Home

Fortinet FortiGate-800 User's Manual

1. Management access Internal External DMZ Interface 1 Interface 2 Interface 3 Interface 4 Factory default firewall configuration HTTPS Ping Ping HTTPS Ping Ping Ping Ping Ping The factory default firewall configuration is the same in NAT Route and Transparent mode Table 4 Factory default firewall configuration 32 Internal ia All IP 0 0 0 0 Represents all of the IP addresses on the internal Address Mask 0 0 0 0 WO External IP 0 0 0 0 Represents all of the IP addresses on the external Address PtemaLAl Mask 0 0 0 0 network DMZ IP 0 0 0 0 Represents all of the IP addresses on the DMZ DMZ_AIl network Address Mask 0 0 0 0 Recurring Always The schedule is valid at all times This means that Schedule the firewall policy is valid at all times Firewall Internal gt External Firewall policy for connections from the internal Policy network to the external network Source Internal_All The policy source address Internal_All means that the policy accepts connections from any internal IP address Destination External_All The policy destination address External_All means that the policy accepts connections with a destination address to any IP address on the external network Schedule Always The policy schedule Always means that the policy is valid at any time Service ANY The policy service ANY means that thi
2. Netmask Default Gateway Primary DNS Server Secondary DNS Server Internal servers Web Server SMTP Server POP3 Server IMAP Server FTP Server If you provide access from the Internet to a web server mail server IMAP server or FTP server installed on an internal network add the IP addresses of the servers here Advanced NAT Route mode settings Use Table 11 to gather the information that you need to customize advanced FortiGate NAT Route mode settings Table 11 Advanced FortiGate NAT Route mode settings If your Internet Service Provider ISP supplies you with DHCP an IP address using DHCP no further information is required External User name interface PPPoE Password If your ISP supplies you with an IP address using PPPoE record your PPPoE user name and password Starting IP Ending IP Netmask DHCP server Default Route DNS IP The FortiGate unit includes a DHCP server that you can configure to automatically set the addresses of the computers on your internal network Fortinet Inc NAT Route mode installation Using the setup wizard DMZ and user defined interfaces Use Table 12 to record the IP addresses and netmasks of the FortiGate DMZ and user defined interfaces if you are configuring them during installation The HA interface is configured during HA installation T
3. Select Apply to save the changes Fortinet Inc RIP configuration Configuring RIP for FortiGate interfaces Figure 34 Configuring RIP settings Settings A Interface Filter yX M Enable RIP l Enable Advertise Default Default Metric 1 Input Queue 50 Ouput Delay 0 RIP Timer Update 30 secs Invalid 180 secs Holddown 180 secs Flush 240 secs Configuring RIP for FortiGate interfaces You can customize a RIP configuration for each FortiGate interface This allows you to customize RIP for the network to which each interface is connected To configure RIP for FortiGate interfaces 1 Go to System gt RIP gt Interface On this page you can view a summary of the RIP settings for each FortiGate interface Select Modify ESI for the interface for which to configure RIP settings Configure any of the following RIP settings RIP1 Send Enables sending RIP version 1 broadcasts from this interface to the network itis connected to The routing broadcasts are UDP packets with a destination port of 520 RIP1 Receive Enables listening on port 520 of an interface for RIP version 1 broadcasts RIP2 Send Enables sending RIP version 2 broadcasts from this interface to the network it is connected to The routing broadcasts are UDP packets with a destination port of 520 RIP2 Receive Enables listening on port 520 of an interface for RIP version 2 broadcasts Split Horizon Prevents RIP from sending updates for a
4. You can add security policies to control whether communications through the FortiGate unit operate in NAT or Route mode Security policies control the flow of traffic based on the source address destination address and service of each packet In NAT mode the FortiGate unit performs network address translation before it sends the packet to the destination network In Route mode there is no translation By default the FortiGate unit has a NAT mode security policy that allows users on the internal network to securely download content from the external network No other traffic is possible until you have configured further security policies You typically use NAT Route mode when the FortiGate unit is operating as a gateway between private and public networks In this configuration you would create NAT mode policies to control traffic flowing between the internal private network and the external public network usually the Internet If you have multiple internal networks such as a DMZ network in addition to the internal private network you could create route mode policies for traffic flowing between them Figure 4 Example NAT Route mode network configuration Internal network SEE 192 168 1 3 FortiGate 800 Unit Internal in NAT Route mode 192 168 1 99 External 204 23 1 5 Route mode policies controlling traffic between internal networks Internet a DMZ DMZ network N
5. 5 0 900 seconds Dead Peer Detection Short Idle Retry Count Retry Interval Long Idle M Enable fio 1 300 seconds B 0 10 times 5 1 60 seconds soo 101 2880 seconds OK Cancel FortiGate 800 Installation and Configuration Guide AutolIKE IPSec VPNs 239 AutolKE IPSec VPNs 240 IPSec VPN Adding a phase 2 configuration for an AutolIKE VPN Add a phase 2 configuration to specify the parameters used to create and maintain a VPN tunnel between the local VPN peer the FortiGate unit and the remote VPN peer the VPN gateway or client Note Adding a Phase 2 configuration is the same for pre shared key and certification VPNs To add a phase 2 configuration Go to VPN gt IPSEC gt Phase 2 Select New to add a new phase 2 configuration Enter a Tunnel Name The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select a Remote Gateway to associate with the VPN tunnel A remote gateway can be either a gateway to another network or an individual client on the Internet Remote gateways are added as part of the phase 1 configuration For details see Adding a phase 1 configuration for an AutoIKE VPN on page 235 Choose either a single DIALUP remote gateway or up to three STATIC remote gateways Multiple STATIC remote gateways are necessary if you are configuri
6. Filtering log messages on page 313 Select Apply levels Table 43 lists and describes FortiGate log message levels Table 43 FortiGate log message levels Levels Description Generated by 0 Emergency The system has become unstable Emergency messages not available 1 Alert Immediate action is required NIDS attack log messages 2 Critical Functionality is affected DHCP 3 Error An error condition exists and Error messages not available functionality could be affected 4 Warning Functionality could be affected Antivirus Web filter email filter and system event log messages 5 Notice Information about normal events Antivirus Web filter and email filter log messages 6 Information General information about system operations Antivirus Web filter email filter log messages and other event log messages Fortinet Inc Logging and reporting Filtering log messages Filtering log messages You can configure the logs that you want to record and the message categories that you want to record in each log To filter log entries 1 Go to Log amp Report gt Log Setting 2 Select Config Policy for the log location that you selected in Recording logs on page 309 3 Select the log types that you want the FortiGate unit to record Traffic Log Event Log Virus Log Web Filtering Log Attack Log Email Filter Log Update Record all co
7. FortiGate email filtering can scan all IMAP and POP3 email content for unwanted senders or unwanted content If there is a match between a sender address pattern on the email block list or an email contains a word or phrase in the banned word list the FortiGate adds an email tag to the subject line of the email The recipient can use the mail client software to filter messages based on the email tag You can configure email blocking to tag email from all or some senders within organizations that are known to send spam email To prevent unintentionally tagging email from legitimate senders you can add sender address patterns to an exempt list that overrides the email block and banned words lists Firewall The FortiGate ICSA certified firewall protects your computer networks from Internet threats ICSA has granted FortiGate firewalls version 4 0 firewall certification providing assurance that FortiGate firewalls successfully screen and secure corporate networks against a range of threats from public or other untrusted networks After basic installation of the FortiGate unit the firewall allows users on the protected network to access the Internet while blocking Internet access to internal networks You can configure the firewall to put controls on access to the Internet from the protected networks and to allow controlled access to internal networks FortiGate policies include a range of options that control all incoming and outgoing ne
8. HTTP with secure socket layer SSL service for secure communication with web servers cp 443 IKE IKE is the protocol to obtain authenticated keying material for use with ISAKMP for IPSEC udp 500 IMAP Internet Message Access Protocol is a protocol used for retrieving email messages tcp 143 Internet Locator Service Internet Locator Service includes LDAP User Locator Service and LDAP over TLS SSL tcp 389 IRC Internet Relay Chat allows people connected to the Internet to join live discussions tcp 6660 6669 L2TP L2TP is a PPP based tunnel protocol for remote access tcp 1701 FortiGate 800 Installation and Configuration Guide 201 Services 202 Table 38 FortiGate predefined services Continued Firewall configuration Service name Description Protocol Port LDAP Lightweight Directory Access Protocol is a set tcp 389 of protocols used to access information directories NetMeeting NetMeeting allows users to teleconference tcp 1720 using the Internet as the transmission medium NFS Network File System allows network users to tcp 111 2049 access shared files stored on computers of different types NNTP Network News Transport Protocol is a tcp 119 protocol used to post distribute and retrieve USENET messages NTP Network time protocol for synchr
9. J Note Do not use regular expressions in the Web URL block list You can use regular S expressions in the Web Pattern Block list to create URL patterns to block See Configuring s FortiGate Web pattern blocking on page 296 Note You can type a top level domain suffix for example com without the leading period to S block access to all URLs with this suffix z A Note URL blocking does not block access to other services that users can access with a web browser For example URL blocking does not block access to ftp ftp badsite com Instead you can use firewall policies to deny FTP connections Ensure that the Enable checkbox has been selected and then select OK Select OK to add the URL to the Web URL block list You can enter multiple URLs and then select Check All to enable all items in the Web URL block list You can disable all of the URLs on the list by selecting Uncheck All Each page of the Web URL block list displays 100 URLs 6 Use Page Up 5 and Page Down to navigate through the Web URL block list Note You must select the Web URL Block option in the content profile to enable the URL ECs blocking Figure 72 Example URL block list URL Block X M Enable URL Block u O A DEt E FORE oF patern a E M www badsite com i amp E 123 78 41 22 news html tT amp E www timewaste com products html tr amp E Clearing the Web URL block list 1 Go to Web Filter gt Web URL Block
10. L2TP 229 323 configuring Windows XP client 267 L2TP gateway configuring 263 language web based manager 171 LCD and keypad configuring IP address 44 LDAP example configuration 228 LDAP server adding server address 227 deleting 228 lease duration DHCP 159 log file downloading 320 log hard disk status 108 log message levels 312 log options block traffic 311 do not log 311 overwrite 311 log setting filtering log entries 120 313 traffic filter 316 log to local logging 311 log to memory configuring 312 viewing saved logs 317 FortiGate 800 Installation and Configuration Guide Index Log Traffic firewall policy 194 policy 194 logging 21 309 attack log 313 configuring traffic settings 315 316 connections to an interface 144 deleting all messages 320 deleting log files 320 downloading log files 320 email filter log 313 enabling alert email 322 event log 313 filtering log messages 313 log to local 311 log to memory 312 log to remote host 310 log to WebTrends 310 message levels 312 recording 309 searching logs 318 319 selecting what to log 313 traffic log 313 traffic logging 144 traffic sessions 314 update log 313 viewing logs 319 virus log 313 web filtering log 313 logs maintaining 318 recording on FortiGate hard disk 311 recording on NetIQ WebTrends server 310 searching 318 viewing 318 MAC address 324 IP MAC binding 214 maintaining logs 318 malicious scripts removing from web pages 299 308 manag
11. Table 39 Virtual IP External Interface examples External Interface Description internal To map an internal address to an address on a network connected to another interface VLAN subinterface or zone If you select internal the static NAT virtual IP can be added to policies for connections from the internal interface or any zone containing the internal interface to any other interface VLAN subinterface or zone external To map an external address to an address on a network connected to another interface VLAN subinterface or zone If you select external the static NAT virtual IP can be added to policies for connections from the external interface or any zone containing the external interface to any other interface VLAN subinterface or zone In the Type section select Static NAT Enter the External IP Address that you want to map to an address on the destination network For example if the virtual IP provides access from the Internet to a web server on a destination network the external IP address must be a static IP address obtained from your ISP for your web server This address must be a unique address that is not used by another host and cannot be the same as the IP address of the external interface selected in step 4 However this address must be routed to this interface The virtual IP address and the external IP address can be on different subnets If the IP address of the external interface sele
12. 10 10 10 1 If you connect to the management interface through a router make sure that you have added a default gateway for that router to the management IP default gateway field Fortinet Inc Transparent mode installation Using the front control buttons and LCD Using the front control buttons and LCD This procedure describes how to use the control buttons and LCD to configure Transparent mode IP addresses Use the information that you recorded in Table 16 on page 59 to complete this procedure Starting with Main Menu displayed on the LCD use the front control buttons and LCD 1 Press Enter three times to configure the management interface IP address IP Address 192 168 100 001 Use the up and down arrow keys to increase or decrease the value of each IP address digit Press Enter to move to the next digit Press Esc to move to the previous digit 2 Set the manager interface IP address A Note When you enter an IP address the LCD always shows three digits for each part of the S address For example the IP address 192 168 100 1 appears on the LCD as 192 168 100 001 The IP address 192 168 23 45 appears as 192 168 023 045 After you set the last digit of the IP address press Enter Use the down arrow to highlight Netmask 3 4 5 Press Enter and set the management IP Netmask 6 After you set the last digit of the Netmask press Enter 7 Press Esc to return to the Main Menu 8 Repeat these steps to configure the def
13. 255 255 255 0 Netmask Next Hop 192 168 1 2 A Note When adding routes to the FortiGate unit add the default route last so that it appears on the bottom of the route list This makes sure that the unit attempts to match more specific routes A before selecting the default route Example default route to an external network Figure 11 shows a FortiGate unit where all destinations including the management computer are located on the external network To reach these destinations the FortiGate unit must connect to the upstream router leading to the external network To facilitate this connection you must enter a single default route that points to the upstream router as the next hop default gateway FortiGate 800 Installation and Configuration Guide 65 Transparent mode configuration examples Figure 11 Default route to an external network te D E Upstream Gateway IP 192 168 1 2 w Router Management IP 192 168 1 1 FortiGate 800 Internal Network e e d ES ama General configuration steps e eesgancea DNS D pP L A Distribution Internet SS Transparent mode installation FortiResponse Network FDN Management Computer 1 Set the FortiGate unit to operate in Transparent mode Configure the Management IP address and Netmask of the FortiGate unit Configure the default route to the external network 66 Fortinet Inc Transparen
14. DHCP service event I Attack Log PPP service event I Attack Detection T Admin login logout event I Attack Prevention I IP MAC binding event Email Filter Log I System activity event I Blocklist email detected T HA activity event l Banned word detected I Firewall authentication event I Update I Route gateway event I Failed update Virus Log I Successful update I Virus infected I FDN error I Filename blocked I File oversized Configuring traffic logging 314 You can configure the FortiGate unit to record traffic log messages for connections to An interface A VLAN subinterface e A firewall policy The FortiGate unit can filter traffic logs for a source and destination address and service You can also enable the following global settings resolve IP addresses to host names e display the port number or service The traffic filter list displays the name source address and destination address and the protocol type of the traffic to be filtered This section describes e Enabling traffic logging e Configuring traffic filter settings e Adding traffic filter entries Fortinet Inc Logging and reporting Configuring traffic logging Enabling traffic logging kh OO N You can enable logging on any interface VLAN subinterface and firewall policy Enabling traffic logging for an interface If you enable traffic logging for an interface all connections to and through the interface are recorded
15. Select Apply The FortiGate unit sends the override push IP address and port to the FDN The FDN now uses this IP address and port for push updates to the FortiGate unit on the internal network If the external IP address or external service port change add the changes to the Use override push configuration and select Apply to update the push information on the FDN Figure 26 Example push update configuration Mo Allow Push Update Use override push IP 64 230 123 149 Port 45001 Select Apply You can select Refresh to make sure that push updates work Push Update changes to Available Registering FortiGate units 128 After purchasing and installing a new FortiGate unit you can register the unit using the web based manager by going to System Update Support page or by using a web browser to connect to http support fortinet com and selecting Product Registration Registration consists of entering your contact information and the serial numbers of the FortiGate units that you or your organization purchased You can register multiple FortiGate units in a single session without re entering your contact information Once registration is completed Fortinet sends a Support Login user name and password to your email address You can use this user name and password to log on to the Fortinet support web site to e View your list of registered FortiGate units e Register additional FortiGate units e Add or change FortiCare Support
16. To delete all messages from an active log Go to Log amp Report gt Logging Select Traffic Log Event Log Attack log Antivirus Log Web Filter Log or Email Filter Log Select Empty Log E Select OK to delete the messages Deleting a saved log file To delete a saved log file Go to Log amp Report gt Logging Select Traffic Log Event Log Attack log Antivirus Log Web Filter Log or Email Filter Log The web based manager lists all saved logs of the selected type with the active log at the top of the list For each log the list shows the date and time at which an entry was last added to the log the size of the log file and its name To delete a saved log file select Delete T Select OK to delete the log file Fortinet Inc Logging and reporting Configuring alert email Configuring alert email You can configure the FortiGate unit to send alert email to up to three email addresses when there are virus incidents block incidents network intrusions and other firewall or VPN events or violations After you set up the email addresses you can test the settings by sending test email e Adding alert email addresses e Testing alert email e Enabling alert email Adding alert email addresses 7 Because the FortiGate unit uses the SMTP server name to connect to the mail server the FortiGate unit must look up this name on your DNS server Before you configure alert email make sure that you configure at least one D
17. ao a Fk WN N 9 Configuring L2TP Select OK to add the address group To add a destination address Add an address to which L2TP users can connect Go to Firewall gt Address Select the internal interface or the DMZ interface Select New to add an address Enter the Address Name IP Address and NetMask for a single computer or for an entire subnetwork on an internal interface of the local VPN peer Select OK to save the source address To add a firewall policy Add a policy that specifies the source and destination addresses and sets the service for the policy to the traffic type inside the L2TP VPN tunnel Go to Firewall gt Policy Select the policy list that you want to add the policy to usually External gt lInternal Select New to add a policy Set Source to the group that matches the L2TP address range Set Destination to the address to which L2TP users can connect Set Service to match the traffic type inside the L2TP VPN tunnel For example if L2TP users can access a web server select HTTP Set Action to ACCEPT Select NAT if address translation is required You can also configure traffic shaping logging and antivirus and web filter settings for L2TP policies Select OK to save the firewall policy Configuring a Windows 2000 client for L2TP Use the following procedure to configure a client computer running Windows 2000 so that it can connect to a FortiGate L2TP VPN To configure an L2TP
18. Before you can add this address to a policy you must add it to the source interface For information about adding an address see Addresses on page 197 Fortinet Inc Firewall configuration Adding firewall policies Destination Select an address or address group that matches the destination address of the packet Before you can add this address to a policy you must add it to the destination interface VLAN subinterface or zone For information about adding an address see Addresses on page 197 For NAT Route mode policies where the address on the destination network is hidden from the source network using NAT the destination can also be a virtual IP that maps the destination address of the packet to a hidden destination address See Virtual IPs on page 208 Schedule Select a schedule that controls when the policy is available to be matched with connections See Schedules on page 205 Service Select a service that matches the service port number of the packet You can select from a wide range of predefined services or add custom services and service groups See Services on page 200 Action Select how you want the firewall to respond when the policy matches a connection attempt ACCEPT Accept the connection If you select ACCEPT you can also configure NAT and Authentication for the policy DENY Deny the connection The only other policy option that you can configure is Log Traffic to log
19. Configuring a DHCP relay agent In a DHCP relay configuration the FortiGate unit forwards DHCP requests from DHCP clients through the FortiGate unit to a DHCP server The FortiGate unit also returns responses from the DHCP server to the DHCP clients The DHCP server must have a route to the FortiGate unit that is configured as the DHCP relay so that the packets sent by the DHCP server to the DHCP client arrive at the FortiGate performing DHCP relay To configure an interface as a DHCP relay agent Go to System gt Network gt DHCP Select Service Select the interface to be the DHCP relay agent Select DHCP Relay Agent Enter the DHCP Server IP address Select Apply ao a fF WN Configuring a DHCP server As a DHCP server the FortiGate unit dynamically assigns IP addresses to hosts located on connected subnets You can configure a DHCP server for any FortiGate interface You can also configure a DHCP server for more than one FortiGate interface For each DHCP server configuration you can add multiple scopes also called address scopes so that the DHCP server can assign IP addresses to computers on multiple subnets Use these procedures to configure an interface as a DHCP server e Adding a DHCP server to an interface e Adding scopes to a DHCP server e Adding a reserve IP to a DHCP server e Viewing a DHCP server dynamic IP list Adding a DHCP server to an interface To add a DHCP server to an interface Go to System gt
20. Connecting to the web based manager Getting started Connecting to the web based manager 28 Use the following procedure to connect to the web based manager for the first time Configuration changes made with the web based manager are effective immediately without resetting the firewall or interrupting service To connect to the web based manager you need e acomputer with an ethernet connection e Internet Explorer version 4 0 or higher e a crossover cable or an ethernet hub and two ethernet cables Note You can use the web based manager with recent versions of most popular web browsers The web based manager is fully supported for Internet Explorer version 4 0 or higher To connect to the web based manager Set the IP address of the computer with an ethernet connection to the static IP address 192 168 1 2 and a netmask of 255 255 255 0 Using the crossover cable or the ethernet hub and cables connect the internal interface of the FortiGate unit to the computer ethernet connection Start Internet Explorer and browse to the address https 192 168 1 99 remember to include the s in https The FortiGate login is displayed Type admin in the Name field and select Login The Register Now window is displayed Use the information in this window to register your FortiGate unit so that Fortinet can contact you for firmware updates You must also register to receive updates to the FortiGate virus and attack definitions
21. Distinguished Name fou marketing dc fortinet dc com Deleting LDAP servers 228 You cannot delete an LDAP server that has been added to a user group To delete an LDAP server Go to User gt LDAP Select Delete mii beside the LDAP server name that you want to delete Select OK Fortinet Inc Users and authentication Configuring user groups Configuring user groups To enable authentication you must add user names RADIUS servers and LDAP servers to one or more user groups You can then select a user group when you require authentication You can select a user group to configure authentication for e Policies that require authentication Only users in the selected user group or users that can authenticate with the RADIUS servers added to the user group can authenticate with these policies e IPSec VPN Phase 1 configurations for dialup users Only users in the selected user group can authenticate to use the VPN tunnel e XAuth for IPSec VPN Phase 1 configurations Only users in the selected user group can be authenticated using XAuth The FortiGate PPTP configuration Only users in the selected user group can use PPTP The FortiGate L2TP configuration Only users in the selected user group can use L2TP When you add user names RADIUS servers and LDAP servers to a user group the order in which they are added determines the order in which the FortiGate unit checks for authentication If user names are f
22. For information about configuring the remaining policy settings see Adding firewall policies on page 189 Select OK to save the encrypt policy To make sure that the encrypt policy is matched for VPN connections arrange the encrypt policy above other policies with similar source and destination addresses and services in the policy list Fortinet Inc IPSec VPN IPSec VPN concentrators Figure 60 Adding an encrypt policy Int gt Ext Int gt DMZ DMZ gt Int DMZ gt Ext Ext gt Int Ext gt DMZ Source FGT 100 z Destination FGT_60 z Schedule Always z Service ANY E Action ENCRYPT z PN Tunnel FGT 60 z M Allow inbound I Inbound NAT M Allow outbound I Outbound NAT I Traffic Shapi Guaranteed o rane shaping Bandwidth IC kBytes s Maximum oo Bandwidth 10 KBytes s Traffic Priority High z I Anti Virus amp Web filter Content Profile Strict 4 I Log Traffic Comments maxmium 63 chars OK Cancel IPSec VPN concentrators In a hub and spoke network all VPN tunnels terminate at a single VPN peer called a hub The peers that connect to the hub are known as spokes The hub functions as a concentrator on the network managing the VPN connections between the spokes The advantage of a hub and spoke network is that the spokes are simpler to configure because they require fewer policy rules Also a hub and spoke network provides some processing efficiencies
23. NAT policy that allows users on your internal network to connect to the external network and stops users on the external network from connecting to the internal network You can add more policies to provide more control of the network traffic passing through the FortiGate unit The factory default content profiles can be used to apply different levels of antivirus protection web content filtering and email filtering to the network traffic that is controlled by firewall policies e Factory default NAT Route mode network configuration e Factory default Transparent mode network configuration e Factory default firewall configuration e Factory default content profiles Factory default NAT Route mode network configuration When the FortiGate unit is first powered on it is running in NAT Route mode and has the basic network configuration listed in Table 2 This configuration allows you to connect to the FortiGate unit web based manager and establish the configuration required to connect the FortiGate unit to the network In Table 2 HTTPS management access means you can connect to the web based manager using this interface Ping management access means this interface responds to ping requests Table 2 Factory default NAT Route mode network configuration Administrator User name admin account Password none IP 192 168 1 99 Internal interface Netmask 255 255 255 0 Management Access HTTPS Ping 30 Fortinet Inc G
24. Open a web browser and enter the following URL http www fortinet com ids ID lt attack ID gt Make sure that you include the attack ID For example to view the Fortinet Attack Analysis web page for the ssh CRC32 overflow bin sh attack ID 101646338 use the following URL http www fortinet com ids ID101646338 Note Each attack log message includes a URL that links directly to the FortiResponse Attack Analysis web page for that attack This URL is available in the Attack Log messages and Alert email messages For information about log message content and formats and about log locations see the FortiGate Logging and Message Reference Guide For information about logging attack messages see Logging attacks on page 276 FortiGate 800 Installation and Configuration Guide 271 Detecting attacks 272 Network Intrusion Detection System NIDS Figure 67 Example signature group members list ID Rule Name Revision 101646337 gobbles SSH exploit attempt 16 101646338 ssh CRC32 overflow bin sh 16 101646339 ssh CRC32 overflaw NOOP 16 101646340 ssh CRC32 overflow 16 101646341 x86linuxsambaoverflow G S 101646342 Solaris x86 nips overflow attempt 16 101646343 nlps x86 solaris overflow 16 101646344 LPRng overflow 16 101646345 redhat 7 0 lprd overflow 16 Disabling NIDS attack signatures ee res By default all NIDS attack signatures are enabled You can use the NIDS signature list to disable detection of some attacks
25. Restarting the FortiGate unit 1 Go to System gt Status 2 Select Restart The FortiGate unit restarts Shutting down the FortiGate unit You can restart the FortiGate unit after shutdown only by turning the power off and then on 1 Go to System gt Status 2 Select Shutdown The FortiGate unit shuts down and all traffic flow stops 110 Fortinet Inc System status System status System status You can use the system status monitor to display FortiGate system health information The system health information includes memory usage the number of active communication sessions and the amount of network bandwidth currently in use The web based manager displays current statistics as well as statistics for the previous minute If the FortiGate unit contains a hard disk the system status monitor displays the capacity of the hard disk and the amount of used and free space on the hard disk You can also view current virus and intrusion status The web based manager displays the current number of viruses and attacks as well as a graph of virus and attack levels over the previous 20 hours In each case you can set an automatic refresh interval that updates the display every 5 to 30 seconds You can also refresh the display manually e Viewing CPU and memory status e Viewing sessions and network status e Viewing virus and intrusions status Viewing CPU and memory status Current CPU and memory status indicates how close the F
26. before requiring the administrator to log in again The default idle time out is 5 minutes The maximum idle time out is 480 minutes 8 hours To set the Auth timeout Go to System gt Config gt Options For Auth Timeout type a number in minutes Fortinet Inc System configuration Changing system options Select Apply Auth Timeout controls the amount of inactive time that the firewall waits before requiring users to authenticate again For more information see Users and authentication on page 223 The default Auth Timeout is 15 minutes The maximum Auth Timeout is 480 minutes 8 hours To select a language for the web based manager Go to System gt Config gt Options From the Languages list select a language for the web based manager to use Select Apply You can choose English Simplified Chinese Japanese Korean or Traditional Chinese Note When the web based manager language is set to use Simplified Chinese Japanese Korean or Traditional Chinese you can change to English by selecting the English button on the upper right of the web based manager To set PIN protection for the LCD panel Go to System gt Config gt Options In the LCD Panel section select the PIN Protection check box Type a 6 digit PIN Administrators must enter the PIN to use the control buttons and LCD Select Apply Modifying the Dead Gateway Detection settings Modify dead gateway detection to control how the
27. particularly on the spokes The disadvantage of a hub and spoke network is its reliance on a single peer to handle management of all VPNs If this peer fails encrypted communication in the network is impossible A hub and spoke VPN network requires a special configuration Setup varies depending on the role of the VPN peer If the VPN peer is a FortiGate unit functioning as the hub or concentrator it requires a VPN configuration connecting it to each spoke AutolIKE phase 1 and 2 settings or manual key settings plus encrypt policies It also requires a concentrator configuration that groups the hub and spoke tunnels together The concentrator configuration defines the FortiGate unit as the hub in a hub and spoke network FortiGate 800 Installation and Configuration Guide 249 IPSec VPN concentrators 250 IPSec VPN If the VPN peer is one of the spokes it requires a tunnel connecting it to the hub but not to the other spokes It also requires policies that control its encrypted connections to the other spokes and its non encrypted connections to other networks such as the Internet e VPN concentrator hub general configuration steps e Adding a VPN concentrator e VPN spoke general configuration steps VPN concentrator hub general configuration steps A central FortiGate that is functioning as a hub requires the following configuration e A tunnel AutolIKE phase 1 and phase 2 configuration or manual key configuration for
28. priority always becomes the new primary unit if the permanent primary unit fails The default priority is 128 For example to set the priority of a cluster unit to 20 enter the command set system ha priority 20 Enter the command exit to return to the primary unit CLI Repeat steps 3 to 5 for each cluster unit Configuring weighted round robin weights 88 By default in active active HA mode the weighted round robin schedule assigns the same weight to each FortiGate unit in the cluster If you configure a cluster to use the weighted round robin schedule you can use the set system ha weight command to configure a weight value for each cluster unit The weight value sets the maximum number of connections that are sent to a cluster unit before a connection can be sent to the next cluster unit You can set weight values to control the number of connections processed by each cluster unit For example you might want to reduce the number of connections processed by the primary cluster unit by increasing the weight assigned to the subordinate cluster units Fortinet Inc High availability Active Active cluster packet flow Weight values are entered in order according to the priority of the units in the cluster For example if you have a cluster of three FortiGate units you can enter the following command to configure the weight values for each unit set system ha weight 1 3 3 This command has the following results e The first connect
29. to your external network e Optionally connect the DMZ interfaces of each FortiGate unit to a switch or hub connected to your DMZ network e Optionally connect ports 1 to 4 of each FortiGate unit to switches or hubs connected to other networks e Connect the HA interfaces of the FortiGate units to another switch or hub Figure 15 HA network configuration Internal Network om m HE in Hub or Switch FortiGate 800 Installation and Configuration Guide Internal External HA om Es Hub or oma GE Switch HA Router Internal External Internet 77 High availability Managing an HA cluster Power on all the FortiGate units in the cluster As the units power on they negotiate to choose the primary cluster unit and the subordinate units This negotiation occurs with no user intervention When negotiation is complete the you can configure the cluster as if it was a single FortiGate unit Use the information in NAT Route mode installation on page 41 or Transparent mode installation on page 59 to configure the cluster interfaces configure your network and complete the cluster configuration Note Do not change the HA interface IP address The HA interface of each FortiGate unit in the cluster is assigned an IP address during cluster negotiation Use the information in Managing an HA cluster on page 78 to log into and m
30. when blocking is enabled the FortiGate unit blocks the following file patterns e executable files bat com and exe compressed or archive files gz rar tar tgz and zip e dynamic link libraries dll e HTML application hta e Microsoft Office files doc ppt xI e Microsoft Works files wps e Visual Basic files vb screen saver files scr in firewall traffic Use content profiles to apply file blocking to HTTP FTP POP3 IMAP and SMTP traffic controlled by firewall policies To block files in firewall traffic Select file blocking in a content profile See Adding content profiles on page 219 Add this content profile to firewall policies to apply content blocking to the traffic controlled by the firewall policy See Adding content profiles to policies on page 221 Adding file patterns to block 282 To add file patterns to block Go to Anti Virus gt File Block Select New Type the new pattern in the File Pattern field You can use an asterisk to represent any characters and a question mark to represent any single character For example dot blocks Microsoft Word template files and do blocks both Microsoft Word template files and document files Select the check box beside the traffic protocols for which you want to enable blocking of this file pattern Select OK Fortinet Inc Antivirus protection Quarantine Quarantine FortiGat
