Fortinet & VMware integration
2 likes5,830 views
Fortinet provides virtualized security solutions that can integrate with VMware NSX to enable micro-segmentation and east-west traffic control in software-defined data centers. The FortiGate-VMX integrates directly with the NSX manager to import network segments defined in NSX and apply firewall policies based on these segments. This allows fine-grained security policies to be applied across virtual machines and workloads in the hybrid cloud.
Fortinet & VMware integration
- 1. © Copyright Fortinet Inc. All rights reserved. Fortinet & VMware Integration VMUGIT Meeting Roma Antonio Gentile Systems Engineer, Italy agentile@fortinet.com 26/09/2016
- 2. Agenda • Fortinet Cloud & SDN Vision • Fortinet NSX Integration • Use Cases • Demonstration
- 3. 3 End-to-End Global Cybersecurity Platform Coverage from Endpoint to Edge to Core to Data Center to Cloud Client Security Secure Access Network Segmentation Application Security Cloud Security Control & Visibility Security Services & Framework USERS NETWORK DATA CENTER FortiGate FortiManager FortiAnalyzer FortiGate for AWS FortiGate VMX FortiClient
- 4. 4 Fortinet Cloud & SDN Vision Network Security as Agile and Elastic Underlying Infrastructure Virtualization SDN Cloud (IaaS) Cloud (SaaS) vSphere XenServer Hyper-V NSX Physical & Virtual Security Appliances FortiGate FortiManagerFortiSandbox FortiAnalyzer FortiWeb FortiADC FortiDDoSFortiWifiFortiMail
- 5. 5 Security for the Cloud Virtualization Hypervisor Port Hypervisor Private Cloud SDDC - SDN - Orchestration Integration Public Cloud On-Demand IaaS Cloud Connector API East-West NGFW WAF Management Reporting APT SaaS Cloud Proxy CASI Broker API Hybrid
- 6. 6 Security Across all of the Network - Global and Local App Control Antivirus Anti-spam IPS Web App Database Web Filtering Vulnerability Management Botnet Mobile Security Cloud Sandbox Deep App Control PartnerFortiWebFortiMailFortiClient FortiGate Threat Researchers Threat Intelligence Exchange FortiSandbox
- 7. 7 Fortinet Virtualized (Guests) Security Solutions • FortiGate-VM • Unified Threat Management • FortiManager-VM • Centralized Management • FortiAnalyzer-VM • Logging and Reporting • FortiWeb-VM • Web Application Security • FortiMail-VM • Messaging Security • FortiAuthenticator-VM • User Identity Management • FortiADC-VM • Application Delivery • FortiCache-VM • Content Caching • FortiVoice-VM • Complete Business Phone Systems • FortiRecorder-VM • Video Security • FortiSanbox-VM • Advanced Threat Detection
- 8. 8 Fortinet Virtualized (Guests) Security Solutions • FortiGate-VM • Unified Threat Management • FortiManager-VM • Centralized Management • FortiAnalyzer-VM • Logging and Reporting • FortiWeb-VM • Web Application Security • FortiMail-VM • Messaging Security • FortiAuthenticator-VM • User Identity Management • FortiADC-VM • Application Delivery • FortiCache-VM • Content Caching • FortiVoice-VM • Complete Business Phone Systems • FortiRecorder-VM • Video Security • FortiSanbox-VM • Advanced Threat Detection Guest-VMs
- 9. 9 Virtual Appliance Platforms – Private and Public Cloud Virtual Appliance VMware Citrix Open Source Amazon Microsoft vSphere v4.0, 4.1 vSphere v5.0 vSphere v5.1, 5.5 vSphere v6.0 Xen Server v5.6 SP2 Xen Server v6.0 Xen KVM AWS Hyper-V 2008 R2 Hyper-V 2012 FortiGate-VM ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ FortiManager-VM ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ FortiAnalyzer-VM ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ FortiWeb-VM ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ FortiMail-VM ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ FortiAuthenticator-VM ✔ ✔ ✔ ✔ ✔ ✔ FortiADC-VM ✔ ✔ ✔ FortiCache-VM ✔ ✔ ✔ ✔ FortiVoice-VM ✔ ✔ ✔ ✔ ✔ ✔ FortiRecorder-VM ✔ ✔ ✔ ✔ ✔ ✔ FortiSandbox-VM ✔ ✔ FortiPrivateCloud ✔ ✔ * * Also available as pay-as-you-go licensing option *
