Fortinet FortiGate 3000 Administration Manual Download Page 253

Page: 253 / 398

FortiGate-3000 Administration Guide Version 2.80 MR6

FortiGate-3000 Administration Guide

01-28006-0010-20041105

253

VPN

FortiGate units support the following protocols to authenticate and encrypt traffic:

• Internet Protocol Security (IPSec)

• Point-to-Point Tunneling Protocol (PPTP)

• Layer Two Tunneling Protocol (L2TP)

This chapter contains information about the following VPN topics:

•

Phase 1

•

Phase 2

•

Manual key

•

Concentrator

•

Ping Generator

•

Monitor

•

PPTP

•

L2TP

•

Certificates

•

CLI configuration

•

Authenticating peers with preshared keys

•

Gateway-to-gateway VPN

•

Dialup VPN

•

Dynamic DNS VPN

•

Manual key IPSec VPN

•

Adding firewall policies for IPSec VPN tunnels

•

Internet browsing through a VPN tunnel

•

IPSec VPN in Transparent mode

•

Hub and spoke VPNs

•

Redundant IPSec VPNs

•

Configuring IPSec virtual IP addresses

•

Troubleshooting

Summary of Contents for FortiGate 3000

Page 1: ...tiGate 3000 Administration Guide ESC ENTER CONSOLE 1 2 3 4 HA INTERNAL POWER Hi Temp 4 HA 1 2 3 INT EXT EXTERNAL FortiGate 3000 Administration Guide Version 2 80 MR6 5 November 2004 01 28006 0010 20041105 ...

Page 2: ...ation Guide Version 2 80 MR6 5 November 2004 01 28006 0010 20041105 Trademarks Products mentioned in this document are trademarks or registered trademarks of their respective holders Regulatory Compliance FCC Class A Part 15 CSA CUS CAUTION RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS For technical support please visit http w...

Page 3: ...ing to a previous firmware version 25 To revert to a previous firmware version using the web based manager 26 To revert to a previous firmware version using the CLI 27 Installing firmware images from a system reboot using the CLI 28 To install firmware from a system reboot 29 Testing a new firmware image before installing it 32 To test a new firmware image 32 Installing and using a backup firmware...

Page 4: ...Transparent Mode 51 Routing table list 51 Transparent mode route settings 52 To add a Transparent mode route 52 VLAN overview 52 FortiGate units and VLANs 53 VLANs in NAT Route mode 53 Rules for VLAN IDs 54 Rules for VLAN IP addresses 54 Adding VLAN subinterfaces 54 To add a VLAN subinterface in NAT Route mode 54 To add firewall policies for VLAN subinterfaces 55 VLANs in Transparent mode 55 Rules...

Page 5: ...67 To set the system idle timeout 67 To set the Auth timeout 67 To select a language for the web based manager 68 To modify the dead gateway detection settings 68 HA 68 HA configuration 69 Configuring an HA cluster 75 To configure a FortiGate unit for HA operation 75 To connect a FortiGate HA cluster 76 To add a new unit to a functioning cluster 76 To configure weighted round robin weights 77 Mana...

Page 6: ...restore 5 Backing up and Restoring 6 To back up all configuration files 6 To restore all configuration files 6 To back up individual categories 6 To restore individual categories 6 To back up VPN certificates 7 To restore VPN certificates 7 Update center 7 Updating antivirus and attack definitions 9 To make sure the FortiGate unit can connect to the FDN 9 To update antivirus and attack definitions...

Page 7: ...anagement virtual domain 5 To select a management virtual domain 6 To select a management virtual domain and add a management IP 6 Configuring virtual domains 6 Adding interfaces VLAN subinterfaces and zones to a virtual domain 6 To add physical interfaces to a virtual domain 6 To add VLAN subinterfaces to a virtual domain 7 To view the interfaces in a virtual domain 7 To add zones to a virtual do...

Page 8: ... a RIP network 6 Interface list 6 Interface options 6 To configure a RIP interface 7 Distribute list 7 Distribute list options 8 To configure a distribute list 8 Offset list 8 Offset list options 9 To configure an offset list 9 Router objects 10 Access list 10 New access list 10 To add an access list name 10 New access list entry 11 To configure an access list entry 11 Prefix list 11 New Prefix li...

Page 9: ...all 41 Policy 42 How policy matching works 42 Policy list 42 Policy options 43 Advanced policy options 45 Configuring firewall policies 46 To add a firewall policy 46 To delete a policy 47 To edit a policy 47 To change the position of a policy in the list 47 To disable a policy 47 To enable a policy 47 Policy CLI configuration 47 Address 48 Address list 49 Address options 49 Configuring addresses ...

Page 10: ...hedule list 56 One time schedule options 56 Configuring one time schedules 56 To add a one time schedule 56 To delete a one time schedule 57 To edit a one time schedule 57 Recurring schedule list 57 Recurring schedule options 57 Configuring recurring schedules 58 To add a recurring schedule 58 To delete a recurring schedule 58 To edit a recurring schedule 58 Virtual IP 58 Virtual IP list 59 Virtua...

Page 11: ...licy 69 CLI configuration 69 Users and authentication 1 Setting authentication timeout 2 Local 2 Local user list 2 Local user options 2 To add a user name and configure authentication 2 To delete a user name from the internal database 3 RADIUS 3 RADIUS server list 3 RADIUS server options 3 To configure the FortiGate unit for RADIUS authentication 3 To delete a RADIUS server 4 LDAP 4 LDAP server li...

Page 12: ...cifying a PPTP range 24 Configuring a Windows 2000 client for PPTP 25 To configure a PPTP dialup connection 25 To connect to the PPTP VPN 25 Configuring a Windows XP client for PPTP 25 To configure a PPTP dialup connection 25 To configure the VPN connection 26 To connect to the PPTP VPN 26 PPTP passthrough 26 To configure a dynamic port forwarding virtual IP for port 1723 27 To configure the firew...

Page 13: ...ption policy direction 42 Setting the source address for encrypted traffic 42 Setting the destination address for encrypted traffic 43 Adding an IPSec firewall encryption policy 43 Internet browsing through a VPN tunnel 43 Configuring Internet browsing through a VPN tunnel 44 IPSec VPN in Transparent mode 45 Special rules 45 Hub and spoke VPNs 46 Configuring the hub 46 Configuring spokes 47 Redund...

Page 14: ...t 69 AutoSubmit list options 69 Configuring the AutoSubmit list 69 To add a file pattern to the AutoSubmit list 69 Config 70 Config 70 Virus list 71 Config 71 Grayware 71 Grayware options 71 CLI configuration 72 system global av_failopen 72 system global optimize 73 heuristic 74 quarantine 75 service http 75 service ftp 76 service pop3 77 service imap 78 service smtp 79 Web filter 81 Content block...

Page 15: ...eports 89 Category block reports options 89 Generating a category block report 90 To generate a category block report 90 Category block CLI configuration 90 Script filter 91 Web script filter options 91 Spam filter 93 IP address 95 IP address list 96 IP address options 96 Configuring the IP address list 96 To add an IP address to the IP address list 96 RBL ORDBL 97 RBL ORDBL list 97 RBL ORDBL opti...

Page 16: ...gging for an interface or VLAN subinterface 113 To enable traffic logging for a firewall policy 113 Log access 114 Disk log file access 114 To access log files on the FortiGate disk 114 To download log files from the FortiGate disk 114 To view and search log messages on the FortiGate disk 115 Viewing log messages 115 To view log messages in the FortiGate memory buffer 115 To view log messages in F...

Page 17: ...Contents FortiGate 3000 Administration Guide 01 28006 0010 20041105 17 FortiGuard categories 121 FortiGate maximum values 127 Glossary 131 Index 135 ...

Page 18: ...Contents 18 01 28006 0010 20041105 Fortinet Inc ...

Page 19: ... service and technical support About FortiGate Antivirus Firewalls The FortiGate Antivirus Firewall is a dedicated easily managed security device that delivers a full suite of capabilities that include application level services such as virus protection and content filtering network level services such as firewall intrusion detection VPN and traffic shaping The FortiGate Antivirus Firewall uses Fo...

Page 20: ... file types from passing through the FortiGate unit You can use the feature to stop files that might contain new viruses FortiGate antivirus protection can also identify and remove known grayware programs Grayware programs are usually unsolicited commercial software programs that get installed on PCs often without the user s consent or knowledge Grayware programs are generally considered an annoya...

Page 21: ...eb content such as Java applets cookies and ActiveX Spam filtering FortiGate spam filtering can scan all POP3 SMTP and IMAP email content for spam You can configure spam filtering to filter mail according to IP address email address mime headers and content Mail messages can be identified as spam or clear You can also add the names of known Real time Blackhole List RBL and Open Relay Database List...

Page 22: ...ach of its interfaces is associated with a different IP subnet and that it appears to other devices as a router This is how a firewall is normally deployed In NAT Route mode you can create NAT mode policies and Route mode policies NAT mode policies use network address translation to hide the addresses in a more secure network from users in a less secure network Route mode policies accept or deny c...

Page 23: ... configuration settings each virtual domain is functionally similar to a single FortiGate unit This separation simplifies configuration because you do not have to manage as many routes or firewall policies at one time Intrusion Prevention System IPS The FortiGate Intrusion Prevention System IPS combines signature and anomaly based intrusion detection and prevention The FortiGate unit can record su...

Page 24: ...configured to operate in active passive A P or active active A A HA mode Active active and active passive clusters can run in either NAT Route or Transparent mode An active passive A P HA cluster also referred to as hot standby HA consists of a primary FortiGate unit that processes traffic and one or more subordinate FortiGate units The subordinate FortiGate units are connected to the network and ...

Page 25: ...iguration and monitoring functionality as the web based manager In addition you can use the CLI for advanced configuration options that are not available from the web based manager This Administration Guide contains information about basic and advanced CLI commands For a more complete description about connecting to and using the FortiGate CLI see the FortiGate CLI Reference Guide Logging and repo...

Page 26: ...k indicates a dotted decimal IPv4 netmask xxx_ipv4mask indicates a dotted decimal IPv4 address followed by a dotted decimal IPv4 netmask xxx_ipv6 indicates a dotted decimal IPv6 address xxx_v6mask indicates a dotted decimal IPv6 netmask xxx_ipv6mask indicates a dotted decimal IPv6 address followed by a dotted decimal IPv6 netmask Vertical bar and curly brackets to separate alternative mutually exc...

Page 27: ... reference default configuration information installation procedures connection procedures and basic configuration procedures Choose the guide for your product model number FortiGate Administration Guide Provides basic information about how to configure a FortiGate unit including how to define FortiGate protection profiles and firewall policies how to apply intrusion prevention antivirus protectio...

Page 28: ...st Security User Guide Describes how to use FortiClient Host Security software to set up a VPN connection from your computer to remote networks scan your computer for viruses and restrict access to your computer and applications by setting up firewall policies FortiClient Host Security online help Provides information and procedures for using and configuring the FortiClient software FortiMail docu...

Page 29: ...ll and configure a FortiLog unit to collect FortiGate and FortiMail log files It also describes how to view FortiGate and FortiMail log files generate and view log reports and use the FortiLog unit as a NAS server FortiLog online help Provides a searchable version of the Administration Guide in HTML format You can access online help from the web based manager as you work ...

Page 30: ...your region For information about our priority support hotline live support see http support fortinet com When requesting technical support please provide the following information your name your company s name and location your email address your telephone number your support contract number if applicable the product name and model number the product serial number if applicable the software or fi...

Page 31: ...sion log This chapter includes Console access Status Session list Changing the FortiGate firmware Console access An alternative to the web based manager discussed in this manual is text based Console Access using the FortiGate command line interface CLI You can get console access by selecting Console Access button in the upper right corner of the web based manager The management computer must have...

Page 32: ...r update FortiGate unit information For information on access profiles see Access profiles on page 119 Viewing system status Changing unit information Viewing system status Figure 2 System status Connect Select Connect to connect to the CLI Disconnect Select Disconnect to disconnect from the CLI Clear screen Select Clear screen to start a new page Automatic Refresh Interval Select to control how o...

Page 33: ... as Change Password or Product Registration Select the reminder to see the detailed reminder message Host Name The host name of the current FortiGate unit Firmware Version The version of the firmware installed on the current FortiGate unit Antivirus Definitions The current installed version of the FortiGate Antivirus Definitions Attack Definitions The current installed version of the FortiGate Att...

Page 34: ...only CPU usage for management processes for example for HTTPS connections to the web based manager is excluded Active Sessions The number of communications sessions being processed by the FortiGate unit Network Utilization The total network bandwidth being used through all FortiGate interfaces and the percentage of the maximum network bandwidth that can be processed by the FortiGate unit History S...

Page 35: ...n section select Change 3 In the New Name field type a new host name 4 Select OK The new host name is displayed in the Host Name field and in the CLI prompt and is added to the SNMP System Name To update the firmware version For information on updating the firmware see Changing the FortiGate firmware on page 38 To update the antivirus definitions manually 1 Download the latest antivirus definition...

Page 36: ... for the attack definitions update file or select Browse and locate the attack definitions update file 5 Select OK to copy the attack definitions update file to the FortiGate unit The FortiGate unit updates the attack definitions This takes about 1 minute 6 Go to System Status Status to confirm that the Attack Definitions Version information has updated To change to Transparent mode After you chan...

Page 37: ...st The session list displays information about the communications sessions currently being processed by the FortiGate unit You can use the session list to view current sessions Figure 4 Sample session list Note If the web based manager IP address was on a different subnet in NAT Route mode you may have to change the IP address of your computer to the same subnet as the management IP address Note I...

Page 38: ...iGate admin user can change the FortiGate firmware After you download a FortiGate firmware image from Fortinet you can use the procedures listed in Table 1 to install the firmware image on your FortiGate unit Total Number of Sessions Total number of sessions currently being conducted through the FortiGate unit Refresh icon Select to update the session list Page up icon Select to view previous page...

Page 39: ...version To use this procedure you must connect to the CLI using the FortiGate console port and a null modem cable This procedure reverts the FortiGate unit to its factory default configuration Testing a new firmware image before installing it Use this procedure to test a new firmware image before installing it To use this procedure you must connect to the CLI using the FortiGate console port and a...

Page 40: ... server is 192 168 1 168 execute ping 192 168 1 168 5 Enter the following command to copy the firmware image from the TFTP server to the FortiGate unit execute restore image name_str tftp_ipv4 Where name_str is the name of the firmware image file and tftp_ip is the IP address of the TFTP server For example if the firmware image file name is FGT_300 v280 build183 FORTINET out and the IP address of ...

Page 41: ...figuration Back up the IPS custom signatures Back up web content and email filtering lists For information see Backing up and Restoring on page 124 If you are reverting to a previous FortiOS version for example reverting from FortiOS v2 80 to FortiOS v2 50 you might not be able to restore the previous configuration from the backup configuration file To revert to a previous firmware version using t...

Page 42: ... up the IPS custom signatures using the command execute backup ipsuserdefsig Back up web content and email filtering lists For information see Backing up and Restoring on page 124 If you are reverting to a previous FortiOS version for example reverting from FortiOS v2 80 to FortiOS v2 50 you might not be able to restore your previous configuration from the backup configuration file To use the foll...

Page 43: ...ayed Get image from tftp server OK Check image OK This operation will downgrade the current firmware version Do you want to continue y n 7 Type y The FortiGate unit reverts to the old firmware version resets the configuration to factory defaults and restarts This process takes a few minutes 8 Reconnect to the CLI 9 To confirm that the new firmware image has been loaded enter get system status 10 T...

Page 44: ...le To install firmware from a system reboot 1 Connect to the CLI using the null modem cable and FortiGate console port 2 Make sure that the TFTP server is running 3 Copy the new firmware image file to the root directory of the TFTP server 4 Make sure that port1 is connected to the same network as the TFTP server 5 To confirm that the FortiGate unit can connect to the TFTP server use the following ...

Page 45: ... boot device B Boot with backup firmware and set as default Q Quit menu and continue to boot with default firmware H Display this list of options Enter G F B Q or H 8 Type G to get the new firmware image from the TFTP server The following message appears Enter TFTP server address 192 168 1 168 9 Type the address of the TFTP server and press Enter The following message appears Enter Local Address 1...

Page 46: ...ation see Backup and restore on page 123 To restore IPS custom signatures see Backing up and restoring custom signature files on page 305 To restore web content filtering lists see Backup and restore on page 123 To restore email filtering lists see Backup and restore on page 123 To update the virus and attack definitions to the most recent version see Updating antivirus and attack definitions on p...

