Lab Setup

Setting Up & Installation

• For this lab, I used EVE-NG to emulate a simple network environment. I downloaded and installed the following:

  • Eve-ng community edition from their website: https://www.eve-ng.net/index.php/download/

  • Eve-ng windows client side (Optional, for wireshark and vnc for windows machiens)

  • FileZilla (To transfer the object files through FTP)

  • OS Images, you can find these online, I got some from here, https://drive.google.com/file/d/1M9LGlev0IgXNQvCbrqtGcAdTJTRIMZLX/view and others like the fortigate firewall I downloaded manually (More on that below)

• After creating the VM in VMware and completing the setup, I logged in to the console using root:eve. When accessing the web GUI, use admin:eve, I spent several minutes trying to log in as root before realizing no error message appears to indicate the correct credentials.

Importing OS Images

• To add devices (switches, routers, PCs, etc.), first import their OS images:

• On the EVE-NG VM, navigate to /opt/unetlab/addons/, which contains three subfolders:

  • dynamips (Cisco routers)

  • iol (Linux-based images)

  • qemu (other generic images)

• Each image must follow a specific naming convention. For example, for FortiGate:

  • Download the KVM file from the FortiGate support site.

  • Check the naming convention at https://www.eve-ng.net/index.php/documentation/qemu-image-namings/ (for FortiGate, it should be virtioa.qcow2).

  • Rename the file to virtioa.qcow2.

  • Create a new folder under /opt/unetlab/addons/qemu/ named fortinet-FGT-7.2.11/, grant it full permissions (chmod 777), and place the renamed file there.

FortiGate KVM

Setting up Local Network

• My simple local network setup included:

  • 1 FortiGate firewall

  • 1 core switch

  • 2 additional switches

  • 4 PCs (2 connected to each switch)

  • 1 management network (to simulate WAN for FortiGate)

• This is how the topology should look:

Simple Topology

• Right-click the workspace, choose Network, then Management to add the management network.

• Add the four PCs, then the switches, and finally the FortiGate.

• While all devices are powered off, connect them as per the diagram.

• Power on all devices and begin configuration.

Fortigate Setup

• Log in to verify the license.

• Navigate to Network -> Interfaces.

  • Port1: WAN (no additional configuration needed).

  • Port2:

    • Role: LAN

    • Addressing Mode: Manual

    • IP/Netmask: 192.168.1.1/255.255.255.0

    • DHCP Server: On

    • Address Range: 192.168.1.100 to 192.168.1.200

    • Default Gateway: 192.168.1.1

    • DNS Server: “Same as System DNS” or specify (8.8.8.8, 8.8.4.4)

• Configure a firewall policy to allow LAN-to-WAN access:

  • Go to Policy & Objects → IPv4 Policy.

  • Click Create New.

    • Name: LAN_to_WAN_Access

    • Incoming Interface: Port2 (LAN_Network)

    • Outgoing Interface: Port1 (WAN)

    • Source: All

    • Destination: All

    • Schedule: Always

    • Service: ALL (for lab simplicity)

    • Action: ACCEPT

    • NAT: Enabled (“Use Outgoing Interface Address”)

    • Log Allowed Traffic: Enable all sessions or security events

Switch Configuration

On each switch I had to do some configurations,

Main Switch

enable
configure terminal

! Port to FortiGate LAN (port2)
interface G0/2
 description Link-to-FortiGate-LAN
 switchport mode access
 spanning-tree portfast
 no shutdown
exit

! Port to Switch 2
interface G0/0
 description Link-to-SW2
 switchport mode access
 no shutdown
exit

! Port to Switch 3
interface G0/1
 description Link-to-SW3
 switchport mode access
 no shutdown
exit

end
write memory

Switch 1

enable
configure terminal

! Port to Main Switch (SW1)
interface G0/0
 description Link-to-SW1
 switchport mode access
 no shutdown
exit

! Ports for PCs
interface G0/1
 description To-PC1
 switchport mode access
 spanning-tree portfast
 no shutdown
exit

interface G0/2
 description To-PC2
 switchport mode access
 spanning-tree portfast
 no shutdown
exit

end
write memory

Switch 2

enable
configure terminal

! Port to Main Switch (SW1)
interface G0/0
 description Link-to-SW1
 switchport mode access
 no shutdown
exit

! Ports for PCs
interface G0/1
 description To-PC3
 switchport mode access
 spanning-tree portfast
 no shutdown
exit

interface G0/2
 description To-PC4
 switchport mode access
 spanning-tree portfast
 no shutdown
exit

end
write memory

• Once complete, each device should have its own IP address and be able to communicate with the rest of the network and access the internet.