31. 0 2 2 2 1 dmz 1 1 1 1 external 0 0 0 0 0 0 0 0 1 1 1 1 external 2 2 2 1 dmz 54 Fortinet Inc NAT Route mode installation Configuration example Multiple connections to the Internet Policy routing examples Adding policy routing increases your control over how packets are routed Policy routing works on top of destination based routing To increase the control provided by destination based routing configure destination based routing first and then build policy routing on top For example if you use destination based routing to configure routing for dual Internet connections you can use policy routing to better control which traffic is sent to which destination route This section describes the following policy routing examples based on topology similar to that shown in Figure 9 on page 51 Differences are noted in each example The policy routes described in these examples work only if you have already defined destination routes similar to those described in the previous section e Routing traffic from internal subnets to different external networks e Routing a service to an external network For more information about policy routing see Policy routing on page 156 Routing traffic from internal subnets to different external networks If the FortiGate unit provides Internet access for multiple internal subnets you can use policy routing to control the route that traffic from each network takes to the In
32. 1 Log into the web based manager Go to System gt Network gt Interface Choose a user defined interface and select Modify 2 Select from port1 to port4 Change the IP address and Netmask as required Select Apply Setting the date and time For effective scheduling and logging the FortiGate system date and time must be accurate You can either manually set the system date and time or configure the FortiGate unit to automatically keep its time correct by synchronizing with a Network Time Protocol NTP server For information about setting the FortiGate system date and time see Setting system date and time on page 169 Changing antivirus protection To change how antivirus protection to protects users on your internal network from downloading a virus from the Internet Go to Firewall gt Policy gt Internal gt External Select Edit to edit this policy Select Anti Virus amp Web filter to enable antivirus protection for this policy kh O N Select a different Content Profile to change how antivirus protection is applied for this policy For a description of each of the content profiles see Content profiles on page 218 5 Select OK to save the changes FortiGate 800 Installation and Configuration Guide 49 Configuration example Multiple connections to the Internet NAT Route mode installation Registering your FortiGate unit After purchasing and installing a new FortiGate unit you can register the
33. 110 123 2308 65 39 139 188 110 85 To top 192 168 110 121 4708 192 168 110 3 443 58 T FortiGate 800 Installation and Configuration Guide 115 Session list System status 116 Fortinet Inc AT MET Virus and attack definitions updates and registration You can configure the FortiGate unit to connect to the FortiResponse Distribution Network FDN to update the antivirus and attack definitions and the antivirus engine You have the following update options Request updates from the FDN Schedule updates to automatically request the latest versions hourly daily or weekly Set Push updates so that the FDN contacts your FortiGate unit when a new update is available To receive scheduled updates and push updates you must register the FortiGate unit on the Fortinet support web page This chapter describes Updating antivirus and attack definitions Scheduling updates Enabling push updates Registering FortiGate units Updating registration information Registering a FortiGate unit after an RMA Updating antivirus and attack definitions You can configure the FortiGate unit to connect to the FortiResponse Distribution Network FDN to automatically receive the latest antivirus and attack definitions and antivirus engine updates The FortiGate unit supports the following antivirus and attack definition update features User initiated updates from the FDN Hourly daily or weekly scheduled antivirus and attac
34. 200 Ending IP 192 168 1 201 User Group L2TP_users C Disable L2TP To add source addresses Add a source address for every address in the L2TP address range Go to Firewall gt Address Select the interface to which L2TP clients connect This can be an interface VLAN subinterface or zone Select New to add an address Enter the Address Name IP Address and NetMask for an address in the L2TP address range Select OK to save the source address Repeat for all addresses in the L2TP address range Note If the L2TP address range is comprised of an entire subnet add an address for this subnet Do not add an address group To add a source address group Organize the source addresses into an address group Go to Firewall gt Address gt Group Add a new address group to the interface to which L2TP clients connect This can be an interface VLAN subinterface or zone Enter a Group Name to identify the address group The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed To add addresses to the address group select an address from the Available Addresses list and select the right arrow to add it to the Members list To remove addresses from the address group select an address from the Members list and select the left arrow to remove it from the group Fortinet Inc PPTP and L2TP VPN kh OO N
35. Adding a ping server to an interface e Controlling administrative access to an interface e Changing the MTU size to improve network performance e Configuring traffic logging for connections to an interface e Configuring the management interface in Transparent mode Fortinet Inc Network configuration Configuring interfaces Viewing the interface list To view the interface list 1 Go to System gt Network gt Interface The interface list is displayed The interface list shows the following status information for all the FortiGate interfaces and VLAN subinterfaces The name of the interface The IP address of the interface The netmask of the interface e The zone that the interface has been added to e The administrative access configuration for the interface See Controlling administrative access to an interface on page 143 for information about administrative access options e The administrative status for the interface If the administrative status is a green arrow the interface is up and can accept network traffic If the administrative status is a red arrow the interface is administratively down and cannot accept traffic To change the administrative status see Changing the administrative status of an interface on page 139 Changing the administrative status of an interface You can use the following procedures to start an interface that is administratively down and stop and interface that is admi
36. Adding content profiles to policies on page 221 Quarantining blocked files Use content profiles to quarantine blocked files found in POP3 IMAP and SMTP traffic controlled by firewall policies To quarantine blocked files 1 Go to Anti Virus gt Quarantine gt Quarantine Config 2 Select the Content protocols for which to quarantine blocked files 3 To quarantine blocked files select file block in a content profile See Adding content profiles on page 219 4 Select Quarantine to save to the quarantine any files that are blocked FortiGate 800 Installation and Configuration Guide 283 Quarantine Antivirus protection 5 Add this content profile to firewall policies See Adding content profiles to policies on page 221 Viewing the quarantine list To view the quarantine list 1 Go to Anti Virus gt Quarantine The quarantine list displays the following information File Name The processed filename of the file that was quarantined The processed filename has all white space removed As a file is quarantined it is 32 bit checksummed and stored on the FortiGate hard disk with the following naming convention lt 32bit CRC gt lt processed filename gt For example a file named Over Size exe is stored as 3fc155d2 oversize exe Date Quarantined The date and time that the file was quarantined in the format dd mm yyyy hh mm This value indicates the time that the first file was quarantined if the duplicate count in
37. CLI command execute updatecenter updatenow to update the antivirus and attack definitions To use the following procedure you must have a TFTP server that the FortiGate unit can connect to To revert to a previous firmware version using the CLI Make sure that the TFTP server is running Copy the new firmware image file to the root directory of the TFTP server Log into the FortiGate CLI as the admin administrative user Make sure the FortiGate unit can connect to the TFTP server You can use the following command to ping the computer running the TFTP server For example if the TFTP server s IP address is 192 168 1 168 execute ping 192 168 1 168 Enter the following command to copy the firmware image from the TFTP server to the FortiGate unit xecute restore image lt name_str gt lt tftp_ip gt Where lt name_str gt is the name of the firmware image file on the TFTP server and lt tftp_ip gt is the IP address of the TFTP server For example if the firmware image file name is FGT_300 v250 build045 FORTINET out and the IP address of the TFTP server is 192 168 1 168 enter xecute restore image FGT 300 v250 build045 FORTINET out 192 168 1 168 The FortiGate unit uploads the firmware image file After the file uploads a message similar to the following is displayed Get image from tftp server OK This operation will downgrade the current firmware version Do you want to continue y n Type Y The FortiGate
38. Contract numbers for each FortiGate unit e View and change registration information e Download virus and attack definitions updates e Download firmware upgrades e Modify registration information after an RMA Soon you will also be able to e Access Fortinet user documentation Access the Fortinet knowledge base Fortinet Inc Virus and attack definitions updates and registration Registering FortiGate units All registration information is stored in the Fortinet Customer Support database This information is used to make sure that your registered FortiGate units can be kept up to date All information is strictly confidential Fortinet does not share this information with any third party organizations for any reason This section describes FortiCare Service Contracts e Registering the FortiGate unit FortiCare Service Contracts Owners of a new FortiGate unit are entitled to 90 days of technical support services To continue receiving support services after the 90 day expiry date you must purchase a FortiCare Support Contract from an authorized Fortinet reseller or distributor Different levels of service are available so you can purchase the support that you need For maximum network protection Fortinet strongly recommends that all customers purchase a service contract that covers antivirus and attack definition updates See your Fortinet reseller or distributor for details of packages and pricing To activate the FortiCare Su
39. DNS configuration fnSysConfig FortiGate system configuration including time options administrative users and HA configuration fnSysSnmp FortiGate SNMP configuration Firewall configuration Table 28 Firewall MIB fields MIB field Description fnFirewallPolicy FortiGate firewall policy list including complete configuration information for each policy fnFirewallAddress FortiGate firewall address and address group list fnFirewallService FortiGate firewall service and service group list fnFirewallSchedule FortiGate firewall schedule list fnFirewallVirtuallP FortiGate firewall virtual IP list fnFirewalllpPool FortiGate firewall IP pool list fnFirewalllPMACBinding FortiGate firewall IP MAC binding configuration fnFirewallContProfiles FortiGate firewall content profile list 179 FortiGate 800 Installation and Configuration Guide Configuring SNMP 180 System configuration Users and authentication configuration Table 29 User and authentication MIB fields FnUserLocalTable Local user list FnUserRadiusSrvTable RADIUS server list FnUserGrpTable User group list VPN configuration and status Table 30 VPN MIB fields fnVpnipsec IPSec VPN configuration including the Phase 1 list Phase 2 list manual key list and VPN concentrator list Status and timeout for each VPN tunnel Phase 2 and the
40. Definition Attack Definition FGT 50 OS2 3 6_4 77 2 36 1 41 FGT 60 2 36 1 41 FGT 100 052 3 6_4 77 2 36 1 41 FGT 200 OS2 3 6_4 77 2 36 1 41 FGT 300 0523 6 A77 2 36 1 41 FGT 400 OS2 3 6_4 77 2 36 1 41 FGT 500 052 3 6_4 77 2 36 1 41 FGT 1000 2 36 1 41 FGT 3000 052 3 6 4 77 2 36 1 41 FGT 3600 2 36 1 41 For information about how to install the downloaded files see Manual virus definition updates on page 106 and Manual attack definition updates on page 107 FortiGate 800 Installation and Configuration Guide 135 Registering a FortiGate unit after an RMA Virus and attack definitions updates and registration Registering a FortiGate unit after an RMA 136 ao a fF WN The Return Material Authorization RMA process starts when a registered FortiGate unit does not work properly because of a hardware failure If this happens while the FortiGate unit is protected by hardware coverage you can return the FortiGate unit that is not functioning to your reseller or distributor The RMA is recorded and you will receive a replacement unit Fortinet adds the RMA information to the Fortinet support database When you receive the replacement unit you can use the following procedure to update your product registration information To register a FortiGate unit after an RMA Go to System gt Update gt Support Select Support Login Enter your Fortinet support user name and password to log in Select Add Registration Sele
41. Disabling NIDS attack signatures on page 272 FortiGate 800 Installation and Configuration Guide 277 Logging attacks Network Intrusion Detection System NIDS 278 Fortinet Inc AT MET Antivirus protection You can enable antivirus protection in firewall policies You can select a content profile that controls how the antivirus protection behaves Content profiles control the type of traffic protected HTTP FTP IMAP POP3 SMTP the type of antivirus protection and the treatment of fragmented email and oversized files or email This chapter describes e General configuration steps e Antivirus scanning e File blocking e Quarantine e Blocking oversized files and emails e Exempting fragmented email from blocking e Viewing the virus list General configuration steps Configuring antivirus protection involves the following general steps 1 Select antivirus protection options in a new or existing content profile See Adding content profiles on page 219 2 Select the Anti Virus amp Web filter option in firewall policies that allow web HTTP FTP and email IMAP POP3 and SMTP connections through the FortiGate unit Select a content profile that provides the antivirus protection options that you want to apply to a policy See Adding content profiles to policies on page 221 3 Configure antivirus protection settings to control how the FortiGate unit applies antivirus protection to the web FTP and email
42. Double click Make New Connection to start the Network Connection Wizard and select Next For Network Connection Type select Connect to a private network through the Internet and select Next For Destination Address enter the IP address or host name of the FortiGate unit to connect to and select Next Set Connection Availability to Only for myself and select Next Select Finish In the Connect window select Properties Select the Security tab Uncheck Require data encryption Select OK To connect to the PPTP VPN Start the dialup connection that you configured in the previous procedure Enter your PPTP VPN User Name and Password Select Connect In the connect window enter the User Name and Password that you use to connect to your dialup network connection This user name and password is not the same as your VPN user name and password Configuring a Windows XP client for PPTP kh O N Use the following procedure to configure a client computer running Windows XP so that it can connect to a FortiGate PPTP VPN To configure a PPTP dialup connection Go to Start gt Settings gt Control Panel Select Network and Internet Connections Select Create a Connection to the network of your workplace and select Next Select Virtual Private Network Connection and select Next FortiGate 800 Installation and Configuration Guide 261 Configuring PPTP 262 EN UNo Y O O N OW _ 11 12 a A O N
43. External External_All This address matches all addresses on the external network DMZ DMZ_All This address matches all addresses on the DMZ network The firewall uses these addresses to match the source and destination addresses of packets received by the firewall The default policy matches all connections from the internal network because it includes the Internal_All address The default policy also matches all connections to the Internet because it includes the External_All address You can add more addresses to each interface to improve the control you have over connections through the firewall For more information about addresses see Addresses on page 197 You can also add firewall policies that perform network address translation NAT To use NAT to translate destination addresses you must add virtual IPs Virtual IPs map addresses on one network to a translated address on another network For more information about Virtual IPs see Virtual IPs on page 208 Services Policies can control connections based on the service or destination port number of packets The default policy accepts connections using any service or destination port number The firewall is configured with over 40 predefined services You can add these services to a policy for more control over the services that can be used by connections through the firewall You can also add user defined services For more information about services s
44. FortiGate unit confirms connectivity with a ping server added to an interface configuration For information about adding a ping server to an interface see Adding a ping server to an interface on page 142 To modify the dead gateway detection settings Go to System gt Config gt Options For Detection Interval type a number in seconds to specify how often the FortiGate unit tests the connection to the ping target For Fail over Detection type a number of times that the connection test fails before the FortiGate unit assumes that the gateway is no longer functioning Select Apply FortiGate 800 Installation and Configuration Guide 171 Adding and editing administrator accounts System configuration Adding and editing administrator accounts 172 When the FortiGate unit is initially installed it is configured with a single administrator account with the user name admin From this administrator account you can add and edit administrator accounts You can also control the access level of each of these administrator accounts and control the IP address from which the administrator can connect to the FortiGate unit There are three administration account access levels admin Has all permissions Can view add edit and delete administrator accounts Can view and change the FortiGate configuration The admin user is the only user who can go to the System Status page and manually update firmware update the antivirus definition
45. Fortinet supported standard MIBs into your SNMP manager FortiGate 800 Installation and Configuration Guide 173 Configuring SNMP 174 System configuration RFC support includes support for most of RFC 2665 Ethernet like MIB and most of RFC 1213 MIB II for more information see FortiGate MIBs This section describes e Configuring the FortiGate unit for SNMP monitoring e Configuring FortiGate SNMP support e FortiGate MIBs FortiGate traps e Fortinet MIB fields Configuring the FortiGate unit for SNMP monitoring Before a remote SNMP manager can connect to the FortiGate agent you must configure one or more FortiGate interfaces to accept SNMP connections See Controlling administrative access to an interface on page 143 Configuring FortiGate SNMP support kh O N Use the information in this section to configure the FortiGate unit so that an SNMP manager can connect to the FortiGate SNMP agent to receive management information and traps e Configuring SNMP access to an interface e Configuring SNMP community settings Configuring SNMP access to an interface Before a remote SNMP manager can connect to the FortiGate agent you must configure one or more FortiGate interface s to accept SNMP connections The configuration steps to follow depend on whether the FortiGate unit is operating in NAT Route mode or Transparent mode To configure SNMP access to an interface in NAT Route mode Go to System gt Networ
46. Inc Introduction Customer service and technical support Volume 4 FortiGate NIDS Guide Describes how to configure the FortiGate NIDS to detect and protect the FortiGate unit from network based attacks Volume 5 FortiGate Logging and Message Reference Guide Describes how to configure FortiGate logging and alert email Also contains the FortiGate log message reference Volume 6 FortiGate CLI Reference Guide Describes the FortiGate CLI and contains a reference to all FortiGate CLI commands The FortiGate online help also contains procedures for using the FortiGate web based manager to configure and manage the FortiGate unit Comments on Fortinet technical documentation You can send information about errors or omissions in this document or any Fortinet technical documentation to techdoc fortinet com Customer service and technical support For antivirus and attack definition updates firmware updates updated product documentation technical support information and other resources please visit the Fortinet technical support web site at http support fortinet com You can also register FortiGate Antivirus Firewalls from http support fortinet com and change your registration information at any time Fortinet email support is available from the following addresses amer_support fortinet com For customers in the United States Canada Mexico Latin America and South America apac_support fortinet com For customers
47. Internet VPNs use encryption and other security mechanisms to ensure that only authorized users can access the network and that data cannot be intercepted Virus A computer program that attaches itself to other programs spreading itself through computers or networks by this mechanism usually with harmful intent Worm A program or algorithm that replicates itself over a computer network usually through email and performs malicious actions such as using up the computer s resources and possibly shutting the system down 325 Glossary 326 Fortinet Inc Index A accept policy 191 action policy option 191 active log deleting all messages 320 searching 318 319 viewing and maintaining saved logs 318 ActiveX 299 removing from web pages 299 address 197 adding 197 adding firewall addresses to a virtual domain 152 editing 198 199 group 199 IP MAC binding 216 virtual IP 208 address group 199 example 200 address name 197 addressing mode DHCP 140 PPPoE 141 admin access level administrator account 172 administrative access to an interface 143 administrative status changing for an interface 139 administrator account adding 172 admin 172 changing password 173 editing 172 173 netmask 172 173 permission 173 trusted host 172 173 FortiGate 800 Installation and Configuration Guide AT MET alert email configuring 321 configuring SMTP server 321 content of messages 276 critical firewall or VPN events 322 e
48. MAC pair Select OK to save the IP MAC binding pair Viewing the dynamic IP MAC list To view the dynamic IP MAC list Go to Firewall gt IP MAC Binding gt Dynamic IP MAC Enabling IP MAC binding Caution Make sure that you have added the IP MAC Address pair of your management computer before enabling IP MAC binding To enable IP MAC binding Go to Firewall gt IP MAC Binding gt Setting Select the Enable IP MAC binding going through the firewall check box if you want to turn on IP MAC binding for packets that could be matched by policies Select the Enable IP MAC binding going to the firewall check box if you want to turn on IP MAC binding for packets connecting to the firewall Configure how IP MAC binding handles packets with IP and MAC addresses that are not defined in the IP MAC list Select Allow traffic to allow all packets with IP and MAC address pairs that are not added to the IP MAC binding list Select Block traffic to block packets with IP and MAC address pairs that are not added to the IP MAC binding list Select Apply to save the changes FortiGate 800 Installation and Configuration Guide 217 Content profiles Firewall configuration Figure 50 IP MAC settings Setting StaticIP MAC Dynamic IP MAC M Enable IP MAC binding going through the firewall MV Enable IP MAC binding going to the firewall For hasts not defined in table C Allow traffic Block traffic Content profi
49. RIP settings 162 Default Metric Input Queue Output Delay RIP configuration RIP uses the default metric to advertise routes learned from other routing protocols Set Default Metric to a positive integer lower than 16 to advertise that metric for all routes learned from other routing protocols The default setting for the Default Metric is 2 Change the depth of the RIP input queue The higher the number the deeper the input queue Change the input queue depth to prevent loss of information from the routing table when you have a FortiGate unit sending at high speed to a router that cannot receive at high speed The range is 0 to 1024 The default input queue depth is 50 A queue size of 0 means there is no input queue Add a delay in milliseconds between packets in a multiple packet RIP update Add an output delay if you are configuring RIP on a FortiGate unit that could be sending packets to a router that cannot receive the packets at the rate the FortiGate unit is sending them Output Delay can be from 8 to 50 milliseconds The default output delay is 0 milliseconds Change the following RIP timer settings as required RIP timer defaults are effective in most configurations You should only have to change these timers to troubleshoot network routing problems All routers and access servers in the network should have the same RIP timer settings Update Invalid Holddown Flush The time interval in seconds between RIP u
50. URL Exempt List El Type the path and filename of your URL Exempt List text file or select Browse and locate the file Select OK to upload the file to the FortiGate unit Select Return to display the updated URL Exempt List You can continue to maintain the URL Exempt List by making changes to the text file and uploading it again as necessary 302 Fortinet Inc AT MET Email filter Email filtering is enabled in firewall policies When you enable Anti Virus amp Web filter in a firewall policy you select a content profile that controls how email filtering behaves for email IMAP and POP3 traffic Content profiles control the following types of protection to identify unwanted email e filtering unwanted sender address patterns e filtering unwanted content exempting sender address patterns from blocking This chapter describes e General configuration steps Email banned word list e Email block list Email exempt list e Adding a subject tag General configuration steps Configuring email filtering involves the following general steps 1 Select email filter options in a new or existing content profile See Adding content profiles on page 219 2 Select the Anti Virus amp Web filter option in firewall policies that allow IMAP and POP3 connections through the FortiGate unit Select a content profile that provides the email filtering options that you want to apply to a policy See Adding content pro
51. VPN Tunnel Allow inbound IPSec VPN Select an Auto Key tunnel for this encrypt policy Select Allow inbound to enable inbound users to connect to the source address Allow outbound Select Allow outbound to enable outbound users to connect to the Inbound NAT Outbound NAT destination address The FortiGate unit translates the source address of incoming packets to the IP address of the FortiGate interface connected to the source address network Typically this is an internal interface of the FortiGate unit Inbound NAT makes it impossible for local hosts to see the IP addresses of remote hosts hosts located on the network behind the remote VPN gateway The FortiGate unit translates the source address of outgoing packets to the IP address of the FortiGate interface connected to the destination address network Typically this is an external interface of the FortiGate unit Outbound NAT makes it impossible for remote hosts to see the IP addresses of local hosts hosts located on the network behind the local VPN gateway If Outbound NAT is implemented it is subject to these limitations Configure Outbound NAT only at one end of the tunnel The end that does not implement Outbound NAT requires an internal to external policy that specifies the remote external interface as the Destination usually a public IP address The tunnel and the traffic within the tunnel can only be initiated at the end that implements Outbound NAT
52. a VPN concentrator on page 251 to add the tunnel to a concentrator the next time you open the tunnel the Concentrator field displays the name of the concentrator to which you added the tunnel 12 Select a Quick Mode Identity Use selectors from policy Select this option for policy based VPNs A policy based VPN uses an encrypt policy to select which VPN tunnel to use for the connection In this configuration the VPN tunnel is referenced directly from the encrypt policy You must select this option if both VPN peers are FortiGate units Use wildcard selectors Select this option for routing based VPNs A routing based VPN uses routing information to select which VPN tunnel to use for the connection In this configuration the tunnel is referenced indirectly by a route that points to a tunnel interface You must select this option if the remote VPN peer is a non FortiGate unit that has been configured to operate in tunnel interface mode 13 Select OK to save the AutolIKE key VPN tunnel Figure 58 Adding a phase 2 configuration Manual Key A Phase 2 Y Phase 1 Concentrator Monitor my New PN Tunnel Tunnel Name Tunnel_1 Remote Gateway Remote_Client_1 z E P2 Proposal 1 Encryption 3DES Authentication SHA1 7 2 Encryption 3DES z Authentication MD5 z 3 Encryption 4ES128 z Authentication MD5 z El M Enable replay detection M Enable perfect forward secrecy PFS DHGroup 10 20 5 Keylife Seconds z 1800 S
53. a firewall policy A packet with IP 1 1 1 1 but with a different MAC address is dropped immediately to prevent IP spoofing A packet with a different IP address but with a MAC address of 12 34 56 78 90 ab cd is dropped immediately to prevent IP spoofing e A packet with both the IP address and MAC address not defined in the IP MAC binding table e is allowed to go on to be matched with a firewall policy if IP MAC binding is set to Allow traffic e is blocked if IP MAC binding is set to Block traffic Configuring IP MAC binding for packets going to the firewall Use the following procedure to use IP MAC binding to filter packets that would normally connect with the firewall for example when an administrator is connecting to the FortiGate unit for management To configure IP MAC binding for packets going to the firewall Go to Firewall gt IP MAC Binding gt Setting Select the Enable IP MAC binding going to the firewall check box Go to Firewall gt IP MAC Binding gt Static IP MAC Select New to add IP MAC binding pairs to the IP MAC binding list All packets that would normally connect to the firewall are first compared with the entries in the IP MAC binding table For example if the IP MAC pair IP 1 1 1 1 and 12 34 56 78 90 ab cd is added to the IP MAC binding list e A packet with IP address 1 1 1 1 and MAC address 12 34 56 78 90 ab cd is allowed to connect to the firewall A packet with IP 1 1 1 1 but with a diff
54. a new LDAP server Type the Name of the LDAP server You can type any name The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Enter the Server Name or IP address of the LDAP server Enter the Server Port used to communicate with the LDAP server By default LDAP uses port 389 6 Enter the common name identifier for the LDAP server The common name identifier for most LDAP servers is cn However some servers use other common name identifiers such as uid FortiGate 800 Installation and Configuration Guide 227 Configuring LDAP support Users and authentication Enter the distinguished name used to look up entries on the LDAP server Enter the base distinguished name for the server using the correct X 500 or LDAP format The FortiGate unit passes this distinguished name unchanged to the server For example you could use the following base distinguished name ou marketing dc fortinet dc com where ou is organization unit and dc is domain component You can also specify multiple instances of the same field in the distinguished name for example to specify multiple organization units ou accounts ou marketing dc fortinet dc com Select OK Figure 54 Example LDAP configuration LDAP y New LDAP Server Name LDAP_1 Server Name IP fi 3245 Server Port 389 Common Name Identifier jn Stti i CS C
55. antivirus and attack definitions are up to date You can also use the CLI command execute updatecenter updatenow to update the antivirus and attack definitions To upgrade the firmware using the CLI 1 Make sure that the TFTP server is running Copy the new firmware image file to the root directory of the TFTP server Log into the CLI as the admin administrative user FortiGate 800 Installation and Configuration Guide 95 Changing the FortiGate firmware System status 96 Make sure the FortiGate unit can connect to the TFTP server You can use the following command to ping the computer running the TFTP server For example if the IP address of the TFTP server is 192 168 1 168 execute ping 192 168 1 168 Enter the following command to copy the firmware image from the TFTP server to the FortiGate unit xecute restore image lt name_str gt lt tftp_ip gt Where lt name_str gt is the name of the firmware image file on the TFTP server and lt tftp_ip gt is the IP address of the TFTP server For example if the firmware image file name is FGT_300 v250 build045 FORTINET out and the IP address of the TFTP server is 192 168 1 168 enter xecute restore image FGT_ 300 v250 build045 FORTINET out 192 168 1 168 The FortiGate unit uploads the firmware image file upgrades to the new firmware version and restarts This process takes a few minutes Reconnect to the CLI To confirm that the new firmware image is successfully i
56. any available user defined interface to different Internet connections each provided by a different service provider See Configuration example Multiple connections to the Internet on page 50 To connect the FortiGate unit running in NAT Route mode Connect the Internal interface to the hub or switch connected to your internal network Connect the External interface to your public switch or router Optionally connect the DMZ interface to your DMZ network You can use a DMZ network to provide access from the Internet to a web server or other server without installing the servers on your internal network Fortinet Inc NAT Route mode installation Connecting the FortiGate unit to your networks Figure 7 FortiGate 800 NAT Route mode connections DMZ Network eee Web Server Internal Network a a s oe e a a e o Seccsecccesecccccccce 2 o B T Mail Server e a a Hub or Switch ta omm a e e e e o o a Baas sairaat Internal DMZ ea o eo FortiGate 800 External Ss ea a Public Switch x SEERE or Router eo o e Internet NS To connect to FortiGate 800 user defined interfaces 1 Connect the user defined interface to the hub or switch connected to the intended network 2 Repeat for all user defined interfaces that you have configured The example in Figure 8 shows an internal network connected to user defined interface 1 and an external network connected
57. appear e FortiGate unit running v2 x BIOS Do You Want To Save The Image Y n Type N FortiGate unit running v3 x BIOS Save as Default firmware Run image without saving D R Type R The FortiGate image is installed to system memory and the FortiGate unit starts running the new firmware image but with its current configuration You can log into the CLI or the web based manager using any administrative account To confirm that the new firmware image has been loaded from the CLI enter get system status You can test the new firmware image as required Installing and using a backup firmware image If the FortiGate unit is running BIOS version v3 x you can install a backup firmware image Once the backup firmware image is installed you can switch to this backup image when required This section describes e Installing a backup firmware image e Switching to the backup firmware image e Switching back to the default firmware image Installing a backup firmware image To run this procedure you access the CLI by connecting to the FortiGate console port using a null modem cable installa TFTP server that you can connect to from the FortiGate as described in the procedure Installing firmware images from a system reboot using the CLI on page 99 FortiGate 800 Installation and Configuration Guide 103 Changing the FortiGate firmware System status 104 kh O N 10 11 To install a backup firmware image Connect
58. be possible because of security considerations or other reasons After you define the Internet connections for both FortiGate units you can configure the VPN tunnel To configure a redundant IPSec VPN 1 Add the phase 1 parameters for up to three VPN connections Enter identical values for each VPN connection with the exception of the Gateway Name and IP Address Make sure that the remote VPN peer Remote Gateway has a static IP address See Adding a phase 1 configuration for an AutoIKE VPN on page 235 2 Add the phase 2 parameters VPN tunnel for up to three VPN connections e If the Internet connections are in the same zone add one VPN tunnel and add the remote gateways to it You can add up to three remote gateways Ifthe Internet connections are in separate zones or assigned to unique interfaces add a VPN tunnel for each remote gateway entered See Adding a phase 2 configuration for an AutoIKE VPN on page 240 3 Add the source and destination addresses See Adding a source address on page 246 See Adding a destination address on page 247 4 Add encrypt policies for up to three VPN connections Ifthe VPN connections are in the same zone add one outgoing encrypt policy for example an Internal gt External policy Add the AutolKE key tunnel to this policy Ifthe VPN connections are in different zones add a separate outgoing encrypt policy for each connection The source and destination of bo
59. broadcast domain Devices in VLAN 1 can connect with other devices in VLAN 1 but cannot connect with devices in other VLANs The communication among devices on a VLAN is independent of the physical network A VLAN segregates devices by adding 802 1Q VLAN tags to all of the packets sent and received by the devices in the VLAN VLAN tags are 4 byte frame extensions that contain a VLAN identifier as well as other information FortiGate 800 Installation and Configuration Guide 145 VLANs in NAT Route mode Network configuration In a typical VLAN configuration 802 1Q compliant VLAN layer 2 switches or layer 3 routers or firewalls add VLAN tags to packets Packets passing between devices in the same VLAN can be handled by layer 2 switches Packets passing between devices in different VLANs must be handled by a layer 3 device such as router firewall or layer 3 switch Operating in NAT Route mode the FortiGate unit functions as a layer 3 device to control the flow of packets between VLANs See VLANs in NAT Route mode on page 146 for more information Operating in Transparent mode the FortiGate unit functions as a layer 2 device to control the flow of packets between segments in the same VLAN See Virtual domains in Transparent mode on page 147 VLANs in NAT Route mode 146 In NAT Route mode FortiGate units support VLANs for constructing VLAN trunks between an IEEE 802 1Q compliant switch or router and the FortiGate unit N
60. but do not process traffic Active active A A HA load balances virus scanning among all the FortiGate units in the cluster An active active HA cluster consists of a primary FortiGate unit that processes traffic and subordinate units that also process traffic The primary FortiGate unit uses a load balancing algorithm to distribute virus scanning to all the FortiGate units in the HA cluster This chapter provides an overview of HA functionality and describes how to configure and manage HA clusters in NAT Route mode and Transparent mode e Configuring an HA cluster e Managing an HA cluster e Advanced HA options e Active Active cluster packet flow Configuring an HA cluster Use the following procedures to create an HA cluster consisting of two or more FortiGate units These procedures describe how to configure each of the FortiGate units for HA operation and then how to connect the FortiGate units to form a cluster Once the cluster is connected you can configure it in the same way as you would configure a standalone FortiGate unit This section describes e Configuring FortiGate units for HA operation e Connecting the cluster e Adding a new FortiGate unit to a functioning cluster Configuring FortiGate units for HA operation 74 Each FortiGate unit in the cluster must have the same HA configuration Use the following procedure to configure each FortiGate unit for HA operation To configure a FortiGate unit for HA operation Po
