Fortinet Fortiwifi fortiwifi-60 Скачать руководство пользователя страница 386 | Manualshive

Страница: 386 / 394

background image

386

01-28006-0014-20041105

Fortinet Inc.

Glossary

«
...
384
385
386
387
388
...
»

Содержание Fortiwifi fortiwifi-60

Страница 1: ...Administration Guide INTERNAL DMZ 4 3 2 1 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 WAN1 WAN2 PWR WLAN FortiWiFi 60 Administration Guide Version 2 80 MR6 5 November 2004 01 28006...

Страница 2: ...ion Guide Version 2 80 MR6 5 November 2004 01 28006 0014 20041105 Trademarks Products mentioned in this document are trademarks or registered trademarks of their respective holders Regulatory Complian...

Страница 3: ...22 Related documentation 22 FortiManager documentation 23 FortiClient documentation 23 FortiMail documentation 23 FortiLog documentation 23 Customer service and technical support 24 System status 25...

Страница 4: ...WiFi units and VLANs 64 VLANs in NAT Route mode 64 Rules for VLAN IDs 65 Rules for VLAN IP addresses 65 Adding VLAN subinterfaces 66 VLANs in Transparent mode 67 Rules for VLAN IDs 69 Transparent mode...

Страница 5: ...16 Administrators options 116 Access profiles 117 Access profile list 118 Access profile options 118 System maintenance 121 Backup and restore 121 Backing up and Restoring 122 Update center 124 Updati...

Страница 6: ...eneral 153 Networks list 154 Networks options 155 Interface list 155 Interface options 156 Distribute list 157 Distribute list options 158 Offset list 159 Offset list options 159 Router objects 160 Ac...

Страница 7: ...service list 209 Custom service list 212 Custom service options 212 Configuring custom services 213 Service group list 215 Service group options 215 Configuring service groups 216 Schedule 216 One ti...

Страница 8: ...r list 241 RADIUS server options 242 LDAP 242 LDAP server list 243 LDAP server options 243 User group 245 User group list 245 User group options 246 CLI configuration 247 peer 247 peergrp 248 VPN 251...

Страница 9: ...VPN access for specific certificate holders 278 CLI configuration 279 ipsec phase1 279 ipsec phase2 281 ipsec vip 282 Authenticating peers with preshared keys 284 Gateway to gateway VPN 284 Dialup VP...

Страница 10: ...ine 312 Quarantined files list 312 Quarantined files list options 313 AutoSubmit list 314 AutoSubmit list options 314 Configuring the AutoSubmit list 314 Config 315 Config 316 Virus list 316 Config 31...

Страница 11: ...ports 337 Category block reports options 338 Generating a category block report 338 Category block CLI configuration 338 Script filter 339 Web script filter options 340 Spam filter 341 IP address 344...

Страница 12: ...E mail options 360 Log filter options 361 Configuring log filters 364 Enabling traffic logging 364 Log access 365 Viewing log messages 365 Searching log messages 367 CLI configuration 368 fortilog se...

Страница 13: ...rvice and technical support About FortiWiFi Antivirus Firewalls The FortiWiFi Antivirus Firewall is a dedicated easily managed security device that delivers a full suite of capabilities that include a...

Страница 14: ...SMTP POP3 and IMAP content as it passes through the FortiWiFi unit FortiWiFi antivirus protection uses pattern matching and heuristics to find viruses If a virus is found antivirus protection removes...

Страница 15: ...out denying access to it completely To prevent unintentionally blocking legitimate web pages you can add URLs to an exempt list that overrides the URL blocking and content blocking lists The exempt li...

Страница 16: ...The FortiWiFi firewall can operate in NAT Route mode or Transparent mode NAT Route mode In NAT Route mode the FortiWiFi unit is a Layer 3 device This means that each of its interfaces is associated wi...

Страница 17: ...firewall and routing services to multiple networks so that traffic from each network is effectively separated from every other network You can develop and manage interfaces VLAN subinterfaces zones f...

Страница 18: ...an connect to an IPSec VPN tunnel VPN hub and spoke using a VPN concentrator to allow VPN traffic to pass from one tunnel to another through the FortiWiFi unit IPSec Redundancy to create a redundant A...

Страница 19: ...manage the FortiWiFi unit The web based manager supports multiple languages You can configure the FortiWiFi unit for HTTP and HTTPS administration from any FortiWiFi interface You can use the web bas...

Страница 20: ...ing the WebTrends enhanced log format Some models can also save logs to an optional internal hard drive If a hard drive is not installed you can configure most FortiWiFi units to log the most recent e...

Страница 21: ...e_str To show the settings for all interfaces you can enter show system interface To show the settings for the internal interface you can enter show system interface internal A space to separate optio...

Страница 22: ...ltering and spam filtering and how to configure a VPN FortiWiFi online help Provides a context sensitive and searchable version of the Administration Guide in HTML format You can access online help fr...

Страница 23: ...rtiClient software FortiMail documentation FortiMail Administration Guide Describes how to install configure and manage a FortiMail unit in gateway mode and server mode including how to configure the...

Страница 24: ...our region For information about our priority support hotline live support see http support fortinet com When requesting technical support please provide the following information your name your compa...

Страница 25: ...n log This chapter includes Console access Status Session list Changing the FortiWiFi firmware Console access An alternative to the web based manager discussed in this manual is text based Console Acc...

Страница 26: ...s on page 117 Viewing system status Changing unit information Viewing system status Figure 2 System status System status Connect Select Connect to connect to the CLI Disconnect Select Disconnect to di...

Страница 27: ...of the FortiWiFi Antivirus Definitions Attack Definitions The current installed version of the FortiWiFi Attack Definitions used by the Intrusion Prevention System IPS Serial Number The serial number...

Страница 28: ...aximum network bandwidth that can be processed by the FortiWiFi unit History Select History to view a graphical representation of the last minute of CPU memory sessions and network usage This page als...

Страница 29: ...P System Name To update the firmware version For information on updating the firmware see Changing the FortiWiFi firmware on page 32 To update the antivirus definitions manually 1 Download the latest...

Страница 30: ...ettings see HA on page 90 To change to Transparent mode 1 Go to System Status Status 2 In the Operation Mode field of the Unit Information section select Change 3 In the Operation Mode field select Tr...

Страница 31: ...m IP Set source IP address for list filtering From Port Set source port for list filtering To IP Set destination IP address for list filtering To Port Set destination port for list filtering Apply Fil...

Страница 32: ...to a more recent build of the same firmware version Reverting to a previous firmware version Use the web based manager or CLI procedure to revert to a previous firmware version This procedure reverts...

Страница 33: ...the CLI 1 Make sure that the TFTP server is running 2 Copy the new firmware image file to the root directory of the TFTP server 3 Log into the CLI 4 Make sure the FortiWiFi unit can connect to the TFT...

Страница 34: ...Reverting to a previous firmware version Use the following procedures to revert your FortiWiFi unit to a previous firmware version Reverting to a previous firmware version using the web based manager...

Страница 35: ...page 121 10 Update antivirus and attack definitions For information about antivirus and attack definitions see To update antivirus and attack definitions on page 127 Reverting to a previous firmware...

Страница 36: ...mage FGT_300 v280 build158 FORTINET out 192 168 1 168 The FortiWiFi unit responds with the message This operation will replace the current firmware version Do you want to continue y n 6 Type y The For...

Страница 37: ...e Backing up and Restoring on page 122 Back up the IPS custom signatures For information see Backing up and restoring custom signature files on page 303 Back up web content and email filtering lists F...

Страница 38: ...Download Boot Image FortiWiFi unit running v3 x BIOS Press any key to display configuration menu Immediately press any key to interrupt the system startup If you successfully interrupt the startup pr...

Страница 39: ...e and restarts The installation might take a few minutes to complete Restoring the previous configuration Change the internal interface address if required You can do this from the CLI using the comma...

Страница 40: ...internal interface To test a new firmware image 1 Connect to the CLI using a null modem cable and FortiWiFi console port 2 Make sure the TFTP server is running 3 Copy the new firmware image file to th...

Страница 41: ...he FTP server The IP address must be on the same network as the TFTP server but make sure you do not use the IP address of another device on this network The following message appears Enter File Name...

Страница 42: ...42 01 28006 0014 20041105 Fortinet Inc Changing the FortiWiFi firmware System status...

Страница 43: ...etwork configuration Interface Zone Management DNS Routing table Transparent Mode Configuring the modem interface VLAN overview VLANs in NAT Route mode VLANs in Transparent mode FortiWiFi IPv6 support...

Страница 44: ...The modem interface is available if a modem is connected to the USB port see Configuring the modem interface on page 59 If you have added VLAN subinterfaces they also appear in the name list below th...

Страница 45: ...e To change the MTU size of the packets leaving an interface To configure traffic logging for connections to an interface Name The name of the Interface Interface Select the name of the physical inter...

Страница 46: ...ministrative distance for the default gateway retrieved from the DHCP server The administrative distance an integer from 1 255 specifies the relative priority of a route when there are multiple routes...

Страница 47: ...session if it is idle for this number of seconds PADT must be supported by your ISP Set initial PADT timeout to 0 to disable Distance Enter the administrative distance for the default gateway retriev...