Page 47: ...wing command to restart the FortiGate unit execute reboot 6 As the FortiGate unit reboots press any key to interrupt the system startup As the FortiGate units starts a series of system startup messages are displayed When one of the following messages appears FortiGate unit running v2 x BIOS Press Any Key To Download Boot Image FortiGate unit running v3 x BIOS Press any key to display configuration...

Page 48: ...ng appear FortiGate unit running v2 x BIOS Do You Want To Save The Image Y n Type N FortiGate unit running v3 x BIOS Save as Default firmware Run image without saving D R or Save as Default firmware Backup firmware Run image without saving D B R 12 Type R The FortiGate image is installed to system memory and the FortiGate unit starts running the new firmware image but with its current configuratio...

Page 49: ... 192 168 1 168 execute ping 192 168 1 168 5 Enter the following command to restart the FortiGate unit execute reboot As the FortiGate unit starts a series of system startup messages are displayed When of the following message appears Press any key to enter configuration menu 6 Immediately press any key to interrupt the system startup If you successfully interrupt the startup process the following ...

Page 50: ...ge that you previously installed When you switch the FortiGate unit to the backup firmware image the FortiGate unit operates using the configuration that was saved with that firmware image If you install a new backup image from a reboot the configuration saved with this firmware image is the factory default configuration If you use the procedure Switching back to the default firmware image on page...

Page 51: ...are image is restored To switch back to the default firmware image 1 Connect to the CLI using the null modem cable and FortiGate console port 2 Enter the following command to restart the FortiGate unit execute reboot As the FortiGate units starts a series of system startup messages are displayed When the following message appears Press any key to enter configuration menu 3 Immediately press any ke...

Page 52: ...52 01 28006 0010 20041105 Fortinet Inc Changing the FortiGate firmware System status ...

Page 53: ... to the FortiGate network configuration Interface Zone Management DNS Routing table Transparent Mode VLAN overview VLANs in NAT Route mode VLANs in Transparent mode FortiGate IPv6 support Interface In NAT Route mode go to System Network Interface to configure FortiGate interfaces and to add and configure VLAN subinterfaces For information about VLANs in NAT Route mode see VLANs in NAT Route mode o...

Page 54: ...ames that include ha are configured with an HA heartbeat device priority see Priorities of Heartbeat Device on page 95 If you have added VLAN subinterfaces they also appear in the name list below the physical interface that they have been added to See VLAN overview on page 68 IP The current IP address of the interface Netmask The netmask of the interface Access The administrative access configurat...

Page 55: ...o add a secondary IP address To add a ping server to an interface To control administrative access to an interface To change the MTU size of the packets leaving an interface To configure traffic logging for connections to an interface Name The name of the Interface Interface Select the name of the physical interface to add the VLAN subinterface to All VLAN subinterfaces must be associated with a p...

Page 56: ... to send the DHCP request Note Where you can enter both an IP address and a netmask in the same field you can use the short form of the netmask For example 192 168 1 100 255 255 255 0 can also be entered as 192 168 1 100 24 Distance Enter the administrative distance for the default gateway retrieved from the DHCP server The administrative distance an integer from 1 255 specifies the relative prior...

Page 57: ...se this IP address can be the same as the IP address of another interface or can be any IP address Initial Disc Timeout Initial discovery timeout The time to wait before retrying to start a PPPoE discovery Set Initial Disc to 0 to disable Initial PADT timeout Initial PPPoE Active Discovery Terminate PADT timeout in seconds Use this timeout to shut down the PPPoE session if it is idle for this numb...

Page 58: ...ptions Connect to server Enable Connect to Server so that the interface automatically attempts to connect to a PPPoE server Disable this option if you are configuring the interface offline Status Displays PPPoE status messages as the FortiGate unit connects to the PPPoE server and gets addressing information Select Status to refresh the addressing mode status message initializing No activity conne...

Page 59: ...Config to configure logging locations and types For information about logging see Log Report on page 357 Configuring interfaces Use the following procedures to configure FortiGate interfaces and VLAN subinterfaces To bring down an interface that is administratively up To add interfaces to a zone To add an interface to a virtual domain To change the static IP address of an interface To configure an...

Page 60: ... for the interface and then add the interface to the zone 1 Go to System Network Zone 2 Choose the zone to add the interface or VLAN subinterface to and select Edit 3 Select the names of the interfaces or VLAN subinterfaces to add to the zone 4 Select OK to save the changes To add an interface to a virtual domain If you have added virtual domains to the FortiGate unit you can use this procedure to...

Page 61: ...rtiGate unit attempts to contact the DHCP server from the interface to set the IP address netmask and optionally the default gateway IP address and DNS server IP addresses 7 Select Status to refresh the addressing mode status message 8 Select OK To configure an interface for PPPoE Use this procedure to configure any FortiGate interface to use PPPoE See PPPoE on page 57 for information on PPPoE set...

Page 62: ...nterface edit intf_str config secondaryip edit 0 set ip second_ip netmask_ip Optionally you can also configure management access and add a ping server to the secondary IP address set allowaccess ping https ssh snmp http telnet set gwdetect enable Save the changes end To add a ping server to an interface 1 Go to System Network Interface 2 Choose an interface and select Edit 3 Set Ping Server to the...

Page 63: ...age 66 1 Go to System Network Interface 2 Choose an interface and select Edit 3 Select the Administrative Access methods for the interface 4 Select OK to save the changes To change the MTU size of the packets leaving an interface 1 Go to System Network Interface 2 Choose an interface and select Edit 3 Select Override default MTU value 1500 4 Set the MTU size To configure traffic logging for connec...

Page 64: ...al domain to which you want to add the zone 2 Go to System Network Zone 3 Select Create New 4 In the New Zone dialog box type a name for the zone Create New Select Create New to create a zone Name The names of the zones that you have added Block intra zone traffic Displays Yes if traffic between interfaces in the same zone is blocked and No if traffic between interfaces in the same zone is not blo...

Page 65: ...tual domain go to System Virtual Domain Current Virtual Domain and select the virtual domain in which to edit the zone 2 Go to System Network Zone 3 Select Edit to modify a zone 4 Select or deselect Block intra zone traffic 5 Select the names of the interfaces or VLAN subinterfaces to add to the zone 6 Clear the check box for the names of the interfaces or VLAN subinterfaces to remove from the zon...

Page 66: ... value of 5 minutes see To set the system idle timeout on page 89 Figure 10 Management To configure the management interface 1 Go to System Network Management 2 Enter the Management IP Netmask 3 Enter the Default Gateway 4 Select the Management Virtual Domain 5 Select Apply The FortiGate unit displays the following message Management IP address was changed Click here to redirect 6 Click on the mes...

Page 67: ...al routers Routing table list Figure 12 Routing table Primary DNS Server Enter the primary DNS server IP address Secondary DNS Server Enter the secondary DNS server IP address Create New Select Create New to add a new route Route number IP The destination IP address for this route Mask The netmask for this route Gateway The IP address of the next hop router to which this route directs traffic Dist...

Page 68: ...same VLAN A VLAN segregates devices logically instead of physically Each VLAN is treated as a broadcast domain Devices in VLAN 1 can connect with other devices in VLAN 1 but cannot connect with devices in other VLANs The communication among devices on a VLAN is independent of the physical network A VLAN segregates devices by adding 802 1Q VLAN tags to all of the packets sent and received by the de...

Page 69: ...ins Traffic from each security domain is given a different VLAN ID The FortiGate unit can recognize VLAN IDs and apply security policies to secure network and IPSec VPN traffic between security domains The FortiGate unit can also apply authentication protection profiles and other firewall policy features for network and VPN traffic that is allowed to pass between security domains VLANs in NAT Rout...

Page 70: ... interfaces There is no internal connection or link between two VLAN subinterfaces with same VLAN ID Their relationship is the same as the relationship between any two FortiGate network interfaces Rules for VLAN IP addresses IP addresses of all FortiGate interfaces cannot overlap That is the IP addresses of all interfaces must be on different subnets This rule applies to both physical interfaces a...

Page 71: ...ID that matches the VLAN ID of the packets to be received by this VLAN subinterface 6 Select the virtual domain to which to add this VLAN subinterface See System virtual domain on page 139 for information about virtual domains 7 Select the name of a zone if you want this VLAN subinterface to belong to a zone You can only select a zone that has been added to the virtual domain selected in the previ...

Page 72: ... FortiGate Internal and external interface you would add a VLAN subinterface to the internal interface and another VLAN subinterface to the external interface If these VLAN subinterfaces have the same VLAN IDs the FortiGate unit applies firewall policies to the traffic on this VLAN If these VLAN subinterfaces have different VLAN IDs or if you add more than two VLAN subinterfaces you can also use f...

Page 73: ...e and configured with three VLAN subinterfaces In this configuration the FortiGate unit could be added to this network to provide virus scanning web content filtering and other services to each VLAN VLAN1 VLAN1 VLAN2 VLAN2 VLAN3 VLAN3 root virtual domain New virtual domain Internal External VLAN1 VLAN3 VLAN2 VLAN Switch or router VLAN Switch or router VLAN trunk VLAN1 VLAN2 VLAN3 VLAN trunk FortiG...

Page 74: ...faces Transparent mode virtual domains and VLANs VLAN subinterfaces are added to and associated with virtual domains By default the FortiGate configuration includes one virtual domain named root and you can add as many VLAN subinterfaces as you require to this virtual domain You can add more virtual domains if you want to separate groups of VLAN subinterfaces into virtual domains For information o...

Page 75: ...rface Virtual Domain Select a virtual domain to display the VLAN interfaces added to this virtual domain Name The name of the interface or VLAN subinterface Access The administrative access configuration for the interface See To control administrative access to an interface on page 62 for information about administrative access options Status The administrative status for the interface If the admi...

Page 76: ... using a Dynamic DNS service DDNS If the FortiGate unit uses a dynamic IP address you can arrange with a DDNS service provider to use a domain name to provide redirection of traffic to your network whenever the IP address changes 8 Configure the administrative access MTU and log settings as you would for any FortiGate interface See Interface settings on page 54 for more descriptions of these setti...

Page 77: ...tatic routing periodic router advertisements and tunneling of IPv6 addressed traffic over an IPv4 addressed network All of these features must be configured through the Command Line Interface CLI See the FortiGate CLI Reference Guide for information on the following commands Table 2 IPv6 CLI commands Feature CLI Command Interface configuration including periodic router advertisements config system...

Page 78: ...78 01 28006 0010 20041105 Fortinet Inc FortiGate IPv6 support System network ...

Page 79: ...face cannot provide both functions at the same time This section describes Service Server Exclude range IP MAC binding Dynamic IP Service Go to System DHCP Service to configure the DHCP service provided by each FortiGate interface You can configure each interface to be a DHCP relay or a DHCP server or you can turn off DHCP services Figure 20 DHCP service list Note To configure DHCP server or DHCP ...

Page 80: ... 3 Select DHCP Relay Agent Interface List of FortiGate interfaces Service The DHCP service provided by the interface none DHCP Relay or DHCP Server Edit View icon Select to view or modify the DHCP service configuration for an interface Interface The name of the interface None No DHCP services provided by the interface DHCP Relay Agent Select to configure the interface to be a DHCP relay agent Type...

Page 81: ...configuration for this interface See To configure a DHCP server for an interface on page 82 Server You can configure one or more DHCP servers for any FortiGate interface As a DHCP server the interface dynamically assigns IP addresses to hosts on a network connected to the interface You can add more than one DHCP server to a single interface to be able to provide DHCP services to multiple networks ...

Page 82: ...nding IP for the range of IP addresses that this DHCP server assigns to DHCP clients Network Mask Enter the netmask that the DHCP server assigns to DHCP clients Lease Time Select Unlimited for an unlimited lease time or enter the interval in days hours and minutes after which a DHCP client must ask the DHCP server for new settings The lease time can range from 5 minutes to 100 days DNS Server Ente...

Page 83: ...nected subnets sends a DHCP request it is relayed to the FortiGate interface by the router using DHCP relay The FortiGate unit selects the DHCP server configuration with an IP range that matches the subnet address from which the DHCP request was received and uses this DHCP server to assign an IP configuration to the computer that made the DHCP request The DHCP configuration packets are sent back t...

Page 84: ... the device When you add the MAC address and an IP address to the IP MAC binding list the DHCP server always assigns this IP address to the MAC address IP MAC binding pairs apply to all FortiGate DHCP servers Figure 26 IP MAC binding list Starting IP Enter the starting IP of an exclude range Ending IP Enter the ending IP of an exclude range Create New Select Create New to add a DHCP IP MAC binding...

Page 85: ...dresses and the expiry time and date for these addresses To view the dynamic IP list 1 Go to System DHCP Dynamic IP 2 Select the interface for which you want to view the list Name Enter a name for the IP MAC address pair IP Address Enter the IP address for the IP and MAC address pair The IP address must be within the configured IP range MAC Address Enter the MAC address of the device Interface Sel...

Page 86: ...86 01 28006 0010 20041105 Fortinet Inc Dynamic IP System DHCP ...

Page 87: ...o set the FortiGate system time For effective scheduling and logging the FortiGate system time must be accurate You can either manually set the FortiGate system time or you can configure the FortiGate unit to automatically keep its system time correct by synchronizing with a Network Time Protocol NTP server Figure 28 System time System Time The current FortiGate system date and time Refresh Select...

Page 88: ... including the idle timeout and authentication timeout The language displayed by the web based manager Front control buttons and LCD PIN protection Dead gateway detection interval and failover detection Automatically adjust clock for daylight saving changes Select the Automatically adjust clock for daylight saving changes check box if you want the FortiGate system clock to be adjusted automaticall...

Page 89: ...d connection can be idle before the user must authenticate again The maximum authtimeout is 480 minutes 8 hours The default Auth Timeout is 15 minutes For more information see Setting authentication timeout on page 242 Language Select a language for the web based manager to use Choose from English Simplified Chinese Japanese Korean or French LCD Panel Select the PIN Protection check box and type a...

Page 90: ... times that the connection test fails before the FortiGate unit assumes that the gateway is no longer functioning 4 Select Apply HA Fortinet achieves high availability HA using redundant hardware and the FortiGate Clustering Protocol FGCP Each FortiGate unit in an HA cluster enforces the same overall security policy and shares the same configuration settings You can add up to 32 FortiGate units to...

Page 91: ...e CLI you can configure the FortiGate unit to load balance all network traffic among the FortiGate units in the cluster See the FortiGate CLI Reference Guide for more information HA configuration Configuring an HA cluster Managing an HA cluster For more information about FortiGate HA and the FGCP see the FortiGate High Availability Guide HA configuration Go to System Config HA and use the options ...

Page 92: ...atus of all FortiGate units in the cluster Status information includes the cluster ID status up time weight and monitor information For more information see To view the status of each cluster member on page 101 Mode All members of the HA cluster must be set to the same HA mode Active Active Load balancing and failover HA Each cluster unit actively processes connections and monitors the status of t...

Page 93: ...imary cluster unit The unit priority range is 0 to 255 The default unit priority is 128 You can use the unit priority to control the order in which cluster units become the primary cluster unit when a cluster unit fails For example if you have three FortiGate 3600s in a cluster you can set the unit priorities as shown in Table 4 Cluster unit A will always be the primary cluster unit because it has...

Page 94: ...rtiGate units in the HA cluster The maximum password length is 15 characters If you have more than one FortiGate HA cluster on the same network each cluster should have a different password Schedule If you are configuring an active active cluster select a load balancing schedule None No load balancing Select None when the cluster interfaces are connected to load balancing switches Hub Load balanci...

Page 95: ... individual cluster member status The HA heartbeat constantly communicates HA status information to make sure that the cluster is operating properly You can enable heartbeat communications for physical interfaces but not for VLAN subinterfaces Enabling the HA heartbeat for more interfaces increases reliability If an interface fails the HA heartbeat can be diverted to another interface HA heartbeat...

Page 96: ...city of the interface to process network traffic For most FortiGate models if you do not change the heartbeat device configuration you would isolate the HA interfaces of all of the cluster units by connecting them all to the same switch If the cluster consists of two FortiGate units you can connect the heartbeat device interfaces directly using a crossover cable HA heartbeat and data traffic are s...