61. by the ID that they transmit during phase 1 Accept any peer ID Select to accept any peer ID and therefore not authenticate remote VPN peers by peer ID Accept this peer ID Select to authenticate a specific VPN peer or a group of VPN peers with a shared user name ID and password pre shared key Also add the peer ID Accept peer ID in dialup group Select to authenticate each remote VPN peer with a unique user name ID and password pre shared key Also select a dialup group user group Configure the user group prior to configuring this peer option 3 Optionally configure XAuth XAuth IKE eXtended Authentication authenticates VPN peers at the user level If the the FortiGate unit the local VPN peer is configured as an XAuth server it authenticates remote VPN peers by referring to a user group The users contained in the user group can be configured locally on the FortiGate unit or on remotely located LDAP or RADIUS servers If the FortiGate unit is configured as an XAuth client it provides a user name and password when it is challenged XAuth Enable as a Client Name Enter the user name the local VPN peer uses to authenticate itself to the remote VPN peer Password Enter the password the local VPN peer uses to authenticate itself to the remote VPN peer FortiGate 800 Installation and Configuration Guide 237 AutolKE IPSec VPNs Encryption method Usergroup IPSec VPN XAuth Enable as a Server Select the e
62. configure the policy Source Select the source address from which users can access the server Destination Select the virtual IP Schedule Select a schedule as required Service Select the service that matches the Map to Service that you selected for the port forwarding virtual IP Action Set action to ACCEPT to accept connections to the internal server You can also select DENY to deny access NAT Select NAT if the firewall is protecting the private addresses on the destination network from the source network 212 Fortinet Inc Firewall configuration IP pools Authentication Optionally select Authentication and select a user group to require users to authenticate with the firewall before accessing the server using port forwarding Log Traffic Select these options to log port forwarded traffic and apply antivirus Anti Virus amp Web filter 2nd web filter protection to this traffic 4 Select OK to save the policy IP pools An IP pool also called a dynamic IP pool is a range of IP addresses added to a firewall interface If you add IP pools to an interface you can select Dynamic IP Pool when you configure a policy with the destination set to this interface You can add an IP pool if you want to add NAT mode policies that translate source addresses to addresses randomly selected from the IP pool rather than being limited to the IP address of the destination interface If you add an IP pool to the internal interface you can s
63. create an IPSec VPN tunnel between the FortiGate unit and a remote IPSec VPN client or gateway that is also using manual key To add a manual key VPN tunnel 1 Go to VPN gt IPSec gt Manual Key 2 Select New to add a new manual key VPN tunnel 3 Type a VPN Tunnel Name The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed 4 Enter the Local SPI The Local Security Parameter Index is a hexadecimal number of up to eight digits digits can be 0 to 9 a to f in the range bb8 to FFFFFFF This number must be added to the Remote SPI at the opposite end of the tunnel FortiGate 800 Installation and Configuration Guide 233 Manual key IPSec VPNs 10 11 12 234 IPSec VPN Enter the Remote SPI The Remote Security Parameter Index is a hexadecimal number of up to eight digits digits can be 0 to 9 a to f in the range bb8 to FFFFFFF This number must be added to the Local SPI at the opposite end of the tunnel Enter the Remote Gateway This is the external IP address of the FortiGate unit or other IPSec gateway at the opposite end of the tunnel Select an Encryption Algorithm from the list Use the same algorithm at both ends of the tunnel Enter the Encryption Key Each two character combination entered in hexadecimal format represents one byte Depending on the encryption algorithm that you select you might be r
64. create an L2TP VPN your ISP s routers must support L2TP IPSec Internet Protocol Security A set of protocols that support secure exchange of packets at the IP layer IPSec is most often used to support VPNs 323 Glossary LAN Local Area Network A computer network that spans a relatively small area Most LANs connect workstations and personal computers Each computer on aLAN is able to access data and devices anywhere on the LAN This means that many users can share data as well as physical resources such as printers MAC address Media Access Control address A hardware address that uniquely identifies each node of a network MIB Management Information Base A database of objects that can be monitored by an SNMP network manager Modem A device that converts digital signals into analog signals and back again for transmission over telephone lines MTU Maximum Transmission Unit The largest physical packet size measured in bytes that a network can transmit Any packets larger than the MTU are divided into smaller packets before being sent Ideally you want the MTU your network produces to be the same as the smallest MTU of all the networks between your machine and a message s final destination If your messages are larger than one of the intervening MTUs they get broken up fragmented which slows down transmission speeds Netmask Also called subnet mask A set of rules for omitting parts of a complete IP address
65. defined 802 1Q VLAN support and stateful failover HA the FortiGate 800 is the choice for mission critical applications The flexibility reliability and easy management of the FortiGate 800 makes it a natural choice for enterprise applications FortiGate 800 Installation and Configuration Guide 15 Antivirus protection Introduction Antivirus protection FortiGate ICSA certified antivirus protection scans web HTTP file transfer FTP and email SMTP POP3 and IMAP content as it passes through the FortiGate unit If a virus is found antivirus protection removes the file containing the virus from the content stream and forwards a replacement message to the intended recipient For extra protection you can configure antivirus protection to block specified file types from passing through the FortiGate unit You can use the feature to stop files that might contain new viruses If the FortiGate unit contains a hard disk infected or blocked files can be quarantined The FortiGate administrator can download quarantined files so that they can be virus scanned cleaned and forwarded to the intended recipient You can also configure the FortiGate unit to automatically delete quarantined files after a specified time The FortiGate unit can send email alerts to system administrators when it detects and removes a virus from a content stream The web and email content can be
66. dialup monitor list showing dialup tunnel status fnVpnPPTP PPTP VPN configuration fnVpnL2TP L2TP VPN configuration fnVpnCert IPSec VPN with certificates configuration NIDS configuration Table 31 NIDS MIB fields fnNidsDetection NIDS detection configuration fnNidsPrevention NIDS prevention configuration fnNidsResponse NIDS response configuration Antivirus configuration Table 32 Antivirus MIB fields fnAvFileBlock Antivirus file blocking configuration fnAvQuarantine Antivirus quarantine configuration fnAVConfig Antivirus configuration including the current virus definition virus list Web filter configuration Table 33 Web filter MIB fields fnWebFiltercfgMsgTable Web filter content block list and configuration fnWebFilterUrIBIk Web filter URL block list fnWebFilterScripts Web filter script blocking configuration fnWebFilterExemptUrl Web filter exempt URL list Fortinet Inc System configuration Replacement messages Logging and reporting configuration Table 34 Logging and reporting MIB fields fnLoglogSetting Log setting configuration fnLoglog Log setting traffic filter configuration fnLogAlertEmail Alert email configuration Replacement messages Replacement messages are added to content passing through the firewall to replace e Files or other content removed from POP3
67. dns secondary lt IP address gt Example set system dns secondary 293 44 75 22 FortiGate 800 Installation and Configuration Guide 45 Connecting the FortiGate unit to your networks NAT Route mode installation Set the default route to the Default Gateway IP address not required for DHCP and PPPoE set system route number lt route_ no gt dst 0 0 0 0 0 0 0 0 gwl lt gateway ip gt Example set system route number 0 dst 0 0 0 0 0 0 0 0 gwl 204 23 1 2 Connecting the FortiGate unit to your networks we Se 46 After you complete the initial configuration you can connect the FortiGate unit between your internal network and the Internet You can also connect networks to the user defined interfaces that you configured There are 4 10 100 1000 Base TX connectors on the FortiGate 800 e Internal for connecting to your internal network e External for connecting to your public switch or router and the Internet e DMZ for connecting to a DMZ network e HA for connecting to another FortiGate 800 for high availability see High availability on page 73 There are 4 10 100 Base TX connectors on the FortiGate 800 e user defined interfaces 1 to 4 for connecting up to four additional networks to your FortiGate unit Note You can also create redundant connections to the Internet by connecting two interfaces to separate Internet connections For example you could connect the external interface and the DMZ interface or
68. filter Email block list 306 You can configure the FortiGate unit to tag all IMAP and POP3 protocol traffic sent from unwanted email addresses When the FortiGate unit detects an email sent from an unwanted address pattern the FortiGate unit adds a tag to the subject line of the email and writes a message to the email filter log Receivers can then use their mail client software to filter messages based on the subject tag You can tag email from a specific sender address or from all address subdomains by adding the top level domain name Alternatively you can tag email sent from individual subdomains by including the subdomain to block e Adding address patterns to the email block list e Downloading the email block list e Uploading an email block list Adding address patterns to the email block list 4 To add an address pattern to the email block list Go to Email Filter gt Block List Select New Type a Block Pattern e To tag email from a specific email address type the email address For example sender abccompany com To tag email from a specific domain type the domain name For example abccompany com e To tag email from a specific subdomain type the subdomain name For example mail abccompany com To tag email from an entire organization category type the top level domain name For example type com to tag email sent from all organizations that use com as the top level domain The pattern can contain num
69. followed by the Transparent mode management IP address By default in Transparent mode you can connect to the internal or DMZ interface The default Transparent mode management IP address is 10 10 10 1 FortiGate 800 Installation and Configuration Guide 109 Changing to NAT Route mode System status Changing to NAT Route mode Use the following procedure to change the FortiGate unit from Transparent mode to NAT Route mode After you change the FortiGate unit to NAT Route mode most of the configuration resets to NAT Route mode factory defaults The following items are not set to NAT Route mode factory defaults The admin administrator account password see Adding and editing administrator accounts on page 172 e HA settings see High availability on page 73 e Custom replacement messages see Replacement messages on page 181 To change to NAT Route mode Go to System gt Status Select Change to NAT Mode Select NAT Route in the operation mode list Select OK The FortiGate unit changes operation mode kh OO N 5 To reconnect to the web based manager you must connect to the interface configured by default for management access By default in NAT Route mode you can connect to the internal or DMZ interface The default Transparent mode management IP address is 192 168 1 99 See Connecting to the web based manager on page 28 or Connecting to the command line interface CLI on page 29
70. for additional security you can enter static routes to a specific FortiResponse server in addition to a default route to the external network If the static route becomes unavailable for example because the IP address of the FortiResponse server changes the FortiGate unit can still receive antivirus and NIDS updates from the FDN using the default route FortiGate 800 Installation and Configuration Guide 67 Transparent mode configuration examples Transparent mode installation 68 we Note This is an example configuration only To configure a static route you require a destination IP address Figure 12 Static route to an external destination i 24 102 233 5 FortiResponse Distribution Internet Network FDN Upstream DNS Gateway IP 192 168 1 2 Router DMZ Management IP 192 168 1 1 FortiGate 800 lt BAGO ooo Internal Network Management Computer General configuration steps Set the FortiGate unit to operate in Transparent mode Configure the Management IP address and Netmask of the FortiGate unit Configure the static route to the FortiResponse server Configure the default route to the external network Web based manager example configuration steps To configure the basic FortiGate settings and a static route using the web based manager Go to System gt Status e Select Change to Transparent Mode e Select Transparent in the Operation Mode list e
71. hard drive usage exceeds 90 On a FortiGate unit without a hard drive log to memory usage has exceeds 90 178 Fortinet Inc Configuring SNMP System configuration Fortinet MIB fields The Fortinet MIB contains fields for configuration settings and current status information for all parts of the FortiGate product This section lists the names of the high level MIB fields and describes the configuration and status information available for each one You can view more details about the information available from all Fortinet MIB fields by compiling the fortinet mib file into your SNMP manager and browsing the Fortinet MIB fields System configuration and status Table 27 System MIB fields MIB field Description fnSysStatus FortiGate system configuration including operation mode firmware version virus definition version attack definition version and serial number Status monitor information including current CPU usage CPU idle status CPU interrupts memory usage system up time the number of active communi cation sessions as well as descriptive information for each active communi cation session fnSysUpdate FortiGate system update configuration including connection status to the FDN push update status periodic update status and current virus and attack definitions versions fnSysNetwork FortiGate system network configuration including the interface VLAN rout ing DHCP zone and
72. in the traffic log To enable traffic logging for an interface Go to System gt Network gt Interface Select Edit in the Modify column beside the interface for which you want to enable logging For Log select Enable Select OK Repeat this procedure for each interface for which you want to enable logging Enabling traffic logging for a VLAN subinterface If you enable traffic logging for a VLAN subinterface all connections to and through the VLAN subinterface are recorded in the traffic log To enable traffic logging for a VLAN subinterface Go to System gt Network gt Interface Select Edit in the Modify column beside the VLAN subinterface for which you want to enable logging For Log select Enable Select OK Repeat this procedure for each VLAN subinterface for which you want to enable logging Enabling traffic logging for a firewall policy If you enable traffic logging for a firewall policy all connections accepted by the firewall policy are recorded in the traffic log To enable traffic logging for a firewall policy Go to Firewall gt Policy Select a policy tab Select Log Traffic Select OK FortiGate 800 Installation and Configuration Guide 315 Configuring traffic logging Logging and reporting Configuring traffic filter settings You can configure the information recorded in all traffic log messages To configure traffic filter settings 1 Go to Log amp Report gt Log Setting gt Traff
73. is down traffic destined for the 100 100 100 0 network is redirected out the DMZ interface to gateway 2 with the IP address 2 2 2 1 Load sharing and primary and secondary connections You can combine these routes into a more complete multiple Internet connection configuration In the topology shown in Figure 9 on page 51 users on the internal network connect to the Internet to access web pages and other Internet resources However they can also connect to services such as email provided by their ISPs You can combine the routes described in the previous examples to provide users with a primary and backup connection to the Internet while at the same time routing traffic to each ISP network as required The routing described below allows a user on the internal network to connect to the Internet through gateway 1 and ISP1 At the same time this user can also connect through gateway 2 to access a mail server maintained by ISP2 To add the routes using the web based manager Go to System gt Network gt Routing Table Select New to add the default route for primary and backup links to the Internet e Destination IP 0 0 0 0 e Mask 0 0 0 0 e Gateway 1 1 1 1 1 e Gateway 2 2 2 2 1 e Device 1 external e Device 2 dmz e Select OK FortiGate 800 Installation and Configuration Guide 53 Configuration example Multiple connections to the Internet NAT Route mode installation 3 Select New to add a route for connections to the n
74. manually Download the latest attack definitions update file from Fortinet and copy it to the computer that you use to connect to the web based manager Start the web based manager and go to System gt Status In the Attack Definitions Version section select Definitions Update SE Type the path and filename for the attack definitions update file or select Browse and locate the attack definitions update file Select OK to copy the attack definitions update file to the FortiGate unit The FortiGate unit updates the attack definitions This takes about 1 minute Go to System gt Status to confirm that the Attack Definitions Version information has updated FortiGate serial number Go to System gt Status The serial number is displayed on the System Status page of the web based manager The serial number is specific to the FortiGate unit and does not change with firmware upgrades FortiGate 800 Installation and Configuration Guide 107 Displaying the FortiGate up time System status Displaying the FortiGate up time Displaying log 1 1 Go to System gt Status The FortiGate up time displays the time in days hours and minutes since the FortiGate unit was last started hard disk status Go to System gt Status Log Hard Disk displays Available if the FortiGate unit contains a hard disk and Not Available if no hard disk is installed The FortiGate unit uses the hard disk to store log messages and quarantine files
75. name in the message are identical to the ID number and rule name that appear on the NIDS Signature Group Members list Fortinet Inc Network Intrusion Detection System NIDS Logging attacks The FortiGate unit uses an alert email queue in which each new message is compared with the previous messages If the new message is not a duplicate the FortiGate unit sends it immediately and puts a copy in the queue If the new message is a duplicate the FortiGate unit deletes it and increases an internal counter for the number of message copies in the queue The FortiGate unit holds duplicate alert email messages for 60 seconds If a duplicate message has been in the queue for more than 60 seconds the FortiGate unit deletes the message and increases the copy number If the copy number is greater than 1 the FortiGate unit sends a summary email that includes Repeated x times in the subject header the statement The following email has been repeated x times in the last y seconds and the original message Manual message reduction If you want to reduce the number of alerts that the NIDS generates you can review the content of attack log messages and alert email If a large number of the alerts are nuisance alerts for example web attacks when you are not running a web server you can disable the signature group for that attack type Use the ID number in the attack log or alert email to locate the attack in the signature group list See
76. number The display includes bar graphs of current CPU and memory usage as well as line graphs of CPU and memory usage for the past minute For more information see Viewing CPU and memory status on page 111 Fortinet Inc High availability Managing an HA cluster 3 Select Sessions amp Network The cluster displays sessions and network status for each cluster member The primary unit is identified as Local and the other units in the cluster are listed by serial number The display includes bar graphs of the current number of sessions and current network utilization as well as line graphs of session and network utilization usage for the last minute The line graph scales are shown in the upper left corner of the graph For more information see Viewing sessions and network status on page 112 Figure 17 Example cluster CPU memory and hard disk display Status Cluster Members Monitor Session Automatic Refresh Interval fo seconds x CPU Memory amp Hard Disk Sessions amp Network Virus amp Intrusions Packets and Bytes CPU 5 Memory Cluster Usage CPU Usage History Usage Memory Usage History Hard Disk C pope aoe MB Used Free fonds MB 4 Select Virus amp Intrusions The cluster displays virus and intrusions status for each cluster member The primary unit is identified as Local and the other units in the cluster are listed by serial number The
77. of the city or town where the FortiGate unit is located such as Vancouver Enter the name of the state or province where the FortiGate unit is located such as California or CA Select the country where the FortiGate unit is located Enter a contact email address for the FortiGate unit Typically email addresses are entered only for clients not gateways Select RSA as the key encryption type No other key type is supported Select 1024 Bit 1536 Bit or 2048 Bit Larger keys are slower to generate but more secure Not all IPSec VPN products support all three key sizes 7 Select OK to generate the private and public key pair and the certificate request The private public key pair are generated and the certificate request is displayed on the Local Certificates list with a status of Pending Figure 59 Adding a Local Certificate Local Certificates oN Certification Name User_One Generate Certificate Signing Request Subject Information Country e mail Key Type Key Size ID Type E mail z e mail one fortinet com Optional Information Orgnization Unit Orgnization Locality City State Province MFO Fortinet vancouver eo canab O 1024 Bit z FortiGate 800 Installation and Configuration Guide 243 Managing digital certificates 244 we s IPSec VPN Downloading the certificate request Use the following procedure to download a certificate request from the FortiGat
78. port Make sure that the TFTP server is running Copy the new firmware image file to the root directory of the TFTP server kh OO N Make sure that the internal interface is connected to the same network as the TFTP server FortiGate 800 Installation and Configuration Guide 99 Changing the FortiGate firmware System status 100 Ss To confirm that the FortiGate unit can connect to the TFTP server use the following command to ping the computer running the TFTP server For example if the IP address of the TFTP server is 192 168 1 168 enter execute ping 192 168 1 168 Enter the following command to restart the FortiGate unit execute reboot As the FortiGate units starts a series of system startup messages is displayed When one of the following messages appears e FortiGate unit running v2 x BIOS Press Any Key To Download Boot Image e FortiGate unit running v3 x BIOS Press any key to enter configuration menu Immediately press any key to interrupt the system startup Note You have only 3 seconds to press any key If you do not press a key soon enough the FortiGate unit reboots and you must log in and repeat the execute reboot command If you successfully interrupt the startup process one of the following messages appears e FortiGate unit running v2 x BIOS Enter TFTP Server Address 192 168 1 168 Go to step 9 e FortiGate unit running v3 x BIOS G Get firmware image from TFTP server F Forma
79. purchased a FortiCare Support Contract for this FortiGate unit enter the support contract number Select Finish The list of FortiGate products that you have registered is displayed The list now includes the new FortiGate unit Adding or changing a FortiCare Support Contract number a Ff WO N To add or change a FortiCare Support Contract number Go to System gt Update gt Support Select Support Login Enter your Fortinet support user name and password Select Login Select Add Change Contract number FortiGate 800 Installation and Configuration Guide 133 Updating registration information Virus and attack definitions updates and registration 134 Select the Serial Number of the FortiGate unit for which to add or change a FortiCare Support Contract number Add the new Support Contract number Select Finish The list of FortiGate products that you have registered is displayed The list now includes the new support contract information Changing your Fortinet support password on oo O N To change your Fortinet support password Go to System gt Update gt Support Select Support Login Enter your Fortinet support user name and password Select Login Select My Profile Select Change Password Enter your current password Enter and confirm a new password An email is sent to your email address confirming that your password has been changed Use your current user name and new password the next tim
80. router FortiGate unit VLAN Virtual Domain 1 External Internal as VLANI SNe vas VLAN2 VLAN1 NiD VLANI VLAN3 VLAN3 VLAN Switch I VLAN2 nternet z F VLAN trunk router VLAN trunk Virtual Domain 2 lt vVLAN2C0 ent fi ering VWLAN2 antivirus VLAN3 NIDS VLAN3 VLAN3 Fortinet Inc Network configuration Virtual domains in Transparent mode Virtual domain properties A virtual domain has the following exclusive properties e VLAN name e VLAN ID e VLAN interface assignment e VLAN zone assignment optional e Firewall policy Virtual domains share the following global properties with other processes on the FortiGate unit System settings e Firewall policy objects addresses services schedule content profiles and so on User information e NIDS settings e Antivirus Web filter Mail filter settings e Log amp report settings In addition to the global properties virtual domains share a common administrative model Administrators have access to all of the virtual domains on the FortiGate unit Only their administrative access level varies Configuring a virtual domain Configure a virtual domain by adding the virtual domain to the FortiGate configuration Then add matching pairs of VLAN subinterfaces to the virtual domain e Adding a virtual domain e Adding VLAN subinterfaces to a virtual domain e Adding zones to virtual domains Adding a virtual domain Use the following procedure to add a v
81. same as your VPN user name and password Fortinet Inc PPTP and L2TP VPN Configuring L2TP Configuring L2TP Some implementations of L2TP support elements of IPSec These elements must be disabled when L2TP is used with a FortiGate unit ue Note L2TP VPNs are only supported in NAT Route mode This section describes e Configuring the FortiGate unit as an L2TP gateway e Configuring a Windows 2000 client for L2TP Configuring a Windows XP client for L2TP Configuring the FortiGate unit as an L2TP gateway Use the following procedures to configure the FortiGate unit as an L2TP gateway To add users and user groups Add a user for each L2TP client 1 Go to User gt Local 2 Add and configure L2TP users See Adding user names and configuring authentication on page 224 Go to User gt User Group Add and configure L2TP user groups See Configuring user groups on page 229 To enable L2TP and specify an address range Go to VPN gt L2TP gt L2TP Range Select Enable L2TP Enter the Starting IP and the Ending IP for the L2TP address range Select the User Group that you added in To add users and user groups on page 263 Select Apply to enable L2TP through the FortiGate unit a fF WOW N FortiGate 800 Installation and Configuration Guide 263 Configuring L2TP 264 PPTP and L2TP VPN Figure 65 Sample L2TP address range configuration L2TP Range y Enable L2TP Starting IP 192 168 1
82. same interface IP addresses Connecting to any interface IP address configured for management access connects to that cluster interface which automatically connects you to the primary FortiGate unit in the cluster Fortinet Inc High availability Managing an HA cluster You can also use SNMP to manage the cluster by configuring a cluster interface for SNMP administrative access Using an SNMP manager you can get cluster configuration information and receive traps Note You cannot connect to the HA interfaces to manage the cluster or to manage individual FortiGate units in the cluster You can change the cluster configuration by connecting to the cluster and changing the configuration of the primary FortiGate unit The cluster automatically synchronizes all configuration changes to the subordinate units in the cluster as the changes are made The only configuration change that is not synchronized is the FortiGate host name You can give each cluster unit a unique host name to help to identify cluster members For information about changing the host name of cluster members see Changing cluster unit host names on page 84 You can use the web based manager to monitor the status and logs of individual cluster members See Monitoring cluster members on page 80 and Viewing and managing cluster log messages on page 82 You can manage individual cluster units by using SSH to connect to the CLI of the cluster From the CLI
83. script filter OPtionS 2cscccceceseceseeeeseceentendcceuestevedeneetamecdeneetehddecneetennddguenteneds 299 Exempt URL list ccc cece eee eeee eee ee aian maania AE AENEA EEA KETARA EEA ENEA 300 Adding URLs to the URL Exempt list 00 0 2 cee eeecee eee eeeneeeeeeeenaeeeeeeeaeeeeeeeaaeeeeeeenaaes 300 Downloading the URL Exempt List 0 eee eeeeeee eee eecneeeeeeeaaeeeeeeeaaeeeeeeeeaeeeeeeeaaas 301 Uploading a URL Exempt List eee cess eect ee eee ereeeeeeeaeeeeeeeeaeeeeeeeenaeeeeeeeaas 301 Email HS cnniacnniiiinaninnnnanininnienornna 303 General configuration Step ccceceseneeeeeeeeneeeeeeeeneeeedeaueneeeeecauansesedeneaneeeeeeeeeeeees 303 Email banned word liSl ececancrainiscrarii iti i a E 304 Adding words and phrases to the email banned word liSt escceeeeeeetteeeeeenes 304 Downloading the email banned word list cc ceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeaeeeeeeeeaeeees 305 Uploading the email banned word list 00 0 2 ce ceeeeceeeeeeeeeecneeeeeeeteneeeeeeeteneeeeeeetieeeeeren 305 Email DIOCK liS Cerren pistatened sedaneeed pane dane dsutdiareseacieeeb el eaddecee Gadinenee house sie 306 Adding address patterns to the email block list ec eeeeeeeeeeeeeeeeneeeeeeenaeeeeeeenaas 306 Downloading the email block list ec eeeereeeeeenee eee ee etne eee eeetaaeeeeeetiaeeeeeetiaeeeeer 306 Uploading an email block list rissies annaa AR 307 Email exempt liSt ccececeecceecee cee eee eee e
84. server 158 configuring DHCP relay 158 interface addressing mode 140 viewing a dynamic IP list 160 dialup L2TP configuring Windows 2000 client 265 configuring Windows XP client 267 dialup PPTP configuring Windows 2000 client 261 configuring Windows 98 client 260 configuring Windows XP client 261 dialup VPN viewing connection status 255 disabling NIDS 270 DMZ interface configuring 49 definition 323 DNS server addresses 153 do not log log option 311 domain DHCP 159 downloading attack definition updates 135 virus definition updates 135 downloading log files 320 dynamic IP list viewing 160 dynamic IP pool IP pool 192 dynamic IP MAC list 215 viewing 217 E email alert testing 321 email filter log 313 enabling policy 196 encrypt policy 191 encrypt policy allow inbound 192 allow outbound 192 Inbound NAT 192 Outbound NAT 192 ending IP address PPTP 258 263 environmental specifications 27 event log 313 viewing 317 exempt URL list 300 307 adding URL 300 308 FortiGate 800 Installation and Configuration Guide Index exempting URLs from content and URL blocking 300 307 expire system status 115 F factory default restoring system settings 109 FAQs 255 FDN connecting to 118 FortiResponse Distribution Network 118 FDS FortiResponse Distribution Server 118 filename pattern adding 282 blocking 281 filter RIP 165 Filtering 285 filtering log messages 313 filtering traffic 314 firewall authentication timeout 1
85. services without allowing unauthorized access to an internal private network Typically the DMZ contains servers accessible to Internet traffic such as Web HTTP servers FTP servers SMTP email servers and DNS servers DMZ interface The FortiGate interface that is connected to a DMZ network DNS Domain Name Service A service that converts symbolic node names to IP addresses Ethernet A local area network LAN architecture that uses a bus or star topology and supports data transfer rates of 10 Mbps Ethernet is one of the most widely implemented LAN standards A newer version of Ethernet called 100 Base T or Fast Ethernet supports data transfer rates of 100 Mbps And the newest version Gigabit Ethernet supports data rates of 1 gigabit 1 000 megabits per second External interface The FortiGate interface that is connected to the Internet For the FortiGate 60 the external interface is WAN1 or WAN2 FTP File transfer Protocol An application and TCP IP protocol used to upload or download files Gateway A combination of hardware and software that links different networks Gateways between TCP IP networks for example can link different subnetworks HTTP Hyper Text Transfer Protocol The protocol used by the World Wide Web HTTP defines how messages are formatted and transmitted and what actions Web servers and browsers should take in response to various commands HTTPS The SSL protocol for transmitting pr
86. set the external interface to use DHCP enter set system interfac xternal mode dhcp connection enable To set the external interface to use PPPoE enter set system interfac xternal mode pppoe username lt user name gt password lt password gt connection enable Example set system interfac xternal mode pppoe usernam user domain com password mypass connection enable Optionally set the IP address and netmask of the DMZ interface to the DMZ IP address and netmask that you recorded in Table 12 on page 43 Enter set system interface dmz mode static ip lt IP_address gt lt netmask gt Example set system interface dmz mode static ip 10 10 10 2 2096259 299 0 Set the IP address and netmask of interfaces 1 to 4 to the IP addresses and netmasks that you recorded in Table 12 on page 43 set system interface lt interface name gt mode static ip lt IP_address gt lt netmask gt Example To set the IP address of interface 3 to 192 45 56 73 and netmask to 255 255 255 0 enter set system interface port3 mode static ip 192 45 56 73 25525525570 Confirm that the addresses are correct Enter get system interface The CLI lists the IP address netmask and other settings for each of the FortiGate interfaces Set the primary DNS server IP addresses Enter set system dns primary lt IP address gt Example set system dns primary 293 44 75 21 Optionally set the secondary DNS server IP addresses Enter set system
87. steps to configure the external interface external default gateway and DMZ interface if required You have now completed the initial configuration of your FortiGate unit and you can proceed to Completing the configuration on page 49 Using the command line interface 44 As an alternative to using the setup wizard you can configure the FortiGate unit using the command line interface CLI For information about connecting to the CLI see Connecting to the command line interface CLI on page 29 Configuring the FortiGate unit to operate in NAT Route mode Use the information that you gathered in Table 10 on page 42 to complete the following procedure Configuring NAT Route mode IP addresses Make sure that you are logged into the CLI Set the IP address and netmask of the internal interface to the internal IP address and netmask that you recorded in Table 10 on page 42 Enter set system interface internal mode static ip lt IP_address gt lt netmask gt Example set system interface internal mode static ip 192 168 1 1 259293529350 Fortinet Inc NAT Route mode installation Using the command line interface Set the IP address and netmask of the external interface to the external IP address and netmask that you recorded in Table 10 on page 42 set system interfac xternal mode static ip lt IP_address gt lt netmask gt Example set system interfac xternal mode static ip 204 23 1 5 259325352950 To
88. the web based manager Go to System gt Status e Select Change to Transparent Mode e Select Transparent in the Operation Mode list e Select OK The FortiGate unit changes to Transparent mode Go to System gt Network gt Management e Change the Management IP and Netmask IP 192 168 1 1 Mask 255 255 255 0 e Select Apply Go to System gt Network gt Routing e Select New to add the static route to the management computer Destination IP 172 16 1 11 Mask 255 255 255 0 Gateway 192 168 1 3 e Select OK e Select New to add the default route to the external network Destination IP 0 0 0 0 Mask 0 0 0 0 Gateway 192 168 1 2 e Select OK CLI configuration steps To configure the FortiGate basic settings a static route and a default route using the CLI Set the system to operate in Transparent Mode set system opmode transparent Add the Management IP address and Netmask set system management ip 192 168 1 1 255 255 255 0 Add the static route to the management computer set system route number 1 dst 172 16 1 11 255 255 255 0 gwl 192 168 1 3 Add the default route to the external network set system route number 2 gwl 192 168 1 2 FortiGate 800 Installation and Configuration Guide 71 Transparent mode configuration examples 72 Transparent mode installation Fortinet Inc AT MET High availability Fortinet achieves high availability HA using redundant hardware and the FortiGate Clustering Pr
89. the FortiGate units in the cluster to each other and to your network You must connect all matching interfaces in the cluster to the same hub or switch Then you must connect these interfaces to their networks using the same hub or switch Fortinet recommends using switches for all cluster connections for the best performance The FortiGate units in the cluster use dedicated HA ethernet interfaces to communicate HA status information to make sure the cluster is functioning properly For this reason the connection between the HA interfaces of all the FortiGate units in the cluster must be well maintained An interruption of this communication can have unpredictable results Fortinet Inc High availability Configuring an HA cluster Inserting an HA cluster into your network temporarily interrupts communications on the network because new physical connections are being made to route traffic through the cluster Also starting the cluster interrupts network traffic until the individual FortiGate units in the cluster are functioning and the cluster completes negotiation Cluster negotiation normally takes just a few seconds During system startup and negotiation all network traffic is dropped To connect the cluster 1 Connect the cluster units Connect the internal interfaces of each FortiGate unit to a switch or hub connected to your internal network e Connect the external interfaces of each FortiGate unit to a switch or hub connected
90. the MAC address of the device When you add the MAC address of a device and an IP address to the reserve IP list the DHCP server always assigns this IP address to the device To add a reserve IP you must first select the interface and scope to which you want to add the reserve IP To add a reserve IP to a DHCP server 1 Go to System gt Network gt DHCP Select Reserve IP Select an interface You must configure the interface as a DHCP server before you can select it 4 Select a scope You must configure an address scope for the interface before you can select it 5 Select New to add a reserved IP 6 Configure the reserved IP IP Enter an IP address The IP address must be within the IP pool added to the selected scope MAC Enter the MAC address of the device Name Optionally specify a name for the IP and MAC address pair so Note The reserved IP cannot be assigned to any other device You can only add a given IP address or MAC address once 7 Select OK Viewing a DHCP server dynamic IP list You can view the list of IP addresses that the DHCP server has assigned their corresponding MAC addresses and the expiry time and date for these addresses To view a DHCP server dynamic IP list 1 Go to System gt Network gt DHCP Select Dynamic IP Select the interface for which you want to view the list 160 Fortinet Inc RAT MET RIP configuration The FortiGate implementation of the Routing Information Protocol R
