Fortinet FortiDDoS Скачать руководство пользователя страница 24 | Manualshive

Страница: 24 / 37

background image

Configuration Options

Using traffic diversion in service provider environment

FortiDDoS v3.2 Installation Guide
28-320-183686-20130401

24

http://docs.fortinet.com/

•

Configuring the bypass switch

A 10/100/1000 bypass switch allows you to set communication parameters. Refer to
the

FortiGate Hardware Guide

to set the following parameters:

•

Auto-negotiation

•

Line speed

•

Link Fault Detect (LFD)

•

Input timeout period

•

Input retry count

Connecting the 10/100/1000 bypass switch to the network

1

Connect the INT 1 port to the Server side.

2

Connect the EXT 1 port to the Internet side.

3

Connect the INT 2 port to the Server Port of the FortiDDoS device.

4

Connect the EXT 2 port to the Internet Port of the FortiDDoS device.

Configuring MAC Addresses for Bypass Switch Heatbeat Packets

When a FortiDDoS appliance is used in conjunction with a bypass switch such as
FortiBridge, you have to ensure that heartbeat packets from the bypass switch are
allowed in Prevention Mode under all possible cases of packets being blocked by the
FortiDDoS.

Typically all bypass switches use heartbeat packets to check if the data path is
connected. If the data path is broken for some critical reason, the bypass switch
switches to bypass mode from normal mode.

To ensure passage of the heartbeat packets, FortiDDoS allows you to configure the
MAC addresses of the bypass switch. These MAC addresses are used by the bypass
switch for the heartbeat packets.

FortiBridge appliance allows you to view the MAC addresses in the status page.

Every FortiDDoS link pair can be connected via a FortiBridge link pair. E.g. LAN1,
WAN1 can be bridged via a FortiBridge link and LAN2, WAN2 on a card can be
similarly bridged via another FortiBridge link. Each of these link pairs will be associated
with a pair of MAC addresses. Therefore if you are using two links you will need to
configure 4 MAC addresses. If you are using one link then you need to specify just one
pair of MAC addresses.

To configure, please refer to section “Configuring MAC Addresses for Bypass Switch
Heatbeat Packets” in the

FortiDDoS Web-based Manager v3.1 Reference Guide

.

Using traffic diversion in service provider environment

Traffic diversion

A FortiDDoS device can be deployed in Service Provider environment where the total
bandwidth may be much more than what the appliance can support, but the attack
traffic to a specific subnet or server is within its capacity. In such cases, normal traffic
is sent through its regular path while the attack traffic is manually diverted by Service
Provider staff during attack through the FortiDDoS device. The FortiDDoS device in
turn cleans the traffic and injects it back to the network.

«
...
22
23
24
25
26
...
»

Содержание FortiDDoS

Страница 1: ...FortiDDoS v3 2 Installation Guide ...

Страница 2: ...ether express or implied except to the extent Fortinet enters a binding written contract signed by Fortinet s General Counsel with a purchaser that expressly warrants that the identified product will perform according to the performance metrics herein For absolute clarity any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests Fortinet disc...

Страница 3: ... 10 Connecting the management ports 10 Setting up network properties 10 Configuring interface settings 11 Checking system status 12 Configuring the operating mode 14 Serial mode 14 Configuring additional modes 14 Configuring prevention or detection mode for a set of VIDs in a specific direction 15 Configuring bypass mode 15 Configuring emergency bypass mode 16 Configuring link down synchronization...

Страница 4: ...eat 23 Using copper 10 100 1000 bypass switch with heartbeat 23 Using traffic diversion in service provider environment 24 Traffic diversion 24 Traffic diversion using a single divert from and inject to router and a switch 26 Using load balancing to support higher bandwidth in service provider environment 29 Load balancing 29 Using FortiGuard IP Reputation Service 36 Configuring FortiGuard IP Repu...

Страница 5: ... service provider environment Using FortiGuard IP Reputation Service Introduction This document explains the tasks required to initially install a FortiDDoS device in a network We assume that you have already read the FortiDDoS Fundamentals Guide and are familiar with the fundamental concepts related to FortiDDoS devices This document explains package contents system overview selecting a mode of o...

