Fortinet FortiADC Load Balancing Training

Download the latest eve ng community edition 6.204 from eve-ng.net, install on VMware Workstation, allocate 16 GB RAM and 4 CPUs, and access the web interface at 192.168.114.x.

Upload io switches images to eve-ng with winscp, extract with seven zip, ensure licenses match f and g, apply fixed permissions via ssh, and verify readiness.

Upload the required lab images to EVE-NG, including 40 ADC image, Fortigate firewall, Kali Linux, Metasploitable Linux, Linux Mint, and Ubuntu server, using Winscp and applying the fix permission command.

Prepare a fresh FortiADC 40 image for Eve-ng by downloading, extracting, creating a lowercase Fortinet folder, renaming boot to A and data to B, and setting permissions.

Construct a FortiADC lab topology with 40 ADC units behind a Fortigate firewall, including internet access, a management subnet, and the defined IP schema.

Export labels as PNG files and import labs in EVE-NG to reuse topologies, adjust subnets, and streamline FortiADC lab setup across editions.

Configure four web servers in a lab topology by assigning static IPs (192.168.1.1–1.4), setting hostnames (SRV1, SRV2, SRV3; metasploitable for server four), and deploying a custom index.html with Apache.

Configure external pcs by assigning static ipv4 addresses, subnet masks, gateways, and dns, then bring interfaces up and verify connectivity with ifconfig and ping across pc1, pc2, and kali.

Configure a Fortigate firewall in the lab topology with three interfaces and management access, then set dns, static routes, two virtual ips, and firewall policies to control traffic.

Configure FortiADC network by assigning IP addresses to port two and port three, enabling ping, and creating a static route to the FortiGate firewall, then verify connectivity.

Configure real server pools in FortiADC by grouping servers into a web pool (servers 1, 2 and 3) and a seq pool (server 4), then save and verify the pools.

Configure two FortiADC virtual servers: a layer four web server for the web pool and a layer seven sick server for the sick pool, with external IPs and port 80.

Demonstrates configuring FortiADC virtual servers and a three-server pool, translating public IPs through Fortigate, and validating load-balanced connectivity with curl tests from Kali Linux.

FortiADC health checks monitor backend servers to ensure availability and route traffic only to healthy servers, using ICMP, TCP, HTTP/HTTPS, and other checks with real server pools.

Configure ICMP health checks on FortiADC and assign them to the web pool to monitor three servers, verify with ICMP echo and captures, and prepare to switch health checks.

Configure an http health check in Fortinet FortiADC by sending http get requests and expecting 200 responses, comparing with icmp and tcp checks, and applying it to the server pool.

Configure a backup server in FortiADC to ensure high availability and disaster recovery by designating server three as the standby and validating health during failover.

Explore how FortiADC distributes traffic across multiple servers using round robin, least connections, fastest response, and hash-based methods, with dynamic weighting from SNMP health checks.

Demonstrates round robin load balancing on Fortinet FortiADC, distributing traffic evenly across three web servers via a virtual server, with verification through logs and curl traffic to confirm equal distribution.

Apply weight-based load balancing by assigning distinct weights to servers in the web pool, using round-robin with weights to distribute traffic; verify with traffic logs and curl tests.

Switch to the fastest response load balancing method and observe which server replies first in the three-server topology behind the 40 adc, with health checks guiding traffic.

Configure least connection load balancing on a three-server web virtual server, simulate heavy load on server one, and verify distribution with Kali Linux curl commands and traffic logs.

Explore FortiADC forwarding methods, including direct routing, destination net, full net, tunneling, and net4to6/net6to4 translation, and learn how loopback and server IP configuration enable correct traffic flow.

Demonstrates destination NAT behavior on FortiADC in a layer-four load balancing setup, showing how the destination IP changes while the source remains constant during test traffic.

Learn how FortiADC implements full NAT (full net) by creating a source pool and updating the virtual server, then verify that both source and destination change with packet captures.

Explain how network address translation enables private hosts to access the internet through a single public address, covering source nat, destination nat, 1-to-1 nat, and port forwarding on FortiADC.

Configure source net on FortiADC to let servers 192.168.1.0/24 reach the internet, translating to 192.168.2.50 via the egress interface.

Learn to configure 1-to-1 NAT for servers on FortiADC, enabling bidirectional traffic between a private IP and a public IP, with optional port forwarding and firewall configuration.

Explore FortiADC persistence rules and how they keep a user's session on the same backend server using source IP, cookies, and URL parameter hash.

Configure IP-based persistence by creating a source address rule with a six-second timeout and attach it to the web virtual server; test from a PC to verify routing and persistence.

Configure a layer seven virtual server on 40 ADC to balance a web pool of three servers using HTTP, convert from layer four, remove persistence, and use round robin.

Demonstrates testing and verifying a layer 7 FortiADC virtual server using curl and slow http tests, validating health, sessions, and throughput across three backend servers, with log checks.

Explore FortiADC layer seven content routing to direct traffic by http header, url, and cookies, and content rewriting to modify http headers and urls for backend integration.

Configure content routing on Fortinet FortiADC to direct specific resources to server three. Create server pools, enable layer 7 routing, and define url and host header conditions with health checks.

Configure content rewriting to redirect http request URL rs.html to the original index.html, enabling traffic to reach server three's resources.

Test and verify content rewriting on the FortiADC load balancer by inspecting redirects to index.html using Rs.html, http streams, and packet captures from Kali Linux and browsers.

Configure a cookie-based persistence profile for a layer 7 virtual server. Create an NZ cookie persistence named test cookies with a six-second timeout and verify server affinity via packet capture.

FortiADC handles the encryption and decryption through ssl offloading, relieving web servers from ssl processing by decrypting user traffic and re-encrypting responses, while managing certificates.

Enable ssl offloading on FortiADC by importing a server certificate, creating a local certificate and group, and configuring https and client ssl profiles for a 443 virtual server.

Configure IP firewall policies on FortiADC to enforce IPv4 and IPv6 rules by creating addresses and top-to-bottom rules, with logs for blocked traffic.

Configure intrusion prevention on FortiADC, attach the default protect HTTP server profile to a layer four virtual server, and verify protection via security logs and Kali Linux testing.

Configure antivirus protection on FortiADC, attach the antivirus profile to the layer seven virtual server, enable monitoring, and test by uploading a virus to verify blocking and security logs.

Explore how Fortinet FortiADC load balancing uses ddos protection profiles to defend servers from application and networking attacks, http access limit, http request flood, and tcp syn flood.

Configure and attach a DDoS protection profile on FortiADC to a layer seven virtual server, enabling tcp syn flood, slow data flood, and http flood protections, then verify logs.

Upgrade FortiADC firmware by downloading the 7.6 file from the support 40 Netcom, uploading it in maintenance, and rebooting to apply the new version.

Configure and test the Fortinet FortiADC web application firewall by creating a WAF profile, HTTP protocol constraint rules, SQL injection, and URL protection, then verify blocks via security logs.