fortiweb-vm™ web application firewall - fortinet...

FortiWeb-VM WebApplication Firewall

Version 4.0 MR2Install Guide

FortiWeb-VM Web Application Firewall Install GuideVersion 4.0 MR2June 17, 2011Revision 3

Copyright 2011 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet, Inc.

TrademarksDynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGate Unified Threat Management System, FortiGuard, FortiGuard-Antispam, FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiWeb, FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Contents

F

h

ContentsOverview of FortiWeb-VM........................................................................ 5Architecture of FortiWeb-VM ......................................................................................... 5

VM resources................................................................................................................... 6

Licensing ......................................................................................................................... 6Evaluation license....................................................................................................... 6

Registering your Fortinet product................................................................................. 7

Customer service & technical support ......................................................................... 7

Training ............................................................................................................................ 7

Documentation ................................................................................................................ 7Fortinet Knowledge Base............................................................................................ 7Comments on Fortinet technical documentation ........................................................ 7

Installing FortiWeb-VM ............................................................................ 9Preparing to install FortiWeb-VM .................................................................................. 9

Getting the FortiWeb-VM software ............................................................................. 9

Deploying the FortiWeb-VM software ......................................................................... 10

Configuring virtual network settings .......................................................................... 14Preparing for transparent mode................................................................................ 14Configuring the number of CPUs.............................................................................. 16

Starting FortiWeb-VM ................................................................................................... 16

What next?..................................................................................................................... 20

Index........................................................................................................ 21

ortiWeb-VM Web Application Firewall Version 4.0 MR2 Install Guide3

ttp://docs.fortinet.com/ Feedback

http://docs.fortinet.com/http://docs.fortinet.com/surveyredirect.html

Contents

FortiWeb-VM Web Application Firewall Version 4.0 MR2 Install Guide4 Revision 3

http://docs.fortinet.com/ Feedback


Overview of FortiWeb-VM Architecture of FortiWeb-VM

F

h

Overview of FortiWeb-VMWelcome, and thank you for selecting Fortinet products to protect your network.FortiWeb-VM is a virtual appliance designed specifically to protect web servers.The FortiWeb family of web application firewalls specializes in layered application threat protection. FortiWebs integrated web application firewall, DoS prevention, XML firewall and vulnerability scanner protect your web-based applications and internet-facing data from attack and data loss. Using advanced techniques to provide bidirectional protection against sophisticated threats like SQL injection and cross-site scripting, FortiWeb helps you prevent identity theft, financial fraud and corporate espionage. FortiWeb delivers the technology you need to monitor and enforce government regulations, industry best practices, and internal policies.FortiWeb significantly reduces deployment costs by consolidating a web application firewall, application delivery, XML filtering, web traffic acceleration, and application traffic balancing into a single device. It drastically reduces the time required to protect your internet-facing data and eases the challenges associated with policy enforcement and regulatory compliance.Its intelligent, application-aware, load-balancing engine: increases application performance improves resource utilization improves application stability reduces server response times

Architecture of FortiWeb-VMFortiWeb-VM supports VMware vSphere Hypervisor ESX/ESXi 4.0 and 4.1.This guide assumes that the reader has a thorough understanding of VMware concepts, procedures, and terminology. VMware vSphere Hypervisor (ESX/ESXi) software must be installed on a server prior to installing FortiWeb-VM. Go to http://www.vmware.com/products/vsphere-hypervisor/index.html for vSphere installation details.FortiWeb-VM, in conjunction with VMware vSphere Hypervisor, leverages the power of virtualization to provide protection to web sites and web servers. FortiWeb-VM runs on the VMware ESX/ESXi server and is managed using the FortiWeb-VM web-based manager accessed from the management computer. See Figure 1.



http://www.vmware.com/products/vsphere-hypervisor/index.htmlhttp://docs.fortinet.com/http://docs.fortinet.com/surveyredirect.htmlhttp://www.vmware.com/products/vsphere-hypervisor/index.html

VM resources Overview of FortiWeb-VM

Figure 1: FortiWeb-VM architecture

VM resourcesFortinet provides three types of licenses for FortiWeb-VM: VM02, VM04 and VM08. Table 1 describes their applicable virtual resources.

