Fortinet FortiRecorder 7.0.0 Instruction Manual

Administration Guide
FortiRecorder 7.0.0

FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com
FORTINET VIDEO LIBRARY
https://video.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com
FORTINET TRAINING & CERTIFICATION PROGRAM
https://www.fortinet.com/training-certification
FORTINET TRAINING INSTITUTE
https://training.fortinet.com
FORTIGUARD LABS
https://www.fortiguard.com
END USER LICENSE AGREEMENT
https://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: [e-mail]
October 24, 2023
FortiRecorder 7.0.0 Administration Guide

TABLEOFCONTENTS
Change log 7
Key concepts 8
FortiRecorder NVR 8
Third-party camera support 8
Licenses 9
Interface overview 9
Quick setup 11
Connecting cameras to FortiRecorder only 11
Connecting cameras to a DHCP server and FortiRecorder 14
Setup 17
Deployment topology 17
Hybrid with FortiCamera Cloud 18
Local to FortiRecorder 19
Remote from FortiRecorder 20
Connecting to the FortiRecorder GUI 20
Connecting to the FortiRecorder CLI 21
Setting the "admin" account password 23
Configuring network settings 24
Configuring network interfaces 24
Configuring routing 28
Configuring DNS settings 30
Making reservations on your DHCPserver 31
Configuring the built-in DHCP server 31
Configuring NAT/portforwarding on your firewall/router 33
Configuring the public port numbers and domain name 35
Configuring the system time 37
Updating the firmware 37
Installing firmware 38
Installing alternative firmware 40
Booting from the alternate partition 42
Upgrading or downgrading camera firmware 43
Upload licenses 43
Plugging in the cameras 43
Discovering cameras in remote networks 44
Configuring cameras 44
Configuring video profiles 44
Configuring camera profiles 47
Configuring cameras 49
More system settings 62
Grouping cameras 62
Configuring user and administrator accounts 62
Configuring administrator profiles 65
Configuring device access control 67
FortiRecorder 7.0.0 Administration Guide 3
Fortinet Inc.

Configuring remote authentication 67
Connecting to the Security Fabric 73
Configuring data storage on the FortiRecorder 73
Configuring email settings for notifications 77
Configuring SMS text message settings for notifications 79
Configuring SNMP traps and queries 81
Configuring notification triggers 85
Customizing notification templates 87
Customizing the theme 90
Working with certificates 91
Using the dashboard 99
Customizing the dashboard 99
Using the CLI Console widget 99
Using FortiView 100
Monitoring camera statistics 100
Viewing bandwidth statistics 100
Viewing top camera usage 101
Analyzing advanced statistics 101
Viewing network connections and sessions 102
Monitoring 103
Viewing video 103
Understanding the timeline 103
Viewing live video 104
Viewing previously recorded video 105
Monitoring events 106
Viewing events as a timeline 106
Viewing events as a table 106
Monitoring motion detection notifications 107
Understanding the logs 107
Viewing logs 110
Monitoring face recognition 112
Monitoring DHCP status 112
Monitoring network security 112
Network security 114
Configuring intrusion detection 114
Schedules 116
Configuring a schedule 116
Configuring the sunrise and sunset time 117
Analytics 118
Using motion detection analytics 118
Using computer vision analytics 118
Face recognition 120
Identifying faces 121
Reviewing new faces 121
Reviewing known faces 122
FortiRecorder 7.0.0 Administration Guide 4
Fortinet Inc.

Configuring a department and role 122
Configuring a floor plan 123
Locating cameras and setting processing schedules 124
Notifications via face recognition 124
Searching the face recognition database 125
Using the face recognition timeline 126
Integrating with an ACS 127
Adding an ACS system 127
Associating cameras with ACS elements 127
Monitoring ACS events 128
Configuring video services 129
Configuring video sharing 129
Sharing video streams 129
Downloading video clips via API 130
Sharing snapshot images 130
Streaming recorded video clips to YouTube 131
Using the monitor display port 131
Using Chromecast with FortiRecorder 131
Analyzing logs and alerts 133
Configuring log settings 133
Configuring alert email 135
Best practices 137
Hardening security 137
Topology 137
Administrator access 138
Operator access 138
Optimizing performance 138
Computer CPUusage 139
FortiRecorder RAMand CPUusage 139
Network bandwidth usage 140
Video performance 140
Sizing guidelines 141
Number of supported cameras 142
Bandwidth per camera 142
Bandwidth per FortiRecorder 143
Storage capacity 143
Software updates and backups 144
Backups 144
Restoring a previous configuration 146
Troubleshooting 147
Login issues 147
When an administrator account cannot log in from a specific IP 147
Remote authentication query failures 147
Resetting passwords 147
Not able to push setting and log shows an error on password 148
FortiRecorder 7.0.0 Administration Guide 5
Fortinet Inc.

