FGT VM in transparent mode on ESXi 6.0

Purpose:

Our goal with this config is to inspect/restrict traffic sourced/destined from servers on our LAN without causing much impact to the existing network.

Caution:

Failing to specify VLAN, Forwarding-domain and strict src/dst addresses may result in a Layer2 loop/broadcast storm. Please make sure to follow the directions carefully.

Topology:

1.     Deploy OVF Template

a.     Follow the instructions in http://docs.fortinet.com/uploaded/files/1734/fortigate-vm-install-50.pdf

b.     I prefer to thin provision everything but that is your choice

c.     Do not power on the Virtual machine after deploying.

2.     Shut off your VM servers that you would like to add to the port group so that we may edit their port assignments.

3.     Create a Port Group in ESXi

Make sure that you assign a unique vlan id here.

Edit your server VM and assign the network adapter to your new port group.

Edit your FGTVM.

Disconnect all ports that will not be used.

You will need 3 ports: In/Out/mgmt.

In this case, we are using:

Port1 for out to our network.

Port2 for management.

Port8 for connection the VM port group.

Your port group should now look something like this if you had 2 servers in it. The only exception is that your ports are not green as we have not powered anything on yet.

4.     Power on your FGT VM  and console into FortiOS CLI.

5.     As a precaution, we should shut all ports.

config sys interface
edit port1
set status down
next
#repeat for all ports

6.     Set the box transparent mode.

config system settings
set opmode transparent
set manageip
            end
            #this will log you out so log back in.

7.     Set DNS and static route if needed.

config system dns
set primary x.x.x.x
set secondary x.x.x.x
            end
            config router static
                        edit 0
                                    set dst x.x.x.x x.x.x.x
                                    set gateway x.x.x.x
            end

           

8.     Set the forward-domain for your interfaces that are not used for management.

config system interface
edit port1
            set forward-domain 100
next
edit port8
            set forward-domain 100
end

9.     Set the allowaccess for your mgmt. interface.

config system interface
edit port2
            set allowaccess ping https
end

10.  Setup the in/out firewall policies for your Server communications.

It is very important that you set specify srcaddr/dstaddr to avoid layer2 issues on your network .

config firewall policy
edit 0
            set name “p1-p8”
            set srcintf port1
            set dstintf port8
            set srcaddr all
            set dstaddr "/32 srvIP"
            set service any
            set schedule always
            set action accept
next
edit 0
            set name “p8-p1”
            set srcintf port8
            set dstintf port1
            set dstaddr  all
            set srcaddr "/32 srvIP"
            set service any
            set schedule always
            set action accept
next     

11.  Enable your 3 interfaces on the FGTVM and power on your VM servers. Traffic towards your servers should now be routed through your FGTVM and the FGT should be accessible via the management IP.

12.  Go back and apply any UTM policies, restrict services, etc in your policies that you may require.