FortiBalancer 8.4 Web UI Handbook

Transcription

1 FortiBalancer 8.4 Web UI Handbook

2 FortiBalancer 8.4 Web UI Handbook 18 March st Edition Copyright 2013 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, and FortiGuard are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance metrics contained herein were attained in internal lab tests under ideal conditions, and performance may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to the performance metrics herein. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. Fortinet disclaims in full any guarantees. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable. Technical Documentation Knowledge Base Forums Customer Service & Support Training Services FortiGuard Threat Research & Response Document Feedback techdocs@fortinet.com Fortinet Technologies Inc. I FortiBalancer 8.4 Web UI Handbook

3 Table of Contents Table of Contents... II Chapter 1 Initial System Setup & Configuration Overview Enabling the web UI through CLI Accessing the web UI Registering the Fortinet Product Logging In to the web UI Initial System Setup Setting the Host Name Setting the Date and Time Setting the NTP Basic Network Configurations Configuring the Network Interface Configuring Routes... 5 Chapter 2 Advanced Network Configuration Configuring NAT Configuring IP Region Importing an IP Region Table File Configuring the IP Pool Configuring Port Forwarding Configuring TCP Port Forwarding... 2 Chapter 3 Link Aggregation Adding a Bond Interface Adding an Interface to the Bond Interface... 4 Chapter 4 Clustering Clustering SLB VIPs in Active-Standby Mode Configuring SLB Configuring the Virtual Cluster ID... 5 Fortinet Technologies Inc. II FortiBalancer 8.4 Web UI Handbook

4 4.1.3 Configuring Virtual Cluster Preemption Defining the VIP of the Cluster Defining the priority Enabling the Cluster... 7 Chapter 5 High Availability (HA) Configuring Unit Configuring SLB Configuring IP Pools for SLB Services Configuring HA Units and Links Configuring the Floating IP Group Configuring the Unit Priority in the Floating IP Group Configuring Preempt Mode Enabling the Group (Optional) Configuring Health Check Conditions (Optional) Configuring the Failover Decision Rule (Optional) Enabling SSF (Optional) Configuring the Synchronization Mode (Optional) Enabling the HA Log Enabling HA and Writing the Configurations into Memory Configuring Unit Enabling FFO Link Configuring the Synchronization Mode (Optional) Enabling SSF Enabling HA Chapter 6 Server Load Balancing (SLB) Adding a Real Service Adding a Group and Defining Its Method Adding a Real Service to the Group Adding a Virtual Service Fortinet Technologies Inc. III FortiBalancer 8.4 Web UI Handbook

5 6.5 Associating the Virtual Service With a Group and Defining a Policy Chapter 7 Reverse Proxy Cache Basic Cache Settings Enabling the Cache Function on a Virtual Service Configuring Cache Filter Enabling Cache Filter Chapter 8 HTTP Content Rewrite Configuring SLB Enabling HTTP Content Rewrite Globally Enabling HTTP Content Rewrite on a Virtual Service Configuring the HTTP Content Rewrite Rule Configuring the File Type to Be Rewritten Configuring the Status Code Chapter 9 DNS Cache Configuring SLB Enabling DNS Cache (Optional) Adding a Static DNS Cache Entry Chapter 10 HTTP Compression Enabling HTTP Compression Globally Enabling HTTP Compression on a Virtual Service Configuring Advanced HTTP Compression Configuring URL-Exclude HTTP Compression Rule Chapter 11 Secure Sockets Layer (SSL) Creating an SSL Virtual Host Applying for a Certificate for the SSL Virtual Host Importing a Key and Certificate for the SSL Virtual Host Importing a Key for the SSL Virtual Host Importing a Certificate for the SSL Virtual Host Enabling the SSL Virtual host Fortinet Technologies Inc. IV FortiBalancer 8.4 Web UI Handbook

6 11.5 Creating an SSL Real Host Enabling the SSL Real Host Chapter 12 Quality of Service (QoS) Specifying the QoS Interface Creating a QoS Queue Defining a QoS Rule Enabling QoS Chapter 13 Link Load Balancing (LLB) Configuring Interface IP Address Configuring MNET Configuring LLB Links Adding LLB Links Bound to ISP1 and ISP Configuring Additional LLB Health Check Enabling LLB Health Check Configuring the Load Balancing Method Configuring Bandwidth Priority Configuring Eroutes Configuring NAT Enabling IPflow and RTS Chapter 14 Global Server Load Balancing (GSLB) General Configurations on FortiBalancer1 and FortiBalancer Adding CDN Sites Adding DPS Detectors Other General Settings Configurations on the SDNS DPS Master (FortiBalancer1) Configuring FortiBalancer1 as the SDNS DPS Master Adding DPS Members Configuring the DPS Dynamic Proximity Method Configurations on the SDNS DPS Slave (FortiBalancer2) Fortinet Technologies Inc. V FortiBalancer 8.4 Web UI Handbook

7 Configuring the DPS Dynamic Proximity Method Enabling DPS Detectors Chapter 15 Access Control Adding an Access Control List (ACL) Rule Configuring an Access Group Enabling WebWall Chapter 16 Advanced IPv6 Configuration Configuring the IP Pool Configuring SLB Configuring DNS Configuring NAT Chapter 17 epolicy Importing Setting Scripts Importing Runtime Scripts Associating the Virtual Service with the Setting Script Associating the Virtual Service with the Runtime Script Chapter 18 Logging General Configurations Configuring Syslog Servers Adding a Syslog Server Configuring Log Filter Chapter 19 Administrative Tools Viewing the Flight Deck Configuring External Authentication Importing the System License Updating the System Configuring parameters for the ping command Shutting Down or Rebooting the System Appendix I Abbreviations Fortinet Technologies Inc. VI FortiBalancer 8.4 Web UI Handbook

8 Chapter 1 Initial System Setup & Configuration 1.1 Overview The web user interface (web UI) is designed to maximize the functionality and performance of the appliance by allowing administrators to configure and control key functions of the appliance. This chapter describes basic operations, including how to enable and access the web UI, register the product, log in to the web UI, and perform initial configurations for the FortiBalancer appliance. 1.2 Enabling the web UI through CLI To connect to the FortiBalancer appliance through CLI, make sure that the terminal software is configured as follows: Setting Value Emulation VT 100 Baud 9600 Number of Bits 8 Parity No Stop Bits 1 Flow Control No In the CLI interface, you will be first prompted for the user name and password (default to admin and admin). After you log in successfully, the FortiBalancer> prompt will be displayed. Enter the enable command to go to the Enable mode, and the FortiBalancer# prompt will be displayed. Continue to enter the configure terminal command to go to the Config mode, and the FortiBalancer(config)# prompt will be displayed. Then, execute the following commands to complete necessary network settings and enable the web UI function: Command ip address {system_ifname mnet_ifname vlan_ifname bond_ifname} <ip_address> <netmask> webui ip <ip_address> ip route default <gateway_ip> webui {on off} Description Sets the IP address and netmask of the system interface, MNET interface, VLAN interface or bond interface. Sets the web UI IP address. Sets the default gateway IP address. Enables or disables the web UI function. Example: FortiBalancer>enable FortiBalancer#config terminal FortiBalancer(config)#ip address outside Fortinet Technologies Inc. 1 FortiBalancer 8.4 Web UI Handbook