91. the connection As a result connections to the Internet appear to be originating from any of the IP addresses in the IP pool IP MAC binding IP MAC binding protects the FortiGate unit and your network from IP spoofing attacks IP spoofing attacks try to use the IP address of a trusted computer to connect to or through the FortiGate unit from a different computer The IP address of a computer is easy to change to a trusted address but MAC addresses are added to ethernet cards at the factory and are not easy to change 214 Fortinet Inc Firewall configuration IP MAC binding You can enter the static IP addresses and corresponding MAC addresses of trusted computers in the static IP MAC table If you have trusted computers with dynamic IP addresses that are set by the FortiGate DHCP server the FortiGate unit adds these IP addresses and their corresponding MAC addresses to the dynamic IP MAC table For information about viewing the table see Viewing a DHCP server dynamic IP list on page 160 The dynamic IP MAC binding table is not available in Transparent mode You can enable IP MAC binding for packets in sessions connecting to the firewall or passing through the firewall Note If you enable IP MAC binding and change the IP address of a computer with an IP or MAC address in the IP MAC list you must also change the entry in the IP MAC list or the computer does not have access to or through the FortiGate unit You must also add t
92. the management IP address and netmask Configure the Transparent mode default gateway 1 Make sure that you are logged into the CLI 2 Set the default route to the default gateway that you recorded in Table 16 on page 59 Enter set system route number lt number gt gwl lt IP address gt Example set system route number 0 gwl 204 23 1 2 Completing the configuration Use the information in this section to complete the initial configuration of the FortiGate unit Setting the date and time For effective scheduling and logging the FortiGate system date and time must be accurate You can either manually set the system date and time or configure the FortiGate unit to automatically keep its time correct by synchronizing with a Network Time Protocol NTP server For information about setting the FortiGate system date and time see Setting system date and time on page 169 Enabling antivirus protection You can protect users on your internal network from downloading a virus from the Internet Go to Firewall gt Policy gt Internal gt External Select Edit to edit this policy Select Anti Virus amp Web filter to enable antivirus protection for this policy Select the Scan Content Profile a Ff WO N Select OK to save the changes 62 Fortinet Inc Transparent mode installation Connecting the FortiGate unit to your networks Registering your FortiGate unit After purchasing and installing a new FortiGate uni
93. the previous configuration from the backup configuration file A Note Installing firmware replaces the current antivirus and attack definitions with the definitions S included with the firmware release that you are installing After you install new firmware use the procedure Manually initiating antivirus and attack definitions updates on page 119 to make sure that antivirus and attack definitions are up to date To revert to a previous firmware version using the web based manager 1 Copy the firmware image file to your management computer 2 Log into the FortiGate web based manager as the admin administrative user 3 Goto System gt Status 4 Select Firmware Upgrade ie 5 Type the path and filename of the previous firmware image file or select Browse and locate the file 6 Select OK The FortiGate unit uploads the firmware image file reverts to the old firmware version resets the configuration restarts and displays the FortiGate login This process takes a few minutes 7 Log into the web based manager For information about logging into the web based manager when the FortiGate unit is set to factory defaults see Connecting to the web based manager on page 28 8 Go to System gt Status and check the Firmware Version to confirm that the firmware is successfully installed 9 Restore your configuration For information about restoring your configuration see Restoring system settings on page 108 10 Update antivir
94. to reach a target destination without using a broadcast message It can indicate a subnetwork portion of a larger network in TCP IP Sometimes referred to as an Address Mask NTP Network Time Protocol Used to synchronize the time of a computer to an NTP server NTP provides accuracies to within tens of milliseconds across the Internet relative to Coordinated Universal Time UTC Packet A piece of a message transmitted over a packet switching network One of the key features of a packet is that it contains the destination address in addition to the data In IP networks packets are often called datagrams Ping Packet Internet Grouper A utility used to determine whether a specific IP address is accessible It works by sending a packet to the specified address and waiting for a reply POP3 Post Office Protocol A protocol used to transfer e mail from a mail server to a mail client across the Internet Most e mail clients use POP 324 PPP Point to Point Protocol A TCP IP protocol that provides host to network and router to router connections PPTP Point to Point Tunneling Protocol A Windows based technology for creating VPNs PPTP is supported by Windows 98 2000 and XP To create a PPTP VPN your ISP s routers must support PPTP Port In TCP IP and UDP networks a port is an endpoint to a logical connection The port number identifies what type of port it is For example port 80 is used for HTTP traffic Protocol A
95. to the CLI using the null modem cable and FortiGate console port Make sure that the TFTP server is running Copy the new firmware image file to the root directory of your TFTP server To confirm that the FortiGate unit can connect to the TFTP server use the following command to ping the computer running the TFTP server For example if the IP address of the TFTP server is 192 168 1 168 execute ping 192 168 1 168 Enter the following command to restart the FortiGate unit execute reboot As the FortiGate unit starts a series of system startup messages are displayed When one of the following messages appears Press any key to enter configuration menu Immediately press any key to interrupt the system startup Note You have only 3 seconds to press any key If you do not press a key soon enough the FortiGate unit reboots and you must log in and repeat the execute reboot command If you successfully interrupt the startup process one of the following messages appears G Get firmware image from TFTP server Format boot device Boot with backup firmware and set as default Quit menu and continue to boot with default firmware Display this list of options F By Q H Enter G F B Q or H Type G to get the new firmware image from the TFTP server Type the address of the TFTP server and press Enter The following message appears Enter Local Address 192 168 1 188 Type the address of th
96. to the Members list 5 To remove services from the service group select a service from the Members list and select the left arrow to remove it from the group 6 Select OK to add the service group Figure 44 Adding a service group New Service Group Group Name web_Services Available Services Members Schedules Use schedules to control when policies are active or inactive You can create one time schedules and recurring schedules You can use one time schedules to create policies that are effective once for the period of time specified in the schedule Recurring schedules repeat weekly You can use recurring schedules to create policies that are effective only at specified times of the day or on specified days of the week This section describes e Creating one time schedules e Creating recurring schedules e Adding schedules to policies FortiGate 800 Installation and Configuration Guide 205 Schedules Firewall configuration Creating one time schedules You can create a one time schedule that activates or deactivates a policy for a specified period of time For example your firewall might be configured with the default policy that allows access to all services on the Internet at all times You can add a one time schedule to block access to the Internet during a holiday period To create a one time schedule 1 Go to Firewall gt Schedule gt One time Select New Type a Name fo
97. to use a one time schedule to deny access to a policy add a policy that matches the policy to be denied in every way Choose the one time schedule that you added and set Action to DENY Then place the policy containing the one time schedule in the policy list above the policy to be denied Use virtual IPs to access IP addresses on a destination network that are hidden from the source network by NAT security policies To allow connections between these networks you must create a mapping between an address on the source network and the real address on the destination network This mapping is called a virtual IP For example if the computer hosting your web server is located on your DMZ network it could have a private IP address such as 10 10 10 3 To get packets from the Internet to the web server you must have an external address for the web server on the Internet You must then add a virtual IP to the firewall that maps the external IP address of the web server to the actual address of the web server on the DMZ network To allow connections from the Internet to the web server you must then add an external gt DMZ firewall policy and set Destination to the virtual IP You can create two types of virtual IPs Static NAT Used to translate an address on a source network to a hidden address on a destination network Static NAT translates the source address of return packets to the address on the source network Port Forwarding Used to translate
98. to user defined interface 4 FortiGate 800 Installation and Configuration Guide 47 Configuring your networks NAT Route mode installation Figure 8 Example FortiGate 800 user defined interface connections Internal Network Hub or Switch User defined Interface 1 FortiGate 800 User defined Interface 4 Public Switch or Router aae Internet Configuring your networks If you are running the FortiGate unit in NAT Route mode your networks must be configured to route all Internet traffic to the IP address of the FortiGate interface to which they are connected Make sure that the connected FortiGate unit is functioning properly by connecting to the Internet from a computer on your internal network You should be able to connect to any Internet address 48 Fortinet Inc NAT Route mode installation Completing the configuration Completing the configuration Use the information in this section to complete the configuration of the FortiGate unit Configuring the DMZ interface Use the following procedure to configure the DMZ interface Log into the web based manager Go to System gt Network gt Interface Choose the dmz interface and select Modify z Change the IP address and Netmask as required a Fk WO N Select Apply Configuring interfaces 1 to 4 Use the following procedure to configure the eight user defined interfaces
99. traffic allowed by policies See e Antivirus scanning on page 280 e File blocking on page 281 e Blocking oversized files and emails on page 286 e Exempting fragmented email from blocking on page 287 4 Configure file quarantine settings to control the quarantining of infected or blocked files by traffic type age and file size See Configuring quarantine options on page 285 5 Configure the messages that users receive when the FortiGate unit blocks or deletes an infected file See Replacement messages on page 181 FortiGate 800 Installation and Configuration Guide 279 Antivirus scanning Antivirus protection Configure the FortiGate unit to send an alert email when it blocks or deletes an infected file See Configuring alert email in the Logging and Message Reference Guide Note For information about receiving virus log messages see Configuring logging and for information about log message content and format see Virus log messages in the Logging Configuration and Reference Guide Antivirus scanning 280 Virus scanning intercepts most files including files compressed with up to 12 layers of compression using zip rar gzip tar upx and OLE in the content streams for which you enable antivirus protection Each file is tested to determine the file type and the most effective method of scanning the file for viruses For example binary files are scanned using binary virus
100. unit reverts to the old firmware version resets the configuration to factory defaults and restarts This process takes a few minutes Reconnect to the CLI For information about logging into the CLI when the FortiGate unit is set to factory defaults see Connecting to the command line interface CLI on page 29 To confirm that the new firmware image has been loaded enter get system status Restore your previous configuration Use the following command xecute restore config Fortinet Inc System status Changing the FortiGate firmware 11 Update antivirus and attack definitions For information see Manually initiating antivirus and attack definitions updates on page 119 or from the CLI enter execute updatecenter updatenow 12 To confirm that the antivirus and attack definitions have been updated enter the following command to display the antivirus engine virus and attack definitions version contract expiry and last update attempt information get system objver Installing firmware images from a system reboot using the CLI This procedure installs a specified firmware image and resets the FortiGate unit to default settings You can use this procedure to upgrade to a new firmware version revert to an older firmware version or re install the current firmware version Note This procedure varies for different FortiGate BIOS versions These variations are explained in the procedure steps that are affected The versio
101. value that defines the structure of the communication between the peers With other methods the SPI is generated automatically but with the manual key configuration it must be entered as part of the VPN setup The encryption and authentication keys must match on the local and remote peers that is the SPI values must be mirror images of each other After you enter these values the VPN tunnel can start without a need for the authentication and encryption algorithms to be negotiated Provided you entered correct complementary values the tunnels are established between the peers This means that the tunnel already exists between the peers As a result when traffic matches a policy requiring the tunnel it can be authenticated and encrypted immediately e General configuration steps for a manual key VPN e Adding a manual key VPN tunnel General configuration steps for a manual key VPN A manual key VPN configuration consists of a manual key VPN tunnel the source and destination addresses for both ends of the tunnel and an encrypt policy to control access to the VPN tunnel To create a manual key VPN configuration 1 Add a manual key VPN tunnel See Adding a manual key VPN tunnel on page 233 2 Configure an encrypt policy that includes the tunnel source address and destination address for both ends of the tunnel See Configuring encrypt policies on page 245 Adding a manual key VPN tunnel Configure a manual key tunnel to
102. well as line graphs of session and network utilization usage for the last minute The line graph scales are shown in the upper left corner of the graph Set the automatic refresh interval and select Go to control how often the web based manager updates the display More frequent updates use system resources and increase network traffic However this only occurs when you are viewing the display using the web based manager Fortinet Inc System status 4 System status Select Refresh to manually update the information displayed Figure 20 Sessions and network status monitor Automatic Refresh Interval 10 seconds CPU amp Memory Sessions amp Network Virus amp Intrusions Sessions Session History LJ SrHESCHHioceat last 1 min Network Utilization Network Utilization History LJ Pree EEEn EE last 1 min Viewing virus and intrusions status Use the virus and intrusions status display to track when viruses are found by the FortiGate antivirus system and to track when the NIDS detects a network based attack To view virus and intrusions status Go to System gt Status gt Monitor Select Virus amp Intrusions Virus and intrusions status is displayed The display includes bar graphs of the number viruses and intrusions detected per hour as well as line graphs of the number of viruses and intrusions detected for the last 20 hours Set the automatic refresh interval and select Go to c
103. word or phrase is added to the Banned Word list You can enable all the words on the banned word list by selecting Check All You can disable all the words on the banned word list by selecting Uncheck All Note Banned Word must be selected in the content profile for web pages containing banned words to be blocked Figure 70 Example banned word list Content Block A Banned Word Modify banned i Vv banned phrase 1 T w amp Vv banned phrase 2 rT Bw IV Clearing the Banned Word list 1 2 Go to Web Filter gt Content Block Select Clear List E to remove all banned words and phrases from the banned word list FortiGate 800 Installation and Configuration Guide 291 Content blocking 292 Web filtering Backing up the Banned Word list You can back up the banned word list by downloading it to a text file on the management computer To back up the banned word list Go to Web Filter gt Content Block Select Backup Banned Word List EJ The FortiGate unit downloads the list to a text file on the management computer You can specify a location to which to download the text file as well as a name for the text file Restoring the Banned Word list You can create a Banned Word list in a text editor and then upload the text file to the FortiGate unit Add one banned word or phrase to each line of the text file The word or phrase should be followed by two parameters separated by spaces The first parame
104. 09 Changing to Transparent MOG ceccccceceeeeeceeeeeeeneeeeeeeeneeesesenneeeeesnaaseeeeensneaeeeenneneaes 109 Changing to NAT Route Mode is ccccesccccccet cece cccsennee cedeubeneeeecdbneene A AN E aala 110 Restarting the FortiGate Unit ccccceecceceeeeeeeceettepenecensbeesedccenbepenecensteedeceetteesededenneeees 110 Shutting down the FortiGate Unit osisesiiissnsiiiia neiii ann EAA ANRA EANA E a EA 110 System StatUS 00 0 eee eect etree terre neat EENEN EEANN ENERE eeeeaaeeeeeeeaaaeeeeseeaaeeeseeenaeeeeeeeeaes 111 Viewing CPU and memory Status 2 cece ee eete eee cette eee eeeaaeeeeeeeaaeeeeeeeaaeeeeeeeaaas 111 Viewing sessions and network Status ccccceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaeeeeeeeenaeeeeeseaaas 112 Viewing virus and intrusions StatUS 20 0 0 cece eeeeeennee eee eeeaaeeeeeeeaaaeeeeeeenaaeeeeeeeaaas 113 DOSSIOMN MISbite eset stecanieesie ees Hentai alae dena ama aides 114 Virus and attack definitions updates and registration ccccceeeeeeeeeees 117 Updating antivirus and attack definitions 0 0 cece eee eeeeeeeeeeseeeeeeeeseeenaeeeseeeaeeees 117 Connecting to the FortiResponse Distribution Network ceceeeeeeeeeeeeeeeeeeeenaees 118 Manually initiating antivirus and attack definitions Updates eeeeeeeeeeeeeetees 119 Configuring update logging 2 ccccceeeceeeeeeseeeeeeeeneeeeeeeeeaneeeeeeeaueeecedeneeneeseeeeeeneees 120 Scheduling Upd ES cciana aitia a aadi dhad
105. 096 subinterfaces Zones N A N A N A 100 100 100 100 100 200 300 500 500 Virtual domains N A N A N A 16 32 64 64 64 128 512 512 512 DHCP address 32 32 32 32 32 32 32 32 32 32 32 32 scopes DHCP reserved 10 20 30 30 50 50 100 100 200 200 200 200 IP MAC pairs Firewall policies 200 500 1000 2000 5000 5000 20000 20000 50000 50000 50000 50000 Firewall 500 500 500 500 3000 3000 6000 6000 10000 10000 10000 10000 addresses Firewall address 500 500 500 500 500 500 500 500 500 500 500 500 groups Firewall custom 500 500 500 500 500 500 500 500 500 500 500 500 services Firewall service 500 500 500 500 500 500 500 500 500 500 500 500 groups Firewall recurring 256 256 256 256 256 256 256 256 256 256 256 256 schedules Firewall onetime 256 256 256 256 256 256 256 256 256 256 256 256 schedules Firewall virtual 500 500 500 500 500 500 500 500 500 500 500 500 IPs Firewall IP pools 50 50 50 50 50 50 50 50 50 50 50 50 Includes the number of physical interfaces FortiGate 800 Installation and Configuration Guide 39 Next steps Getting started Table 9 FortiGate maximum values matrix FortiGate model 50 60 100 200 300 400 500 800 1000 3000 3600 4000 IP MAC binding 500 500 500 500 500 500 500 500 500 500 500 500 table entries Firewall content 32 32 32 32 32 32 32 32 32 32 32 32 profiles User names 20 500 1000
106. 1 Advanced NAT Route mode settings ccccccecceeeeeeeeeennneeeeeeenaeeeeeeenaaeeeeeeeeneeeeeeeeaas 42 DMZ and user defined interfaces ccccccecceccccceeeeecceeeeeeeeceeeneeeacaeneneeeacaneeeneeaaneenteeaee 43 Using the setup WIZAI sses a oteetda peated Ad AAEE E pe eel 43 Starting the setup WIZANG sssr ranna EENE ci lena geet devdntge catvlioneaegeeees 43 Reconnecting to the web based manager seececeeeeeeeeeeeeeeeeeeeeeeeeenaeeeeeeeetaeeeeeeenaas 43 Using the front control buttons and LCD cceeeeeeeeeeeeeeeeeeeeeeeeeseeeeaeeeeteeeaeeeeeeenaeeees 44 Using the command linge Interface cccceteaeieecneececdenitieaecceeataauecetaseaessteateaedestiiieaeeetes 44 Configuring the FortiGate unit to operate in NAT Route mode 0 cccceeeeeeeeeeees 44 Connecting the FortiGate unit to your NEtWOFKS ee ee eeene eee eeenteeeeeeeeeaeeeeeeeenateeeeeenaees 46 Configuring your NEtWOFKS 20 2 2 eeeeeeeeeeene eee eeeeeeeeeeeeeeeaeeeeeeeeaaeeeeseeaaaeeeeseeaaeeeeseenaeeeeeesenaees 48 Completing the Configuration c cece eeeeeneeeeeeeeneeeeeeeeaeeeeeeeaaaeeeeeeeeeeeeseeeiteeeeeenaees 49 Configuring the DMZ interface sorrara E OEE 49 Configuring interfaces 1 tO 4 eecscnicrccicriii arii a cansieeei deanna anda 49 Setting the date and time ccc ci ctelie ti ditvendeddineeeesediercnadiainenaslietenaddinenaeianens 49 Changing antivirus Protection cccccccceeceeeeeeeeeeeeeeeeeeeeeeeeeseeeee
107. 1000 1000 1000 1000 1000 1000 1000 1000 1000 Radius servers 6 6 6 6 6 6 6 6 6 6 6 6 LDAP servers 6 6 6 6 6 6 6 6 6 6 6 6 User groups 100 100 100 100 100 100 100 100 100 100 100 100 Total number of 300 300 300 300 300 300 300 300 300 300 300 300 user group members IPSec remote 20 50 80 200 1500 1500 3000 3000 5000 5000 5000 5000 gateways Phase 1 IPSec VPN 20 50 80 200 1500 1500 3000 3000 5000 5000 5000 5000 tunnels Phase 2 IPSec VPN 500 500 500 500 500 500 500 500 500 500 500 500 concentrators PPTP users 500 500 500 500 500 500 500 500 500 500 500 500 L2TP users 500 500 500 500 500 500 500 500 500 500 500 500 NIDS user defined 100 100 100 100 100 100 100 100 100 100 100 100 signatures Antivirus file 56 56 56 56 56 56 56 56 56 56 56 56 block patterns Web filter and Limit varies depending on available system memory Fortinet recommends limiting total size of web and email filter lists email filter lists to 4 Mbytes or less If you want to use larger web filter lists consider using Cerberian web filtering Log setting traffic 50 50 50 50 50 50 50 50 50 50 50 50 filter entries Includes the number of physical interfaces Next steps 40 Now that your FortiGate unit is operating you can proceed to configure it to connect to networks If you are going to operate the FortiGate unit in NAT Route mode go to NAT Route mode installation on page 41 If you are going to operate the FortiGa
108. 2 Select Clear URL Block List Ea to remove all URLs and patterns from the Web URL block list 294 Fortinet Inc Web filtering URL blocking Downloading the Web URL block list You can back up the Web URL block list by downloading it to a text file on the management computer To download a Web URL block list 1 Go to Web Filter gt Web URL Block 2 Select Download URL Block List EH The FortiGate unit downloads the list to a text file on the management computer You can specify a location to which to download the text file as well as a name for the text file Uploading a URL block list You can create a URL block list in a text editor and then upload the text file to the FortiGate unit Add one URL or pattern to each line of the text file You can follow the item with a space and then a 1 to enable or a zero 0 to disable the URL If you do not add this information to the text file the FortiGate unit automatically enables all URLs and patterns that are followed by a 1 or no number when you upload the text file Figure 73 Example URL block list text file www badsite com index 1 www badsite com products 1 182 63 44 67 index 1 You can either create the URL block list or add a URL list created by a third party URL block or blacklist service For example you can download the squidGuard blacklists available at http www squidguard org blacklist as a starting point for creating a URL block list Three times per week th
109. 2TP PPTP and L2TP VPN To disable IPSec Select the Networking tab Select Internet Protocol TCP IP properties Double click the Advanced tab Go to the Options tab and select IP security properties Make sure that Do not use IPSEC is selected aoa fF WON Select OK and close the connection properties window A Note The default Windows XP L2TP traffic policy does not allow L2TP traffic without IPSec encryption You can disable default behavior by editing the Windows XP Registry as described in the following steps See the Microsoft documentation for editing the Windows Registry T Use the registry editor regedit to locate the following key in the registry HKEY LOCAL MACHINE System CurrentControlSet Services Rasman Parameters 8 Add the following registry value to this key Value Name ProhibitIpSec Data Type REG DWORD Value 1 9 Save the changes and restart the computer for the changes to take effect You must add the ProhibitIpSec registry value to each Windows XP based endpoint computer of an L2TP or IPSec connection to prevent the automatic filter for L2TP and IPSec traffic from being created When the ProhibitIpSec registry value is set to 1 your Windows XP based computer does not create the automatic filter that uses CA authentication Instead it checks for a local or active directory IPSec policy To connect to the L2TP VPN Connect to your ISP Start the VPN connection that you configured in the previo
110. 3 x BIOS Press any key to enter configuration menu Immediately press any key to interrupt the system startup Note You have only 3 seconds to press any key If you do not press a key soon enough the FortiGate unit reboots and you must log in and repeat the execute reboot command If you successfully interrupt the startup process one of the following messages appears e FortiGate unit running v2 x BIOS Enter TFTP Server Address 192 168 1 168 Go to step 9 e FortiGate unit running v3 x BIOS Get firmware image from TFTP server Format boot device Quit menu and continue to boot with default firmware Display this list of options Enter G F Q or H Type G to get the new firmware image from the TFTP server Fortinet Inc System status 11 12 13 Changing the FortiGate firmware Type the address of the TFTP server and press Enter The following message appears Enter Local Address 192 168 1 188 Type the address of the internal interface of the FortiGate unit and press Enter Note The local IP address is used only to download the firmware image After the firmware is installed the address of this interface is changed back to the default IP address for this interface The following message appears Enter File Name image out Enter the firmware image file name and press Enter The TFTP server uploads the firmware image file to the FortiGate unit and messages similar to the following
111. 5 Adding a source address 00 eeeeceeee cette eect eette ee eee etae ee ee eeaeee eee etaeeeeeeeaaeeeesesiaeeeseeeaas 246 Adding a destination AddreSS cccccicceeeeeteee tere eeneeeeeeeineeeeeeeeeeeeeetiieeeeeeetiieeeeeeenaa 247 Adding an enciypt POllCysicccccsve dcccervenentcacsspecccadebespiacaces vamsdeadevvaseacdeerssancandvives dd ctezeveende 247 IPSec VPN concentrators ssion pected aerate eae 249 VPN concentrator hub general configuration steps 0 00 0 eceeeeeeeeeteeeeeeeenteeeeeeeaas 250 Adding a VPN Concentrator eeeceeceeee tenner eee eecneeeeeeeaaeeeeeeeaeeeeeeeenaeeeeeeeeieeeeeseaaas 251 VPN spoke general configuration stepS ce eeececceeeeeeeeeeeeeeetcneeeeeeetaeeeeeeenaeeeeeseaas 252 Redundant IPSec VPNS eee eeeeeceeceeeee tere eeenee eee eeeeeaeeeeeeeeaaeeeeeeeeaaeeeeeeeaaeeeeseeiaeeeeeeenaaes 253 Configuring redundant IPSec VPNS cceceeeseeeeeeeeeeeeeeseeeeeeeeeseeeaeeeeeeeeaaeeeeteeaaaees 254 Monitoring and Troubleshooting VPNS cceccceeeeeeeeceeeeceeeeeeeeeseneeeeeeesenaaeeeeeeeeaaeees 255 Viewing VPN tunnel Status coi jccecdaussedeedeielasaececd en sgedede aud saceeds ih caededesieeceeediecden neds 255 Viewing dialup VPN connection Status 0 0 ee ceececeeeeeeeneeeeeeeeneeeeeeeeaeeeeeeeenaeeeeeeeeaes 255 Testing a VPN eee 256 PPIP and L2TP VPN ciaren N 257 Contiguning PP TF naeia O O aveeeeeieceden asses 257 Configuring the FortiGate unit as a PPTP gateway
112. 70 configuring 185 introduction 17 overview 185 firewall address adding to a virtual domain 152 firewall events enabling alert email 322 firewall policy accept 191 adding for a virtual domain 152 Comments 194 deny 191 guaranteed bandwidth 192 Log Traffic 194 maximum bandwidth 193 firewall setup wizard 20 43 60 starting 43 60 firmware changing 94 installing 99 re installing current version 99 reverting to an older version 99 upgrading 94 upgrading to a new version 95 upgrading using the CLI 95 97 upgrading using the web base manager 95 96 first trap receiver IP address SNMP 175 fixed port 192 FortiCare service contracts 129 support contract number 133 Fortinet customer service 23 Fortinet support recovering a lost password 132 329 Index FortiResponse Distribution Network 118 connecting to 118 FortiResponse Distribution Server 118 from IP system status 115 from port system status 115 front keypad and LCD configuring IP address 61 G get community SNMP 175 grouping services 204 groups address 199 user 229 guaranteed bandwidth 192 H HA 73 connecting a NAT Route mode cluster 76 introduction 19 managing HA group 78 NAT Route mode 74 replacing FortiGate unit after fail over 87 hard disk recording logs 311 status 108 hard disk full alert email 322 high availability 73 introduction 19 HTTP enabling web filtering 289 303 HTTPS 20 201 323 ICMP 202 323 configuring checksum verification 270 I
113. AC_V which is a virtual MAC address created by the HA cluster The virtual MAC address is 00 09 0f 06 ff 00 Switch 1 and 2 know where the virtual MAC address and the real MAC address are Packets are routed through the subordinate unit as follows A request packet from a client on the internal network to a server on the external network 1 Source is MAC_C and destination is MAC_V from client to primary Source is MAC_V and destination is MAC_S_I from primary to subordinate internal Source is MAC_S_E and destination is MAC_S from subordinate external to server A response packet from a server on the external network to a client on the internal network 1 Source is MAC_S and destination is MAC_V from server to primary Source is MAC_V and destination is MAC_S_E from primary to subordinate external Source is MAC_S_ and destination is MAC_C from subordinate internal to client Configuring switches to work with a NAT Route mode cluster Some switch vendors use a Global MAC address table for the entire switch instead of multiple MAC address tables one for each interface and VLAN The Global MAC address table feature causes interoperability problems with FortiGate HA For a switch to work with FortiGate HA the switch should support and be configured to use individual MAC address tables for each switch interface 90 Fortinet Inc High availability Active Active cluster packet flow The following are examples of switches that ar
114. AN subinterface or zone VLAN subinterfaces or zones only appear in the source and destination lists if they have been added to the selected virtual domain and if you have added firewall addresses for them The source and destination cannot be the same VLAN subinterface or zone Select New to add a new policy Configure the policy Select OK to add the policy 152 Fortinet Inc Network configuration Adding DNS server IP addresses Deleting virtual domains You must remove all VLAN subinterfaces and zones that have been added to the virtual domain before you can delete the virtual domain To remove VLAN subinterfaces and zones you must remove all firewall policies and firewall addresses for the VLAN subinterfaces and zones You can only delete virtual domains that have the Delete icon beside them in the zone list Delete the virtual domain components in the following order e firewall policies source and destination addresses e VLAN subinterfaces zones e the virtual domain Adding DNS server IP addresses Several FortiGate functions including sending email alerts and URL blocking use DNS Use the following procedure to add the IP addresses of the DNS servers that your FortiGate unit can connect to DNS server IP addresses are usually supplied by your ISP To add DNS server IP addresses 1 Go to System gt Network gt DNS Change the primary and secondary DNS server IP addresses as required Select Apply to save the c
115. AT device and a custom port to the IP address of the FortiGate unit on the internal network This IP address can either be the external IP address of the FortiGate unit if it is operating in NAT Route mode or the Management IP address of the FortiGate unit if it is operating in Transparent mode Note This example describes the configuration for a FortiGate NAT device However you can use any NAT device with a static external IP address that can be configured for port forwarding Fortinet Inc Virus and attack definitions updates and registration Enabling push updates Figure 24 Example network topology Push updates through a NAT device u FortiResponse gt Distribution e i w Network FDN Internet Push update to D IP address 64 230 123 149 and port 45001 External IP 64 230 123 149 Virtual IP maps FortiGate 300 64 230 123 149 45001 NAT Device to 192 168 1 99 9443 External IP or Management IP 192 168 1 99 FortiGate 800 ForRriner Internal Network e seeses General procedure Use the following steps to configure the FortiGate NAT device and the FortiGate unit on the internal network so that the FortiGate unit on the internal network can receive push updates 1 Add a port forwarding virtual IP to the FortiGate NAT device 2 Add a firewall policy to the FortiGate NAT device that includes the port forwarding virtual IP 3 Configure the FortiGate unit on the in
116. AT mode policies controlling 10 10 10 1 traffic between internal and external networks 10 10 10 2 36 Fortinet Inc Getting started Planning the FortiGate configuration NAT Route mode with multiple external network connections In NAT Route mode you can configure the FortiGate unit with multiple redundant connections to the external network usually the Internet For example you could create the following configuration e External is the default interface to the external network usually the Internet e Interface 1 is the redundant interface to the external network e Internal is the interface to the internal network e DMZ is the interface to the DMZ network You must configure routing to support redundant Internet connections Routing can be used to automatically redirect connections from an interface if its connection to the external network fails Otherwise security policy configuration is similar to a NAT Route mode configuration with a single Internet connection You would create NAT mode policies to control traffic flowing between the internal private network and the external public network usually the Internet If you have multiple internal networks such as a DMZ network in addition to the internal private network you could create route mode policies for traffic flowing between them Figure 5 Example NAT Route multiple internet connection configuration Internal network 192 168 1 3 FortiGate 800 U
117. CMP service custom 204 idle timeout web based manager 170 IDS log viewing 317 IKE 323 IMAP 201 323 Inbound NAT encrypt policy 192 330 interface adding a DHCP server 158 administrative access 143 administrative status 139 changing administrative status 139 configuring user defined 49 DHCP 140 management access 143 manual IP address 140 MTU size 144 ping server 142 PPPoE 141 RIP 163 secondary IP address 142 traffic logging 144 user defined 49 viewing the interface list 139 internal address example 198 internal address group example 200 internal network configuring 48 Internet blocking access to Internet sites 293 306 blocking access to URLs 293 306 Internet key exchange 323 intrusion attempts alert email 322 intrusion status 113 IP configuring checksum verification 270 IP address interface 140 IP MAC binding 214 IP addresses configuring from the CLI 61 configuring with front keypad and LCD 44 61 IP pool adding 213 IP service custom 204 IP spoofing 214 IP MAC binding 214 adding 216 allow traffic 216 block traffic 216 dynamic IP MAC list 215 enabling 217 static IP MAC list 215 IPSec 323 Fortinet Inc IPSec VPN authentication for user group 229 AutolKE 232 certificates 232 disabling 266 268 manual keys 232 pre shared keys 232 remote gateway 229 status 255 timeout 255 256 IPSec VPN tunnel testing 256 J Java applets 299 removing from web pages 299 K keyword log search 318 319 L
118. Certificates gt Local Certificates Select Generate Type a Certificate Name The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Configure the Subject Information that identifies the object being certified Preferably use an IP address or domain name If this is impossible such as with a dialup client use an email address Host IP For Host IP enter the IP address of the FortiGate unit being certified Domain Name For Domain name enter the fully qualified domain name of the FortiGate unit being certified Do not include the protocol specification http or any port number or path names E Mail For E mail enter the email address of the owner of the FortiGate unit being certified Typically e mail addresses are entered only for clients not gateways Configure the Optional Information to further identify the object being certified Fortinet Inc IPSec VPN Organization Unit Organization Locality State Province Country e mail 6 Configure the key Key Type Key Size Managing digital certificates Enter a name that identifies the department or unit within the organization that is requesting the certificate for the FortiGate unit such as Manufacturing or MF Enter the legal name of the organization that is requesting the certificate for the FortiGate unit such as Fortinet Enter the name
119. DN see Enabling push updates through a NAT device on page 124 or if your FortiGate unit connects to the Internet using a proxy server see Enabling scheduled updates through a proxy server on page 122 Manually initiating antivirus and attack definitions updates You can use the following procedure to update the antivirus and attack definitions at any time The FortiGate unit must be able to connect to the FDN or to an override FortiResponse server To update antivirus and attack definitions Go to System gt Update 2 Select Update Now to update the antivirus and attack definitions If the connection to the FDN or override server is successful the web based manager displays a message similar to the following Your update request has been sent Your database will be updated in a few minutes Please check your update page for the status of the update After a few minutes if an update is available the System Update page lists new version information for antivirus definitions the antivirus engine or attack definitions The System Status page also displays new dates and version numbers for antivirus and attack definitions Messages are recorded to the event log indicating whether the update was successful or not FortiGate 800 Installation and Configuration Guide 119 Scheduling updates Virus and attack definitions updates and registration Configuring update logging Use the following procedure to configu
120. Disabling unnecessary NIDS attack signatures can improve system performance and reduce the number of IDS log messages and alert emails that the NIDS generates For example the NIDS detects a large number of web server attacks If you do not provide access to a web server behind your firewall you might want to disable all web server attack signatures Note To save your NIDS attack signature settings Fortinet recommends that you back up your FortiGate configuration before you update the firmware and restore the saved configuration after the update To disable NIDS attack signatures Go to NIDS gt Detection gt Signature List Scroll through the signature list to find the signature group that you want to disable Attack ID numbers and rule names in attack log messages and alert email match those in the signature group members list You can scroll through a signature group members list to locate specific attack signatures by ID number and name Clear the Enable check box Select OK Repeat steps 2 to 4 for each NIDS attack signature group that you want to disable Select Check All a enable all NIDS attack signature groups in the signature list I Select Uncheck A to disable all NIDS attack signature groups in the signature list Adding user defined signatures S You can create a user defined signature list in a text file and upload it from the management computer to the FortiGate unit Note You cannot upload individual signatur
