Fortinet FortiGate-7060E User manual

FortiOS™ Handbook - FortiGate-7000
VERSION 5.4.5
7000

FORTINET DOCUMENTLIBRARY
http://docs.fortinet.com
FORTINETVIDEOGUIDE
http://video.fortinet.com
FORTINETBLOG
https://blog.fortinet.com
CUSTOMERSERVICE&SUPPORT
https://support.fortinet.com
http://cookbook.fortinet.com/how-to-work-with-fortinet-support/
FORTIGATECOOKBOOK
http://cookbook.fortinet.com
FORTINETTRAININGSERVICES
http://www.fortinet.com/training
FORTIGUARDCENTER
http://www.fortiguard.com
FORTICAST
http://forticast.fortinet.com
ENDUSER LICENSE AGREEMENT
http://www.fortinet.com/doc/legal/EULA.pdf
FORTINET PRIVACY POLICY
https://www.fortinet.com/corporate/about-us/privacy.html
FEEDBACK
Email: [e-mail]
December 20, 2017
FortiOS™ Handbook - FortiGate-7000
01-545-3966550-20171220

TABLEOFCONTENTS
Change Log 7
Introduction 8
What's new in for FortiGate-7000 v5.4.5 8
M1 and M2 interfaces can use different VLANs for heartbeat traffic (408386) 8
GTP load balancing 8
FSSO user authentication is synchronized 8
HA Link failure threshold changes (422264 ) 9
FortiGate-7000s running FortiOS v5.4.5 can be configured as dialup IPsec VPN servers 9
FortiGate-7000 overview 11
Licenses, Device Registration, and Support 11
FortiGate-7060E 12
FortiGate-7060E front panel 12
FortiGate-7060E schematic 13
FortiGate-7040E 14
FortiGate-7040E front panel 14
FortiGate-7040E schematic 15
FortiGate-7030E 15
FortiGate-7030E front panel 16
FortiGate-7030E schematic 16
FIM-7901E interface module 18
FIM-7901E schematic 19
FIM-7904E interface module 20
Splitting the FIM-7904E B1 to B8 interfaces 21
FIM-7904E hardware schematic 21
FIM-7910E interface module 22
Splitting the FIM-7910E C1 to C4 interfaces 23
FIM-7910E hardware schematic 24
FIM-7920E interface module 24
Changing the interface type and splitting the FIM-7920E C1 to C4 interfaces 25
Splitting the C1 to C4 interfaces 26
FIM-7920E hardware schematic 26
FPM-7620E processing module 27
NP6 network processors - offloading load balancing and network traffic 28

Accelerated IPS, SSL VPN, and IPsec VPN (CP9 content processors) 30
Getting started with FortiGate-7000 31
Managing individual modules 32
Managing individual modules from the CLI 33
Connecting to module CLIs using the management module 33
Connecting to the FortiOS CLI of the FIM module in slot 1 34
Default VDOM configuration 35
Default management VDOM 35
Firmware upgrades 35
Restarting the FortiGate-7000 35
Load balancing 36
Traffic that cannot be load balanced 36
Recommended configuration for traffic that cannot be load balanced 37
Configuration synchronization 39
Failover in a standalone FortiGate-7000 39
Replacing a failed FPMor FIMmodule 39
Replacing a failed module in a standalone FortiGate-7000 chassis 39
Replacing a failed module in a FortiGate-7000 chassis inan HAcluster 40
Installing firmware on an FIM or FPM module from the BIOS using a TFTP server 41
Uploading firmware from a TFTP server to an FIMmodule 41
Uploading firmware from a TFTP server to an FPMmodule 43
Operating a FortiGate-7000 45
Failover in a standalone FortiGate-7000 45
Replacing a failed FPMor FIMmodule 45
Replacing a failed module in a standalone FortiGate-7000 chassis 45
Replacing a failed module in a FortiGate-7000 chassis inan HAcluster 46
Installing firmware on an FIM or FPM module from the BIOS using a TFTP server 46
Uploading firmware from a TFTP server to an FIMmodule 47
Uploading firmware from a TFTP server to an FPMmodule 48
IPsec VPN 51
Adding source and destination subnets to IPsec VPN phase 2 configurations 51
Example basic IPsec VPN Phase 2 configuration 51
Example multiple subnet IPsec VPN Phase 2 configuration 52
Configuring the FortiGate-7000 as a dialup IPsec VPN server 53
Example dialup IPsec VPN configuration 53
Troubleshooting 54
High Availability 57
Before you begin configuring HA 57
Connect the M1 and M2 interfaces for HA heartbeat communication 58
HA configuration 60
Setting up HA on the FIM interface modules in the first FortiGate-7000 (chassis 1) 60
HA management configuration 62

