FortiADC Transparent Mode Configuration Guide VERSION 1.0.0
FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT https://support.fortinet.com FORTIGATE COOKBOOK http://cookbook.fortinet.com FORTINET TRAINING SERVICES http://www.fortinet.com/training FORTIGUARD CENTER http://www.fortiguard.com END USER LICENSE AGREEMENT http://www.fortinet.com/doc/legal/eula.pdf FEEDBACK Email: techdocs@fortinet.com Wednesday, February 28, 2018 FortiADC Transparent Mode Configuration Guide Initial Release
TABLE OF CONTENTS Change Log 4 Introduction 5 Software switch 6 Important things to know about softswitch 6 Recommations 6 Configure a softswitch interface 7 From the Console 7 From the GUI 7 Test the softswitch 8 Configure softswitch management IP 10 From the Console 10 From the GUI 10 Test the softswitch management IP 11 Configure softswitch VLAN sub-interface 13 From the Console 13 From the GUI 13 Test the softswitch VLAN sub-interface 14 Create a Layer-4 VS in DNAT mode 16 From the Console 16 Configure a load-balancing real server 16 Configure a load-balancing virtual server 16 From the GUI 17 Traffic flow 19 Create a Layer-7 VS with client address enabled 21 From the Console 21 Configure a load-balancing real server 21 Enable client IP address 21 From the GUI 22 Configure a application profile 22 Configure a Layer-7 virtual server 23 Traffic flow 25
Change Log Change Log Date Change Description 02/28/2018 Initial release. 4 Transparent Mode Configuration Guide
Introduction Introduction Transparent mode allows you to deploy a FortiADC appliance directly into a network environment without making changes to the existing routing infrastructure while providing full services for Layer-2 switching. A single or multiple VLANs can be configured on a FortiADC appliance to perform Layer-2 switching. Because a VLAN is a pair of logical interfaces sharing the same characteristics, it can cover one or more ports on multiple devices. In this way, a FortiADC appliance works as a Layer-2 switch with multiple VLAN segments and provides services within the same Layer-2 network. To support transparent mode, you must create a softswitch interface on FortiADC. For more information, see "Software switch" on page 6. 5 Transparent Mode Configuration Guide
Software switch Software switch A software switch, or softswitch, is a virtual switch that is implemented at the software or firmware level rather than the hardware level. It can be used to simplify communication between devices connected to different FortiADC interfaces. For example, using a softswitch, you can place the FortiADC interface connected to an internal network on the same subnet as your wireless interfaces. This allows devices on the internal network to communicate with devices on the wireless network without any additional configuration. A softswitch can also be useful if you require more hardware ports for the switch on a FortiADC unit. For example, if your FortiADC has a 4-port switch, WAN1, WAN2, and DMZ interfaces, and you need one more port, you can create a softswitch that includes the 4-port switch and the DMZ interface all on the same subnet. Such applications also apply to wireless interfaces, virtual wireless interfaces, and physical interfaces. Similar to a hardware switch, a softswitch functions like a single interface. It has one IP address, and all interfaces in the softswitch are on the same subnet. Traffic between devices connected to each interface is not regulated by security policies, and traffic passing in and out of the switch is affected by the same policy. Important things to know about softswitch The softswitch interface is a standard Layer-3 interface supported on all FortiADC platforms,. Members of a softswitch automatically switches to Layer-2 type. The softswitch interface can be defined as a normal Layer-3 interface, such as management, server load-balancing, link load-balancing, global load-balancing, and firewall, but can't be used by an HA configuration as a heartbeat port, data port, or monitor port. Member ports of the softswitch can't be used by management, server load-balancing, link load-balancing, global load-balancing, firewall, or HA traffic. LLDP in member port of the softswitch is supported. You can't add a softswitch to an aggregate interface. The softswitch interface can be used in a tunnel interface. The softswitch interface is supported in all Layer-2, Layer-4, and Layer-7 virtual server modes; using softswitch interface in Layer-2 mode will not trigger route-redirect events. FortiADC softswitch does not participate in the Spanning Tree Protocol (STP) node, but will forward all STP BPDU by this soft-switch interface directly. Recommations Before setting up a softswitch, we strongly recomm that you do the following: Back up your existing configuration. Have at least one port or connection such as the console port to connect to the FortiADC unit. In so doing, if you accidentally combine too many ports, you still have a way to undo it. 6 Transparent Mode Configuration Guide