- 10. 10 Virtual Data Center Security Challenges § Difficult configuration to have security within the same vSwitch and/or forward domain § Perimeter-centric network security has proven insufficient § Use fine-grained network segmentation approach - wrap security control around much smaller groups of resources § Best practice approach from a security perspective, but difficult to apply in traditional environments § Two key operational barriers » throughput capacity » operations/change management East-West Micro-Segmentation Zero-Trust East-West Control Trust No One – Not Even Your End Users
- 11. FortiGate VMX with VMware NSX
- 12. 12 Added Value of Security integration in SDDC Requirements Solution Not just firewall, but advanced features Micro-Segmentation and Zero Trust Control of ‘east-west’ traffic, Inter and Intra VM security, Logical Security Zone (multi-tier) Integration, Orchestration and Automation
- 13. 13 Key Cloud Security Use Cases Segment End-to-End Traffic Within and Across the Hybrid Cloud or Intra-VM Mitigate increasing concentration of data and risk in consolidated data centers, and across private and public cloud Security Requirements Whitelist-based policy model Fine-grained honeycomb based on user, role, apps, devices Deployable into flat, open networks without disruption Monitor and restrict VPN and data connection between on-premise and public clouds Internet Cloud Internal Network (100 Gbps+) Private Cloud Edge Gateway Data Center ISFW ISFW ISFW ISFWISFW External Internal Hypervisor ISFW SG3 SG2 SG1 FortiGate-VMX Security Node
- 14. 14 Manage Components for NSX Integration Mandatory Components for NSX Integration Third Party Solution Service Manager Service Appliance ESXi Hosts VMware vCenter Server V5.5 or v6.0 VMware vSphere (Enterprise Plus license v5.5 or v6.0) REST API Fortinet Solution FortiGate-VMX Service Manager FortiGate-VMX Security Appliance
- 15. 15 FortiGate-VMX and NSX Integration/Interactions dvSwitch FGT-VMX FGT-VMX Pushpolicysynchronizationtoall FortiGate-VMXdeployedincluster 7 Register Fortinet as security service with NSX Manager1 Auto-deployFortiGate-VMX toallhostsinsecuritycluster 2 FortiGate-VMXconnects withFortiGate-VMX ServiceManager 3 License verification & configuration synchronization with FortiGate-VMX 4 NSXSecurityPolicydefinenetwork introspectionrulestoredirecttraffic 5 Real-time updates of object database6 FortiGate-VMX Service Manager
- 16. 16 FortiGate-VMX and NSX Manager Setup Adding VMware NSX details on FortiGate Service Manager FortiGate VMX Service on NSX Manager
- 17. 17 FGT-VMX imports NSX Security Groups § On NSX create Security Groups and assign “Objects” Security Groups defined on NSX are automatically created on FGT-VMX
- 18. 18 FGT-VMX imports NSX Security Groups § On NSX create Security Groups and assign “Objects” § FortiGate VMX automatically imports the Security Groups as a dynamic firewall addresses with the VMs IP address Security Groups defined on NSX are automatically created on FGT-VMX
- 19. 19 NSX Security Group definition and usage Server SG FortiGate-VMX NSX Manager Service Groups created on NSX Manager automatically get sent to the FortiGate- VMX and are available for Policy Creation Policy Created on FortiGate-VMX using Exchanged Security Group
