Centralized Management

FortiManager Overview and Core Capabilities

• Single-Pane-of-Glass Management: FortiManager provides a centralized platform to manage various Fortinet devices, specifically focused on FortiGate, FortiSwitch, and FortiAP in LAN Edge environments.

• Business Benefits:

  • Minimizes initial deployment costs and ongoing operating expenses (OPEX) for large-scale environments.

  • Assists in maintaining regulatory compliance through tracking and auditing.

  • Reduces WAN usage by acting as a local FortiGuard cache server for managed devices.

• Key Functions:

  • Provisioning: Automates mass device provisioning and maintains firewall policies across the network.

  • Configuration Management: Acts as a central repository for configuration revision control and security audits.

  • Management Scopes: Centrally manages FortiSwitch and FortiAP devices through the switch controller and wireless controller functionality of managed FortiGates.

  • FDS Services: Functions as a private FortiGuard Distribution Server (FDS).

  • Automation: Supports scripting and automation of policy changes and provisioning via JSON APIs.

FortiGate Registration and Device Management

• Registration Methods:

  • Method $1$: Device Registration Wizard: Use the wizard on FortiManager to register the device. If the FortiGate model is supported and details are correct, the registration is completed.

  • Method $2$: Request from FortiGate: The administrator adds FortiManager details on the FortiGate GUI. The FortiManager administrator then accepts or denies the incoming request.

• Communication Channel: During registration, a secure tunnel is established between FortiManager and FortiGate using TCP port $541$. This tunnel is used for status checks, configuration synchronization, and installations.

• Device Manager Features:

  • Device-Level Settings: Allows viewing and configuring individual device parameters such as interfaces, High Availability (HA), DNS, log settings, and static routes (Network > Static Route).

  • Correlation: Most settings in Device Manager have a one-to-one correlation with the local FortiGate GUI or CLI configuration.

• Policy & Objects:

  • Policy Packages: Firewall policies are organized into packages. These can be customized for specific VDOMs or applied across multiple devices requiring identical policy sets.

• Install Wizard Options:

  • Install Device Settings (only): Installs only device-level configuration changes (e.g., interface IP, routes) without affecting firewall policies.

  • Install Policy Package & Device Settings: Installs both a selected policy package and any device-specific configuration changes.

Switch Controller and FortiLink Management

• Feature Enablement: Most FortiGate models have the switch controller enabled by default. On FortiGate VM models, it must be enabled via CLI:

  • $config \, system \, global$

  • $set \, switch-controller \, enable$

  • $end$

• GUI Visibility: If the menu is missing, it must be enabled using $set \, gui-switch-controller \, enable$ under $config \, system \, settings$.

• FortiLink Interface: A factory-default interface in the root VDOM dedicated to managing FortiSwitches.

  • Default Configuration: Created as a Link Aggregation Group (LAG) interface with no members by default.

  • Connectivity: Requires at least one physical LAG member. FortiGate uses the assigned IP and netmask to create a DHCP scope for managing switches.

  • Authorization: Switches must be authorized manually by default unless "Automatically authorize devices" is enabled (configurable on FMG via scripts or CLI-only objects).

  • FortiLink Split Interface: Enabled by default to keep only one port active when connecting to multiple switches that do not yet support Multi-Chassis Link Aggregation Group (MCLAG).

FortiSwitch Manager Modes

• Central Management (Default):

  • Mechanism: Uses FortiSwitch Templates assigned to devices.

  • Scalability: Ideal for large deployments where multiple switches require identical configurations. A single template change updates all associated switches.

  • Templates: Based on specific FortiSwitch models. Can be created from scratch or imported from an existing production switch.

  • Template Objects: Includes VLANs (bound to FortiLink), Security Profiles (for $802.1X$), LLDP Profiles (for TLV advertising and auto-VLAN via LLDP-MED), QoS Policies (for egress priority), and Custom Commands.

• Per-Device Management:

  • Mechanism: Configuration is maintained on a per-switch basis, similar to the FortiGate GUI.

  • Use Case: Ideal for sites where switches require unique, non-standardized configurations.

  • Activation: Requires clearing the "FortiSwitch" checkbox in the ADOM settings.

  • Features: Adds "NAC Policy" in the profile section for automatic port configuration based on device criteria (MAC, OS, etc.) and "CLI Configurations" for settings not in the standard GUI.

• Monitoring Tools:

  • Topology: Displays a block-style representation of the switch fabric hierarchy.

  • Faceplates: Shows a diagram of management connections and real-time port status.

  • Status Indicators: Online, Offline, Unauthorized, and Unknown (Unknown status occurs if the controlling FortiGate is also offline). Status is polled via REST API every $3$ minutes.

AP Manager and Wireless Administration

• Central Management (Default):

  • Shared Wi-Fi Profiles: Configurations are deployed using profiles shared across all FortiGates and APs of a specific model.

  • Consistency: A change in the shared profile affects every AP using that profile.

• Per-Device Management:

  • Local Profiles: Each FortiGate maintains its own unique set of Wi-Fi profiles that are not shared with other controllers.

  • Activation: Requires clearing the "FortiAP" checkbox in the ADOM settings.

• Monitoring and Actions:

  • Status: Online, Offline, or Unauthorized (Note: No "Unknown" status for APs).

  • Visibility: Monitors connected wireless clients ($Client \, Connected$) and identifies Rogue APs.

Extender Manager and SD-Branch

• FortiExtender Role: Provides $4G/5G$ LTE wireless WAN connections to extend network reach or provide backup connectivity in SD-Branch deployments.

• Management Components:

  • Managed Extenders: Centralized platform for authorization, firmware upgrades, and profile assignment.

  • Extender Profiles: Configuration templates that include SIM settings and data plan links.

  • Data Plans: Tracks and controls cellular data consumption to prevent overage charges.

• SD-Branch Solution: Integrates SD-WAN with LAN/WAN infrastructure.

  • Convergence: Combines FortiGate (NGFW), FortiSwitch, FortiAP, and FortiExtender into a unified, managed architecture via FortiManager.

  • High Availability: FortiExtender provides seamless failover to LTE if primary wired connections fail.

Zero-Touch Provisioning (ZTP)

• Purpose: Provisioning devices without onsite technical intervention, reducing human error and deployment time.

• Workflow Implementation:

  1. Preparation: Administrator adds a "Model Device" on FortiManager using the Serial Number ($SN$). If the $SN$ is unknown, a Pre-Shared Key ($PSK$) can be used.

  2. DHCP Discovery: Once powered on, FortiGate retrieves the FortiManager address via DHCP Option $240$ ($IP$) or Option $241$ ($FQDN$).

  3. Initiation: FortiGate contacts FortiManager on port $541$. (Manual GUI entry is possible, but CLI entry does not initiate the tunnel by design).

  4. Verification: FortiManager validates the $SN$ or $PSK$ against its database.

  5. Provisioning: FortiManager pushes the preconfigured device settings and policy packages.

  6. Edge Deployment: FortiGate subsequently pushes configurations to connected FortiSwitch and FortiAP devices.

• Post-Provisioning: Devices are automatically authorized. They may take several minutes to appear as "Online" because FortiManager polls status every $3$ minutes and devices reboot during authorization.