Configure a softswitch interface From the Console Configure a softswitch interface To support transparent mode, you must first set up a softswitch interface on your FortiADC appliance, which can be done either from the console or the GUI. From the Console config system interface edit "sw" set type switch set member port9 port10 From the GUI 1. From the navigation bar, click Networking>Interface. 2. On top the interface table, click Add. 3. Make the entries or selections as highlighted in Figure 1. 4. Click Save when done. 7 Transparent Mode Configuration Guide
From the GUI Configure a softswitch interface Figure 1: Configure a softswitch interface Test the softswitch After you have created a softswitch, you must test it to make sure that it works properly. Simply run a Ping test against the server's IP address to see if the client can reach the server via the softswitch, as illustrated in Figure 2. Transparent Mode Configuration Guide 8
Configure a softswitch interface From the GUI Figure 2: Ping a real server via the softswitch 9 Transparent Mode Configuration Guide
Configure softswitch management IP From the Console Configure softswitch management IP The softswitch interface can be managed or referenced by any other modules in the same way as any regular interface. Once a softswitch is created, you need to set a management IP for it. From the Console config system interface edit "sw" set type switch set ip 1.1.250.1/16 set allowaccess https ping ssh snmp http telnet set member port9 port10 From the GUI 1. On the softswitch configuration page, make the selections and entry as highlighted in Figure 3. 2. Click Save when done. 10 Transparent Mode Configuration Guide
Test the softswitch management IP Configure softswitch management IP Figure 3: Configure softswitch management IP Test the softswitch management IP Once you have set up the management IP of the softswitch, you must test it to make sure that it works properly. Simply run a Ping test against the management IP of the softswitch interface, as illustrated in Figure 4. Transparent Mode Configuration Guide 11
Configure softswitch management IP Test the softswitch management IP Figure 4: Ping softswitch management IP 12 Transparent Mode Configuration Guide
Configure softswitch VLAN sub-interface From the Console Configure softswitch VLAN sub-interface You can create a VLAN sub-interface for the softswitch from either the console or the GUI. From the Console config system interface edit "sw" set type switch set vdom root set ip 1.1.250.1/16 set allowaccess https ping http set member port9 port10 config ha-node-ip-list set traffic-group default edit "vlan100" set type vlan set vdom root set ip 100.1.1.1/16 set allowaccess https ping ssh snmp http telnet set vlanid 100 set interface sw config ha-node-ip-list From the GUI 1. From the navigation bar, click Networking>Interface. 2. On top of the interface table, click Add. 3. Make the entries or selections as highlighted in Figure 5. 4. Click Save when done. 13 Transparent Mode Configuration Guide
Test the softswitch VLAN sub-interface Configure softswitch VLAN sub-interface Figure 5: Configure softswitch VLAN sub-interface Test the softswitch VLAN sub-interface After you have configured the softswitch VLAN sub-interface, you must test it to make sure that it works properly. Simply run a Ping test against the VLAN sub-interface of the softswitch, as inllustrated in Figure 6. Transparent Mode Configuration Guide 14
Configure softswitch VLAN sub-interface Test the softswitch VLAN sub-interface Figure 6: Ping VLAN sub-interface 15 Transparent Mode Configuration Guide
