読者です 読者をやめる 読者になる 読者になる

labunix's blog

labunixのラボUnix

約4.8GBの空きメモリに収まるように無理やりFortiSandboxを起動するまで。

■約4.8GBの空きメモリに収まるように無理やりFortiSandboxを起動するまで。
 FortiSandbox-VM版には評価ライセンスは含まれていない。
 代理店に申請するFortiSandbox-VM評価ライセンスの他、
 MS Windows XPor7(評価版にも含まれる?)や、
 Office2010or2013のライセンスが必要。

$ wget http://docs.fortinet.com/uploaded/files/2107/fortisandbox-vm-vmware-install-guide.pdf
$ pdftotext fortisandbox-vm-vmware-install-guide.pdf - | grep -A 2 ^IP.*license
IP information in the license file. If a new license has been imported or the FortiSandbox VM’s IP
address has been changed, the FortiSandbox VM must be rebooted in order for the system to
validate the change and operate with a valid license.

■ホストOSの物理メモリの空き容量は以下。

$ free | awk '/^Mem/{print $3/1024/1024"GB"}'
4.87477GB

■OVFテンプレートzipの解凍

$ ls *.zip | awk -F\- '{print "mkdir "$1";cd "$1";unzip ../"$0";cd .."}' | sh
Archive:  ../FGT_VM64-v5-build0670-FORTINET.out.ovf.zip
  inflating: datadrive.vmdk          
  inflating: FortiGate-VM64.ovf      
  inflating: FortiGate-VM64.hw04.ovf  
  inflating: FortiGate-VM64.hw07_vmxnet2.ovf  
  inflating: FortiGate-VM64.hw07_vmxnet3.ovf  
  inflating: fortios.vmdk            
Archive:  ../FSA_VM-v200-build0042-FORTINET.out.ovf.zip
  inflating: datadrive.vmdk          
  inflating: FortiSandbox-VM.ovf     
  inflating: fsa.vmdk                

■Fortigate-VMのメモリは減らせない。
 FortiAnalyzer-VM(x86)のメモリを2GBから512MBに。
 FortiSandbox-VM(x64)のメモリを8GBから3GBに。
 計、4.5GBのメモリを使用する想定。

$ sed -i -e 's/2048/512/g' FAZ_VM64/FortiAnalyzer-VMi64.ovf
$ sed -i 's/8192/3072/g' FSA_VM/FortiSandbox-VM.ovf

■OVFテンプレートの記述間違いを修正

$ sed -i -e 's/VirtualSCSI/lsilogic/g' FAZ_VM64/FortiAnalyzer-VM64.ovf 
$ sed -i -e 's/vmkernel5Guest/other26xLinuxGuest/g' FSA_VM/FortiSandbox-VM.ovf 

■OVFをVMXに変換

$ echo */ | tr ' ' '\n' | awk -F\/ '{print "test -d "$1"_VMX || mkdir "$1"_VMX;cp "$1"/*.vmdk "$1"_VMX"}' | sh
$ ls */*VM.ovf */*64.ovf | awk -F\. '{print "ovftool --skipManifestGeneration --acceptAllEulas "$0" "$1".vmx"}' | \
    sed -e 's%/[A-z0-9\-]*.vmx%_VMX&%g' | sh
Opening OVF source: FAZ_VM64/FortiAnalyzer-VM64.ovf
Opening VMX target: FAZ_VM64_VMX/FortiAnalyzer-VM64.vmx
Writing VMX file: FAZ_VM64_VMX/FortiAnalyzer-VM64.vmx
Transfer Completed                    
Warning:
 - No manifest file found.
 - Wrong file size specified in OVF descriptor for 'datadrive.vmdk' (specified: 75264, actual 10551808).
 - No manifest entry found for: 'faz.vmdk'.
 - No manifest entry found for: 'datadrive.vmdk'.
Completed successfully
Opening OVF source: FGT_VM64/FortiGate-VM64.ovf
Opening VMX target: FGT_VM64_VMX/FortiGate-VM64.vmx
Writing VMX file: FGT_VM64_VMX/FortiGate-VM64.vmx
Transfer Completed                    
Warning:
 - No manifest file found.
 - No manifest entry found for: 'fortios.vmdk'.
 - No manifest entry found for: 'datadrive.vmdk'.
Completed successfully
Opening OVF source: FSA_VM/FortiSandbox-VM.ovf
Opening VMX target: FSA_VM_VMX/FortiSandbox-VM.vmx
Writing VMX file: FSA_VM_VMX/FortiSandbox-VM.vmx
Transfer Completed                    
Warning:
 - No manifest file found.
 - Wrong file size specified in OVF descriptor for 'fsa.vmdk' (specified: 1073741824, actual 104059392).
 - No manifest entry found for: 'fsa.vmdk'.
 - No manifest entry found for: 'datadrive.vmdk'.
Completed successfully

