FortiPortal Admin Guide v3.0.0

93 Pages·2016·6.4 MB·English

by  Fortinet Technical Documentation

FortiPortal Administration Guide
Version3.0.0
FORTINETDOCUMENT LIBRARY
http://docs.fortinet.com
FORTINET VIDEO GUIDE
http://video.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com 
http://cookbook.fortinet.com/how-to-work-with-fortinet-support/
FORTIGATE COOKBOOK
http://cookbook.fortinet.com
FORTINET TRAINING SERVICES
http://www.fortinet.com/training
FORTIGUARD CENTER
http://www.fortiguard.com
END USER LICENSE AGREEMENT
http://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email:[email protected]
Tuesday,August30,2016
FortiPortalAdministration GuideVersion3.0.0
TABLE OF CONTENTS
Change Log 7
FortiPortalOverview 8
KeyFeatures 8
What'sNew 8
3.0.0Release 8
SpecialCharacters 8
Components 9
End-CustomerDevices 10
FortiPortalConcepts 10
DeploymentArchitecture 12
Installation Using OpenStack 13
Prerequisites 13
DownloadingFortiPortalImageFiles 13
OpenStackHorizonDashboard 13
CreateImagesforthePortalandCollectors 13
CreateVolumesforthePortalandCollector 14
LaunchtheInstances 14
AssignaFloatingIP Address 15
AssociateVolumetotheInstances 15
ReboottheInstances 15
DeterminetheIP AddressandPortNumber 15
ConfigurePortalParameters 16
ConfigureCollectorParameters 17
UpdatingSSL CertificateFile 18
UpdateCertificateusingAdminPortal 18
InstallingMySQL forFortiPortalDatabases 19
ReconfiguringMySQL PasswordonFortiPortal 19
Installation using VMware 20
Prerequisites 20
VM Requirements 20
InstallationAlternatives 20
DownloadingOVF files 21
InstallingFortiPortalVMs 21
CreateaVMinstance 21
CreateaVMvApp 22
DefaultCredentials 23
ConfigureVM HardwareSettings 23
StarttheVMorvApp 23
ConfiguringFortiPortal 23
ConfigureMySQL forFortiPortalDatabases 23
ConfigurePortalParameters 23
ConfigureFortiPortalCollectorParameters 25
UpdatingSSL CertificateFile 26
UpdateCertificateusingAdminPortal 26
InstallingMySQL forFortiPortalDatabases 27
ReconfiguringMySQL PasswordonFortiPortal 27
FortiPortalConfiguration 28
LicenseExpiry 28
Pagebanner 28
ConfigurationMajorSteps 29
Administrative Users 30
PageActions 30
Per-UserActions 30
CreateaUser 30
TrustedHosts 31
AdminUserRoles 32
Dashboard 33
InitialData-AggregationDelay 33
Customers 34
PageActions 34
Per-CustomerInformation 34
Per-CustomerActions 35
Add orEditCustomer 36
CustomerSites 41
PageActions 41
Per-SiteActions 41
Wireless Networks 43
PageActions 43
Per-NetworkActions 43
CustomerUsers 45
PageActions 45
Per-UserActions 45
AddorEditUser 45
AddTrustedHostforaUser 46
CustomerUserRoles 47
CustomerReports 49
FortiPortalReports 49
PageActions 49
Per-ReportActions 49
FortiAnalyzerReports 50
PageActions 51
FortiManagerDevices 52
PageActions 52
Per-FortiManagerActions 52
FortiManagerHighAvailability(HA) 52
AddaFortiManager 53
EditaFortiManager 54
ManageFortiGateDevices 55
AP ControllerDevices 56
PageActions 56
Per-ControllerActions 56
EditaController 57
FortiAnalyzerDevices 58
PageActions 58
Per-FortiAnalyzerActions 58
EditaFortiAnalyzer 59
ViewFortiAnalyzerReports 60
FortiPortalCollectors 61
PageActions 61
CollectorHighAvailability(HA) 61
AddFortiPortalCollector 61
Per-CollectorActions 62
EditaCollector 62
Admin Settings 64
RemoteAuthentication 66
RadiusServerConfiguration 67
SSO Configuration 67
Radius Roles 69
PageActions 69
Per-RoleActions 69
Roles 71
PageActions 71
Per-RoleActions 71
SystemLog 73
PageActions 73
InitialLog-AggregationDelay 73
Theme 74
CustomThemeOptions 74
SelectaPredefinedColorScheme 74
CreateaCustomColorScheme 74
UsingtheColorPicker 75
UsingCustomCSS File 77
CustomURLsandText 77
CustomImages 78
ResizingImages 79
DetailsoftheThemeConfigurationFields 80
SystemInfo 83
LicenseInformation 83
UploadLicense 84
VersionInformation 84
CertifcateInformation 84
Trusted Hosts 85
PageActions 85
Per-RoleActions 85
Audit 87
PageActions 87
Per-AuditActions 87
Upgrading FortiPortalsoftware 89
AlertMessages 91
Service-ProviderLevelMessages: 91
Customer-LevelMessages: 92
ChangeLog
Change Log
Date ChangeDescription
2016-08-30 Contentupdatesforrelease3.0.0
FortiPortalAdminGuidev3.0.0 7
FortinetInc.
KeyFeatures FortiPortalOverview
FortiPortal Overview
FortiPortalenablesaManagedSecurityServiceProvider(MSSP)tooperateacloud-basedhostedsecurity