9 FortiBalancer(config)#webui ip FortiBalancer(config)#ip route default FortiBalancer(config)#webui on 1.3 Accessing the web UI Before accessing the web UI, make sure that you have enabled the web UI through CLI as described in Section 1.2 Enabling the web UI through CLI. To access the web UI, enter the address in the format of UI IP address:port number in the address bar of the browser, for example, Then, press Enter. In the pop-up dialog box, enter the user name and password, which are admin and admin by default. Click the OK button. Next, Fortinet will invite you to register your product. The FortiBalancer appliance web UI supports the following browsers: IE (Recommended) Firefox Chrome 1.4 Registering the Fortinet Product At the first time you login to the FortiBalancer product, you will be prompted to register your product. It is recommended that you register your product immediately. To do so, click the Register Now button in the pop-up message box. A short questionnaire will be displayed. Fill in the questionnaire and click the Register button to complete registration. If you click the Register Later or Never Register button, you will skip the registration step and go to the login step, which is described in the following section. You can register your product in the future by selecting Home > Basic Information and clicking the Register Now action link in the System Information area. 1.5 Logging In to the web UI After the registration step, the FortiBalancer appliance will prompt you for an Enable level password. Enter the password properly (null by default), and click the Login button. Then, the home page of the web UI will become available, as shown in the figure below. Fortinet Technologies Inc. 2 FortiBalancer 8.4 Web UI Handbook

10 Figure 1-1 Home Page of the web UI The web UI consists of three parts: top bar, side bar, and configuration window. The top bar displays information such as user name and FortiBalancer appliance host name, and several commonly used action links. The side bar is on the left of the web UI and displays the user access mode and features organized into groups. The configuration window displays the detailed configuration options, results, and statistics of a specific feature. 1.6 Initial System Setup This section describes how to initialize the FortiBalancer appliance, including setting the host name, date and time, and NTP Setting the Host Name In Config mode, select System Configuration > General Settings > Host Settings. Enter the host name in the Host Name text box. Click the Save Changes button. The new host name takes effect immediately. Note: To save the configurations you have made into system memory, click the Save Config action link in the top bar, which is available only when you are in Config mode. Fortinet Technologies Inc. 3 FortiBalancer 8.4 Web UI Handbook

11 1.6.2 Setting the Date and Time In Config mode, select System Configuration > General Settings > Date/Time. Specify the date, time, and time zone. Click the Save Changes button. The new setting takes effect immediately. By default, Greenwich Mean Time (GMT) is adopted. To use another time zone, clear the GMT check box and set the time zone from the Continent, Country, and Timezone drop-down lists Setting the NTP By default, the Network Time Protocol (NTP) is disabled. After the NTP is enabled, the FortiBalancer appliance automatically synchronizes time with the specified NTP server every 15 minutes. To add an NTP server, select System Configuration > General Settings > NTP in Config mode and click the Add action link, as shown in the figure below. Figure 1-2 NTP Settings On the page that is displayed, enter the IP address of the NTP server and select the NTP server version from the drop-down list. Click the Save action link. The added NTP server will be displayed in the NTP Servers table. Select the Enable NTP check box. Click the Save Changes button. A system warning will be displayed. Read the warning carefully and perform operations accordingly. 1.7 Basic Network Configurations This section describes how to complete basic network configurations so that the FortiBalancer appliance can properly connect to the network. Fortinet Technologies Inc. 4 FortiBalancer 8.4 Web UI Handbook

12 1.7.1 Configuring the Network Interface In Config mode, select System Configuration > Basic Networking > Interface > Port. In the Interface Settings area, select the interface to be configured from the Port ID drop-down list. Specify other required parameters properly. Click the Save Changes button Configuring Routes In Config mode, select System Configuration > Basic Networking > Routing. Here, you can select the sub-tabs for different routing configurations. Basic network configurations also include other items such as ARP, DNS, and name resolution host. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 5 FortiBalancer 8.4 Web UI Handbook

13 Chapter 2 Advanced Network Configuration Advanced network configuration includes NAT, IP region, IP pool, and port forwarding. The following sections describe the detailed configuration procedures. 2.1 Configuring NAT The FortiBalancer appliance supports static NAT, port-level NAT, IP pool-based dynamic NAT, and destination IP based NAT. Because the configurations of these types of NAT are similar, the following takes port-level NAT as an example to describe the procedure: In Config mode, select System Configuration > NAT. Click the Add NAT Port action link in the NAT Port Configuration area. The page for configuring port-level NAT becomes available, as shown in the figure below. Specify the parameters properly. Figure 2-1 Port-Level NAT Configuration Note: To configure port-level NAT, do not select the Destination Based NAT check box. In port-level NAT, parameter Network IP is the source IP address, that is, the IP address of the real server. In addition, the value of parameter Netmask/Prefix Length should be that of the source IP address. The default gateway value is , which is valid only when the virtual IP address and the route gateway are in the same network segment. If not, the gateway value must be configured as the route gateway. Click the Save action link. The added NAT entry will be displayed in the NAT Port Configuration table. Fortinet Technologies Inc. 1 FortiBalancer 8.4 Web UI Handbook

14 2.2 Configuring IP Region This section takes how to import an IP region table file into the FortiBalancer appliance as an example to describe the configuration procedure of IP region Importing an IP Region Table File You can import an IP region table file into the FortiBalancer appliance from local, by FTP, or by HTTP. In Config mode, select System Configuration > Advanced Networking > IP Region. In the IP Region Table area, select the import mode and specify the required parameters. Click the Import action link. The imported IP region table will be displayed in the adjacent table, as shown in the figure below. 2.3 Configuring the IP Pool Figure 2-2 IP Region Table Import This section describes how to add an IP pool on the FortiBalancer appliance. In Config mode, select System Configuration > Advanced Networking > IP Pool. In the Add IP Pool area, specify the Pool Name, Start IP, and End IP parameters and click the Add action link. The added IP pool will be displayed in the IP Pools List table. 2.4 Configuring Port Forwarding The FortiBalancer appliance supports both TCP and UDP port forwarding. This section takes how to configure TCP port forwarding as an example to describe the configuration procedure Configuring TCP Port Forwarding In Config mode, select System Configuration > NAT > Port Forwarding > TCP/UDP. Click the Add TCP Entry action link in the TCP Port Forwarding area. The page for adding a TCP port forwarding entry becomes available, as shown in the figure below. Fortinet Technologies Inc. 2 FortiBalancer 8.4 Web UI Handbook

15 Figure 2-3 Adding a TCP Port Forwarding Entry Specify the parameters as required and click the Save action link. The added entry will be displayed in the table of the TCP Port Forwarding area. Then, select System Configuration > NAT > Port Forwarding > Mode to configure the port forwarding mode. The default mode is transparent, in which the FortiBalancer appliance uses the IP address of the client as the source IP address for port forwarding. The FortiBalancer appliance also supports the non-transparent mode, in which the FortiBalancer appliance uses its own management IP address as the source IP address for port forwarding. Advanced network configuration items may be required by a specific feature such as Server Load Balancing (SLB). Therefore, you need to configure the items according to the actual networking environment. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 3 FortiBalancer 8.4 Web UI Handbook

16 Chapter 3 Link Aggregation The combination of physical links into a single logical link is referred to as link aggregation. This chapter describes how to configure link aggregation by adding a bond interface on the FortiBalancer appliance. 3.1 Adding a Bond Interface In Config mode, select System Configuration > Basic Networking > Interface > Link Aggregation. The page for configuring bond interfaces will be displayed, as shown in the figure below. Figure 3-1 Adding a Bond Interface In the Interface Settings area, select a bond ID from the Bond ID drop-down list, specify the Name and MTU parameters, and configure either the Static IP Address (v4) + Static Netmask or Static IP Address (v6) + Prefix Length parameters. Click the Save Changes button to save the configurations. 3.2 Adding an Interface to the Bond Interface After a bond interface is created successfully, you can continue to add system interfaces to the bond interface. Still on the page as shown in Figure 3-1 Adding a Bond Interface, select a bond interface from the Bond ID drop-down list and click the Add Bond action link. The page for adding an interface to the bond interface will be displayed, as shown in the figure below. Figure 3-2 Adding an Interface to a Bond Interface Select an interface from the Interface Name drop-down link and specify the interface type. Click the Save action link. The added interface will be displayed in the table of the Interface Settings area. Continue this step to add more interfaces to the bond interface as required. Fortinet Technologies Inc. 4 FortiBalancer 8.4 Web UI Handbook