121. FTP_Main_Office Source IP Address 10 10 10 1 Source Netmask 255 255 255 0 Destination IP ie Address 10 10 10 2 Destination Netmask 255 255 255 0 Service FTP Viewing logs saved to memory Viewing logs If the FortiGate unit is configured to save log messages in system memory you can use the web based manager to view search and clear the log messages This section describes e Viewing logs e Searching logs Log messages are listed with the most recent message at the top To view log messages saved in system memory Go to Log amp Report gt Logging Select Event Log Attack Log Antivirus Log Web Filter Log or Email Filter Log The web based manager lists the log messages saved in system memory Scroll through the log messages to view them FortiGate 800 Installation and Configuration Guide 317 Viewing and managing logs saved to the hard disk Logging and reporting 4 _ To view a specific line in the log type a line number in the Go to line field and select 5 To navigate through the log message pages select Go to next page 5 or Go to previous page P Searching logs To search log messages saved in system memory Go to Log amp Report gt Logging Select Event Log Attack Log Antivirus Log Web Filter Log or Email Filter Log Select E to search the messages in the selected log Select AND to search for messages that match all the specified search criteria a Fk WO N Select OR to sea
122. Figure 3 FortiGate login NN M S FortiGate 300 NaN Name Password l LOGIN NS Fortinet Inc Getting started Connecting to the command line interface CLI Connecting to the command line interface CLI As an alternative to the web based manager you can install and configure the FortiGate unit using the CLI Configuration changes made with the CLI are effective immediately without resetting the firewall or interrupting service To connect to the FortiGate CLI you need a computer with an available communications port e the RJ 45 serial cable included in your FortiGate package e the RJ 45 to DB 9 convertor included in your FortiGate package if required e terminal emulation software such as HyperTerminal for Windows Note The following procedure describes how to connect to the CLI using Windows HyperTerminal software You can use any terminal emulation program To connect to the CLI Connect the RJ 45 serial cable to the communications port of your computer and to the FortiGate Console port Use the RJ 45 to DB 9 convertor if your PC communications port requires a DB 9 connector Make sure that the FortiGate unit is powered on Start HyperTerminal enter a name for the connection and select OK Configure HyperTerminal to connect directly to the communications port on the computer to which you have connected the null modem cable and select OK Select the following port setti
123. FortiGate unit to control traffic between these network segments External can connect to the external firewall or router e Internal can connect to the internal network HA can connect to another network or to other FortiGate 800s if you are installing an HA cluster e DMZ and interfaces 1 to 4 can connect to other network segments Configuration options Once you have selected Transparent or NAT Route mode operation you can complete the configuration plan and begin to configure the FortiGate unit You can use the web based manager setup wizard the control buttons and LCD or the command line interface CLI for the basic configuration of the FortiGate unit Setup wizard If you are configuring the FortiGate unit to operate in NAT Route mode the default the setup wizard prompts you to add the administration password and the internal and external interface addresses Using the wizard you can also add DNS server IP addresses and a default route for the external interface In NAT Route mode you can also configure the FortiGate to allow Internet access to your internal Web FTP or email servers If you are configuring the FortiGate unit to operate in Transparent mode you can switch to Transparent mode from the web based manager and then use the setup wizard to add the administration password the management IP address and gateway and the DNS server addresses CLI If you are configuring the FortiGate unit to operate in
124. Gate unit downloads the user defined signature list to a text file on the management computer You can specify a location to which to download the text file as well as a name for the text file FortiGate 800 Installation and Configuration Guide 273 Preventing attacks Network Intrusion Detection System NIDS Preventing attacks NIDS attack prevention protects the FortiGate unit and the networks connected to it from common TCP ICMP UDP and IP attacks You can enable NIDS attack prevention to prevent a set of default attacks with default threshold values You can also enable or disable and set the threshold values for individual attack prevention signatures Note After the FortiGate unit reboots NIDS attack prevention and synflood prevention are always disabled e Enabling NIDS attack prevention e Enabling NIDS attack prevention signatures e Setting signature threshold values Enabling NIDS attack prevention 1 2 To enable NIDS attack prevention Go to NIDS gt Prevention Select the Enable Prevention check box in the top left corner Enabling NIDS attack prevention signatures 274 The NIDS Prevention module contains signatures that are designed to protect your network against attacks Some signatures are enabled by default others must be enabled For a complete list of NIDS Prevention signatures and descriptions see the FortiGate NIDS Guide To enable attack prevention signatures Go to NIDS gt Prevention Sel
125. I using the command set system interface After changing the interface addresses you can access the FortiGate unit from the web based manager and restore the configuration e To restore the FortiGate unit configuration see Restoring system settings on page 108 To restore NIDS user defined signatures see Adding user defined signatures on page 272 e To restore web content filtering lists see Restoring the Banned Word list on page 292 and Uploading a URL block list on page 295 e To restore email filtering lists see Uploading the email banned word list on page 305 and Uploading an email block list on page 307 If you are reverting to a previous firmware version for example reverting from FortiOS v2 50 to FortiOS v2 36 you might not be able to restore your previous configuration from the backup up configuration file Update the virus and attack definitions to the most recent version see Manually initiating antivirus and attack definitions updates on page 119 Testing a new firmware image before installing it You can test a new firmware image by installing the firmware image from a system reboot and saving it to system memory After completing this procedure the FortiGate unit operates using the new firmware image with the current configuration This new firmware image is not permanently installed The next time the FortiGate unit restarts it operates with the originally installed fi
126. IP supports both RIP version 1 as defined by RFC 1058 and RIP version 2 as defined by RFC 2453 RIP version 2 enables RIP messages to carry more information and to support simple authentication and subnet masks RIP is a distance vector routing protocol intended for small relatively homogeneous networks RIP uses hop count as its routing metric Each network is usually counted as one hop The network diameter is limited to 15 hops This chapter describes how to configure FortiGate RIP e RIP settings e Configuring RIP for FortiGate interfaces e Adding RIP filters RIP settings To configure RIP on the FortiGate unit 1 Go to System gt RIP gt Settings 2 Select Enable RIP When you enable RIP the Fortigate unit starts the RIP process The FortiGate unit does not send or receive RIP packets until you enable RIP on at least one interface For information about configuring RIP see Configuring RIP for FortiGate interfaces on page 163 3 Select Enable Advertise Default if you want RIP to always send the default route to neighbors whether or not the default route is in the static routing table If you disable Advertise Default RIP never sends the default route 4 Change the following RIP default settings as required RIP defaults are effective in most configurations You should only have to change these settings to troubleshoot problems with the RIP configuration FortiGate 800 Installation and Configuration Guide 161
127. IP address 0 0 0 0 and Netmask 255 255 255 255 is not a valid firewall address This section describes e Adding addresses e Editing addresses e Deleting addresses e Organizing addresses into address groups Adding addresses To add an address Go to Firewall gt Address Select the interface VLAN subinterface or zone that you want to add the address to Select New to add a new address kh O N Enter an Address Name to identify the address The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Spaces and other special characters are not allowed 5 Enter the IP Address The IP address can be The IP address of a single computer for example 192 45 46 45 e The IP address of a subnetwork for example 192 168 1 0 for a class C subnet e 0 0 0 0 to represent all possible IP addresses FortiGate 800 Installation and Configuration Guide 197 Addresses 198 Firewall configuration Enter the Netmask The netmask corresponds to the type of address that you are adding For example e The netmask for the IP address of a single computer should be 255 255 255 255 e The netmask for a class A subnet should be 255 0 0 0 e The netmask for a class B subnet should be 255 255 0 0 e The netmask for a class C subnet should be 255 255 255 0 e The netmask for all addresses should be 0 0 0 0 Note To add an address to represent any address on a network set the I
128. Inc Contents Viewing logs saved tO Memory ceceeeeeeeeeteteeeeeeeene nesses tenes eeetaeeeeesteeeeeeenieeeeenenea 317 VIGWING lOQS ercer A E ences weer 317 SEANCHING LOGS ssiri tiriksan a a N A 318 Viewing and managing logs saved to the Nard disk seesseeeeesssesrrrsseerrrrsserrrrsssrrenn 318 Viewing lOQS ii cites sta deseunsted a a O 319 Searching 1OGS 0 eee cece eee eeeeeee eee eeeee ener eeeeeaaeeeeeeeeaeeeeceeeaaaeeeseeeaaeeeeseeenaeeeeseeenaeeeeeeenaaes 319 Downloading a log file to the management COMpUtel ccceeeeeeeeeeeeeeeetttteeeeeteee 320 Deleting all messages from an active l0g eee eeeeeceeeeeeeeeeeeeeeeeeteeeeeeeeteeeeaaeeeteeeaeeees 320 Deleting a Saved log TNC a acjizucs cee sionen inanan en anA OAREN 320 Conigunng alen email einni aran aAA E A 321 Adding alert email AaddreSSes 0 2 2 ecccccccesesecccceeeesececenseseececeensseccecerenseececeeeensneeeeeensaees 321 Lesting alert Gmail ci ccscicecevevsenccceediiiicessvsditaeeeesviidicevveiaas caves dada deeeevilanadeevi haben 321 Enabling alert email 00 0 eee cece eee eeeeeeeeeeeeceeeeeeeeeeeeeeeseceeeeeeeseceeeeeeseeeeaaeeeeseeaaeeees 322 eee 323 MOE geet nen este ner errno re een ee ee ere eee eee ere errs 327 FortiGate 800 Installation and Configuration Guide 13 Contents 14 Fortinet Inc RAT MET Introduction FortiGate Antivirus Firewalls support network based deployment of application level services including a
129. Inc IPSec VPN Redundant IPSec VPNs Action ENCRYPT VPN Tunnel The VPN tunnel name added in step 1 Use the same tunnel for all encrypt policies Allow inbound Select allow inbound Allow outbound Do not enable Inbound NAT Select inbound NAT if required Outbound NAT Select outbound NAT if required See Adding an encrypt policy on page 247 6 Arrange the policies in the following order e outbound encrypt policies inbound encrypt policy e default non encrypt policy Internal_All gt External_All Note The default non encrypt policy is required to allow the VPN spoke to access other S networks such as the Internet Redundant IPSec VPNs To ensure the continuous availability of an IPSec VPN tunnel you can configure multiple connections between the local FortiGate unit and the remote VPN peer remote gateway With a redundant configuration if one connection fails the FortiGate unit establishes a tunnel using the other connection The configuration depends on the number of connections that each VPN peer has to the Internet For example if the local VPN peer has two connections to the Internet then it can provide two redundant connections to the remote VPN peer A single VPN peer can be configured with up to three redundant connections The VPN peers are not required to have a matching number of Internet connections For example between two VPN peers one peer can have multiple Internet connections while the other ha
130. M File Block O oO O o o Quarantine Mw yw M MY m Web URL Block O Web Content Block O Web Script Filter O Web Exempt List O Email Block List O El Email Exempt List O O Email Content Block E O Oversized File Email Block pass pass pass pass pass Pass Fragmented Emails O O O Fortinet Inc Getting started Web content profile Factory default FortiGate configuration settings Use the web content profile to apply antivirus scanning and web content blocking to HTTP content traffic You can add this content profile to firewall policies that control HTTP traffic Table 7 Web content profile Options HTTP FTP IMAP POP3 SMTP Antivirus Scan Mw O O E Oo File Block oO O O o o Quarantine Mw O O Oo Oo Web URL Block Mw Web Content Block Mw Web Script Filter O Web Exempt List O Email Block List m O O Email Exempt List O O Email Content Block O O Oversized File Email Block pass pass pass pass pass Pass Fragmented Emails O O O Unfiltered content profile Use the unfiltered content profile if you do not want to apply content protection to traffic You can add this content profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected Table 8 Unfiltered content profile FortiGate 800 Installation and Configuration Guide O
131. NAT Route mode you can add the administration password and all interface addresses Using the CLI you can also add DNS server IP addresses and a default route for the external interface If you are configuring the FortiGate unit to operate in Transparent mode you can use the CLI to switch to Transparent mode Then you can add the administration password the management IP address and gateway and the DNS server addresses Fortinet Inc Getting started Front keypad and LCD FortiGate model maximum values matrix If you are configuring the FortiGate unit to operate in NAT Route mode you can use the control buttons and LCD to add the IP address of the FortiGate interfaces as well as the external default gateway If you are configuring the FortiGate unit to operate in Transparent mode you can use the control buttons and LCD to switch to Transparent mode Then you can add the management IP address and default gateway FortiGate model maximum values matrix Table 9 FortiGate maximum values matrix FortiGate model 50 60 100 200 300 400 500 800 1000 3000 3600 4000 Routes 500 500 500 500 500 500 500 500 500 500 500 500 Policy routing 500 500 500 500 500 500 500 500 500 500 500 500 gateways Administrative 500 500 500 500 500 500 500 500 500 500 500 500 users VLAN N A N A N A 4096 4096 4096 4096 4096 4096 4096 4096 4
132. NS server To add a DNS server Go to System gt Network gt DNS If they are not already there type the primary and secondary DNS server addresses provided by your ISP Select Apply To add alert email addresses Go to Log amp Report gt Alert Mail gt Configuration Select the Authentication check box if your email server requires an SMTP password In the SMTP Server field type the name of the SMTP server where you want the FortiGate unit to send email in the format smtp domain com The SMTP server can be located on any network connected to the FortiGate unit In the SMTP User field type a valid email address in the format user domain com This address appears in the From header of the alert email In the Password field type the password that the SMTP user needs to access the SMTP server A password is required if you select Authentication Type up to three destination email addresses in the Email To fields These are the email addresses to which the FortiGate unit sends alert email Select Apply Testing alert email You can test the alert email settings by sending a test email To send a test email Go to Log amp Report gt Alert Mail gt Configuration Select Test to send test email messages from the FortiGate unit to the Email To addresses FortiGate 800 Installation and Configuration Guide 321 Configuring alert email Logging and reporting Enabling alert email You can configure the FortiGate unit to s
133. Network gt DHCP Select Service Select an interface Select DHCP Server Select Apply a Ff WOW N Adding scopes to a DHCP server If you have configured an interface as a DHCP server the interface requires at least one scope also called an address scope The scope designates the starting IP and ending IP for the range of addresses that the FortiGate unit assigns to DHCP clients 158 Fortinet Inc Network configuration Configuring DHCP services You can add multiple scopes to an interface so that the DHCP server added to that interface can supply IP addresses to computers on multiple subnets Add multiple scopes if the DHCP server receives DHCP requests from subnets that are not connected directly to the FortiGate unit In this case the DHCP requests are sent to the FortiGate unit through DHCP relay DHCP relay packets contain DHCP relay IP which is the IP address of the subnet from which the DHCP relay received the request If the DHCP request received by the DHCP server is not forwarded by a DHCP relay the DHCP server decides which scope to use based on the IP address of the interface that received the DHCP request usually the scope with the same subnet as the interface If the DHCP request received by the server is forwarded by a DHCP relay the relay IP is used to select the scope To add a scope to a DHCP server Go to System gt Network gt DHCP Select Address Scope Select an interface You must config
134. O N 154 You can add destination based routes to the FortiGate routing table to control the destination of traffic exiting the FortiGate unit You configure routes by adding destination IP addresses and netmasks and adding gateways for these destination addresses The gateways are the next hop routers to which to route traffic that matches the destination addresses in the route You can add one or two gateways to a route If you add one gateway the FortiGate unit routes the traffic to that gateway You can add a second gateway to route traffic to the second gateway if the first gateway fails To support routing failover the IP address of each gateway must be added to the ping server of the interface connected to the same network as the gateway For information about adding a ping server see Adding a ping server to an interface on page 142 To add destination based routes to the routing table Go to System gt Network gt Routing Table Select New to add a new route Type the Destination IP address and netmask for the route Add the IP address of Gateway 1 Gateway 1 is the IP address of the primary destination for the route Gateway 1 must be on the same subnet as a Fortigate interface If you are adding a static route from the FortiGate unit to a single destination router you need to specify only one gateway Add the IP address of Gateway 2 if you want to route traffic to multiple gateways Fortinet Inc Network
135. P Address to 0 0 0 0 and the Netmask to 0 0 0 0 Select OK to add the address Figure 42 Adding an internal address New Address Interface internal Address Name fInternal_Server IP Address 192 63 16 45 _ Netmask 255 255 255 255 Editing addresses kh OO N Edit an address to change its IP address and netmask You cannot edit the address name To change the address name you must delete the address entry and then add the address again with a new name To edit an address Go to Firewall gt Address Select the interface list containing the address that you want to edit Choose an address to edit and select Edit Address z Make the required changes and select OK to save the changes Fortinet Inc Firewall configuration Addresses Deleting addresses Deleting an address removes it from an address list To delete an address that has been added to a policy you must first remove the address from the policy To delete an address 1 Go to Firewall gt Address 2 Select the interface list containing the address that you want to delete You can delete any address that has a Delete Address icon T Choose an address to delete and select Delete T Select OK to delete the address Organizing addresses into address groups You can organize related addresses into address groups to make it easier to add policies For example if you add three addresses and then add them to an address group you only have to ad
136. PPTP and L2TP VPN Name the connection and select Next If the Public Network dialog box appears choose the appropriate initial connection and select Next In the VPN Server Selection dialog enter the IP address or host name of the FortiGate unit to connect to and select Next Select Finish To configure the VPN connection Right click the Connection icon that you created in the previous procedure Select Properties gt Security Select Typical to configure typical settings Select Require data encryption Note If a RADIUS server is used for authentication do not select Require data encryption PPTP encryption is not supported for RADIUS server authentication Select Advanced to configure advanced settings Select Settings Select Challenge Handshake Authentication Protocol CHAP Make sure that none of the other settings are selected Select the Networking tab Make sure that the following options are selected e TCP IP e QoS Packet Scheduler Make sure that the following options are not selected e File and Printer Sharing for Microsoft Networks e Client for Microsoft Networks Select OK To connect to the PPTP VPN Connect to your ISP Start the VPN connection that you configured in the previous procedure Enter your PPTP VPN User Name and Password Select Connect In the connect window enter the User Name and Password that you use for your dialup network connection This user name and password is not the
137. RADIUS servers and LDAP servers to user groups You can then select a user group when you require authentication You can select user groups to require authentication for e any firewall policy with Action set to ACCEPT e IPSec dialup user phase 1 configurations e Auth functionality for phase 1 IPSec VPN configurations e PPTP e L2TP When a user enters a user name and password the FortiGate unit searches the internal user database for a matching user name If Disable is selected for that user name the user cannot authenticate and the connection is dropped If Password is selected for that user and the password matches the connection is allowed If the password does not match the connection is dropped If RADIUS is selected and RADIUS support is configured and the user name and password match a user name and password on the RADIUS server the connection is allowed If the user name and password do not match a user name and password on the RADIUS server the connection is dropped If LDAP is selected and LDAP support is configured and the user name and password match a user name and password on the LDAP server the connection is allowed If the user name and password do not match a user name and password on the LDAP server the connection is dropped If the user group contains user names RADIUS servers and LDAP servers the FortiGate unit checks them in the order in which they have been added to the user group FortiGate 800 Install
138. Retrieve default gateway and DNS from server if you do not want the DHCP server to configure these FortiGate settings To configure an interface for DHCP Go to System gt Network gt Interface Choose an interface and select Modify z In the Addressing Mode section select DHCP Fortinet Inc Network configuration 8 Configuring interfaces Clear the Retrieve default gateway and DNS from server check box if you do not want the FortiGate unit to obtain a default gateway IP address and DNS server IP addresses from the DHCP server By default this option is enabled Clear the Connect to Server check box if you do not want the FortiGate unit to connect to the DHCP server By default this option is enabled Select Apply The FortiGate unit attempts to contact the DHCP server from the interface to set the IP address netmask default gateway IP address and DNS server IP addresses Select Status to refresh the addressing mode status message initializing No activity connecting The FortiGate unit is attempting to connect to the DHCP server connected The FortiGate unit retrieves an IP address netmask and other settings from the DHCP server failed The FortiGate unit was unable to retrieve an IP address and other information from the DHCP server Select OK Configuring an interface for PPPoE a Fk WO N Use the following procedure to configure any FortiGate interface to use PPPoE If you configure the interf
139. Select OK The FortiGate unit changes to Transparent mode Fortinet Inc Transparent mode installation Transparent mode configuration examples Go to System gt Network gt Management e Change the Management IP and Netmask IP 192 168 1 1 Mask 255 255 255 0 e Select Apply Go to System gt Network gt Routing e Select New to add the static route to the FortiResponse server Destination IP 24 102 233 5 Mask 255 255 255 0 Gateway 192 168 1 2 e Select OK e Select New to add the default route to the external network Destination IP 0 0 0 0 Mask 0 0 0 0 Gateway 192 168 1 2 e Select OK CLI configuration steps To configure the Fortinet basic settings and a static route using the CLI Set the system to operate in Transparent Mode set system opmode transparent Add the Management IP address and Netmask set system management ip 192 168 1 1 255 255 255 0 Add the static route to the primary FortiResponse server set system route number 1 dst 24 102 233 5 255 255 255 0 gwl 192 168 1 2 Add the default route to the external network set system route number 2 gwl 192 168 1 2 Example static route to an internal destination Figure 13 shows a FortiGate unit where the FDN is located on an external subnet and the management computer is located on a remote internal subnet To reach the FDN you need to enter a single default route that points to the upstream router as the next hop default gateway To reach the man
140. Session list FortiGate 800 Installation and Configuration Guide 93 Changing the FortiGate host name System status Changing the FortiGate host name kh OO N The FortiGate host name appears on the Status page and in the FortiGate CLI prompt The host name is also used as the SNMP system name For information about the SNMP system name see Configuring SNMP on page 173 The default host name is FortiGate 800 To change the FortiGate host name Go to System gt Status Select Edit Host Name Eee Type a new host name Select OK The new host name is displayed on the Status page and in the CLI prompt and is added to the SNMP System Name Changing the FortiGate firmware 94 After you download a FortiGate firmware image from Fortinet you can use the procedures listed in Table 18 to install the firmware image on your FortiGate unit Table 18 Firmware upgrade procedures Procedure Description Upgrading to a new Commonly used web based manager and CLI procedures to firmware version upgrade to a new FortiOS firmware version or to a more recent build of the same firmware version Reverting to a Use the web based manager or CLI procedure to revert to a previous firmware previous firmware version This procedure reverts the FortiGate version unit to its factory default configuration Installing firmware Use this procedure to install a new firmware version or revert to a images from a system Previous firmw
141. The monitor also lists the tunnel lifetime timeout proxy ID source and proxy ID destination for each tunnel To view dialup connection status 1 Go to VPN gt IPSec gt Dialup Monitor 2 View the dialup connection status information for the FortiGate unit Remote gateway The IP address of the remote dialup remote gateway on the FortiGate unit Lifetime The amount of time that the dialup VPN connection has been active FortiGate 800 Installation and Configuration Guide 255 Monitoring and Troubleshooting VPNs 256 Testing a VPN IPSec VPN Timeout The time before the next key exchange The time is calculated by subtracting the time elapsed since the last key exchange from the keylife Proxy ID Source The actual IP address or subnet address of the remote peer Proxy ID The actual IP address or subnet address of the local peer Destination Figure 63 Dialup Monitor Manual Key Phase 2 Phase1 Concentrator i i s Remote gateway Lifetime Timeout Proxy ID Source Proxy ID Destination 192 168 100 124 1800 secs 79 14 14 14 0 255 255 255 0 192 168 100 124 255 255 255 255 192 168 100 40 1800 secs 3585 14 14 14 0 255 255 255 0 192 168 100 40 255 255 255 255 To confirm that a VPN between two networks has been configured correctly use the ping command from one internal network to connect to a computer on the other internal network The IPSec VPN tunnel starts automatically when the first data p
142. WAAAVAAAL AML AAA AAAA AALLLLLLLELLLLNI A ttttttttttIT ALL WAMAN WAM ASALLI wi OL N VA une VARNUNn ee TIT EFSRTIMET FortiGate User Manual Volume 1 Version 2 50 January 15 2004 Copyright 2004 Fortinet Inc All rights reserved No part of this publication including text examples diagrams or illustrations may be reproduced transmitted or translated in any form or by any means electronic mechanical manual optical or otherwise for any purpose without prior written permission of Fortinet Inc FortiGate 800 Installation and Configuration Guide Version 2 50 January 15 2004 Trademarks Products mentioned in this document are trademarks or registered trademarks of their respective holders Regulatory Compliance FCC Class A Part 15 CSA CUS CAUTION RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS For technical support please visit http www fortinet com Send information about errors or omissions in this document or any Fortinet technical documentation to techdoc fortinet com Contents Table of Contents REE CUE srs cs ectteasasedtes a e A E E EA 15 Antivirus PrOteCuiOn aeina ad e a cove aaaea 16 Web content filtering 2 0 0 2 2 ccc ceceeeeceeeeee cee ee eee ee eee eee cece aeaaeaaeeeeeeeeeeseesecsecneecaeeeeeeeeeeeeeeseeeeaea 16 Emal ARENG secs ccceticesavtertets tetedentet eeetites Heel A 17 a ee
143. Windows 2000 Registry as described in the following steps See the Microsoft documentation for editing the Windows Registry Use the registry editor regedit to locate the following key in the registry HKEY LOCAL MACHINE System CurrentControlSet Services Rasman Parameters Add the following registry value to this key Value Name ProhibitIpSec Data Type REG DWORD Value 1 Save the changes and restart the computer for the changes to take effect You must add the ProhibitIpSec registry value to each Windows 2000 based endpoint computer of an L2TP or IPSec connection to prevent the automatic filter for L2TP and IPSec traffic from being created When the ProhibitIpSec registry value is set to 1 your Windows 2000 based computer does not create the automatic filter that uses CA authentication Instead it checks for a local or active directory IPSec policy To connect to the L2TP VPN Start the dialup connection that you configured in the previous procedure Enter your L2TP VPN User Name and Password Select Connect Fortinet Inc PPTP and L2TP VPN 4 Configuring L2TP In the connect window enter the User Name and Password that you use to connect to your dialup network connection This user name and password is not the same as your VPN user name and password Configuring a Windows XP client for L2TP ao a Aa WO DN I 6 hwnd O O ON OO _ 11 Use the following procedure to configure a clien
144. YN 2048 1 1000000 segments received per second Queue Size Maximum proxied 4096 100 1000000 connections Timeout Number of seconds for the 15 1 3600 SYN cookie to keep a proxied connection alive portscan Maximum number of SYN segments 512 1 1000000 received per second srcsession Total number of TCP sessions initiated 2048 1 1000000 from the same source ftpovfl Maximum buffer size for an FTP 256 32 1408 command bytes smtpovfl Maximum buffer size for an SMTP 512 32 1408 command bytes pop3ovfl Maximum buffer size for a POP3 512 32 1408 command bytes udpflood Maximum number of UDP packets 2048 1 1000000 received from the same source or sent to the same destination per second udpsrcsession Total number of UDP sessions initiated 2048 1 1000000 from the same source icmpflood Maximum number of ICMP packets 256 1 1000000 received from the same source or sent to the same destination per second icmpsrcsession Total number of ICMP sessions 128 1 1000000 initiated from the same source icmpsweep Maximum number of ICMP packets 128 1 1000000 received from the same source per second icmplarge Maximum ICMP packet size bytes 32000 64 64000 FortiGate 800 Installation and Configuration Guide 275 Logging attacks Network Intrusion Detection System NIDS To set Prevention signature threshold values Go to NIDS gt Prevention Select Modify ES beside the signatu
145. a complete URL including path and filename to exempt access to a page ona website For example www goodsite com index html exempts access to the main page of this example website You can also add IP addresses for example 122 63 44 67 index html exempts access to the main web page at this address Do not include http in the URL to exempt Exempting a top level URL such as www goodsite com exempts all requested subpages for example www goodsite com badpage from all content and URL filtering rules A Note Exempting a top level URL does not exempt pages such as mail goodsite com from all content and URL filtering rules unless goodsite com without the www is added to the exempt URL list Ensure that the Enable checkbox has been selected Select OK to add the URL to the exempt URL list You can enter multiple URLs and then select Check All m to activate all items in the exempt URL list You can disable all the URLs in the list by selecting Uncheck All Each page of the exempt URL list displays 100 URLs 6 Use Page Down and Page Up F to navigate the exempt URL list 300 Fortinet Inc Web filtering Exempt URL list Figure 75 Example URL Exempt list Exempt URL D Url Exempt List www goodsite com Tt E www goodsite com index T E 127 33 44 55 wT amp Vv Downloading the URL Exempt List You can back up the URL Exempt List by downloading it to a text file on the management computer G
146. able 12 DMZ and user defined interfaces Optional DMZ IP g Netmask 1 IP 3 Netmask 2 IP g Netmask 3 IP Netmask 4 IP i Netmask Using the setup wizard From the web based manager you can use the setup wizard to do the initial configuration of the FortiGate unit For information about connecting to the web based manager see Connecting to the web based manager on page 28 Starting the setup wizard 1 In the web based manager select Easy Setup Wizard the middle button in the upper right corner of the web based manager Select the Next button to step through the wizard pages Use the information that you gathered in Table 10 on page 42 to fill in the wizard fields You can also use the information in Table 11 on page 42 4 Confirm the configuration settings and then select Finish and Close Note If you use the setup wizard to configure internal server settings the FortiGate unit adds ue port forwarding virtual IPs and firewall policies for each server For example for each server x located on the Internal network the FortiGate unit adds an External gt Internal firewall policy Reconnecting to the web based manager If you changed the IP address of the internal interface while you were using the setup wizard you must reconnect to the web based manager using a new IP address Browse to https followed by the new IP address of the int
147. able shows the destination IP address and mask of each route that you add as well as the gateways and devices added to the route The routing table also displays the gateway connection status A green check mark indicates that the FortiGate unit has used the ping server and dead gateway detection to determine that it can connect to the gateway A red X means that a connection cannot be established A blue question mark means that the connection status is unknown For more information see Adding a ping server to an interface on page 142 The FortiGate unit assigns routes using a best match algorithm based on the destination address of the packet and the destination address of the route To select a route for a packet the FortiGate unit searches the routing table for a route that best matches the destination address of the packet If a match is not found the FortiGate unit routes the packet using the default route To configure the routing table 1 Go to System gt Network gt Routing Table 2 Choose the route that you want to move and select Move to a to change its order in the routing table 3 Type a number in the Move to field to specify where in the routing table to move the route and select OK 4 Select Delete jf to delete a route from the routing table Figure 33 Routing table Interface DNS Routing Table DHCP ips Mask Gateway 1 Gateway 2 Device 1 Device 2 Modify 10 10 10 0 255 255 255 0 120 45 67 19 ext
148. ace to use PPPoE the FortiGate unit automatically broadcasts a PPPoE request You can disable connect to server if you are configuring the FortiGate unit offline and you do not want the FortiGate unit to send the PPPoE request By default the FortiGate unit also retrieves a default gateway IP address and DNS server IP addresses from the PPPoE server You can disable the option Retrieve default gateway and DNS from server if you do not want the PPPoE server to configure these FortiGate settings To configure an interface for PPPoE Go to System gt Network gt Interface Choose an interface and select Modify E In the Addressing Mode section select PPPoE Enter your PPPoE account User Name and Password Clear the Retrieve default gateway and DNS from server check box if you do not want the FortiGate unit to obtain a default gateway IP address and DNS server IP addresses from the PPPoE server By default this option is enabled Clear the Connect to Server check box if you do not want the FortiGate unit to connect to the PPPoE server By default this option is enabled FortiGate 800 Installation and Configuration Guide 141 Configuring interfaces 9 Network configuration Select Apply The FortiGate unit attempts to contact the PPPoE server from the interface to set the IP address netmask default gateway IP address and DNS server IP addresses Select Status to refresh the addressing mode status message Possible mess
149. ace with the lower metric will seem to have a lower cost More traffic will use routes to the interface with the lower metric Metric can be from 1 to 16 with 16 equalling unreachable 4 Select OK to save the RIP configuration for the selected interface Figure 35 Example RIP configuration for an internal interface Settings a Interface y Filter N Edit RIP on Interface Interface internal 164 I RIP1 Send I RIP1 Receive M RIP2 Send I RIP2 Receive V Split Horizon J Authentication Password Mode Ne ne z Metric Roo ag Fortinet Inc RIP configuration Adding RIP filters Adding RIP filters a Use the Filter page to create RIP filter lists and assign RIP filter lists to the neighbors filter incoming route filter or outgoing route filter The neighbors filter allows or denies updates from other routers The incoming filter accepts or rejects routes in an incoming RIP update packet The outgoing filter allows or denies adding routes to outgoing RIP update packets Each entry in a RIP filter list consists of a prefix IP address and netmask the action RIP should take for this prefix allow or deny and the interface to which to apply this RIP filter list entry When RIP applies a filter while processing an update packet it starts at the top of the filter list and works down through the list looking for a matching prefix If RIP finds a matching prefix it then checks that the interface in
150. acket destined for the VPN is intercepted by the FortiGate unit To confirm that a VPN between a network and one or more clients has been configured correctly start a VPN client and use the ping command to connect to a computer on the internal network The VPN tunnel initializes automatically when the client makes a connection attempt You can start the tunnel and test it at the same time by pinging from the client to an address on the internal network Fortinet Inc RAT MET PPTP and L2TP VPN You can use PPTP and L2TP to create a virtual private network VPN between a remote client computer that is running Windows and your internal network Because PPTP and L2TP are supported by Windows you do not require third party software on the client computer Provided your ISP supports PPTP and L2TP connections you can create a secure connection by making some configuration changes to the client computer and the FortiGate unit This chapter provides an overview of how to configure FortiGate PPTP and L2TP VPN For a complete description of FortiGate PPTP and L2TP see the FortiGate VPN Guide This chapter describes e Configuring PPTP e Configuring L2TP Configuring PPTP Point to Point protocol PPTP packages data within PPP packets and then encapsulates the PPP packets within IP packets for transmission through a VPN tunnel ue Note PPTP VPNs are supported only in NAT Route mode This section describes e Configuring the Fort
