Users Guide

Sample Route-Mode ESI Topology
This section introduces the configuration for a sample route-mode topology using the controller and Fortinet
Anti-Virus gateways. In route mode, the trusted and untrusted interfaces between the controller and the
Fortinet gateways are on different subnets. The following figure shows an example route-mode topology.
ESI with Fortinet Anti-Virus gateways is supported only in route mode.
Figure 230 Example Route-Mode Topology
In the topology shown, the following configurations are entered on the controller and Fortinet gateway:
ESI server configuration on controller
l Trusted IP address = 10.168.172.3 (syslog source)
l Untrusted IP address = 10.168.171.3
l Mode = route
IP routing configuration on Fortinet gateway
l Default gateway (core router) = 10.168.172.1
l Static route for wireless user subnet (10.168.173.0/24) through the controller (10.168.171.2)
Configuring the Example Routed ESI Topology
This section describes how to implement the example routed ESI topology shown in . The description includes
the relevant configuration—both the WebUI and the CLI configuration processes are described—required on
the controller to integrate with a AVF server appliance.
The ESI configuration process will redirect all HTTP user traffic to the Fortinet server for examination, and any
infected user will be blacklisted. The configuration process consists of these general tasks:
l Defining the ESI server.
l Defining the default ping health check method.
l Defining the ESI group.
l Defining the HTTP redirect filter for sending HTTP traffic to the ESI server.
l Applying the firewall policy to the guest role.
Dell Networking W-Series ArubaOS 6.5.x | User Guide External Services Interface | 1052