■Fortigateは3NIC、
 FortiAnalyzerは2NIC、
 FortiSandboxは4NICの計9NICとする。

$ sed -i -e 's/ethernet[3-9]/#&/' FGT_VM64_VMX/FortiGate-VM*.vmx
$ sed -i -e 's/ethernet[2-9]/#&/' FAZ_VM64_VMX/FortiAnalyzer-VM64.vmx
$ sed -i -e 's/ethernet[5-9]/#&/g' FSA_VM_VMX/FortiSandbox-VM.vmx 

■内部はブリッジ、DMZはvmnet1、外部はvmnet8とする。

$ netstat -i | awk '/^[ev]/{print "ip a list "$1}' | sh | \
    awk '/^[0-9]/ || /inet /{print $2}' | tr -d '\n' | sed -e 's%/[0-9]*%&\n%g'
eth0:172.31.31.90/24
vmnet1:172.16.76.1/24
vmnet8:192.168.152.1/24

■vmplayerで起動

$ ls */*.vmx | awk '{print "vmrun -T player start "$0}' | sh

■Fortigate-VM/FortiAnalyzer-VMの共通設定

config system global
    set timezone 60
    set language japanese
end

■Fortigate-VMの設定

execute formatlogdisk

config system interface
    edit "port1"
        set ip 172.31.31.11 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm
    next
    edit "port2"
        set ip 172.16.76.11 255.255.255.0
    next
    edit "port3"
        set ip 192.168.152.11 255.255.255.0
    next
    edit "port4"
        set status down
    next
    edit "port5"
        set status down
    next
    edit "port6"
        set status down
    next
    edit "port7"
        set status down
    next
    edit "port8"
        set status down
    next
    edit "port9"
        set status down
    next
    edit "port10"
        set status down
    next
end
config router static
    edit 0
        set dst 172.31.31.0 255.255.255.0
        set gateway 172.31.31.254
        set device port1
    next
    edit 0
        set device port3
        set gateway 192.168.152.254
    next
end
config log fortianalyzer setting
    set status enable
    set server 172.31.31.12
    set source-ip 172.31.31.11
    set upload-option realtime
end

■FortiAnalyzerの設定
 以下を設定後、GUI接続で未登録デバイスを登録。

config system interface
    edit "port1"
        set ip 172.31.31.12 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm
    next
    edit "port2"
        set status down
    next
    edit "port3"
        set status down
    next
    edit "port4"
        set status down
    next
end
config system route
    edit 0
        set dst 172.31.31.0 255.255.255.0
        set gateway 172.31.31.254
        set device port1
    next
end

■FortiSandboxの設定
 以下を設定してGUI接続。というよりGUIでしか設定出来ない項目が多い印象。
 なお、「v2.02,build0042 (GA)」では日本語に変更する箇所が見つからなかった。

> set port1-ip 172.31.31.13/255.255.255.0
> set default-gw 172.31.31.254

■FortigateからSandboxへの最小限の接続設定

config system fortisandbox
    set status enable
    set server 172.31.31.13
end