151. adding filename patterns 282 file 281 oversized files and email 286 URL 293 web pages 290 304 web pattern blocking 296 Cc certificates introduction 232 checksum verification configuring 270 clearing communication sessions 114 URL block list 294 CLI 21 configuring IP addresses 61 configuring NAT Route mode 44 connecting to 29 upgrading the firmware 95 97 328 command line interface 21 Comments firewall policy 194 policy 194 connecting to network 46 63 to the FDN 118 to the FortiResponse Distribution Network 118 web based manager 28 contact information registration 134 SNMP 175 content blocking exempting URLs 300 307 web page 290 304 content filter 289 303 content profiles default 219 cookies blocking 299 CPU status 111 112 critical firewall events alert email 322 critical VPN events alert email 322 custom ICMP service 204 custom IP service 204 custom TCP service 203 custom UDP service 203 customer service 23 D date and time setting example 170 181 date setting 169 default gateway configuring Transparent mode 62 default route 159 deleting log files 320 deny firewall policy 191 policy 191 destination policy option 191 destination route adding 154 adding a default route 154 detection NIDS 269 device auto 155 Fortinet Inc DHCP adding a DHCP server to an interface 158 adding a reserved IP to a DHCP server 160 adding a scope to a DHCP server 158 configuring 157 configuring a DHCP
152. adequate air flow and cooling Dimensions e 16 75 x 12 x 1 75 in 42 7 x 30 5 x 4 5 cm Weight 10 Ib 4 5 kg Fortinet Inc Getting started Powering on kh OQ N Powering on Power requirements e Power dissipation 300 W max e AC input voltage 100 to 240 VAC e AC input current 6 A e Frequency 50 to 60 Hz Environmental specifications e Operating temperature 41 to 95 F 5 to 35 C e Storage temperature 4 to 176 F 20 to 80 C e Humidity 10 to 90 non condensing To power on the FortiGate 800 unit Make sure that the power switch on the back is turned off Connect the power cable to the power connection on the back of the FortiGate unit Connect the power cable to a power outlet Turn on the power switch After a few seconds SYSTEM STARTING appears on the LCD SYSTEM STARTING ta a MAIN MENU appears on the LCD when the system Table 1 FortiGate 500 LED indicators LED State Description Power Green The FortiGate unit is powered on Off The FortiGate unit is powered off Internal Amber The correct cable is in use and the connected equipment has External power DMZ Flashing Network activity at this interface HA amber 1 to4 Green The interface is connected Internal External DMZ and HA connect at up to 1000 Mbps Interfaces 1 2 3 and 4 connect at up to 100 Mbps Off No link established FortiGate 800 Installation and Configuration Guide 27
153. aeeeeeesnaeeeeesenaas 272 Adding user defined signatures cccceeeeceteeenneeeeeeeeeeeeeeeeeaaeeeeeseeaeeeeeeeenaeeeeeeeeaas 272 PREVOMUMG aiak ise ca ei eens Sp cce Zettd pe dedicens bepcu cate pen ceand tap cceend Geuaeseied peneceentd auelalnd Goad 274 Enabling NIDS attack prevention esiisasid aeiia rania ii an RNA EA NEE ARR Nai 274 Enabling NIDS attack prevention signatures ce eceeeeeeeeteeeeeeeetteeeeeeettaeeeeeneaaas 274 Setting signature threshold values sseseeesssessresssesrrrsssirrnsstttrrsttennrnnsternnsnstennnnnnnnn 275 Logging attacks eee e ee eetee cette tena eee eee tunnt ttuna AAEE eee seaeeeeeeeseaaeeeseceeaeeeeseeeeaeeeeseenaeeees 276 Logging attack messages to the attack 1OQ ceceeeeeseeeeeeeeeeeteeeeeeetieeeeeeetiieeeeeeeeea 276 Reducing the number of NIDS attack log and email messages 276 Antivirus Protect cciinninimnunnianniaininmuMaaRaahemnN 279 General configuration StepSeesrecnarernidari na A 279 ADVIS SCING eo T agen daey ts aneeusevta agudsdesiadeadacete dent 280 File DIOCKIUAG vie i3 secs 28s feetede de eta ede tiene de edes bi edad end a nde aed eaetaa tits 281 Blocking files in firewall traffic 0 0 0 2 ecceceeeeeeeeee eee eecneeeeeeeaeeeeeeeeaeeeeeeeeiaeeeeseeenaeeeeseenaas 282 Adding file patterns to DIOCK a neccccnccnsnirnenninns 282 Quarantine saci iz nnii obit ea a a Ee aa edie iat dies 283 Quarantining infected files 2 2 2 cece ceccceeceeceeeceeeeceeaeeeeeeeeeceaeees
154. agement computer you need to enter a single static route that leads directly to it This route points to the internal router as the next hop No route is required for the DNS servers because they are on the same layer 3 subnet as the FortiGate unit FortiGate 800 Installation and Configuration Guide 69 Transparent mode configuration examples Transparent mode installation Figure 13 Static route to an internal destination essecsesessecsecaesa 4 FortiResponse TTT Distribution Ge ee Network FDN Internet SS lt Upstream Gateway IP 192 168 1 2 w Router DNS DMZ 2 K e Management IP 192 168 1 1 L2 te UT UT te i FortiGate 800 E Go OOOO a a e 2 e Gateway IP O 192 168 1 3 gt W Internale Router e OQ L Internal Network B eo d Computer 172 16 1 11 General configuration steps Set the unit to operate in Transparent mode Configure the Management IP address and Netmask of the FortiGate unit Configure the static route to the management computer on the internal network Configure the default route to the external network khOND 70 Fortinet Inc Transparent mode installation Transparent mode configuration examples Web based manager example configuration steps To configure the FortiGate basic settings a static route and a default route using
155. ages initializing No activity connecting The FortiGate unit is attempting to connect to the DHCP server connected The FortiGate unit retrieves an IP address netmask and other settings from the PPPoE server failed The FortiGate unit was unable to retrieve an IP address and other information from the PPPoE server Select OK Adding a secondary IP address to an interface You can use the CLI to add a secondary IP address to any FortiGate interface The secondary IP address cannot be the same as the primary IP address but it can be on the same subnet To add a secondary IP address from the CLI enter the command set system interface lt intf str gt config secip lt second_ip gt lt netmask_ ip gt You can also configure management access and add a ping server to the secondary IP address set system interface lt intf str gt config secallowaccess ping https ssh snmp http telnet set system interface lt intf str gt config secgwdetect enabl Adding a ping server to an interface 142 Add a ping server to an interface if you want the FortiGate unit to confirm connectivity with the next hop router on the network connected to the interface Adding a ping server is required for routing failover See Adding destination based routes to the routing table on page 154 To add a ping server to an interface Go to System gt Network gt Interface Choose an interface and select Modify z Set Ping Server to the IP a
156. al keylife can be from 120 to 172 800 seconds For Authentication Method select Preshared Key or RSA Signature e Preshared Key Enter a key that is shared by the VPN peers The key must contain at least 6 printable characters and should only be known by network administrators For optimum protection against currently known attacks make sure the key consists of a minimum of 16 randomly chosen alphanumeric characters e RSA Signature Select a local certificate that has been digitally signed by the certificate authority CA To add a local certificate to the FortiGate unit see Obtaining a signed local certificate on page 242 Fortinet Inc IPSec VPN AutolKE IPSec VPNs 10 Configure the Local ID the that the FortiGate unit sends to the remote VPN peer e Preshared key If the FortiGate unit is functioning as a client and uses its ID to authenticate itself to the remote VPN peer enter an ID If no ID is specified the FortiGate unit transmits its IP address e RSA Signature No entry is required because the Local ID field contains the Distinguished Name DN of the certificate associated with this phase 1 configuration The DN identifies the owner of the certificate and includes as a minimum a Common Name CN The DN is transmitted in place of an ID or IP address Configuring advanced options To configure phase 1 advanced options 1 Select Advanced Options 2 Selecta Peer Option if you want to authenticate remote VPN peers
157. alue of 5 minutes see To set the system idle timeout on page 170 To configure administrative access in Transparent mode see Configuring the management interface in Transparent mode on page 144 To control administrative access to an interface 1 Go to System gt Network gt Interface Choose an interface and select Modify z Select the Administrative Access methods for the interface HTTPS To allow secure HTTPS connections to the web based manager through this interface PING If you want this interface to respond to pings Use this setting to verify your installation and for testing HTTP To allow HTTP connections to the web based manager through this interface HTTP connections are not secure and can be intercepted by a third party SSH To allow SSH connections to the CLI through this interface SNMP To allow a remote SNMP manager to request SNMP information by connecting to this interface See Configuring SNMP on page 173 TELNET To allow Telnet connections to the CLI through this interface Telnet connections are not secure and can be intercepted by a third party 4 Select OK to save the changes FortiGate 800 Installation and Configuration Guide 143 Configuring interfaces 144 Network configuration Changing the MTU size to improve network performance kh OO N To improve network performance you can change the maximum transmission unit MTU of the packets that the FortiGate unit transmits fro
158. alup networking and virtual private networking support To install PPTP support Go to Start gt Settings gt Control Panel gt Network Select Add Select Adapter Select Add Select Microsoft as the manufacturer Select Microsoft Virtual Private Networking Adapter Select OK twice Insert diskettes or CDs as required Restart the computer To configure a PPTP dialup connection Go to My Computer gt Dial Up Networking gt Configuration Double click Make New Connection Name the connection and select Next Enter the IP address or host name of the FortiGate unit to connect to and select Next Select Finish An icon for the new connection appears in the Dial Up Networking folder Right click the new icon and select Properties Go to Server Types Uncheck IPX SPX Compatible Select TCP IP Settings Uncheck Use IP header compression Uncheck Use default gateway on remote network Select OK twice Fortinet Inc PPTP and L2TP VPN Configuring PPTP To connect to the PPTP VPN Start the dialup connection that you configured in the previous procedure Enter your PPTP VPN User Name and Password Select Connect Configuring a Windows 2000 client for PPTP O O ON OO kr OO N Use the following procedure to configure a client computer running Windows 2000 so that it can connect to a FortiGate PPTP VPN To configure a PPTP dialup connection Go to Start gt Settings gt Network and Dial up Connections
159. an address and a port number on a source network to a hidden address and optionally a different port number on a destination network Using port forwarding you can also route packets with a specific port number and a destination address that matches the IP address of the interface that receives the packets This technique is called port forwarding or port address translation PAT You can also use port forwarding to change the destination port of the forwarded packets Fortinet Inc Firewall configuration Virtual IPs This section describes e Adding static NAT virtual IPs e Adding port forwarding virtual IPs e Adding policies with virtual IPs Adding static NAT virtual IPs To add a static NAT virtual IP Go to Firewall gt Virtual IP Select New to add a virtual IP Type a Name for the virtual IP The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select the virtual IP External Interface from the list The external interface is the interface connected to the source network that receives the packets to be forwarded to the destination network You can select any firewall interface or a VLAN subinterface You can set the virtual IP external interface to any FortiGate interface Table 39 contains example virtual IP external interface settings and describes the policies that you can add the resulting virtual IP to
160. anage the cluster Adding a new FortiGate unit to a functioning cluster You can add a new FortiGate unit to a functioning cluster at any time The new FortiGate unit must be the same model as the other units in the cluster and must be running the same firmware version To add a new unit to the cluster Configure the new FortiGate unit for HA operation with the same HA configuration as the other units in the cluster See Configuring FortiGate units for HA operation on page 74 If the cluster is running in Transparent mode change the operating mode of the new FortiGate unit to Transparent mode See Changing to Transparent mode on page 109 Connect the new FortiGate unit to the cluster See Connecting the cluster on page 76 Power on the new FortiGate unit When the unit powers on it negotiates to join the cluster After it joins the cluster the cluster synchronizes the new unit configuration with the configuration of the primary unit Managing an HA cluster 78 The configurations of all of the FortiGate units in the cluster are synchronized so that the FortiGate units can function as a cluster Because of this synchronization you manage the HA cluster instead of managing the individual FortiGate units in the cluster You manage the cluster by connecting to the web based manager or CLI using any interface configured for management access except the HA interface All units in the cluster are synchronized with the
161. and IMAP email messages by the antivirus system e Files or other content removed from HTTP downloads by the antivirus system or web filtering e Files removed from FTP downloads by the antivirus system You can edit the content of replacement messages You can also edit the content added to alert email messages to control the information that appears in alert emails for virus incidents NIDS events critical system events and disk full events This section describes e Customizing replacement messages e Customizing alert emails Figure 38 Sample replacement message Message setup Email virus message Allowed Formats Text HTML Size 4095 characters Sorry Dangerous Attachment has been Removed lt INFECTED gt The file S FILE has heen removed because of a virus It was infected with the sVIRUS lt s wirus lt INFECTED gt lt QOUARANTINE gt File quarantined as QUARF ILENAMES lt QUARANTINE gt FortiGate 800 Installation and Configuration Guide 181 Replacement messages System configuration Customizing replacement messages Each of the replacement messages in the replacement message list is created by combining replacement message sections You can use these sections as building blocks to create your own replacement messages You can edit any of the replacement messages in the replacement message list and add and edit the replacement message sections as required To custom
162. are version You must run this procedure by connecting to the CLI using the FortiGate console port and a reboot usingthe CLI null modem cable This procedure reverts the FortiGate unit to its factory default configuration Testing a new Use this procedure to test a new firmware image before installing it firmware image before You must run this procedure by connecting to the CLI using the installing i FortiGate console port and a null modem cable This procedure g it t ates emporarily installs a new firmware image using your current configuration You can test the firmware image before installing it permanently If the firmware image works correctly you can use one of the other procedures listed in this table to install it permanently Installing and using a If the FortiGate unit is running BIOS version v3 x you can install a backup firmware backup firmware image Once the backup firmware image is image installed you can switch to this backup image when required Fortinet Inc System status Changing the FortiGate firmware Upgrading to a new firmware version Use the following procedures to upgrade the FortiGate unit to a newer firmware version Upgrading the firmware using the web based manager amp Note Installing firmware replaces the current antivirus and attack definitions with the definitions S included with the firmware release that you are installing After you install new firmware use the pro
163. at which an entry was last added to the log the size of the log file and its name To view a log file select View The web based manager displays the messages in the selected log You can set the number of log messages to view on a single page to 30 50 or 1000 You can scroll through the log entries To view a specific line in the log file type a line number in the Go to line field and select To navigate through the log message pages select Go to next page or Go to previous page P To search the messages in the log file that you are viewing select C4 Searching logs N ao a Aa Q To search the active log or the saved log files Go to Log amp Report gt Logging Select Traffic Log Event Log Attack Log Antivirus Log Web Filter Log or Email Filter Log To view a log file select View T Select to search the messages in the log file that you are viewing Select AND to search for messages that match all the specified search criteria Select OR to search for messages that match one or more of the specified search criteria Select one or more of the following search criteria Keyword To search for any text in a log message Keyword searching is case sensitive Source To search for any source IP address Destination To search for any destination IP address Time ce search log messages created during the selected year month day and our Select OK to run the search The web based manager di
164. atch a URL pattern Create URL patterns using regular expressions for example badsite matches badsite com badsite org badsite net and so on FortiGate web pattern blocking supports standard regular expressions You can add up to 20 patterns to the web pattern block list To add patterns to the Web pattern block list Go to Web Filter gt URL Block gt Web Pattern Block Select New to add an item to the Web pattern block list Type the web pattern that you want to block You can use standard regular expressions for web patterns Note URL blocking does not block access to other services that users can access with a web browser For example URL blocking does not block access to ftp ftp badsite com Instead you can use firewall policies to deny FTP connections Select Enable to block the pattern Select OK to add the pattern to the Web pattern block list Note You must select the Web URL Block option in the content profile to enable the URL blocking Configuring Cerberian URL filtering 296 The FortiGate unit supports Cerberian URL filtering For information about Cerberian URL filtering see www cerberian com Note If you are operating FortiGate units in active passive HA mode each FortiGate unit in the cluster must have its own Cerberian license Cerberian web filtering is not supported for active active HA For information about HA see High availability on page 73 If you have purchased the Cerberian web fil
165. ate cluster is connected and s functioning See Configuring cluster interface monitoring on page 79 10 Select Apply The FortiGate unit negotiates to establish an HA cluster When you select apply you might temporarily loose connectivity with the FortiGate unit as the HA cluster negotiates FortiGate 800 Installation and Configuration Guide 75 High availability Configuring an HA cluster 11 12 13 14 15 16 Figure 14 Example Active Active HA configuration C Standalone Mode wa Active Active v Password Retype Password Group ID jo y Schedule fRound Robin x Monitor on interface I internal M external M dmz l porti I port2 M port3 I port4 If you are configuring a NAT Route mode cluster power off the FortiGate unit and then repeat this procedure for all the FortiGate units in the cluster Once all the units are configured proceed to Connecting the cluster on page 76 If you are configuring a Transparent mode cluster reconnect to the web based manager You might have to wait a few minutes before you can reconnect Go to System gt Status Select Change to Transparent Mode and select OK to switch the FortiGate unit to Transparent mode Power off the FortiGate unit Repeat this procedure for all the FortiGate units in the cluster Connecting the cluster 76 Use the following procedure to connect a cluster operating in NAT Route mode or Transparent mode Connect
166. ation Tunneling encapsulates data so that it can be transferred over the public network Instead of being sent in its original format the data frames are encapsulated within an additional header and then routed between tunnel endpoints Upon arrival at the destination endpoint the data is decapsulated and forwarded to its destination within the private network Encryption changes a data stream from clear text something that a human or a program can interpret to cipher text something that cannot be interpreted The information is encrypted and decrypted using mathematical algorithms known as keys Authentication provides a means to verify the origin of a packet and the integrity of its contents Authentication is done using checksums calculated with keyed hash function algorithms This chapter provides an overview about how to configure FortiGate IPSec VPN For a complete description of FortiGate VPN see the FortiGate VPN Guide e Key management e Manual key IPSec VPNs e AutolKE IPSec VPNs e Managing digital certificates e Configuring encrypt policies IPSec VPN concentrators e Redundant IPSec VPNs e Monitoring and Troubleshooting VPNs FortiGate 800 Installation and Configuration Guide 231 Key management IPSec VPN Key management 232 Manual Keys There are three basic elements in any encryption system e analgorithm that changes information into code e a cryptographic key that serves as a secret starting poi
167. ation and Configuration Guide 223 Users and authentication Setting authentication timeout This chapter describes e Setting authentication timeout e Adding user names and configuring authentication e Configuring RADIUS support e Configuring LDAP support e Configuring user groups Setting authentication timeout Authentication timeout controls how long authenticated firewall connections can remain idle before users must authenticate again to get access through the firewall To set authentication timeout Go to System gt Config gt Options In Auth Timeout type a number in minutes The default authentication timeout is 15 minutes Adding user names and configuring authentication Use the following procedures to add user names and configure authentication This section describes e Adding user names and configuring authentication e Deleting user names from the internal database Adding user names and configuring authentication To add a user name and configure authentication Go to User gt Local Select New to add a new user name Type the User Name The user name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select one of the following authentication configurations Disable Prevent this user from authenticating Password Enter the password that this user must use to authenticate The password shoul
168. ation interface of the policy If you do not select Dynamic IP Pool a policy with Fixed Port selected can only allow one connection at a time for this port or service VPN Tunnel Select a VPN tunnel for an ENCRYPT policy You can select an AutolKE key or Manual Key tunnel VPN Tunnel is not available in Transparent mode Allow inbound Select Allow inbound so that users behind the remote VPN gateway can connect to the source address Allow outbound Select Allow outbound so that users can connect to the destination address behind the remote VPN gateway Inbound NAT Select Inbound NAT to translate the source address of incoming packets to the FortiGate internal IP address Outbound NAT Select Outbound NAT to translate the source address of outgoing packets to the FortiGate external IP address Traffic Shaping Traffic Shaping controls the bandwidth available to and sets the priority of the traffic processed by the policy Traffic Shaping makes it possible to control which policies have the highest priority when large amounts of data are moving through the FortiGate device For example the policy for the corporate web server might be given higher priority than the policies for most employees computers An employee who needs unusually high speed Internet access could have a special outgoing policy set up with higher bandwidth If you set both guaranteed bandwidth and maximum bandwidth to 0 the policy does not allow any traffic Guara
169. attern blocking 296 web URL blocking 293 web based manager 20 connecting to 28 introduction 20 language 171 timeout 170 WebTrends recording logs on NetIQ WebTrends server 310 Windows 2000 configuring for L2TP 265 configuring for PPTP 261 connecting to L2TP VPN 266 connecting to PPTP VPN 261 Windows 98 configuring for PPTP 260 connecting to PPTP VPN 261 Windows XP configuring for L2TP 267 configuring for PPTP 261 connecting to L2TP VPN 268 connecting to PPTP VPN 262 wizard setting up firewall 43 60 starting 43 60 worm list displaying 287 worm protection 287 Z zone adding 138 adding to a virtual domain 150 configuring 137 Fortinet Inc
170. ault gateway if required Using the command line interface As an alternative to the setup wizard you can begin the initial configuration of the FortiGate unit using the command line interface CLI To connect to the CLI see Connecting to the command line interface CLI on page 29 Use the information that you gathered in Table 16 on page 59 to complete the following procedures Changing to Transparent mode using the CLI 1 Make sure that you are logged into the CLI 2 Switch to Transparent mode Enter set system opmode transparent After a few seconds the login prompt appears 3 Type admin and press Enter The following prompt appears Type for a list of commands 4 Confirm that the FortiGate unit has switched to Transparent mode Enter get system status The CLI displays the status of the FortiGate unit The last line shows the current operation mode Operation mode Transparent FortiGate 800 Installation and Configuration Guide 61 Completing the configuration Transparent mode installation Configuring the Transparent mode management IP address 1 Make sure that you are logged into the CLI 2 Setthe management IP address and netmask to the IP address and netmask that you recorded in Table 16 on page 59 Enter set system management ip lt IP address gt lt netmask gt Example set system management ip 10 10 10 2 255 255 255 0 3 Confirm that the address is correct Enter get system management The CLI lists
171. bers 0 9 uppercase and lowercase letters A Z a z and the special characters hyphen underscore and Spaces and other special characters are not allowed Select OK to add the address pattern to the Email Block list Downloading the email block list You can back up the email block list by downloading it to a text file on the management computer To download the email block list Go to Email Filter gt Block List Select Download The FortiGate unit downloads the list to a text file on the management computer You can specify a location to which to download the text file as well as a name for the text file Fortinet Inc Email filter Email exempt list Uploading an email block list You can create a email block list in a text editor and then upload the text file to the FortiGate unit Add one pattern to each line of the text file You can follow the pattern with a space and then a 1 to enable or a zero 0 to disable the pattern If you do not add this information to the text file the FortiGate unit automatically enables all patterns that are followed with a 1 or no number when you upload the text file Figure 78 Example email block list text file mail badsite com 1 suredeal org 1 userl badsite com 1 You can either create the email block list yourself or add a block list created by a third party email blacklist service For example you can subscribe to the Realtime Blackhole List service availab
172. bility 92 Fortinet Inc RAT MET System status You can connect to the web based manager and view the current system status of the FortiGate unit The status information that is displayed includes the current firmware version the current virus and attack definitions and the FortiGate unit serial number If you log into the web based manager using the admin administrator account you can make any of the following changes to the FortiGate system settings Changing the FortiGate host name e Changing the FortiGate firmware e Manual virus definition updates e Manual attack definition updates e Backing up system settings e Restoring system settings e Restoring system settings to factory defaults e Changing to Transparent mode e Changing to NAT Route mode e Restarting the FortiGate unit e Shutting down the FortiGate unit If you log into the web based manager with another administrator account you can view the system settings including e Displaying the FortiGate serial number e Displaying the FortiGate up time e Displaying log hard disk status All administrative users can also go to the Monitor page and view FortiGate system status System status displays FortiGate system health monitoring information including CPU and memory status session and network status e System status All administrative users can also go to the Session page and view the active communication sessions to and through the FortiGate unit e
173. blocked file patterns even if they do not contain viruses Enable file blocking when a virus has been found that is so new that virus scanning does not detect it See File blocking on page 281 Quarantine Quarantine blocked and infected files according to the quarantine configuration Note If both Anti Virus Scan and File Block are enabled the FortiGate unit blocks files that match enabled file patterns before they are scanned for viruses Enable the web filtering options that you want Web URL Block Block unwanted web pages and web sites This option adds FortiGate Web URL blocking see Configuring FortiGate Web URL blocking on page 293 FortiGate Web Pattern blocking see Configuring FortiGate Web pattern blocking on page 296 and Cerberian URL filtering see Configuring Cerberian URL filtering on page 296 to HTTP traffic accepted by a policy FortiGate 800 Installation and Configuration Guide 219 Content profiles 220 Web Content Block Web Script Filter Web Exempt List Firewall configuration Block web pages that contain unwanted words or phrases See Content blocking on page 290 Remove scripts from web pages See Script filtering on page 299 Exempt URLs from web filtering and virus scanning See Exempt URL list on page 300 Enable the email filter protection options that you want Email Block List Email Exempt List Email Content Block Add a subject tag to email
174. can select Clear jf to stop an active session Fortinet Inc System status Session list Each line of the session list displays the following information Protocol The service protocol of the connection for example udp tcp or icmp From IP The source IP address of the connection From Port The source port of the connection To IP The destination IP address of the connection To Port The destination port of the connection Expire The time in seconds before the connection expires Clear Stop an active communication session Figure 22 Example session list Total Number of Sessions 659 BE a eA Protocol From IP From Port To IP To Port Expire Clear secs udp 192 168 110 200 1242 206 191 0210 53 76 To top 192 168 110 121 4704 192 168 110 3 443 8 m t 192 168 110 200 1250 65 39 139 188 110 4 E tcp 192 168 110 121 4699 192 168 110 3 443 8 E tep 192 168 110 121 4691 192 168 110 3 443 56 E a tcp 192 168 110 121 4479 10 0 1 128 6969 72 io udp 192 168 110 200 1246 209 87 239 20 53 86 i udp 192 168 110 200 1246 209 97 23921 53 89 E i tep 192 168 110 121 4674 192 168 110 3 443 8 T tcp 192 168 110 155 1107 65 39 139 188 143 3262 To tcp 192 168 110 200 1248 65 39 139 188 110 30 ii top 192 168 110 123 2307 65 39 139 198 110 26 wo tep 192 168 110 121 4701 192 168 110 3 443 8 i tcp 192 168 110 154 1117 65 39 139 188 143 92 top 192 168 110 121 4361 10 0 1 128 6969 49 To tcp 192 168
175. cccccceeeeeeeeeeeeeeees 133 Changing your Fortinet support password cceeeeeeeeeeeeeeeeeeeteeeeeeeeteeeaaeeeeeeeaaeeees 134 Changing your contact information or security QUESTION eeeeeeeeeeeeteteeeeeeeeneeeees 134 Downloading virus and attack definitions updates ec ee eceeeeeeeeeeteeeeeeeteteeeeeeeeee 135 Registering a FortiGate unit after an RMA eeeeeeeeeeeeeee eee eeeeeeeeeeteeeeeeeeseeeaeeeeeeeenaees 136 6 Fortinet Inc Contents Network configuration ua ocsicsases ccooecs Sass c nescence eee 137 CONMGUMNG ZONES saser a ci feccentiae AE ehiedeeetanttdeeetsiede 137 Adding ZONCS neresen A ensaaialeeaesninesdiviliieeeevalatis 138 DGltING ZONES ssns E T 138 Configuring interfaces 0 eceeeeeeeenee eee eeene eee eeeeaeeeeeeeeaeeeeeeeeaeeeeeeeceeeeeeeeiaeeeeeeenaaes 138 Viewing the interface letci annia aia legeass and acadesviedc cress eicdeuedandonds 139 Changing the administrative status of an interface 0 00 0 eeceeeeeeeeetteeeeeettteeeeeeee 139 Adding an interface to a ZONG essesi eenia Eea EEEE EEA ENEA 139 Configuring an interface with a manual IP address sseseeeeeseseeeseeerrrsseerrrsssrrrrrsssees 140 Configuring an interface for DHCP sssiessrsssiiinsrrerniiininsnnnnidennidadiinnnn ianiai 140 Configuring an interface for PPPOE aaeessseesssseeeeerressrsnnnnseinnnanennnnnnstannnnaannnunnataannaannan 141 Adding a secondary IP address to an interface 0 0 0 eeeeeceeceeeeeeeeeeeeenee
176. ccceceeeeeeeeececeee cance eeeeeeeeeesecceaaaecaeeeeeeeeeeeseesecscccaaeeeeeeseeeeeeeeeeneee 218 Default content profiles siisii i a aa 219 Adding Content prowiles iscizececisistdacecsysecdecvbe seeders a a ain 219 Adding content profiles to policies ceccececeeecceceeeeeeeeeeeesececenaecaeeeeeeeeeeeseseneneenaees 221 Us rs and AUTISTIC CNUs sa sewers aaisan napa aodann annarai 223 Setting authentication timeout ecrini eeeeaaaeeeeeeeaeeeeeeeeaeeeeeeeaeeeeeeeaaes 224 Adding user names and configuring authentication eee eceeeeeeeeeeneeeeeeeeeneeeeeeeeaaes 224 Adding user names and configuring authentication cc eeceeeeeeeeeeeeeeeeeeetteeeeeeeeee 224 Deleting user names from the internal database ccceeeeeeeeeeeeeeeettteeeeeeetnteeeeeee 225 Configuring RADIUS SUP POM essri ccdeeecedecseesnseedvecessendecdees sbi aAA AAE AAAA ARa 226 Adding RADIUS Servers occencrcnccccnnreeinnii iA 226 Deleting RADIUS Servers s jcceceentsstazcsbidecncevnaddccecea eiiiai AARAA nainii aAa Taa E iA 226 Conigunng LDAP SUPPOM sesiceietetnsedeaes bind qodaeeeeevedtenonedvdece ARAALE RA 227 Adding LOAF SCrvers sins seccizccesvetacsceacupianceasspeecacecanagaccdadevvetcceneaviacscegdevsslacedeeevtetsceaseptaes 227 Deleting LDAP Servers serisi nea vendatedas pmsl igen AA ALAAN T P 228 Conigunng user groups sssini arrana aA raie I ARNALA A TEAN 229 Adding user QOUPS tizccessuececccenssancecdanpueccecterpecaceddsvpaddcacs N A 229 P
177. ccount select Edit E Optionally type a Trusted Host IP address and netmask for the location from which the administrator can log into the web based manager If you want the administrator to be able to access the FortiGate unit from any address set the trusted host to 0 0 0 0 and the netmask to 255 255 255 255 To limit the administrator to only be able to access the FortiGate unit from a specific network set the trusted host to the address of the network and set the netmask to the netmask for the network For example to limit an administrator to accessing the FortiGate unit from your internal network set the trusted host to the address of your internal network for example 192 168 1 0 and set the netmask to 255 255 255 0 Change the administrator s permission level as required Select OK 10 To delete an administrator account choose the account to delete and select Delete T Configuring SNMP You can configure the FortiGate SNMP agent to report system information and send traps to SNMP managers Using an SNMP manager you can access SNMP traps and data from any FortiGate interface or VLAN subinterface configured for SNMP management access The FortiGate SNMP implementation is read only SNMP v1 and v2c compliant SNMP managers have read only access to FortiGate system information and can receive FortiGate traps To monitor FortiGate system information and receive FortiGate traps you must compile Fortinet proprietary MIBs as well as
178. ccuecaveedscdeasasdeccudersdecedceeabsaddiudervot SNN 208 Virt al IPS ise ccetteeseeceas en scesditvs anazacees cegeatedias sod cadet vesasecduaneea cud sc AEEA OEE E EAAS 208 Adding static NAT virtual IPS sensencan dastieesddaanetevhoas veeereetaiatee 209 Adding port forwarding virtual IPS eeececeeceee scence eee eeceeeeeeesaaeeeeeeeaeeeeeeeenaeeeeeeenaaes 210 Adding policies with virtual IPS c cc cceceeeneeeeeeenne eee eeeenaeeeeeeeeaeeeeeeeiaeeeeeeenaeeeeeeeaaas 212 IP POOIS wos sevice cessed dices reendd a danas auedddada a aa a a a aaa aa iaat 213 Adding an IP POs siceccecsdacdetsiuanastisecias ay dePeculs acct ean ope deseevi easteveuid gyeceevdiiedvbeasis ede iees 213 IP Pools for firewall policies that use fixed Ports 0 ccceeeceeeeeeeeeceeceeeeeeeeeeeeeeeeenaees 214 IP pools and dynamic NAT 0 ccccecceeeeeeceeeeeeeeceneeeeeeeneeeeeeesaeeeeeeeenaeeeeseeenaeeeesenaees 214 IP IMAC bindigi sanani tener ele ieee ai ede ds 214 Configuring IP MAC binding for packets going through the firewall eee 215 Configuring IP MAC binding for packets going to the firewall eceeeeeeseeeeeeeeees 216 Adding IP MAC addresses ieas anidan ENANA NNA NaN aAA RANNAS RNA NAANA Ea 216 Viewing the dynamic IP MAC list ecceceeeeeeeeneeeeeeeeeeeeeeeeeeeeaeeeeseeeeaeeeeteeeaeeeeteeeaaees 217 Enabling IP MAC binding ic c 00ec0is scceeceissseceeetis EEA 217 Content profiles cccccc
179. ce or the DMZ interface Select New to add an address Enter the Address Name IP Address and NetMask for a single computer or for an entire subnetwork on an internal interface of the local VPN peer Select OK to save the destination address To add a firewall policy Add a policy which specifies the source and destination addresses and sets the service for the policy to the traffic type inside the PPTP VPN tunnel Go to Firewall gt Policy Select the policy list that you want to add the policy to usually External gt Internal Select New to add a new policy Set Source to the group that matches the PPTP address range Set Destination to the address to which PPTP users can connect FortiGate 800 Installation and Configuration Guide 259 Configuring PPTP 9 PPTP and L2TP VPN Set Service to match the traffic type inside the PPTP VPN tunnel For example if PPTP users can access a web server select HTTP Set Action to ACCEPT Select NAT if address translation is required You can also configure traffic shaping logging and antivirus and web filter settings for PPTP policies Select OK to save the firewall policy Configuring a Windows 98 client for PPTP oA N Oo FP WO D a fF WO N oO ON CO 12 260 Use the following procedure to configure a client computer running Windows 98 so that it can connect to a FortiGate PPTP VPN To configure the Windows 98 client you must install and configure Windows di
180. ce the firmware upgrade is finished for all the FortiGate units in the cluster log into the cluster and update antivirus and attack definitions for the cluster For information about updating antivirus and attack definitions see Manually initiating antivirus and attack definitions updates on page 119 Fortinet Inc High availability Advanced HA options Replacing a FortiGate unit after failover A failover can occur because of a hardware or software problem When a failover occurs you can attempt to restart the failed FortiGate unit by cycling its power If the FortiGate unit starts up correctly it rejoins the HA cluster which then continues to function normally If the FortiGate unit does not restart normally or does not rejoin the HA cluster you must take it out of the network and either reconfigure or replace it Once the FortiGate unit is reconfigured or replaced change its HA configuration to match the FortiGate unit that failed and reconnect it to the network The reconnected FortiGate unit then automatically joins the HA cluster Advanced HA options You can configure the following advanced HA options using the FortiGate CLI e Selecting a FortiGate unit as a permanent primary unit e Configuring the priority of each FortiGate unit in the cluster e Configuring weighted round robin weights Selecting a FortiGate unit as a permanent primary unit In a typical FortiGate cluster configuration the primary unit is selected aut
181. cedestaadctenavestaeudsevenddderespeace 120 Enabling scheduled updates cecceececeeeeeeeeeeetneee trssstinnanatttntnsattnnnantttnnnsttennnnnenn 120 Adding an override SOIVel eecnevssnciearraiiisi rrei EAE 121 Enabling scheduled updates through a Proxy SEIrVEl eceeceeeeeeteeeeeeeeeeteeeeeettnneeeeees 122 Enabling push Updates ic i acct sncccss seri cneesaeta peace legunde ceeierdietdua foes ie anaeeens E A Aiai 122 Enabling pusm updates osseo iiiseil ia ad 123 Push updates when FortiGate IP addresses Chang 0 ccccccceeeeeeeeeeereeeeeteteeeeeees 123 Enabling push updates through a NAT deVICE ceicceeeeceeeeeeeeeeeeettteeeeeeetnieeeeeren 124 Registering FortiGate Units 2 20 0 ecceeeeeeeeeeeee eee eeeeeeeeeeeneeeeeeseeeeeeeeeseeeeaeeeeeeeeaeeeeeeeaaaees 128 FortiCare Service Contracts cccccecccceceeeeeeeeeeeeeeeeceeeeeeeseneeeeeeeseneeaeeeseeeeaeeeeeneeaeeees 129 Registering the FortiGate Unit ecceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseneeeeeeeseeaaeeeeeenaaeeees 130 Updating registration information sssrinin onnie 131 Recovering a lost Fortinet Support PASSWOTG 2 ce ceeeeceeeeeeeeeeeeeeteeeeenaeeaeeeeeeeeess 132 Viewing the list of registered FortiGate units 0 ee ceeeeeeeceeeeeeeeeteeeeeeenaeeeeeeeaaes 132 Registering a new FortiGate Unit 2 00 2 eceeeeee teen cece eeene eee eeeeaeeeeeeteeeeeeeteeeeeree 133 Adding or changing a FortiCare Support Contract numbe c