Страница 48: ...connect You can select the following administrative access options connected The interface retrieves an IP address netmask and other settings from the PPPoE server failed The interface was unable to...

Страница 49: ...e traffic log for a logging location and set the logging severity level to Notification or lower Go to Log Report Log Config to configure logging locations and types For information about logging see...

Страница 50: ...for the interface and then add the interface to the zone 1 Go to System Network Zone 2 Choose the zone to add the interface or VLAN subinterface to and select Edit 3 Select the names of the interfaces...

Страница 51: ...iWiFi unit attempts to contact the DHCP server from the interface to set the IP address netmask and optionally the default gateway IP address and DNS server IP addresses 7 Select Status to refresh the...

Страница 52: ...terface edit intf_str config secondaryip edit 0 set ip second_ip netmask_ip Optionally you can also configure management access and add a ping server to the secondary IP address set allowaccess ping h...

Страница 53: ...e 56 1 Go to System Network Interface 2 Choose an interface and select Edit 3 Select the Administrative Access methods for the interface 4 Select OK to save the changes To change the MTU size of the p...

Страница 54: ...l domain to which you want to add the zone 2 Go to System Network Zone 3 Select Create New 4 In the New Zone dialog box type a name for the zone Create New Select Create New to create a zone Name The...

Страница 55: ...al domain go to System Virtual Domain Current Virtual Domain and select the virtual domain in which to edit the zone 2 Go to System Network Zone 3 Select Edit to modify a zone 4 Select or deselect Blo...

Страница 56: ...value of 5 minutes see To set the system idle timeout on page 89 Figure 10 Management To configure the management interface 1 Go to System Network Management 2 Enter the Management IP Netmask 3 Enter...

Страница 57: ...d or that the FortiWiFi unit obtained automatically Figure 11 DNS To add DNS server IP addresses 1 Go to System Network DNS 2 Change the primary and secondary DNS server IP addresses as required 3 Sel...

Страница 58: ...te number IP The destination IP address for this route Mask The netmask for this route Gateway The IP address of the next hop router to which this route directs traffic Distance The the relative prefe...

Страница 59: ...o an ISP Connecting a modem to the FortiWiFi unit Configuring modem settings Connecting and disconnecting the modem Backup mode configuration Standalone mode configuration Adding firewall policies for...

Страница 60: ...redial limit is 1 Select None to allow the modem to never stop redialing Holddown Timer For backup configurations The time 1 60 seconds that the FortiWiFi unit waits before switching from the modem in...

Страница 61: ...until the modem connects to an ISP To disconnect the modem Use the following procedure to disconnect the modem from a dialup account 1 Go to System Network Modem 2 Select Hang Up if you want to disco...

Страница 62: ...iguration In standalone mode you manually connect the modem to a dialup account The modem interface operates as the primary connection to the Internet The FortiWiFi unit routes traffic through the mod...

Страница 63: ...terfaces on the FortiWiFi unit For information about adding firewall policies see To add a firewall policy on page 202 VLAN overview A VLAN is group of PCs servers and other network devices that commu...

Страница 64: ...rom each security domain is given a different VLAN ID The FortiWiFi unit can recognize VLAN IDs and apply security policies to secure network and IPSec VPN traffic between security domains The FortiWi...

Страница 65: ...t physical interfaces There is no internal connection or link between two VLAN subinterfaces with same VLAN ID Their relationship is the same as the relationship between any two FortiWiFi network inte...

Страница 66: ...hes the VLAN ID of the packets to be received by this VLAN subinterface 6 Select the virtual domain to which to add this VLAN subinterface See System virtual domain on page 137 for information about v...

Страница 67: ...tween the FortiWiFi Internal and external interface you would add a VLAN subinterface to the internal interface and another VLAN subinterface to the external interface If these VLAN subinterfaces have...

Страница 68: ...ured with three VLAN subinterfaces In this configuration the FortiWiFi unit could be added to this network to provide virus scanning web content filtering and other services to each VLAN VLAN1 VLAN1 V...

Страница 69: ...ork interfaces Transparent mode virtual domains and VLANs VLAN subinterfaces are added to and associated with virtual domains By default the FortiWiFi configuration includes one virtual domain named r...

Страница 70: ...Domain Select a virtual domain to display the VLAN interfaces added to this virtual domain Name The name of the interface or VLAN subinterface Access The administrative access configuration for the i...

Страница 71: ...or disable using a Dynamic DNS service DDNS If the FortiWiFi unit uses a dynamic IP address you can arrange with a DDNS service provider to use a domain name to provide redirection of traffic to your...

Страница 72: ...periodic router advertisements and tunneling of IPv6 addressed traffic over an IPv4 addressed network All of these features must be configured through the Command Line Interface CLI See the FortiGate...

Страница 73: ...an connect through the FortiWiFi 60 unit to the Internet or to internal or DMZ networks The FortiWiFi 60 supports the following wireless network standards IEEE 802 11b 2 4 GHz Band IEEE 802 11g 2 4 GH...

Страница 74: ...the FortiWiFi 60 wireless network should configure their computers with the same settings Key For a 64 bit WEP key enter 10 hexadecimal digits 0 9 a f For a 128 bit WEP key enter 26 hexadecimal digits...

Страница 75: ...regulatory domain Channels 1 through 8 are for indoor use only Channels 9 through 11 can be used indoors and outdoors You must make sure that the channel number complies with the regulatory standards...

Страница 76: ...ettings 2 Set Geography to your country or region 3 Select a channel number for your FortiWiFi 60 wireless network 4 Enter the required Service Set ID SSID 5 Enable or disable SSID Broadcast as requir...

Страница 77: ...opriate 5 To move MAC addresses between lists select the MAC address and then select the appropriate arrow key 6 To remove a MAC address from a list select the MAC address and then select the Remove b...

Страница 78: ...78 01 28006 0014 20041105 Fortinet Inc Wireless MAC Filter System wireless...

Страница 79: ...e cannot provide both functions at the same time This section describes Service Server Exclude range IP MAC binding Dynamic IP Service Go to System DHCP Service to configure the DHCP service provided...

Страница 80: ...3 Select DHCP Relay Agent Interface List of FortiWiFi interfaces Service The DHCP service provided by the interface none DHCP Relay or DHCP Server Edit View icon Select to view or modify the DHCP serv...

Страница 81: ...nfiguration for this interface See To configure a DHCP server for an interface on page 82 Server You can configure one or more DHCP servers for any FortiWiFi interface As a DHCP server the interface d...

Страница 82: ...ding IP for the range of IP addresses that this DHCP server assigns to DHCP clients Network Mask Enter the netmask that the DHCP server assigns to DHCP clients Lease Time Select Unlimited for an unlim...

Страница 83: ...cted subnets sends a DHCP request it is relayed to the FortiWiFi interface by the router using DHCP relay The FortiWiFi unit selects the DHCP server configuration with an IP range that matches the sub...

Страница 84: ...the device When you add the MAC address and an IP address to the IP MAC binding list the DHCP server always assigns this IP address to the MAC address IP MAC binding pairs apply to all FortiWiFi DHCP...

Страница 85: ...esses and the expiry time and date for these addresses To view the dynamic IP list 1 Go to System DHCP Dynamic IP 2 Select the interface for which you want to view the list Name Enter a name for the I...

Страница 86: ...86 01 28006 0014 20041105 Fortinet Inc Dynamic IP System DHCP...

Страница 87: ...et the FortiWiFi system time For effective scheduling and logging the FortiWiFi system time must be accurate You can either manually set the FortiWiFi system time or you can configure the FortiWiFi un...

Страница 88: ...ions Timeout settings including the idle timeout and authentication timeout The language displayed by the web based manager Dead gateway detection interval and failover detection Automatically adjust...

Страница 89: ...s 8 hours To improve security keep the idle timeout at the default value of 5 minutes Auth Timeout Set the firewall user authentication timeout to control how long an authenticated connection can be i...

Страница 90: ...ion synchronize the cluster routing table and report individual cluster member status The units in the cluster are constantly communicating HA status information to make sure that the cluster is opera...

Страница 91: ...distribute virus scanning to all the FortiWiFi units in the HA cluster By default the FortiWiFi unit load balances virus scanning among all of the FortiWiFi units in the cluster Using the CLI you can...

Страница 92: ...e same virtual MAC address This virtual MAC address is set according to the group ID Table 5 lists the virtual MAC address set for each group ID If you have more than one HA cluster on the same networ...

Страница 93: ...ates a different cluster unit becomes the primary cluster unit Override Master Configure a cluster unit to always override the current primary cluster unit and become the primary cluster unit Enable o...

Страница 94: ...s are connected to load balancing switches Hub Load balancing if the cluster interfaces are connected to a hub Traffic is distributed to cluster units based on the Source IP and Destination IP of the...

Страница 95: ...m to be able to process heartbeat packets In HA mode the cluster assigns virtual IP addresses to the heartbeat device interfaces The primary cluster unit heartbeat device interface is assigned the IP...

Страница 96: ...cluster becomes the new primary unit to provide better service to the high priority network If a low priority interface fails on one cluster unit and a high priority interface fails on another cluster...