Page 97: ...n and then how to connect the FortiGate units to form a cluster Once the cluster is connected you can configure it in the same way as you would configure a standalone FortiGate unit To configure a FortiGate unit for HA operation To connect a FortiGate HA cluster To add a new unit to a functioning cluster To configure weighted round robin weights To configure a FortiGate unit for HA operation Each ...

Page 98: ...tem Status 16 Select Change to Transparent Mode and select OK to switch the FortiGate unit to Transparent mode 17 Power off the FortiGate unit 18 Repeat this procedure for all of the FortiGate units in the cluster then continue with To connect a FortiGate HA cluster on page 98 To connect a FortiGate HA cluster Use the following procedure to connect a cluster operating in NAT Route mode or Transpar...

Page 99: ...al network Connect the external interfaces of each FortiGate unit to a switch or hub connected to your external network Optionally connect ports 1 2 and 3 of each FortiGate unit to switches or hubs connected to other networks Connect the 4 HA interfaces of the FortiGate units to another switch or hub Figure 31 HA network configuration 2 Power on all the FortiGate units in the cluster As the units ...

Page 100: ...ions processed by the primary cluster unit by increasing the weight assigned to the subordinate cluster units Weight values are entered as two values the priority order of the unit in the cluster in the range 0 to 31 followed by its weight also in the range 0 to 31 For example if you have a cluster of three FortiGate units you can enter the following command to configure the weight values for each...

Page 101: ... of each cluster member on page 101 and To view and manage logs for individual cluster units on page 102 You can manage individual cluster units by using SSH to connect to the CLI of the cluster From the CLI you can use the execute ha manage command to connect to the CLI of each unit in the cluster You can also manage individual cluster units by using a null modem cable to connect to the primary c...

Page 102: ...n check mark indicates that the cluster unit is operating normally A red X indicates that the cluster unit cannot communicate with the primary unit Up Time The time in days hours minutes and seconds since the cluster unit was last started Monitor Displays system status information for each cluster unit CPU Usage The current CPU status of each cluster unit The web based manager displays CPU usage f...

Page 103: ...o connect to the CLI of subordinate cluster units You log into the subordinate unit using the ha_admin administrator account This built in administrator account gives you read and write permission on the subordinate unit 1 Use SSH to connect to the cluster and log into the CLI Connect to any cluster interface configured for SSH administrative access to log into the cluster You can also use a direc...

Page 104: ...ncludes support for most of RFC 2665 Ethernet like MIB and most of RFC 1213 MIB II for more information see FortiGate MIBs on page 107 This section describes Configuring SNMP SNMP community FortiGate MIBs FortiGate traps Fortinet MIB fields Configuring SNMP Go to System Config SNMP v1 v2c to configure the SNMP agent Figure 33 Configuring SNMP SNMP Agent Enable the FortiGate SNMP agent Description ...

Page 105: ...r the FortiGate unit for a different set of events You can also add the IP addresses of up to 8 SNMP managers to each community Figure 34 SNMP community options part 1 Communities The list of SNMP communities added to the FortiGate configuration You can add up to 3 communities Name The name of the SNMP community Queries The status of SNMP queries for each SNMP community The query status can be ena...

Page 106: ...manager can use this SNMP community Interface Optionally select the name of the interface that this SNMP manager uses to connect to the FortiGate unit You only have to select the interface if the SNMP manager is not on the same subnet as the FortiGate unit This can occur if the SNMP manager is on the Internet or behind a router Add Select Add to add more SNMP managers You can add up to 8 SNMP mana...

Page 107: ...K FortiGate MIBs The FortiGate SNMP agent supports FortiGate proprietary MIBs as well as standard RFC 1213 and RFC 2665 MIBs RFC support includes support for the parts of RFC 2665 Ethernet like MIB and the parts of RFC 1213 MIB II that apply to FortiGate unit configuration The FortiGate MIBs are listed in Table 6 You can obtain these MIB files from Fortinet technical support To be able to communic...

Page 108: ...aps see FortiGate traps on page 108 RFC 1213 MIB II The FortiGate SNMP agent supports MIB II groups with the following exceptions No support for the EGP group from MIB II RFC 1213 section 3 11 and 6 10 Protocol statistics returned for MIB II groups IP ICMP TCP UDP etc do not accurately capture all FortiGate traffic activity More accurate information can be obtained from the information reported by...

Page 109: ...Change The IP address of an interface of a FortiGate unit changes The trap message includes the name of the interface the new IP address of the interface and the serial number of the FortiGate unit This trap can be used to track interface IP address changes for interfaces configured with dynamic IP addresses set using DHCP or PPPoE Table 9 FortiGate VPN traps Trap message Description VPN tunnel is...

Page 110: ...thout a hard drive log to memory usage has exceeds 90 Table 13 FortiGate HA traps Trap message Description Primary unit switch HaSwitch The different unit in the HA cluster became the primary unit Table 14 System MIB fields MIB field Description model FortiGate model number for example 400 for the FortiGate 400 serial FortiGate unit serial number version The firmware version currently running on t...

Page 111: ...r of packets processed by the FortiGate unit byteCount The number of bytes processed by the FortiGate unit idsCount The number of attacks detected by the IPS running on the FortiGate unit in the last 20 hours avCount The number of viruses detected by the antivirus system running on the FortiGate unit in the last 20 hours Table 16 Administrator accounts MIB field Description index The index number ...

Page 112: ...d Description index The index number virtual domain added to the FortiGate unit name The name of the virtual domain added to the FortiGate unit Each FortiGate unit includes at least one virtual domain named root auth The authentication type of for the local user Can be password LDAP or RADIUS state Whether the local user is enabled or disable Table 19 Active IP sessions MIB field Description index...

Page 113: ...lacement message that you want to change select Edit 4 Edit the content of the message Name The type of replacement message You can change messages added to email web pages in http traffic messages that are displayed to ftp users alert mail messages messages added to smtp email and messages added to web pages blocked by web filter category blocking Description Description of the replacement messag...

Page 114: ...t contained a virus or was blocked by antivirus file blocking QUARFILENAME can be used in virus and file block messages Quarantining is only available on FortiGate units with a local disk URL The URL of a web page This can be a web page that is blocked by web filter content or URL blocking URL can also be used in http virus and file block messages to be the URL of the web page from which a user at...

Page 115: ...which the file was removed EMAIL_TO The email address of the intended receiver of the message from which the file was removed NIDSEVENT The IPS attack message NIDSEVENT is added to alert email intrusion messages SERVICE The name of the web filtering service CATEGORY The name of the content category of the web site FORTINET The Fortinet logo Table 20 Replacement message tags Continued Tag Descripti...

Page 116: ...116 01 28006 0010 20041105 Fortinet Inc FortiManager System config ...

Page 117: ...ow read only write only or both read and write access to the following FortiGate features This chapter describes Administrators Access profiles Administrators Use the admin account or an account with system configuration read and write privileges to add new administrator accounts and control their permission levels System Configuration Can access the system status interface virtual domain HA routi...

Page 118: ...ge Password icon The admin administrator account cannot be deleted Administrator Enter the login name for the administrator account Password Type a password for the administrator account For improved security the password should be at least 6 characters long Confirm Password Type the password for the administrator account a second time to confirm that you have typed it correctly Trusted Host 1 Tru...

Page 119: ...tor must connect only through the subnet or subnets you specify You can even restrict an administrator to a single IP address if you define only one trusted host IP address with a netmask of 255 255 255 255 When you set trusted hosts for all administrators the FortiGate unit does not respond to administrative access attempts from any other hosts This provides the highest security If you leave even...

Page 120: ...under Access Control Allow Write All Select Allow Write All to give an administrator write privilege on all the items under Access Control System Configuration Allow or deny access to the system status interface virtual domain HA routing option SNMP time and replacement message features Log Report Allow or deny access to the log setting log access and alert email features Security Policy Allow or ...

Page 121: ...041105 121 To configure an access profile 1 Go to System Admin Access Profile 2 Select Create New to add an access profile or select the edit icon to edit an existing access profile 3 Enter a name for the access profile 4 Select or clear the Access Control check boxes as required 5 Select OK ...

Page 122: ...122 01 28006 0010 20041105 Fortinet Inc Access profiles System administration ...

Page 123: ...d spam filtering files to the management computer You can also restore system configuration VPN certificate web and spam filtering files from previously downloaded backup files Figure 44 Backup and restore list Category The list of files that can be backed up and restored Latest Backup The date and time of the last backup The Restore Upload Backup and Reset to factory default icons All Configurati...

Page 124: ... system to its original configuration including resetting interface addresses This procedure does not change the firmware version or the antivirus or attack definitions Debug Log Download debug log Web Filtering Web Content Block Restore or back up the Web Content Block list Web URL Block List Restore or back up the Web URL Block list Web URL Exempt List Restore or back up the Web URL Exempt list ...

Page 125: ... or select Browse and locate the file 4 Select OK If you restore the system configuration the FortiGate unit restarts loading the new system settings You should then reconnect to the web based manager and review your configuration to confirm that the uploaded system settings have taken effect 5 Select Return This step does not apply if you restore the system configuration To back up VPN certificat...

Page 126: ...rt 9443 To receive push updates the FDN must be able to route packets to the FortiGate unit using UDP port 9443 For information about configuring push updates see To enable push updates on page 131 The FDN is a world wide network of FortiProtect Distribution Servers FDSs When the FortiGate unit connects to the FDN it connects to the nearest FDS To do this all FortiGate units are programmed with a ...

Page 127: ...he FortiGate unit to send push updates Push updates may not be available if you have not registered the FortiGate unit see To register a FortiGate unit on page 136 if there is a NAT device installed between the FortiGate unit and the FDN see Enabling push updates through a NAT device on page 132 or if your FortiGate unit connects to the Internet using a proxy server see To enable scheduled updates...

Page 128: ...t was successful and new updates were installed Other messages can indicate that the FortiGate was not able to connect to the FDN and other error conditions Allow Push Update Select this check box to allow automatic updates of the FortiGate unit Use override push IP Select this check box and enter the override IP address and port number Override push IP addresses and ports are used when there is a...

Page 129: ...g whether the update was successful or not To enable scheduled updates 1 Go to System Maintenance Update center 2 Select the Scheduled Update check box 3 Select one of the following to check for and download updates 4 Select Apply The FortiGate unit starts the next scheduled update according to the new update schedule Whenever the FortiGate unit runs a scheduled update the event is recorded in the...

Page 130: ...em autoupdate tunneling set address proxy address_ip set port proxy port set username username_str set password password_str set status enable end For example if the IP address of the proxy server is 67 35 50 34 its port is 8080 the user name is proxy_user and the password is proxy_pwd enter the following command config system autoupdate tunneling set address 67 35 50 34 set port 8080 set username...

Page 131: ...as the only method for obtaining updates The FortiGate unit might not receive the push notification Also when the FortiGate unit receives a push notification it makes only one attempt to connect to the FDN and download updates To enable push updates 1 Go to System Maintenance Update center 2 Select Allow Push Update 3 Select Apply Push updates when FortiGate IP addresses change The SETUP message t...

Page 132: ... the FortiGate NAT device and the FortiGate unit on the internal network so that the FortiGate unit on the internal network can receive push updates 1 Add a port forwarding virtual IP to the FortiGate NAT device 2 Add a firewall policy to the FortiGate NAT device that includes the port forwarding virtual IP 3 Configure the FortiGate unit on the internal network with an override push IP and port To...

Page 133: ...Select the Use override push check box 4 Set IP to the external IP address added to the virtual IP 5 Set Port to the external service port added to the virtual IP 6 Select Apply The FortiGate unit sends the override push IP address and port to the FDN The FDN now uses this IP address and port for push updates to the FortiGate unit on the internal network If the external IP address or external serv...

Page 134: ...egister the FortiGate unit with FortiNet Contact Information Enter the contact information so that FortiNet support can reply to your bug report Items marked with an are required Bug Description Enter a description of the problem you have encountered with the FortiGate unit Send diagnostic information Send diagnostic information about the FortiGate unit including its current configuration to Forti...

Page 135: ... organization purchased You can register multiple FortiGate units in a single session without re entering your contact information Once registration is completed Fortinet sends a Support Login user name and password to your email address You can use this user name and password to log on to the Fortinet support web site to View your list of registered FortiGate units Register additional FortiGate u...

Page 136: ...d the FortiCare Support Contract number to the registration information You can also register the FortiGate unit without purchasing a FortiCare Support Contract In that case when you purchase a FortiCare Support Contract you can update the registration information to add the support contract number A single FortiCare Support Contract can cover multiple FortiGate units You must enter the same servi...

Page 137: ...eturn to the previous page to enter the number If you do not have a FortiCare Support Contract you can select Continue to complete the registration If you have entered a support contract number a real time validation is performed to verify that the SCN information matches the FortiGate unit If the information does not match you can try entering it again A web page is displayed that contains detail...

Page 138: ...e to reset system settings to the values set at the factory This procedure does not change the firmware version or the antivirus or attack definitions 1 Go to System Maintenance Shutdown 2 Select Reset to factory default 3 Select Apply The FortiGate unit restarts with the configuration that it had when it was first powered on 4 Reconnect to the web based manager and review the system configuration...

Page 139: ...r cross the virtual domain border The remainder of FortiGate functionality is shared between virtual domains This means that there is one IPS configuration one antivirus configuration one web filter configuration one protection profile configuration and so on shared by all virtual domains As well virtual domains share firmware versions antivirus and attack databases and user databases For a comple...

Page 140: ...gs Physical interfaces see To add physical interfaces to a virtual domain on page 144 VLAN subinterfaces see To add VLAN subinterfaces to a virtual domain on page 145 Zones see To add zones to a virtual domain on page 145 Management IP Transparent mode see To select a management virtual domain and add a management IP on page 144 Routing configuration Router configuration in NAT Route mode see To c...

Page 141: ...virus Definitions and engine Attack Definitions and engine Serial Number Operation Mode Network configuration DNS settings DHCP configuration DHCP settings are applied per interface no matter which virtual domain the interface has been added to System Config Time Options HA SNMP v1 v2c Replacement messages FortiManager configuration System Admin Administrators Access profiles System Maintenance Up...

Page 142: ...al domain if you want these systems to communicate with network resources that can connect to a different virtual domain Virtual domains Go to System Virtual domain Virtual domains to view and add virtual domains Figure 49 Virtual domain list Create New Add a new virtual domain Current The name of the current virtual domain Select Change to choose a different domain The default virtual domain is r...

Page 143: ...in Name The virtual domain must not have the same name as a VLAN or zone 4 Select OK Selecting a virtual domain The following procedure applies to NAT Route and Transparent mode To select a virtual domain to configure 1 Go to System Virtual domain Virtual domains 2 Select Change following the current virtual domain name above the table 3 Choose the virtual domain to configure 4 Select OK The foote...

Page 144: ...domains Adding interfaces VLAN subinterfaces and zones to a virtual domain Configuring routing for a virtual domain Configuring firewall policies for a virtual domain Configuring IPSec VPN for a virtual domain Adding interfaces VLAN subinterfaces and zones to a virtual domain To add physical interfaces to a virtual domain A virtual domain must contain at least two interfaces These can be physical ...

Page 145: ...binterface from one virtual domain to another You cannot remove a VLAN subinterface from a virtual domain if firewall policies have been added for it Delete the firewall policies or remove the VLAN subinterface from the firewall policies first If the VLAN subinterface has been added to a zone it is removed from the zone when you move it to a different virtual domain 1 Go to System Network Interfac...

Page 146: ...rtual domain To configure the routing table for a virtual domain in Transparent mode 1 Go to System Virtual domain Virtual domains 2 Select Change following the current virtual domain name above the table 3 Choose the virtual domain for which to configure routing 4 Select OK 5 Go to System Network Routing Table 6 Configure the routing table for the current virtual domain as required See Routing ta...

Page 147: ...able 3 Choose the virtual domain for which to configure firewall addresses 4 Select OK 5 Go to Firewall Address 6 Add new firewall addresses address ranges and address groups to the current virtual domain See Address on page 206 To add IP pools to a virtual domain The following procedure applies to NAT Route mode 1 Go to System Virtual domain Virtual domains 2 Select Change following the current v...

Page 148: ...irtual domain The following procedure applies to NAT Route and Transparent mode 1 Go to System Virtual domain Virtual domains 2 Select Change following the current virtual domain name above the table 3 Choose the virtual domain for which to configure VPN 4 Select OK 5 Go to VPN 6 Configure IPSec VPN PPTP L2TP and certificates as required See VPN on page 253 ...

