Cooperative Security Fabric - Fortinet Cookbook
`1/11/24, 12:04 PM
`The Wayback Machine - https://web.archive.org/web/20160728170025/http://cookbook.fortinet.com:...
`
`ENTERPRISE
`COOPERATIVE SECURITY FABRIC
`/
`5.4.1
`FORTISWITCH
`FORTISWITCHOS 3.3.0
`/
`/
`/
`
`FORTICLIENT 5.4
`FORTICLIENT
`/
`/
`FORTISWITCHOS 3.4.0
`SECURITY
`/
`
`Cooperative Security Fabric
`
`/
`
`FORTIGATE
`
`/
`
`FORTIOS
`
`Posted on June 8, 2016 by Victoria Martin
`
`This collection of related recipes shows how to configure a Cooperative Security Fabric (CSF) – also
`known as a Fortinet Security Fabric – throughout your network, using a range of Fortinet products. This
`security fabric will link different security sensors and tools together to collect, coordinate, and respond
`to malicious behavior anywhere it occurs on your network in real time.
`
`https://web.archive.org/web/20160728170025/http://cookbook.fortinet.com/cooperative-security-fabric-54
`
`1/6
`
`Fortinet Ex. 2012, Page 1 of 6
`
`
`
`1/11/24, 12:04 PM
`
`Cooperative Security Fabric - Fortinet Cookbook
`
`Below, you will find links to a number of Cookbook
`recipes. By using these recipes in the listed order, you can
`create a network similar to the one shown above.
`
`This collection is a work-in-progress. Check back to see what new recipes have been added.
`
`Between most steps are screenshots showing the FortiView Topology dashboards, introduced in FortiOS
`5.4.1. These dashboards display the devices that make up your cooperative security fabric. The Physical
`Topology dashboard shows all access layer devices, while the Logical Topology dashboard displays
`information about the interface (logical or physical) that each device is connected to.
`
`CSF is supported by the following Fortinet firmware:
`
`FortiOS 5.4.1+
`
`FortiSwitchOS 3.3+
`
`FortiClient 5.4.1+
`
`1. Installing a FortiGate in NAT/Route mode
`
`In this recipe, you install the initial FortiGate, which will later be used as the Internet-facing, or
`upstream, FortiGate in the security fabric.
`
`Because the CSF has not yet been enabled, the FortiView topology dashboards are not yet available.
`
`2. Installing internal FortiGates and enabling a security fabric
`
`
`
` Watch the video
`
`In this recipe, two additional FortiGates are added to the network as an Internal Segmentation Firewalls
`(ISFWs). Once the FortiGates are installed, a security fabric is set up between them and the external
`FortiGate which was installed in the network previously.
`
`In the example network, the Internet-facing FortiGate is called External, with two additional FortiGates,
`called Accounting and Marketing, configured as ISFWs. The FortiGates all appear in the FortiView
`toplogy dashboards on the External FortiGate.
`
`Physical topology:
`
`https://web.archive.org/web/20160728170025/http://cookbook.fortinet.com/cooperative-security-fabric-54
`
`2/6
`
`Fortinet Ex. 2012, Page 2 of 6
`
`
`
`1/11/24, 12:04 PM
`
`Cooperative Security Fabric - Fortinet Cookbook
`
`2a-physical
`
`Logical topology:
`
`2b-logical
`
`3. Adding FortiAnalyzer to a security fabric
`
`In this recipe, a FortiAnalyzer is installed to record and display logs from all FortiGates in the security
`fabric.
`
`The FortiAnalyzer does not appear ain the FortiView dashboards, so they remain unchanged.
`
`4. High Availability with two FortiGates
`
`In this recipe, the External FortiGate is set up as part of an High Availability (HA) cluster. This provides
`redundancy for the network in case one of the FortiGates in the cluster fails.
`
`The topology dashboards do not show both FortiGates in the HA cluster. However, the name of the
`upstream FortiGate has changed to the name of the primary unit in the cluster (External-Primary).
`
`Physical topology:
`
`3a-physical
`
`https://web.archive.org/web/20160728170025/http://cookbook.fortinet.com/cooperative-security-fabric-54
`
`3/6
`
`Fortinet Ex. 2012, Page 3 of 6
`
`
`
`1/11/24, 12:04 PM
`Logical topology:
`
`3b-logical
`
`Cooperative Security Fabric - Fortinet Cookbook
`
`5. Setting up an internal network with a managed FortiSwitch
`
`In this recipe, two FortiSwitches are installed behind the ISFWs. The FortiSwitches are managed by the
`FortiGates and will be used to connect two internal networks that will be protected by the FortiGates.
`
`The FortiSwitches now appears in the Physical Topology dashboard, provided the Access Device view is
`selected. The switches do not appear in the Logical Topology dashboard.
`
`Physical topology:
`
`4a-physical
`
`Logical topology:
`
`4b-logical
`
`6. Adding endpoint control to a security fabric
`
`https://web.archive.org/web/20160728170025/http://cookbook.fortinet.com/cooperative-security-fabric-54
`
`4/6
`
`Fortinet Ex. 2012, Page 4 of 6
`
`
`
`Cooperative Security Fabric - Fortinet Cookbook
`1/11/24, 12:04 PM
`In this recipe, a FortiClient profile is used to enforce endpoint control for devices that are connected to
`the CSF.
`
`In the screenshots below, endpoint control has been applied to a PC on the Marketing Network. Also, the
`Marketing FortiSwitch now appears in the Logical Topology dashboard because traffic is flowing
`through it.
`
`Physical topology:
`
`5a-physical-topology
`
`Logical topology:
`
`5b-logical-topology
`
`About
`
` Latest Posts
`
`Victoria Martin
`Technical Writer & Head Cookbook Chef at Fortinet
`
`https://web.archive.org/web/20160728170025/http://cookbook.fortinet.com/cooperative-security-fabric-54
`
`5/6
`
`Fortinet Ex. 2012, Page 5 of 6
`
`
`
`1/11/24, 12:04 PM
`
`Cooperative Security Fabric - Fortinet Cookbook
`
`Victoria Martin works in Ottawa as part of the FortiOS technical documentation team. She
`graduated with a Bachelor's degree from Mount Allison University, after which she attended
`Humber College's book publishing program, followed by the more practical technical writing
`program at Algonquin College. She does need glasses but also likes wearing them, since glasses
`make you look smarter.
`
`Related posts:
`
`Adding endpoint control to a security fabric
`
`ISFW and Cooperative Security Fabric (Video)
`
`Installing internal FortiGates and enabling a security fabric
`
`Share this recipe:
`
` Botnet C&C, CSF, FortiAP, FortiClient, FortiSwitch, HA, ISFW
`
`
`
`https://web.archive.org/web/20160728170025/http://cookbook.fortinet.com/cooperative-security-fabric-54
`
`6/6
`
`Fortinet Ex. 2012, Page 6 of 6
`
`