17 Chapter 4 Clustering Two kinds of clusters are available on the FortiBalancer appliance: the cluster of inside interfaces and the cluster of virtual IP addresses (VIPs) of Server Load Balancing (SLB). Each kind can work in either Active-Standby or Active-Active mode. Regardless of the working mode, the configuration procedures of clusters are similar. Therefore, the following takes how to cluster SLB VIPs in Active-Standby mode as an example to describe the configuration procedure. 4.1 Clustering SLB VIPs in Active-Standby Mode The configuration example in this section is based on the following network environment: Two FortiBalancers (FortiBalancer1 and FortiBalancer2) work in Active-Standby mode to form a cluster. FortiBalancer1 has a higher priority than FortiBalancer2 and therefore is the master that uses the VIP to process traffic. FortiBalancer2 is the backup that listens to advertisements from the master and will become the master if FortiBalancer1 stops sending advertisements. To cluster SLB VIPs in Active-Standby mode, do as follows: Note: The configuration must be performed in the order of the following sections. All following sections should be executed on both FortiBalancer1 and FortiBalancer2. Unless otherwise specified, parameters should be set to identical values on FortiBalancer1 and FortiBalancer Configuring SLB The prerequisite for clustering SLB VIPs is that you have already completed SLB configurations. For SLB configuration procedures, refer to Chapter 6 Server Load Balancing (SLB) Configuring the Virtual Cluster ID In Config mode, select System Configuration > High Availability > Clustering > Virtual Clusters. In the Virtual Cluster List area, click the Add Virtual Cluster action link. The page for configuring the virtual cluster ID will be displayed, as shown in the figure below. Fortinet Technologies Inc. 5 FortiBalancer 8.4 Web UI Handbook

18 Figure 4-1 Virtual Cluster ID Configuration Specify the Virtual Cluster ID (VCID) and Interface Name parameters. Click the Save action link. The added cluster will be displayed in the Virtual Cluster List table Configuring Virtual Cluster Preemption In Config mode, double click the cluster entry in the Virtual Cluster List table. The page for general cluster configuration will be displayed, as shown in the figure below. Figure 4-2 Virtual Cluster General Settings Specify the parameters properly in the Virtual Cluster General Settings area. On FortiBalancer1, select the Enable Preemption check box so that FortiBalancer1, the initial master, will preempt the VIP when it returns to working state. On FortiBalancer2, clear the Enable Preemption check box. For other parameters, the configurations must be consistent on FortiBalancer1 and FortiBalancer2. After the configuration is complete, click the Save Changes button Defining the VIP of the Cluster In Config mode, select the Virtual IP (VIP) sub-tab on the page as shown in Figure 4-2 Virtual Cluster General Settings. The page for configuring the cluster VIP will be displayed. In the Virtual Cluster VIP Configuration area, click the Add VIP Entry action link. The page for adding a VIP will be displayed. Specify the Virtual IP (VIP) parameter and click the Save action link. The added VIP will be displayed in the table of the Virtual Cluster VIP Configuration area. Fortinet Technologies Inc. 6 FortiBalancer 8.4 Web UI Handbook

19 4.1.5 Defining the priority In Config mode, select the Priority sub-tab on the page as shown in Figure 4-2 Virtual Cluster General Settings. Set the priority of FortiBalancer1 to a value higher than that of FortiBalancer2, which makes FortiBalancer1 the master of the cluster Enabling the Cluster By default, the FortiBalancer appliance automatically enables a newly added cluster. To confirm whether a cluster is enabled or not, select System Configuration > High Availability > Clustering > Virtual Clusters in Config mode, double click the cluster entry in the Virtual Cluster List table, and make sure that the Enable This Virtual Cluster check box is selected. This completes the configuration of clustering SLB VIPs in Active-Standby mode. For more clustering configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 7 FortiBalancer 8.4 Web UI Handbook

20 Chapter 5 High Availability (HA) This chapter describes a basic configuration example of High Availability (HA). In this example, the FortiBalancer appliances are deployed in the Active/Standby scenario, where: The HA domain contains two HA units, and the same floating IP group is enabled on both units. The floating IP group contains the VIPs of two virtual services. Unit1 provides the service and unit2 serves as the backup of unit1. The FFO link is be used for fast failover. The following sections describe the detailed configuration procedure. Note: The configuration must be performed in the order of the following sections. 5.1 Configuring Unit Configuring SLB The prerequisite for configuring HA is that you have already completed SLB configurations. For SLB configuration procedures, refer to Chapter 6 Server Load Balancing (SLB) Configuring IP Pools for SLB Services You need to add and set IP pools for SLB services. For how to add an IP pool, refer to Section 2.3 Configuring the IP Pool. Do as follows to set IP pools for SLB services: In Config mode, select Server Load Balance > Groups > Groups IP Pool. In the IP Pools List area, specify the Group Name and All IP Pools parameters and click the Add action link, as shown in the figure below. Fortinet Technologies Inc. 8 FortiBalancer 8.4 Web UI Handbook

21 Figure 5-1 Setting IP Pools for SLB Services Configuring HA Units and Links In Config mode, select System Configuration > High Availability > HA > General Config. In the Unit area, click the Add action link. On the page that is displayed, specify the Unit Name, IP Address, and UDP Port parameters and click the Save action link, as shown in the figure below. Figure 5-2 Adding an HA Unit The added units will be displayed in the Unit area. You need to add both unit1 and unit2 on unit1. In the HA Reliable Link area, click the on radio button to enable the HA network link, including the primary link and the secondary link(s) and click the Save Changes button, as shown in the figure below. Figure 5-3 Enabling the HA Network Link In the HA Reliable FFO area, click the on radio button to enable the HA FFO link and click the Save Changes button, as shown in the figure below. Figure 5-4 Enabling HA FFO Link Configuring the Floating IP Group In Config mode, select System Configuration > High Availability > HA > Groups. In the Add Group area, specify the Group ID parameter and click the Add action link, as shown in the figure below. Fortinet Technologies Inc. 9 FortiBalancer 8.4 Web UI Handbook

22 Figure 5-5 Adding a Floating IP Group The added group will be displayed in the table of the Groups List area. Double-click the group. In the Group Floating IP area, click the Add action link. On the page that is displayed, specify the IP and Port parameters and click the Save action link, as shown in the figure below. Figure 5-6 Adding an Floating IP Configuring the Unit Priority in the Floating IP Group In Config mode, select System Configuration > High Availability > HA > Groups. In the Groups List area, double-click the group. In the Group Priority area, click the Add action link. The page for configuring unit priority will be displayed, as shown in the figure below. Figure 5-7 Configuring the Unit Priority Specify the Unit Name and Priority parameters and click the Save action link. You need to configure the priority of both unit1 and unit2 on unit1. The priority of unit1 should be higher than that of unit Configuring Preempt Mode In Config mode, select System Configuration > High Availability > HA > Groups. In the Groups List area, double-click the group. In the Groups Edit area, click the on radio button for the parameter Preempt and click the Save action link, as shown in the figure below. Fortinet Technologies Inc. 10 FortiBalancer 8.4 Web UI Handbook