Page 149: ...ted You can decrease the distance value of a static route to indicate that the route is preferable compared to another static route that specifies a different gateway to the same destination network Routes having lower administrative distances are preferable and are selected first when two or more routes to the same destination network are available The FortiGate unit routes packets using a best m...

Page 150: ...68 10 1 Device Name of the interface connected to network 192 168 10 0 24 e g external Distance 10 The Gateway setting specifies the IP address of the next hop router interface to the FortiGate external interface The interface behind the router 192 168 10 1 is the default gateway for FortiGate_1 In some cases there may be routers behind the FortiGate unit If the destination IP address of a packet ...

Page 151: ...stination IP mask 192 168 30 0 24 Gateway 192 168 10 2 Device dmz Distance 10 To route packets from Network_2 to Network_1 Router_2 must be configured to use the FortiGate dmz interface as its default gateway On the FortiGate unit you would create a new static route with these settings Destination IP mask 192 168 20 0 24 Gateway 192 168 10 1 Device internal Distance 10 Static route list Figure 52 ...

Page 152: ...uence number for this route IP The destination IP address for this route Mask The netmask for this route Gateway The IP address of the first next hop router to which this route directs traffic Device The name of the FortiGate interface through which to route traffic Distance The administrative distance for the route The Delete Edit and Move to icons Destination IP Mask Enter the destination IP add...

Page 153: ...g list and attempts to match the packet with a policy The policy route supplies the next hop gateway as well as the FortiGate interface to be used by the traffic If no policy route matches the packet the FortiGate unit routes the packet using the regular routing table Policy route list Figure 55 Policy routes Create New Add a new policy route The sequence number for this policy route Incoming The ...

Page 154: ...RIP supports both RIP version 1 as defined by RFC 1058 and RIP version 2 as defined by RFC 2453 RIP version 2 enables RIP messages to carry more information and to support simple authentication and subnet masks Protocol Match packets that have this protocol number Incoming Interface Match packets that are received on this interface Source Address Mask Match packets that have this source IP address...

Page 155: ...s servers in the network should have the same RIP timer settings Update The time interval in seconds between RIP updates Garbage The time in seconds that must elapse after the timeout interval for a route expires before RIP deletes the route If RIP receives an update for the route after the timeout timer expires but before the garbage timer expires then the entry is switched back to reachable Time...

Page 156: ...used for the redistributed routes 4 Select a Route map name 5 Select Apply Networks list Identify the networks for which to send and receive RIP updates If a network is not specified interfaces in that network will not be advertised in RIP updates Figure 58 RIP Networks list Route map Enter the name of the route map to use for the redistributed connected routes For information on how to configure ...

Page 157: ...on 2 authentication RIP version send and receive for the specified interface and configure and enable split horizon Authentication is only available for RIP version 2 packets sent and received by an interface Set authentication to None if Send Version or Receive Version are set to 1 or 1 2 Figure 60 RIP interface list Create New Add a new RIP interface Interface The FortiGate interface name Send V...

Page 158: ... the Receive Version here overrides the default RIP version for this interface Split Horizon Configure RIP to use either regular or poisoned reverse split horizon on this interface Select Regular to prevent RIP from sending updates for a route back out the interface from which it received that route Select Poisoned reverse to send updates with routes learned on an interface back out the same inter...

Page 159: ...x list If you do not specify an interface the filter will be applied to all interfaces in the current virtual domain You must configure the access list or prefix list that you want the distribute list to use before you configure the distribute list For more information on configuring access lists and prefix lists see Access list on page 162 and Prefix list on page 163 Figure 62 RIP Distribute list...

Page 160: ...ribute list Direction The direction for the filter Filter The type of filter and the filter name Interface The interface to use this filter on If no interface name is displayed this distribute list is used for all interfaces Enable The status of this distribute list The Delete and Edit icons Direction Set the direction for the filter Select In to filter incoming packets Select Out to filter outgoi...

Page 161: ...virtual domain go to System Virtual Domain Virtual Domains and select the virtual domain Create New Add a new offset list Direction The direction for the offset list Access list The access list to use for this offset list Offset The offset number to add to the metric for this offset list Interface The interface to match for this offset list Enable The status of this offset list The Delete and Edit...

Page 162: ...ix exactly or to match the prefix and any more specific prefix The FortiGate unit attempts to match a packet against the rules in an access list starting at the top of the list If it finds a match for the prefix it takes the action specified for that prefix If no match is found the default action is deny For an access list to take effect it must be called by another FortiGate routing feature such ...

Page 163: ...ed Match a network address enter the IP address and netmask that define the prefix for this access list entry 6 Select Exact match if required 7 Select OK Prefix list A prefix list is an enhanced version of an access list that allows you to control the length of the prefix netmask Each rule in a prefix list consists of a prefix IP address and netmask the action to take for this prefix permit or de...

Page 164: ...ture such as RIP or OSPF Figure 69 Prefix list New Prefix list Figure 70 Prefix list name configuration To add a prefix list name 1 Go to Router Router Objects Prefix List 2 Select Create New 3 Enter a name for the prefix list 4 Select OK Create New Add a new prefix list name An access list and a prefix list cannot have the same name Name The prefix list name Action The action to take for the pref...

Page 165: ... Select OK Route map list Route maps are a specialized form of filter Route maps are similar to access lists but have enhanced matching criteria and in addition to permit or deny actions can be configured to make changes as defined by set statements list Entry The prefix list name and the number of this entry Action Set the action to take for this prefix to Permit or Deny Prefix Select Match any t...

Page 166: ...tiple match statements are defined in a rule all the match statements must match before the set statements can be used For a route map to take effect it must be called by another FortiGate routing feature such as RIP Figure 72 Route map list New Route map Figure 73 Route map name configuration To add a route map name 1 Go to Router Router Objects Route map 2 Select Create New 3 Enter a name for th...

Page 167: ...y to deny routes that match this entry Match The criteria to match Interface Match a route with the selected destination interface Address Match a route if the destination address is included in the selected access list or prefix list Next hop Match a route that has a next hop router address included in the selected access list or prefix list Metric Match a route with the specified metric The metr...

Page 168: ...ates from one key to the next according to the scheduled send and receive lifetimes The sending and receiving routers should have their system dates and times synchronized but overlapping the key lifetimes ensures that a key is always available even if there is some difference in the system times See System time on page 87 for information on setting the FortiGate system date and time Figure 75 Key...

Page 169: ...he required hour minute second year month and day to start using this key for received routing updates Key chain entry The key chain name and the ID number for this key chain entry Key The key password can be up to 35 characters long Accept Lifetime Set the time period during which the key can be received Send Lifetime Set the time period during which the key can be sent Start For both accept and ...

Page 170: ...te routing table Routing monitor list Figure 78 Routing monitor To filter the routing monitor display 1 Go to Router Monitor Routing Monitor 2 Select a type of route to display or select all to display routes of all types For example select Connected to display all the directly connected routes or select RIP to display all the routes learned from RIP Type FIlter the display to show routes of the s...

Page 171: ...et router info ospf database get router info ospf interface get router info protocols Show the current state of active routing protocols Command syntax get router info protocols Note You can configure Type Network and Gateway filters individually or in any combination router info ospf command keywords and variables Keywords and variables Description Availability border routers Show OSPF routing ta...

Page 172: ...a A router connected to more than one area is an area border router ABR Routing information is contained in a link state database Routing information is communicated between routers using link state advertisements LSAs More information on OSPF can be found in RFC 2328 Command syntax pattern config router ospf set keyword variable end config router ospf unset keyword end get router ospf show router...

Page 173: ...before entering the overflow state The lsas_integer must be the same on all routers attached to the OSPF area and the OSPF backbone The valid range for lsas_integer is 0 to 4294967294 10000 All models database overflow time to recover seconds_integer Enter the time in seconds after which the FortiGate unit will attempt to leave the overflow state If seconds_integer is set to 0 the FortiGate unit w...

Page 174: ...y supports RFC 1583 When RFC 1583 compatibility is enabled routers choose the path with the lowest cost Otherwise routers choose the lowest cost intra area path through a non backbone area disable All models router id address_ipv4 Set the router ID The router ID is a unique number in IP address dotted decimal format that is used to identify an OSPF router to other OSPF routers The router ID should...

Page 175: ...must be a backbone area that all areas can connect to You can use a virtual link to connect areas that do not have a physical connection to the backbone Routers within an OSPF area maintain link state databases for their own areas config area command syntax pattern config area edit id_ipv4 set keyword variable end config area edit id_ipv4 unset keyword variable end config area delete id_ipv4 end c...

Page 176: ...on for interfaces the authentication configured for the area is not used Authentication passwords or keys are defined per interface See config ospf interface on page 188 none All models default cost cost_integer Enter the metric to use for the summary default route in a stub area or not so stubby area NSSA A lower default cost indicates a more preferred route The valid range for cost_integer is 1 ...

Page 177: ...SSA You can set the translator role to always to ensure this FortiGate unit always acts as a translator if it is in a NSSA even if other routers in the NSSA are also acting as translators You can set the translator role to candidate to have this FortiGate unit participate in the process for electing a translator for a NSSA You can set the translator role to never to ensure this FortiGate unit neve...

Page 178: ...ix list on page 163 config filter list command syntax pattern config filter list edit id_integer set keyword variable end config filter list edit id_integer unset keyword end config filter list delete id_integer end config filter list edit id_integer get end config filter list edit id_integer show end Note Both keywords are required filter list command keywords and variables Keywords and variables...

Page 179: ...ple shows how to display the configuration for area 15 1 1 1 config router ospf config area edit 15 1 1 1 show end config range Access the config range subcommand using the config area command Use the area range command to summarize routes at an area boundary If the network numbers in an area are contiguous the ABR advertises a summary route that includes all the networks within the area that are ...

Page 180: ... how to display the configuration for area 15 1 1 1 Note Only the prefix keyword is required All other keywords are optional range command keywords and variables Keywords and variables Description Default Availability advertise disable enable Enable or disable advertising the specified range enable All models prefix address_ipv4mask Specify the range of addresses to summarize No default All models...

Page 181: ... link allows traffic from the area to transit a directly connected area to reach the backbone The transit area cannot be a stub area Virtual links can only be set up between two area border routers ABRs config virtual link command syntax pattern config virtual link edit name_str set keyword variable end config virtual link edit name_str unset keyword end config virtual link delete name_str end con...

Page 182: ...t authentication The authentication key must be the same on both ends of the virtual link The maximum length for the authentication key is 15 characters No default All models authentication must be set to text dead interval seconds_integer The time in seconds to wait for a hello packet before declaring a router down The value of the dead interval should be four times the value of the hello interva...

Page 183: ...fig router ospf command retransmit interval seconds_integer The time in seconds to wait before sending a LSA retransmission The value for the retransmit interval must be greater than the expected round trip delay for a packet The valid range for seconds_integer is 1 to 65535 5 All models transmit delay seconds_integer The estimated time in seconds required to send a link state update packet on thi...

Page 184: ...g distribute list edit id_integer unset keyword end config distribute list delete id_integer end config distribute list edit id_integer get end config distribute list edit id_integer show end Example This example shows how to configure a distribute list numbered 2 to use an access list named acc_list1 for all static routes Note Both keywords are required distribute list command keywords and variab...

Page 185: ...for distribute list 2 config router ospf config distribute list edit 2 show end config neighbor Access the config neighbor subcommand using the config router ospf command Use this command to manually configure an OSPF neighbor on nonbroadcast networks OSPF packets are unicast to the specified neighbor address You can configure multiple neighbors config neighbor command syntax pattern config neighb...

Page 186: ...other keywords are optional neighbor command keywords and variables Keywords and variables Description Default Availability cost cost_integer Enter the cost to use for this neighbor The valid range for cost_integer is 1 to 65535 10 All models ip address_ipv4 Enter the IP address of the neighbor 0 0 0 0 All models poll interval seconds_integer Enter the time in seconds between hello packets sent to...

Page 187: ...d_integer end config network edit id_integer get end config network edit id_integer show end Example Use the following command to enable OSPF for the interfaces attached to networks specified by the IP address 10 0 0 0 and the netmask 255 255 255 0 and to add these interfaces to area 10 1 1 1 config router ospf config network edit 2 set area 10 1 1 1 set prefix 10 0 0 0 255 255 255 0 end end netwo...

Page 188: ...interface command syntax pattern config ospf interface edit interface name_str set keyword variable end config ospf interface edit interface name_str unset keyword end config ospf interface delete interface name_str end config ospf interface edit interface name_str get end config ospf interface edit interface name_str show end Note The interface name_str variable in the syntax pattern below repres...

Page 189: ...router is mistakenly added to the network If you configure authentication for the interface authentication for areas is not used All routers on the network must use the same authentication type none All models authentication key password_str Enter the password to use for text authentication The authentication key must be the same on all neighboring routers The maximum length for the authentication...

Page 190: ...y without unsetting all of the keys The key ID and key must be the same on all neighboring routers The valid range for id_integer is 1 to 255 key_str is an alphanumeric string of up to 16 characters No default All models authentication must be set to md5 mtu mtu_integer Change the Maximum Transmission Unit MTU size included in database description packets sent out this interface The valid range fo...

Page 191: ...priority router ID is used Point to point networks do not elect a DR or BDR therefore this setting has no effect on a point to point network The valid range for priority_integer is 0 to 255 1 All models retransmit interval seconds_integer The time in seconds to wait before sending a LSA retransmission The value for the retransmit interval must be greater than the expected round trip delay for a pa...

Page 192: ...ion key a2b3c4d5e end end This example shows how to display the settings for the OSPF interface configuration named test config router ospf config ospf interface edit test get end This example shows how to display the configuration for the OSPF interface configuration named test config router ospf config ospf interface edit test show end config redistribute Access the config redistribute subcomman...

Page 193: ...outer ospf config summary address Access the config summary address subcommand using the config router ospf command redistribute command keywords and variables Keywords and variables Description Default Availability metric metric_integer Enter the metric to be used for the redistributed routes The metric_integer range is from 1 to 16777214 10 All models metric type 1 2 Specify the external link ty...

Page 194: ...d get router ospf show router ospf Example This example shows how to summarize routes using the prefix 10 0 0 0 255 0 0 0 config router ospf config summary address edit 5 set prefix 10 0 0 0 255 0 0 0 end end This example shows how to display the OSPF settings get router ospf Note Only the prefix keyword is required All other keywords are optional summary address command keywords and variables Key...

Page 195: ...oute that best matches the destination address of the packet If a match is not found the FortiGate unit routes the packet using the default route Command syntax pattern config router static6 edit sequence_integer set keyword variable end config router static6 edit sequence_integer unset keyword end config router static6 delete sequence_integer end get router static6 sequence_integer show router st...

Page 196: ... 60 set gateway 12AB 0 0 CD30 123 4567 89AB CDEF end This example shows how to display the list of IPV6 static route numbers get router static6 This example shows how to display the settings for IPV6 static route 2 get router static6 2 This example shows how to display the IPV6 static route configuration show router static6 This example shows how to display the configuration for IPV6 static route ...

Page 197: ...et Each policy can be individually configured to route connections or apply network address translation NAT to translate source and destination IP addresses and ports You can add IP pools to use dynamic NAT when the firewall translates source addresses You can use policies to configure port address translation PAT through the FortiGate You can add protection profiles to firewall policies to apply ...

Page 198: ...wall policies How policy matching works When the FortiGate unit receives a connection attempt at an interface it selects a policy list to search through for a policy that matches the connection attempt The FortiGate unit chooses the policy list based on the source and destination addresses of the connection attempt The FortiGate unit then starts at the top of the selected policy list and searches ...

Page 199: ...chedule The schedule that controls when the policy should be active See Schedule on page 218 Service The service to which the policy applies See Service on page 210 Action The response to make when the policy matches a connection attempt Enable Enable or disable the policy Enabling the policy makes it available for the firewall to match it to incoming connections source destination n Policy list h...

Page 200: ...you must add it to the destination interface VLAN subinterface or zone For information about adding an address see Addresses on page x For NAT Route mode policies where the address on the destination network is hidden from the source network using NAT the destination can also be a virtual IP that maps the destination address of the packet to a hidden destination address See Virtual IP on page 222 ...

Page 201: ...If you select NAT you can also select Dynamic IP Pool and Fixed Port NAT is not available in Transparent mode Dynamic IP Pool Select Dynamic IP Pool to translate the source address to an address randomly selected from the IP pool An IP pool dropdown list appears when the policy destination interface is the same as the IP pool interface You cannot select Dynamic IP Pool if the destination interface...

