path: root/doc/book-enea-nfv-access-example-usecases/doc/forti_vnf_examples.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<chapter id="vnf_fortigate">
  <title>FortiGate VNF Example Use-cases</title>

  <para>FortiGate virtual appliances feature all of the security and
  networking services common to traditional hardware-based FortiGate
  appliances. The virtual appliances can be integrated in Firewall or SD-WAN
  solution development.</para>

  <section id="forti_firewall_prereq">
    <title>Prerequisites</title>

    <para>System requirements for the uCPE device:</para>

    <itemizedlist>
      <listitem>
        <para>3 x Network Interfaces</para>
      </listitem>

      <listitem>
        <para>1 x vCPU</para>
      </listitem>

      <listitem>
        <para>1 GB of RAM memory</para>
      </listitem>
    </itemizedlist>

    <para>The following files are needed for this example use case:</para>

    <itemizedlist>
      <listitem>
        <para>FortiGate VNF image. This file is provided by the local Fortinet
        sales representatives in your region.</para>
      </listitem>

      <listitem>
        <para>FortiGate VNF license file. This file is provided by the local
        Fortinet sales representatives in your region.</para>
      </listitem>

      <listitem>
        <para>FortiGate specific documentation. This is provided by the local
        Fortinet sales representatives in your region.</para>
      </listitem>

      <listitem>
        <para>FortiGate configuration example files. These files are provided
        with your Enea NFV Access release.</para>
      </listitem>
    </itemizedlist>
  </section>

  <section id="fortigate_firewall_uc_1">
    <title>FortiGate VNF as a Firewall</title>

    <para>Enea provides an example of a simple base firewall configuration for
    the FortiGate VNF.</para>

    <table>
      <title>FortiGate VNF Example Configuration</title>

      <tgroup cols="2">
          <colspec align="center" colwidth="1*" />

          <colspec align="center" colwidth="4*" />

        <thead>
          <row>
            <entry align="center">Component</entry>

            <entry align="center">Setting/Description</entry>
          </row>
        </thead>

        <tbody>
          <row>
            <entry align="left">Firewall</entry>

            <entry align="left">"All pass" mode</entry>
          </row>

          <row>
            <entry align="left">WAN (Virtual Port1)</entry>

            <entry align="left"><para>DHCP Client, dynamically assigned IP
            address.</para><para>FortiGate In-Band
            Management<superscript>1</superscript>.</para></entry>
          </row>

          <row>
            <entry align="left">WAN (Virtual Port2)</entry>

            <entry align="left"><para>IP address:
            172.168.16.1</para><para>DHCP server (IP range 172.168.16.1 -
            172.168.16.255).</para></entry>
          </row>

          <row>
            <entry align="left">WAN (Virtual Port3)</entry>

            <entry align="left">Ignored</entry>
          </row>
        </tbody>
      </tgroup>
    </table>

    <para><superscript>1</superscript>FortiGate In-Band Management is a
    feature used for running FortiGate Management traffic over WAN.</para>

    <para>Instructions on how to alter the default configuration are provided in section
    <olink targetdoc="book_enea_nfv_access_example_usecases"
    targetptr="fortigate_webmg">FortiGate VNF Web Management in <xi:include
    href="../../s_docbuild/olinkdb/pardoc-names.xml"
    xmlns:xi="http://www.w3.org/2001/XInclude"
    xpointer="element(book_enea_nfv_access_example_usecases/1)" /></olink>.</para>

    <section id="lab_setup_fortfirewall">
      <title>Lab Setup</title>

      <para>Before starting the configuration of the FortiGate Firewall, a lab
      setup concerning hardware and software components has to be created. The
      following table illustrates the requirements for this setup.</para>

      <table>
        <title>Lab Setup Prerequisites</title>

        <tgroup cols="2">
          <colspec align="center" />

          <thead>
            <row>
              <entry align="center">Component</entry>

              <entry align="center">Description/Requirements</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry align="left">Lab Network</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>DHCP enabled Lab Network.</entry>
                  </row>

                  <row>
                    <entry>Internet Connectivity.</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>