- 20. 20 VMware Kernel dvSwitch FGT-VMX and VMWARE NSX Filter Driver Interaction 1 Define NGFW Firewall Policies 2 FGT-VMX NetX NSX Filter Driver int ext Packet Flow 1. From VM to NSX Filter Driver 2. NSX Filter Driver Forward to Third party Solution (FGT-VMX) 3. FGT-VMX applies Security and sends packet back to NSX Filter Driver 4. NSX Filter Driver can do service chaining or send packet to destination FortiGate-VMX Service Manager
- 21. 21 Policy Creation § Firewall Policy is now IP independent Policy created based on Security Group Internal External DistributedVirtual Switch
- 22. 22 FortiGate-VMX License Model § One license for the FortiGate-VMX Service Manager § Simple license based on number of FGT-VMX Security Appliance deployed » One FortiGate-VMX license per ESXi host » No limits placed on resources (virtual or hardware), nor number of protected VM workloads Hypervisor with 2 sockets Hypervisor with 1 socket 2 FGT-VMX Licenses 3 FGT-VMX Licenses Hypervisor with 2 sockets Central license server with auto decrement
- 23. 23 Multiple Services/Customers § Real Multi-tenancy (VDOM) support » Virtual Domain (VDOM) dedicated per tenant or individual security feature » Service Profile and Groups ensure proper segmentation
- 24. 24 Resource Monitoring § Per Security Appliance instance Resource monitor
- 26. Use Cases
- 27. 27 TELCO – Use Case – Dedicated Customer Firewall (FortiGate-VM) Web Servers Application Servers Database Servers vSwitch APP Hypervisor vSwitch DBvSwitch WEB vSwitch External Internet •Customer Managed Firewall •Orchestrated Customer Creation •FortiGate-VM to control east-west application traffic • Traffic is required to flow through the FortiGate-VM (L2 or L3) to secure traffic • Intra-VM security requires L2 VDOMs and inter-VDOM link configuration • Physical FortiGate to control north-south traffic App Control Antivirus Anti-spam IPS Web App Web Filtering Botnet Cloud Sandbox
- 28. 28 ENTERPRISE – NSX Integration Use Case: Function Segmentation with VDOMs Security Group D Security Group C Security Group B VDOM1: IPS VDOM 2: URL Filtering VDOM 3: App Control VDOM 5: Anti-Virus VDOM 6: Anti spam nsx VDOM (on by default): NGFW, IPS, URL Filtering, Anti-Virus etc.. Security Group A • Segmented groups can have unique feature set applied • Provides performance benefits as all groups don’t have identical security requirements • Each department eg.. Human Resources, Legal, Marketing etc. can have it’s own VDOM and it’s own security feature set • Fortinet Patented Virtual Domain Technology • Only Security Vendor to support Virtual Segmentation by Function for Security. VDOM 4: Web Application Firewall
- 29. 29 ENTERPRISE – NSX Integration Use Case: Function Segmentation with VDOMs Security Group D Security Group C Security Group B VDOM1: IPS VDOM 2: URL Filtering VDOM 3: App Control VDOM 5: Anti-Virus VDOM 6: Anti spam nsx VDOM (on by default): NGFW, IPS, URL Filtering, Anti-Virus etc.. Security Group A VDOM 4: Web Application Firewall
- 30. Demo!!
- 31. 31 Multi-Tier Application Diagram web-01 web-02 Web-01 10.0.1.0/24 .11 .12 External 192.168.195.0/23 App-01 .11 .1 .1 .1 .2 App-02 .12 App-01 10.0.2.0/24 DB-01 .11 .1 DB-01 10.0.3.0/24 Transit-01 172.16.1.0/24 .2 VIP-Web: 192.168.195.143:80 (Web-01:80+Web-02:80) VIP-App: 172.16.1.6:80 (App-01:80+App-02:80) Client to Web: HTTP (80)1 Web to App: HTTP (80)2 App to DB: mysql (3306)3
- 32. 32 Demonstration - Use Cases 1 § Security Policies for Multi-Tier Application Segmentation » Web Tier allowed to receive request from outside and generate requests to App Tier only » App Tier allowed to receive requests from Web Tier and generate requests to BD Tier only » DB Tier allowed to receive requests from App Tier and not allowed to generate requests App-02 App-01 Web-02 Web-01 DB-01 IPS Web App App Control IPS Antivirus
- 33. Questions??