In this video, we're going to walk through the process of setting up and using
administrative
domains on the 40 analyzer. So our first step in our game plan will be to
enable that feature
because it's off by default. So we'll enable a DOM support. And then by default
, when we enable
it, we'll have our root item is literally called root. And then all of our
existing firewalls,
when we enable a DOM support, are going to fall into that root a DOM. And then
secondly,
let's go ahead and create a second administrative domain. And let's go ahead
and call it BR1 for
branch one. And then what we can do is move the branch firewall over into and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
branch one. And then what we can do is move the branch firewall over into and
now have it report
to and send logs messages to that specific administrative domain. So going
forward,
new log messages from this branch firewall one will be sent to this new ADOM.
So with that game
plan in place, let's first go into the 40 analyzer, take a look at what
currently is, and we'll go
to work in setting up and enabling ADOMs. So as a quick check here with our top
ology, I've got here
firewall one at headquarters site firewall two firewall three, and also the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewall one at headquarters site firewall two firewall three, and also the
branch firewall.
And I've done different color schemes for each one that way, if we need to go
back to these
interfaces, besides the name at the top left showing which device we're on, it
's also going to be
visually different based on the colors that we're using. So here's our 40 analy
zer. And if
go to the status page, right here on the system information widget, it's
showing details, including
the version. Oh, yeah, I need to remind you, I'm not reminding you to tell you,
I took the liberty
of upgrading from whatever the thing was seven dot four something to seven dot WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of upgrading from whatever the thing was seven dot four something to seven dot
six three, the
latest and greatest feature version as of this recording. And here's what I
discovered along the
way is that every time there's a update with 40 analyzer, sometimes options are
moved. And so I
would encourage you as you're working with whatever flavor and feature of 40
analyzer is that sometimes
if something isn't like where it used to be in a previous version, it's very
likely still there.
And I'm going to be using version 763 going forward with this course to make it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'm going to be using version 763 going forward with this course to make it
as current as possible.
So here under the status dashboard, I've got the system information widget and
right here.
In fact, let me go ahead and expand that full screen. So if we expand that, it
's showing us right
here that the administrative domain feature is currently off right there. And
if we go into
systems, some of these eight items, it's going to show us right here route,
even though we haven't
enabled ADOM support yet. So think of what we're seeing here like the default
behavior. So to
enable ADOMs, we have a couple options. One is we could click right here under
system settings,
ADOMs and click on enable ADOM. It's going to ask us if we want to do that, or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ADOMs and click on enable ADOM. It's going to ask us if we want to do that, or
we could go back to
the dashboard, the status dashboard, and here on system information, which I'll
expand once again,
and we could go ahead and click right here to enable administrative domains.
Either way you
want to do it is perfectly fine under system settings or do it right here. So
let's go ahead
and enable the feature. So we'll click OK. It's going to force us to re log in.
So we'll re log in as admin.
I'll supply the lab password here for this for the analyzer and we'll click on
login. All right,
so now we're logged in. So another way of ADOM support enabled. I'm not just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so now we're logged in. So another way of ADOM support enabled. I'm not just
automatically
taken to my 40 analyzer. Now I have to select which ADOM. So by default, we're
going to go to the
route ADOM and our four devices are still there. So there's also an option
right here to create a
new ADOM if you want to. But before we do that, let me just click right here on
route to go into the
route ADOM also appear in the upper right showing you which ADOM you're in. So
if you need to switch
ADOMs, you click there and choose the other ADOM that you have access to. Now
we don't have
any other ADOMs yet. So we'll fix that here in a moment. And so if we go now to
device manager, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
device manager,
here in our device manager, you're showing us all of our 48 firewall serves the
branch firewall one
and then the headquarters firewall one, two and three, which are part of the
same
Fortinet security fabric. And that's why they're all grouped together under
this security fabric.
Also, if we went down to system settings and clicked on ADOMs, it also
indicates here now,
then on our route ADOM, we have those four devices and there's different types
of ADOMs for different
devices that report in. So there's a long list here that we can see and we're
going to be putting
all of our ADOMs into a ADOM type of fabric because that's what 40 gates would WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all of our ADOMs into a ADOM type of fabric because that's what 40 gates would
report into.
So to create a new administrative domain, what we can do is click here and we
can click on
create new ADOM. That's one option or we can simply right here click on create
new to create a new ADOM
or when we log in and are selecting the ADOM, there's the option to create new
there as well.