Managing individual modules in HAmode 63
Firmware upgrade 64
Session failover (session-pickup) 64
Enabling session pickup for TCP and UDP 65
If session pickup is disabled 65
Primary unit selection and failover criteria 66
Verifying primary chassis selection 68
How link and module failures affect primary chassis selection 68
FIM module failures 70
Management link failures 70
Link failure threshold and board failover tolerance 70
Link failure threshold 70
Board failover tolerance 70
Priority and primary chassis selection 71
Override and primary chassis selection 71
FortiGate-7000 v5.4.5 special features and limitations 72
Managing the FortiGate-7000 72
Default management VDOM 72
Firewall 72
IP Multicast 72
HighAvailability 73
Shelf Manager Module 73
FortiOS features that are not supported by FortiGate-7000 v5.4.5 74
IPsec VPN tunnels terminated by the FortiGate-7000 74
SSL VPN 75
Traffic shaping and DDoS policies 75
Sniffer mode (one-arm sniffer) 75
FortiGuard Web Filtering 75
Log messages include a slot field 75
FortiOS Carrier 75
Special notice for new deployment connectivity testing 75
FortiGate-7000 v5.4.3 special features and limitations 77
Managing the FortiGate-7000 77
Default management VDOM 77
Firewall 77
Link monitoring and health checking 77
IP Multicast 78
HighAvailability 78
Shelf Manager Module 79
FortiOS features that are not supported by FortiGate-7000 v5.4.3 79
IPsec VPN tunnels terminated by the FortiGate-7000 79
More about IPsec VPN routing limitations 80

SSL VPN 80
Authentication 80
Traffic shaping and DDoS policies 81
Sniffer mode (one-arm sniffer) 81
FortiGuard Web Filtering 81
Log messages include a slot field 81
FortiOS Carrier 81
Special notice for new deployment connectivity testing 81
FortiGate-7000 Load balancing commands 82
config load-balance flow-rule 82
Syntax 82
status {disable | enable} 83
src-interface <interface-name> [interface-name>...} 83
vlan <vlan-id> 83
ether-type {any | arp | ip | ipv4 | ipv6} 83
{src-addr-ipv4 | dst-addr-ipv4 | src-addr-ipv6 | dst-addr-ipv6} <ip-address> <netmask> 83
protocol {any | icmp | tcp | udp | igmp | sctp | gre | esp | ah | ospf | pim | vrrp} 83
{src-l4port | dst-l4port} <start>[-<end>] 83
action {forward | mirror-ingress | mirror-egress | stats | drop} 83
set mirror-interface <interface-name> 84
forward-slot {master | all | load-balance | FPM3 | FPM4 | FPM5 | FPM6} 84
priority <number> 84
comment <text> 84
config load-balance setting 84
gtp-load-balance {disable | enable} 84
max-miss-heartbeats <heartbeats> 85
max-miss-mgmt-heartbeats <heartbeats> 85
weighted-load-balance {disable | enable} 85
dp-load-distribution-method {round-robin | src-ip | dst-ip | src-dst-ip | src-ip-sport | dst-
ip-dport | src-dst-ip-sport-dport} 85
config workers 85

Change Log
Change Log
Date Change Description
December 20, 2017 Updated for FortiGate-7000 v5.4.5. New sections include What's new in for
FortiGate-7000 v5.4.5 on page 8,FortiGate-7000 v5.4.5 special features and
limitations on page 72,IPsec VPN on page 51,gtp-load-balance {disable | enable} on
page 84, and Operating a FortiGate-7000 on page 45. Also, changes to High
Availability on page 57. New section Recommended configuration for traffic that
cannot be load balanced on page 37.Additional changes and fixes throughout the
document.
November 7, 2017
Changes to Installing firmware on an FIM or FPM module from the BIOS using a
TFTP server on page 41. Also added a note about the MGMT interface being a static
aggregate and not an LACP aggregate.
November 2, 2017 Updated with new information throughout the document including a new HA chapter.
August 30, 2017 Updated with new information throughout the document.
December 1, 2016 Initial Release
7 FortiGate-7000
Fortinet Technologies Inc.