managementandlogretentionservice.TheserviceprovidestheMSSP end-customerswithcentralizedreporting,
trafficanalysis,configurationmanagement,andlogretentionwithouttheneedfortheendcustomertoinvestin
additionalhardwareandsoftware.
Key Features
FortiPortalprovidesthefollowingfeatures:
dashboardwidgetsforsystemandlogstatus
l
logviewerwithfilters
l
drill-downanalysisofuserandnetworkactivity
l
reportgenerator(withcustomizationoptions)
l
wirelessnetworkstatus
l
devicemanagement
l
policymanagement
l
RemoteauthenticationusingFortiAuthenticator
l
FortiPortalsupportsthefollowinglanguages: Romanian,French,Portuguese,SpanishandEnglish
What's New
3.0.0 Release
SSOIntegration.FortiPortalsupportsServiceProviderinitiatedorIdentityProviderinitiatedSAMLauthentication.
l
Policyinsertioninanyorder.
l
FortiAnayzer-generatedreportsavailableinthecustomerportal.
l
FortiSandboxintegration.
l
FortiPortaloptiontodisableanalytics.
l
SpecialCharacters
Inpreviousreleases,youcouldincludesomespecialcharacters(quoteandbackslash)incontrollernames.For
example,thefollowingnamewouldbevalid:
Name'1/3
However,Inrelease2.4.0andlater,youmustnotusethesecharacters.Priortoupgradingtorelease2.4.0,you
mustremovethesespecialcharactersfromexistingnames.
8 FortiPortalAdminGuidev3.0.0
FortinetInc.
FortiPortalOverview Components
Inrelease2.4.0,ifanentryhasanamecontainingaspecialcharacter,youwillnotbeabletoedittheentry(but
youcandeleteit).
Components
Theend-customer'sFortiGatedevicesaremanagedbyoneormoreFortiManagers.Optionally,logsfromthe
FortiGatedevicescanbegatheredbyoneormoreFortiAnalyzers.
IntheFortiPortal,theCollectorscollectlogsfromtheFortiAnalyzer(ortheFortiGatedevicesdirectly)andstore
thelogsinCollectordatabases.ThePortalaggregatesthelogsintoacentraldatabase,andperformssecurity
analyticsonthelogs.ThePortalprovidesanadministrativewebinterface(fortheserviceprovideradministrative
staff)andacustomerwebinterface(fortheMSSP'scustomers).
ThefollowingfigureillustratestheFortiPortalcomponentsandatypicalcustomernetwork.
TheFortiPortalsolutionincludesthefollowingcomponents:
1. Collector: virtualappliance:
ManageslogssentfromtheFortiGatedevices
l
TheFortiPortalmayincludemorethanoneCollector
l
2. CollectorDB: MySQLdatabase:
PhysicalorvirtualserverprovidedbytheServiceProvider.
l
Collectorstoresthelogsinthisdatabase.
l
TheFortiPortalmayincludemorethanoneCollectorDB
l
3. Portal: virtualappliance:
Providestheserviceproviderwebinterfaceandthecustomerwebinterface.
l
UsestheFortiManagerAPItomanageDevices,ObjectsandPolicies
l
FortiPortalAdminGuidev3.0.0 9
FortinetInc.
End-CustomerDevices FortiPortalOverview
TheFortiPortalincludesonlyonePortal(however,theportalmayconsistofmultipleVMinstancesfor
l
redundancyand/orscalability)
4. PortalDB: MySQLdatabase:
PhysicalorvirtualserverprovidedbytheServiceProvider.
l
Portalaggregatesthelogsintothisdatabase.
l
TheFortiPortalincludesonlyonePortalDatabase
l
Thecustomerwebinterfaceenableseachendcustomertoaccess/analyzetheirdataandadministertheir
service.Foradditionalinformationaboutthecustomerwebinterface,seetheFortiPortalUserHelp(whichisalso
availablebyclickingthehelpbuttoninthecustomerwebinterface).
Theadministrativewebserviceallowstheserviceprovidertoconfiguretheservicesforeachendcustomer,andto
managetheoverallcloudservice.
End-Customer Devices
TheFortiPortalrequiresthatthecustomerFortiGatedevicesmustbemanagedbyFortiManager.FortiManagers
mayresideinthecustomernetworkorintheMSSPcloud.
1. FortiGate: securitydevicesinthecustomerenvironment:
generatesthesecuritylogs
l
passeslogstothecollector
l
alsofulfillstheAP WirelessControllerrole
l
2. FortiManager: managesasetofFortiGatedevices:
AllFortiGatedevicesintheFortiPortalmustbemanagedbyFortiManager
l
FortiManagerprovidesdeviceinformationtotheFortiPortal
l
MayresideinthecustomernetworkorintheMSSPcloud
l
3. (Optional)FortiAnalyzer:receiveslogsfromthedevices:
passesthelogsontothecollector
l
MayresideinthecustomernetworkorintheMSSPcloud
l
FortiPortal Concepts
FortiPortalintroducesthefollowingconcepts:
CustomerSites
Anend-customercanhavemultiplesites.
l
Asiteisalogicalgroupingofdevices(independentofwhichFortiManagermanagesthedevice).
l
DevicesareFortiGatedevicesorAPWirelessDevices.
l
10 FortiPortalAdminGuidev3.0.0
FortinetInc.