182. cedure Manually initiating antivirus and attack definitions updates on page 119 to make sure that antivirus and attack definitions are up to date To upgrade the firmware using the web based manager Copy the firmware image file to your management computer Log into the web based manager as the admin administrative user Go to System gt Status Select Firmware Upgrade ie Type the path and filename of the firmware image file or select Browse and locate the file 6 Select OK The FortiGate unit uploads the firmware image file upgrades to the new firmware version restarts and displays the FortiGate login This process takes a few minutes a fF WN Log into the web based manager Go to System gt Status and check the Firmware Version to confirm that the firmware upgrade is successfully installed 9 Update antivirus and attack definitions For information about antivirus and attack definitions see Manually initiating antivirus and attack definitions updates on page 119 Upgrading the firmware using the CLI To use the following procedure you must have a TFTP server that the FortiGate unit can connect to A Note Installing firmware replaces your current antivirus and attack definitions with the S definitions included with the firmware release that you are installing After you install new z firmware use the procedure Manually initiating antivirus and attack definitions updates on page 119 to make sure that
183. configuration Configuring routing 6 Set Device 1 to the FortiGate interface or VLAN subinterface through which to route traffic to connect to Gateway 1 You can select the name of an interface VLAN subinterface or Auto the default If you select the name of an interface or VLAN subinterface the traffic is routed to that interface If you select Auto the system selects the interface according to the following rules e Ifthe Gateway 1 IP address is on the same subnet as a FortiGate interface or VLAN subinterface the system sends the traffic to that interface e Ifthe Gateway 1 IP address is not on the same subnet as a FortiGate interface or VLAN subinterface the system routes the traffic to the external interface using the default route You can use Device 1 to send packets to an interface that is on a different subnet than the destination IP address of the packets without routing them using the default route 7 Set Device 2 to the FortiGate interface or VLAN subinterface through which to route traffic to connect to Gateway 2 You can select the name of an interface VLAN subinterface or Auto the default If you select the name of an interface or VLAN subinterface the traffic is routed to that interface If you select Auto the system selects the interface according to the following rules Ifthe Gateway 2 IP address is on the same subnet as a FortiGate interface or VLAN subinterface the system sends the traffic to that
184. creases Service The service from which the file was quarantined HTTP FTP IMAP POP3 SMTP Status Indicates if the file is infected by a virus caught by heuristics blocked by a block pattern or oversized Status Specific information related to the status for example File is infected with Description W32 Klez h or File was stopped by file block pattern DC Duplicate count A count of how many duplicate files were discovered during quarantine A rapidly increasing number can indicate a virus outbreak TTL Time to live in the format hh mm When the TTL elapses the FortiGate unit labels the file as EXP under the TTL heading In the case of duplicate files each duplicate found refreshes the TTL Actions You can delete or download the file When you download a file it is downloaded in its original format A Note In the case of duplicate files all fields relate to the originally quarantined file except TTL XS which is refreshed with every new instance of a specific file Duplicate files based on S checksum are never stored but an internal counter for each file records the number of duplicates Sorting the quarantine list You can sort the quarantine list according to status infected or blocked service IMAP POP3 SMTP FTP or HTTP date quarantined time to live TTL duplicate count or alphabetically by filename To sort the Quarantine list Go to Anti Virus gt Quarantine Select a column head
185. ct the link to replace a unit with a new unit from an RMA Select Finish The list of FortiGate products that you have registered is displayed The list now includes the replacement FortiGate unit All support levels are transferred to the replacement unit Fortinet Inc RAT MET Network configuration You can use the System Network page to change any of the following FortiGate network settings e Configuring zones e Configuring interfaces e VLAN overview e VLANs in NAT Route mode e Virtual domains in Transparent mode e Adding DNS server IP addresses e Configuring routing e Configuring DHCP services Configuring zones In NAT Route mode you can use zones to group related interfaces and VLAN subinterfaces Grouping interfaces and VLAN subinterfaces into zones simplifies policy creation If you group interfaces an VLAN subinterfaces into a zone you can configure policies for connections to and from this zone rather than to and from each interface and VLAN subinterface You can add zones rename and edit zones and delete zones from the zone list A new zone does not appear in the policy grid until you add an interface to it see Adding an interface to a zone on page 139 and add a firewall address for it see Adding addresses on page 197 This section describes e Adding zones e Deleting zones FortiGate 800 Installation and Configuration Guide 137 Configuring interfaces Adding zones 5 Net
186. cted in step 4 is set using PPPoE or DHCP you can enter 0 0 0 0 for the external IP address The FortiGate unit substitutes the IP address set for this external interface using PPPoE or DHCP FortiGate 800 Installation and Configuration Guide 209 Virtual IPs Firewall configuration In Map to IP type the real IP address on the destination network for example the IP address of a web server on an internal network Note The firewall translates the source address of outbound packets from the host with the Map to IP address to the virtual IP External IP Address instead of the firewall external address Select OK to save the virtual IP You can now add the virtual IP to firewall policies Figure 47 Adding a static NAT virtual IP Virtual IP D Add New Virtual IP Mapping Name Web_Server External Interface fexternal I Type Static NAT Port Forwarding External IP Address 173 87 39 21 Map to IP 10 10 10 5 Adding port forwarding virtual IPs 210 To add port forwarding virtual IPs Go to Firewall gt Virtual IP Select New to add a virtual IP Type a Name for the virtual IP The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select the virtual IP External Interface from the list The external interface is the interface connected to the source network that receives the packets to be fo
187. ction to the FDN The test results are displayed at the top of the System Update page 118 Fortinet Inc Virus and attack definitions updates and registration Updating antivirus and attack definitions Table 19 Connections to the FDN Connections Status Comments Available The FortiGate unit can connect to the FDN You can configure the FortiGate unit for scheduled updates See Scheduling updates on page 120 Not available The FortiGate unit cannot connect to the FDN You j must configure your FortiGate unit and your network so FortiResponse that the FortiGate unit can connect to the Internet and Distribution to the FDN For example you may need to add routes Network to the FortiGate routing table or configure your network to allow the FortiGate unit to use HTTPS on port 8890 to connect to the Internet You may also have to connect to an override FortiResponse server to receive updates See Adding an override server on page 121 Available The FDN can connect to the FortiGate unit to send push updates You can configure the FortiGate unit to receive push updates See Enabling push updates on page 122 Not available The FDN cannot connect to the FortiGate unit to send push updates Push updates may not be available if Push Update you have not registered the FortiGate unit see Registering the FortiGate unit on page 130 if there is a NAT device installed between the FortiGate unit and the F
188. d be at least six characters long The password can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Fortinet Inc 224 Users and authentication Adding user names and configuring authentication LDAP Require the user to authenticate to an LDAP server Select the name of the LDAP server to which the user must authenticate You can only select an LDAP server that has been added to the FortiGate LDAP configuration See Configuring LDAP support on page 227 Radius Require the user to authenticate to a RADIUS server Select the name of the RADIUS server to which the user must authenticate You can only select a RADIUS server that has been added to the FortiGate RADIUS configuration See Configuring RADIUS support on page 226 5 Select the Try other servers if connect to selected server fails check box if you have selected Radius and you want the FortiGate unit to try to connect to other RADIUS servers added to the FortiGate RADIUS configuration 6 Select OK Figure 52 Adding a user name Local N pew User User Name User 2 l Disable Password pea C LDAP LDAP_1 7 C Radius Radiusi x I Try other servers if connect to selected server fails Deleting user names from the internal database You cannot delete user names that have been added to user groups Remove user names from user groups before deleti
189. d manager by going to System gt Status The serial number is also available from the CLI using the get system status command e FortiCare Support Contract numbers if you purchased FortiCare Support Contracts for the FortiGate units that you want to register To register one or more FortiGate units Go to System gt Update gt Support 2 Enter your contact information on the product registration form Figure 27 Registering a FortiGate unit contact information and security question Contact Information First Name Customer tti i s S Last Name Name o Company Company tsts sS Title Administrator Email Customer company com Addressa i23MySteet Address 2 CT City City rade ce tate sg hz Country onte states Zip 123456 Region os UNITED STATES contact 1 555 555 5555 Fax Number one Security Question Security question will be used if you forgot your password Answer to Security Question will be used if you forgot your password 3 Provide a security question and an answer to the security question 130 Fortinet Inc Virus and attack definitions updates and registration Updating registration information 4 Select the model number of the Product Model to register 5 Enter the Serial Number of the FortiGate unit 6 If you have purchased a FortiCare Support Contract for this FortiGate unit enter the support contract number Figure 28 Registering a Fort
190. d managing cluster log messages To view log messages for each cluster member 1 Connect to the cluster and log into the web based manager 2 Goto Log amp Report gt Logging The cluster displays the primary unit Traffic log Event log Attack log Antivirus log Web Filter log and Email Filter log The pull down list at the upper right of the display identifies the unit for which logs are displayed The primary unit is identified as Local and the other units in the cluster are listed by serial number 3 Select the serial number of one of the units in the cluster to display the logs for this cluster unit You can view logs saved to memory or logs saved to the hard disk depending on the configuration of the cluster unit 4 For each cluster unit e Ifthe cluster unit logs to memory you can view search and manage log messages For more information see Viewing logs saved to memory on page 317 e Ifthe cluster unit contains a hard disk you can view search and manage log messages For more information see Viewing and managing logs saved to the hard disk on page 318 Downloading a log file to the management computer on page 320 Deleting all messages from an active log on page 320 Deleting a saved log file on page 320 82 Fortinet Inc High availability Managing an HA cluster Monitoring cluster units for failover If the primary unit in the cluster fails the units in the cluster renegotiate to se
191. d one policy using the address group rather than a separate policy for each address You can add address groups to any interface VLAN subinterface or zone The address group can only contain addresses from that interface VLAN subinterface or zone Address groups are available in interface VLAN subinterface or zone source or destination address lists Address groups cannot have the same names as individual addresses If an address group is included in a policy it cannot be deleted unless it is first removed from the policy To organize addresses into an address group 1 Go to Firewall gt Address gt Group 2 Select the interface VLAN subinterface or zone that you want to add the address group to 3 Enter a Group Name to identify the address group The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed 4 To add addresses to the address group select an address from the Available Addresses list and select the right arrow to add it to the Members list 5 To remove addresses from the address group select an address from the Members list and select the left arrow to remove it from the group 6 Select OK to add the address group FortiGate 800 Installation and Configuration Guide 199 Services Figure 43 Adding an internal address group Interface A Group New Address Group internal Firewall conf
192. day You can specify the time of day to check for updates Weekly Once a week You can specify the day of the week and the time of day to check for updates 120 Fortinet Inc Virus and attack definitions updates and registration Scheduling updates 4 Select Apply The FortiGate unit starts the next scheduled update according to the new update schedule Whenever the FortiGate unit runs a scheduled update the event is recorded in the FortiGate event log Figure 23 Configuring automatic antivirus and attack definitions updates Update FortiResponse Distribution Network available Push Update not available I Use override server address Update Version Expiry date Last update attempt ndate Status Anti Virus Engine 1 00 Mon Nov 29 19 00 00 1999 Tue Aug 12 14 25 21 2003 No updates anti Virus Definition 4 115 Mon Nov 29 19 00 00 1999 Tue Aug 12 14 25 21 2003 No updates Attack Definition 2 56 Mon Nov 29 19 00 00 1999 Tue Aug 12 14 25 21 2003 No updates V Allow Push Update M Use override push IP 64 230 123 149 Port 45034 V Scheduled Update Every o x hour m a minutes after the hour C Daily jo a hour foo minute C Weekly Sunday z day fo H hour foo minute Adding an override server If you cannot connect to the FDN or if your organization provides antivirus and attack updates using their own FortiResponse server you can use the following procedure to add the IP address of a
193. ddress of the next hop router on the network connected to the interface Select the Enable check box The FortiGate unit uses dead gateway detection to ping the Ping Server IP address to make sure that the FortiGate unit can connect to this IP address To configure dead gateway detection see Modifying the Dead Gateway Detection settings on page 171 Select OK to save the changes Fortinet Inc Network configuration Configuring interfaces Controlling administrative access to an interface For a FortiGate unit running in NAT Route mode you can control administrative access to an interface to control how administrators access the FortiGate unit and the FortiGate interfaces to which administrators can connect Controlling administrative access for an interface connected to the Internet allows remote administration of the FortiGate unit from any location on the Internet However allowing remote administration from the Internet could compromise the security of your FortiGate unit You should avoid allowing administrative access for an interface connected to the Internet unless this is required for your configuration To improve the security of a FortiGate unit that allows remote administration from the Internet e Use secure administrative user passwords e Change these passwords regularly e Enable secure administrative access to this interface using only HTTPS or SSH Do not change the system idle timeout from the default v
194. ddress of the primary unit is 10 0 0 1 The IP address of the first subordinate unit is 10 0 0 2 The IP address of the second subordinate unit is 10 0 0 3 and so on Managing individual cluster units You can connect to the CLI of each unit in the cluster This procedure describes how to log into the primary unit CLI and from there connect to the CLI of subordinate cluster units You log into the subordinate unit with the ha_admin administrator account This built in administrator account gives you read amp write permission on the subordinate unit For information about administration accounts and permissions see Adding and editing administrator accounts on page 172 FortiGate 800 Installation and Configuration Guide 83 Managing an HA cluster High availability To manage a cluster unit Use SSH to connect to the cluster and log into the CLI Connect to any cluster interface configured for SSH management to log into the cluster You can also use a direct cable connection to log into the primary unit CLI To do this you must know which unit is the primary unit See Selecting a FortiGate unit as a permanent primary unit on page 87 to control which FortiGate unit becomes the primary unit Enter the following command followed by a space and type a question mark 7 execute ha manage The CLI displays a list of all the subordinate units in the cluster Each cluster unit is numbered starting at 1 The information displayed fo
195. default option Block traffic Block all network traffic when the hard disk is full Do not log Stop logging messages when the hard disk is full 8 Select Apply FortiGate 800 Installation and Configuration Guide 311 Recording logs 312 Recording logs in system memory A gt 5 Log message Logging and reporting If your FortiGate unit does not contain a hard disk you can configure the FortiGate unit to reserve some system memory for storing current event attack antivirus web filter and email filter log messages Logging to memory allows quick access to only the most recent log entries The FortiGate unit can store a limited number of messages in system memory After all available memory is used the FortiGate unit deletes the oldest messages If the FortiGate unit restarts the log entries are lost Note The FortiGate unit can record only the event and attack log messages in system memory To record logs in system memory Go to Log amp Report gt Log Setting Select the Log to memory check box Select the severity level for which you want to record log messages The FortiGate logs all levels of severity down to but not lower than the level you choose For example if you want to record emergency alert critical and error messages select Error See Log message levels on page 312 Select Config Policy To configure the FortiGate to filter the types of logs and events to record use the procedures in
196. describes e Adding a RIP filter list e Assigning a RIP filter list to the neighbors filter e Assigning a RIP filter list to the incoming filter e Assigning a RIP filter list to the outgoing filter Adding a RIP filter list Each entry in a RIP filter list consists of a prefix IP address and netmask the action RIP should take for this prefix allow or deny and the interface to which to apply this RIP filter list entry To add a RIP filter list Go to System gt RIP gt Filter Select New to add a RIP filter FortiGate 800 Installation and Configuration Guide 165 Adding RIP filters 166 N oO NO oO FR WO DN RIP configuration For Filter Name type a name for the RIP filter list The name can be 15 characters long and can contain upper and lower case letters numbers and special characters The name cannot contain spaces Select the Blank Filter check box to create a RIP filter list with no entries or enter the information for the first entry on the RIP filter list Enter the IP address and Mask to create the prefix For Action select allow or deny For Interface enter the name of the interface to which to apply the entry Select OK to save the RIP filter list To add an entry to a RIP filter list Go to System gt RIP gt Filter For the RIP filter list name select Add Prefix to add an entry to the filter list Enter the IP address and Mask to create the prefix For Action select allow or den
197. destination email address Email users can use their mail client software to filter the messages based on the subject tag To add a subject tag Go to Email Filter gt Config Type the Subject Tag that you want to display in the subject line of email received from unwanted addresses or that contains banned words For example type Unwanted Mail Note Do not use quotation marks in the subject tags Select Apply The FortiGate unit adds the tag to the subject line of all unwanted email Fortinet Inc RAT MET Logging and reporting You can configure the FortiGate unit to log network activity from routine configuration changes and traffic sessions to emergency events You can also configure the FortiGate unit to send alert email messages to inform system administrators about events such as network attacks virus incidents and firewall and VPN events This chapter describes e Recording logs e Filtering log messages e Configuring traffic logging e Viewing logs saved to memory e Viewing and managing logs saved to the hard disk e Configuring alert email Recording logs You can configure logging to record logs to one or more of a computer running a syslog server a computer running a WebTrends firewall reporting server the FortiGate hard disk if your FortiGate unit contains a hard disk e the console For information about filtering the log types and activities that the FortiGate unit records see Filter
198. dialup connection Go to Start gt Settings gt Network and Dial up Connections Double click Make New Connection to start the Network Connection Wizard and select Next For Network Connection Type select Connect to a private network through the Internet and select Next For Destination Address enter the address of the FortiGate unit to connect to and select Next Set Connection Availability to Only for myself and select Next Select Finish FortiGate 800 Installation and Configuration Guide 265 Configuring L2TP 266 os 10 11 12 ao a fF WN PPTP and L2TP VPN In the Connect window select Properties Select the Security tab Make sure that Require data encryption is selected Note If a RADIUS server is used for authentication do not select Require data encryption L2TP encryption is not supported for RADIUS server authentication Select the Networking tab Set VPN server type to Layer 2 Tunneling Protocol L2TP Save the changes and continue with the following procedure To disable IPSec Select the Networking tab Select Internet Protocol TCP IP properties Double click the Advanced tab Go to the Options tab and select IP security properties Make sure that Do not use IPSEC is selected Select OK and close the connection properties window Note The default Windows 2000 L2TP traffic policy does not allow L2TP traffic without IPSec encryption You can disable default behavior by editing the
199. display includes bar graphs of the number viruses and intrusions detected per hour as well as line graphs of the number of viruses and intrusions detected for the last 20 hours For more information see Viewing virus and intrusions status on page 113 5 Select Packets amp Bytes The cluster displays the number of packets and bytes processed by each cluster member To set the update frequency 1 Select the automatic refresh interval 2 Select Go More frequent updates use more system resources and increase network traffic However this only occurs when you are viewing the display using the web based manager FortiGate 800 Installation and Configuration Guide 81 Managing an HA cluster High availability Viewing cluster sessions To view the cluster communication sessions 1 Connect to the cluster and log into the web based manager 2 Go to System gt Status gt Session The session table displays the sessions processed by the primary unit in the cluster including HA communication sessions between the primary unit and the subordinate units HA communications use e Port 702 as the destination port From and To IP address on the 10 0 0 0 subnet During cluster negotiation the HA interface of each cluster unit is assigned an IP address The IP address of the primary unit is 10 0 0 1 The IP address of the first subordinate unit is 10 0 0 2 The IP address of the second subordinate unit is 10 0 0 3 and so on Viewing an
200. down 110 signature threshold values 275 334 SMTP 202 configuring alert email 321 definition 324 SNMP configuring 173 contact information 175 definition 324 first trap receiver IP address 175 get community 175 MIBs 176 system location 175 trap community 175 traps 177 source log search 319 policy option 190 squidGuard 295 307 SSH 202 325 SSL 323 service definition 201 starting IP DHCP 159 160 PPTP 258 263 static IP MAC list 215 static NAT virtual IP 208 adding 209 static route adding 154 status CPU 111 interface 139 intrusions 113 IPSec VPN tunnel 255 memory 111 network 112 sessions 112 viewing dialup connection status 255 viewing VPN tunnel status 255 virus 113 subnet definition 325 subnet address definition 325 support contract number adding 133 changing 133 support password changing 134 syn interval 169 synchronize with NTP server 169 system configuration 169 system date and time setting 169 system location SNMP 175 system name SNMP 175 system options changing 170 Fortinet Inc system settings backing up 108 restoring 108 restoring to factory default 109 system status 93 111 161 system status monitor 114 T TCP configuring checksum verification 270 custom service 203 technical support 23 testing alert email 321 time log search 318 319 setting 169 time zone 169 timeout firewall authentication 170 idle 170 IPSec VPN 255 256 web based manager 170 to IP system status 115
201. e Adding VLAN subinterfaces on page 147 to adda VLAN subinterface to a zone if you are adding new VLAN subinterfaces to a virtual domain to which you have already added zones FortiGate 800 Installation and Configuration Guide 151 Virtual domains in Transparent mode Network configuration Adding firewall policies for virtual domains Once the network configuration for the virtual domain is complete you must create firewall policies for the virtual domain to allow packets to flow through the firewall between VLAN subinterfaces e Adding addresses for virtual domains e Adding firewall policies for virtual domains Adding addresses for virtual domains Before you can create firewall policies for a virtual domain you must add source and destination addresses for the VLAN subinterfaces and zones added to the virtual domain Go to Firewall gt Address Select the VLAN subinterface or zone to which to add the address Select New to add a new address Enter an Address Name to identify the address Enter the IP Address Enter the NetMask Select OK to add the address N oO oO Ff WO DN a Adding firewall policies for virtual domains Add Firewall policies to control connections and traffic between FortiGate VLAN subinterfaces and zones in a virtual domain Go to Firewall gt Policy Select the Virtual Domain to which you want to add the policy Select a source VLAN subinterface or zone kh OO N Select a destination VL
202. e Users list and select the right arrow to add the RADIUS server to the Members list To add an LDAP server to the user group select an LDAP server from the Available Users list and select the right arrow to add the LDAP server to the Members list To remove users RADIUS servers or LDAP servers from the user group select a user RADIUS server or LDAP server from the Members list and select the left arrow to remove the name RADIUS server or LDAP server from the group Select OK Deleting user groups You cannot delete user groups that have been selected in a policy a dialup user phase 1 configuration or a PPTP or L2TP configuration To delete a user group Go to User gt User Group Select Delete 1 beside the user group that you want to delete Select OK Fortinet Inc AT MET IPSec VPN A Virtual Private Network VPN is an extension of a private network that encompasses links across shared or public networks such as the Internet For example a company that has two offices in different cities each with its own private network can use a VPN to create a secure tunnel between the offices Similarly a teleworker can use a VPN client for remote access to a private office network In both cases the secure connection appears to the user as a private network communication even though the communication is over a public network Secure VPN connections are enabled by a combination of tunneling data encryption and authentic
203. e 17 NAT ROUtG MOJE aiina nnana a ai i a a aa aaa 18 Transparent Modeion a n iaa aa a a aaa a a 18 VLANs and virtual dOmaN Seians iaaa eaa a aaa aiia aaia 18 Network intrusion detection ccccecceeececeeeeeeceeeeeeceeeeeeeeesedseceaaeaeeeceeeeeeeeeseeseseeeneenaeees 18 MPN ssid E E EEEE E E A naade cents E E E 19 FAI Ma VANADINGY siii E acuddudancheleyyeencdiut vent aeeeeet 19 Secure installation configuration and management ecceecceeeeeeeeeeeseeeeesnneaeees 20 Web based Manager iscccieiiteledicetieccdiateteacdiavenecdilevi oldie ceeaaaiabeentiedi iw eedtilaceede 20 Command line interface cccececeecececeeceeceeeeeeeeeeeeecaeeaaecaeceeeeeeeeeeesecsecccuccueeeeeeeeeeess 21 bogging and FEPOMING 43 ceccevis feces ita eet aed hs hae aa eae eee 21 DOCUMENT CONVENTIONS saisin adiri a aaa aai 22 Fortinet d cu umentati n csiga ansia aaiae aE AEA aa AA 22 Comments on Fortinet technical dOCUMENtATION cece eteteeteeeeeeeteeeeseeeenees 23 Customer service and technical SUPPOSt 2 c cececceceeee eee eeeeeeeceaeaeceeeeeeeeeseeseesnnnnnaeeees 23 Getting Started sinici 25 Package COMMS ereenn ea R E A 26 MOONIN ecce E EE E EE EN EARE 26 FPowernng OFM sci epic cteda vied nonea E A E E ETS 27 Connecting to the web based Manager ccceceeeececeeeeeeeeeeeeeeeeeeeeteeeeeeeeeteeeaaeeeeeeenaeeees 28 Connecting to the command line interface CLI eceeeeeeceeeeeeeeeeteeeeeeetteeee
204. e compatible with the FGCP because they use a Global MAC address table HP 4100 GL series e HP2628 HP5300 e Cisco Catalyst e Cisco 2850 e Cisco 3550 e Nortel PP8600 e Nortel XLR Transparent mode packet flow In transparent mode six MAC addresses are involved in active active communication between a client and a server if the cluster routes the packets to the subordinate unit in the cluster e Client MAC address MAC_C e Server MAC address MAC_S e Primary unit internal MAC address MAC_P_1 e Primary unit external MAC address MAC_P_E e Subordinate unit internal MAC address MAC_S_1 Subordinate unit external MAC address MAC_S_E A request packet from a client on the internal network to a server on the external network Source is MAC_C and destination is MAC_S from client to primary Source is MAC_P_ and destination is MAC_S_ from primary internal to subordinate internal Source is MAC_S_E and destination is MAC_S from subordinate external to server A response packet from a server on the external network to a client on the internal network Source is MAC_S and destination is MAC_C from server to primary Source is MAC_P_E and destination is MAC_S_E from primary external to subordinate external Source is MAC_S_ and destination is MAC_C from subordinate internal to client FortiGate 800 Installation and Configuration Guide 91 Active Active cluster packet flow High availa
205. e configuration settings Planning the FortiGate configuration FortiGate model maximum values matrix Next steps FortiGate 800 Installation and Configuration Guide 25 Getting started Package contents Package contents Mounting 26 The FortiGate 800 package contains the following items e FortiGate 800 Antivirus Firewall one orange crossover ethernet cable one grey regular ethernet cable one RJ 45 serial cable e one RJ 45 to DB 9 convertor one power cable e two 19 inch rack mount brackets e FortiGate 800 QuickStart Guide e CD containing Fortinet user documentation Figure 2 FortiGate 800 package contents Front Ethernet Cables _Orange Crossover Z Grey Straight through J RJ 45 Serial Cable LCD Control _ Internal External DMZ 1to4 Serial USB RJ 45 to DB 9 Convert Buttons HA Interface Interface Port future d 9 omveyor Back O Power Cable te i E Be Rack Mount Brackets _ 5 Power Power Connection Switch se e Documentation The FortiGate 800 unit can be mounted in a standard 19 inch rack It requires 1 U of vertical space in the rack The FortiGate 800 unit can also be installed as a free standing appliance on any stable surface For free standing installation make sure that the appliance has at least 1 5 in 3 75 cm of clearance on each side to allow for
206. e high CPU usage exceeds 90 memory low Memory usage exceeds 90 disk low On a FortiGate unit with a hard drive hard drive usage exceeds 90 lt FortiGate_serial_no gt The configuration of an interface of a FortiGate unit changes The trap lt interface_name gt message includes the name of the interface and the serial number of the FortiGate unit HA switch The primary unit in an HA cluster fails and is replaced with a new pri mary unit FortiGate 800 Installation and Configuration Guide 177 Configuring SNMP System configuration VPN traps Table 23 FortiGate VPN traps Trap message Description VPN tunnel is up An IPSec VPN tunnel starts up and begins processing network traf fic VPN tunnel down An IPSec VPN tunnel shuts down NIDS traps Table 24 FortiGate NIDS traps Trap message Description Flood attack happened NIDS attack prevention detects and provides protection from a syn flood attack Port scan attack hap NIDS attack prevention detects and provides protection from a pened port scan attack Antivirus traps Table 25 FortiGate antivirus traps Trap message Description virus detected The FortiGate unit detects a virus and removes the infected file from an HTTP or FTP download or from an email message Logging traps Table 26 FortiGate logging traps Trap message Description log full On a FortiGate unit with a hard drive
207. e interface cece eter eee eenneee eee taeeeeee eases eeetiaeeeeeetaaeeeeeee 61 Changing to Transparent mode using the CLI ec eeeeeeeeeeeeeeeeeeeeeeeeeeteeeeeeetneeeeeee 61 Configuring the Transparent mode management IP address ceeeeeeeeeeeees 62 Configure the Transparent mode default gateway ccceceeeeestteeeeeeettteeeeeetneeeeeees 62 Completing the Configuration cece eeeeeeeeeeeeeeeneeeeseeeeaeeeeeeeaaeeeeeeeaeeeeeeeeneeeeesenaees 62 Setting the date and UMO sccreresnenccarii ia ebadileiieadalieieh biechailaeess 62 Enabling antivirus protection s cccccciecceteetciecceecsteveeeetestndvecteate a 62 Registering your FortiGate Units ieccsccesscntseeseiedatectawectucedeenecccetanphiccncsvened qieyvvaenectebaventeanees 63 Configuring virus and attack definition updates ee eceeceeeeeetee cette tneeeeeeeetaeeeeeeeee 63 Connecting the FortiGate unit to your NEtWOFKS ee eee eeeeeeeeeeeneeeeeeeeaeeeeeeeeaeeeeeeeaees 63 4 Fortinet Inc Transparent mode configuration CXAMPIES ccceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeteeaaeeeeteeaaeees 64 Default routes and static routes escrieu 65 Example default route to an external NEtWOFK cccceecceeeeeeeeeteeeeeeeetteeeeeeeenaeeeeeeeeaaes 65 Example static route to an external destination eee ceceeeeeteeeeeeeeetteeeeeeeeteeeeeeeeaaes 67 Example static route to an internal destination cc eceeceeeeeeeeeeeeeete
208. e interface of the FortiGate unit that can connect to the TFTP server and press Enter The following message appears Enter File Name image out Enter the firmware image file name and press Enter The TFTP server uploads the firmware image file to the FortiGate unit and messages similar to the following appear Save as Default firmware Backup firmware Run image without saving D B R Type B The FortiGate unit saves the backup firmware image and restarts When the FortiGate unit restarts it is running the previously installed firmware version Fortinet Inc System status Changing the FortiGate firmware Switching to the backup firmware image Use this procedure to switch the FortiGate unit to operating with a backup firmware image that you previously installed When you switch the FortiGate unit to the backup firmware image the FortiGate unit operates using the configuration that was saved with that firmware image If you install a new backup image from a reboot the configuration saved with this firmware image is the factory default configuration If you use the procedure Switching back to the default firmware image on page 106 to switch to a backup firmware image that was previously running as the default firmware image the configuration saved with this firmware image is restored To switch to the backup firmware image Connect to the CLI using the null modem cable and FortiGate console port Enter the follow
209. e list Viewing attack descriptions Disabling NIDS attack signatures Adding user defined signatures FortiGate 800 Installation and Configuration Guide 269 Detecting attacks Network Intrusion Detection System NIDS Selecting the interfaces to monitor To select the interfaces to monitor for attacks 1 Go to NIDS gt Detection gt General 2 Select the interfaces to monitor for network attacks You can select up to a total of 4 interfaces and VLAN subinterfaces 3 Select Apply Disabling monitoring interfaces To disable monitoring interfaces for attacks 1 Go to NIDS gt Detection gt General Clear the check box for all the interfaces that you do not want monitored Select Apply Configuring checksum verification Checksum verification tests the files that pass through the FortiGate unit to make sure that they have not been changed in transit The NIDS can run checksum verification on IP TCP UDP and ICMP traffic For maximum detection you can turn on checksum verification for all types of traffic However if the FortiGate unit does not need to run checksum verification you can turn it off for some or all types of traffic to improve system performance For example you might not need to run checksum verification if the FortiGate unit is installed behind a router that also does checksum verification To configure checksum verification 1 Go to NIDS gt Detection gt General Select the type of traffic that you want
210. e policy The policy applies virus scanning because the Antivirus amp Web Filter option is selected and the Content profile is set to Scan For more information about content profiles see Content profiles on page 218 Figure 39 Default firewall policy ID Source Dest Schedule Service Action Enable Config 1 1 Internal_All External_All Always ANY ACCEPT M T amp ce Cc e Interfaces e VLAN subinterfaces e Zones e Addresses e Services e Schedules e Content profiles Fortinet Inc Firewall configuration Interfaces Default firewall configuration Add policies to control connections between FortiGate interfaces and between the networks connected to these interfaces By default you can add policies for connections that include the internal external and DMZ interfaces To add policies that include the port1 to port4 interfaces you must use the following steps to add these interfaces to the firewall policy grid If they are down start the interfaces up See Changing the administrative status of an interface on page 139 Add IP addresses to the interfaces See Configuring interfaces on page 138 Add firewall addresses for these interfaces See Adding addresses on page 197 VLAN subinterfaces Zones You can also add VLAN subinterfaces to the FortiGate configuration to control connections between VLANs For more information about VLANs see VLANs in NAT Route mode on page 146 or V
211. e squidGuard robot searches the web for new URLs to add to the blacklists You can upload the squidGuard blacklists to the FortiGate unit as a text file with only minimal editing to remove comments at the top of each list and to combine the lists that you want into a single file A Note All changes made to the URL block list using the web based manager are lost when you upload a new list However you can download your current URL block list add more items to it using a text editor and then upload the edited list to the FortiGate unit To upload a URL block list In a text editor create the list of URLs and patterns that you want to block Using the web based manager go to Web Filter gt Web URL Block Select Upload URL Block List Elt Type the path and filename of the URL block list text file or select Browse and locate the file Select OK to upload the file to the FortiGate unit 6 Select Return to display the updated Web URL block list Each page of the Web URL block list displays 100 URLs 7 Use Page Down and Page Up F to navigate through the Web URL block list kh OO N oa FortiGate 800 Installation and Configuration Guide 295 Configuring Cerberian URL filtering Web filtering 8 You can continue to maintain the Web URL block list by making changes to the text file and uploading it again Configuring FortiGate Web pattern blocking You can configure FortiGate web pattern blocking to block web pages that m