Video viewing issues 148
Live feed delay 148
Video not being sent to FortiRecorder 149
Notification issues 149
Resource issues 149
Downloading a trace log 150
Data storage issues 150
Deleting all video clips 151
Connectivity issues 151
Checking hardware connections 151
Bringing up network interfaces 152
Examining the ARPtable 152
Examining routing 153
Discovery fails 156
Multiple DHCPservers 156
Unauthorized DHCP clients or DHCP pool exhaustion 157
Examining IPsessions 157
Resolving IPaddress conflicts 159
Examining live video streams 159
Packet tracing 159
Resetting the configuration 166
Restoring firmware ("clean install") 167
Appendices 170
Appendix A:Port numbers 170
Outgoing traffic 170
Incoming traffic 171
Appendix B:Maximum values 172
FortiRecorder 7.0.0 Administration Guide 6
Fortinet Inc.

Change log
Change log
The following is a list of documentation changes. For a list of software changes, see the Release Notes.
Date Change Description
2023-02-27 Initial release of FortiRecorder 7.0.0 Administration Guide.
2023-03-29 Updates.
2023-03-31 Bug fixes.
2023-04-13 Added security fabric info.
2023-05-16 Bug fixes.
2023-06-08 Improvements and bug fixes.
2023-08-25 Improvements and bug fixes.
FortiRecorder 7.0.0 Administration Guide 7
Fortinet Inc.

Key concepts
If you are new to FortiRecorder, or new to digital video surveillance systems, understanding some important ideas and
words can help you quickly understand how to use your FortiRecorder.
FortiRecorder NVR
The FortiRecorder network video recorder (NVR) provides central management for:
lConfiguring your cameras
lRecording your video feeds
lViewing recordings and live video feeds
It can also be connected to access control systems (ACS) to correlate events such as when doors are opened.
Third-party camera support
FortiRecorder supports Fortinet FortiCam cameras and third-party ONVIF-compliant cameras. Some features on third-
party cameras might not be fully supported, however. In that case, you can configure those features through the built-in
GUI on the camera.
By default, FortiRecorder allows you to connect one third-party camera. To connect more third-party cameras, please
contact Fortinet or your reseller to purchase a license.
FortiRecorder 7.0.0 Administration Guide 8
Fortinet Inc.

Key concepts
Licenses
For more capabilities, you can purchase and install licenses on your FortiRecorder for:
lManaging more third-party ONVIFcameras
lFace recognition AI
lConnecting cameras to FortiCamera Cloud, through FortiRecorder
lVirtual machine (VM) support for large scale deployments that can grow with your organization
If you are unsure which licenses you have installed, or whether they are valid, you can use the dashboard to verify their
status. See Upload licenses on page 43.
Subscription services such as FortiCare support contracts and FortiCamera Cloud are purchased separately.
Interface overview
The GUIof FortiRecorder contains the following main areas and common controls:
Settings are often grouped into a reusable, named item. Instead of repeatedly configuring the same settings, you
configure settings once, give them a name, and then reference it by selecting it in other parts of the configuration. For
example, multiple cameras often use the same settings. You can configure those settings once — in a camera profile —
and then simply select that camera profile when you add each camera.
While referenced by another part of the configuration, an item cannot be deleted. If you need to trace references to it,
then:
FortiRecorder 7.0.0 Administration Guide 9
Fortinet Inc.

Key concepts
1. Use the navigation menus to go to the list of items.
2. In the item's row, click the green references dot.
A list of item names or index numbers that reference the item are displayed.
When an item is not referenced, you can either delete it ,or temporarily disable it. Disabling the item keeps it in the
configuration file for later use, but it is not loaded into memory. This optimizes RAMusage, improving performance.
The Help button is context-aware. When you click it, it jumps to the part of the documentation that matches your current
location in the GUI.
FortiRecorder 7.0.0 Administration Guide 10
Fortinet Inc.