            <row>
              <entry align="left">Setup of an Intel Whitebox uCPE
              device</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>Minimum 4 Physical Network Devices.</entry>
                  </row>

                  <row>
                    <entry>4 GB RAM and 4 cores (C3000 or Xeon D).</entry>
                  </row>

                  <row>
                    <entry>Enea NFV Access Installed.</entry>
                  </row>

                  <row>
                    <entry>WAN Connected to the Lab Network.</entry>
                  </row>

                  <row>
                    <entry>LAN1 Connected to the Test Machine.</entry>
                  </row>

                  <row>
                    <entry>LAN2 Unconnected.</entry>
                  </row>

                  <row>
                    <entry>ETH0 connected to the Lab Network (for Enea uCPE
                    Manager communications).</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>

            <row>
              <entry align="left">Setup of a Lab Machine</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>Connected to the Lab Network.</entry>
                  </row>

                  <row>
                    <entry>Running either Windows or CentOS.</entry>
                  </row>

                  <row>
                    <entry>The Enea uCPE Manager installed.</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>

            <row>
              <entry align="left">Setup of a Test Machine</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>Connected to Whitebox LAN.</entry>
                  </row>

                  <row>
                    <entry>Internet Connectivity via LAN.</entry>
                  </row>

                  <row>
                    <entry>Configured as the DHCP client on LAN.</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>
          </tbody>
        </tgroup>
      </table>

      <figure>
        <title>Lab Setup Overview</title>

        <mediaobject>
          <imageobject>
            <imagedata align="center" fileref="images/intel_whitebox.png"
                       contentwidth="600" />
          </imageobject>
        </mediaobject>
      </figure>
    </section>

    <section id="exam_setup_fortifirewall">
      <title>Use-case Setup</title>

      <para><emphasis role="bold">Network Configuration:</emphasis></para>

      <para>Since the firewall uses three External Network Interfaces, three
      bridges need to be configured. Each bridge provides the ability to
      connect a physical network interface to the virtual machines' virtual
      network interface.</para>

      <orderedlist>
        <listitem>
          <para>Select the uCPE device, access
          <literal>Configuration</literal> and bind the three physical network
          interfaces to DPDK.</para>
        </listitem>

        <listitem>
          <para>Create three OVS bridges, one for each DPDK network interface
          (WAN, LAN1 and LAN2).</para>
        </listitem>
      </orderedlist>

      <para>Alternatively, the firewall can be setup to use bridges as
      connection points for the FortiGate VNF, by replacing the OVS-DPDK
      bridges with SR-IOV connection points.</para>

      <para>Please note that while previously three physical interfaces were 
        presumed necessary for VNF connection, in the case of a firewall setup 
        only two physical interfaces are required for the data path 
        (one for WAN and one for LAN).</para>
      
      <para>Only two interfaces will be configured as DPDK, with two bridges 
        created, one for each type of connection.</para>

      <note><para>At VNF instantiation instead of assigning distinct bridges for 
        each LAN interface, only one will be used for both LAN1 and LAN2, 
        with no changes in WAN interface configuration.</para></note>
        
        <para>See the picture below for the final setup:</para>

      <figure>
        <title>Two-Interface Configuration</title>

        <mediaobject>
          <imageobject>
            <imagedata align="center" fileref="images/two_inst_firewall.png"
                       contentwidth="600" />
          </imageobject>
        </mediaobject>
      </figure>

      <para><emphasis role="bold">Onboarding the VNF:</emphasis></para>

      <para>Onboard the FortiGate VNF by filling the required fields with the
      following values:</para>

      <itemizedlist spacing="compact">
        <listitem>
          <para><emphasis role="bold">VM Image File</emphasis>: Provide the
          path to the FortiGate VNF qcow2 image.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Memory in MB</emphasis>: 1024</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Num of CPUs</emphasis>: 1</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Storage in GB</emphasis>: 20</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Interfaces</emphasis>: Add 3
          interfaces.</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init Datasource</emphasis>:
          ConfigDrive</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init Disk Type</emphasis>:
          cdrom</para>
        </listitem>