23 Figure 5-8 Configuring the Group Preempt Mode Enabling the Group In Config mode, select System Configuration > High Availability > HA > Groups. In the Groups List area, double-click the group. In the Groups Edit area, click the Enable radio button for the parameter Enable Mode and click the Save action link, as shown in Figure 5-8 Configuring the Group Preempt Mode (Optional) Configuring Health Check Conditions In Config mode, select System Configuration > High Availability > HA > HC Condition. Configure the health check conditions as required (Optional) Configuring the Failover Decision Rule In Config mode, select System Configuration > High Availability > HA > Decision. Configure the failover decision rules as required (Optional) Enabling SSF In Config mode, select System Configuration > High Availability > HA > SSF. Configure the SSF function as required (Optional) Configuring the Synchronization Mode In Config mode, select System Configuration > High Availability > HA > Synchronization. Configure the synchronization mode as required (Optional) Enabling the HA Log In Config mode, select System Configuration > High Availability > HA > General Config. In the HA Log Settings area, configure the parameters as required Enabling HA and Writing the Configurations into Memory In Config mode, select System Configuration > High Availability > HA > General Config. In the HA General Settings area, select the Enable check box and click the Save Changes button. Fortinet Technologies Inc. 11 FortiBalancer 8.4 Web UI Handbook

24 To save the configurations you have made into system memory, click the Save Config action link in the top bar. 5.2 Configuring Unit Enabling FFO Link In Config mode, select System Configuration > High Availability > HA > General Config. In the HA Reliable FFO area, click the on radio button to enable the HA FFO link and click the Save Changes button, as shown in the figure below. Figure 5-9 Enabling HA FFO Link Configuring the Synchronization Mode In Config mode, select System Configuration > High Availability > HA > Synchronization. click the on radio button to enable HA Synconfig Bootup and click the Save Changes button (Optional) Enabling SSF In Config mode, select System Configuration > High Availability > HA > SSF. Configure the SSF function as required Enabling HA In Config mode, select System Configuration > High Availability > HA > General Config. In the HA General Settings area, select the Enable check box and click the Save Changes button. Fortinet Technologies Inc. 12 FortiBalancer 8.4 Web UI Handbook

25 Chapter 6 Server Load Balancing (SLB) Server Load Balancing (SLB) allows you to distribute load and traffic to specific groups of servers or to a specific server. The following sections describe the basic operations for configuring SLB. Note: The configuration must be performed in the order of the following sections. 6.1 Adding a Real Service A real service is an application server hosting varied applications or services. It processes the requests from the client side. In Config mode, select Server Load Balance > Real Services > Real Services. Click the Add Real Service Entry action link. Specify parameters in the Add Real Service Entry area and click the Save action link, as shown in the figure below. Figure 6-1 Adding a Real Service The added real service will be displayed in the SLB Real Services Configuration table. 6.2 Adding a Group and Defining Its Method In Config mode, select Server Load Balance > Groups > Groups. Specify parameters in the Add Group area and click the Add action link, as shown in the figure below. Figure 6-2 Adding a Group Fortinet Technologies Inc. 13 FortiBalancer 8.4 Web UI Handbook

26 The added group will be displayed in the Groups List table. 6.3 Adding a Real Service to the Group In Config mode, select Server Load Balance > Groups > Groups. In the Groups List table, double-click the group. More configurations about the group will become available. In the Group Members area, click the Add action link. Specify the parameters and click the Save action link, as shown in the figure below. Figure 6-3 Adding a Real Service to the Group 6.4 Adding a Virtual Service A virtual service is commonly represented with a VIP/port pair and can be accessed by the external clients to get their target network resources. In Config mode, select Server Load Balance > Virtual Services > Virtual Services. Specify parameters in the Add Virtual Service area and click the Add action link, as shown in the figure below. Figure 6-4 Adding a Virtual Service The added virtual service will be displayed in the Virtual Service List table. 6.5 Associating the Virtual Service With a Group and Defining a Policy In Config mode, select Server Load Balance > Virtual Services > Virtual Services. In the Virtual Service List table, double-click the virtual service. More configurations about the virtual service will become available. In the Associate Groups area, select a group from the Eligible Fortinet Technologies Inc. 14 FortiBalancer 8.4 Web UI Handbook

27 Groups drop-down list, select a policy from the Eligible Policies drop-down list, specify other parameters properly, and click the Add action link, as shown in the figure below. Figure 6-5 Associating a Virtual Service with a Group The binding relationship will be displayed in the table of the Associate Groups area. To check the configuration you have made, select Server Load Balance > Monitoring > Summary. You can click the Open All action link to check the detailed configuration. Note: Some parameters in the above steps may vary with the real service type, virtual service type, health check type, group method, or policy type. For detailed parameter descriptions, refer to the FortiBalancer 8.4 CLI Reference. This completes the basic configuration of SLB. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 15 FortiBalancer 8.4 Web UI Handbook

28 Chapter 7 Reverse Proxy Cache This chapter describes a basic configuration example of Reverse Proxy Cache (hereinafter referred to as the cache function). In this example, the cache function is enabled on the virtual service virtual_moss. The FortiBalancer appliance caches all.jpg objects from the host and the cache expiration time is 200,000 seconds. The following sections describe the detailed configuration procedure. Note: The configuration must be performed in the order of the following sections. 7.1 Basic Cache Settings In Config mode, select Proxy > Caching Proxy > Cache Settings > Cache Settings. In the Cache Settings area, specify the Maximum Cachable Object Size (KB) and Expiration Time (Seconds) parameters as required, select the Enable Cache check box, and click the Save Changes button, as shown in the figure below. Figure 7-1 Configuring Basic Cache Settings 7.2 Enabling the Cache Function on a Virtual Service In Config mode, select Proxy > Caching Proxy > Cache Settings > Cache Settings. In the Virtual Service Cache Settings area, select the virtual service on which the cache function is to be enabled, and click the Enable action link, as shown in the figure below. Figure 7-2 Enabling the Cache Function 7.3 Configuring Cache Filter In Config mode, select Proxy > Caching Proxy > Cache Settings > Cache Filter. In the Cache Filter Rule area, specify the Host Name, Regular Expression, TTL, Cache, and URL Query Fortinet Technologies Inc. 16 FortiBalancer 8.4 Web UI Handbook

29 parameters, and click the Add action link. The added filter rule will be displayed in the table of the Cache Filter Rule area, as shown in the figure below. Figure 7-3 Configuring Cache Filter Note: Parameter TTL indicates the cache expiration time, in seconds. For descriptions of the parameters Host Name, Regular Expression, TTL, Cache and URL Query, refer to the command cache filter rule in the FortiBalancer 8.4 CLI Reference. 7.4 Enabling Cache Filter In the Cache Filter Setting area, select the Cache Filter Setting check box to enable box to enable the cache filter function, and click the Save Changes button, as shown in the figure below. Figure 7-4 Enabling Cache Filter This completes the configuration of Reverse Proxy Cache. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 17 FortiBalancer 8.4 Web UI Handbook