Страница 6: ...N 4 and WAN 4 The FDD 300A has additional ports that are marked LAN 5 WAN 5 LAN 6 and WAN 6 USB keyboard port Use of the keyboard port is optional and is to be used during diagnostics on the console Serial Interface through USB port A serial console can be connected using a USB to serial adapter The console can be used for Command Line Interface CLI access for advanced usage Monitor port Use of mo...

Страница 7: ...ted systems Figure 2 A simple network prior to installation of a FortiDDoS device In a simple network shown in Figure 2 a system is connected to an Ethernet local area network In the simplest configuration you can install a FortiDDoS unit as an inline device as shown in Figure 3 Figure 3 Network with a FortiDDoS device protecting a single system The appliance is stateful and bidirectional so a con...

Страница 8: ...tups can protect multiple systems In a basic web hosting deployment a FortiDDoS device can protect systems in multiple customer cages as shown in Figure 5 You can either use a single VID system or a multiple VID system Please refer to the FortiDDoS Fundamentals Guide for concepts related to VID and the FortiDDoS Web Based Manager Guide for the actual configuration of VIDs Figure 5 Basic web hostin...

Страница 9: ...eedback Managed hosting deployment with high availability Figure 6 shows another setup protecting multiple systems in a data center environment In this case two FortiDDoS devices independently protect the routers and the subsequent networks from DoS and DDoS attacks Figure 6 Managed hosting deployment with high availability ...

Страница 10: ...t and the other end to the appliance itself Connecting the management ports To manage the FortiDDoS device via a web browser 1 Connect the 10 100 ethernet port to a workgroup switch router or use a crossover Ethernet cable to a computer with an HTML web browser The IP address of the management port is preset to 192 168 1 1 2 You must first access the FortiDDoS device using this IP address but you ...

Страница 11: ...ice are connected have to be described clearly to the device so that it can communicate with the networks without any errors You must know the network settings before installing FortiDDoS device The existing switches routers firewalls have their ports set to certain speed duplexity and flow control mode With those settings in mind you must set the values in the Configure Global Card 1 Interface Se...

Страница 12: ...e pages will also tell you if the sendmail service is operational This service can be used in conjunction with the Event Monitor to notify you or other email recipients of system events This can be configured under the Configure Current VID Event Notification menu For the FortiDDoS device to send a mail message it must be able to contact a Domain Name Server DNS to resolve the domain name of the e...

Страница 13: ...em status FortiDDoS v3 2 Installation Guide 28 320 183686 20130401 13 http docs fortinet com Feedback Figure 8 Status page for FortiDDoS devices with copper connections Part 1 Figure 9 Status page for FortiDDoS devices with copper connections Part 2 ...

Страница 14: ...ge bypass switches for failover protection For other bypass switches available in the market please contact your Sales Engineer to check if it is qualified to work with FortiDDoS appliances Refer to Configuration Options on page 22 Direction Based VID Based Prevention Mode Prevention Mode for a set of chosen VIDs in a specific direction is the full function operating mode of the FortiDDoS device P...

Страница 15: ...rly LAN 2 receives traffic from WAN 2 and versa Configuring prevention or detection mode for a set of VIDs in a specific direction To set the Prevention Detection Mode of a set of VIDs click Configure Global Operating Mode Please refer to Figure 11 above In Prevention Detection Mode section click the VIDs you want in Prevention Mode and leave the VIDs unchecked if you want them in Detection Mode Y...

Страница 16: ...n a segment when one of the links goes down The device monitors the link state for a pair of ports which are protecting a segment These correspond to LAN 1 connected to LAN or WAN 1 connected to the Internet Similarly for Dual WAN Link mode these ports correspond to LAN 2 and WAN 2 If the link goes down on either port the partner port is disabled Link Down Synchronization once enabled propagates t...

Страница 17: ...ose that you do not need Figure 12 Network with FortiDDoS protecting multiple VIDs Configuring VIDs To configure a VID 1 From the main menu click Configure Global VIDs 2 Simply enter the following information Subnet ID This ID is used to for subnet based reporting Administrator can generate attack event report for individual subnets You can enter up to 512 subnets Please refer to the datasheet of ...