Страница 97: ...er When you select apply you may temporarily lose connectivity with the FortiWiFi unit as the HA cluster negotiates 13 If you are configuring a NAT Route mode cluster power off the FortiWiFi unit and...

Страница 98: ...e that the cluster is operating properly This cluster communication is also called the cluster heartbeat Inserting an HA cluster into your network temporarily interrupts communications on the network...

Страница 99: ...onfiguration as the other units in the cluster 2 If the cluster is running in Transparent mode change the operating mode of the new FortiWiFi unit to Transparent mode 3 Connect the new FortiWiFi unit...

Страница 100: ...te unit priority 1 weight 3 The next three connections are processed by the second subordinate unit priority 2 weight 3 The subordinate units process more connections than the primary unit and both su...

Страница 101: ...logs for individual cluster units To monitor cluster units for failover To manage individual cluster units To view the status of each cluster member 1 Connect to the cluster and log into the web base...

Страница 102: ...Cluster Members list The host name and serial number of the primary cluster unit changes The new primary unit logs the following messages to the event log HA slave became master Detected HA member dea...

Страница 103: ...luster Each cluster unit is numbered starting at 1 The information displayed for each cluster unit includes the unit serial number and the host name of the unit 3 Complete the command with the number...

Страница 104: ...system location description can be up to 35 characters long Contact Enter the contact information for the person responsible for this FortiWiFi unit The contact information can be up to 35 characters...

Страница 105: ...three SNMP communities Each community can have a different configuration for SNMP queries and traps Each community can be configured to monitor the FortiWiFi unit for a different set of events You can...

Страница 106: ...d one or more SNMP communities IP Address The IP address of an SNMP manager than can use the settings in this SNMP community to monitor the FortiWiFi unit You can also set the IP address to 0 0 0 0 to...

Страница 107: ...compiled into your SNMP manager you do not have to compile them again Table 8 FortiWiFi MIBs MIB file name or RFC Description fortinet 2 80 mib The Fortinet MIB is a proprietary MIB that includes det...

Страница 108: ...rap message includes the name of the interface and the serial number of the FortiWiFi unit HA state HA state changes The trap message includes the previous state the new state and a flag indicating wh...

Страница 109: ...Flood NIDS attack prevention detects and provides protection from a syn flood attack Port scan attack IdsPortScan NIDS attack prevention detects and provides protection from a port scan attack Table 1...

Страница 110: ...priority of the individual FortiWiFi unit in a cluster override The master override setting enable or disable for an individual FortiWiFi unit in a cluster autoSync Auto config synchronization flag sc...

Страница 111: ...Can be password LDAP or RADIUS state Whether the local user is enabled or disable Table 20 Virtual domains MIB field Description index The index number virtual domain added to the FortiWiFi unit name...

Страница 112: ...igure 40 Replacement messages list To change a replacement message 1 Go to System Config Replacement Messages 2 Select the category of replacement message to edit by clicking on the blue triangle for...

Страница 113: ...a file that contained a virus or was blocked by antivirus file blocking QUARFILENAME can be used in virus and file block messages Quarantining is only available on FortiWiFi units with a local disk UR...

Страница 114: ...le was removed EMAIL_TO The email address of the intended receiver of the message from which the file was removed NIDSEVENT The IPS attack message NIDSEVENT is added to alert email intrusion messages...

Страница 115: ...read only write only or both read and write access to the following FortiWiFi features This chapter describes Administrators Access profiles Administrators Use the admin account or an account with sys...

Страница 116: ...e Password icon The admin administrator account cannot be deleted Administrator Enter the login name for the administrator account Password Type a password for the administrator account For improved s...

Страница 117: ...r must connect only through the subnet or subnets you specify You can even restrict an administrator to a single IP address if you define only one trusted host IP address with a netmask of 255 255 255...

Страница 118: ...nder Access Control Allow Write All Select Allow Write All to give an administrator write privilege on all the items under Access Control System Configuration Allow or deny access to the system status...

Страница 119: ...1105 119 To configure an access profile 1 Go to System Admin Access Profile 2 Select Create New to add an access profile or select the edit icon to edit an existing access profile 3 Enter a name for t...

Страница 120: ...120 01 28006 0014 20041105 Fortinet Inc Access profiles System administration...

Страница 121: ...pam filtering files to the management computer You can also restore system configuration VPN certificate web and spam filtering files from previously downloaded backup files Figure 48 Backup and resto...

Страница 122: ...system to its original configuration including resetting interface addresses This procedure does not change the firmware version or the antivirus or attack definitions Debug Log Download debug log Web...

Страница 123: ...r select Browse and locate the file 4 Select OK If you restore the system configuration the FortiWiFi unit restarts loading the new system settings You should then reconnect to the web based manager a...

Страница 124: ...t 9443 To receive push updates the FDN must be able to route packets to the FortiWiFi unit using UDP port 9443 For information about configuring push updates see To enable push updates on page 129 The...

Страница 125: ...FortiWiFi unit to send push updates Push updates may not be available if you have not registered the FortiWiFi unit see To register a FortiWiFi unit on page 134 if there is a NAT device installed bet...

Страница 126: ...was successful and new updates were installed Other messages can indicate that the FortiWiFi was not able to connect to the FDN and other error conditions Allow Push Update Select this check box to a...

Страница 127: ...whether the update was successful or not To enable scheduled updates 1 Go to System Maintenance Update center 2 Select the Scheduled Update check box 3 Select one of the following to check for and dow...

Страница 128: ...m autoupdate tunneling set address proxy address_ip set port proxy port set username username_str set password password_str set status enable end For example if the IP address of the proxy server is 6...

Страница 129: ...ded as the only method for obtaining updates The FortiWiFi unit might not receive the push notification Also when the FortiWiFi unit receives a push notification it makes only one attempt to connect t...

Страница 130: ...FortiWiFi NAT device and the FortiWiFi unit on the internal network so that the FortiWiFi unit on the internal network can receive push updates 1 Add a port forwarding virtual IP to the FortiWiFi NAT...

Страница 131: ...lect the Use override push check box 4 Set IP to the external IP address added to the virtual IP 5 Set Port to the external service port added to the virtual IP 6 Select Apply The FortiWiFi unit sends...

Страница 132: ...gister the FortiWiFi unit with FortiNet Contact Information Enter the contact information so that FortiNet support can reply to your bug report Items marked with an are required Bug Description Enter...

Страница 133: ...rtiWiFi units in a single session without re entering your contact information Once registration is completed Fortinet sends a Support Login user name and password to your email address You can use th...

Страница 134: ...you purchase a FortiCare Support Contract you can update the registration information to add the support contract number A single FortiCare Support Contract can cover multiple FortiWiFi units You must...

Страница 135: ...entered a support contract number a real time validation is performed to verify that the SCN information matches the FortiWiFi unit If the information does not match you can try entering it again A we...

Страница 136: ...the values set at the factory This procedure does not change the firmware version or the antivirus or attack definitions 1 Go to System Maintenance Shutdown 2 Select Reset to factory default 3 Select...

Страница 137: ...ctions between VLAN subinterfaces or zones in the virtual domain Packets never cross the virtual domain border The remainder of FortiWiFi functionality is shared between virtual domains This means tha...

Страница 138: ...s Physical interfaces see To add physical interfaces to a virtual domain on page 142 VLAN subinterfaces see To add VLAN subinterfaces to a virtual domain on page 143 Zones see To add zones to a virtua...

Страница 139: ...rus Definitions and engine Attack Definitions and engine Serial Number Operation Mode Network configuration DNS settings DHCP configuration DHCP settings are applied per interface no matter which virt...

Страница 140: ...l domain if you want these systems to communicate with network resources that can connect to a different virtual domain Virtual domains Go to System Virtual domain Virtual domains to view and add virt...

Страница 141: ...Name The virtual domain must not have the same name as a VLAN or zone 4 Select OK Selecting a virtual domain The following procedure applies to NAT Route and Transparent mode To select a virtual doma...

Страница 142: ...nfigure virtual domains Adding interfaces VLAN subinterfaces and zones to a virtual domain Configuring routing for a virtual domain Configuring firewall policies for a virtual domain Configuring IPSec...

Страница 143: ...dure describes how to move a VLAN subinterface from one virtual domain to another You cannot remove a VLAN subinterface from a virtual domain if firewall policies have been added for it Delete the fir...

Страница 144: ...on for the current virtual domain To configure the routing table for a virtual domain in Transparent mode 1 Go to System Virtual domain Virtual domains 2 Select Change following the current virtual do...

Страница 145: ...le 3 Choose the virtual domain for which to configure firewall addresses 4 Select OK 5 Go to Firewall Address 6 Add new firewall addresses address ranges and address groups to the current virtual doma...

Страница 146: ...rtual domain The following procedure applies to NAT Route and Transparent mode 1 Go to System Virtual domain Virtual domains 2 Select Change following the current virtual domain name above the table 3...

Страница 147: ...You can decrease the distance value of a static route to indicate that the route is preferable compared to another static route that specifies a different gateway to the same destination network Rout...

