■約4.8GBの空きメモリに収まるように無理やりFortiSandboxを起動するまで。 FortiSandbox-VM版には評価ライセンスは含まれていない。 代理店に申請するFortiSandbox-VM評価ライセンスの他、 MS Windows XPor7(評価版にも含まれる？)や、 Office2010or2013のライセンスが必要。 $ wget http://docs.fortinet.com/uploaded/files/2107/fortisandbox-vm-vmware-install-guide.pdf $ pdftotext fortisandbox-vm-vmware-install-guide.pdf - | grep -A 2 ^IP.*license IP information in the license file. If a new license has been imported or the FortiSandbox VM’s IP address has been changed, the FortiSandbox VM must be rebooted in order for the system to validate the change and operate with a valid license. ■ホストOSの物理メモリの空き容量は以下。 $ free | awk '/^Mem/{print $3/1024/1024"GB"}' 4.87477GB ■OVFテンプレートzipの解凍 $ ls *.zip | awk -F\- '{print "mkdir "$1";cd "$1";unzip ../"$0";cd .."}' | sh Archive: ../FGT_VM64-v5-build0670-FORTINET.out.ovf.zip inflating: datadrive.vmdk inflating: FortiGate-VM64.ovf inflating: FortiGate-VM64.hw04.ovf inflating: FortiGate-VM64.hw07_vmxnet2.ovf inflating: FortiGate-VM64.hw07_vmxnet3.ovf inflating: fortios.vmdk Archive: ../FSA_VM-v200-build0042-FORTINET.out.ovf.zip inflating: datadrive.vmdk inflating: FortiSandbox-VM.ovf inflating: fsa.vmdk ■Fortigate-VMのメモリは減らせない。 FortiAnalyzer-VM(x86)のメモリを2GBから512MBに。 FortiSandbox-VM(x64)のメモリを8GBから3GBに。 計、4.5GBのメモリを使用する想定。 $ sed -i -e 's/2048/512/g' FAZ_VM64/FortiAnalyzer-VMi64.ovf $ sed -i 's/8192/3072/g' FSA_VM/FortiSandbox-VM.ovf ■OVFテンプレートの記述間違いを修正 $ sed -i -e 's/VirtualSCSI/lsilogic/g' FAZ_VM64/FortiAnalyzer-VM64.ovf $ sed -i -e 's/vmkernel5Guest/other26xLinuxGuest/g' FSA_VM/FortiSandbox-VM.ovf ■OVFをVMXに変換 $ echo */ | tr ' ' '\n' | awk -F\/ '{print "test -d "$1"_VMX || mkdir "$1"_VMX;cp "$1"/*.vmdk "$1"_VMX"}' | sh $ ls */*VM.ovf */*64.ovf | awk -F\. '{print "ovftool --skipManifestGeneration --acceptAllEulas "$0" "$1".vmx"}' | \ sed -e 's%/[A-z0-9\-]*.vmx%_VMX&%g' | sh Opening OVF source: FAZ_VM64/FortiAnalyzer-VM64.ovf Opening VMX target: FAZ_VM64_VMX/FortiAnalyzer-VM64.vmx Writing VMX file: FAZ_VM64_VMX/FortiAnalyzer-VM64.vmx Transfer Completed Warning: - No manifest file found. - Wrong file size specified in OVF descriptor for 'datadrive.vmdk' (specified: 75264, actual 10551808). - No manifest entry found for: 'faz.vmdk'. - No manifest entry found for: 'datadrive.vmdk'. Completed successfully Opening OVF source: FGT_VM64/FortiGate-VM64.ovf Opening VMX target: FGT_VM64_VMX/FortiGate-VM64.vmx Writing VMX file: FGT_VM64_VMX/FortiGate-VM64.vmx Transfer Completed Warning: - No manifest file found. - No manifest entry found for: 'fortios.vmdk'. - No manifest entry found for: 'datadrive.vmdk'. Completed successfully Opening OVF source: FSA_VM/FortiSandbox-VM.ovf Opening VMX target: FSA_VM_VMX/FortiSandbox-VM.vmx Writing VMX file: FSA_VM_VMX/FortiSandbox-VM.vmx Transfer Completed Warning: - No manifest file found. - Wrong file size specified in OVF descriptor for 'fsa.vmdk' (specified: 1073741824, actual 104059392). - No manifest entry found for: 'fsa.vmdk'. - No manifest entry found for: 'datadrive.vmdk'. Completed successfully ■Fortigateは3NIC、 FortiAnalyzerは2NIC、 FortiSandboxは4NICの計9NICとする。 $ sed -i -e 's/ethernet[3-9]/#&/' FGT_VM64_VMX/FortiGate-VM*.vmx $ sed -i -e 's/ethernet[2-9]/#&/' FAZ_VM64_VMX/FortiAnalyzer-VM64.vmx $ sed -i -e 's/ethernet[5-9]/#&/g' FSA_VM_VMX/FortiSandbox-VM.vmx ■内部はブリッジ、DMZはvmnet1、外部はvmnet8とする。 $ netstat -i | awk '/^[ev]/{print "ip a list "$1}' | sh | \ awk '/^[0-9]/ || /inet /{print $2}' | tr -d '\n' | sed -e 's%/[0-9]*%&\n%g' eth0:172.31.31.90/24 vmnet1:172.16.76.1/24 vmnet8:192.168.152.1/24 ■vmplayerで起動 $ ls */*.vmx | awk '{print "vmrun -T player start "$0}' | sh ■Fortigate-VM/FortiAnalyzer-VMの共通設定 config system global set timezone 60 set language japanese end ■Fortigate-VMの設定 execute formatlogdisk config system interface edit "port1" set ip 172.31.31.11 255.255.255.0 set allowaccess ping https ssh http telnet fgfm next edit "port2" set ip 172.16.76.11 255.255.255.0 next edit "port3" set ip 192.168.152.11 255.255.255.0 next edit "port4" set status down next edit "port5" set status down next edit "port6" set status down next edit "port7" set status down next edit "port8" set status down next edit "port9" set status down next edit "port10" set status down next end config router static edit 0 set dst 172.31.31.0 255.255.255.0 set gateway 172.31.31.254 set device port1 next edit 0 set device port3 set gateway 192.168.152.254 next end config log fortianalyzer setting set status enable set server 172.31.31.12 set source-ip 172.31.31.11 set upload-option realtime end ■FortiAnalyzerの設定 以下を設定後、GUI接続で未登録デバイスを登録。 config system interface edit "port1" set ip 172.31.31.12 255.255.255.0 set allowaccess ping https ssh http telnet fgfm next edit "port2" set status down next edit "port3" set status down next edit "port4" set status down next end config system route edit 0 set dst 172.31.31.0 255.255.255.0 set gateway 172.31.31.254 set device port1 next end ■FortiSandboxの設定 以下を設定してGUI接続。というよりGUIでしか設定出来ない項目が多い印象。 なお、「v2.02,build0042 (GA)」では日本語に変更する箇所が見つからなかった。 > set port1-ip 172.31.31.13/255.255.255.0 > set default-gw 172.31.31.254 ■FortigateからSandboxへの最小限の接続設定 config system fortisandbox set status enable set server 172.31.31.13 end
