FortiCloud – FortiOS 6.2

FortiCloud

FortiCloud is a hosted security management and log retention service for FortiGate devices. It gives you centralized reporting, traffic analysis, configuration management, and log retention without the need for additional hardware or software.

FortiCloud offers a wide range of features:

• Simplified central management — FortiCloud provides a central web-based management console to manage individual or aggregated FortiGate and FortiWiFi devices. Adding a device to the FortiCloud management subscription is straightforward. FortiCloud has detailed traffic and application visibility across the whole network.
• Hosted log retention with large default storage allocated — Log retention is an integral part of any security and compliance program but administering a separate storage system is burdensome. FortiCloud takes care of this automatically and stores the valuable log information in the cloud. Each device is allowed up to 200GB of log retention storage. Different types of logs can be stored including Traffic, System Events, Web, Applications, and Security Events.
• Monitoring and alerting in real time — Network availability is critical to a good end-user experience. FortiCloud enables you to monitor your FortiGate network in real time with different alerting mechanisms to pinpoint potential issues. Alerting mechanisms can be delivered via email.
• Customized or pre-configured reporting and analysis tools — Reporting and analysis are your eyes and ears into your network’s health and security. Pre-configured reports are available, as well as custom reports that can be tailored to your specific reporting and compliance requirements. For example, you may want to look closely at application usage or website violations. The reports can be emailed as PDFs and can cover different time periods.
• Maintain important configuration information uniformly — The correct configuration of the devices within your network is essential to maintaining an optimum performance and security posture. In addition, maintaining the correct firmware (operating system) level allows you to take advantage of the latest features.
• Service security — All communication (including log information) between the devices and the clouds is encrypted. Redundant data centers are always used to give the service high availability. Operational security measures have been put in place to make sure your data is secure — only you can view or retrieve it.

Registration and activation

FortiCloud accounts can be registered manually through the FortiCloud website, https://www.forticloud.com, but you can easily register and activate your account directly from your FortiGate.

Activating your FortiCloud account

1. On your device’s dashboard, in the FortiCloud widget, select the Activate button in the status field.
2. A dialogue asking you to register your FortiCloud account appears. Select Create Account, enter your information, view and accept the terms and conditions, and select OK.
3. A second dialogue window appears, asking you to enter your information to confirm your account. This sends a confirmation email to your registered email. The dashboard widget then updates to show that confirmation is required.
4. Open your email, and follow the confirmation link it contains.

Results

A FortiCloud page will open, stating that your account has been confirmed. The Activation Pending message on the dashboard will change to state the type of account you have (‘1GB Free’ or ‘200GB Subscription’), and will provide a link to the FortiCloud portal.

Enabling logging to FortiCloud

1. Go to Log & Report > Log Settings.
2. Enable Send Logs to FortiCloud.
3. Select Test Connectivity to ensure that your FortiGate can connect to the registered FortiCloud account.
4. Scroll down to GUI Preferences, set Display Logs/FortiView From, to see FortiCloud logs within the FortiGate’s GUI.

Logging into the FortiCloud portal

Once logging has been configured and you have registered your account, you can log into the FortiCloud portal and begin viewing your logging results. There are two methods to reach the FortiCloud portal:

• If you have direct networked access to the FortiGate, you can simply open your Dashboard and check the License Information Next to the current FortiCloud connection status will be a link to reach the FortiCloud Portal.
• If you do not currently have access to the FortiGate’s interface, you can visit the FortiCloud website

(https://forticloud.com) and log in remotely, using your email and password. It will ask you to confirm the FortiCloud account you are connecting to and then you will be granted access. Connected devices can be remotely configured using the Scripts page in the Management Tab, useful if an administrator may be away from the unit for a long period of time.

Cloud sandboxing

FortiCloud can be used for automated sample tracking, or sandboxing, for files from a FortiGate. This allows suspicious files to be sent to be inspected without risking network security. If the file exhibits risky behavior, or is found to contain a virus, a new virus signature is created and added to the FortiGuard antivirus signature database.

Cloud sandboxing is configured by going to Security Fabric > Settings. After enabling Sandbox Inspection, select the FortiSandbox type.

Sandboxing results are shown in a new tab called AV Submissions in the FortiCloud portal. This tab only appears after a file has been sent for sandboxing.

For more information about FortiCloud, see the FortiCloud documentation.