Страница 148: ...8 10 1 Device Name of the interface connected to network 192 168 10 0 24 e g external Distance 10 The Gateway setting specifies the IP address of the next hop router interface to the FortiGate externa...

Страница 149: ...ination IP mask 192 168 30 0 24 Gateway 192 168 10 2 Device dmz Distance 10 To route packets from Network_2 to Network_1 Router_2 must be configured to use the FortiGate dmz interface as its default g...

Страница 150: ...ence number for this route IP The destination IP address for this route Mask The netmask for this route Gateway The IP address of the first next hop router to which this route directs traffic Device T...

Страница 151: ...list and attempts to match the packet with a policy The policy route supplies the next hop gateway as well as the FortiWiFi interface to be used by the traffic If no policy route matches the packet th...

Страница 152: ...IP supports both RIP version 1 as defined by RFC 1058 and RIP version 2 as defined by RFC 2453 RIP version 2 enables RIP messages to carry more information and to support simple authentication and sub...

Страница 153: ...servers in the network should have the same RIP timer settings Update The time interval in seconds between RIP updates Garbage The time in seconds that must elapse after the timeout interval for a rou...

Страница 154: ...sed for the redistributed routes 4 Select a Route map name 5 Select Apply Networks list Identify the networks for which to send and receive RIP updates If a network is not specified interfaces in that...

Страница 155: ...2 authentication RIP version send and receive for the specified interface and configure and enable split horizon Authentication is only available for RIP version 2 packets sent and received by an int...

Страница 156: ...the Receive Version here overrides the default RIP version for this interface Split Horizon Configure RIP to use either regular or poisoned reverse split horizon on this interface Select Regular to pr...

Страница 157: ...list If you do not specify an interface the filter will be applied to all interfaces in the current virtual domain You must configure the access list or prefix list that you want the distribute list t...

Страница 158: ...ibute list Direction The direction for the filter Filter The type of filter and the filter name Interface The interface to use this filter on If no interface name is displayed this distribute list is...

Страница 159: ...rtual domain go to System Virtual Domain Virtual Domains and select the virtual domain Create New Add a new offset list Direction The direction for the offset list Access list The access list to use f...

Страница 160: ...x exactly or to match the prefix and any more specific prefix The FortiWiFi unit attempts to match a packet against the rules in an access list starting at the top of the list If it finds a match for...

Страница 161: ...Match a network address enter the IP address and netmask that define the prefix for this access list entry 6 Select Exact match if required 7 Select OK Prefix list A prefix list is an enhanced versio...

Страница 162: ...ure such as RIP or OSPF Figure 73 Prefix list New Prefix list Figure 74 Prefix list name configuration To add a prefix list name 1 Go to Router Router Objects Prefix List 2 Select Create New 3 Enter a...

Страница 163: ...elect OK Route map list Route maps are a specialized form of filter Route maps are similar to access lists but have enhanced matching criteria and in addition to permit or deny actions can be configur...

Страница 164: ...iple match statements are defined in a rule all the match statements must match before the set statements can be used For a route map to take effect it must be called by another FortiWiFi routing feat...

Страница 165: ...to deny routes that match this entry Match The criteria to match Interface Match a route with the selected destination interface Address Match a route if the destination address is included in the sel...

Страница 166: ...tes from one key to the next according to the scheduled send and receive lifetimes The sending and receiving routers should have their system dates and times synchronized but overlapping the key lifet...

Страница 167: ...required hour minute second year month and day to start using this key for received routing updates Key chain entry The key chain name and the ID number for this key chain entry Key The key password...

Страница 168: ...i routing table Routing monitor list Figure 82 Routing monitor To filter the routing monitor display 1 Go to Router Monitor Routing Monitor 2 Select a type of route to display or select all to display...

Страница 169: ...router info ospf database get router info ospf interface get router info protocols Show the current state of active routing protocols Command syntax get router info protocols Note You can configure T...

Страница 170: ...nnected to more than one area is an area border router ABR Routing information is contained in a link state database Routing information is communicated between routers using link state advertisements...

Страница 171: ...ng the overflow state The lsas_integer must be the same on all routers attached to the OSPF area and the OSPF backbone The valid range for lsas_integer is 0 to 4294967294 10000 All models database ove...

Страница 172: ...hat only supports RFC 1583 When RFC 1583 compatibility is enabled routers choose the path with the lowest cost Otherwise routers choose the lowest cost intra area path through a non backbone area disa...

Страница 173: ...backbone area that all areas can connect to You can use a virtual link to connect areas that do not have a physical connection to the backbone Routers within an OSPF area maintain link state databases...

Страница 174: ...n for interfaces the authentication configured for the area is not used Authentication passwords or keys are defined per interface See config ospf interface on page 186 none All models default cost co...

Страница 175: ...A You can set the translator role to always to ensure this FortiWiFi unit always acts as a translator if it is in a NSSA even if other routers in the NSSA are also acting as translators You can set th...

Страница 176: ...x list on page 161 config filter list command syntax pattern config filter list edit id_integer set keyword variable end config filter list edit id_integer unset keyword end config filter list delete...

Страница 177: ...e shows how to display the configuration for area 15 1 1 1 config router ospf config area edit 15 1 1 1 show end config range Access the config range subcommand using the config area command Use the a...

Страница 178: ...5 1 1 1 get end Note Only the prefix keyword is required All other keywords are optional range command keywords and variables Keywords and variables Description Default Availability advertise disable...

Страница 179: ...nection to the backbone A virtual link allows traffic from the area to transit a directly connected area to reach the backbone The transit area cannot be a stub area Virtual links can only be set up b...

Страница 180: ...authentication The authentication key must be the same on both ends of the virtual link The maximum length for the authentication key is 15 characters No default All models authentication must be set...

Страница 181: ...g router ospf command retransmit interval seconds_integer The time in seconds to wait before sending a LSA retransmission The value for the retransmit interval must be greater than the expected round...

Страница 182: ...distribute list edit id_integer unset keyword end config distribute list delete id_integer end config distribute list edit id_integer get end config distribute list edit id_integer show end Example T...

Страница 183: ...r distribute list 2 config router ospf config distribute list edit 2 show end config neighbor Access the config neighbor subcommand using the config router ospf command Use this command to manually co...

Страница 184: ...ther keywords are optional neighbor command keywords and variables Keywords and variables Description Default Availability cost cost_integer Enter the cost to use for this neighbor The valid range for...

Страница 185: ...integer end config network edit id_integer get end config network edit id_integer show end Example Use the following command to enable OSPF for the interfaces attached to networks specified by the IP...

Страница 186: ...nterface command syntax pattern config ospf interface edit interface name_str set keyword variable end config ospf interface edit interface name_str unset keyword end config ospf interface delete inte...

Страница 187: ...uter is mistakenly added to the network If you configure authentication for the interface authentication for areas is not used All routers on the network must use the same authentication type none All...

Страница 188: ...without unsetting all of the keys The key ID and key must be the same on all neighboring routers The valid range for id_integer is 1 to 255 key_str is an alphanumeric string of up to 16 characters No...

Страница 189: ...iority router ID is used Point to point networks do not elect a DR or BDR therefore this setting has no effect on a point to point network The valid range for priority_integer is 0 to 255 1 All models...

Страница 190: ...on key a2b3c4d5e end end This example shows how to display the settings for the OSPF interface configuration named test config router ospf config ospf interface edit test get end This example shows ho...

Страница 191: ...ter ospf config summary address Access the config summary address subcommand using the config router ospf command redistribute command keywords and variables Keywords and variables Description Default...

Страница 192: ...get router ospf show router ospf Example This example shows how to summarize routes using the prefix 10 0 0 0 255 0 0 0 config router ospf config summary address edit 5 set prefix 10 0 0 0 255 0 0 0...

Страница 193: ...te that best matches the destination address of the packet If a match is not found the FortiWiFi unit routes the packet using the default route Command syntax pattern config router static6 edit sequen...

Страница 194: ...60 set gateway 12AB 0 0 CD30 123 4567 89AB CDEF end This example shows how to display the list of IPV6 static route numbers get router static6 This example shows how to display the settings for IPV6 s...

Страница 195: ...Each policy can be individually configured to route connections or apply network address translation NAT to translate source and destination IP addresses and ports You can add IP pools to use dynamic...

Страница 196: ...mpt source and destination addresses service port and time and date at which the connection attempt was received The first policy that matches is applied to the connection attempt If no policy matches...

Страница 197: ...on page 204 Schedule The schedule that controls when the policy should be active See Schedule on page 216 Service The service to which the policy applies See Service on page 208 Action The response to...

Страница 198: ...Before you can add this address to a policy you must add it to the destination interface VLAN subinterface or zone For information about adding an address see Addresses on page x For NAT Route mode po...

Страница 199: ...you select NAT you can also select Dynamic IP Pool and Fixed Port NAT is not available in Transparent mode Dynamic IP Pool Select Dynamic IP Pool to translate the source address to an address randoml...

Страница 200: ...ups for authentication You can select Authentication for any service Users can authenticate with the firewall using HTTP Telnet or FTP For users to be able to authenticate you must add an HTTP Telnet...

