications - Details regarding the applicable part number

      • VM Server Resource Sizing - Suggested values for memory and CPU to allocate for the virtual appliance

  • Virtual Machine Generation: Generation 1 (for VHD) with IDE must be used. Generation 2 (for VHDX) with SCSI and UEFI is not supported at this time.

  • VLAN Tagging and Trunking are supported with CentOS-7 and Hyper-V on Windows Server version 2016, 2012 R2, 2012, or 2008 R2. When configuring adapters for Layer 2 VLAN Tagging/Trunking, see VLAN Tagging in Appendix.

Considerations

In versions 7.x and greater, FortiNAC doesn't have any ports open by default. In previous versions, this was not the case. As features are configured, ports must also be added to the allowaccess list in order for the feature to work.

Operating System and Open Ports

FortiNAC-F series appliances use the FortiNAC-OS operating system. Limited TCP/UDP ports are open by default for security purposes. This was not the case for FortiNAC appliances using the CentOS operating system.

Virtual appliances do not have any TCP/UDP ports listening by default. Opening additional ports requires the use of the "set allowaccess" command in the appliance CLI.

The configuration steps provided include opening ports for the applicable features and functions covered in this guide. As more features are configured, additional access must be enabled using the "set allowaccess" command via the appliance CLI. For details, see Open Ports in the FortiNAC Administration Guide.

The best practice is to keep the number of open ports to a minimum, and block all other ports. If there is a need to provide users access to network resources through a static port (e.g., from outside a firewall), the best option is to allow users to connect by VPN.