        <listitem>
          <para><emphasis role="bold">Cloud-init content file</emphasis>: Add
          a license file entry.</para>
        </listitem>
      </itemizedlist>

      <para><emphasis role="bold">Instantiating the VNF:</emphasis></para>

      <para>Instantiate the FortiGate VNF by filling the required fields with
      the following values:</para>

      <table>
        <title>Instantiation Requirements</title>

        <tgroup cols="2">
          <colspec align="center" colwidth="1*" />

          <colspec align="center" colwidth="4*" />

          <thead>
            <row>
              <entry align="center">Field</entry>

              <entry align="center">Description</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry align="left">Name</entry>

              <entry align="left">Name of the VM which will be created on the
              uCPE device.</entry>
            </row>

            <row>
              <entry align="left">VNF Type</entry>

              <entry align="left">Name of the onboarded VNF.</entry>
            </row>

            <row>
              <entry align="left">uCPE Device</entry>

              <entry align="left">Select the uCPE device where the VNF will be
              instantiated.</entry>
            </row>

            <row>
              <entry align="left">License file</entry>

              <entry align="left">The FortiGate license file provided by
              Fortinet.</entry>
            </row>

            <row>
              <entry align="left">Configuration file</entry>

              <entry align="left">The Firewall example configuration file provided
              by Enea
              (<filename>FGVM080000136187_20180828_0353_basic_fw.conf</filename>).</entry>
            </row>

            <row>
              <entry align="left">Port1 - WAN</entry>

              <entry align="left">Set the <literal>External Interface</literal> type to 
                <literal>DPDK</literal> and connect it to the <literal>wanmgrbr</literal> ovs
              bridge.</entry>
            </row>

            <row>
              <entry align="left">Port2 - LAN1</entry>

              <entry align="left">Set the <literal>Incoming Interface</literal> type to 
                <literal>DPDK</literal> and connect it to the <literal>lan1</literal> ovs 
                bridge.</entry>
            </row>

            <row>
              <entry align="left">Port3 - LAN2</entry>

              <entry align="left">Set the <literal>Outgoing Interface</literal> type to 
                <literal>DPDK</literal> and connect it to the <literal>lan2</literal> ovs 
                bridge.</entry>
            </row>
          </tbody>
        </tgroup>
      </table>
    </section>

    <section id="testing_fortigate_uc_1">
      <title>Testing the Use-case</title>

      <para>Connect the Test Machine on the LAN interface and access the
      internet from the Test Machine to use the firewall on the uCPE
      device.</para>

      <note>
        <para>The connected Test Machine can be a laptop or a uCPE device. It
        must have one interface configured to get a dynamic IP from a DHCP
        server. The <literal>dhclient &lt;interface&gt;</literal> command can
        be used to request an IP address. The received IP must be in the
        172.16.1.2 - 172.16.1.255 range.</para>
      </note>

      <para>The FortiGate VNF management interface is accessible through the
      WAN interface. The WAN IP address can be used from a web browser on the
      Lab Machine to access the FortiGate VNF Management Web UI. Please check
      <olink targetdoc="book_enea_nfv_access_example_usecases"
      targetptr="fortigate_webmg">FortiGate VNF web management<xi:include
      href="../../s_docbuild/olinkdb/pardoc-names.xml"
      xmlns:xi="http://www.w3.org/2001/XInclude"
      xpointer="element(book_enea_nfv_access_example_usecases/1)" /></olink>
      for more information.</para>
    </section>
  </section>

  <section id="fortigate_sdwan_vpn">
    <title>FortiGate VNF as an SD-WAN VPN</title>

    <para>SD-WAN decouples the network from the management plane, detaching
    traffic management and monitoring functions from hardware. Most forms of
    SD-WAN technology create a virtual overlay that is transport-agnostic,
    i.e. it abstracts underlying private or public WAN connections.</para>

    <para>For deployment, the user plugs in WAN links into the device,
    which automatically configures itself with the network.</para>

    <para>Example SD-WAN configurations for the FortiGate VNF are provided by
    Enea.</para>