Page 202: ...oups for authentication You can select Authentication for any service Users can authenticate with the firewall using HTTP Telnet or FTP For users to be able to authenticate you must add an HTTP Telnet or FTP policy that is configured for authentication When users attempt to connect through the firewall using this policy they are prompted to enter a firewall username and password If you want users ...

Page 203: ...able routers sort IP traffic into classes by inspecting the DS field in IPv4 header or the Traffic Class field in the IPv6 header You can use the FortiGate DiffServ feature to change the DSCP Differentiated Services Code Point value for all packets accepted by a policy The network uses these DSCP values to classify mark shape and police traffic and to perform intelligent queuing DSCP features are ...

Page 204: ...he results that you expect For information about arranging policies in a policy list see How policy matching works on page 198 To delete a policy 1 Go to Firewall Policy 2 Select the Delete icon beside the policy you want to delete 3 Select OK To edit a policy 1 Go to Firewall Policy 2 Select the Edit icon beside the policy you want to edit 3 Edit the policy as required 4 Select OK To change the p...

Page 205: ...le To enable a policy 1 Go to Firewall Policy 2 Select Enable Policy CLI configuration The natip keyword for the firewall policy command is used in encrypted VPN policies A natip address cannot be added using the web based manager You can configure complete firewall policies using from the CLI See the FortiGate CLI Reference Guide for descriptions of all firewall policy keywords Command syntax pat...

Page 206: ...s Configuring address groups firewall policy command keywords and variables Keywords and variables Description Default Availability natip address_ipv4mask Configure natip for a firewall policy with action set to encrypt and with outbound NAT enabled Specify the IP address and subnet mask to translate the source address of outgoing packets Set natip for peer to peer VPNs to control outbound NAT IP ...

Page 207: ...ubnet IP address 192 168 20 0 and Netmask 255 255 255 0 A single IP address for example IP Address 192 168 20 1 and Netmask 255 255 255 255 All possible IP addresses represented by IP Address 0 0 0 0 and Netmask 0 0 0 0 Create New Select Create New to add a firewall address Name The name of the firewall address Address The IP address and mask or IP address range of the firewall The Delete and Edit...

Page 208: ...n address 1 Go to Firewall Address 2 Select Create New 3 Enter a name to identify the address 4 Enter the IP address and netmask or the IP address range 5 Select OK To edit an address Edit an address to change its IP information You cannot edit the address name 1 Go to Firewall Address Address 2 Select the Edit icon beside the address you want to edit 3 Make any required changes 4 Select OK To del...

Page 209: ...s and features Address group options Address group options are configurable when creating or editing an address group Figure 87 Address group options Address group has the following options Note If an address group is included in a policy it cannot be deleted unless it is first removed from the policy Create New Select Create New to add an address group Group Name The name of the address group Mem...

Page 210: ...up 2 Select the Delete icon beside the address group you want to delete 3 Select OK To edit an address group 1 Go to Firewall Address Group 2 Select the Edit icon beside the address group you want to modify 3 Make any required changes 4 Select OK Service Use services to determine the types of communication accepted or denied by the firewall You can add any of the predefined services to a policy Yo...

Page 211: ... The name of the predefined services Detail The protocol for each predefined service Table 21 FortiGate predefined services Service name Description Protocol Port ANY Match connections on any port A connection that uses any of the predefined services is allowed through the firewall all all GRE Generic Routing Encapsulation A protocol that allows an arbitrary network protocol to be transmitted over...

Page 212: ...n ITU that defines how audiovisual conferencing data is transmitted across networks tcp 1720 1503 HTTP HTTP is the protocol used by the word wide web for transferring data for web pages tcp 80 HTTPS HTTP with secure socket layer SSL service for secure communication with web servers tcp 443 IKE IKE is the protocol to obtain authenticated keying material for use with ISAKMP for IPSEC udp 500 IMAP In...

Page 213: ... Protocol is a protocol that allows corporations to extend their own corporate network through private tunnels over the public Internet tcp 1723 QUAKE For connections used by the popular Quake multi player computer game udp 26000 27000 27910 27960 RAUDIO For streaming real audio multimedia traffic udp 7070 RLOGIN Rlogin service for remotely logging into a server tcp 513 RIP Routing Information Pro...

Page 214: ... protocol similar to FTP but with no security features udp 69 UDP All UDP ports udp 0 65535 UUCP Unix to Unix copy utility a simple file copying protocol udp 540 VDOLIVE For VDO Live streaming multimedia traffic tcp 7000 7010 WAIS Wide Area Information Server is an Internet search protocol tcp 210 WINFRAME For WinFrame communications between computers running Windows NT tcp 1494 X WINDOWS For remo...

Page 215: ...ns are the same Source Port Specify the Source Port number range for the service by entering the low and high port numbers If the service uses one port number enter this number in both the low and high fields Destination Port Specify the Destination Port number range for the service by entering the low and high port numbers If the service uses one port number enter this number in both the low and ...

Page 216: ... Select Create New 3 Enter a name for the new custom ICMP service 4 Select ICMP as the Protocol Type 5 Enter the ICMP type number and code number for the service 6 Select OK You can now add this custom service to a policy To add a custom IP service 1 Go to Firewall Service Custom 2 Select Create New 3 Enter a name for the new custom IP service 4 Select IP as the Protocol Type 5 Enter the IP protoc...

Page 217: ...up can contain predefined services and custom services in any combination You cannot add service groups to another service group Figure 93 Sample service group list The service group list has the following icons and features Service group options Service group options are configurable when creating or editing a service group Figure 94 Service group options Note To change the custom service name yo...

Page 218: ...up 2 Select the Edit icon beside the service group you want to modify 3 Make any required changes 4 Select OK Schedule Use schedules to control when policies are active or inactive You can create one time schedules and recurring schedules You can use one time schedules to create policies that are effective once for the period of time specified in the schedule Recurring schedules repeat weekly You ...

Page 219: ...on the Internet at all times You can add a one time schedule to block access to the Internet during a holiday period Figure 95 Sample one time schedule list The one time schedule list has the following icons and features One time schedule options Figure 96 One time schedule options One time schedule has the following options Create New Select Create New to add a one time schedule Name The name of ...

Page 220: ...me schedule you want to modify 3 Modify the schedule as required 4 Select OK to save the changes Recurring schedule list You can create a recurring schedule that activates or deactivates policies at specified times of the day or on specified days of the week For example you might want to prevent game play during working hours by creating a recurring schedule Figure 97 Sample recurring schedule lis...

Page 221: ...curring schedules use a 24 hour clock 6 Select OK To delete a recurring schedule 1 Go to Firewall Schedule Recurring 2 Select the Delete icon beside the recurring schedule you want to delete 3 Select OK Create New Select Create New to add a recurring schedule Name The name of the recurring schedule Day The initials of the days of the week on which the schedule is active Start The start time of the...

Page 222: ...r you must then add a port2 port3 firewall policy and set Destination to the virtual IP You can create three types of virtual IPs This section describes Virtual IP list Virtual IP options Configuring virtual IPs Note To change the one time schedule name you must delete the schedule and add it with a new name Static NAT Used to translate an address on a source network to a hidden address on a desti...

Page 223: ...tic NAT or port forwarding Figure 100 Virtual IP options static NAT Figure 101 Virtual IP options port forwarding Create New Select Create New to add a virtual IP Name The name of the virtual IP IP The external IP address mapped to an address on the destination network Service Port The external port number of the service from the IP Map to IP The real IP address on the destination network Map to P...

Page 224: ...cted in step 4 However the external IP address must be routed to the selected interface The virtual IP address and the external IP address can be on different subnets 7 Enter the Map to IP address to which to map the external IP address For example the IP address of a web server on an internal network 8 Select OK Name Enter the name to identify the virtual IP Addresses address groups and virtual I...

Page 225: ...7 Enter the External Service Port number for which you want to configure port forwarding The external service port number must match the destination port of the packets to be forwarded For example if the virtual IP provides access from the Internet to a web server the external service port number is 80 the HTTP port 8 Enter the Map to IP address to which to map the external IP address For example ...

Page 226: ...P server the external service port number should be 1723 the PPTP port See PPTP passthrough on page 270 for more information 8 Enter the Map to IP address to which to map the external IP address For example the IP address of a PPTP server on an internal network 9 Enter the Map to Port number to be added to packets when they are forwarded If you do not want to translate the port enter the same numb...

Page 227: ...P pools to any interface and select the IP pool to use when configuring a firewall policy You can enter an IP address range using the following formats x x x x x x x x for example 192 168 110 100 192 168 110 120 x x x x x for example 192 168 110 100 120 This section describes IP pool list IP pool options Configuring IP pools IP Pools for firewall policies that use fixed ports IP pools and dynamic ...

Page 228: ...the IP pool as required 4 Select OK to save the changes IP Pools for firewall policies that use fixed ports Some network configurations do not operate correctly if a NAT policy translates the source port of packets used by the connection NAT translates source ports to keep track of connections for a particular service You can select fixed port for NAT policies to prevent source port translation Ho...

Page 229: ...ection As a result connections to the Internet appear to be originating from any of the IP addresses in the IP pool Protection profile Use protection profiles to apply different protection settings for traffic that is controlled by firewall policies You can use protection profiles to Configure antivirus protection for HTTP FTP IMAP POP3 and SMTP policies Configure web filtering for HTTP policies C...

Page 230: ...ofile under normal circumstances but it is available if you have extreme problems with viruses and require maximum screening Scan To apply virus scanning to HTTP FTP IMAP POP3 and SMTP traffic Quarantine is also selected for all content services On FortiGate models with a hard disk if antivirus scanning finds a virus in a file the file is quarantined on the FortiGate hard disk If required system a...

Page 231: ... See Configuring web category filtering options on page 233 Spam Filtering See Configuring spam filtering options on page 234 IPS See Configuring IPS options on page 235 Content Archive See Configuring content archive options on page 235 Virus Scan Enable or disable virus scanning for viruses and worms for each protocol HTTP FTP IMAP POP3 SMTP Grayware if enabled in Antivirus Config Config is incl...

Page 232: ...reate and enable a signature to append to outgoing email SMTP only Web Content Block Enable or disable web page blocking for HTTP traffic based on the banned words and patterns in the content block list Web URL Block Enable or disable web page filtering for HTTP traffic based on the URL block list Web Exempt List Enable or disable web page filtering for HTTP traffic based on the URL exempt list Ex...

Page 233: ...s HTTP only Block any web pages that have not been rated by the web filtering service Provide details for blocked HTTP 4xx and 5xx errors HTTP only Display a replacement message for 4xx and 5xx HTTP errors If the error is allowed through then malicious or objectionable sites could use these common error pages to circumvent web category blocking Allow websites when a rating error occurs HTTP only A...

Page 234: ...e or disable checking incoming email addresses against the configured spam filter email address list Return e mail DNS check Enable or disable checking that the domain specified in the reply to or from address has an A or MX record MIME headers check Enable or disable checking source MIME headers against the configured spam filter MIME header list Banned word check Enable or disable checking sourc...

Page 235: ...iles 1 Go to Firewall Protection Profile 2 Select Create New 3 Enter a name for the profile 4 Configure the protection profile options 5 Select OK Note Some popular email clients cannot filter messages based on the MIME header Check your email client features before deciding how to tag spam IPS Signature Enable or disable signature based intrusion detection and prevention for all protocols IPS Ano...

Page 236: ...network protection for files downloaded from the web by internal network users select an internal to external policy list 3 Select Create New to add a policy or select Edit for the policy you want to modify 4 Select protection profile 5 Select a protection profile from the list 6 Configure the remaining policy settings if required 7 Select OK 8 Repeat this procedure for any policies for which you ...

Page 237: ... profiles to apply different protection settings for traffic controlled by firewall policies Command syntax pattern config firewall profile edit profilename_str set keyword variable end config firewall profile edit profilename_str unset keyword end config firewall profile delete profilename_str end get firewall profile profilename_str show firewall profile profilename_str ...

Page 238: ... downloading files from an FTP server the FortiGate unit sends 1 byte every 30 seconds to prevent the client from timing out during scanning and download If a virus is detected the FortiGate unit stops the download The user must then delete the partially downloaded file There should not be enough content in the file to cause any harm Enabling splice reduces timeouts when uploading and downloading ...

Page 239: ...ice enables the FortiGate unit to simultaneously scan an email and send it to the SMTP server If the FortiGate unit detects a virus it terminates the server connection and returns an error message to the sender listing the virus name and infected filename In this mode the SMTP server is not able to deliver the email if it was sent with an infected attachment Throughput is higher when splice is ena...

Page 240: ...mmand get firewall profile This example shows how to display the settings for the spammail profile get firewall profile spammail This example shows how to display the configuration for the firewall profile command show firewall profile This example shows how to display the configuration for the spammail profile show firewall profile spammail ...

Page 241: ...ify the user s credentials locally or using an external LDAP or RADIUS server Authentication expires if the user leaves the connection idle for longer than the authentication timeout period You need to determine the number and membership of your user groups appropriate to your authentication needs To set up user groups 1 If external authentication is needed configure RADIUS or LDAP servers See RAD...

Page 242: ... minutes Local Go to User Local to add local user names and configure authentication Local user list Figure 112 Local user list Local user options Figure 113 Local user options Create New Add a new local username User Name The local user name Type The authentication type to use for this user The Delete and Edit icons User Name Enter the user name Disable Select Disable to prevent this user from au...

Page 243: ...r authentication The default port for RADIUS traffic is 1812 If your RADIUS server is using port 1645 you can use the CLI to change the default RADIUS port For more information see the config system global command entry in the FortiGate CLI Reference Guide RADIUS server list Figure 114 RADIUS server list LDAP Select LDAP to require the user to authenticate to an LDAP server Select the name of the ...

Page 244: ...ame that you want to delete 3 Select OK LDAP If you have configured LDAP support and a user is required to authenticate using an LDAP server the FortiGate unit contacts the LDAP server for authentication To authenticate with the FortiGate unit the user enters a user name and password The FortiGate unit sends this user name and password to the LDAP server If the LDAP server can authenticate the use...

Page 245: ...igure 116 LDAP server list LDAP server options Figure 117 LDAP server configuration Create New Add a new LDAP server Server Name IP The domain name or IP address of the LDAP server Port The port used to communicate with the LDAP server Common Name Identifier The common name identifier for the LDAP server 20 characters maximum This is the Distinguished Name The distinguished name used to look up en...

Page 246: ...ect Delete beside the LDAP server name that you want to delete 3 Select OK Common Name Identifier Enter the common name identifier for the LDAP server The common name identifier for most LDAP servers is cn However some servers use other common name identifiers such as uid Distinguished Name Enter the distinguished name used to look up entries on the LDAP server Enter the base distinguished name fo...

Page 247: ...XAuth The FortiGate PPTP configuration Only users in the selected user group can use PPTP The FortiGate L2TP configuration Only users in the selected user group can use L2TP When you add user names RADIUS servers and LDAP servers to a user group the order in which they are added determines the order in which the FortiGate unit checks for authentication If user names are first then the FortiGate un...

Page 248: ...t an LDAP server from the Available Users list and select the right arrow to add the LDAP server to the Members list 7 To remove users RADIUS servers or LDAP servers from the user group select a user RADIUS server or LDAP server from the Members list and select the left arrow to remove the name RADIUS server or LDAP server from the group 8 Select a protection profile from the Protection Profiles l...

Page 249: ...e_str set keyword variable config user peer edit name_str unset keyword config user peer delete name_str get user peer name_str show user peer name_str Example This example shows how to add the branch_office peer config user peer edit branch_office set ca set cn set cn type end This example shows how to display the list of configured peers radius command keywords and variables Keywords and variabl...

Page 250: ...word config user peergrp delete name_str get user peergrp name_str show user peergrp name_str Example This example shows how to add peers to the peergrp EU_branches config user peergrp edit EU_branches set member Sophia_branch Valencia_branch Cardiff_branch end This example shows how to display the list of configured peer groups get user peergrp This example shows how to display the settings for t...

Page 251: ...ion Guide 01 28006 0010 20041105 251 get user peergrp EU_branches This example shows how to display the configuration for all the peers groups show user peergrp This example shows how to display the configuration for the peergrp EU_branches show user peergrp EU_branches ...

Page 252: ...252 01 28006 0010 20041105 Fortinet Inc CLI configuration Users and authentication ...

