Overview
This document provides the steps necessary for installing FortiNAC appliance(s). It is intended to be used in conjunction with the FortiNAC Deployment Guide in the Fortinet Document Library.
For additional details on the steps outlined in this document, refer to the appropriate vendor documentation.
Virtual Appliance (VM) Part Numbers
|
Part Number |
Description |
|---|---|
|
FNC-MX-VM |
Control Manager |
|
FNC-CAX-VM |
Control and Application Server (CA) |
The FortiNAC VM can be preconfigured to boot with a predetermined configuration. See Cloud-init for details.
Requirements
-
Direct access to the AWS environment (direct connection or VPN tunnel). Public connections are not recommended due to lack of security.
-
Virtual appliance specifications and resource sizing values have been determined. See section Appliance Installation of the Deployment Guide for details.
-
AWS CLI is installed on a computer.
-
Instructions to install AWS CLI on your computer can be found at
https://docs.aws.amazon.com/cli/latest/userguide/installing.html
-
Instructions to configure the credentials for your AWS CLI can be found at
https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#cli-quick-configuration
Note: To test that setup was done correctly, you can create a test directory, and download or copy the FortiNAC OVA into the test directory.
-
The computer must have sufficient hard drive space available for the FortiNAC OVA.
-
Considerations
-
In versions 7.x and greater, FortiNAC doesn't have any ports open by default. In previous versions, this was not the case. As features are configured, ports must also be added to the allowaccess list in order for the feature to work.
Operating System and Open Ports
The FortiNAC software runs on top of the FortiNAC-OS operating system. For security purposes, FortiNAC-OS does not have any open (listening) TCP/UDP ports configured by default. Access must be configured using the "set allowaccess" command via the appliance CLI. The ports that must be enabled depend upon the features required.
The best practice is to keep the number of open ports to a minimum, and block all other ports. If there is a need to provide users access to network resources through a static port (e.g., from outside a firewall), the best option is to allow users to connect by VPN. For details, see Open Ports in the FortiNAC Administration Guide.