    <section id="prereq_forti_sdwan_vpn">
      <title>Prerequisites</title>

      <para>The following table illustrates the use-case prerequisites for the
      setup:</para>

      <table>
        <title>Prerequisites</title>

        <tgroup cols="2">
          <colspec align="center" />

          <thead>
            <row>
              <entry align="center">Component</entry>

              <entry align="center">Description</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry align="left">Lab Network</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>DHCP enabled Lab Network.</entry>
                  </row>

                  <row>
                    <entry>Internet Connectivity.</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>

            <row>
              <entry align="left">Two Intel Whitebox uCPE devices</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>Minimum 4 Physical Network Devices.</entry>
                  </row>

                  <row>
                    <entry>4 GB RAM and 4 cores (C3000 or Xeon D).</entry>
                  </row>

                  <row>
                    <entry>Enea NFV Access Installed.</entry>
                  </row>

                  <row>
                    <entry>VNFMgr connected to the Lab Network for VNF management
                    access.</entry>
                  </row>

                  <row>
                    <entry>WAN interfaces directly connected through the Ethernet
                    cable.</entry>
                  </row>

                  <row>
                    <entry>LAN connected to the Test Machine.</entry>
                  </row>

                  <row>
                    <entry>ETH0 connected to the Lab Network (for Enea uCPE
                    Manager communications).</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>

            <row>
              <entry align="left">One Lab Machine</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>Connected to the Lab Network.</entry>
                  </row>

                  <row>
                    <entry>Running either Windows or CentOS.</entry>
                  </row>

                  <row>
                    <entry>The Enea uCPE Manager installed.</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>

            <row>
              <entry align="left">Two Test Machines</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>Connected to Whitebox LANs.</entry>
                  </row>

                  <row>
                    <entry>Internet Connectivity via LAN.</entry>
                  </row>

                  <row>
                    <entry>Configured as the DHCP client on LAN.</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>
          </tbody>
        </tgroup>
      </table>
    </section>

    <section id="forti_labsetup_uc2">
      <title>Lab Setup</title>

      <para>The following will detail an SD-WAN setup for a branch to branch
      connection using the FortiGate VNF. FortiGate provides native SD-WAN
      along with integrated advanced threat protection.</para>

      <table>
        <title>FortiGate VNF Example Configuration - SD-WAN uCPE device
        1</title>

        <tgroup cols="2">
          <colspec align="center" />

          <thead>
            <row>
              <entry align="center">Component</entry>

              <entry align="center">Description</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry align="left">SD-WAN</entry>

              <entry>VPN connection between two branches (uCPE device 1 and
              uCPE device 2).</entry>
            </row>

            <row>
              <entry align="left">VNFMgr (Virtual Port1)</entry>

              <entry>DHCP Client, dynamically assigned IP address.</entry>
            </row>

            <row>
              <entry align="left">WAN (Virtual Port2)</entry>

              <entry>IP address: 10.0.0.1</entry>
            </row>

            <row>
              <entry align="left">LAN (Virtual Port3)</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>IP address: 172.16.1.1</entry>
                  </row>

                  <row>
                    <entry>DHCP server (IP range 172.16.1.2 -
                    172.16.1.254)</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>
          </tbody>
        </tgroup>
      </table>

      <table>
        <title>FortiGate VNF Example Configuration - SD-WAN uCPE device
        2</title>

        <tgroup cols="2">
          <colspec align="center" />

          <thead>
            <row>
              <entry align="center">Component</entry>

              <entry align="center">Description</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry align="left">SD-WAN</entry>

              <entry>VPN connection between two branches (uCPE device 2 and
              uCPE device 1).</entry>
            </row>

            <row>
              <entry align="left">VNFMgr (Virtual Port1)</entry>

              <entry>DHCP Client, dynamically assigned IP address.</entry>
            </row>

            <row>
              <entry align="left">WAN (Virtual Port2)</entry>

              <entry>IP address: 10.0.0.2</entry>
            </row>

            <row>
              <entry align="left">LAN (Virtual Port3)</entry>

              <entrytbl cols="1">
                <tbody>
                  <row>
                    <entry>IP address: 172.16.2.1</entry>
                  </row>