Страница 201: ...le routers sort IP traffic into classes by inspecting the DS field in IPv4 header or the Traffic Class field in the IPv6 header You can use the FortiWiFi DiffServ feature to change the DSCP Differenti...

Страница 202: ...e results that you expect For information about arranging policies in a policy list see How policy matching works on page 196 To delete a policy 1 Go to Firewall Policy 2 Select the Delete icon beside...

Страница 203: ...To enable a policy 1 Go to Firewall Policy 2 Select Enable Policy CLI configuration The natip keyword for the firewall policy command is used in encrypted VPN policies A natip address cannot be added...

Страница 204: ...Configuring address groups firewall policy command keywords and variables Keywords and variables Description Default Availability natip address_ipv4mask Configure natip for a firewall policy with act...

Страница 205: ...net IP address 192 168 20 0 and Netmask 255 255 255 0 A single IP address for example IP Address 192 168 20 1 and Netmask 255 255 255 255 All possible IP addresses represented by IP Address 0 0 0 0 an...

Страница 206: ...ss 1 Go to Firewall Address 2 Select Create New 3 Enter a name to identify the address 4 Enter the IP address and netmask or the IP address range 5 Select OK To edit an address Edit an address to chan...

Страница 207: ...Figure 91 Address group options Address group has the following options Note If an address group is included in a policy it cannot be deleted unless it is first removed from the policy Create New Sele...

Страница 208: ...all Address Group 2 Select the Delete icon beside the address group you want to delete 3 Select OK To edit an address group 1 Go to Firewall Address Group 2 Select the Edit icon beside the address gro...

Страница 209: ...lows an arbitrary network protocol to be transmitted over any other arbitrary network protocol by encapsulating the packets of the protocol within GRE packets 47 AH Authentication Header AH provides s...

Страница 210: ...tocol used for retrieving email messages tcp 143 Internet Locator Service Internet Locator Service includes LDAP User Locator Service and LDAP over TLS SSL tcp 389 IRC Internet Relay Chat allows peopl...

Страница 211: ...Routing Information Protocol is a common distance vector routing protocol udp 520 SIP MSNmessenger Session Initiation Protocol is used by Microsoft Messenger to initiate an interactive possibly multi...

Страница 212: ...WAIS Wide Area Information Server is an Internet search protocol tcp 210 WINFRAME For WinFrame communications between computers running Windows NT tcp 1494 X WINDOWS For remote communications between...

Страница 213: ...and high port numbers If the service uses one port number enter this number in both the low and high fields Destination Port Specify the Destination Port number range for the service by entering the l...

Страница 214: ...service 6 Select OK You can now add this custom service to a policy To add a custom IP service 1 Go to Firewall Service Custom 2 Select Create New 3 Enter a name for the new custom IP service 4 Selec...

Страница 215: ...s the following icons and features Service group options Service group options are configurable when creating or editing a service group Figure 98 Service group options Service group has the following...

Страница 216: ...ewall Service Group 2 Select the Edit icon beside the service group you want to modify 3 Make any required changes 4 Select OK Schedule Use schedules to control when policies are active or inactive Yo...

Страница 217: ...e schedule list has the following icons and features One time schedule options Figure 100 One time schedule options One time schedule has the following options Configuring one time schedules To add a...

Страница 218: ...of the day or on specified days of the week For example you might want to prevent game play during working hours by creating a recurring schedule Figure 101 Sample recurring schedule list The recurri...

Страница 219: ...edules use a 24 hour clock 6 Select OK To delete a recurring schedule 1 Go to Firewall Schedule Recurring 2 Select the Delete icon beside the recurring schedule you want to delete 3 Select OK To edit...

Страница 220: ...e types of virtual IPs This section describes Virtual IP list Virtual IP options Configuring virtual IPs Note To change the one time schedule name you must delete the schedule and add it with a new na...

Страница 221: ...ic NAT or port forwarding Figure 104 Virtual IP options static NAT Figure 105 Virtual IP options port forwarding Create New Select Create New to add a virtual IP Name The name of the virtual IP IP The...

Страница 222: ...ted in step 4 However the external IP address must be routed to the selected interface The virtual IP address and the external IP address can be on different subnets 7 Enter the Map to IP address to w...

Страница 223: ...ust be routed to the external interface selected in step 4 The virtual IP address and the external IP address can be on different subnets 7 Enter the External Service Port number for which you want to...

Страница 224: ...server the external service port number should be 1723 the PPTP port See PPTP passthrough on page 268 for more information 8 Enter the Map to IP address to which to map the external IP address For ex...

Страница 225: ...he IP pool to use when configuring a firewall policy You can enter an IP address range using the following formats x x x x x x x x for example 192 168 110 100 192 168 110 120 x x x x x for example 192...

Страница 226: ...he IP pool as required 4 Select OK to save the changes IP Pools for firewall policies that use fixed ports Some network configurations do not operate correctly if a NAT policy translates the source po...

Страница 227: ...tion As a result connections to the Internet appear to be originating from any of the IP addresses in the IP pool Protection profile Use protection profiles to apply different protection settings for...

Страница 228: ...policy or included in a user group Strict To apply maximum protection to HTTP FTP IMAP POP3 and SMTP traffic You may not wish to use the strict protection profile under normal circumstances but it is...

Страница 229: ...or disable virus scanning for viruses and worms for each protocol HTTP FTP IMAP POP3 SMTP Grayware if enabled in Antivirus Config Config is included with the Virus Scan Heuristic if enabled in the CL...

Страница 230: ...and patterns in the content block list Web URL Block Enable or disable web page filtering for HTTP traffic based on the URL block list Web Exempt List Enable or disable web page filtering for HTTP tr...

Страница 231: ...to circumvent web category blocking Allow websites when a rating error occurs HTTP only Allow web pages that return a rating error from the web filtering service Category The FortiGuard web filtering...

Страница 232: ...you to append a custom tag to the subject or header of email identified as spam For SMTP you can choose between tagged or discard Discard immediately drops the connection You can tag email by appendin...

Страница 233: ...profile to a policy You can enable protection profiles for firewall policies with action set to allow or encrypt and with service set to ANY HTTP FTP IMAP POP3 SMTP or a service group that includes t...

Страница 234: ...ion profiles Use protection profiles to apply different protection settings for traffic controlled by firewall policies Command syntax pattern config firewall profile edit profilename_str set keyword...

Страница 235: ...etes When downloading files from an FTP server the FortiWiFi unit sends 1 byte every 30 seconds to prevent the client from timing out during scanning and download If a virus is detected the FortiWiFi...

Страница 236: ...he FortiWiFi unit to simultaneously scan an email and send it to the SMTP server If the FortiWiFi unit detects a virus it terminates the server connection and returns an error message to the sender li...

Страница 237: ...profile command get firewall profile This example shows how to display the settings for the spammail profile get firewall profile spammail This example shows how to display the configuration for the f...

Страница 238: ...238 01 28006 0014 20041105 Fortinet Inc Protection profile Firewall...

Страница 239: ...the user s credentials locally or using an external LDAP or RADIUS server Authentication expires if the user leaves the connection idle for longer than the authentication timeout period You need to d...

Страница 240: ...minutes Local Go to User Local to add local user names and configure authentication Local user list Figure 116 Local user list Local user options Figure 117 Local user options Create New Add a new loc...

Страница 241: ...authentication The default port for RADIUS traffic is 1812 If your RADIUS server is using port 1645 you can use the CLI to change the default RADIUS port For more information see the config system glo...

Страница 242: ...me that you want to delete 3 Select OK LDAP If you have configured LDAP support and a user is required to authenticate using an LDAP server the FortiWiFi unit contacts the LDAP server for authenticati...

Страница 243: ...ure 120 LDAP server list LDAP server options Figure 121 LDAP server configuration Create New Add a new LDAP server Server Name IP The domain name or IP address of the LDAP server Port The port used to...

Страница 244: ...ct Delete beside the LDAP server name that you want to delete 3 Select OK Common Name Identifier Enter the common name identifier for the LDAP server The common name identifier for most LDAP servers i...

Страница 245: ...uth The FortiWiFi PPTP configuration Only users in the selected user group can use PPTP The FortiWiFi L2TP configuration Only users in the selected user group can use L2TP When you add user names RADI...

Страница 246: ...group select an LDAP server from the Available Users list and select the right arrow to add the LDAP server to the Members list 7 To remove users RADIUS servers or LDAP servers from the user group sel...

Страница 247: ...syntax pattern config user peer edit name_str set keyword variable config user peer edit name_str unset keyword config user peer delete name_str get user peer name_str show user peer name_str Example...

Страница 248: ...str set keyword variable config user peergrp edit name_str unset keyword config user peergrp delete name_str get user peergrp name_str show user peergrp name_str Example This example shows how to add...

Страница 249: ...is example shows how to display the settings for the peergrp EU_branches get user peergrp EU_branches This example shows how to display the configuration for all the peers groups show user peergrp Thi...

Страница 250: ...250 01 28006 0014 20041105 Fortinet Inc CLI configuration Users and authentication...

