Security Fabric Topology & Configuration Quiz

Security Fabric Fundamentals

• The first device that needs to be configured in the Security Fabric topology is the root FortiGate.

FortiTelemetry

• FortiTelemetry is used for collecting and sharing network security information and threat intelligence among FortiGate devices in the Security Fabric.
• FortiTelemetry uses TCP port 541 for communication.
• The requirement for FortiTelemetry connectivity in the Security Fabric is that all FortiGate devices must be connected to the root FortiGate.

FortiAnalyzer

• FortiAnalyzer is used for log collection, analysis, and reporting in the Security Fabric.
• FortiGate uses the serial number to verify the FortiAnalyzer.
• FortiAnalyzer collects network topology information in the Security Fabric.

FortiManager

• FortiManager is used for centralized management, configuration, and policy deployment in the Security Fabric.
• The purpose of FortiManager in the Security Fabric is to synchronize configurations across all FortiGate devices.

Security Fabric Topology

• The Security Fabric topology model consists of a root FortiGate, downstream FortiGate devices, and a FortiAnalyzer.
• The root FortiGate is typically the central device in the Security Fabric topology.

FortiSandbox

• FortiSandbox is used for sandboxing and threat analysis in the Security Fabric.

Security Fabric Configuration Synchronization

• The purpose of Security Fabric Configuration Synchronization is to synchronize configurations across all FortiGate devices.
• Disabling configuration synchronization using the setting configuration-sync under config system csf prevents FortiManager from pushing configurations to other FortiGate devices.

IoC and Log Sending

• When a FortiGate receives an IoC from FortiAnalyzer, it updates its security policies and configuration accordingly.
• The default behavior for log sending in a Security Fabric is that logs are sent to FortiAnalyzer.
• The command to see which upstream or downstream FortiGate a FortiGate is connected to is show csf neighbors.

Security Fabric Maps

• Security Fabric maps include network topology information and provide a visual representation of the Security Fabric.

FortiGate Configuration

• The FortiManager configuration is pushed from the root FortiGate to all other FortiGate devices.