Страница 18: ...iled description of VID configuration please refer to the Web based Manager Administration Guide Performing a sanity test The following steps can serve as a simple demonstration of how FortiDDoS devices block traffic To run the demo the network configuration should be in serial prevention mode as shown in Figure 13 The protected server should respond to ICMP Echo ping packets and a connected syste...

Страница 19: ... ping packet to the specified address every 0 1 seconds until 100 packets are sent This is the equivalent of 10 packets per second for 10 seconds Following is a screen capture from an actual ping flood test Notice that the first few pings are allowed to pass and receive a response As soon as the rate per second rises above the threshold somewhere in the first 11 packets the FortiDDoS device blocks...

Страница 20: ...shows the properties of all events that have occurred for a selected period of time Event Monitor provides a comprehensive way to display network attacks so that users can investigate them intuitively Users can choose a particular date range or number of events to be displayed In addition FortiDDoS devices provide categorized event entries as well as VID and database choices so that users can see ...

Страница 21: ...face provides several granular event reports to summarize the past attack events You can see the reports for each VID independently The detailed description of these reports is available in the FortiDDoS Web based Manager Guide Corresponding to the ping test activity will appear in the following reports Top Attacked Services and Top Attacked ICMP Type and Code Top Attacked Protocols Top Attacks ...

Страница 22: ...still be maintained As shown in Figure 15 when the bypass switch is in disabled mode the in line traffic continues to flow through the FortiDDoS device This is the default mode Figure 15 Bypass Switch in Disabled Mode As shown in Figure 16 when the bypass switch is in bypass enabled mode all in line traffic is routed through the bypass switch In this mode the switch allows the FortiDDoS device to ...

Страница 23: ...d restores the traffic through the FortiDDoS device as soon as the link is restored Configuring the optical bypass switch Refer to the FortiBridge QuickStart Guide and FortiGate Hardware Guide to set the following parameters Input timeout period Input retry count Connecting the optical bypass switch to the network 1 Connect the INT 1 port to the Server side 2 Connect the EXT 1 port to the Internet...

Страница 24: ...al mode To ensure passage of the heartbeat packets FortiDDoS allows you to configure the MAC addresses of the bypass switch These MAC addresses are used by the bypass switch for the heartbeat packets FortiBridge appliance allows you to view the MAC addresses in the status page Every FortiDDoS link pair can be connected via a FortiBridge link pair E g LAN1 WAN1 can be bridged via a FortiBridge link...

Страница 25: ...ivert from Router Router 1 is used to divert the traffic to the attacked destination This traffic passes through the FortiDDoS device The traffic is then forwarded to the Inject to Router Router 2 These two interfaces are in the same network 192 168 1 x and therefore an ARP request from Router 1 for 192 168 1 2 passes through the FortiDDoS device and reaches Router 2 and Router 2 can respond back ...

Страница 26: ...rom the attacked destination This traffic passes through the FortiDDoS device through a switch The traffic is then forwarded to the Inject to interface on the same Router through the same switch A static route is added on the Router for addresses for the attacked customer network Having the longest matching prefix the rule matches first and therefore all traffic to attacked customer network is div...

Страница 27: ...itEthernet1 0 5 interface GigabitEthernet1 0 6 interface GigabitEthernet1 0 7 interface GigabitEthernet1 0 8 interface GigabitEthernet1 0 9 interface GigabitEthernet1 0 10 switchport access vlan 2 interface GigabitEthernet1 0 11 ip address 10 100 0 250 255 255 255 0 no ip directed broadcast ip policy route map FDD X00A PBR interface GigabitEthernet1 0 12 interface Vlan2 ip address 10 1 0 251 255 2...

Страница 28: ...ort trunk encapsulation dot1q interface GigabitEthernet1 0 3 switchport access vlan 3 interface GigabitEthernet1 0 4 switchport access vlan 3 switchport trunk encapsulation dot1q interface GigabitEthernet1 0 5 interface GigabitEthernet1 0 6 interface GigabitEthernet1 0 7 interface GigabitEthernet1 0 8 interface GigabitEthernet1 0 9 interface GigabitEthernet1 0 10 switchport access vlan 2 interface...

