Demo mode

Demo mode (also called the showcase) runs FireSight on your own machine with a built-in, in-memory FortiManager and a standalone FortiGate, demo users, regions, IP pools, extra approval chains and half an hour of device health history. Nothing is sent to a real firewall. Use it to try requests, approvals, deployment, back-out, the rule audit and device health.

Warning

Demo mode is not for production. It uses development secrets (FIRESIGHT_ENVIRONMENT=dev) and a local SQLite database.

Start the demo

You need Docker Desktop, or Docker Engine with the Compose plugin. In the FireSight release folder:

docker compose -f docker-compose.demo.yml up --build

Then open http://localhost:8081 and sign in as admin with the demo password Demo-Password-123! (set in docker-compose.demo.yml).

If port 8081 is already in use, choose another one:

FIRESIGHT_PORT=8090 docker compose -f docker-compose.demo.yml up

In PowerShell, run $env:FIRESIGHT_PORT=8090 first, then the docker compose command. Open http://localhost:8090.

The demo compose file sets:

Variable	Demo value	Effect
`FIRESIGHT_ENVIRONMENT`	`dev`	Development defaults are allowed.
`FIRESIGHT_DATABASE_URL`	`sqlite:////data/firesight.db`	A SQLite file in the `firesight-demo` volume.
`FIRESIGHT_ADMIN_PASSWORD`	the demo password	Password of `admin`.
`FIRESIGHT_LOAD_DEMO`	`true`	Loads the demo data on first start.
`FIRESIGHT_DEMO_PASSWORD`	the demo password	Password of every demo user.
`FIRESIGHT_DEPLOY_MODE`	`simulate`	Real connections would only be simulated. The built-in demo firewalls always take live writes, because they live in memory.

Demo users

Every demo user has the same password. Sign in as each to see what the roles can do.

User	Name	Roles
`admin`	Administrator	Administrator
`alice`	Alice Requester	Requester
`tom`	Tom Team-Lead	Team lead and Requester
`sara`	Sara Security	Security
`carl`	Carl CAB	Change board
`ivan`	Ivan Implementer	Implementer
`aud`	Audrey Auditor	Auditor

What's in the demo

A FortiManager called Demo FortiManager with two management domains (ADOMs): EMEA, without workspace mode, and APAC, with workspace mode.
A standalone FortiGate called Dublin office, reached over a VPN from London.
Firewalls in Rome, Milan, Bari, London, Singapore, Sydney and Dublin, already placed in nested regions (EMEA, Italy, Rome and so on) with IP pools.
Every policy set (policy package) already audited.
An extra approval chain, APAC network team, assigned to the APAC domain.
A chain called Security architects, added by two conditions: Remote admin ports (ports 22 and 3389) and Inbound from the internet.
Emergency changes switched on.
Half an hour of device health history, so Device health has trends and alerts to show.

Things to try

Request	What it shows
`10.10.5.0/24` to `10.110.3.4`, TCP 22	Crosses Rome, London and Singapore, uses the internal zone and creates a normalised interface in APAC. It goes to three chains at once: the standard chain (EMEA), APAC network team (APAC's own chain) and Security architects (added by the "Remote admin ports" condition).
`10.30.2.0/24` to `203.0.113.5`	Bari sends it out of wan2 because of a policy route.
`10.120.4.0/24` to `198.51.100.9`	Sydney uses the virtual-wan-link SD-WAN zone.
`10.50.0.0/24` to `203.0.113.80`, TCP 8443	A change on the standalone Dublin FortiGate, with a configuration backup.

For an emergency change, tick This is an emergency change on any request. Sign in as sara to approve it and as ivan to deploy it, then as tom and the others to review it.

Stop and reset

Stop it with Ctrl+C.
Data is kept in a Docker volume between runs. To delete it and start again:
```
docker compose -f docker-compose.demo.yml down -v
```
The demo firewalls live in memory, so rules pushed to them are forgotten when the container restarts.

Licensing in the demo

The built-in demo firewalls are never counted for licensing, and deployments to them are never stopped by the license, so evaluating with the demo never stops. See Licensing.