====== HUB Configuration======

<color #ed1c24>*For the Fortigate</color>

==== Configuration strategy goals====
**Separation of Power approach:** To help divide responsibilities and access to enhance security and minimize the potential for unauthorized access or control.


==== Fortigate admin profile controls====
  * **Scope-Based Access:** Admin access can be global or on VDOM basis. Global scope admins have access to the base device and all VDOMs by default. Per-VDOM access allows tighter control for specific ships/tenants.
  * **Separate Config Access:** Control access are granted independently for network interface configuration (Ethernet, VLANs, inter-VDOM links) and VPN (IPSec) configurations.
  * **Restrict Sensitive Options:** Can be blocked access to FortiView (metadata) and packet capture (raw packets) for admins who do not require these features.


==== Tasks Requiring Hub-Side Global Admin Access ====
Assign global admin access only for tasks where it is essential, minimizing the risk of unintended or unauthorized actions using the principle of least privilege.

== Per-Ship Tasks ==
These tasks are needed for each ship added to the system:
  * [Hub FGT] Creating VDOMs: Set up virtual domains for new ships.
  * [Hub FGT] Creating inter-VDOM links: Enable communication between ship-specific VDOMs and the hub.
  * [Hub FMG] Assigning ship + hub VDOMs to an ADOM in FortiManager: Associate the ship and hub VDOMs with a specific Administrative Domain (ADOM) for configuration and management.
  * [Hub FAZ] Creating hub logging ADOM: Set up an Administrative Domain for managing logs at the hub.
  * [Hub FAZ] Assigning devices to appropriate hub logging ADOM: Link the devices to the logging ADOM for centralized log management.


== One-Time Commissioning Tasks ==
These tasks are performed once during the initial setup:
  * [Hub FGT] Assigning physical interfaces to VDOMs: Map physical network ports to their respective VDOMs.
  * [Hub FGT] Configuring Hub 40gate -> Hub host OI summary routing: Set up routing for traffic between the hub FortiGate and the host Operational Interface (OI).
  * [Hub FGT] Configuring HA: Enable HA for redundancy and reliability.
  * [Hub FGT] Configuring system DNS: Set up Domain Name System settings for the hub.
  * [Hub FGT] Configuring system NTP: Configure Network Time Protocol settings for synchronized timekeeping.
  * [Hub FGT] Configuring system FortiManager connection: Establish a connection between the hub FortiGate and FortiManager for centralized management.
  * [Hub FGT] Configuring system (hub) FortiAnalyzer connection: Link the hub FortiGate to FortiAnalyzer for log and analytics management.

==== Building the Admin Profile System ====
  * **Identify Sensitive Options to Restrict:** Explicitly restrict the sensitive options including FortiView (metadata view), packet capture (raw packet view), and VPN configuration (IPSec management). These options explicitly lock-out an admin's options to inappropriately egress "inside-the-veil" IPSec sessions.
  * **Configure Certificate Management:** Transition certificate management to a VDOM-level scope to ensure certificate private keys are isolated and protected from global admin access.
  * **Leverage FortiManager for Configuration Management:** Utilize the FortiManager auto-config process to create regular backup configurations, to test configurations and to implement configuration changes while maintaining a version-controlled audit trail.
  * **Define Separate Admin Profiles:** Create role-specific admin profiles with clear separation of duties. Profiles for hub admins, providing connectivity to per-ship VDOMs and seeing IPSec ciphertext, versus ship admins with ability to see inside the ship VDOMs, on a per-ship basis.