Страница 251: ...l L2TP This chapter contains information about the following VPN topics Phase 1 Phase 2 Manual key Concentrator Ping Generator Monitor PPTP L2TP Certificates CLI configuration Authenticating peers wit...

Страница 252: ...re Phase 1 list Figure 124 IPSec VPN Phase 1 list Create New Select Create New to add a Phase 1 configuration also called a remote gateway Gateway Name The names of the Phase 1 configurations remote g...

Страница 253: ...fields may become available or be removed IP Address If you select Static IP Address for Remote Gateway enter the IP address of the gateway or client Dynamic DNS If you select Dynamic DNS for Remote...

Страница 254: ...icate name of the remote client or peer for the remote client or peer to start a VPN session with the FortiWiFi unit Select Accept any peer ID to accept the local ID or peer ID of any remote client or...

Страница 255: ...hentication enter the distinguished name DN of the local certificate XAuth You can configure the FortiWiFi unit as an Extended Authentication XAuth client or an XAuth server For more information see C...

Страница 256: ...AP between the XAuth client and the FortiWiFi unit and CHAP between the FortiWiFi unit and the authentication server Use CHAP whenever possible Use PAP if the authentication server does not support CH...

Страница 257: ...identification process For information about how to create a Phase 1 Dialup User configuration see Dialup VPN on page 285 If the tunnel is to connect a static remote gateway select the name of an exis...

Страница 258: ...d session NULL Do not use a message digest MD5 Message Digest 5 the hash algorithm developed by RSA Data Security SHA1 Secure Hash Algorithm 1 which produces a 160 bit message digest To specify one co...

Страница 259: ...keep alive to keep the VPN connection open even if no data is being transferred DHCP IPSec If the tunnel will service remote dialup clients that broadcast a DHCP request when connecting to the tunnel...

Страница 260: ...name for the VPN tunnel Local SPI The local Security Parameter Index SPI identifies the local manual key VPN peer Enter a hexadecimal number digits can be 0 to 9 a to f in the range bb8 to FFFFFFF Thi...

Страница 261: ...to two segments of 16 characters For AES192 enter a 48 character 24 byte hexadecimal number 0 9 A F Separate the number into three segments of 16 characters For AES256 enter a 64 character 32 byte hex...

Страница 262: ...through two tunnels simultaneously The ping interval is fixed at 40 seconds The source and destination IP addresses refer to the source and destination addresses of IP packets that are to be transport...

Страница 263: ...Sec VPN monitor to view connections to IPSec VPN tunnels The display provides information about tunnel connections including addressing proxy IDs and status information Enable Disable or enable pingin...

Страница 264: ...the tunnel connected and idle The dialup client must disconnect before another tunnel can be initiated Flush dialup tunnels icon Stop all dialup tunnels and stop the traffic passing through all dialup...

Страница 265: ...enable authentication you must add a user group to the FortiWiFi unit Within the user group add a user name for each PPTP client You can add users to the FortiWiFi user database to authentication ser...

Страница 266: ...example if you want PPTP clients to be able to access a web server set the service to HTTP See To add a firewall policy on page 202 6 Configure the Windows clients See Configuring a Windows 2000 clie...

Страница 267: ...ocedure 2 Enter your PPTP VPN User Name and Password 3 Select Connect 4 In the connect window enter the User Name and Password that you use to connect to your dialup network connection This user name...

Страница 268: ...he same as your VPN user name and password PPTP passthrough The FortiWiFi unit supports PPTP passthrough by configuring a port forwarding virtual IP to use port 1723 Normally PPTP passthrough requires...

Страница 269: ...nternal 4 For Address name Set Source to All Set Destination to PPTP_pass 5 Set Schedule as required 6 Set Service to ANY 7 Set action to ACCEPT 8 Select NAT 9 Select OK L2TP You can set up VPN connec...

Страница 270: ...L2TP range See To add an address on page 206 4 Add a destination address The destination address is the address to which the L2TP clients can connect For example if the destination address is on the...

Страница 271: ...ination Address enter the address of the FortiWiFi unit to connect to and select Next 5 Set Connection Availability to Only for myself and select Next 6 Select Finish 7 In the Connect window select Pr...

Страница 272: ...ndows 2000 based computer does not create the automatic filter that uses CA authentication Instead it checks for a local or active directory IPSec policy To connect to the L2TP VPN 1 Start the dialup...

Страница 273: ...1 Make sure that the following options are not selected File and Printer Sharing for Microsoft Networks Client for Microsoft Networks To disable IPSec 1 Select the Networking tab 2 Select Internet Pro...

Страница 274: ...a public key and some identifying information that has been digitally signed by a trusted third party known as a certificate authority CA Because CAs can be trusted the certificates issued by a CA ar...

Страница 275: ...509 standard To generate a certificate request 1 Go to VPN Certificates Local Certificates 2 Select Generate 3 Enter a Certificate Name Typically this is the name of the FortiWiFi unit being certifie...

Страница 276: ...upport all three key sizes 7 Select OK The request is generated and displayed in the Local Certificates list with a status of Pending 8 Select the Download button to download the request to a PC on th...

Страница 277: ...Certificates Certificate Name Type a certificate name Subject Information Enter an ID type and the related information for the FortiWiFi unit being certified You can use one of the following three ID...

Страница 278: ...y CA_Cert_1 CA_Cert_2 CA_Cert_3 and so on Enabling VPN access for specific certificate holders When a VPN peer is configured to authenticate using digital certificates it sends the Distinguished Name...

Страница 279: ...o the group The group must be added to the FortiWiFi configuration through the config user peergrp CLI command before it can be selected here For more information see the config user chapter of the CL...

Страница 280: ...is period of time expires whenever the local peer sends traffic to the remote VPN peer it will also send a DPD probe to determine the status of the link The dpd idleworry range is 1 to 300 To control...

Страница 281: ...le_GW set Type dynamic set proposal des md5 set authmethod psk set psksecret Qf2p3O93jIj2bz7E set mode aggressive set dpd enable set dpd idlecleanup 1000 set dpd idleworry 150 set dpd retrycount 5 set...

Страница 282: ...ffic to the intended destinations automatically Each IPSec VIP entry is identified by an integer An entry identifies the name of the FortiWiFi interface to the destination network and the IP address o...

Страница 283: ...set out interface external next edit 2 set ip 192 168 12 2 set out interface external end This example shows how to display the settings for the vpn ipsec vip command get vpn ipsec vip This example s...

Страница 284: ...is often referred to as adding a tunnel See Phase 2 on page 256 4 Add the firewall configuration required for the VPN See Adding firewall policies for IPSec VPN tunnels on page 286 Gateway to gateway...

Страница 285: ...Dynamic DNS VPN allows remote users or gateways with dynamic IP addresses to use VPN to connect to a private network In this case the gateway or client at the remote end of the VPN tunnel has a dynami...

Страница 286: ...bout firewall policies You can also use firewall policies for IPSec VPN to apply protection profiles to VPN traffic to log IPSec VPN traffic and to apply advanced features to IPSec VPN traffic such as...

Страница 287: ...icy direction See Setting the encryption policy direction on page 286 3 Add the source and destination addresses See To add an address on page 206 4 Set Action to ENCRYPT 5 From the VPN tunnel list se...

Страница 288: ...al source interface Then create Internet access policies for VPN users For example if the virtual source interface is VLAN_21 and the wan 1 interface is connected to the Internet you would require cre...

Страница 289: ...guration to define the parameters used to authenticate the remote VPN peer 2 Set other phase 1 options as required See Phase 1 on page 252 3 Add the phase 2 configuration to define the parameters used...

Страница 290: ...s the address of the spoke either a client on the Internet or a network located behind a gateway See To add an address on page 206 3 Add the concentrator configuration This step groups the tunnels tog...

Страница 291: ...e VPN concentrator configuration To add a VPN concentrator configuration 1 Go to VPN IPSEC Concentrator 2 Select New to add a VPN concentrator 3 Enter the name of the new concentrator in the Concentra...

Страница 292: ...the address of the spoke either a client on the Internet or a network located behind a gateway See To add an address on page 206 4 Add a separate outbound encrypt policy for each remote VPN spoke Thes...

Страница 293: ...en two VPN peers one peer can have multiple Internet connections while the other has only one Internet connection In the case of an asymmetrical configuration the level of redundancy varies from one e...

Страница 294: ...three VPN connections If the Internet connections are in the same zone add one VPN tunnel and add the remote gateways to it You can add up to three remote gateways If the Internet connections are in s...

Страница 295: ...the two sites have been coordinated to protect against ambiguous routing no two IP addresses are the same Setting up a configuration like this involves performing the following tasks at FortiGate_1 an...

Страница 296: ...remote peer software configuration Check the FortiWiFi firewall configuration Configuration Error Correction Wrong remote network information Check the IP addresses of the remote gateway and network W...

Страница 297: ...file select edit or Create New and select IPS See Protection profile options on page 228 Protection profile configuration For information about adding protection profiles to firewall policies see To a...

Страница 298: ...tion to an extensive list of predefined attack signatures you can also create your own custom attack signatures for the FortiWiFi unit See Adding custom signatures on page 303 Predefined Predefined si...

