SD-WAN Fortinet Solution Deployment / Configuration Guide

The following steps apply to perform an installation from scratch of the Fortinet solution on SevOne NMS.

1. Using ssh, login to SevOne NMS appliance as support.

   ssh support@<SevOne NMS appliance IP address>

2. To install the spk files, execute the following commands in the sequence as shown below.
   • For a list of containers and its ids, run the following command.

     podman ps

   • Go to SevOne NMS container.

     podman exec -it <nms_container_id_or_name>/bin/bash

   • Make a directory Fortinet under the /tmp folder and change the directory to /tmp/Fortinet.

     
     cd /tmp/
     
     mkdir Fortinet
     
     cd /tmp/Fortinet

3. Download the following (latest) files from IBM Passport Advantage (https://www.ibm.com/software/passportadvantage/pao_download_software.html) via Passport Advantage Online. However, if you are on a legacy / flexible SevOne contract and do not have access to IBM Passport Advantage but have an active Support contract, please contact IBM SevOne Support for the latest files. You must place <tar/zip> files in /tmp/Fortinet directory.
   1. sdwan-fortinet-installation-v7.2.0-build.<###>.tgz
   2. sdwan-fortinet-installation-v7.2.0-build.<###>.tgz.sha256.txt
   3. signature-tools-<latest-version>-build.<latest>.tgz
   4. signature-tools-<latest-version>-build.<latest>.tgz.sha256.txt
4. Execute the following commands to verify the checksum of the code signing tool before extracting it.

   
   (cd /tmp/Fortinet && cat $(ls -Art signature-tools-*.tgz.sha256.txt | \
   tail -n 1) | sha256sum --check)
   
   sudo tar xvfz $(ls -Art /tmp/Fortinet/signature-tools-*.tgz | \
   tail -n 1) -C /tmp/Fortinet

5. Verify the signature of Solutions .tgz files.

   sh usr/local/sbin/SevOne-validate-image \
   -i $(ls -Art /tmp/Fortinet/sdwan-*.tgz | tail -n 1) \
   -s $(ls -Art /tmp/Fortinet/sdwan-*.tgz.sha256.txt | tail -n 1)

6. Make a directory. For example, sdwan-fortinet-installation.

   mkdir /tmp/Fortinet/sdwan-fortinet-installation

7. Extract the latest build.

   tar xvfz $(ls -Art /tmp/Fortinet/sdwan-*.tgz | \
   tail -n 1) -C /tmp/Fortinet/sdwan-fortinet-installation 

   You will see the following files in the directory.

   • Fortigate.MIBs.spk - it imports two Fortigate MIB files (FORTINET-CORE-MIB.mib and FORTINET-FORTIGATE-MIB.mib).
   • Fortigate.Certification.spk - it creates one device type Fortinet Fortigate and 58 object types suffixed with (Fortinet Fortigate).
   • Fortigate.Interface.SubType.Rules.spk - it imports the interface subtype rules to allow mapping the subtypes.
   • Fortigate.Metadata.Schema.spk - it imports the metadata schema for Fortigate devices.
   • Fortigate.DeviceGroups.spk - it creates 4 device groups.
   • Fortigate.ObjectGroups.spk - it creates 1 object group class (Fortigate) and 6 Object Groups underneath it.
   • SDWAN_Solution_Fortinet_Alerts_v1-1.spk - it imports 3 alert policies. All policies are imported as disabled by default.
   • Fortigate.TopN.spk - it imports 17 TopN Report views.
8. Change the directory to /tmp/Fortinet/sdwan-fortinet-installation.

   cd /tmp/Fortinet/sdwan-fortinet-installation

9. Please check the following for existing Device Types and Object Types.
   • (if available) Delete existing Device Type Fortigate which is available under Generic.
   • (if available) Delete existing Object Types suffixed by (Fortigate) to prevent the creation of duplicate objects.
10. Import the following spk files, run the commands in the following sequence.
    1. Fortinet Fortigate MIBs

       SevOne-import --allow-overwrite --file Fortigate.MIBs.spk

    2. Device Type and Object Types

       SevOne-import --allow-overwrite --file Fortigate.Certification.spk

    3. Interface Subtype Rules

       SevOne-import --allow-overwrite --file Fortigate.Interface.SubType.Rules.spk

    4. Metadata Schema

       SevOne-import --allow-overwrite --file Fortigate.Metadata.Schema.spk

    5. Device Groups

       SevOne-import --allow-overwrite --file Fortigate.DeviceGroups.spk

    6. Object Groups

       SevOne-import --allow-overwrite --file Fortigate.ObjectGroups.spk

    7. Alert Policies

       SevOne-import --allow-overwrite --file SDWAN_Solution_Fortinet_Alerts_v1-1.spk

       The following is the list of alerts imported.