So let's create a new administrative domain. And based on our plan, we're going
to go ahead and call
this BR1 dash ADOM. And the type we want to make is fabric because that's the
type that a 40 gate
is going to send messages to. So select the type of fabric which is the default WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to send messages to. So select the type of fabric which is the default
and then we get to
go ahead and select our device. So right now, if we wanted to bring over the
branch firewall, we could
or we did a subsequent step. Also, there's details regarding the data policy
for how long we're going
to keep the data before it gets archived and dyskeletalization. So I'm going to
take all those
defaults and click on OK. So it's creating this new administrative domain
called BR1 dash ADOM.
And here it is right here. So so currently I'm logged on as admin with full
access. So if we
wanted to change administrative domains, I can click on the ADOM up here, click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
wanted to change administrative domains, I can click on the ADOM up here, click
on BR1 dash ADOM,
and then click right here on our brand new administrative domain called BR1
dash ADOM.
And it would take us to that now. Unfortunately, there's not going to be
logging here because
nobody's reporting to this. So if we go to device manager and look at logging
devices,
there's nothing here because this is the brand new ADOM and we haven't
configured any of our
firewalls to report to this logical ADOM. So there's a couple of different ways
we can bring
in device in one is to go system settings and ADOMs and then select this ADOM.
And with the selected,
we can click on edit. And then from here, we can select the device we want to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can click on edit. And then from here, we can select the device we want to
bring in. So we'll
select the device and we want to bring in our branch firewall one, which is
this guy right there.
We'll go ahead and click on OK, then click on OK again to confirm. And now it's
bringing in
that new device. Now the logging information is not yet coming in. So the
logging information
from our branch firewall, let's look at the topology for a moment together. So
the branch
firewall is right here. Any existing logs that had sent previously are part of
that root ADOM still,
but any new logs that are being sent are going to become part of that new WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but any new logs that are being sent are going to become part of that new
branch one ADOM we just
created. So to confirm that, let's go back to device manager. So here we have
our BR1-ADOM. We
have one device that's the branch firewall. Fantastic. So if we went to log
view and went to logs,
and the interface looks a little bit different based on the flavor we're using
here. So if I
click here on toggle horizontal menu, it's going to go ahead and put those Fort
nite logs and log
browse on the top. So here's the tab for 40 analyzer, it's logs. And here's the
48 firewall logs. And
this is the new logs that are now coming in as of just a few minutes ago when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this is the new logs that are now coming in as of just a few minutes ago when
we added branch firewall
one to report to this brand new ADOM. So currently it's showing here for the
last four hours, let's
go ahead and say last five minutes. And let me bring up that computer with AD
user seven,
let's generate some new traffic just to verify it's showing up in the correct
ADOM here. So here
is PC seven. And let me go ahead and close the browser. I'm going to reopen it
here. Oh, also,
it looks like I'm doing some pings in the background. Let me go ahead and close
that,
close the terminal. And let's go out to YouTube. So we'll go ahead and let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
close the terminal. And let's go out to YouTube. So we'll go ahead and let's
watch a video. So that
video is playing and all this log information regarding this traffic going
through the branch
firewall should now show up in this ADOM called BR one dash eight on because
that's the aid on
this branch firewall is reporting to you. So you go ahead and close the browser
, let me minimize that.
And here with logs, it sure is currently set for the last five minutes. Let me
do a refresh. Another
option here, we could also go to more and say real time logs, and that will
just feed in new log
information as it comes up. And so it's going to push down those log messages WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information as it comes up. And so it's going to push down those log messages
as new one comes in,
or we could pause it right here. Again, that's what the real time logs, or we
could go to more
and go to historical log and just take a look at the historical logs for the
last five minutes.
And they want to refresh, we could do that as well. And so they're showing us
our YouTube traffic
that we just generated. So if we switched ADOMs, now went back to the root ADOM
, and we looked at
the same information in the log view, logs, for net logs, and with Fortigate
selected. And we said,
let's look at the last five minutes here and click down refresh. We asked some WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's look at the last five minutes here and click down refresh. We asked some
YouTube traffic,
but it's coming from a different client. So we double click on this and take a
look at the
details here. This is coming from the source address of 1030 103, and that's
coming from PC3,
and being reported by HQ firewall three. So the other PC3 is also doing some
YouTube traffic,
but the YouTube traffic coming from PC7 is not showing up here in this ADOM
anymore,
the root ADOM, because it's been assigned to the other ADOM. So the next step
now is if we have a
separate administrator who's in charge of the branch firewall, we'd also want WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
separate administrator who's in charge of the branch firewall, we'd also want
to set up permissions
for that new administrator to just see the contents of that new ADOM called BR1
-ADOM.
