FireSight docs

Regions and IP addressing

FireSight organises firewalls into nested geographic regions, lets each region own IP pools, and keeps track of the networks allocated to each firewall. Allocations also help automatic placement find where an address lives.

Everyone can view these pages. Implementers and administrators can change them.

Regions & devices

Network, Regions & devices has the region tree on the left and the firewalls on the right.

  • All devices lists every firewall; No region yet lists those without a region.
  • Click a region to see its details and its firewalls.

The region panel shows the Code, Part of (its parent), its IP pools with how much of each is allocated, and Notes. A region without pools says None. Devices use the nearest parent region's pools.

The devices table shows:

Column Shows
Device Name, and the site (or serial number).
Model and firmware Model and FortiOS version.
ADOM The management domain.
Status Online, Unreachable or Removed from FortiManager, with the management address. This is the connection status from the last sync; see Device health for live checks.
Region The region. Implementers choose it from the list here; No region removes it.
Synced When the firewall was last synced.

Add or edit a region

  1. Click Add region (or Edit region on a selected region).

  2. Fill in:

    Field Meaning
    Name Such as Bari. Up to 100 characters.
    Code Short and unique, such as IT-BAR. Letters, digits, _ and -, up to 20 characters.
    Part of The parent region, or Top level. A region can't be inside itself.
    Notes Optional.

  3. Click Add region or Save region.

Regions nest as deep as you like, for example EMEA, then Italy, then Bari.

IP addressing

Network, IP addressing has two parts.

Regional pools

Each region with its pools, indented under its parent, and a bar of how much of each pool is allocated (red above 85%).

To add a pool, click Add pool on the region, enter the Network (such as 10.30.0.0/16) and click Add pool.

  • A pool may sit inside a parent region's pool, but not overlap the pool of an unrelated region.
  • Pools in the same region can't overlap each other.
  • Networks must be written exactly (10.30.0.0/16, not 10.30.1.0/16).

Allocations

Every network allocated to a firewall. Type in Find an IP, network or device to search.

Column Shows
Network The allocated network.
Device The firewall.
Interface The interface, if given.
VLAN The VLAN ID, if given.
Description Free text; for discovered networks, the interface address.
Source From device (discovered on sync) or Allocated with when (manual).

Discovered allocations come from the firewalls' interface addresses and are refreshed on every sync. They can't be released by hand. Offline snapshots are never added.

Allocate a network

  1. Click Allocate a network.
  2. Choose the Device. The hint shows its region, or that it has none (then any free network is allowed).
  3. Enter the Network, or use Or find a free block: choose a prefix length (/16 to /30) and click Suggest. FireSight fills in the first free block of that size in the region's pools (the device needs a region).
  4. Optionally fill in Interface, VLAN (1 to 4094) and Description.
  5. Click Allocate.

Rules:

  • The network must sit inside the pools of the nearest region (the firewall's own region, or the closest parent) that has pools.
  • It may not overlap any other allocation, manual or discovered.

To give a network back, click Release on a manual allocation and confirm.

Every allocation, release and pool change is recorded in the audit log.

← PDF audit report DNS names →