Страница 299: ...s Action can be Pass Drop Reset Reset Client Reset Server Drop Session Clear Session or Pass Session See Table 26 Revision The revision number for individual signatures To show the signature group mem...

Страница 300: ...Used for TCP connections only If you set this action for non TCP connection based attacks the action will behave as Clear Session If the Reset Client action is triggered before the TCP connection is f...

Страница 301: ...a signature 1 Go to IPS Signature Predefined 2 Select the blue triangle next to a signature group name to display the members of that group 3 Select the Reset icon for the signature you want to resto...

Страница 302: ...out If a session is idle for longer than this number of seconds the session will not be maintained by tcp_reassembler min_ttl A packet with a higher ttl number in its IP header than the number specifi...

Страница 303: ...custom signatures from the custom signature group Reset to recommended settings Reset all the custom signatures to the recommended settings Name The custom signature names Revision The revision number...

Страница 304: ...essions targeting a single destination in one second is over a threshold the destination is experiencing flooding Scan If the number of sessions from a single source in one second is over a threshold...

Страница 305: ...t Reset Server Drop Session Clear Session or Pass Session Modify The Edit and Reset icons If you have changed the settings for an anomaly you can use the Reset icon to change the settings back to the...

Страница 306: ...is fully established it acts as Clear Session Reset Client The FortiWiFi unit drops the packet that triggered the anomaly sends a reset to the client and removes the session from the FortiWiFi session...

Страница 307: ...dit name_str unset keyword end config limit delete name_str Example Use the following command to configure the limit for the tcp_src_session anomaly config ips anomaly tcp_src_session config limit edi...

Страница 308: ...g signatures for attacks that your system is not vulnerable to for example web attacks when you are not running a web server For more information on FortiWiFi logging and alert email see Log Report on...

Страница 309: ...ocol HTTP FTP IMAP POP3 SMTP View a read only list of current viruses File Block Antivirus File Block Enable or disable file blocking for each protocol Configure file patterns to block enable or disab...

Страница 310: ...rtiProtect Center at http www fortinet com FortiProtectCenter To set up automatic and push updates see Update center on page 124 This chapter describes File block Quarantine Config CLI configuration F...

Страница 311: ...nformation files pif Figure 155 Default file block list File block list has the following icons and features Create New Select Create New to add a new file pattern to the file block list Apply Select...

Страница 312: ...ed files list Quarantined files list options AutoSubmit list AutoSubmit list options Configuring the AutoSubmit list Config Quarantined files list The quarantined files list displays information about...

Страница 313: ...versize exe Date The date and time that the file was quarantined in the format dd mm yyyy hh mm This value indicates the time that the first file was quarantined if the duplicate count increases Servi...

Страница 314: ...ions AutoSubmit list has the following icons and features Configuring the AutoSubmit list To add a file pattern to the AutoSubmit list 1 Go to Anti Virus Quarantine AutoSubmit 2 Select Create New Figu...

Страница 315: ...e time limit in hours for which to keep files in quarantine The age limit is used to formulate the value in the TTL column of the quarantined files list When the limit is reached the TTL column displa...

Страница 316: ...he FortiWiFi unit to receive automatic updates daily or whenever required To manually upload a virus list update see Changing unit information on page 29 To find out how to use the Fortinet Update Cen...

Страница 317: ...t all new categories are disabled Grayware is enabled in a protection profile when Virus Scan is enabled Grayware options Grayware categories are populated with known executable files Each time the Fo...

Страница 318: ...or bookmarks start pages and menu options Plugin Select enable to block browser plugins Browser plugins can often be harmless Internet browsing tools that are installed and operate directly from the b...

Страница 319: ...for the antivirus heuristic command show antivirus heuristic quarantine The quarantine command also allows configuration of heuristic related settings Table 28 antivirus heuristic command keywords an...

Страница 320: ...s Description Default Availability drop_heuristic ftp http imap pop3 smtp Do not quarantine files found by heuristic scanning in traffic for the specified protocols imap smtp pop3 http ftp FortiGate m...

Страница 321: ...tiWiFi unit handles antivirus scanning of large files how the FortiWiFi unit handles the buffering and uploading of files to an FTP server and what ports the FortiWiFi unit virus scans for FTP traffic...

Страница 322: ...igure how the FortiWiFi unit handles antivirus scanning of large files and what ports the FortiWiFi unit virus scans for POP3 traffic Command syntax pattern config antivirus service pop3 set keyword v...

Страница 323: ...command to configure how the FortiWiFi unit handles antivirus scanning of large files and what ports the FortiWiFi unit virus scans for IMAP traffic Command syntax pattern config antivirus service im...

Страница 324: ...this command to configure how the FortiWiFi unit handles antivirus scanning of large files in SMTP traffic and what ports the FortiWiFi unit scans for SMTP Command syntax pattern config antivirus serv...

Страница 325: ...r SMTP traffic Adding more ports for scanning does not erase the default port 25 Use the unset command to remove all ports from the list config antivirus service smtp set port 465 end This example sho...

Страница 326: ...326 01 28006 0014 20041105 Fortinet Inc CLI configuration Antivirus...

Страница 327: ...ned words and patterns in the content block list for HTTP traffic Add words and patterns to block web pages containing those words or patterns Web URL Block Web Filter URL Block Enable or disable web...

Страница 328: ...r Content block Control web content by blocking specific words or word patterns The FortiWiFi unit blocks web pages containing banned words and displays a replacement message instead You can use Perl...

Страница 329: ...egular expression i For example bad language i will block all instances of bad language regardless of case Wildcard patterns are not case sensitive Note Enable Web filtering Web Content Block in your...

Страница 330: ...t the pattern type if required 5 Select the language character set 6 Select Enable 7 Select OK URL block You can block access to specific URLs by adding them to the URL block list You can also add pat...

Страница 331: ...must be separated by hard returns to upload correctly Figure 165 Sample Web URL block list Web URL block options Web URL block has the following icons and features Configuring the web URL block list N...

Страница 332: ...all pages with a URL that ends with badsite com add badsite com to the block list For example adding badsite com blocks access to www badsite com mail badsite com www finance badsite com and so on 5...

Страница 333: ...3 Select Create New Figure 168 Adding a new pattern 4 Enter a pattern to add to the web pattern block list 5 Select Enable 6 Select OK URL exempt This section describes URL exempt list URL exempt list...

Страница 334: ...L to the URL exempt list 1 Go to Web Filter URL Exempt 2 Select Create New Figure 170 Adding a new exempt URL 3 Enter the URL to add to the URL exempt list 4 Select Enable 5 Select OK Note Enable Web...

Страница 335: ...dded to or updated as the Internet evolves Users can also choose to allow block or monitor entire groups of categories to make configuration simpler Blocked pages are replaced with a message indicatin...

Страница 336: ...If you have ordered FortiGuard through Fortinet technical support or are using the free 30 day trial you only need to enable the service to start configuring and using FortiGuard Figure 171 Category b...

Страница 337: ...230 and FortiGuard categories on page 373 Once you select Apply the FortiGuard license type and expiration date appears on the configuration screen Web Filter Category Block Category block reports You...

Страница 338: ...Guide for descriptions of all webfilter catblock keywords Profile Select the profile for which you want to generate a report Report Type Select the time frame for which you want to generate the repor...

Страница 339: ...uration for the catblock settings show webfilter catblock If the show command returns you to the prompt the settings are at default Script filter You can configure the FortiWiFi unit to filter certain...

Страница 340: ...for script filtering Note Enable Web filtering Web Script Filter in your firewall Protection Profile to activate the script filter settings Javascript Select Javascript to block all Javascript based...

Страница 341: ...able or disable checking incoming IP addresses against the configured spam filter IP address list SMTP only Add to and edit IP addresses to the list You can configure the action to take as spam clear...

Страница 342: ...ers against the configured spam filter MIME header list Add to and edit MIME headers to the list with the option of using wildcards and regular expressions You can configure the action to take as spam...

Страница 343: ...s the IP address list from email captured by spam probes located around the world Spam probes are email addresses purposely configured to attract spam and identify known spam sources to create the ant...

Страница 344: ...You can mark each IP address as clear spam or reject You can filter single IP addresses or a range of addresses at the network level by configuring an address and mask Figure 174 Sample IP address lis...

Страница 345: ...eral free and subscription servers available that provide reliable access to continually updated RBLs and ORDBLs Check with the service you are using to confirm the correct domain name for connecting...

Страница 346: ...to add 4 Select the action to take on email matched by the server 5 Select Enable 6 Select OK Create New Select Create New to add a server to the RBL ORDBL list Total The number of items in the list...

Страница 347: ...m a domain such as sample net You can mark each email address as clear or spam Figure 178 Sample email address list Email address options Email address list has the following icons and features Config...

Страница 348: ...ontent_Type image jpg The first part of the MIME header is called the header key or just header The second part is called the value Spammers will often insert comments into header values or leave them...

Страница 349: ...Filter MIME headers 2 Select Create New Create New Select Create New to add a MIME header to the MIME headers list Total The number of items in the list The Page up Page down and Remove all entries ic...

Страница 350: ...52 This section describes Banned word list Banned word options Configuring the banned word list Banned word list You can add one or more banned words to sort email containing those words in the email...

