Fortimanager – Dynamic Interfaces and how to use them

Fortimanager is a centralized configuration and management solution for Fortinet devices.  Although the ENTIRE line of Fortinet product are not used today, Fortigates, Fortiswitches, and FortiAPs certainly are.  In this post, I will show how to use dynamic interface objects for the goal of managing dissimilar platforms.

USE CASE:

You have a Fortigate 140E which has 40 Gigabit Ethernet ports and a 51E with 7 Gigabit Ethernet ports.  Additionally, the 140E has some DMZ ports not present on the 51E.  The challenge is; you wast to use the ‘DMZ’ interface on the 140E but since there is no DMZ on the 51E, you plan on using port 3.  You only want to use one policy package.

To give you some perspective on the hardware, in case you are unfamiliar with the products:

 

As you can visually see, the interfaces do not match up.

First we will need to make sure the devices are connected and being managed by the Fortigate.  I will be covering that on a different blog post.  Once this is done, you will need to do the following:

Log into your Fortimanager and choose the correct ADOM. In my case, I had created a 6-Dot-1-Adom but your mileage may vary.

Next you will need to choose Policy & Objects

Once you are there, you will need to choose Object Configuration (1), then Zone/Interface (2), then choose Interface (3).

Once there, you can choose Create New

Name the interface, this is a dynamic interface name (e.g. inside, outside, trust, untrust, etc), choose a color, Choose Per-Device Mapping .

The Per-Device Mapping section will allow you to select an interface per device that will function as that dynamic interface

For example, on the 140E, I will use port7 while the FortiWiFi 51E will use wan2. As the dmz-002interface.

Here we can see the Fortigate 140E

And here we can see the FortiWiFi 51E

We will now create a Policy Package (if you do not already have one),  and inside that package, we will create a Policy using the dynamic interface.

1.  Name the policy
2. Choose the incoming interface
3. Choose the dmz-002interface 

Now lets push this policy package.  You will need to ensure that you have your Installation Targets

Once the policy is installed, we can log into each device separately and validate the interfaces.

On the 51E

As you can see, we are using wan2 as the dmz-002 interface.

On the 140E

And on the 140E, we can see that port7 is being used as dmz-002

Hope this helps.