LicensingWhen you place an order for FortiWeb-VM, Fortinet sends a registration number to the email address supplied on the order form. Use that number to register with FortiCare (support.fortinet.com) and to obtain a license file. You need the license file to activate FortiWeb-VM. See Getting the FortiWeb-VM software on page 9 for details about getting a license file.For license access, FortiWeb-VM requires a valid FortiGuard connection using: for DNS lookup; RBL lookup UDP 53 for FortiGuard Licensing TCP 443

Evaluation licenseFortiWeb-VM includes a 15-day trial license that includes all features except FortiGuard updates. You do not need to manually upload the trial license, it is built-in. The trial period begins the first time you start FortiWeb-VM.

Table 1: FortiWeb-VM resource usage

Resource VM02 VM04 VM08Virtual CPUs 2 vCPUs 4 vCPUs 8 vCPUs

Virtual Memory 1 GB to 4 GB of vRAM 1 GB to 4 GB of vRAM 1 GB to 4 GB of vRAM

Virtual NICs 2 vNICs to 4 vNICs 2 vNICs to 4 vNICs 2 vNICs to 4 vNICs

Virtual Storage 40 GB minimum 40 GB minimum 40 GB minimum



http://www. support.fortinet.comhttp://docs.fortinet.com/http://docs.fortinet.com/surveyredirect.html

Overview of FortiWeb-VM Registering your Fortinet product

F

h

Registering your Fortinet productBefore you begin to configure and customize features, take a moment to register your Fortinet product at the Fortinet Technical Support web site, https://support.fortinet.com. Many Fortinet customer services, such as firmware updates and technical support, require product registration.

Customer service & technical supportFortinet Technical Support provides services designed to make sure that you can install your Fortinet products quickly, configure them easily, and operate them reliably in your network.To learn about the technical support services that Fortinet provides, visit the Fortinet Technical Support web site at https://support.fortinet.com.You can dramatically improve the time that it takes to resolve your technical support ticket by providing your configuration file, a network diagram, and other specific information. For a list of required information, see the Fortinet Knowledge Base article Fortinet Technical Support Requirements at http://kb.fortinet.com.

TrainingFortinet Training Services provide classes that orient you quickly to your new equipment, and provide certifications to verify your knowledge level. Fortinet provides a variety of training programs to serve the needs of our customers and partners world-wide.To learn about training, visit the Fortinet Training Services web site at http://campus.training.fortinet.com, or email them at [email protected].

DocumentationThe Fortinet Technical Documentation web site, http://docs.fortinet.com, provides the most up-to-date versions of Fortinet publications.

Fortinet Knowledge BaseThe Fortinet Knowledge Base provides additional Fortinet technical documentation, such as troubleshooting and how-to-articles, examples, FAQs, technical notes, and more. Visit the Fortinet Knowledge Base at http://kb.fortinet.com.

Comments on Fortinet technical documentationPlease send information about any errors or omissions in this technical document to [email protected].



https://support.fortinet.comhttps://support.fortinet.comhttps://support.fortinet.comhttp://campus.training.fortinet.comhttp://docs.fortinet.comhttp://docs.fortinet.com/http://kb.fortinet.commailto:[email protected]://docs.fortinet.com/surveyredirect.htmlhttp://kb.fortinet.commailto:[email protected]

Documentation Overview of FortiWeb-VM




Installing FortiWeb-VM Preparing to install FortiWeb-VM

F

h

Installing FortiWeb-VMThis chapter provides instructions for installing FortiWeb-VM: Preparing to install FortiWeb-VM Deploying the FortiWeb-VM software Configuring virtual network settings Starting FortiWeb-VM

Preparing to install FortiWeb-VMBefore installing FortiWeb-VM, make sure the following are in place and functioning properly: The VMware vSphere Hypervisor software (ESX/ESXi) must be installed on a network

server prior to installing FortiWeb-VM. This documentation does not cover how to install and set up the VMware server. Go to http://www.vmware.com/products/vsphere-hypervisor/index.html for installation details.

The VMware vSphere Client must be installed on the computer you plan to use for FortiWeb-VM management. This could be a desktop or a laptop connected to your network.

