Fortinet Ansible Solution Part 2
- 1. FortiNet/Ansible solution Part 2 Presented by: Salim Haniff (shaniff@parabellyx.com)
- 2. INTRODUCTIONINTRODUCTION Second of 4 in the lecture series Set up 2 CentOS servers on VLAN_100 and VLAN_200 Verify that they are able to communicate as instructed by firewall policy
- 3. BACKGROUNDBACKGROUND Our FortiGate Appliance was configured via Ansible to create VLAN_100 and VLAN_200, and firewall policies This ensures network separation between Dev and Prod environment Separate servers will now need to be installed in the respected zones
- 4. WHY CENTOS?WHY CENTOS? Free alternative to RedHat Enterprise Linux Lots of information online to help troubleshoot issues Easy to implement VLAN, network bridges and VMs
- 5. SETTING UP CENTOSSETTING UP CENTOS The installations for both the Dev and Prod servers used a minimal installation Ensures we don't have a lot of packages on the servers We need to disable NetworkManager since it sometimes conflicts with network setting $ sudo systemctl stop NetworkManager $ sudo systemctl disable NetworkManager
- 6. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON DEV SERVERDEV SERVER All network configurations are stored in /etc/sysconfig/network-scripts/ To find which interface is active run Here we can see interface enp3s0 is our main network interface Backup the configuration $ ip a $ sudo cp ifcfg-enp3s0 $HOME/
- 7. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON DEV SERVERDEV SERVER We will now install the libvirt package to help us bring up a virtual switch and help with launching VMs. $ sudo yum -y install libvirt $ sudo systemctl enable libvirtd $ sudo systemctl start libvirtd
- 8. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON DEV SERVERDEV SERVER Change the settings of the ifcfg-enp3s0 file to reflect the changes below BOOTPROTO="none" DEVICE="enp3s0" ONBOOT="yes" TYPE="Ethernet"
- 9. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON DEV SERVERDEV SERVER Create new file called ifcfg-enp3s0.100 . This denotes that this interface will use VLAN_100 Notice the we added the parameter BRIDGE, this will tell the virtual bridge to use this interface as the uplink to the network. DEVICE="enp3s0.100" BOOTPROTO="None" ONBOOT="yes" VLAN=yes BRIDGE="virbr0"
- 10. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON DEV SERVERDEV SERVER Create a new file called ifcfg-virbr0 . This is the virtual network bridge configuration. DEVICE="virbr0" BOOTPROTO="static" ONBOOT="yes" IPADDR="10.1.1.2" PREFIX=24 NETWORK=10.1.1.0 VLAN=yes GATEWAY=10.1.1.1 DNS=8.8.8.8 TYPE="Bridge"
- 11. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON DEV SERVERDEV SERVER One final setting that needs to be configured is loading the 802.1q kernel module that enables VLAN. To enable this module, enter the following command: Now reboot the server and check that the server comes up. $ sudo sh -c 'echo "8021q" > /etc/modules-load.d/8021q.conf
- 12. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON PROD SERVERPROD SERVER Exact same procedure that we did on the Dev server This time our main network interface is enp2s0
- 13. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON PROD SERVERPROD SERVER Settings for ifcfg-enp2s0 TYPE="Ethernet" BOOTPROTO="none" DEVICE="enp2s0" ONBOOT="yes"
- 14. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON PROD SERVERPROD SERVER Settings for ifcfg-enp2s0.200 BOOTPROTO="none" DEVICE="enp2s0.200" ONBOOT="yes" VLAN=yes BRIDGE="virbr0"
- 15. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON PROD SERVERPROD SERVER Settings for ifcfg-virbr0 DEVICE="virbr0" BOOTPROTO="static" IPADDR="10.1.2.10" NETMASK="255.255.255.0" GATEWAY="10.1.2.1" DNS1="8.8.8.8" ONBOOT="yes" TYPE="Bridge" VLAN=yes
- 16. CONFIGURING THE NETWORK ONCONFIGURING THE NETWORK ON PROD SERVERPROD SERVER One final setting that needs to be configured is loading the 802.1q kernel module that enables VLAN. To enable this module, enter the following command: Now reboot the server and check that the server comes up. $ sudo sh -c 'echo "8021q" > /etc/modules-load.d/8021q.conf
- 17. VERIFICATIONVERIFICATION Now both of our servers are now configured. We need to test them. With your workstation, set the network device to VLAN_200 and try to ping 10.1.1.1 and 10.1.2.1 Now try to ping 10.1.1.2 and 10.1.2.10 Finally, try SSHing to both of those boxes
- 18. WRAPPING UPWRAPPING UP We now have a dev and prod servers running on their own network Our workstation is now able to communicate to both of them In the next tutorial, we will install Wordpress on both the Dev and Prod servers. If you have any questions or feedback, please reach out to me ( ) or our staff. Contact info will be provided below. shaniff@parabellyx.com