Lab Notes And Processes

Question 1

Script Types and When To sync

Answer 1

Remote via CLI: Directly to Device Target. Does not need sync to take effect. Device Layer will automatically retrieve changes to config with Auto-Sync

Device Database: Needs to sync Device layer to device to take effect. Recommended to install both device and policy layer to avoid Unknown status for policy layer

Policy Script: Needs to sync policy layer to device to take effect

Question 2

ZTP

Answer 2

Zero Touch Provisioning:

Involves settings up Metadata variables and a Pre-run CLI template. Pre-run CLI is used since it unassigns itself from the device after being used. The meta data varaibles are used to set common things like gateway IPs, port IPs, and Hostname

Then add model device to assign values to the variables and assig Pre-run CLI template to the model. The model will show as unknown device layer and never install policy layer. Run Quick install(Device DB) to apply the template to the model. Template unassigns once done, and Policy status will update, but still have modified status. Must install policy DB.

Just have to adjust real device to have a port with fmgr access, static route to fmgr, and set the fortimanager IP under central management. Then execute registration of fmger, this connects the device to fmgr and begins provisioning process, AKA autolinking

Question 3

Enable VDOMs

Answer 3

On System Information Dashboard of Device > Edit VDOM > Set to Multi-VDOM

Question 4

Default Priority for Virtual Cluster

Answer 4

128

Question 5

Does FGSP sync configuration?

Answer 5

No

Question 6

Session Sync Encryption is encapsulated by

Answer 6

ESP packets over SESSYNC_1 IPsec tunnel

Question 7

How to enable OSPF ECMP:

Answer 7

Enable the rfc1583-compatible flag

Question 8

How to block encrypted attack:

Answer 8

Map the device layer local certificate to Dynamic Mapping by creating an inspection profile.

Question 9

Remember that every time you use an IPsec template,

Answer 9

The interfaces must be mapped to normalize interfaces

Question 10

Does Unsetting the IPsec template delete the tunnel and dependencies?

Answer 10

No. You must individually remoted the objects and policies that were create and reference the tunnel or its interfaces.