Getting the FortiWeb-VM softwareOnce registered with Fortinet, do the following:1 From the link provided by Fortinet, download the license file (.lic) to the computer you

plan to use for FortiWeb-VM management. You need this file to complete the installation. (See Licensing on page 6.)

2 From the link provided by Fortinet, download the compressed FortiWeb-VM file to the computer you plan to use for FortiWeb-VM management.

3 Extract the compressed file to a folder. It contains files similar to those in Table 2.

There must be an OVF file to deploy FortiWeb-VM.

Tip: Take note of the IP address of the server hosting VMware vSphere Hypervisor. You also need an account and password for that server. You will need these to log in using the VMware vSphere Client. You also need an IP address from that server's IP pool for use later when configuring FortiWeb-VM.

Table 2: Extracted files

Filename Descriptionfortiweb-vm-disk1.vmdk Virtual disk.

fortiweb-vm-disk2.vmdk Virtual disk.

fortiweb-vm-64-hw7.ovf This is the OVF deployment template file for ESX/ESXi 4.0 and later versions.



http://www.vmware.com/products/vsphere-hypervisor/index.htmlhttp://www.vmware.com/products/vsphere-hypervisor/index.htmlhttp://docs.fortinet.com/http://docs.fortinet.com/surveyredirect.html

Deploying the FortiWeb-VM software Installing FortiWeb-VM

Deploying the FortiWeb-VM softwareTo install FortiWeb-VM, you must successfully deploy the OVF file using the VMware vSphere Client.

To deploy the software1 Start the VMware vSphere Client.

The login dialog appears.

Figure 2: VMware vSphere Client login dialog

2 Enter: the IP address of the ESX/ESXi server hosting VMware vSphere Hypervisor an account user name on the ESX/ESXi server the account passwordWhen you successfully log in, the vSphere Client window appears.




Installing FortiWeb-VM Deploying the FortiWeb-VM software

F

h

Figure 3: vSphere Client window

3 On the vSphere Client window, select File > Deploy OVF Template. The first dialog of the OVF deployment wizard appears.

Figure 4: OVF deployment wizard

4 Select Browse and locate the applicable OVF template file you extracted earlier, such as fortiweb-vm-64-hw7.ovf, and click Next.

5 The second dialog displays the details of the deployed file. Click Next.A window appears and prompts for the name of your OVF template. The name you choose becomes the name of your virtual machine.




Deploying the FortiWeb-VM software Installing FortiWeb-VM

Figure 5: OVF template name

6 Enter a unique name for your virtual machine and click Next. A window appears asking where to deploy the OVF template.

Figure 6: Resource pool selection

7 Select a resource pool and click Next.A windows appears asking for the disk storage format.




Installing FortiWeb-VM Deploying the FortiWeb-VM software

F

h

Figure 7: Disk storage options

8 Select a format option and click Next.A window appears asking which network to deploy on.

Figure 8: Deployment network

9 Select a virtual network if there is more than one and click Next.A window appears listing all your settings.

10 Click Finish.The vSphere Client window reappears and displays your new virtual machine.




Configuring virtual network settings Installing FortiWeb-VM

Figure 9: Completed deployment

Configuring virtual network settingsBefore you power on FortiWeb-VM, you may need to set the number of virtual CPUs and configure the virtual network to support transparent mode in FortiWeb-VM.This section includes: Preparing for transparent mode Configuring the number of CPUsWhen you deploy the FortiWeb-VM OVF file, one virtual network interface card (vNIC) is automatically mapped to a port on the ESX/ESXi server. You can change the mapping, or map other vNICs if required. Each vNIC has its own MAC address and one or more IP addresses. When you deploy the FortiWeb-VM OVF file, the virtual environment has one vNetwork Standard Switch (vSwitch). You can add additional vSwitches. A vSwitch routes traffic internally between virtual machines and links to external networks through network adapters.For more information, see the VMware vSphere documentation at http://www.vmware.com/support/pubs/vs_pages/vsp_pubs_esxi41_e_vc41.html

Preparing for transparent modeIf you plan to set the operation mode of FortiWeb-VM to either true transparent proxy or transparent inspection and create a v-zone bridge, you need to create an additional vSwitch for the bridge. You also need to set promiscuous mode and modify the network adapter configuration.For information on available operation modes, see the Planning the network topology chapter of the FortiWeb Installation and Setup Guide.