30 Chapter 8 HTTP Content Rewrite This chapter describes a typical configuration example of HTTP Content Rewrite based on the following network environment: A real server whose IP address is is placed behind the FortiBalancer appliance, and its corresponding virtual service is v1, whose IP address is The end user can only access the IP address of the virtual service vs1 because the real server is hidden by the FortiBalancer appliance. To enable the access of the end user to Web resource a.xml on the real server by clicking a link on the Web page, the FortiBalancer appliance should rewrite URL address of the Web resource on the Web page from into Note: The configuration must be performed in the order of the following sections. 8.1 Configuring SLB The prerequisite for configuring HTTP Content Rewrite is that you have already completed SLB configurations to bind the real server and the virtual service. For SLB configuration procedures, refer to Chapter 6 Server Load Balancing (SLB). 8.2 Enabling HTTP Content Rewrite Globally By default, the HTTP Content Rewrite function is enabled on each virtual service but globally disabled. To make the HTTP Content Rewrite function effective on a virtual service, you need to first enable the function globally. In Config mode, select Proxy > Caching Proxy > Content Rewrite > General Setting. In the Content Rewrite Setting area, select the Enable Content Rewrite check box and click the Save Changes button, as shown in the figure below. Figure 8-1 Enabling HTTP Content Rewrite Globally Fortinet Technologies Inc. 18 FortiBalancer 8.4 Web UI Handbook

31 8.3 Enabling HTTP Content Rewrite on a Virtual Service In Config mode, select Proxy > Caching Proxy > Content Rewrite > General Setting. In the Virtual Service Content Rewrite Setting area, select the check box of the virtual service on which HTTP Content Rewrite is to be enabled and click the Save Changes button, as shown in the figure below. Figure 8-2 Enabling HTTP Content Rewrite on a Virtual Service 8.4 Configuring the HTTP Content Rewrite Rule In Config mode, select Proxy > Caching Proxy > Content Rewrite > Rewrite Rule. In the Rule List area, click the Add action link. The page for adding an HTTP Content Rewrite rule will be displayed. Specify the Type, From Pattern, To Pattern, and Flags parameters, as shown in the figure below. Figure 8-3 Configuring the Rewrite Rule Note: If the Type parameter is specified as ProxyHTMLURLMap, the FortiBalancer appliance rewrites only the URLs inside the HTML tags. If the Type parameter is specified as Substitute, the FortiBalancer appliance rewrites URLs both inside and outside the HTML tags. For descriptions of the Type, From Pattern, To Pattern, and Flags parameters, refer to the http rewrite body rule command in the FortiBalancer 8.4 CLI Reference. Fortinet Technologies Inc. 19 FortiBalancer 8.4 Web UI Handbook

32 Click the Save action link. The added rewrite rule will be displayed in the table of the Rule List area. 8.5 Configuring the File Type to Be Rewritten In Config mode, select Proxy > Caching Proxy > Content Rewrite > General Setting. In the MIME Type area, click the Add action link. The page for specifying the MIME type of files to be rewritten will be displayed, as shown in the figure below. Figure 8-4 Adding a MIME Type Select xml from the MIME Type drop-down list and click the Save action link. The newly added MIME type will be displayed in the table of the MIME Type area. Repeat this step to add more MIME types. 8.6 Configuring the Status Code In Config mode, select Proxy > Caching Proxy > Content Rewrite > General Setting. In the Status Code area, click the Add action link. The page for specifying the status code will be displayed, as shown in the figure below. Figure 8-5 Adding a Status Code Specify the Status code parameter and click the Save action link. This completes the configuration of HTTP Content Rewrite. The end user should be able to access the Web resource a.xml on the real server by clicking a link on the Web page because the FortiBalancer appliance will rewrite the URL address in the HTML tag of the response into according to the HTTP Content Rewrite rule. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 20 FortiBalancer 8.4 Web UI Handbook

33 Chapter 9 DNS Cache This chapter describes how to configure DNS Cache on the FortiBalancer appliance. Note: The configuration must be performed in the order of the following sections. 9.1 Configuring SLB The prerequisite for configuring DNS Cache is that you have already completed SLB configurations. For SLB configuration procedures, refer to Chapter 6 Server Load Balancing (SLB). 9.2 Enabling DNS Cache In Config mode, select Proxy > Caching Proxy > DNS Cache Settings. In the DNS Cache area, specify the Min (Seconds) and Max (Seconds) parameters to configure the minimum and maximum DNS Cache expiration time. Select the Enable DNS Cache check box and click the Save Changes button, as shown in the figure below. Figure 9-1 Enabling DNS Cache After preceding configurations, DNS Cache is enabled on the FortiBalancer appliance. You can also add a static DNS Cache entry to manually specify a host to be cached. 9.3 (Optional) Adding a Static DNS Cache Entry In Config mode, select Proxy > Caching Proxy > DNS Cache Settings. In the DNS Cache Static Entries area, specify the Host Name and Host IP parameters. Click the Add action link. The added host entry will be displayed in the table of the DNS Cache Static Entries area, as shown in the figure below. Fortinet Technologies Inc. 21 FortiBalancer 8.4 Web UI Handbook

34 Figure 9-2 Adding a DNS Cache Host This completes the configuration of DNS Cache. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 22 FortiBalancer 8.4 Web UI Handbook

35 Chapter 10 HTTP Compression This chapter describes how to configure HTTP Compression on the FortiBalancer appliance. Note: The configuration must be performed in the order of the following sections Enabling HTTP Compression Globally In Config mode, select Proxy > Compression > Compression Setting. In the HTTP Compression Setting area, select the Enable Compression check box. Click the Save Changes button, as shown in the figure below: Figure 10-1 Enabling HTTP Compression Globally 10.2 Enabling HTTP Compression on a Virtual Service In Config mode, select Proxy > Compression > Compression Setting. In the HTTP Compression Setting area, select the virtual service from the HTTP/HTTPS Virtual Service(s) drop-down list and click the Enable VS Compression action link. The virtual service on which HTTP Compression is enabled will be displayed in the Compression is Enabled for the Following HTTP/HTTPS Virtual Services table, as shown in the figure blow. Figure 10-2 Enabling HTTP Compression on a Virtual Service 10.3 Configuring Advanced HTTP Compression With HTTP Compression enabled, the FortiBalancer appliance compresses the following MIME types for all browsers by default: Text (text/plain) Fortinet Technologies Inc. 23 FortiBalancer 8.4 Web UI Handbook

36 HTML (text/html) XML (text/xml) To enable the compression of other MIME types, do as follows: In Config mode, select Proxy > Compression > Compression Type. In the Compression MIME Types area, specify the User Agent and MIME Types parameters as required. Click the Add MIME Type action link. The added user agent and MIME type pair will be displayed in the Supported Compression MIME Types table, as shown in the figure below. Figure 10-3 Configuring Advanced HTTP Compression 10.4 Configuring URL-Exclude HTTP Compression Rule In Config mode, select Proxy > Compression > Compression Setting. In the Compression URL Exclude area, specify the Wildcard Expression and HTTP/HTTPS Virtual Service(s) parameters as required. Click the Add action link. The added virtual service and wildcard expression pair will be displayed in the URL Exclude List table, as shown in the figure below. Figure 10-4 Configuring URL-Exclude HTTP Compression Rule A URL-exclude HTTP Compression rule determines the scenario where HTTP Compression is not applied. For example, when the v1 and ghi.txt$ pair is configured, as shown in the above Fortinet Technologies Inc. 24 FortiBalancer 8.4 Web UI Handbook

37 figure, and the URL of a client request to the virtual service v1 ends with the string ghi.txt, the textual contents in the response will not be compressed even if HTTP Compression is enabled. This completes the configuration of HTTP Compression. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 25 FortiBalancer 8.4 Web UI Handbook