Introduction What's new in for FortiGate-7000 v5.4.5
Introduction
This document describes what you need to know to get started using a FortiGate-7000 product. Also included are
details about CLI commands that are specific to FortiGate-7000 products.
This FortiOS Handbook chapter contains the following sections:
FortiGate-7000 overview provides a quick overview of FortiGate-7000 components.
Getting started with FortiGate-7000 describes how to get started with managing and configuring your FortiGate-
7000 product.
FortiGate-7000 Load balancing commands describes FortiGate-7000 load balancing CLI commands.
What's new in for FortiGate-7000 v5.4.5
The following new features have been added to FortiGate-7000 v5.4.5.
M1 and M2 interfaces can use different VLANs for heartbeat traffic (408386)
The M1 and M2 interfaces can be configured to use different VLANs for HA heartbeat traffic.
The following command now configures the VLAN used by the M1 interface (default 999):
config system ha
set hbdev-vlan-id 999
end
The following new command configures the VLAN used by the M2 interface (default 1999):
config system ha
set hbdev-second-vlan-id 1999
end
GTP load balancing
GTP load balancing is supported for FortiGate-7000 configurations licensed for FortiOSCarrier. You can use the
following command to enable GTP load balancing. This command is only available after you have licensed the
FortiGate-7000 for FortiOSCarrier.
config load-balance setting
set gtp-load-balance enable
end
FSSO user authentication is synchronized
FSSO user authentication is synchronized to all FIM and FPMmodules. FSSO users are no longer required to re-
authenticate when sessions are processed by a different FIM or FPM module.
FortiGate-7000
Fortinet Technologies Inc.
8

What's new in for FortiGate-7000 v5.4.5 Introduction
HA Link failure threshold changes (422264 )
The link failure threshold is now determined based on the all FIM modules in a chassis. This means that the
chassis with the fewest active links will become the backup chassis.
FortiGate-7000s running FortiOS v5.4.5 can be configured as dialup IPsec VPN servers
The following shows how to setup a dialup IPsec VPN configuration where the FortiGate-7000 running v5.4.5 acts
as a dialup IPsec VPN server.
Configure the phase1, set type to dynamic.
config vpn ipsec phase1-interface
edit dialup-server
set type dynamic
set interface "v0020"
set peertype any
set psksecret <password>
end
Configure the phase 2, to support dialup IPsec VPN, set the destination subnet to 0.0.0.0 0.0.0.0.
config vpn ipsec phase2-interface
edit dialup-server
set phase1name dialup-server
set src-subnet 4.2.0.0 255.255.0.0
set dst-subnet 0.0.0.0 0.0.0.0
end
To configure the remote FortiGate as a dialup IPsec VPN client
The dialup IPsec VPN client should advertise its local subnet(s) using the phase 2 src-subnet option.
If there are multiple local subnets create a phase 2 for each one. Each phase 2 only
advertises one local subnet to the dialup IPsec VPN server. If more than one local
subnet is added to the phase 2, only the first one is advertised to the server.
Dialup client configuration:
config vpn ipsec phase1-interface
9 FortiGate-7000
Fortinet Technologies Inc.

Introduction What's new in for FortiGate-7000 v5.4.5
edit "to-fgt7k"
set interface "v0020"
set peertype any
set remote-gw 1.2.0.1
set psksecret <password>
end
config vpn ipsec phase2-interface
edit "to-fgt7k"
set phase1name "to-fgt7k"
set src-subnet 4.2.6.0 255.255.255.0
set dst-subnet 4.2.0.0 255.255.0.0
next
edit "to-fgt7k-2"
set phase1name "to-fgt7k"
set src-subnet 4.2.7.0 255.255.255.0
set dst-subnet 4.2.0.0 255.255.0.0
end
FortiGate-7000
Fortinet Technologies Inc.
10