Page 253: ...ocol L2TP This chapter contains information about the following VPN topics Phase 1 Phase 2 Manual key Concentrator Ping Generator Monitor PPTP L2TP Certificates CLI configuration Authenticating peers with preshared keys Gateway to gateway VPN Dialup VPN Dynamic DNS VPN Manual key IPSec VPN Adding firewall policies for IPSec VPN tunnels Internet browsing through a VPN tunnel IPSec VPN in Transparen...

Page 254: ...ure Phase 1 list Figure 120 IPSec VPN Phase 1 list Create New Select Create New to add a Phase 1 configuration also called a remote gateway Gateway Name The names of the Phase 1 configurations remote gateways added Gateway IP The IP address of the remote gateway if this is a static IP address phase 1 Dialup if this is a dialup Phase 1 configuration and the domain name if this is a dynamic DNS phas...

Page 255: ...in fields may become available or be removed IP Address If you select Static IP Address for Remote Gateway enter the IP address of the gateway or client Dynamic DNS If you select Dynamic DNS for Remote Gateway enter the Dynamic DNS DDNS name DDNS allows a computer to keep the same domain name even if its IP address changes Mode Select Aggressive or Main ID Protection mode Both modes establish a se...

Page 256: ...ficate name of the remote client or peer for the remote client or peer to start a VPN session with the FortiGate unit Select Accept any peer ID to accept the local ID or peer ID of any remote client or VPN peer Select Accept this peer ID to accept a remote client or group that has a particular local ID or peer ID Enter the value Select Accept peer ID in dialup group to accept remote clients that b...

Page 257: ...uthentication enter the distinguished name DN of the local certificate XAuth You can configure the FortiGate unit as an Extended Authentication XAuth client or an XAuth server For more information see Configuring XAuth on page 257 Nat traversal Enable this option if you expect the IPSec VPN traffic to go through a gateway that performs NAT If no NAT device is detected enabling NAT traversal has no...

Page 258: ...PAP between the XAuth client and the FortiGate unit and CHAP between the FortiGate unit and the authentication server Use CHAP whenever possible Use PAP if the authentication server does not support CHAP Use PAP with all implementations of LDAP and some implementations of Microsoft RADIUS Use MIXED if the authentication server supports CHAP but the XAuth client does not Use MIXED with the Fortinet...

Page 259: ...r identification process For information about how to create a Phase 1 Dialup User configuration see Dialup VPN on page 287 If the tunnel is to connect a static remote gateway select the name of an existing Phase 1 configuration from the Static IP Address section of the list See Gateway to gateway VPN on page 286 for information about how to define a Phase 1 Static IP Address configuration You can...

Page 260: ...rypted session NULL Do not use a message digest MD5 Message Digest 5 the hash algorithm developed by RSA Data Security SHA1 Secure Hash Algorithm 1 which produces a 160 bit message digest To specify one combination only set the Encryption and Authentication options of the second combination to NULL To specify a third combination use the add button beside the fields for the second combination Enabl...

Page 261: ... keep alive to keep the VPN connection open even if no data is being transferred DHCP IPSec If the tunnel will service remote dialup clients that broadcast a DHCP request when connecting to the tunnel select DHCP IPSec The FortiGate unit can relay the request to an external DHCP server For more information see System DHCP on page 79 Internet browsing Select the Interface through which remote VPN u...

Page 262: ... name for the VPN tunnel Local SPI The local Security Parameter Index SPI identifies the local manual key VPN peer Enter a hexadecimal number digits can be 0 to 9 a to f in the range bb8 to FFFFFFF This number must be added to the Remote SPI at the opposite end of the tunnel Remote SPI The remote Security Parameter Index identifies the remote manual key VPN peer Enter a hexadecimal number of up to...

Page 263: ...into two segments of 16 characters For AES192 enter a 48 character 24 byte hexadecimal number 0 9 A F Separate the number into three segments of 16 characters For AES256 enter a 64 character 32 byte hexadecimal number 0 9 A F Separate the number into four segments of 16 characters Authentication Algorithm Select an Authentication Algorithm from the list Use the same algorithm at both ends of the t...

Page 264: ... through two tunnels simultaneously The ping interval is fixed at 40 seconds The source and destination IP addresses refer to the source and destination addresses of IP packets that are to be transported through the VPN When a destination address of 0 0 0 0 is entered for the ping generator the address means none Members The names of the Phase 2 configurations and manual key configurations added t...

Page 265: ...t tunnel connections including addressing proxy IDs and status information To monitor a VPN tunnel 1 Go to VPN IPSEC Monitor You can establish or take down a VPN tunnel manually through the Monitor tab To establish or take down a VPN tunnel 1 Go to VPN IPSEC Monitor Enable Disable or enable pinging between the specified source and destination addresses Source IP 1 Enter the private IP address from...

Page 266: ...other tunnel can be initiated Flush dialup tunnels icon Stop all dialup tunnels and stop the traffic passing through all dialup tunnels Dialup users may have to re connect to establish new VPN sessions Name The name of the phase 2 for the dialup tunnel followed by the number of the dialup tunnel For example if there are 4 dialup tunnels running that use a phase 2 configuration named Dial_tunnel th...

Page 267: ... a user name for each PPTP client You can add users to the FortiGate user database to authentication servers RADIUS or LDAP or to both See Users and authentication on page 241 2 Enable PPTP and specify a PPTP address range See Enabling PPTP and specifying a PPTP range on page 268 3 Add a source address range for the firewall policy The source address range must match the range of PPTP addresses Se...

Page 268: ...e service to HTTP See To add a firewall policy on page 204 6 Configure the Windows clients See Configuring a Windows 2000 client for PPTP Configuring a Windows XP client for PPTP Enabling PPTP and specifying a PPTP range The PPTP address range is the range of addresses reserved for remote PPTP clients When a remote PPTP client connects to the internal network using PPTP the client computer is assi...

Page 269: ...procedure 2 Enter your PPTP VPN User Name and Password 3 Select Connect 4 In the connect window enter the User Name and Password that you use to connect to your dialup network connection This user name and password is not the same as your VPN user name and password Configuring a Windows XP client for PPTP To configure a PPTP dialup connection 1 Go to Start Control Panel 2 Select Network and Intern...

Page 270: ...the same as your VPN user name and password PPTP passthrough The FortiGate unit supports PPTP passthrough by configuring a port forwarding virtual IP to use port 1723 Normally PPTP passthrough requires the generic routing encapsulation GRE protocol on IP port 47 When you configure PPTP passthrough using the following procedure the FortiGate unit automatically enables the GRE protocol for PPTP pass...

Page 271: ... internal 4 For Address name Set Source to All Set Destination to PPTP_pass 5 Set Schedule as required 6 Set Service to ANY 7 Set action to ACCEPT 8 Select NAT 9 Select OK L2TP You can set up VPN connections between FortiGate units and remote Windows clients using Layer 2 Tunneling Protocol L2TP L2TP lets you create a secure connection between a client computer running Microsoft Windows and your i...

Page 272: ...e L2TP range See To add an address on page 208 4 Add a destination address The destination address is the address to which the L2TP clients can connect For example if the destination address is on the internal network you would create an external to internal policy to control the access that L2TP users have through the FortiGate unit Typically you would add only one destination address for the ent...

Page 273: ...r the address of the FortiGate unit to connect to and select Next 5 Set Connection Availability to Only for myself and select Next 6 Select Finish 7 In the Connect window select Properties 8 Select the Security tab 9 Make sure that Require data encryption is selected 10 Select the Networking tab 11 Set VPN server type to Layer 2 Tunneling Protocol L2TP 12 Save your changes and continue with the fo...

Page 274: ... CA authentication Instead it checks for a local or active directory IPSec policy To connect to the L2TP VPN 1 Start the dialup connection that you configured in the previous procedure 2 Enter your L2TP VPN User Name and Password 3 Select Connect 4 In the connect window enter the User Name and Password that you use to connect to your dialup network connection This user name and password is not the...

Page 275: ...lected File and Printer Sharing for Microsoft Networks Client for Microsoft Networks To disable IPSec 1 Select the Networking tab 2 Select Internet Protocol TCP IP properties 3 Double click the Advanced tab 4 Go to the Options tab and select IP security properties 5 Make sure that Do not use IPSec is selected 6 Select OK and close the connection properties window 7 Use the registry editor regedit ...

Page 276: ...y a public key and some identifying information that has been digitally signed by a trusted third party known as a certificate authority CA Because CAs can be trusted the certificates issued by a CA are deemed to be trustworthy To obtain a personal or site certificate you must send a request to a CA that provides digital certificates that adhere to the X 509 standard The FortiGate unit provides a ...

Page 277: ... X 509 standard To generate a certificate request 1 Go to VPN Certificates Local Certificates 2 Select Generate 3 Enter a Certificate Name Typically this is the name of the FortiGate unit being certified Generate Select to use the FortiGate unit to generate a local certificate request Import Select to import a signed local certificate Name The name of the local certificate or certificate request S...

Page 278: ...support all three key sizes 7 Select OK The request is generated and displayed in the Local Certificates list with a status of Pending 8 Select the Download button to download the request to a PC on the local network 9 In the File Download dialog box select Save 10 Name the file and save it on the local file system 11 Submit the request to your CA as follows Using the web browser on the local PC b...

Page 279: ...l Certificates Certificate Name Type a certificate name Subject Information Enter an ID type and the related information for the FortiGate unit being certified You can use one of the following three ID types If you select Host IP enter the IP address of the FortiGate unit being certified If you select Domain Name enter the fully qualified domain name of the FortiGate unit being certified If you se...

Page 280: ...er is configured to authenticate using digital certificates it sends the Distinguished Name DN on its certificate to the remote peer This DN can be used to deny VPN access For example a FortiGate unit can be configured to deny connections to all remote peers except the one having the specified DN If the FortiGate unit participates in a gateway to gateway configuration and you want both peers to ac...

Page 281: ...mand before it can be selected here For more information see the config user chapter of the CLI Reference Guide 3 If you want to define the DN of the FortiGate unit select Advanced and from the Local ID list select the DN of the FortiGate unit 4 Select OK CLI configuration This guide only covers Command Line Interface CLI commands keywords or variables in bold that are not represented in the web b...

Page 282: ...his period of time expires whenever the local peer sends traffic to the remote VPN peer it will also send a DPD probe to determine the status of the link The dpd idleworry range is 1 to 300 To control the length of time that the FortiGate unit takes to detect a dead peer with DPD probes use the dpdretrycount and dpd retryinterval keywords 10 seconds All models dpd must be set to enable dpd retryco...

Page 283: ...mple_GW set Type dynamic set proposal des md5 set authmethod psk set psksecret Qf2p3O93jIj2bz7E set mode aggressive set dpd enable set dpd idlecleanup 1000 set dpd idleworry 150 set dpd retrycount 5 set dpd retryinterval 30 end ipsec phase2 In addition to the advanced IPSec Phase 2 settings the config vpn ipsec phase2 CLI command provides a way to bind the VPN tunnel selected in a Phase 2 configur...

Page 284: ...affic to the intended destinations automatically Each IPSec VIP entry is identified by an integer An entry identifies the name of the FortiGate interface to the destination network and the IP address of a destination host on the destination network Specify an IP address for every host that needs to be accessed on the other side of the tunnel you can define a maximum of 32 IPSec VIP addresses on th...

Page 285: ... 1 set out interface external next edit 2 set ip 192 168 12 2 set out interface external end This example shows how to display the settings for the vpn ipsec vip command get vpn ipsec vip This example shows how to display the settings for the VIP entry named 1 get vpn ipsec vip 1 This example shows how to display the current configuration of all existing VIP entries show vpn ipsec vip ipsec vip co...

Page 286: ... is often referred to as adding a tunnel See Phase 2 on page 258 4 Add the firewall configuration required for the VPN See Adding firewall policies for IPSec VPN tunnels on page 288 Gateway to gateway VPN Using a peer to peer VPN users on a network behind a VPN gateway can connect to another remote network behind a remote VPN gateway Both VPN gateways or peers are FortiGate units or other VPN gate...

Page 287: ...N Dynamic DNS VPN allows remote users or gateways with dynamic IP addresses to use VPN to connect to a private network In this case the gateway or client at the remote end of the VPN tunnel has a dynamic IP address but the FortiGate unit can get the IP address by looking up a domain name The remote client or gateway uses dynamic DNS to re map this domain name to its IP address whenever the IP addr...

Page 288: ...about firewall policies You can also use firewall policies for IPSec VPN to apply protection profiles to VPN traffic to log IPSec VPN traffic and to apply advanced features to IPSec VPN traffic such as traffic shaping and differentiated services Adding a firewall policy for an IPSec VPN involves creating an internal external policy setting the policy action to ENCRYPT and selecting the VPN tunnel ...

Page 289: ...olicy direction See Setting the encryption policy direction on page 288 3 Add the source and destination addresses See To add an address on page 208 4 Set Action to ENCRYPT 5 From the VPN tunnel list select a phase 2 tunnel configuration 6 Configure the following options if required 7 Select additional options if required to apply a protection profile and or other firewall policy features 8 Select...

Page 290: ...ual source interface Then create Internet access policies for VPN users For example if the virtual source interface is VLAN_21 and the external interface is connected to the Internet you would require create VLAN_21 external firewall policies To configure Internet browsing through a VPN tunnel 1 Go to VPN IPSec Phase 1 2 Add a phase 1 configuration to define the parameters used to authenticate the...

Page 291: ...figuration to define the parameters used to authenticate the remote VPN peer 2 Set other phase 1 options as required See Phase 1 on page 254 3 Add the phase 2 configuration to define the parameters used to create and maintain the AutoKey VPN tunnel See Phase 2 on page 258 4 Add the firewall configuration required for the VPN See Adding firewall policies for IPSec VPN tunnels on page 288 Special ru...

Page 292: ...is the address of the spoke either a client on the Internet or a network located behind a gateway See To add an address on page 208 3 Add the concentrator configuration This step groups the tunnels together on the FortiGate unit The tunnels link the hub to the spokes The tunnels are added as part of the AutoIKE phase 2 configuration or the manual key configuration See To add an address on page 208...

Page 293: ...ple VPN concentrator configuration To add a VPN concentrator configuration 1 Go to VPN IPSEC Concentrator 2 Select New to add a VPN concentrator 3 Enter the name of the new concentrator in the Concentrator Name field 4 To add tunnels to the VPN concentrator select a VPN tunnel from the Available Tunnels list and select the right arrow 5 To remove tunnels from the VPN concentrator select the tunnel...

Page 294: ... the address of the spoke either a client on the Internet or a network located behind a gateway See To add an address on page 208 4 Add a separate outbound encrypt policy for each remote VPN spoke These policies control the encrypted connections initiated by the local VPN spoke The encrypt policy must include the appropriate source and destination addresses and the tunnel added in step 1 Use the f...

Page 295: ...ween two VPN peers one peer can have multiple Internet connections while the other has only one Internet connection In the case of an asymmetrical configuration the level of redundancy varies from one end of the VPN to the other Configuring redundant IPSec VPNs For each FortiGate unit first add multiple two or more external interfaces Then assign each interface to an external zone Finally add a ro...

Page 296: ... three VPN connections If the Internet connections are in the same zone add one VPN tunnel and add the remote gateways to it You can add up to three remote gateways If the Internet connections are in separate zones or assigned to unique interfaces add a VPN tunnel for each remote gateway entered See Phase 2 on page 258 3 Add the source and destination addresses See To add an address on page 208 4 ...

Page 297: ...n the two sites have been coordinated to protect against ambiguous routing no two IP addresses are the same Setting up a configuration like this involves performing the following tasks at FortiGate_1 and FortiGate_2 To enable IPSec VPN communication between two network hosts that coordinate the same private address space on physically separate networks perform the following tasks at the local and ...

Page 298: ... remote peer software configuration Check the FortiGate firewall configuration Configuration Error Correction Wrong remote network information Check the IP addresses of the remote gateway and network Wrong preshared key Reenter the preshared key Wrong Aggressive Mode peer ID Reset to the correct Peer ID Mismatched IKE or IPSec proposal combination in the proposal lists Make sure both the FortiGate...

Page 299: ...Profile select edit or Create New and select IPS See Protection profile options on page 231 Protection profile configuration For information about adding protection profiles to firewall policies see To add a protection profile to a policy on page 236 IPS updates and information FortiProtect services are a valuable customer resource and include automatic updates of virus and IPS attack engines and ...