To create a virtual switch1 Log in to the vSphere Client.2 Do not power on FortiWeb-VM.3 Select the host IP at the top of the left navigation pane.4 On the Configuration tab, select Networking.

A window with information similar to Figure 10 appears.

Note: Do not power on FortiWeb-VM yet if you need to configure the virtual network first.



http://docs.fortinet.com/http://docs.fortinet.com/surveyredirect.htmlhttp://www.vmware.com/support/pubs/vs_pages/vsp_pubs_esxi41_e_vc41.htmlhttp://docs.fortinet.com/fweb.html

Installing FortiWeb-VM Configuring virtual network settings

F

h

Figure 10: Virtual switches

5 Select the Virtual Switch view and click Add Networking.6 Accept the default connection type, Virtual Machines, and click Next.7 Select Create a virtual switch and click Next.8 Under Port Group Properties, enter a network label that identifies the port group to

create.9 In VLAN ID, enter a number between 1 and 4094 and click Next.10 Click Finish.Next, set the network to run in promiscuous mode.

To set promiscuous mode1 On the Configuration tab, select Networking.2 For each virtual switch, do the following:

Select Properties. Click Edit and select the Security tab. Select Accept from the drop-down list for Promiscuous Mode.

Next, you need to link a FortiWeb-VM network adapter to each new vSwitch.

To modify a network adapter1 Select your FortiWeb-VM machine in the left navigation pane.2 On the Getting Started tab, select Edit Virtual Machine Settings.

A window similar to Figure 11 appears.

Note: The setting on the port group overrides the virtual switch setting.




Starting FortiWeb-VM Installing FortiWeb-VM

Figure 11: Network adapter

3 On the Hardware tab, select a network adapter from the hardware list.4 Select the new vSwitch from the Network label drop-down list.5 Click OK.

Configuring the number of CPUsYou may have 2, 4, or 8 CPUs depending on the type of license you purchased. You can change the number of CPUs that the virtual machine uses by changing the number of virtual processors.

To change the number of CPUs1 Go to the Hardware tab as shown in Figure 11.2 Select CPUs in the hardware list.3 In the CPUs drop-down list, select the number of virtual processors for the virtual

machine. 4 Click OK.For more information, see the VMware vSphere documentation at http://www.vmware.com/support/pubs/vs_pages/vsp_pubs_esxi41_e_vc41.html

Starting FortiWeb-VMOnce you successful deploy the OVF file and set up the network (if required), you need to power on your FortiWeb-VM virtual appliance and enter initial setup commands.

To start FortiWeb-VM the first time1 Log in to the vSphere Client.2 Select your newly deployed FortiWeb-VM virtual machine in the left navigation pane of

vSphere Client and power it on. There are several ways to power on a virtual machine. The easiest is to click the green triangle icon on the icon bar.

Note: You cannot change the CPU setting while FortiWeb-VM is running.



http://docs.fortinet.com/http://docs.fortinet.com/surveyredirect.htmlhttp://www.vmware.com/support/pubs/vs_pages/vsp_pubs_esxi41_e_vc41.html

Installing FortiWeb-VM Starting FortiWeb-VM

F

h

3 Select the Console tab in the vSphere Client window. When you power on the virtual appliance, the console displays several messages ending in a login prompt.

Figure 12: Console startup messages

4 Press the Enter key once to get a new prompt, and log in using the default FortiWeb-VM administrator name, admin.

Figure 13: Admin login

There is no password yet for this administrator, so press Enter when prompted.You will see a welcome message.

5 Use the CLI to configure the IP address of a virtual interface (usually port1) on the virtual appliance to use for administrative access. You will later access the FortiWeb-VM web-based manager through a browser at this IP.

Note: At this point, you have accessed the FortiWeb-VM command line interface (CLI) but you do not have access to all CLI commands until you confirm the license in a later step.