Quick setup
When you connect cameras locally — directly, or on the same LAN as FortiRecorder — then FortiRecorder can
automatically discover the cameras. FortiRecorder supports UPnP, mDNS, and ONVIFdiscovery. Basic setup can be
completed in a few minutes.
Deployment patterns that can use quick setup are:
1. Connecting cameras to FortiRecorder only on page 11
2. Connecting cameras to a DHCP server and FortiRecorder on page 14
This results in a very basic but functional configuration where you can log in and the cameras are connected to
FortiRecorder as their NVR. If you want to add more administrator or user accounts, set up alerts, or want to configure
more advanced system settings, also perform More system settings on page 62.
For more complex or larger deployments (for example, if the Internet or a firewall is between cameras and
FortiRecorder), instead use the instructions in Setup on page 17.
Connecting cameras to FortiRecorder only
You can use this scenario if you want a new, dedicated network where you install your FortiRecorder, FortiCam or
third-party ONVIFcameras, and any other devices such as an access control system (ACS). The built-in DHCPserver on
FortiRecorder is enabled to automatically give IPaddresses to the devices, so you don't need a separate DHCPserver
or router.
If you already have a DHCPserver, do not use these instructions. Instead use Connecting
cameras to a DHCP server and FortiRecorder on page 14.
If isolated from your office LAN, this network topology provides maximum network security
because no other devices or untrusted computers are connected to your surveillance network.
Due to this isolation, this network topology can also be used if you want to test a third-party
camera or other device with FortiRecorder in a lab.
FortiRecorder 7.0.0 Administration Guide 11
Fortinet Inc.

Quick setup
1. Use Ethernet network cables to connect port1 of FortiRecorder and your computer to a power-over-Ethernet (PoE)
switch.
Do not plug in your cameras yet.
2. Change your computer's IP address to be 192.168.1.98 with subnet 255.255.255.0. Steps vary by whether you use
Apple macOS,Linux, or Microsoft Windows.
Alternatively, you can use a different IP address, but it must be on the same subnet as the default IP address of
FortiRecorder port1:192.168.1.0/24.
3. On your computer, open a web browser and go to:
https://192.168.1.99
Log in with the username admin and no password.
4. Change the password. For details, see Setting the "admin" account password on page 23.
5. Configure the built-in DHCP server:
a. On the FortiRecorder GUI, go to System> Network> DHCP.
b. Click the New button.
FortiRecorder 7.0.0 Administration Guide 12
Fortinet Inc.

Quick setup
c. Enable Enable DHCP server.
d. From Interface, select port1.
e. In the DHCPIPRange area, click New. Enter a range of IPaddresses (pool)that is larger than all of the
devices that you want to connect.
DHCPIPaddresses must be in the same subnet as the IPaddress that you will give to port1. For example, if
port1 is 192.168.1.9/24, then a DHCPrange for 10 cameras could be 192.168.1.10-192.168.1.19.
f. Click the Create button to close the dialog, and then click the Create button to start the DHCPserver.
6. Configure port1:
a. Go to System> Network> Interface.
b. Select port1. Click the Edit button.
c. Enable Discover cameras on this port.
d. Click OK.
7. Use Ethernet network cables to connect the cameras to the switch.
If you connected the cameras too soon, before a DHCPserver was available, then they
are using a default IPaddress.The default address will not work with your network. To fix
this, unplug the cameras and then plug them in again. This reboots the cameras and
requests a correct IPaddress from the DHCPserver.
8. Discover and configure the cameras:
a. Go to Camera> Configuration> Camera.
b. Click the Discoverbutton.
After several seconds, a list of cameras appears. Newly discovered cameras are highlighted in yellow, and
their Status column displays Not Configured.
FortiRecorder 7.0.0 Administration Guide 13
Fortinet Inc.

Quick setup
c. Double-click each camera to configure its settings. For details, see Configuring cameras on page 49.
Repeat this step for all cameras.
9. To verify that FortiRecorder is able to receive video from the camera, go to Monitor> Video> Video. You should be
able to see the camera's live video feed.
Connecting cameras to a DHCP server and FortiRecorder
You can use this scenario if you already have an existing network with a DHCP server where you will install your
FortiRecorder, FortiCam or third-party ONVIFcameras, and any other devices such as an access control system (ACS).
Like the other quick setup method, this deployment could be isolated from your office LAN. Often, however, the
PoEswitch is connected to an existing router, and the existing DHCP server also gives IPaddresses to other existing
devices on the same subnet.
The cameras get network settings from your DHCP server, but FortiRecorder does not. Like any server, FortiRecorder
uses a static IPaddress so that its GUI or CLIcan always be reached at the same location.
FortiRecorder 7.0.0 Administration Guide 14
Fortinet Inc.

