Fortinet Gate 60D, Руководство администратора

Страница: 345 / 706

Firewall Address About firewall addresses
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424
345
http://docs.fortinet.com/ • Feedback
Firewall Address
Firewall addresses and address groups define network addresses that you can use when
configuring firewall policies’ source and destination address fields. The FortiGate unit
compares the IP addresses contained in packet headers with firewall policy source and
destination addresses to determine if the firewall policy matches the traffic.
You can organize related addresses into address groups to simplify your firewall policy list.
If you enable virtual domains (VDOMs) on the FortiGate unit, firewall addresses are
configured separately for each virtual domain, and you must first enter the virtual domain
to configure its firewall addresses. For details, see
“Using virtual domains” on page 103 .
This section describes:
• About firewall addresses
• Viewing the firewall address list
• Configuring addresses
• Viewing the address group list
• Configuring address groups
About firewall addresses
A firewall address can contain one or more network addresses. Network addresses can
be represented by an IP address with a netmask, an IP address range, or a fully qualified
domain name (FQDN).
When representing hosts by an IP address with a netmask, the IP address can represent
one or more hosts. For example, a firewall address can be:
• a single computer, such as
192.45.46.45
• a subnetwork, such as
192.168.1.0
for a class C subnet
•
0.0.0.0
, which matches any IP address
The netmask corresponds to the subnet class of the address being added, and can be
represented in either dotted decimal or CIDR format. The FortiGate unit automatically
converts CIDR formatted netmasks to dotted decimal format. Example formats:
• netmask for a single computer:
255.255.255.255
, or
/32
• netmask for a class A subnet:
255.0.0.0
, or
/8
• netmask for a class B subnet:
255.255.0.0
, or
/16
• netmask for a class C subnet:
255.255.255.0
, or
/24
• netmask including all IP addresses:
0.0.0.0
Valid IP address and netmask formats include:
• x.x.x.x/x.x.x.x, such as
192.168.1.0/255.255.255.0
• x.x.x.x/x, such as
192.168.1.0/24
Note: An IP address
0.0.0.0
with netmask
255.255.255.255
is not a valid firewall
address.