Starting FortiWeb-VM Installing FortiWeb-VM

Figure 14: IP address configuration

Enter the following CLI commands in the vSphere Client console:config system interfaceedit set ip

endWhere: port_name is the name of the FortiWeb-VM virtual port (usually port1) ipv4-mask is the IP (with a netmask) of your virtual machine on the the ESX/ESXi

server

6 Use the CLI to configure a static route to act as a default gateway. This is needed for license authentication.Enter the following CLI commands in the vSphere Client console:config router staticedit set gateway set device

endWhere: is the index number, such as 1, of the route in the list of static routes is the IP address of the gateway router is the name of the FortiWeb-VM network interface through which

data will egress, such as port1 (use the same port as set for the system interface)7 When you successfully configure administrative access, the web-based manager login

dialog appears automatically if you have a browser open. If not, open a browser and enter the IP address of the virtual interface your set in Step 5.

Tip: Take note of the IP you enter. Later, you will use that IP, minus the netmask, to configure and manage FortiWeb-VM through the CLI or a browser.




Installing FortiWeb-VM Starting FortiWeb-VM

F

h

Figure 15: FortiWeb-VM login

8 For Name, enter admin, skip the Password field, and click Login.The license prompt appears.

Figure 16: FortiWeb-VM license prompt

9 Click Browse and locate the license file (.lic) you downloaded earlier from Fortinet.10 Click OK on the license prompt dialog.

A message box appears stating your license is being authenticated.11 Click Refresh on the message box.

If you uploaded a valid license, a second message box will appear informing you that your license authenticated successfully. This may take a few minutes.

12 Click OK on the message box.The web-based manager login dialog reappears.

13 Enter admin, skip the password field, and click Login.The web-based manager interface appears.




What next? Installing FortiWeb-VM

Figure 17: FortiWeb-VM administration GUI

Congratulations! You have successfully installed FortiWeb-VM and can now configure your virtual appliance.To access the web-based manager login dialog later, open a browser and enter the IP of your virtual machine on the ESX/ESXi server.

What next?At this point, FortiWeb-VM is running but is almost entirely unconfigured. Before you can use it to protect web sites and web servers, you must configure its system settings and server policies. Do the following: First, follow the instructions in the Installation and setup workflow chapter of the

FortiWeb Installation and Setup Guide to create a basic configuration. Next, use information in the Deployment guidelines chapter of the FortiWeb

Administration Guide to test, enhance and deploy FortiWeb-VM.



http://docs.fortinet.com/http://docs.fortinet.com/surveyredirect.htmlhttp://docs.fortinet.com/fweb.htmlhttp://docs.fortinet.com/fweb.htmlhttp://docs.fortinet.com/fweb.html

Index

IndexAadministrator, 17architecture, 5, 6

CCLI, 17CLI commands, 17, 18compressed file, 9console, 17CPUs, 16

Ddeploy, 10deployment wizard, 11disk storage, 12

EESX/ESXi, 5extract file, 9

FFortiASIC, 2FortiBIOS, 2

Ggateway, 18

Iinterface

virtual, 17, 18IP address, 9, 10, 17, 18

Llicense, 6

CPUs, 16download, 9file, 19prompt, 19static route, 18

loginFortiWeb-VM GUI, 19in console, 17vSphere Client, 10

Mmessage box, 19

Nnetwork, 13network adapter, 15network interface, 18

OOVF file, 10

Ppassword, 17power on, 16promiscuous mode, 15

Rresource pool, 12router, 18

Sstatic route, 18support, 7

Ttechnical support, 7template, 11training, 7

VVMware vSphere Hypervisor, 5vNIC, 14vSphere Client, 9vSwitch, 14v-zone bridge, 14

Wwizard, 11

FortiWeb-VM Web Application Firewall Version 4.0 MR2 Install GuideRevision 3 21http://docs.fortinet.com/ Feedback


Index




ContentsOverview of FortiWeb-VMArchitecture of FortiWeb-VMVM resourcesLicensingEvaluation license

Registering your Fortinet productCustomer service & technical supportTrainingDocumentationFortinet Knowledge BaseComments on Fortinet technical documentation

Installing FortiWeb-VMPreparing to install FortiWeb-VMGetting the FortiWeb-VM software

Deploying the FortiWeb-VM softwareConfiguring virtual network settingsPreparing for transparent modeConfiguring the number of CPUs

Starting FortiWeb-VMWhat next?

Index

fortiweb-vm™ web application firewall - fortinet...

Documents