Страница 351: ...wildcard or regular expression See Using Perl regular expressions on page 352 Language The character set to which the banned word belongs Simplified Chinese Traditional Chinese French Japanese Korean...

Страница 352: ...any single character It is similar to the character in wildcard match pattern As a result fortinet com not only matches fortinet com but also matches fortinetacom fortinetbcom fortinetccom and so on...

Страница 353: ...nd of the string a b either of a and b abc abc the string abc at the beginning or at the end of the string ab 2 4 c an a followed by two three or four b s followed by a c ab 2 c an a followed by at le...

Страница 354: ...d perl B perl when not followed by a word boundary e g in perlert but not in perl stuff x tells the regular expression parser to ignore white space that is neither backslashed nor within a character c...

Страница 355: ...You can configure the FortiWiFi unit to send alert email to up to three recipients when selected events occur It is not necessary for an event to be logged to trigger an alert email The FortiWiFi uni...

Страница 356: ...52 device_id APS3012803033139 log_id 0101023002 type event subtype ipsec pri notice loc_ip 172 16 81 2 loc_port 500 rem_ip 172 16 81 1 rem_port 500 out_if dmz vpn_tunnel ToDmz action negotiate init lo...

Страница 357: ...l the FortiWiFi unit begins to overwrite the oldest messages All log entries are deleted when the FortiWiFi unit restarts Syslog A remote computer running a syslog server WebTrends A remote computer r...

Страница 358: ...e is started Roll log policy The policy to follow for saving the current log and starting a new active log Overwritten deletes the oldest log entry when the disk is full Block traffic stops all networ...

Страница 359: ...e logging severity level you select For example if you select Error the unit logs Error Critical Alert and Emergency level messages See Table 38 Logging severity levels on page 358 Facility Facility i...

Страница 360: ...email Test Select Test to send a test alert email to the configured recipients Level The FortiWiFi unit sends alert email for all messages at and above the logging severity level you select Emergency...

Страница 361: ...t email 7 Select Apply Log filter options For each logging location you enable you can create a customized log filter based on the log types described in the following sections Information The interva...

Страница 362: ...ting gateway has been added You can apply the following filters Policy allowed traffic The FortiWiFi unit logs all traffic that is allowed according to the firewall policy settings Policy violation tr...

Страница 363: ...nit logs all pattern update events such as antivirus and IPS pattern updates and update failures Virus infected The FortiWiFi unit logs all virus infections Filename blocked The FortiWiFi unit logs al...

Страница 364: ...5 Repeat steps 1 through 4 for each interface for which you want to enable logging 6 Make sure you enable traffic logs for a logging location and set the logging severity level to Notification or lowe...

Страница 365: ...following table describes the features and icons you can use to navigate and search the logs when viewing logs through the web based manager Type The location of the log messages memory Go to previous...

Страница 366: ...ess the log contains information not available in any of the other more specific columns Column settings button Select to choose columns for log display Raw or Formatted Select Raw to switch to an unf...

Страница 367: ...Searching log messages There are two ways to search log messages a simple keyword search or an advanced search that enables you to use multiple keywords and specify a time range To perform a simple ke...

Страница 368: ...nfig log fortilog setting unset keyword get log fortilog setting show log fortilog setting all of the following The message must contain all of the keywords any of the following The message must conta...

Страница 369: ...server You can configure the FortiWiFi unit to send logs to a remote computer running a syslog server psksecret str_psk Enter the pre shared key for the IPSec VPN tunnel to a FortiLog unit You can cr...

Страница 370: ...es disable All models facility alert audit auth authpriv clock cron daemon ftp kernel local0 local1 local2 local3 local4 local5 local6 local7 lpr mail news ntp syslog user uucp Enter the facility type...

Страница 371: ...lay the configuration for logging to a remote syslog server show log syslogd setting If the show command returns you to the prompt the settings are at default Table 39 Facility types Facility type Des...

Страница 372: ...372 01 28006 0014 20041105 Fortinet Inc CLI configuration Log Report...

Страница 373: ...ites that provide information about or promote the cultivation preparation or use of marijuana 2 Cult or Occult Sites that provide information about or promote religions not specified in Traditional R...

Страница 374: ...y with no pornographic intent 9 Advocacy Groups Sites that promote change or reform in public policy public opinion social practice economic activities and relationships 10 Alcohol and Tobacco Sites t...

Страница 375: ...cussion groups message boards and list servers includes blogs and mail magazines Digital post cards Sites for sending viewing digital post cards 22 Pay to Surf Sites that pay users to view Web sites a...

Страница 376: ...nformation about or cater to gay lesbian or bisexual lifestyles including those that support online shopping but excluding those that are sexually or issue oriented 33 Health Sites that provide inform...

Страница 377: ...s devoted to professional advancement or workers interests Service and Philanthropic Organizations Sites sponsored by or that support or offer information about organizations devoted to doing good as...

Страница 378: ...ated business firms including sites supporting the sale of hardware software peripherals and services 53 Military Organizations Military Sites sponsored by branches or agencies of the armed services O...

Страница 379: ...2 32 32 32 32 32 system interface ip6 prefix list 32 32 32 32 32 32 32 32 32 32 32 32 32 system ipv6_tunnel 4 4 4 4 4 4 4 4 4 4 4 4 4 system accprofile 8 8 8 16 16 16 16 16 64 64 64 64 64 system admin...

Страница 380: ...500 500 500 500 500 500 firewall service group member 300 300 300 300 300 300 300 300 300 300 300 300 300 firewall schedule onetime 256 500 256 256 256 256 256 256 256 256 256 256 256 firewall schedu...

Страница 381: ...tem memory and performance considerations ips anomaly limit 100 100 100 100 100 100 100 100 100 100 100 100 100 ips custom 32 32 32 32 32 32 32 32 32 32 32 32 32 log trafficfilter rule 50 50 50 50 50...

Страница 382: ...100 100 100 100 router ospf network 100 100 100 100 100 100 100 100 100 100 100 100 100 router ospf neighbor 10 10 10 10 10 10 10 10 10 10 10 10 10 router ospf passive interface 100 100 100 100 100 10...

Страница 383: ...es are formatted and transmitted and what actions Web servers and browsers should take in response to various commands HTTPS The SSL protocol for transmitting private documents over the Internet using...

Страница 384: ...o the specified address and waiting for a reply POP3 Post Office Protocol A protocol used to transfer e mail from a mail server to a mail client across the Internet Most e mail clients use POP PPP Poi...

Страница 385: ...networks TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent UDP User Datagram Protocol A connectionless protocol that like TCP...

Страница 386: ...386 01 28006 0014 20041105 Fortinet Inc Glossary...

Страница 387: ...ive 259 B back up configuration 122 backup mode modem 59 61 bandwidth guaranteed 201 202 maximum 201 202 banned word spam 350 beacon interval wireless setting 74 bindtoif 282 browsing the Internet thr...

Страница 388: ...280 dpd retryinterval 280 dst 193 263 dst2 263 Dynamic DNS 253 on network interface 48 dynamic DNS monitor 263 264 Dynamic DNS VPN 285 dynamic IP pool IP pool 205 240 241 243 245 dynamic port forwardi...

Страница 389: ...orities 96 override master 93 password 93 priorities of heartbeat device 94 schedule 94 status 101 unit priority 93 view the status of each cluster member 101 HA cluster configuring 96 HA monitor acti...

Страница 390: ...reless setting 74 MAC filter configure the wireless MAC filter 77 wireless 77 manage cluster units HA 103 Managing digital certificates 274 Manual Key 259 Manual key IPSec VPN 286 Manual key list 260...

Страница 391: ...abling authentication 245 guaranteed bandwidth 201 202 IPSec VPN 286 matching 196 maximum bandwidth 201 202 policy routing 151 poll interval 184 POP3 211 384 port 370 port forward dynamic 220 port for...

Страница 392: ...custom UDP 212 213 group 215 predefined 209 service name 209 user defined TCP 212 213 user defined UDP 212 213 set time 88 shortcut 175 Signature list 299 Signatures 298 SMTP 211 definition 384 smtp...

Страница 393: ...roperties 138 virtual IP 220 dynamic port forwarding 224 port forwarding 220 static NAT 220 virus detected HA monitor 102 virus protection worm protection 14 VLAN overview 63 VLAN subinterface bringin...

Страница 394: ...the wireless MAC filter 77 configure wireless settings 76 fragmentation threshold 74 geography 74 key 74 MAC address 74 MAC filter 77 operation mode 74 pre shared key 74 radius server name 74 RTS thre...

Отзывы:

Нет отзывов

Похожие инструкции для Fortiwifi fortiwifi-60

Бренд: Fortinet Страницы: 12

FortiGate 1000D

Бренд: Fortinet Страницы: 14

Бренд: Fortinet Страницы: 20

Бренд: Fortinet Страницы: 54

Бренд: Fortinet Страницы: 56

Бренд: Watchguard Страницы: 2

Бренд: IS5 COMMUNICATIONS Страницы: 47

Бренд: Freecom Страницы: 58

Бренды по названию

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Популярные бренды

Загрузить еще бренды