38 Chapter 11 Secure Sockets Layer (SSL) This chapter describes how to configure basic SSL acceleration on the FortiBalancer appliance. Note: The configuration must be performed in the order of the following sections Creating an SSL Virtual Host The prerequisite for creating an SSL virtual host is that you have already created an SLB virtual service. For how to create an SLB virtual service, refer to Chapter 6 Server Load Balancing (SLB). An SSL virtual host is associated with an SLB virtual service and acts as an SSL server in the communication between the browser and the FortiBalancer appliance. To create an SSL virtual host, do as follows: In Config mode, select Proxy > SSL > Virtual Hosts. In the SSL Virtual Hosts area, click the Add action link, and the page for adding an SSL virtual host will be displayed, as shown in the figure below. Figure 11-1 Creating an SSL Virtual Host Specify the parameters as required and click the Save action link. The added SSL virtual host will be displayed in the table of the SSL Virtual Hosts area Applying for a Certificate for the SSL Virtual Host If you do not possess a certificate and key pair, do as follows to generate a CSR for the SSL virtual host to apply for a certificate from a Certificate Authority (CA). In Config mode, select Proxy > SSL > Virtual Hosts. In the SSL Virtual Hosts area, double-click the SSL virtual host, and the page for generating a CSR for the SSL virtual host will be displayed, as shown in the figure below. Fortinet Technologies Inc. 26 FortiBalancer 8.4 Web UI Handbook

39 Figure 11-2 Generating a New CSR/Key Note: You must select Yes for the Private Key Exportable parameter and configure a password to export the private key. Specify other parameters properly and click the Apply action link. The FortiBalancer will create a CSR and display the private key for the SSL virtual host, as shown in the figure below. Figure 11-3 Generated CSR This CSR uses the public key of the public-private key pair generated when the CSR is created. You need to send the entire text in the Existing CSR area to a CA for signing. The CA needs these lines to expedite your request for a certificate. Fortinet Technologies Inc. 27 FortiBalancer 8.4 Web UI Handbook

40 11.3 Importing a Key and Certificate for the SSL Virtual Host You must first import the key and then the certificate with only one exception: when you import an SSL certificate and key pair from an iplanet server, import the certificate first Importing a Key for the SSL Virtual Host In Config mode, select Proxy > SSL > Virtual Hosts. In the SSL Virtual Hosts area, double-click the SSL virtual host. On the displayed page, select Virtual Host CSR/Cert/Key > CSR/Key. Make a copy of the entire text of the SSL Exportable Key area. Select Virtual Host CSR/Cert/Key > Import Cert/Key. In the SSL Key area, select Manual Input and paste the copy into the SSL Key text box and specify the Key Passphase parameter. Click the Import action link to import the key Importing a Certificate for the SSL Virtual Host In Config mode, select Proxy > SSL > Virtual Hosts. In the SSL Virtual Hosts area, double-click the SSL virtual host. On the displayed page, select Virtual Host CSR/Cert/Key > Import Cert/Key. In the SSL Certificate area, choose to import the certificate from local, by FTP, or by manual input and click the Import action link to import the certificate. After a certificate is successfully imported, the certificate status will be displayed as Inactive in the table of the SSL Certificate area. To enable the certificate, click the Activate action link, as shown in the figure below. Figure 11-4 Certificate Status 11.4 Enabling the SSL Virtual host In Config mode, select Proxy > SSL > Virtual Hosts. In the SSL Virtual Hosts area, double-click the SSL virtual host. On the displayed page, select Virtual Host Settings > Basic Settings. In the SSL Basic Settings area, select the Enable SSL check box and click the Save Changes button Creating an SSL Real Host The prerequisite for creating an SSL real host is that you have already created an SLB real service. For how to create an SLB real service, refer to Chapter 6 Server Load Balancing (SLB). Fortinet Technologies Inc. 28 FortiBalancer 8.4 Web UI Handbook

41 An SSL real host is associated with an SLB real service and acts as an SSL client in the communication between the FortiBalancer appliance and the backend server. To create an SSL real host, do as follows: In Config mode, select Proxy > SSL > Real Hosts. In the SSL Real Hosts area, click the Add action link, and the page for adding an SSL real host will be displayed, as shown in the figure below. Figure 11-5 Creating an SSL Real Host Specify the parameters as required and click the Save action link. The added SSL real host will be displayed in the table of the SSL Real Hosts area Enabling the SSL Real Host In Config mode, select Proxy > SSL > Real Hosts. In the SSL Real Hosts area, double-click the SSL real host. On the displayed page, select Real Host Settings > Basic Settings. In the SSL Basic Settings area, select the Enable SSL check box and click the Save Changes button. This completes the basic configuration of SSL acceleration. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 29 FortiBalancer 8.4 Web UI Handbook

42 Chapter 12 Quality of Service (QoS) This chapter describes how to configure QoS on the FortiBalancer appliance. Note: The configuration must be performed in the order of the following sections Specifying the QoS Interface In Config mode, select QoS Configuration > QoS > QoS Entries. Click the Add QoS Entry action link. The page for adding a QoS entry will be displayed, as shown in the figure below. Figure 12-1 Adding a QoS Entry Select interface from the QoS Entry Type drop-down list. The page for specifying the QoS interface will be displayed, as shown in the figure below. Figure 12-2 Specifying the QoS Interface Specify the required parameters properly. Click the Save action link. The QoS Configuration > QoS > QoS Entries page will be displayed to illustrate QoS configurations in a tree structure, as shown in the figure below. Figure 12-3 QoS Configurations Fortinet Technologies Inc. 30 FortiBalancer 8.4 Web UI Handbook

43 12.2 Creating a QoS Queue On the page as shown in Figure 12-1 Adding a QoS Entry, select root queue from the QoS Entry Type drop-down list. The page for creating a QoS root queue will be displayed, as shown in the figure below. Figure 12-4 Creating a QoS Queue Specify the parameters properly. Click the Save action link. The QoS Configuration > QoS > QoS Entries page will be displayed to illustrate QoS configurations in a tree structure, as shown in Figure 12-3 QoS Configurations. Note: You can repeat this step to add a sub-queue to the root queue as required Defining a QoS Rule On the page as shown in Figure 12-1 Adding a QoS Entry, select L4 filter from the QoS Entry Type drop-down list. The page for defining a QoS rule will be displayed, as shown in the figure below. Figure 12-5 Defining a QoS Rule Fortinet Technologies Inc. 31 FortiBalancer 8.4 Web UI Handbook

44 Specify the required parameters properly. Click the Save action link. The QoS Configuration > QoS > QoS Entries page will be displayed to illustrate QoS configurations in a tree structure, as shown in Figure 12-3 QoS Configurations Enabling QoS QoS is disabled by default. To enable QoS on an interface, do as follows: In Config mode, select QoS Configuration > QoS > Interfaces. The interfaces on which QoS is configured will be displayed in the QoS Interface Operation table, as shown in the figure below. Figure 12-6 Enabling QoS To enable QoS in the specific direction on an interface, select the corresponding Enabled check box and click the Save Changes button. You can check the QoS enabling status on the QoS Configuration > QoS > QoS Entries page. This completes the configuration of QoS. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 32 FortiBalancer 8.4 Web UI Handbook

45 Chapter 13 Link Load Balancing (LLB) This chapter takes how to configure LLB on an FortiBalancer appliance balancing outbound traffic between two ISPs as an example to describe LLB configurations on the FortiBalancer. The configuration example in this chapter is based on the following network environment: An FortiBalancer appliance is placed between two Internet Service Providers (ISPs) and the internal network. The FortiBalancer appliance balances load bound to the Internet between ISPs (ISP1 and ISP2). Eroutes are configured to transmit traffic along dedicated links to specific gateways. Gateway link bandwidths can be controlled Configuring Interface IP Address The FortiBalancer appliance is connected to ISPs (ISP1 and ISP2) through port1 and to the internal network through port2. You need to assign an IP address on the same network segment with ISP1 to port1, and an IP address on the same network segment with the internal network to port2. For the detailed procedure, refer to Section Configuring the Network Interface Configuring MNET You also need to assign an IP address on the same network segment with ISP2 to port1. The detailed procedure is as follows: In Config mode, select System Configuration > Basic Networking > Interface > Port. In the MNET Configuration area, click the Add MNET action link. The page for configuring MNET will be displayed, as shown in the figure below. Figure 13-1 Configuring MNET Fortinet Technologies Inc. 33 FortiBalancer 8.4 Web UI Handbook