Quick setup
1. Use Ethernet cables to connect your DHCPserver (and router, if any)to your power-over-Ethernet (PoE) switch.
Your DHCPserver must have a range of IPaddresses (pool)that is larger than all of the devices that you will
connect.
2. Use Ethernet network cables to connect the cameras to the switch.
If you connected the cameras too soon, before a DHCPserver was available, then they
are using a default IPaddress. The default address will not work with your network. To fix
this, unplug the cameras and then plug them in again. This reboots the cameras and
requests a correct IPaddress from the DHCPserver.
3. On your DHCPserver, create a reservation for each camera so that it always gets the same IPaddress.
Fortinet strongly recommends to either:
lconfigure your cameras with a static IP address (see Address), or
lconfigure your DHCP server with lease reservations
Without reservations, the IP address provided by the DHCP server might appear to work
initially, but later, when the DHCPlease expires, the DHCP server might change the IP
address of the camera. DHCP servers do not notify FortiRecorder about the camera's new
dynamic IP address. During this time, FortiRecorder will try to control the camera at its old
IPaddress. This does not work. Connections with that camera will be broken and
all video from that camera could be lost during that interruption. To fix this, create
IP address reservations on your DHCPserver and then update the camera's Address with
its current IPaddress.
4. Use Ethernet network cables to directly connect port1 of FortiRecorder to your computer.
Do not put your switch between them yet. FortiRecorder network settings are not configured yet.
5. Temporarily change your computer's IP address to be 192.168.1.98 with subnet 255.255.255.0. (If your computer
has a static IPaddress, write it down so that you can restore the settings later.) Steps vary by whether you use
Apple macOS,Linux, or Microsoft Windows.
Alternatively, you can use a different IP address, but it must be on the same subnet as the default IP address of
FortiRecorder port1:192.168.1.0/24.
FortiRecorder 7.0.0 Administration Guide 15
Fortinet Inc.

Quick setup
6. On your computer, open a web browser and go to:
https://192.168.1.99
Log in with the name admin and no password.
7. Change the password. For details, see Setting the "admin" account password on page 23.
8. Configure port1:
a. Go to System> Network> Interface.
b. Select port1. Click the Edit button.
c. Enable Discover cameras on this port.
d. In IP/Netmask, enter the IPaddress and netmask that FortiRecorder will have on your network.
Do not use one of the range of IPaddresses that the DHCPserver assigns to cameras,
computers, etc. (This can cause IPaddress conflict error messages.)
e. Click OK.
9. Change your computer's IP address and subnet back to its original settings.
10. Unplug the Ethernet cable between your computer and FortiRecorder port1, and then plug them both into the
switch.
11. In your web browser, go to the new IP address of FortiRecorder. Log in.
12. Discover and configure the cameras:
a. Go to Camera> Configuration> Camera.
b. Click the Discoverbutton.
After several seconds, a list of cameras appears.Newly discovered cameras are highlighted in yellow, and their
Status column displays Not Configured.
c. Double-click each camera to adjust its settings. For details, see Configuring cameras on page 49.
Repeat this step for all cameras.
13. To verify that FortiRecorder is able to receive video from the camera, go to Monitor> Video> Video. You should be
able to see the camera's live video feed.
FortiRecorder 7.0.0 Administration Guide 16
Fortinet Inc.

Setup
If you did not use one of the quick setup scenarios — or later want to change settings — then you can use these
instructions.
When you initially install FortiRecorder, or after a configuration reset or clean install, you must perform these steps in
order:
1. Deployment topology on page 17
2. Connecting to the FortiRecorder GUI on page 20 or CLI
3. Setting the "admin" account password on page 23
4. Network settings, including:
a. Configuring network interfaces on page 24
b. Configuring routing on page 28
c. Configuring DNS settings on page 30
d. DHCPserver settings, either:
lMaking reservations on your DHCPserver on page 31
lConfiguring the built-in DHCP server on page 31
e. (Remote network deployments) Firewall/router settings:
i. Configuring NAT/portforwarding on your firewall/router on page 33
ii. Configuring the public port numbers and domain name on page 35
5. (Optional) Configuring the system time on page 37
6. (Optional)Updating the firmware on page 37
7. Upload licenses on page 43
8. Plugging in the cameras on page 43
a. (Remote network deployments)Discovering cameras in remote networks on page 44
9. Camera settings, including:
a. (Optional) Configuring video profiles on page 44
b. (Optional) Configuring camera profiles on page 47
c. Configuring cameras on page 49
This results in a basic, functional configuration where you can log in and cameras are connected to FortiRecorder.
Optional steps can be skipped if you want to use factory default settings.
If you want to add more administrator or user accounts, set up alert email, or configure more advanced settings,
continue with More system settings on page 62.
Deployment topology
Cameras and other devices such as ACScan be deployed in networks that are:
lHybrid with FortiCamera Cloud on page 18
lLocal to FortiRecorder on page 19
FortiRecorder 7.0.0 Administration Guide 17
Fortinet Inc.