Страница 29: ...t higher bandwidth in service provider environment Load balancing Many data center architectures require protecting network infrastructure and server farms With these requirements becoming more prevalent traffic requirements on some networks may exceed the capabilities of the FortiDDoS appliance Furthermore the FortiDDoS devices in such network topologies could potentially become a network bottlen...

Страница 30: ...ss interfaces of the peer device behind the FortiDDoS device For this to work each FortiDDoS device must reside in a different VLAN and subnet and the physical ports connected to the FortiDDoS device must be on different VLANs as well In addition for each VLAN both load balancers must be in the same subnet Each load balancer interface and the FortiDDoS device connected to it reside in a separate V...

Страница 31: ...rrect FortiDDoS device On the path to the intranet Load Balancing Switch 1 LBS1 balances traffic across VLANs 101 102 and 103 through the firewalls to Load Balancing Switch 2 On the path to the Internet Load Balancing Switch 2 LBS2 balances traffic across VLANs 201 202 and 203 through the FortiDDoS device to Load Balancing Switch 1 Each Load Balancing Switch uses the alias IP addresses configured ...

Страница 32: ... 82 show run Current Configuration System Description FortiSwitch 248B DPS 48x1G 4x10G System Software Version 5 2 0 2 4 serviceport ip 192 168 22 98 255 255 255 0 0 0 0 0 vlan database vlan name 10 egress vlan name 11 ingress exit port channel egress 1 interface 0 1 channel group 1 1 exit interface 0 3 channel group 1 1 exit interface 0 5 channel group 1 1 exit interface 0 7 channel group 1 1 exi...

Страница 33: ...face 0 4 channel group 1 2 exit interface 0 6 channel group 1 2 exit interface 0 8 channel group 1 2 exit interface 0 10 channel group 1 2 exit interface 0 12 channel group 1 2 exit interface 0 14 channel group 1 2 exit interface 0 16 channel group 1 2 exit mac addr table aging time 60000 interface 0 1 no cdp run switchport allowed vlan add 10 exit interface 0 2 no cdp run exit interface 0 3 no cd...

Страница 34: ... no cdp run exit interface 0 9 no cdp run exit interface 0 10 no cdp run exit interface 0 11 no cdp run exit interface 0 12 no cdp run exit interface 0 13 no cdp run exit interface 0 14 no cdp run exit interface 0 15 no cdp run exit interface 0 16 no cdp run exit interface 0 17 no cdp run switchport allowed vlan add 10 switchport native vlan 10 exit interface 0 18 no cdp run switchport allowed vla...

Страница 35: ...e 1 1 staticcapability switchport allowed vlan add 10 switchport native vlan 10 lacp collector max delay 0 exit interface 1 2 staticcapability switchport allowed vlan add 11 switchport native vlan 11 lacp collector max delay 0 exit interface 1 3 staticcapability switchport allowed vlan add 10 switchport tagging 10 lacp collector max delay 0 exit interface 1 4 staticcapability switchport allowed vl...

Страница 36: ...ng non existent attacks takes up valuable resources If a malicious machine attacks a target in one location the rest of the global network needs to find out fast in order to pre empt the next wave FortiGuard IP Reputation Service provides the updates FortiGuard IP Reputation Service Protects against malicious sources associated with web attacks phishing activity web scanning scraping etc Blocks la...

Страница 37: ......

Отзывы:

Нет отзывов

Похожие инструкции для FortiDDoS

Atto RCM D4 ECT

Бренд: Electrex Страницы: 4

Бренд: Medion Страницы: 43

Бренд: Magnavox Страницы: 60

Бренд: Warmup Страницы: 3

Бренд: Panasonic Страницы: 1

Crouse-Hinds GFS Series

Бренд: Eaton Страницы: 2

Бренд: ATS Страницы: 3

WaluCover Initial

Бренд: Walter Страницы: 20

Бренды по названию

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Популярные бренды

Загрузить еще бренды