So back here at the Porti Analyzer, under system settings, we go to
administrators,
let's create a new branch administrators. We'll click here and create new
administrator,
and let's go ahead and call this branch admin. We'll give them a password here.
We'll confirm
the password. And then here is where we're going to specify what that new
administrator has access
to. So instead of saying all ADOMs, we'll go ahead and click on specify, and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to. So instead of saying all ADOMs, we'll go ahead and click on specify, and
then we'll choose
the ADOM that we want to get information to. So let's go ahead and give them
permission for
BR1-ADOM. We'll click on OK. And then for the admin profile, let's go ahead and
specify
restricted user effectively. They're restricted to that specific ADOM. If we
chose super user,
it's going to give them access to all ADOMs. So we'll go back to restricted
user. So we're
going to go back to specify single ADOM. And then once again, choose the ADOM,
we want to give
them access to now we'll click on OK there. And then for the theme, let's go
ahead and use
their own theme. Let's change the theme. So it's very different. When we look
at it, let's go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at it, let's go ahead
and use how about that one. Fantastic. And we'll click on OK. So now if we log
in as branch admin,
branch admin will only have access to that specific ADOM. So we'll go to admin,
we'll log out,
we'll log in as branch admin, I'll specify the password, and we'll click on
login. So the
background has changed. Fantastic. And as far as ADOMs are concerned, that
administrator is
logged into this specific ADOM. So if we get a log view here and logs and
select 40 gate, the
only firewall that sending messages to this ADOM and log messages is branch WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
only firewall that sending messages to this ADOM and log messages is branch
firewall one. So
everything here in log view is going to be associated with that specific
firewall. And that's all this
administrator branch admin can get to. So now go ahead and log out. Let me log
back as admin. I'll
supply the password, we'll click on login. And for the benefit of not having to
go back and forth,
I'm going to go back to the root ADOM as the King Kong user here admin. Then I
'm going to go to
system settings and ADOMs, select the root, click on edit. And let's bring in
the branch firewall,
that way going forward, all of our logs will be in the root ADOM. So click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that way going forward, all of our logs will be in the root ADOM. So click on
select device,
there's our branch firewall, click on OK, click on OK, and it's bringing it in.
So now there's four
devices, if we go to device manager, it's showing all four devices as belonging
to this root ADOM.
So going forward in the course, we'll see now the content, the logs from all
four of our 48
firewalls being sent to the root ADOM. And just for grins, now if we get a log
view and logs and
with 40 gate selected here, and then from drop down is reporting on all devices
, let's go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
, let's go ahead
and just for a moment remove that and say I only want to see logs coming in
from this specific
48 our branch firewall, click on OK. I'll also just play here with clicking on
more that I want to
see the real time logs. And then we'll just wait for a second and verify that
new traffic is showing
up because we currently have the traffic log selected. And there we go, there's
some new updates
right there. And that looks like the 48 itself, let me also generate some more
traffic from PC7.
So here's PC7, let's open up a browser, let's go to some social media sites,
let's go ahead and do
fast.com, which is simulating Netflix traffic, fantastic. And let's also go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
fast.com, which is simulating Netflix traffic, fantastic. And let's also go
ahead and go to YouTube
and let's also go ahead and go to sales force. So all that traffic based on the
traffic logs
should now be showing up at the 40 analyzer in the root ADOM because branch
firewall one is now
part of that root ADOM. Let me close the browser, minimize the clients and with
the real time logs,
here they come pouring in right there. So the quick review to enable ADOMs, we
'd go ahead under
status and make sure that ADOMs is enabled, which we can do right here under WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
status and make sure that ADOMs is enabled, which we can do right here under
the system
information widget or under system settings ADOMs, we can go ahead and enable
it here if it
isn't already enabled. And then to create new ADOMs right here in our system
settings ADOMs,
we could create new or when you log in as a super user, there's the opportunity
to select the ADOM
you want to jump into, or you can also create new ADOMs right from there. And
then as we manage
and work with ADOMs and edit them, that's the point where we can go ahead and
add additional
48 firewalls or other devices to report into a specific ADA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
48 firewalls or other devices to report into a specific ADA.