46 Set the Static IP Address parameter to an IP address on the same network segment with ISP2 and specify other parameters properly. Click the Save action link. The added MNET entry will be displayed in the table of the MNET Configuration area Configuring LLB Links Adding LLB Links Bound to ISP1 and ISP2 In Config mode, select Advanced Load Balance > Link load Balance > Outbound Settings. In the LLB Link Route area, click the Add action link. The page for adding an LLB link will be displayed, as shown in the figure below. Figure 13-2 Adding an LLB Link Specify the parameters properly to configure an LLB link bound to ISP1 and click the Save & Add Another action link to add an LLB link bound to ISP2. Note: To configure an LLB link to ISP1/ISP2, set the source IP address to the one using which the FortiBalancer appliance is connected to ISP1/ISP2 through port1, and set the gateway IP address to the gateway of ISP1/ISP2. The Bandwidth Threshold parameter indicates the maximum bandwidth allowed for the gateway specified by the Gateway IP parameter. This threshold takes effect if the priority of the corresponding Eroute, which is configured in Section 13.4 Configuring Eroutes, is lower than the bandwidth priority configured in Section Configuring Bandwidth Priority Configuring Additional LLB Health Check In Config mode, select Advanced Load Balance > Link load Balance > Outbound Settings. In the LLB Link Route area, double click the link. In the Link Health Checker area on the displayed page, click the Add action link. Specify the parameters to configure additional LLB health check. Fortinet Technologies Inc. 34 FortiBalancer 8.4 Web UI Handbook

47 Enabling LLB Health Check In Config mode, select Advanced Load Balance > Link Load Balance > Outbound Settings. In the LLB Link Global Settings area, select the Enable Link Heath Check check box. Click the Save Changes button Configuring the Load Balancing Method In Config mode, select Advanced Load Balance > Link Load Balance > Outbound Settings. In the LLB Link Global Settings area, select the load balancing method from the Method drop-down list. Click the Save Changes button Configuring Bandwidth Priority In Config mode, select Advanced Load Balance > Link Load Balance > Outbound Settings. In the LLB Link Global Settings area, specify the Bandwidth Priority parameter. Click the Save Changes button Configuring Eroutes In Config mode, select System Configuration > Basic Networking > Routing > RTS/IPflow/Eroutes. In the Eroutes area, click the Add action link. The page for adding an Eroute will be displayed, as shown in the figure below. Figure 13-3 Adding an Eroute Specify the parameters properly to add Eroutes to specify links for traffic from the internal network to the Internet through ISP1 or ISP2. In addition, you must add an Eroute to transmit traffic that does not match any other Eroute. For this Eroute, its source IP address, source netmask/prefix length, source port, destination IP address, destination netmask/prefix length, and destination port are all 0s. In addition, its protocol should be any and gateway should be the gateway of either ISP1 or ISP2. Fortinet Technologies Inc. 35 FortiBalancer 8.4 Web UI Handbook

48 13.5 Configuring NAT To translate an internal network IP address into an IP address on the same network segment with ISP1 or ISP2, you need to configure NAT for both ISP1 and ISP2. For the detailed procedure, refer to Section 2.1 Configuring NAT Enabling IPflow and RTS In Config mode, select System Configuration > Basic Networking > Routing > RTS/IPflow/Eroutes. In the RTS Settings and IPflow Settings areas, specify the parameters properly. Click the Save Changes button. This completes the LLB configuration on an FortiBalancer appliance balancing outbound traffic between two ISPs. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 36 FortiBalancer 8.4 Web UI Handbook

49 Chapter 14 Global Server Load Balancing (GSLB) Global Server Load Balancing (GSLB) is also known as Smart DNS (SDNS). This chapter takes how to configure SDNS Dynamic Proximity System (DPS) on the FortiBalancer appliance as an example to describe GSLB configurations on the FortiBalancer. The configuration example in this chapter is based on the following network environment: Two FortiBalancers and two DPS detectors are deployed on the network to form an SDNS DPS. FortiBalancer1 works as the master and FortiBalancer2 works as the slave. Two Content Distribution Network (CDN) sites are available, each of which uses an FortiBalancer appliance or other qualified server as its DPS detector General Configurations on FortiBalancer1 and FortiBalancer2 Note: Configurations in this section should be performed on both FortiBalancer1 and FortiBalancer2. For every parameter mentioned in this section, its values on FortiBalancer1 and FortiBalancer2 must be identical Adding CDN Sites In Config mode, select Advance Load Balance > Global Load Balance > Topology > Site. In the SDNS Site Settings area, click the Add Site Entry action link. The page for adding a CDN site will be displayed, as shown in the figure below. Figure 14-1 Adding a CDN Site Specify the parameters properly to add CDN site1. Click the Save & Add Another action link to add CDN site2. Fortinet Technologies Inc. 37 FortiBalancer 8.4 Web UI Handbook

50 Adding DPS Detectors In Config mode, select Advance Load Balance > Global Load Balance > DPS > SDNS DPS Settings. In the SDNS DPS Detectors area, click the Add action link. The page for adding a DPS detector will be displayed, as shown in the figure below. Figure 14-2 Adding a DPS Detector Specify the parameters properly to add DPS detector1. Click the Save & Add Another action link to add DPS detector Other General Settings Enabling SDNS In Config mode, select Advance Load Balance > Global Load Balance > General Settings. In the General Settings area, select the SDNS Status check box and specify the SDNS Report Interval, and SDNS Heart Beat Interval parameters. Click the Save Changes button Enabling SDNS DPS In Config mode, select Advance Load Balance > Global Load Balance > DPS > SDNS DPS Settings. In the SDNS DPS Settings area, specify the Query Interval, Send Interval, and History Scale parameters, and select the SDNS DPS check box. Click the Save Changes button. Fortinet Technologies Inc. 38 FortiBalancer 8.4 Web UI Handbook

51 14.2 Configurations on the SDNS DPS Master (FortiBalancer1) Configuring FortiBalancer1 as the SDNS DPS Master Configuring SDNS Statistics In Config mode, select Advance Load Balance > Global Load Balance > General Settings. In the General Settings area, select the SDNS Statistics and SDNS Local Statistics check boxes. Click the Save Changes button Enabling the SDNS DPS Mater In Config mode, select Advance Load Balance > Global Load Balance > DPS > SDNS DPS Settings. In the SDNS DPS Settings area, select the SDNS DPS Master check box. Click the Save Changes button Adding DPS Members In Config mode, select Advance Load Balance > Global Load Balance > DPS > SDNS DPS Settings. In the SDNS DPS Members area, set the Member IP Address parameter to the IP address of FortiBalancer1. Click the Add action link. The added member entry will be displayed in the table of the SDNS DPS Members area, as shown in the figure below. Figure 14-3 Adding a DPS Member Repeat this step to add FortiBalancer2 as a DPS member Configuring the DPS Dynamic Proximity Method In Config mode, select Advance Load Balance > Global Load Balance > DPS > SDNS DPS Settings. In the SDNS DPS Settings area, select a method from the Method drop-down list. Click the Save Changes button. Fortinet Technologies Inc. 39 FortiBalancer 8.4 Web UI Handbook

