FortiExtender on FortiCloud

By Manny Fernandez

March 23, 2020

FortiExtender on FortiCloud

FEX Cloud

I recently set up a FortiExtender in my lab but I didn’t use my FortiGate as the controller/manager. You get there by going to https://fortiextender.forticloud.com. My plan for this deployment is to use it as a mobile hotspot in my RV. This would work for many mobile solutions though. I wanted this to be a standalone (non-FortiGate) deployment and thus, why I went this route. Manny Fernandez also has a walkthrough blog here if you want to see more of the standalone GUI.

Out of the box, I followed the instructions on the sticker:

Register the unit at https://support.fortinet.com (you will use the FortiCloud Key)
Connect the unit to a network with internet access
Sign in to https://fortiextender.forticloud.com

fullsizeoutput_e79

The device shows up as an inventory device and then an online device once the configuration pushes out.

Next, I called Verizon and added the SIM card to my plan first. Then I put the SIM card into the SIM1 slot. You have to take the antennas off and take the plastic cover off to get to the SIM slots.

From the FortiExtender Cloud page, I went to Device and then clicked on the FortiExtender (FEX). This page gives you General, MODEM, System, and LTE information about the specific device. Once I could see the MODEM was online with Verizon, I unplugged the WAN cable.

FEX Device Info Screen I went into the CLI from the >_CONSOLE button and ran:

execute ping 8.8.8.8

Success! My FEX has connectivity through the Verizon SIM.

FEX Ping 8.8.8.8

I still want to be able to plug in a device to the FEX on port1-port4, so I have to allow traffic, but I also need a DHCP server. Port1 automatically has an IP of 192.168.1.99 when it comes from the factory. You could plug in there and hit the GUI. Again, Manny has a write up on the walkthrough of the GUI here.

You are also going to need to set up firewall rules to allow traffic to pass. I just modified the ‘all-pass’ rule that was there to allow it to work. I also modified the ‘src’ address object since, in my case, I was going to use a different network space than 192.168.1.0/24.

FEX FW Rule

One thing that you can’t change inside the GUI is the DHCP server. (If you can do it, I didn’t find it). So, I went back into the CLI and set it there. See the below config for that.

FEX DHCP CLI Commands

I plug into port1. Now when I do a traceroute to 8.8.8.8 you can see that I have connectivity from my subnet (192.168.60.x/24) through Verizon, to Goggle DNS.

FEX TraceRoute 8.8.8.8

Now I’m passing traffic, as I am passing the miles in the RV.

FortiExtender on FortiCloud

Recent posts