Setup
lRemote from FortiRecorder on page 20
or a combination of them.
Do not plug in your cameras and FortiRecorder yet. Diagrams below are for comparison and planning purposes.
Follow the order of steps in Setup on page 17.
If you connected FortiCam cameras too soon, before a DHCPserver was available, then they
are using a default IPaddress.The default address will not work with your network. To fix this,
unplug the cameras. Later, when indicated in Setup on page 17, you will plug them in again.
This reboots the cameras and requests a correct IPaddress from the DHCPserver.
Often there is a DHCPserver on the LAN already, but if not, you do not need to deploy one. Use the built-in
DHCPserver on FortiRecorder instead. In their factory default state, FortiCam cameras automatically get network
settings from a DHCPserver during initial setup. Many third-party cameras require a DHCP server, too. Some third-party
cameras have a default static IP address, however; these require you to manually configure the network settings
through the camera's native GUI. Later, once connected, optionally cameras can be reconfigured to use a static IP
address.
For Wi-Fi cameras, you will temporarily use an Ethernet cable during setup with FortiRecorder. Later, once setup is
complete, you will disconnect and move the camera to its location on the Wi-Fi network. Power is then supplied by a
PoE injector, not a physical connection through a PoE switch.
For external storage, Chromecast integration, and/or larger, more complex networks, you may need more network
connections than the diagrams show, although the designs are similar.
Hybrid with FortiCamera Cloud
FortiCamera Cloud can be used together with FortiRecorder. You can use FortiCamera Cloud to configure most
camera settings, and to monitor video from cameras, while FortiRecorder provides video storage and is used to
configure remaining camera settings, if any. For details, see Managed by cloud.
FortiRecorder 7.0.0 Administration Guide 18
Fortinet Inc.

Setup
This architecture scales well if your organization is adding small locations quickly. Each location can start with a cloud
native FortiCam model connected to FortiCamera Cloud, and then later add FortiRecorder when more cameras need
local storage, or for advanced features.
Topology is similar to remote networks, but once setup is complete, an administrator or operator usually logs in through
FortiCamera Cloud — not FortiRecorder.
Local to FortiRecorder
In a simple local deployment, cameras are installed on the same local network as FortiRecorder, with either:
1. No router or firewall between them
2. Router or firewall between them, but they do no network address translation (NAT)/port forwarding, such as
a FortiGate operating in transparent mode or LANs joined via VPN
Often the switch is connected to a router, and devices connect through it to the Internet. However, this is not required
unless you use camera or FortiRecorder features that require an Internet connection. See also Appendix A:Port
numbers on page 170.
FortiRecorder 7.0.0 Administration Guide 19
Fortinet Inc.

Setup
Remote from FortiRecorder
Remote camera deployment is when there is a firewall or router — perhaps many internal networks, or the Internet —
between FortiRecorder and the cameras, ACS, and/or administrators and operators. Branch offices often use this
design. Devices in your deployment will connect through either:
lsecure tunnel (VPN)
lnetwork address translation (NAT) and/or port forwarding
on the router or firewall.
To strengthen security, use a VPN — not NAT/port forwarding.
Communications include surveillance video and other sensitive information which could be
intercepted or changed if it travels over untrusted networks such as the Internet. Remote
access through NAT/port forwarding opens ports and can weaken the strength of your network
security. To prevent attackers on the Internet from gaining access to your surveillance system,
require authentication, use a firewall to restrict which IP addresses can use your port forward
or virtual IP, and scan requests for viruses and hacking attempts.
For larger networks, VPNcan be simpler than configuring NAT/port forwarding for many
devices, too.
If you require remote access while you are out of the office, you can also use the VPNor VIP/NAT, connecting through
the Internet to use the GUI or notification video clips.
Connecting to the FortiRecorder GUI
To configure the FortiRecorder appliance, you must connect to its management GUI or CLI console.
During initial installation, you can connect to the GUI using its factory default settings.
FortiRecorder 7.0.0 Administration Guide 20
Fortinet Inc.