Create a Layer-4 VS in DNAT mode From the Console Create a Layer-4 VS in DNAT mode You can create a Layer-4 DNAT virtual server in transparent mode. From the Console Configure a load-balancing real server FortiADC-VM # config load-balance real-sever FortiADC-VM (real-server)# show config load-balance real-server edit srsl set ip 1.1.1.200 edit "swrs2" set ip 1.1.1.201 FortiADC-VM # config load-balance pool FortiADC_VM (pool) # edit sw_pool FortiADC-VM (sw_pool) # show config load-balance pool edit sw_pool set real-server-ssl-profile NONE config pool_member edit 1 set pool_member_cookie rs1 set real-server srs1 edit 2 set pool_member_cookie rs2 Set real-server swrs2 Configure a load-balancing virtual server config load-balance virtual server edit "SW_L4_DNAT" set type l4-load-balance set packet-forwarding-method NAT set interface sw sett addr-type ipv4 set ip 1.1.1.100 set port 80 16 Transparent Mode Configuration Guide
From the GUI Create a Layer-4 VS in DNAT mode set load-balance-profile LB_PROF_TCP set load-balance-method LB_METHOD_ROUND_ROBIN set load-balance-pool sw_pool From the GUI 1. Configure a real-server pool with two real servers, as illustrated in Figure 7. 2. Configure a virtual sever using DNAT as the packet forwarding method, making sure it references the softswitch interface, as illustrated in Figure 8. Figure 7: Create a real-server pool with two members Transparent Mode Configuration Guide 17
Create a Layer-4 VS in DNAT mode From the GUI Figure 8: Configure a virtual server in DNAT mode and reference to softswitch interface 18 Transparent Mode Configuration Guide
Traffic flow Create a Layer-4 VS in DNAT mode Traffic flow Figure 9 illustrates the network traffic flow when FortiADCis deployed in Layer-4 DNAT mode. Transparent Mode Configuration Guide 19
Create a Layer-4 VS in DNAT mode Traffic flow Figure 9: Layer-4 DNAT mode 20 Transparent Mode Configuration Guide
Create a Layer-7 VS with client address enabled From the Console Create a Layer-7 VS with client address enabled This section discusses how to create a Layer-7 virtual sever with client address enabled in transparent mode. It can be done from either the Console or the GUI. From the Console Configure a load-balancing real server FortiADC-VM # config load-balance real-server FortiADC-VM (real-server) # show config load-balance real-server edit srs1 set ip 1.1.1.200 edit "swrs2" set ip 1.1.1.201 FortiADC-VM # conf load-balance pool FortiADC-VM (pool) # edit sw_pool FortiADC_VM (sw_pool) # show config load-balance pool edit sw_pool set real-server-ssl-profile NONE config pool_member edit 1 set pool_member_cookie rs1 set real-server srs1 edit 2 set pool_member_cookie rs2 set real-server swrs2 Enable client IP address FortiADC-VM (http_client) # show config load-balance profile edit "http_client" set type http set client-address enable 21 Transparent Mode Configuration Guide
From the GUI Create a Layer-7 VS with client address enabled FortiADC-VM (http_client) # FortiADC-VM # conf load-balance virtual-server FortiADC-VM (virtual-sever) # edit sw_l7_vs FortiADC-VM (sw_l7_vs) # show config load-balance virtual-server edit "sw_l7_vs" set interface sw set ip 1.1.1.100 set load-balance-profile http_client set load-balance-method LB_METHOD_ROUND_ROBIN set load-balance-pool sw_pool set traffic-group default From the GUI Configure a application profile 1. Create an application profile. 2. Enable the Source Address (client address), as illustrated in Figure 10. Transparent Mode Configuration Guide 22
Create a Layer-7 VS with client address enabled From the GUI Figure 10: Create an application profile with client IP (Source Address) enabled Configure a Layer-7 virtual server 1. Create a Layer-7 virtual server. 2. Reference to the softswitch interface and the application profile, as illustrated in Figure 11. 23 Transparent Mode Configuration Guide
From the GUI Create a Layer-7 VS with client address enabled Figure 11: Configure a Layer-7 virtual server Transparent Mode Configuration Guide 24
Create a Layer-7 VS with client address enabled From the GUI Traffic flow Figure 12 illustrates the network traffic flow when FortiADC is deployed transparent mode in Layer-7 with client IP address enabled. 25 Transparent Mode Configuration Guide
From the GUI Create a Layer-7 VS with client address enabled Figure 12: Layer-7 with client IP address enabled Transparent Mode Configuration Guide 26
Copyright 2018 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.