       • Fortigate - Performance SLA - Latency - 3 Std Dev
       • Fortigate - Performance SLA - Jitter - 6 Std Dev
       • Fortigate - Performance SLA - Packet Loss - 10 Percent
       Important: All alerts are disabled by default.

To onboard Fortinet devices in SevOne NMS, execute the following steps.

1. Using a web browser of your choice, enter the URL for the SevOne NMS appliance. Enter the credentials and click Login.

   

   

2. From the navigation bar, click the Devices menu and select Device Manager.

   

3. Click Add Device to create a new device.

   

4. On the New Device page, add the following details.

   

   1. In the Name field, enter the device name.
   2. In the Alternate Name field, enter an alternate device name. You can search for a device by its alternate name.
   3. In the Description field, enter the device description. You can use this to provide additional information about the function, location, or any other pertinent information about the device.
   4. In the IP Address field, enter the device IP address.
   5. Click the plugin drop-down. By default, it is set to SNMP. Select SDWAN.
      1. Select the Enable SDWAN API Integration check box.

         

      2. Click the Vendor drop-down and select the FortiManager option.
      3. In the FortiManager URL field, enter the URL for SDWAN vendor, FortiManager.
      4. In the Username field, enter the username for SDWAN vendor, FortiManager.
      5. In the Password field, enter the password for SDWAN vendor, FortiManager.
      6. Enable field Auto-discover and monitor associated FortiGates - Use SNMP Plugin to automatically discover and monitor FortiGate devices.
   6. Once the SD-WAN plugin details are entered, select the SNMP plugin from the plugin drop-down menu.

      

   7. Ensure that the field SNMP Capable check box is selected to enable the discovery of SNMP object types and to poll SNMP data on the device.
   8. In the Version field and select the version. For example, select 3 from the available options in the drop-down list.
   9. Enter credentials (Username & Password) for FortiGate devices. (Make sure to have same SNMP credentials for all Fortigate Devices)
   10. Select other options and click Save As New to save the current changes as a New Device. This device is then queued for discovery.
   11. A new device has been added to the Device Manager screen.
   12. Click the Devices menu and select Discovery Manager. Here, you will see that thedevice is in the discovery queue.
   13. After the discovery process is completed, FortiGate devices will be visible on the Device Manager screen.

       

   14. To retrieve the metadata of a FortiGate device, execute the steps below.
       1. Choose a device from the list that you wish to view the metadata for.
       2. Click in the Actions column to open the Edit Metadata pop-up.
       3. In the Edit Metadata pop-up, locate the section SDWAN_DEVICES to find the metadata fields.

          

   15. To retrieve the metadata of a Fortinet Fortigate object, follow these steps.
       1. From the navigation bar, click the Devices menu and select Object Manager.
       2. Select an object from the list with the type Virtual WAN Link/Virtual WAN Link (Fortinet Fortigate) or Interface/Interface (Fortinet Fortigate) for which you wish to view metadata for.
       3. Click in the Actions column to open the Edit Metadata pop-up.

          

SevOne-import --allow-overwrite --file Fortigate.TopN.spk

1. Log in to your SevOne Data Insight by navigating to the appropriate URL in your web browser. Enter your credentials on the login page and click Login.
2. On the Report Manager screen, click Reports and then click on SevOne Folders.

   

3. Under SevOne Folders, select Fortinet folder from the SD-WAN drop-down list.

   

4. Select the Fortinet Report displayed. You can either click on the Run button as shown below or click on the report link directly to view detailed OOTB reports.

   

   Note: The following reports get imported.

   • Fortigate Device Summary
   • Fortigate Interface Summary
   • Fortigate Performance SLA Tests
   • Fortigate Tunnel Summary
   • Fortinet Fortigate Dashboard