Page 300: ...ition to an extensive list of predefined attack signatures you can also create your own custom attack signatures for the FortiGate unit See Adding custom signatures on page 305 Predefined Predefined signatures are arranged into groups based on the type of attack By default all signature groups are enabled while some signatures within groups are not Check the default settings to ensure they meet th...

Page 301: ...ers Action can be Pass Drop Reset Reset Client Reset Server Drop Session Clear Session or Pass Session See Table 24 Revision The revision number for individual signatures To show the signature group members click on the blue triangle Modify The Configure and Reset icons Reset only appears when the default settings have been modified Selecting Reset restores the default settings Table 24 Actions to...

Page 302: ... Used for TCP connections only If you set this action for non TCP connection based attacks the action will behave as Clear Session If the Reset Client action is triggered before the TCP connection is fully established it acts as Clear Session Reset Server The FortiGate unit drops the packet that triggered the signature sends a reset to the server and removes the session from the FortiGate session ...

Page 303: ...of a signature 1 Go to IPS Signature Predefined 2 Select the blue triangle next to a signature group name to display the members of that group 3 Select the Reset icon for the signature you want to restore to recommended settings The Reset icon is displayed only if the settings for the signature have been changed from recommended settings 4 Select OK Configuring parameters for dissector signatures ...

Page 304: ...eout If a session is idle for longer than this number of seconds the session will not be maintained by tcp_reassembler min_ttl A packet with a higher ttl number in its IP header than the number specified here is not processed by tcp_reassembler port_list A comma separated list of ports The dissector can decode these TCP ports bad_flag_list A comma separated list of bad TCP flags reassembly_ direct...

Page 305: ...e custom signatures from the custom signature group Reset to recommended settings Reset all the custom signatures to the recommended settings Name The custom signature names Revision The revision number for each custom signature The revision number is a number you assign to the signature when you create or revise it Enable The status of each custom signature A white check mark in a green circle in...

Page 306: ...sessions targeting a single destination in one second is over a threshold the destination is experiencing flooding Scan If the number of sessions from a single source in one second is over a threshold the source is scanning Source session limit If the number of concurrent sessions from a single source is over a threshold the source session limit is reached Destination session limit If the number o...

Page 307: ...ent Reset Server Drop Session Clear Session or Pass Session Modify The Edit and Reset icons If you have changed the settings for an anomaly you can use the Reset icon to change the settings back to the recommended settings Name The anomaly name Enable Select the Enable box to enable the anomaly or clear the Enable box to disable the anomaly Logging Select the Logging box to enable logging for the ...

Page 308: ... is fully established it acts as Clear Session Reset Client The FortiGate unit drops the packet that triggered the anomaly sends a reset to the client and removes the session from the FortiGate session table Used for TCP connections only If you set this action for non TCP connection based attacks the action will behave as Clear Session If the Reset Client action is triggered before the TCP connect...

Page 309: ... edit name_str unset keyword end config limit delete name_str Example Use the following command to configure the limit for the tcp_src_session anomaly config ips anomaly tcp_src_session config limit edit subnet1 set ipaddress 1 1 1 0 255 255 255 0 set threshold 300 end end Note This guide only covers Command Line Interface CLI commands that are not represented in the web based manager For complete...

Page 310: ...ng signatures for attacks that your system is not vulnerable to for example web attacks when you are not running a web server For more information on FortiGate logging and alert email see Log Report on page 357 Default fail open setting If for any reason the IPS should cease to function it will fail open by default This means that crucial network traffic will not be blocked and the Firewall will c...

Page 311: ...rotocol HTTP FTP IMAP POP3 SMTP View a read only list of current viruses File Block Antivirus File Block Enable or disable file blocking for each protocol Configure file patterns to block enable or disable blocking for each protocol Quarantine Antivirus Quarantine Enable or disable quarantining for each protocol Quarantine is only available on units with a local disk View and sort the list of quar...

Page 312: ...ortiProtect Center at http www fortinet com FortiProtectCenter To set up automatic and push updates see Update center on page 126 This chapter describes File block Quarantine Config CLI configuration File block Configure file blocking to remove all files that are a potential threat and to prevent active computer virus attacks You can block files by name by extension or any other pattern giving you...

Page 313: ... information files pif Figure 151 Default file block list File block list has the following icons and features Create New Select Create New to add a new file pattern to the file block list Apply Select Apply to apply any changes to the file block configuration Pattern The current list of blocked file patterns You can create a pattern by using or wildcard characters Check All Select a check box bes...

Page 314: ...ned files list Quarantined files list options AutoSubmit list AutoSubmit list options Configuring the AutoSubmit list Config Quarantined files list The quarantined files list displays information about each file that is quarantined because of virus infection or file blocking You can sort the files by any one of file name date service status duplicate count DC or time to live TTL You can also filte...

Page 315: ... oversize exe Date The date and time that the file was quarantined in the format dd mm yyyy hh mm This value indicates the time that the first file was quarantined if the duplicate count increases Service The service from which the file was quarantined HTTP FTP IMAP POP3 SMTP Status The reason the file was quarantined infected heuristics or blocked Status Description Specific information related t...

Page 316: ...tions AutoSubmit list has the following icons and features Configuring the AutoSubmit list To add a file pattern to the AutoSubmit list 1 Go to Anti Virus Quarantine AutoSubmit 2 Select Create New Figure 154 Adding a file pattern 3 Enter the file pattern or file name you want to automatically upload to Fortinet for analysis 4 Select Enable 5 Select OK Create New Select Create New to add a new file...

Page 317: ...The time limit in hours for which to keep files in quarantine The age limit is used to formulate the value in the TTL column of the quarantined files list When the limit is reached the TTL column displays EXP and the file is deleted although a record is maintained in the quarantined files list Entering an age limit of 0 zero means files are stored on disk indefinitely depending on low disk space a...

Page 318: ...the FortiGate unit to receive automatic updates daily or whenever required To manually upload a virus list update see Changing unit information on page 35 To find out how to use the Fortinet Update Center see Update center on page 126 Figure 156 Virus list partial Config Oversize threshold configuration refers to the size limits you can apply to scan files and email in memory Figure 157 Example th...

Page 319: ...ult all new categories are disabled Grayware is enabled in a protection profile when Virus Scan is enabled Grayware options Grayware categories are populated with known executable files Each time the FortiGate unit receives a virus and attack definitions update the grayware categories and contents are updated Figure 158 Sample grayware options The categories may change or expand when the FortiGate...

Page 320: ...avorites or bookmarks start pages and menu options Plugin Select enable to block browser plugins Browser plugins can often be harmless Internet browsing tools that are installed and operate directly from the browser window Some toolbars and plugins can attempt to control or record and send browsing preferences NMT Select enable to block network management tools Network management tools can be inst...

Page 321: ... for either antivirus scanning or straight throughput traffic When optimize is set to antivirus the FortiGate unit uses symmetric multiprocessing to spread the antivirus tasks to several CPUs making scanning faster For more information see the FortiGate Antivirus Optimization and Operation Technical Note Command syntax pattern config system global set keyword variable end Keywords and variables De...

Page 322: ...s way heuristic scanning may detect new viruses but may also produce some false positive results The heuristic engine is enabled by default to pass suspected files to the recipient and send a copy to quarantine Once configured in the CLI heuristic is enabled in a protection profile when Virus Scan is enabled Use the heuristic command to change the heuristic scanning mode Command syntax pattern con...

Page 323: ...e set keyword variable end config antivirus quarantine unset keyword end get antivirus quarantine show antivirus quarantine Table 26 antivirus heuristic command keywords and variables Keywords and variables Description Default Availability mode pass block disable Enter pass to enable heuristics but pass detected files to the recipient Suspicious files are quarantined if quarantine is enabled Enter...

Page 324: ...rantine command keywords and variables Keywords and variables Description Default Availability drop_heuristic ftp http imap pop3 smtp Do not quarantine files found by heuristic scanning in traffic for the specified protocols imap smtp pop3 http ftp FortiGate models numbered 200 and higher store_heuristic ftp http imap pop3 smtp Quarantine files found by heuristic scanning in traffic for the specif...

Page 325: ...Example This example shows how to add antivirus scanning for FTP traffic on ports 22 and 23 Adding more ports for scanning does not erase the default port 21 Use the unset command to remove all ports from the list config antivirus service ftp set port 22 set port 23 end This example shows how to display the antivirus FTP traffic settings get antivirus service ftp This example shows how to display ...

Page 326: ...3 set port 992 set port 993 end This example shows how to display the antivirus POP3 traffic settings get antivirus service pop3 This example shows how to display the configuration for antivirus POP3 traffic show antivirus service pop3 service imap Use this command to configure how the FortiGate unit handles antivirus scanning of large files and what ports the FortiGate unit virus scans for IMAP t...

Page 327: ...xample shows how to display the configuration for antivirus IMAP traffic show antivirus service imap service smtp Use this command to configure how the FortiGate unit handles antivirus scanning of large files in SMTP traffic and what ports the FortiGate unit scans for SMTP Note This command has more keywords than are listed in this Guide See the FortiGate CLI Reference Guide for a complete list of...

Page 328: ...rt 25 Use the unset command to remove all ports from the list config antivirus service smtp set port 465 end This example shows how to display the antivirus SMTP traffic settings get antivirus service smtp This example shows how to display the configuration for antivirus SMTP traffic show antivirus service smtp Table 31 antivirus service smtp command keywords and variables Keywords and variables D...

Page 329: ...banned words and patterns in the content block list for HTTP traffic Add words and patterns to block web pages containing those words or patterns Web URL Block Web Filter URL Block Enable or disable web page filtering for HTTP traffic based on the URL block list Add URLs and URL patterns to block web pages from specific sources Web Exempt List Web Filter URL Exempt Enable or disable web page filte...

Page 330: ...er Content block Control web content by blocking specific words or word patterns The FortiGate unit blocks web pages containing banned words and displays a replacement message instead You can use Perl regular expressions or wildcards to add banned word patterns to the list See Using Perl regular expressions on page 354 Protection Profile web category filtering Web Filter setting Enable category bl...

Page 331: ... regular expression i For example bad language i will block all instances of bad language regardless of case Wildcard patterns are not case sensitive Note Enable Web filtering Web Content Block in your firewall Protection Profile to activate the content block settings Create new Select Create New to add a banned word to the web content block list total The number of banned words in the web content...

Page 332: ...et the pattern type if required 5 Select the language character set 6 Select Enable 7 Select OK URL block You can block access to specific URLs by adding them to the URL block list You can also add patterns using text and regular expressions or wildcard characters to block URLs The FortiGate unit blocks web pages matching any specified URLs or patterns and displays a replacement message instead Ba...

Page 333: ...e must be separated by hard returns to upload correctly Figure 161 Sample Web URL block list Web URL block options Web URL block has the following icons and features Configuring the web URL block list Note URL blocking does not block access to other services that users can access with a web browser For example URL blocking does not block access to ftp ftp badsite com Instead you can use firewall p...

Page 334: ...k all pages with a URL that ends with badsite com add badsite com to the block list For example adding badsite com blocks access to www badsite com mail badsite com www finance badsite com and so on 5 Select Enable 6 Select OK Web pattern block list In addition to blocking specific or partial URLs you can block all URLs that match patterns you create using text and regular expressions or wildcard ...

Page 335: ...k 3 Select Create New Figure 164 Adding a new pattern 4 Enter a pattern to add to the web pattern block list 5 Select Enable 6 Select OK URL exempt This section describes URL exempt list URL exempt list options Configuring URL exempt Create New Select Create New to add a new pattern to the web pattern block list Pattern The current list of blocked patterns Select the check box to enable all the we...

Page 336: ...dd a URL to the URL exempt list 1 Go to Web Filter URL Exempt 2 Select Create New Figure 166 Adding a new exempt URL 3 Enter the URL to add to the URL exempt list 4 Select Enable Note Enable Web filtering Web Exempt List in your firewall Protection Profile to activate the URL exempt settings Create New Select Create New to add a URL to the URL exempt list total The number of URLs in the URL exempt...

Page 337: ...may be added to or updated as the Internet evolves Users can also choose to allow block or monitor entire groups of categories to make configuration simpler Blocked pages are replaced with a message indicating that the page is not accessible according to the Internet usage policy FortiGuard ratings are performed by a combination of proprietary methods including text analysis exploitation of the We...

Page 338: ... If you have ordered FortiGuard through Fortinet technical support or are using the free 30 day trial you only need to enable the service to start configuring and using FortiGuard Figure 167 Category block configuration You can configure the following options to enable and help maintain FortiGuard web filtering Enable Service FortiGuard Select to enable FortiGuard web filtering Status Select Check...

Page 339: ...e 233 and FortiGuard categories on page 377 Once you select Apply the FortiGuard license type and expiration date appears on the configuration screen Web Filter Category Block Category block reports You can generate a text and pie chart format report on web filtering for any profile The FortiGate unit maintains statistics for allowed blocked and monitored web pages for each category You can view r...

Page 340: ...e Guide for descriptions of all webfilter catblock keywords Profile Select the profile for which you want to generate a report Report Type Select the time frame for which you want to generate the report Choose from hour day or all historical statistics Report Range Select the time range 24 hour clock or day range from six days ago to today for which you want the report For example if you select re...

Page 341: ...iguration for the catblock settings show webfilter catblock If the show command returns you to the prompt the settings are at default Script filter You can configure the FortiGate unit to filter certain web scripts You can filter Java applets cookies and ActiveX controls from web pages catblock command keywords and variables Keywords and variables Description Default Availability ftgd_hostname url...

Page 342: ...s for script filtering Note Enable Web filtering Web Script Filter in your firewall Protection Profile to activate the script filter settings Javascript Select Javascript to block all Javascript based pages or applications Cookies Select Cookies to block web sites from placing cookies on individual computers ActiveX Select ActiveX to block all ActiveX applications ...

Page 343: ... Enable or disable checking incoming IP addresses against the configured spam filter IP address list SMTP only Add to and edit IP addresses to the list You can configure the action to take as spam clear or reject for each IP address You can place an IP address anywhere in the list The filter checks each IP address in sequence SMTP only RBL ORDBL check Spam Filter RBL ORDBL Enable or disable checki...

Page 344: ...ders against the configured spam filter MIME header list Add to and edit MIME headers to the list with the option of using wildcards and regular expressions You can configure the action to take as spam or clear for each MIME header Banned word check Spam Filter Banned Word Enable or disable checking source email against the configured spam filter banned word list Add to and edit banned words to th...

Page 345: ...les the IP address list from email captured by spam probes located around the world Spam probes are email addresses purposely configured to attract spam and identify known spam sources to create the antispam IP address list FortiShield combines IP address checks with other spam filter techniques in a two pass process On the first pass FortiShield checks the SMTP mail server source address against ...

Page 346: ... addresses You can mark each IP address as clear spam or reject You can filter single IP addresses or a range of addresses at the network level by configuring an address and mask Figure 170 Sample IP address list IP address options IP address list has the following icons and features Configuring the IP address list To add an IP address to the IP address list 1 Go to Spam Filter IP Address Create N...

Page 347: ...n as open relays which some spammers use to send unsolicited bulk email There are also several free and subscription servers available that provide reliable access to continually updated RBLs and ORDBLs Check with the service you are using to confirm the correct domain name for connecting to the server The FortiGate unit communicates with RBL servers using UDP through port 53 The FortiGate unit co...

Page 348: ...RBL or ORDBL server 3 Enter the domain name of the RBL or ORDBL server you want to add 4 Select the action to take on email matched by the server 5 Select Enable 6 Select OK Create New Select Create New to add a server to the RBL ORDBL list Total The number of items in the list The Page up Page down and Remove all entries icons RBL Server The current list of servers Select the check box to enable ...

Page 349: ...rom a domain such as sample net You can mark each email address as clear or spam Figure 174 Sample email address list Email address options Email address list has the following icons and features Configuring the email address list To add an email address or domain to the list 1 Go to Spam Filter E mail Address 2 Select Create New Create New Select Create New to add an email address to the email ad...

Page 350: ...Content_Type image jpg The first part of the MIME header is called the header key or just header The second part is called the value Spammers will often insert comments into header values or leave them blank These malformed headers can fool some spam and virus filters You can use the MIME headers list to mark email from certain bulk mail programs or with certain types of content that are common in...

Page 351: ... Go to Spam Filter MIME headers Create New Select Create New to add a MIME header to the MIME headers list Total The number of items in the list The Page up Page down and Remove all entries icons Header The list of MIME headers keys Value The list of MIME header values for each key Pattern Type The pattern type used in the MIME header list entry Choose from wildcard or regular expression See Using...