                  <row>
                    <entry>DHCP server (IP range 172.16.2.2 -
                    172.16.2.254)</entry>
                  </row>
                </tbody>
              </entrytbl>
            </row>
          </tbody>
        </tgroup>
      </table>

      <figure>
        <title>SD-WAN: VPN Configuration</title>

        <mediaobject>
          <imageobject>
            <imagedata align="center"
                       fileref="images/sdwan_vpn_overview_1.png" contentwidth="600" />
          </imageobject>
        </mediaobject>
      </figure>
    </section>

    <section id="forti_examsetup_uc2">
      <title>Use-case Setup</title>

      <para><emphasis role="bold">Network Configuration:</emphasis></para>

      <para>Since the SD-WAN VNF uses three External Network Interfaces, three
      bridges need to be configured. Each bridge provides the ability to
      connect a physical network interface to the VM's virtual network
        interface.</para>
      
      <para>Each VNF instance will have a virtual interface for VNF
      management, for the WAN network and for LAN communication.</para>

      <orderedlist>
        <listitem>
          <para>Select uCPE Device 1, access <literal>Configuration</literal>
          and bind the three physical network interfaces to the DPDK.</para>
        </listitem>

        <listitem>
          <para>Create three OVS bridges, one for each DPDK network interface
          (VNF management, WAN and LAN).</para>
        </listitem>

        <listitem>
          <para>Repeat the steps above for uCPE device 2.</para>
        </listitem>
      </orderedlist>

      <para><emphasis role="bold">Onboarding the FortiGate VNF</emphasis></para>

      <para>See the onboarding parameters detailed in the previous use-case above.</para>

      <para><emphasis role="bold">Instantiating the FortiGate VNF</emphasis></para>

      <para>Instantiate the FortiGate VNF by filling the required fields with
      the following values:</para>

      <table>
        <title>Instantiation Requirements</title>

        <tgroup cols="2">
          <colspec align="center" colwidth="1*" />

          <colspec align="center" colwidth="4*" />

          <thead>
            <row>
              <entry align="center">Field</entry>

              <entry align="center">Description</entry>
            </row>
          </thead>

          <tbody>
            <row>
              <entry align="left">Name</entry>

              <entry align="left">Name of the VM which will be created on the
              uCPE device.</entry>
            </row>

            <row>
              <entry align="left">VNF Type</entry>

              <entry align="left">Name of the onboarded VNF.</entry>
            </row>

            <row>
              <entry align="left">uCPE Device</entry>

              <entry align="left">Select the uCPE device where the VNF will be
              instantiated.</entry>
            </row>

            <row>
              <entry align="left">License file</entry>

              <entry align="left">The FortiGate license file provided by
              Fortinet.</entry>
            </row>

            <row>
              <entry align="left">Configuration files</entry>

              <entry align="left">The SD-WAN example configuration files provided
              by Enea:
              <literal>FGVM080000136187_20180215_0708_sdwan1.conf</literal>
              <literal>FGVM080000136188_20180215_0708_sdwan2.conf</literal></entry>
            </row>

            <row>
              <entry align="left">Port1 - VNFMgr</entry>

              <entry align="left">Set the type to <literal>DPDK</literal> and connect it to the
              <literal>vnfmgrbr</literal> bridge.</entry>
            </row>

            <row>
              <entry align="left">Port2 - WAN</entry>

              <entry align="left">Set the type to <literal>DPDK</literal> and connect it to the
              <literal>wanbr</literal> bridge.</entry>
            </row>

            <row>
              <entry align="left">Port3 - LAN</entry>

              <entry align="left">Set the type to <literal>DPDK</literal> and connect it to the
              <literal>lanbr</literal> bridge.</entry>
            </row>
          </tbody>
        </tgroup>
      </table>

      <orderedlist>
        <listitem>
          <para>Instantiate the FortiGate VNF on uCPE device 1 using the
          <literal>sdwan1</literal> example configuration file.</para>
        </listitem>