52 14.3 Configurations on the SDNS DPS Slave (FortiBalancer2) Configuring the DPS Dynamic Proximity Method In Config mode, select Advance Load Balance > Global Load Balance > DPS > SDNS DPS Settings. In the SDNS DPS Settings area, select a method from the Method drop-down list. Click the Save Changes button Enabling DPS Detectors You need to perform required operations on the DPS detectors to enable them. If the DPS detector is a FortiBalancer appliance, do as follows: In Config mode, select Advance Load Balance > Global Load Balance > DPS > Local Detectors. In the Add an SDNS DPS Local Detector area, specify the parameters properly. Click the Add action link. This completes the SDNS DPS configuration on the FortiBalancer appliance. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 40 FortiBalancer 8.4 Web UI Handbook

53 Chapter 15 Access Control This section describes how to configure WebWall on the FortiBalancer appliance Adding an Access Control List (ACL) Rule In Config mode, select System Configuration > Access Control > WebWall. In the Access List Configuration area, click the Add action link. The page for configuring an ACL rule will be displayed, as shown in the following figure. Figure 15-1 Adding an ACL Rule Specify the parameters properly. Click the Save action link. The added ACL rule will be displayed in the table of the Access List Configuration area. Repeat this step to add more ACL rules according to the actual situation Configuring an Access Group In Config mode, select System Configuration > Access Control > WebWall. In the Access Group Configuration area, select an interface from the Interface drop-down list, specify the Access List ID parameter and click the Add action link. The added access group will be displayed in the table of the Access Group Configuration area, as shown in the figure below. Figure 15-2 Adding an Access Group For the configurations shown in the preceding figure, ACL rules whose ID is 100 are all applied on port1 and rules whose ID is 200 are all applied on port2. Fortinet Technologies Inc. 41 FortiBalancer 8.4 Web UI Handbook

54 15.3 Enabling WebWall In Config mode, select System Configuration > Access Control > WebWall. In the WebWall Status area, select the corresponding check box to enable WebWall for an interface, that is, to apply ACL rules on the interface. Click the Save Changes button. This completes the basic WebWall configuration on the FortiBalancer appliance. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 42 FortiBalancer 8.4 Web UI Handbook

55 Chapter 16 Advanced IPv6 Configuration IPv6 addressed are widely supported by features of the FortiBalancer appliance. This chapter takes how to configure DNS64 and NAT64 as an example to describe IPv6 support on the FortiBalancer appliance. Note: The configuration must be performed in the order of the following sections Configuring the IP Pool Select System Configuration > Advanced Networking > IP Pool. In the Add IP Pool area, specify the required parameters and click the Add action link to save the configuration Configuring SLB In Config mode, select Server Load Balance > Real Services > Real Services. In the SLB Real Services Configuration area, click the Add Real Service Entry action link. In the Add Real Service Entry area of displayed page, specify the required parameters and click Save to save the configuration. In Config mode, select Server Load Balance > Groups > Groups. In the Add Group area, specify the required parameters and click the Add action link. In Groups List, double-click the newly added group. In the Group Members area of the displayed page, click the Add action link. In the Add Group Member area of the displayed page, specify the required parameters and click Save to save the configuration. In Config mode, select Server Load Balance > Virtual Services > Virtual Services. In the Add Virtual Service area, specify the required parameters and click the Add action link. In Virtual Service List, double-click the newly added virtual service. In the Associate Groups area of the displayed page, associate the virtual service with the default or backup policy and click the Add action link Configuring DNS64 In Config mode, select System Configuration > NAT > V4/V6 NAT. In the DNS64 Configuration area, specify the required parameters and click the Set action link to save the configuration. Figure 16-1 Configuring DNS64 Fortinet Technologies Inc. 43 FortiBalancer 8.4 Web UI Handbook

56 16.4 Configuring NAT64 In the NAT64 Configuration area, specify the required parameters and click the Set action link to save the configuration. Figure 16-2 Configuring NAT64 This completes the DNS64 and NAT64 configurations on the FortiBalancer appliance. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 44 FortiBalancer 8.4 Web UI Handbook

57 Chapter 17 epolicy This chapter describes a basic configuration example of epolicy. The following sections describe the detailed configuration procedure. Note: The configuration must be performed in the order of the following sections Importing Setting Scripts The prerequisite for configuring epolicy is that you have already created an SLB virtual service. For how to create an SLB virtual service, refer to Chapter 6 Server Load Balancing (SLB). In Config mode, select Server Load Balance > Virtual Services > Virtual Services. In the Virtual Service List table, double-click the virtual service. More configurations about the virtual service will become available. Select the epolicy Scripts tab, and the page for configuring epolicy will be displayed, as shown in the figure below. Figure 17-1 Configuring epolicy In the Import epolicy Setting Scripts area, choose to import the setting script from local file, by HTTP, or by FTP, specify the Local File Path/HTTP URL/FTP URL and Setting Scripts Name parameters, and click the Import action link to import the setting script Importing Runtime Scripts On the page as shown in Figure 17-1 Configuring epolicy, in the Import epolicy Runtime Scripts area, choose to import the runtime script from local file, by HTTP, or by FTP, specify the Fortinet Technologies Inc. 45 FortiBalancer 8.4 Web UI Handbook

58 Local File Path/HTTP URL/FTP URL and Setting Scripts Name parameters, and click the Import action link to import the runtime script Associating the Virtual Service with the Setting Script On the page as shown in Figure 17-1 Configuring epolicy, in the VS Associated with Setting Scripts area, select the setting script in the All Setting Scripts area and click the button to associate the setting script with the virtual service Associating the Virtual Service with the Runtime Script On the page as shown in Figure 17-1 Configuring epolicy, in the VS Associated with Runtime Scripts area, select the runtime script in the All Runtime Scripts area and click the button to associate the runtime script with the virtual service. Fortinet Technologies Inc. 46 FortiBalancer 8.4 Web UI Handbook

59 Chapter 18 Logging This section describes how to configure the basic Logging function on the FortiBalancer appliance General Configurations In Config mode, select Admin Tools > Graph > Logging > General. In the General Settings area, select the Enable Logging check box and specify other parameters properly. Click the Save Changes button. Note: For the Level parameter, logs whose levels are lower than the specified level will not be transmitted to the log server Configuring Syslog Servers Adding a Syslog Server In Config mode, select Admin Tools > Graph > Logging > Syslog Servers. In the Remote Syslog Server Configuration area, click the Add Server Entry action link. The page for adding a syslog server will be displayed, as shown in the figure below. Figure 18-1 Adding a Syslog Server Specify the parameters properly. Click the Save action link. The added syslog server will be displayed in the table of the Remote Syslog Server Configuration area Configuring Log Filter In Config mode, select Admin Tools > Graph > Logging > Syslog Servers. In the HTTP Log Filter Configuration area, click the Add action link. The page for adding a log filter entry will be displayed, as shown in the figure below. Fortinet Technologies Inc. 47 FortiBalancer 8.4 Web UI Handbook

60 Figure 18-2 Adding a Log Filter Entry Specify the parameters properly. Click the Save action link. The added log filter will be displayed in the table of the HTTP Log Filter Configuration area. Note: The log filter cannot be configured on the syslog host whose ID is 0. This completes the basic Logging configuration on the FortiBalancer appliance. For more configuration examples, refer to the FortiBalancer 8.4 User Guide. Fortinet Technologies Inc. 48 FortiBalancer 8.4 Web UI Handbook