Page 352: ...s on page 354 This section describes Banned word list Banned word options Configuring the banned word list Banned word list You can add one or more banned words to sort email containing those words in the email subject body or both Words can be marked as spam or clear Banned words can be one word or a phrase up to 127 characters long If you enter a single word the FortiGate unit blocks all email t...

Page 353: ...m wildcard or regular expression See Using Perl regular expressions on page 354 Language The character set to which the banned word belongs Simplified Chinese Traditional Chinese French Japanese Korean Thai or Western Where The location which the FortiGate unit searches for the banned word subject body or all Action The selected action to take on email with banned words The Delete and Edit View ic...

Page 354: ...o any single character It is similar to the character in wildcard match pattern As a result fortinet com not only matches fortinet com but also matches fortinetacom fortinetbcom fortinetccom and so on To match a special character such as and use the escape character For example To mach fortinet com the regular expression should be fortinet com In Perl regular expressions means match 0 or more time...

Page 355: ... end of the string a b either of a and b abc abc the string abc at the beginning or at the end of the string ab 2 4 c an a followed by two three or four b s followed by a c ab 2 c an a followed by at least two b s followed by a c ab c an a followed by any number zero or more of b s followed by a c ab c an a followed by one or more b s followed by a c ab c an a followed by an optional b followed by...

Page 356: ...abcd perl B perl when not followed by a word boundary e g in perlert but not in perl stuff x tells the regular expression parser to ignore white space that is neither backslashed nor within a character class You can use this to break up your regular expression into slightly more readable parts x used to add regexps within other text If the first character in a pattern is forward slash the is treat...

Page 357: ... level and log format Log filters define the types of log messages saved to each location You can configure the FortiGate unit to send alert email to up to three recipients when selected events occur It is not necessary for an event to be logged to trigger an alert email The FortiGate unit will collect and send log messages in alert emails according to the level and time intervals you configure in...

Page 358: ... 52 device_id APS3012803033139 log_id 0101023002 type event subtype ipsec pri notice loc_ip 172 16 81 2 loc_port 500 rem_ip 172 16 81 1 rem_port 500 out_if dmz vpn_tunnel ToDmz action negotiate init local mode stage 112 dir inbound status success msg Initiator tunnel 172 16 81 1 transform ESP_3DES HMAC_SHA1 Message meets Alert condition 2004 04 27 13 28 54 device_id APS3012803033139 log_id 0101023...

Page 359: ...buffer When the memory is full the FortiGate unit begins to overwrite the oldest messages All log entries are deleted when the FortiGate unit restarts Syslog A remote computer running a syslog server WebTrends A remote computer running a NetIQ WebTrends firewall reporting server FortiGate log formats comply with WebTrends Enhanced Log Format WELF and are compatible with NetIQ WebTrends Security Re...

Page 360: ...le is started Roll log policy The policy to follow for saving the current log and starting a new active log Overwritten deletes the oldest log entry when the disk is full Block traffic stops all network traffic when the disk is full Do not log stops logging messages when the disk is full Level The FortiGate unit logs all messages at and above the logging severity level you select For example if yo...

Page 361: ...the logging severity level you select For example if you select Error the unit logs Error Critical Alert and Emergency level messages See Table 36 Logging severity levels on page 360 Facility Facility indicates the source of a log message By default FortiGate reports Facility as local7 You might want to change Facility to distinguish log messages from different FortiGate units Enable CSV Format If...

Page 362: ... email Test Select Test to send a test alert email to the configured recipients Level The FortiGate unit sends alert email for all messages at and above the logging severity level you select Emergency The interval to wait before sending an alert e mail for emergency level log messages Alert The interval to wait before sending an alert e mail for alert level log messages Critical The interval to wa...

Page 363: ...ert email 7 Select Apply Log filter options For each logging location you enable you can create a customized log filter based on the log types described in the following sections Information The interval to wait before sending an alert e mail for information level log messages Apply Select Apply to activate any additions or changes to configuration Note If more than one log message is collected be...

Page 364: ...on or packet log You can apply the following filters Event log The Event Log records management and activity events such as when a configuration has changed or a routing gateway has been added You can apply the following filters Policy allowed traffic The FortiGate unit logs all traffic that is allowed according to the firewall policy settings Policy violation traffic The FortiGate unit logs all t...

Page 365: ...s HA activity event The FortiGate unit logs all high availability events such as link member and state information Firewall authentication event The FortiGate unit logs all firewall related events such as user authentication Pattern update event The FortiGate unit logs all pattern update events such as antivirus and IPS pattern updates and update failures Virus infected The FortiGate unit logs all...

Page 366: ...traffic log 1 Go to System Network Interface 2 Select the Edit icon for an interface 3 Select Log 4 Select OK 5 Repeat steps 1 through 4 for each interface for which you want to enable logging 6 Make sure you enable traffic logs for a logging location and set the logging severity level to Notification or lower Attack Signature The FortiGate unit logs all detected and prevented attacks based on the...

Page 367: ...e traffic logging for a firewall policy All connections accepted by the firewall policy are recorded in the traffic log 1 Go to Firewall Policy 2 Select the Edit icon for a policy 3 Select Log Traffic 4 Select OK 5 Make sure you enable traffic log under Log Filter for a logging location and set the logging severity level to Notification or lower ...

Page 368: ...n the FortiGate disk The following table describes the column headings and the icons you can use to view and manage the log files when accessing logs saved to the disk To access log files on the FortiGate disk 1 Go to Log Report Log Access Note FortiGate units do not save some types of logs to memory You can view these log messages with Log Access only if your FortiGate unit contains a hard disk d...

Page 369: ...wnload 5 Select Download file in normal or CSV format 6 Select Open to view the log file or Save to save the log file to your computer To view and search log messages on the FortiGate disk 1 Go to Log Report Log Access 2 Select the log type you wish to access 3 Select Disk from the Type list 4 Select the View icon for the disk file you want to display For detailed information about searching logs ...

Page 370: ...og page or search the log by selecting the corresponding icon Choosing columns You can customize your log messages display using the Column Settings window The column settings apply only when the formatted not raw display is selected Type Select the log location for which you want to view logs disk or memory Go to previous page icon View to the previous page in the log file Go to next page icon Vi...

Page 371: ...elds list and select the left arrow button 4 To change the position of a column select the field in the Show these fields list and then select Move Up or Move Down as necessary 5 Select OK Available fields The fields that you can add to the log message display Right arrow button Select to move selected fields from Available fields list to Show these fields list Left arrow button Select to move sel...

Page 372: ...an advanced search 1 Display the log messages you want to search For more information see Viewing log messages on page 369 2 Select Advanced Search The Log Search window is displayed Figure 187 Search for log messages 3 If you want to search for log messages in a particular date range select the From and To dates 4 Select one of the following options 5 In the Keywords field type the keywords for t...

Page 373: ...iables Description Default Availability encrypt enable disable Enter enable to enable encrypted communication with the FortiLog unit disable All models localid str_id Enter the local ID for an IPSec VPN tunnel to a FortiLog unit You can create an IPSec VPN tunnel if one or more FortiGate units are sending log messages to a FortiLog unit across the Internet Using an IPSec VPN tunnel means that all ...

Page 374: ...the settings are at default syslogd setting Use this command to configure log settings for logging to a remote syslog server You can configure the FortiGate unit to send logs to a remote computer running a syslog server Command syntax pattern config log syslogd setting set keyword variable config log syslogd setting unset keyword get log syslogd setting show log syslogd setting Note The only comma...

Page 375: ...the IP address of the syslog server that stores the logs No default All models status disable enable Enter enable to enable logging to a remote syslog server disable All models Table 37 Facility types Facility type Description alert audit auth security authorization messages authpriv security authorization messages private clock clock daemon cron cron daemon performing scheduled commands daemon sy...

Page 376: ...e to user config log syslogd setting set status enable set server 220 210 200 190 set port 601 set facility user end This example shows how to display the log setting for logging to a remote syslog server get log syslogd setting This example shows how to display the configuration for logging to a remote syslog server show log syslogd setting If the show command returns you to the prompt the settin...

Page 377: ...d sites that provide information about or promote the cultivation preparation or use of marijuana 2 Cult or Occult Sites that provide information about or promote religions not specified in Traditional Religions or other unconventional cultic or folkloric beliefs and practices Sites that promote or offer methods means of instruction or other resources to affect or influence real events through the...

Page 378: ...ty with no pornographic intent 9 Advocacy Groups Sites that promote change or reform in public policy public opinion social practice economic activities and relationships 10 Alcohol and Tobacco Sites that provide information about promote or support the sale of alcoholic beverages or tobacco products or associated paraphernalia 11 Gambling Sites that provide information about or promote gambling o...

Page 379: ...iscussion groups message boards and list servers includes blogs and mail magazines Digital post cards Sites for sending viewing digital post cards 22 Pay to Surf Sites that pay users to view Web sites advertisements or email 23 Web based Email Sites that host Web based email Potentially Bandwidth Consuming 24 File Sharing and Storage Peer to Peer File Sharing Sites that provide client software to ...

Page 380: ...information about or cater to gay lesbian or bisexual lifestyles including those that support online shopping but excluding those that are sexually or issue oriented 33 Health Sites that provide information or advice on personal health or medical services procedures or devices but not drugs Includes self help groups 34 Job Search Sites that offer information about or support the seeking of employm...

Page 381: ...ons devoted to professional advancement or workers interests Service and Philanthropic Organizations Sites sponsored by or that support or offer information about organizations devoted to doing good as their primary activity Social and Affiliation Organizations Sites sponsored by or that support or offer information about organizations devoted chiefly to socializing or common interests other than ...

Page 382: ...lated business firms including sites supporting the sale of hardware software peripherals and services 53 Military Organizations Military Sites sponsored by branches or agencies of the armed services Others 54 Dynamic Content Dynamic Content URLs that are generated dynamically by a Web server 55 Miscellaneous Content Delivery Networks Commercial hosts that deliver content to subscribing Web sites ...

Page 383: ...2 32 32 32 32 32 32 system interface ip6 prefix list 32 32 32 32 32 32 32 32 32 32 32 32 32 system ipv6_tunnel 4 4 4 4 4 4 4 4 4 4 4 4 4 system accprofile 8 8 8 16 16 16 16 16 64 64 64 64 64 system admin 8 8 8 64 64 64 64 64 256 256 256 256 256 system snmp community 3 3 3 3 3 3 3 3 3 3 3 3 3 system snmp community hosts 8 8 8 8 8 8 8 8 8 8 8 8 8 system session_ttl port 512 512 512 512 512 512 512 5...

Page 384: ...0 500 500 500 500 500 500 firewall service group member 300 300 300 300 300 300 300 300 300 300 300 300 300 firewall schedule onetime 256 500 256 256 256 256 256 256 256 256 256 256 256 firewall schedule recurring 256 500 256 256 256 256 256 256 256 256 256 256 256 firewall ippool 50 50 50 50 50 50 50 50 50 50 50 50 50 firewall profile 32 32 32 32 32 32 32 32 32 256 256 256 256 firewall vip 500 50...

Page 385: ...ystem memory and performance considerations ips anomaly limit 100 100 100 100 100 100 100 100 100 100 100 100 100 ips custom 32 32 32 32 32 32 32 32 32 32 32 32 32 log trafficfilter rule 50 50 50 50 50 50 50 50 50 50 50 50 50 router access list 32 32 32 100 100 100 100 100 100 100 100 100 100 router access list rule 20 20 20 20 20 20 20 20 20 20 20 20 20 router prefix list 32 32 32 100 100 100 100...

Page 386: ... 100 100 100 100 router ospf network 100 100 100 100 100 100 100 100 100 100 100 100 100 router ospf neighbor 10 10 10 10 10 10 10 10 10 10 10 10 10 router ospf passive interface 100 100 100 100 100 100 100 100 100 100 100 100 100 router ospf redistribute 100 100 100 100 100 100 100 100 100 100 100 100 100 router ospf summary address 10 10 10 10 10 10 10 10 10 10 10 10 10 router ospf distribute li...

Page 387: ...sages are formatted and transmitted and what actions Web servers and browsers should take in response to various commands HTTPS The SSL protocol for transmitting private documents over the Internet using a Web browser Internal interface The FortiGate interface that is connected to an internal private network Internet A collection of networks connected together that span the entire globe using the ...

Page 388: ...to the specified address and waiting for a reply POP3 Post Office Protocol A protocol used to transfer e mail from a mail server to a mail client across the Internet Most e mail clients use POP PPP Point to Point Protocol A TCP IP protocol that provides host to network and router to router connections PPTP Point to Point Tunneling Protocol A Windows based technology for creating VPNs PPTP is suppo...

Page 389: ...P networks TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent UDP User Datagram Protocol A connectionless protocol that like TCP runs on top of IP networks Unlike TCP UDP provides very few error recovery services offering instead a direct way to send and receive datagrams over an IP network It is used primarily for broadcast...

Page 390: ...390 01 28006 0010 20041105 Fortinet Inc Glossary ...

Page 391: ...n 321 B back up configuration 124 bandwidth guaranteed 203 204 maximum 203 204 banned word spam 352 bindtoif 284 browsing the Internet through a VPN tunnel 261 289 C CA certificates 279 Certificate Name 256 279 CLI 25 upgrading the firmware 40 42 cluster managing an HA cluster 100 cluster ID HA 102 cluster members HA 92 command line interface 25 Concentrator 259 263 Concentrator list 263 Concentra...

Page 392: ...interface 58 dynamic DNS monitor 265 266 Dynamic DNS VPN 287 dynamic IP pool IP pool 207 242 243 245 247 dynamic port forwarding 222 226 E Email address 349 Enable perfect forward secrecy PFS 260 Enable replay detection 260 Encryption 257 for FortiLog unit 359 Encryption Algorithm 254 262 Encryption Key 263 Exempt URL options 336 expire system status 38 F facility 375 fail open 310 failover monito...

Page 393: ...onfiguring 97 HA monitor active sessions 102 CPU usage 102 intrusion detected 102 memory usage 102 monitor 102 network utilization 102 total bytes 102 total packets 102 up time 102 virus detected 102 heartbeat failover 91 heartbeat device IP addresses HA 96 hello interval 182 190 High Availability 92 high availability introduction 24 http 239 HTTPS 25 212 387 hub HA schedule 94 Hub and spoke VPNs ...

Page 394: ...1 memory usage HA monitor 102 metric 193 metric type 193 MIB FortiGate 107 MIME headers 350 Mode 254 255 mode HA 92 Transparent 22 monitor HA monitor 102 IPSec VPN 265 monitor priorities HA 96 mtu 190 MTU size 59 definition 388 mtu ignore 190 N NAT introduction 22 push update 132 NAT Route mode introduction 22 natip 206 Nat traversal 257 netmask administrator account 118 119 network address transl...

Page 395: ...m status 38 Proxy ID Destination 266 267 Proxy ID Source 266 267 proxy server 130 push updates 130 push update configuring 131 external IP address changes 131 management IP address changes 132 through a NAT device 132 through a proxy server 130 Q Quarantine 314 Quarantine list 314 Quick Mode Identities 261 R RADIUS definition 388 random HA schedule 94 RBL and ORDBL 347 read write access level admi...

Page 396: ...on 279 subnet definition 389 subnet address definition 389 substitute 180 substitute status 180 syn interval 88 synchronize with NTP server 88 Syslog logging settings 361 system configuration 87 system date and time setting 87 system options changing 88 T tag 193 194 TCP custom service 214 215 technical support 30 threshold 309 time setting 87 time zone 88 Timeout 259 266 267 timeout firewall auth...

Page 397: ...unnel Name 262 VPNs 253 W web content filtering introduction 21 Web filter 329 377 content block 330 Web pattern block 334 Web script filter options 342 Web URL block list 333 web based manager introduction 25 language 89 90 timeout 89 WebTrends logging settings 361 weighted round robin HA schedule 94 weighted round robin configuring weights 100 Windows 2000 configuring L2TP dialup connection 273 ...

Page 398: ...398 01 28006 0010 20041105 Fortinet Inc Index ...

Search results

Summary of Contents for FortiGate 3000

Reviews:

Related manuals for FortiGate 3000

Brands by name

Popular brands

Fortinet FortiGate 3000, Administration Manual

Search results

Summary of Contents for FortiGate 3000

Reviews:

Related manuals for FortiGate 3000

Brands by name

Popular brands