        <listitem>
          <para>To complete the branch-to-branch setup, configure <literal>uCPE device
          2</literal> in the same way as <literal>uCPE device 1</literal>. Make sure to
          use the <literal>sdwan2</literal> configuration file for the second VNF
          instantiation.</para>
        </listitem>
      </orderedlist>
    </section>

    <section id="forti_test_uc2">
      <title>Testing the Use-case</title>

      <para>Once the full SD-WAN setup is in place a VPN connection needs to
      be established between the two uCPE devices. The Test Machines can be
      connected to the LAN interface on each uCPE device.</para>

      <para>The connected Test Machine can be a laptop or a uCPE device that
      has one interface configured to get a dynamic IP from a DHCP server. The
      <command>dhclient &lt;interface&gt;</command> command can be used to
      request an IP address.</para>

      <note>
        <para>The received IP must be in the 172.16.1.2 - 172.16.1.255 range
        for Test Machine-1 and in the 172.16.2.2 - 172.16.2.255 range for Test
        Machine-2.</para>
      </note>

      <para><literal>uCPE device 1</literal> should be able to ping Test
      <literal>uCPE device 2</literal> in this setup over the WAN connection.
      The FortiGate VNF management interface can be accessed from a web
      browser on the Lab Machine. For more details please see <olink
      targetdoc="book_enea_nfv_access_example_usecases"
      targetptr="fortigate_webmg">FortiGate VNF Web Management, <xi:include
      href="../../s_docbuild/olinkdb/pardoc-names.xml"
      xmlns:xi="http://www.w3.org/2001/XInclude"
      xpointer="element(book_enea_nfv_access_example_usecases/1)" /></olink>.</para>

      <note>
        <para>In this SD-WAN VPN setup example, bridges were used as
        connection points for the FortiGate VNF. It is possible to replace
        OVS-DPDK bridges with SR-IOV connection points.</para>
      </note>
    </section>
  </section>

  <section id="fortigate_webmg">
    <title>FortiGate VNF Web Management</title>

    <para>In order to check the IP address assigned to the FortiGate VNF you
    need to connect to the FortiGate CLI.</para>

    <orderedlist>
      <listitem>
        <para>SSH to the uCPE Device (Username: root) and connect to the
        FortiGate VNF console:</para>

        <programlisting>virsh list
virsh console &lt;id of FortiGate VNF&gt;</programlisting>
      </listitem>

      <listitem>
        <para>To access the FortiGate CLI, use <literal>admin</literal> as the
        user, leaving the password blank/empty, and press enter.</para>

        <para>Use the CLI command <literal>get system interface</literal> to
        get the dynamic interfaces configuration.</para>
      </listitem>

      <listitem>
        <para>Use the IP address assigned for the management interface in the
        web browser (<literal>https://&lt;IP&gt;</literal>), to access the
        FortiGate VNF Web Management Interface. Use the same credentials as
        before to login.</para>
      </listitem>

      <listitem>
        <para>Browse through the configuration and perform changes
        according to your setup:</para>

        <figure>
          <title>The FortiGate VNF Web Management Interface</title>

          <mediaobject>
            <imageobject>
              <imagedata align="center"
                         fileref="images/fortinet_interface.png" contentwidth="600" />
            </imageobject>
          </mediaobject>
        </figure>
      </listitem>

      <listitem>
        <para>Optionally, alter the default FortiGate example configuration
        provided by Enea, through the following steps:</para>

        <orderedlist>
          <listitem>
            <para>Deploy the FortiGate Firewall in its default
            settings.</para>
          </listitem>

          <listitem>
            <para>Connect to the FortiGate VNF Web Management interface with a
            web browser.</para>
          </listitem>

          <listitem>
            <para>Modify the FortiGate configuration in the FortiGate VNF Web
            Management as needed.</para>
          </listitem>

          <listitem>
            <para>Store the updated configuration in a file, so it may be used
            at the next FortiGate VNF instantiation.</para>
          </listitem>
        </orderedlist>

        <note>
          <para>Editing the default configuration is only recommended for
          FortiGate configuration experts.</para>
        </note>
      </listitem>
    </orderedlist>
  </section>
</chapter>