212. e status of the link even if there is no traffic between the local peer and the remote peer 6 Select OK to save the phase 1 parameters 238 Fortinet Inc IPSec VPN Figure 56 Adding a phase 1 configuration Standard options New VPN Gateway Gateway Name Remote_Client_3 Remote Gatevray Dialuo User z Mode agressive Main 1D protection P1 Proposal 1 Encryption 308S Z Authantication SHA1 1 2 Eneryption 30ES z Authenticationm05 2 A DH Group i 2 5M Keylife 28800 seconds Authentication Method R54 Signature Certificate Name Local_FGT_certificate 2 Local ID optional W Advanced Options Dialup Group Peer XAUTH Nat Traversal DPD Peer Options Accept any peer ID Accept this peer 1D Accept peer ID in dialup group nore H xauth Disable C Enable as Client Enable as Server Nat traversal M Enable Keepalive Frequency 5 Seconds Dead Peer Detection M Enable Short Idle 1o seconds Retry Count B times Retry Interval 5 Seconds Long Idle B00 seconds Cancel Figure 57 Adding a phase 1 configuration Advanced options Advanced Options Dialup Group Peer XAUTH Nat Traversal DPD Peer Options Accept any peer ID C Accept this peer ID ae ____ Accept peer ID in dialup group Gregory XAuth Nat traversal Keepalive Frequency Disable Enable as Client Enable as Server M Enable
213. e unit to the management computer To download the certificate request Go to VPN gt Certificates gt Local Certificates Select Download X to download the local certificate to the management computer Select Save Name the file and save it in a directory on the management computer After downloading the certificate request you can submit it tor your CA so that your CA can sign the certificate Importing the signed local certificate With this procedure you import the signed local certificate from the management computer to the FortiGate unit To import the signed local certificate Go to VPN gt Certificates gt Local Certificates Select Import Enter the path or browse to locate the signed local certificate on the management computer Select OK The signed local certificate is displayed on the Local Certificates list with a status of OK Backing up and restoring the local certificate and private key When you back up a FortiGate configuration that includes IPSec VPN tunnels using certificates you must also back up the local certificate and private key in a password protected PKCS12 file Before restoring the configuration you must import the PKCS12 file and set the local certificate name to the same that was in the original configuration Public Key Cryptography Standard 12 PKCS12 describes the syntax for securely exchanging personal information Note Use the execute vpn certificates key CLI command to back
214. e units with a hard disk can quarantine blocked or infected files The quarantined files are removed from the content stream and stored on the FortiGate hard disk Users receive a message that the removed files have been quarantined On the FortiGate the names of quarantined files are displayed on the quarantine list The list displays status duplication and age information for each quarantined file You can sort and filter this list based on these criteria From the list you can also delete or download files Quarantining infected files e Quarantining blocked files e Viewing the quarantine list Sorting the quarantine list e Filtering the quarantine list e Deleting files from the quarantine list e Downloading quarantined files e Configuring quarantine options Quarantining infected files Use content profiles to quarantine infected files found in HTTP FTP POP3 IMAP and SMTP traffic controlled by firewall policies To quarantine infected files Go to Anti Virus gt Quarantine gt Quarantine Config N Select the Content protocols for which you want quarantine infected files 3 Select antivirus scanning in a content profile See Adding content profiles on page 219 4 Select Quarantine to save to the quarantine any files that are found to be infected with a virus 5 Add this content profile to firewall policies to quarantine infected files found in the traffic controlled by the firewall policy See
215. e you log into the Fortinet technical support web site Changing your contact information or security question oOo N Oo oa A WO N To change your contact information or security question Go to System gt Update gt Support Select Support Login Enter your Fortinet support user name and password Select Login Select My Profile Select Edit Profile Make the required changes to your contact information Make the required changes to your security question and answer Select Update Profile Your changes are saved to the Fortinet technical support database If you changed your contact information the changes are displayed Fortinet Inc Virus and attack definitions updates and registration Updating registration information Downloading virus and attack definitions updates Use the following procedure to manually download virus and attack definitions updates This procedure also describes how to install the attack definitions updates on your FortiGate unit To download virus and attack definitions updates Go to System gt Update gt Support Select Support Login Enter your Fortinet support user name and password Select Login Select Download Virus Attack Update If required select the FortiOS version NO oO fF WD Select the virus and attack definitions to download Figure 30 Downloading virus and attack definition updates Download Virus Attack Updates Version v2 36 2 30 FGT Unit irus
216. each spoke e Destination addresses for each spoke e A concentrator configuration e An encrypt policy for each spoke To create a VPN concentrator configuration Configure one of the following tunnels for each spoke A manual key tunnel consists of a name for the tunnel the IP address of the spoke client or gateway at the opposite end of the tunnel and the encryption and authentication algorithms to use for the tunnel See Manual key IPSec VPNs on page 233 e An AutolKE tunnel consists of phase 1 and phase 2 parameters The phase 1 parameters include the name of the spoke client or gateway designation of how the spoke receives its IP address static or dialup encryption and authentication algorithms and the authentication method either pre shared keys or PKI certificates The phase 2 parameters include the name of the tunnel selection of the spoke client or gateway configured in phase 1 encryption and authentication algorithms and a number of security parameters See AutolKE IPSec VPNs on page 235 Add a destination address for each spoke The destination address is the address of the spoke either a client on the Internet or a network located behind a gateway See Adding a source address on page 246 Add the concentrator configuration This step groups the tunnels together on the FortiGate unit The tunnels link the hub to the spokes The tunnels are added as part of the AutolKE phase 2 config
217. eas 196 Enabling and disabling policies ceeceeceeeeeeeeeeeeeeenceeeeeeeaaeeeeeeetaeeeeeeenaeeeeeeeaas 196 Aadress oS cic eis sen ns deocsdzen gaged Bea ved uaa en seed dei pa aucutd ant died Dan ox sae cDadev wage dedeve oud waves eeePetesas 197 Adding AddreSSOS 522i acts nicdeecGal nas deedld grectesind gedeteevingyedey Ain negcdcas layezeeewiasee eed pecdeewn tees 197 Editing addresses wi 2cci sincetieiiacecenidt T EAE 198 Deleting addresses 1 2ccavvucactenta sand canna vated cccet peda dant E sled 199 Organizing addresses into address GrOUNS ceeeeeeeeeeeeeeeeeeeeeeeeneeeeeeeteeeeeeettaeeeeee 199 8 Fortinet Inc Contents SEa e oii fe E ncn dag deve secede E E A A E E E 200 Predetined Sof viCES cserecciarnisdin iaa a aad 200 Adding custom TCP and UDP ServiCe esiiiiieniiiirinniiiiananiiid anaidai anA aii 203 Adding custom ICMP Services 2 J2is3 a ssscdeceuernseaeeeeantsaceeesinsnaceed tnd padeseaneeadeeeseteseed aise 204 Adding custom IP SerniceS esadi niaaa ana aana NENANA a ANE AAAS ENAA N 204 GIOUPING SErV CeS e eee cee eee tt ee trett trett ernie AEE aden ee eet e ee eee naeeeeeeteeeeeeenneeeeeee 204 SCMEGUICS neran E A E E A 205 Creating one time schedules 00 0 eee cece eee eeeeeee eee teeeeeeeeseceeeeeeeseeeaaeeeseneeaaeeeeeeenaeeees 206 Creating recurring schedules cceceeeeceeeeeeeeeeeeeeeeeeeeeeeecaneeeseesaneneseeceenaeeseenseneeeees 207 Adding schedules to policies c0 cii ccesescecesscan
218. econds 4608000 KBytes Autokey Keep Alive Enable Concentrator None 7 ARSED aa FortiGate 800 Installation and Configuration Guide 241 Managing digital certificates IPSec VPN Managing digital certificates 242 we a Use digital certificates to make sure that both participants in an IPSec communication session are trustworthy prior to setting up an encrypted VPN tunnel between the participants Fortinet uses a manual procedure to obtain certificates This involves copying and pasting text files from your local computer to the certificate authority and from the certificate authority to your local computer e Obtaining a signed local certificate e Obtaining CA certificates Note Digital certificates are not required for configuring FortiGate VPNs Digital certificates are an advanced feature provided for the convenience of system administrators This manual assumes the user has prior knowledge of how to configure digital certificates for their implementation Obtaining a signed local certificate The signed local certificate provides the FortiGate unit with a means to authenticate itself to other devices Note The VPN peers must use digital certificates that adhere to the X 509 standard Generating the certificate request With this procedure you generate a private and public key pair The public key is the base component of the certificate request To generate the certificate request Go to VPN gt
219. ect the Enable check box beside each signature that you want to enable Select Check All to enable all signatures in the NIDS attack prevention signature list Select Uncheck All to disable all signatures in the NIDS attack prevention signature list Select Reset to Default Values to enable only the default NIDS attack prevention signatures and return to the default threshold values Fortinet Inc Network Intrusion Detection System NIDS Preventing attacks Setting signature threshold values You can change the default threshold values for the NIDS Prevention signatures listed in Table 40 The threshold depends on the type of attack For flooding attacks the threshold is the maximum number of packets received per second For overflow attacks the threshold is the buffer size for the command For large ICMP attacks the threshold is the ICMP packet size limit to pass through For example setting the icmpflood signature threshold to 500 allows 500 echo requests from a source address to which the system sends echo replies The FortiGate unit drops any requests over the threshold of 500 If you enter a threshold value of O or a number out of the allowable range the FortiGate unit uses the default value Table 40 NIDS Prevention signatures with threshold values Signature Threshold value units Default Minimum Maximum abbreviation threshold threshold threshold value value value synflood Threshold Maximum number of S
220. ect the policy list to which you want to add the policy Select New to add a new policy You can also select Insert Policy before F on a policy in the list to add the new policy above a specific policy 4 Configure the policy For information about configuring the policy see Firewall policy options on page 190 Select OK to add the policy Arrange policies in the policy list so that they have the results that you expect For information about arranging policies in a policy list see Configuring policy lists on page 195 FortiGate 800 Installation and Configuration Guide 189 Adding firewall policies Firewall configuration Figure 40 Adding a NAT Route policy Policy A Source Internal_All he Destination External_All 7 Schedule Always z Service ANY bd Action ACCEPT x Edit Policy internal gt external Traffic Priority High 7 M NAT Dynamic IP Pool W Fixed Port ol M Traffic Shapin Guaranteed loo pens Bandwidth 100 KBytes s Maximum too Bandwidth 100 KBytes s M authentication User_Group_1 M M anti Virus amp Web filter Content Profile Scan l Log Traffic Comments maximum 63 characters Policy Traffic Shaping Authentication and Virus Scanning Firewall policy options 190 This section describes the options that you can add to firewall policies Source Select an address or address group that matches the source address of the packet
221. ect to the CLI using the null modem cable and FortiGate console port 2 Enter the following command to restart the FortiGate unit execute reboot As the FortiGate units starts a series of system startup messages are displayed When the following message appears Press any key to enter configuration menu 3 Immediately press any key to interrupt the system startup sA Note You have only 3 seconds to press any key If you do not press a key soon enough the Z FortiGate unit reboots and you must log in and repeat the execute reboot command If you successfully interrupt the startup process the following message appears G Get firmware image from TFTP server F Format boot device B Boot with backup firmware and set as default Q Quit menu and continue to boot with default firmware H Display this list of options Enter G F B Q or H 4 Type B to load the backup firmware image The FortiGate unit loads the backup firmware image and restarts When the FortiGate unit restarts it is running the backup firmware version with a restored configuration Manual virus definition updates The Status page of the FortiGate web based manager displays the current installed versions of the FortiGate antivirus definitions A Note For information about configuring the FortiGate unit for automatic antivirus definitions updates see Virus and attack definitions updates and registration on page 117 You can also manual
222. ed Select the Protocol either TCP or UDP used by the service Specify a Source and Destination Port number range for the service by entering the low and high port numbers If the service uses one port number enter this number in both the low and high fields If the service has more than one port range select Add to specify additional protocols and port ranges If there are too many port range rows select Delete H to remove each extra row Select OK to add the custom service You can now add this custom service to a policy FortiGate 800 Installation and Configuration Guide 203 Services Firewall configuration Adding custom ICMP services Add a custom ICMP service if you need to create a policy for a service that is not in the predefined service list To add a custom ICMP service Go to Firewall gt Service gt Custom Select ICMP from the Protocol list Select New kh OO N Type a Name for the new custom ICMP service This name appears in the service list used when you add a policy The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Specify the ICMP type and code for the service Select OK to add the custom service You can now add this custom service to a policy Adding custom IP services Add a custom IP service if you need to create a policy for a service that is not in the predefined service l
223. ed above the default policy in the internal gt external policy list In this example all FTP connection attempts from the internal network would then match the FTP policy and be blocked Connection attempts for all other kinds of services would not match with the FTP policy but they would match with the default policy Therefore the firewall would still accept all other connections from the internal network Note Policies that require authentication must be added to the policy list above matching policies that do not otherwise the policy that does not require authentication is selected first FortiGate 800 Installation and Configuration Guide 195 Configuring policy lists Firewall configuration Changing the order of policies in a policy list To change the order of a policy in a policy list Go to Firewall gt Policy Select the policy list that you want to change the order of Choose the policy that you want to move and select Move To to change its order in the policy list Type a number in the Move to field to specify where in the policy list to move the policy and select OK Enabling and disabling policies 196 You can enable and disable policies in the policy list to control whether the policy is active or not The FortiGate unit matches enabled policies but does not match disabled policies Disabling policies Disable a policy to temporarily prevent the firewall from selecting the policy Disabling a policy does no
224. ee Services on page 200 Schedules Policies can control connections based on the time of day or day of the week when the firewall receives the connection The default policy accepts connections at any time The firewall is configured with one schedule that accepts connections at any time You can add more schedules to control when policies are active For more information about schedules see Schedules on page 205 188 Fortinet Inc Firewall configuration Adding firewall policies Content profiles Add content profiles to policies to apply antivirus protection web filtering and email filtering to web file transfer and email services The FortiGate unit includes the following default content profiles Strict to apply maximum content protection to HTTP FTP IMAP POP3 and SMTP content traffic e Scan to apply antivirus scanning to HTTP FTP IMAP POP3 and SMTP content traffic e Web to apply antivirus scanning and Web content blocking to HTTP content traffic Unfiltered to allow oversized files to pass through the FortiGate unit without scanned for viruses The default policy includes the scan content profile For more information about content profiles see Content profiles on page 218 Adding firewall policies Add Firewall policies to control connections and traffic between FortiGate interfaces zones and VLAN subinterfaces To add a firewall policy 1 Go to Firewall gt Policy Sel
225. eeeeeeeeceaeaaeeeeeeeeeeeeeeeesecaaeaaaeaeeeeeeeeeeeseeeesssneuaeeees 307 Adding address patterns to the email exempt list ee ee eee eeeeeecceeeeeeeeeeeeetteeeees 308 Adding a subject LAG suner shecdecisaccecdestaguacadavs secebuaxss duces desTs dacedeavs sdenhadevaduencqents snceacesie dues 308 LO QCING SING reporting sssini rasanira ana di rdar ars roroa Ninanais 309 Recording 016 ecenin EEEE AE EKANA EEEE AE 309 Recording logs on a remote COMPUTED sseesessssssssernesesennneaetenneetnsnnnaanennneannannnadtennnaaana 310 Recording logs on a NetIQ WebTrends server cc ceeeeeeteeeeeeeteeneeeeeetecieeeeeetnieeeeeee 310 Recording logs on the FortiGate hard disk cceceseeeeeseeeeeeeeeseeeeeeeeeeeneeeeeeeeenaeeees 311 Recording logs in system MEMOLSY s ssiisisssrriissirrsaiiiddstravaddddsnnnndiddds raai iddadrranadddeennaaida 312 Log MESSAGE levels 000 eee cette eceeeeeeeeeteee cette eteeeeeeteeeeeeeeseeeaeeeeseeeeaeeeeseeeaeeeeseeeaeeees 312 Filtering log MESSAGES ceceeeeeeeeeeeeeee eee eeeeee eee teeeeaeeeeseeeeaeeeeeeeeaaeeeeeeeedaeeeeseenaeeeeesenaaes 313 Configuring traffic logging srs ogan 314 Enabling traffic lOQGING encccanersnnneninai i 315 Configuring traffic filter settings ee eecetee eee ceeeee eee eeeeeeeeeeeeeeeaeeeeseeeeaeeeeteeeaeeeeseeeaaees 316 Adding traffic filler OntrieS ccc sutacdessivinccccat gue decdcavetencdedadghdaceadarindaceaderpaceceeseviwedcdaavigtacs 316 12 Fortinet
226. eeeeeeeeeeeeeeseeeaaeeeeeeeaeeees 49 Registering your FortiGate Unit ccccccccceccccceeeecteacasnccneaaeneescccauanensecisasebesciadebeenecceneneaveanees 50 Configuring virus and attack definition updates 22 0 eceeceeeeeeeeeee eee eeteeeeeeetttaeeeeeeeee 50 Configuration example Multiple connections to the Internet eeeeeeeeeeeeeerteeeeeees 50 Configuring PING Servers ceeeeeeeeee eee ceeeeeeeeeeeeeeeeeeeeaeeeeeeteceeeeeeeseeeeeeeeeseeeaeeeeeeeenaeeees 51 Destination based routing CEXAMPIeS ceceeeeee eect eee ee ener eee eeeeaeeeeeeeaeeeeeeenneeeeeetea 52 Policy routing examples ecer E pepehnes hagean eee Bie 55 Firewall policy examples iiiaae A ERE Eaa 56 Transparent mode installation ccccccceeeeeeeeeeeeeeeeeeeeeeeeseeeeeeeeeeeeeeeeeeeeeeeenaes 59 Preparing to configure Transparent mode ccceeceeeeeeeeeeeeeeeeeecaeeeeeeenaeeeeeeeenaeeeeeneeaaes 59 Using the setup WIZAIC witteicccicileuiehacieeiaidies ieaidiate outetes hacieadn iia d wading ide 60 Changing to Transparent mode using the web based manager eceeeeeeeeeeteeeeeeeees 60 Starting the setup wizard 2 ic 221 ccdecciieiessdeietebecbdiadvdedceandeeeeedaiaiwecdeael ee eeuudisanteedalaeetens 60 Reconnecting to the web based manager ceececeeeeeeeeeeeeeeeeteeeeeeeenaeeeeeeetaeeeeenenaas 60 Using the front control buttons and LCD ceceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeteeaaeeeeeeeaeenes 61 Using the command lin
227. eeeeeeneeeeeeeeaaes 142 Adding a ping server to an interface 20 0 eceeeeeeeeeeeneneeeeeeeaaeeeeeeeaaeeeeeeenaeeeeeeeaaas 142 Controlling administrative access to an interface ceceeeeeeeeeeeeeeeeeeteeeeeeeetnieeeeeee 143 Changing the MTU size to improve network performance ccceeeeeeeeeeeeeeteteeeeeeeee 144 Configuring traffic logging for connections to an interface 0 00 2 eeeeeeeeeeeeeeeetteeeeees 144 Configuring the management interface in Transparent MOdE c eeeeeeeeeeeteeeeeees 144 VLAN OVErVICW 0 0 eee eeeeeee eee ette eee teenie ee eee ete eee eerie eee eetaneeee eee taeeee eee naeeeeeeniieeeeeeetieeeeenenea 145 VLANS In NAT Route Mode s cccccccccceiceecelet cence ana aa i E a aaa 146 Rules for VLAN IDS scccciccsccceeiiscoceeeedeaueccuerssaanecves E 146 Rules for VLAN IP addresses cc cccccctesecccccereeeccecentaneceeceunsenecederessececertneseeeeetenssees 146 Adding VLAN subinterfacess 0 00 0 eececceceeeeeceeeeeeeeeneee eee eaaeeeeeeeaaeeeeeeeaeeeeesenaeeeeeeenaaes 147 Virtual domains in Transparent MOde 2 c s eeeecee cece ee eeeee eee eeeeceaaeaaeaeeeeeeeeeeeeeeeeeneees 147 Virtual domain Propet ES rsa aa aE Ai 149 Configuring a virtual domal esros E 149 Adding firewall policies for virtual domains 00 eee eeeeee eee eeeneeeeeeeeaaeeeeeeetaeeeeeeeeaas 152 Deleting virtual domains icash aa AAE AAAA AEAEE NALAN 153 Adding DNS server IP addresses uaeseeeeesseersnunn
228. eeeeesesseeerersserrrrssrrrrressrrern 258 Configuring a Windows 98 client for PPTP ececcceeeeeeeeeeeeeeeeeeeeeeeeseeaaeeeeseeenaees 260 Configuring a Windows 2000 client for PPTP eessseeeeesssesrissseerrssserrrssererrrsseernnssns 261 Configuring a Windows XP client for PPTP assseeesssseeeesssserrrsseerrssserirrssrrirnrssernrnssne 261 Connguring L2 TP reed a E SN 263 Configuring the FortiGate unit as an L2TP gateway eesseeeseesseeeeresseerresserrrrsserees 263 Configuring a Windows 2000 client for L2TP 0 2 ececteeeeeeeeeneeeeeeeeeteeeeeeetneeeeeereee 265 Configuring a Windows XP client for LOTP eeeceeceeesecneeeeeeeeeteeeeeeeteeeeeeetneeeeere 267 10 Fortinet Inc Contents Network Intrusion Detection System NIDS cccceseeseeeeeeeeeeeeeeeeeeeeeeeeees 269 Detecting attacks 00 0 eee cceceeee eee eeeee seer eecneeeeeeseceeeeeeeseeeeeeeseceeeeeeseeeesaeeeseeeaeeeeseeenaneees 269 Selecting the interfaces to MOMItOM ec ceeceeeeeeeeeeeeeeeeeeeseeeeeeeeeseneaeeeeseeeaaeeeseeenaeeees 270 Disabling monitoring interfaces sssini anaana a E ana ai 270 Configuring checksum VerifiCAtiON s sssseasssiricsiiiioaa N innia eiaa Eaa 270 Viewing the signature list onsnransii ienna inaa Ean aA A Aaaa 271 Viewing attack descriptionS eesssesssrsssseerrneeassnandditinnadttinanastanaaaaanaaaaddtannaaaandaaaaaaaana 271 Disabling NIDS attack signatures ee eececeeee scene ee eee eenteee eee eeaeeeeeeea
229. eeneeacaaeeeesenenaaeneeee 94 Upgrading to a new firmware version eeececeeee scene eee eeeeneeeeeeeeaaeeeeeeeaaeeeeeeenaeeeeeneeaas 95 Reverting to a previous firmware VErSiONn cccccceceeeeeeeeeeeeeeeeeteneeeeeesaeeeeeetieeeeeeeea 96 Installing firmware images from a system reboot using the CLI aaaeei 99 Testing a new firmware image before installing it eee eeeeeeeeeeeeeeeeeeeeeeeeeeeeaas 101 Installing and using a backup firmware iMaQe 0 ccceeeeceeeeeeeeeeeeeeeeeteeeeeesnaeeeeeeenaas 103 Manual virus definition Updates 20 0 2 ccc cceeeeeeeececee cee ce eee eeeeeeeeeeeeeeaaeaaecaeeeeeeeeeeeteteeeeeeaees 106 Manual attack definition updates ce ecceeeeeeceeeeee eee eeeeeee eee eeeeeeeeeeeeeeeeeeeeseeeaeeeeeeeaaees 107 Displaying the FortiGate serial NUMDEM cceceeeeceeeeee eee eeeeeeeeeeeeeeeaeeeeeteeaeeeeeeeeeaees 107 FortiGate 800 Installation and Configuration Guide Contents Contents Displaying the FortiGate Up timMe cceeeeeeeeeeeee eee eeeeeeeeeeeeeeaeeeeeseeeaeeeeeeeeeaaeeeeeeeneateees 108 Displaying log hard disk Status nesccaine 108 Backing Up system settings 0 0 0 0 ec eee eeceee eee etcne ee errr ae teste eeeee eee eaeeeeeeeeeeeeereiaeeeeere 108 Restoring system Settings 2 ccccccececccteeceeeececeeseneccneneedeeccdesenenedeneepededectanseececensneeeenccdaneneds 108 Restoring system settings to factory defaults eect eeeeeeeeeeeeeeeeeeeseeeeaeeeseeeneeeees 1
230. eep track of connections for a particular service You can select fixed port for NAT policies to prevent source port translation However selecting fixed port means that only one connection can be supported through the firewall for this service To be able to support multiple connections you can add an IP pool to the destination interface and then select dynamic IP pool in the policy The firewall randomly selects an IP address from the IP pool and assigns it to each connection In this case the number of connections that the firewall can support is limited by the number of IP addresses in the IP pool IP pools and dynamic NAT You can use IP pools for dynamic NAT For example your organization might have purchased a range of Internet addresses but you might have only one Internet connection on the external interface of your FortiGate unit You can assign one of your organization s Internet IP addresses to the external interface of the FortiGate unit If the FortiGate unit is operating in NAT Route mode all connections from your network to the Internet appear to come from this IP address If you want connections to originate from all your Internet IP addresses you can add this address range to an IP pool for the external interface Then you can select Dynamic IP Pool for all policies with the external interface as the destination For each connection the firewall dynamically selects an IP address from the IP pool to be the source address for
231. eetiaeeeeeeees 29 Factory default FortiGate configuration settings ccccceeeeceeeeeeeseeeeeeeeeeieeeeeeeteeeeereea 30 Factory default NAT Route mode network Configuration ccccceeeeeeeeeeeeeeenteeeeeeeeaes 30 Factory default Transparent mode network configuration 31 Factory default firewall Configuration ceeeeeeeceeeeeeeeeneeeeeeeicneeeeeetiaeeeeeeeneeeeeetea 32 Factory default content profiles c ccccceneesdecccasteeedenteneeesdeneneendenenateesddenteneeesdenenerteeate 33 Planning the FortiGate Configuration c cccceceeeeeeeeeeeeeeee eee eeneeeeeeeeeeeeeeeeeeeeeeeeneeeeeee 36 NATHROULE mode ariston onini anae naaa ii aa aiaa aaa a 36 NAT Route mode with multiple external network connections ccccccceeeeeeeeeteees 37 TRANSPARENT MOG iis iecessardieiesaeadcaessadandPecsnaaunnttetanaadedcersabudauun snacdcceuanaadctedsesateutaanraadacees 37 CONMQUIATION OPtlONS serea 38 FortiGate model maximum values Matrix 0 eee cette ee eet ee eee teaeee eee taeeeeeetaeeeeeeeee 39 INEXE SLEDS iiiccasiacdcztesvanaidazsncdnndcatansandudaannbataaeddasdaadsudesuanancddanbacdecegssduatsadesssnaacceasseanadeuasaeesees 40 FortiGate 800 Installation and Configuration Guide 3 Contents NAT Route mode installation cccccccsseeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeenenes 41 Preparing to configure NAT ROUte MOdE cccceeeeeeeeeeeeeeeneeeeeeeetaeeeeeeeeaeeeeeeeetaeeeeeeenaas 4
232. elect Dynamic IP pool for policies with the internal interface as the destination For example you can add IP pools to External gt Internal and DMZ gt Internal policies You can add multiple IP pools to any interface but only the first IP pool is used by the firewall This section describes e Adding an IP pool e IP Pools for firewall policies that use fixed ports e IP pools and dynamic NAT Adding an IP pool To add an IP pool 1 Go to Firewall gt IP Pool 2 Select the interface to which to add the IP pool You can select a firewall interface or a VLAN subinterface 3 Select New to add a new IP pool to the selected interface Enter the Start IP and End IP addresses for the range of addresses in the IP pool The start IP and end IP must define the start and end of an address range The start IP must be lower than the end IP The start IP and end IP must be on the same subnet as the IP address of the interface that you are adding the IP pool 5 Select OK to save the IP pool FortiGate 800 Installation and Configuration Guide 213 IP MAC binding Firewall configuration Figure 49 Adding an IP Pool Dynamic IP Pool A New Dynamic IP Pool Interface internal Start IP 192 168 1 10 End IP 192 168 1 20 IP Pools for firewall policies that use fixed ports Some network configurations do not operate correctly if a NAT policy translates the source port of packets used by the connection NAT translates source ports to k
233. elect the name of the RIP filter list to assign to the outgoing filter 4 Select Apply FortiGate 800 Installation and Configuration Guide 167 Adding RIP filters RIP configuration 168 Fortinet Inc AT MET System configuration Use the System Config page to make any of the following changes to the FortiGate system configuration Setting system date and time e Changing system options e Adding and editing administrator accounts e Configuring SNMP e Replacement messages Setting system date and time For effective scheduling and logging the FortiGate system time must be accurate You can either manually set the FortiGate system time or you can configure the FortiGate unit to automatically keep its system time correct by synchronizing with a Network Time Protocol NTP server To set the date and time Go to System gt Config gt Time Select Refresh to display the current FortiGate system date and time Select your Time Zone from the list kh OO N Select the Automatically adjust clock for daylight saving changes check box if you want the FortiGate system clock to be adjusted automatically when your time zone changes to daylight saving time 5 Select Set Time and set the FortiGate system date and time to the correct date and time if required 6 Select Synchronize with NTP Server to configure the FortiGate unit to use NTP to automatically set the system time and date For more information about NTP and to fi
234. eletng user Groups x ccecsetescccacsnessccatsnbcecedes pods NEEE AN A ET 230 FortiGate 800 Installation and Configuration Guide 9 Contents i a cal Ber Peer eye Remeron etre a seh eels eae rn Ere Set Senne Er Baier Ree 231 Key MANAGEMENL eee eter eee et tree rete e eter etre ee eee ne ee eee aeee eee naeee ee eneeeeeeeenaeeeeeee 232 Manual Keys iscsi cctisccseectetecek che ieee Fat E T E 232 Automatic Internet Key Exchange AutolKE with pre shared keys or certificates 232 Manual key IPSec VPNScnercanercarici iinan EA 233 General configuration steps for a manual key VPN eceeeeeeeseeeeeeeeeeeeenteeeeeeeeeaees 233 Adding a manual key VPN tunnel 0 eeeceeceeeeeeeeeeeeeeeeeneeeeeeeaaeeeeeeeaaeeeeeeenaeeeeeeeeaes 233 AutolKE IPSec VPNS orep A sebedacenst pitinwades fendseuaseabaccaucet ponds 235 General configuration steps for an AUtOIKE VPN eeeeeceeeeeeeeeeeeeeeeeeeeeeeennaeeeeeeenaaes 235 Adding a phase 1 configuration for an AutoIKE VPN 0 eecececeeeeeeeeeeeeeeeeeeeeeeeaas 235 Adding a phase 2 configuration for an AutolKE VPN eeesceeeeeeeeeeeeeeeeneeeeeeeaas 240 Managing digital Certificates srca E EEEE AET E 242 Obtaining a signed local certificate 0 0 cece eee nertir eee eeeaaeeeeeeeaeeeeeeeiaeeeeeeeaaes 242 Obtaining CA Certificates sinsin cnc EE E ASANA AAS 245 Configuring encrypt PolicieS ccccccccceeeesenccceeeeseesseeeeeenaseeeeetenscceeetseseeeestsnaceeeenteaeeee 24
235. ement access to an interface 143 management interface 144 management IP address transparent mode 62 manual IP address interface 140 manual keys introduction 232 matching policy 195 maximum bandwidth 193 memory status 111 112 messages replacement 176 MIB FortiGate 176 331 Index mode Transparent 18 monitor system status 114 monitored interfaces 270 monitoring system status 111 MTU size 144 changing 144 definition 324 improving network performance 144 interface 144 N NAT introduction 18 policy option 192 push update 124 NAT mode adding policy 189 IP addresses 44 NAT Route mode changing to 110 configuration from the CLI 44 connecting an HA cluster 76 HA 74 introduction 18 VLANs 146 netmask administrator account 172 173 network address translation introduction 18 network intrusion detection 18 Network Intrusion Detection System 269 network status 112 next hop router 142 NIDS 18 269 attack prevention 274 detection 269 prevention 274 reducing alert email 276 reducing attack log messages 276 user defined signatures 272 NTP 49 62 202 324 NTP server 169 setting system date and time 169 O one time schedule 206 creating 206 operating mode changing to NAT Route mode 110 changing to Transparent mode 109 options changing system options 170 Outbound NAT encrypt policy 192 332 override serve adding 120 121 oversized files and email blocking 286 overwrite log option 311 P pa
236. empted to download the email containing the virus EMAIL_FROM The email address of the sender of the message in which the virus was found VEMAIL_TO The email address of the intended receiver of the message in which the virus was found Section End lt VIRUS_ALERT gt Block alert Used for file block alert email messages Section Start lt BLOCK_ALERT gt Allowed Tags FILE The name of the file that was blocked PROTOCOL The service for which the file was blocked FortiGate 800 Installation and Configuration Guide 183 Replacement messages 184 Table 36 Alert email message sections System configuration SOURCE_ IP The IP address from which the block file was received For email this is the IP address of the email server that sent the email containing the blocked file For HTTP this is the IP address of web page that sent the blocked file DEST_IP The IP address of the computer that would have received the blocked file For email this is the IP address of the user s computer that attempted to download the message from which the file ware removed EMAIL_FROM The email address of the sender of the message from which the file was removed W WEMAIL_TO The email address of the intended receiver of the message from which the file was removed Section End lt BLOCK_ALERT gt Critical event Used for critical firewall event ale
237. emselves in Management Information Bases MIBs and return this data to the SNMP requesters Fortinet Inc SSH Secure shell A secure Telnet replacement that you can use to log into another computer over a network and run commands SSH provides strong secure authentication and secure communications over insecure channels Subnet A portion of a network that shares a common address component On TCP IP networks subnets are defined as all devices whose IP addresses have the same prefix For example all devices with IP addresses that start with 100 100 100 would be part of the same subnet Dividing a network into subnets is useful for both security and performance reasons IP networks are divided using a subnet mask Subnet Address The part of the IP address that identifies the subnetwork TCP Transmission Control Protocol One of the main protocols in TCP IP networks TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent FortiGate 800 Installation and Configuration Guide Glossary UDP User Datagram Protocol A connectionless protocol that like TCP runs on top of IP networks Unlike TCP UDP provides very few error recovery services offering instead a direct way to send and receive datagrams over an IP network It is used primarily for broadcasting messages over a network VPN Virtual Private Network A network that links private networks over the
238. enable and disable prevention attack signatures and customize attack signature thresholds and other parameters To notify system administrators of the attack the NIDS records the attack and any suspicious traffic to the attack log and can be configured to send alert emails Fortinet updates NIDS attack definitions periodically You can download and install updated attack definitions manually or you can configure the FortiGate unit to automatically check for and download attack definition updates Fortinet Inc Introduction VPN VPN Using FortiGate virtual private networking VPN you can provide a secure connection between widely separated office networks or securely link telecommuters or travellers to an office network Service providers can also use the FortiGate unit to provide VPN services for their clients FortiGate VPN features include the following e Industry standard and ICSA certified IPSec VPN including IPSec ESP security in tunnel mode DES 3DES triple DES and AES hardware accelerated encryption e HMAC MD5 and HMAC SHA1 authentication and data integrity e AutolKE key based on pre shared key tunnels IPSec VPN using local or CA certificates e Manual Keys tunnels Diffie Hellman groups 1 2 and 5 e Aggressive and Main Mode e Replay Detection e Perfect Forward Secrecy XAuth authentication e Dead peer detection PPTP for easy connectivity with the VPN standard supported by the most
239. end alert email in response to virus incidents intrusion attempts and critical firewall or VPN events or violations If you have configured logging to a local disk you can enable sending an alert email when the hard disk is almost full To enable alert email 1 Go to Log amp Report gt Alert Mail gt Categories 2 Select Enable alert email for virus incidents Alert email is not sent when antivirus file blocking deletes a file 3 Select Enable alert email for block incidents to have the FortiGate unit send an alert email when it blocks files affected by viruses 4 Select Enable alert email for intrusions to have the FortiGate unit send an alert email to notify the system administrator of attacks detected by the NIDS 5 Select Enable alert email for critical firewall VPN events or violations to have the FortiGate unit send an alert email when a critical firewall or VPN event occurs Critical firewall events include failed authentication attempts Critical VPN events include when replay detection detects a replay packet Replay detection can be configured for both manual key and AutolIKE Key VPN tunnels 6 Select Send alert email when disk is full to have the FortiGate unit send an alert email when the hard disk is almost full 7 Select Apply 322 Fortinet Inc Glossary Connection A link between machines applications processes and so on that can be logical physical or both DMZ Demilitarized Zone Used to host Internet
240. equired to enter the key in multiple segments Use the same encryption key at both ends of the tunnel DES Enter a 16 character 8 byte hexadecimal number 0 9 A F 3DES Enter a 48 character 24 byte hexadecimal number 0 9 A F Separate the number into three segments of 16 characters AES128 Enter a 32 character 16 byte hexadecimal number 0 9 A F Separate the number into two segments of 16 characters AES192 Enter a 48 character 24 byte hexadecimal number 0 9 A F Separate the number into three segments of 16 characters AES256 Enter a 64 character 32 byte hexadecimal number 0 9 A F Separate the number into four segments of 16 characters Select an Authentication Algorithm from the list Use the same algorithm at both ends of the tunnel Enter the Authentication Key Each two character combination entered in hexadecimal format represents one byte Use the same authentication key at both ends of the tunnel MD5 Enter a 32 character 16 byte hexadecimal number 0 9 A F Separate the number into two segments of 16 characters SHA1 Enter a 40 character 20 byte hexadecimal number 0 9 A F Separate the number into two segments the first of 16 characters the second of 24 characters Select a concentrator if you want the tunnel to be part of a hub and spoke VPN configuration See Adding a VPN concentrator on page 251 Select OK to save the manual key VPN tunnel Fortinet Inc IPSec VPN Aut
241. erent MAC address is dropped immediately to prevent IP spoofing A packet with a different IP address but with a MAC address of 12 34 56 78 90 ab cd is dropped immediately to prevent IP spoofing A packet with both the IP address and MAC address not defined in the IP MAC binding table e is allowed to connect to the firewall if IP MAC binding is set to Allow traffic e is blocked if IP MAC binding is set to Block traffic kh OO N Adding IP MAC addresses To add an IP MAC address 1 Go to Firewall gt IP MAC Binding gt Static IP MAC 2 Select New to add an IP address MAC address pair 216 Fortinet Inc Firewall configuration IP MAC binding Enter the IP Address and the MAC Address You can bind multiple IP addresses to the same MAC address You cannot bind multiple MAC addresses to the same IP address However you can set the IP address to 0 0 0 0 for multiple MAC addresses This means that all packets with these MAC addresses are matched with the IP MAC binding list Similarly you can set the MAC address to 00 00 00 00 00 00 for multiple IP addresses This means that all packets with these IP addresses are matched with the IP MAC binding list Type a Name for the new IP MAC address pair The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select the Enable check box to enable IP MAC binding for the IP
242. ernal i amp 0 0 0 0 0 0 0 0 64 230 129 22 120 45 67 10 external i Policy routing Policy routing extends the functions of destination routing Using policy routing you can route traffic based on the following e Destination address e Source address e Protocol service type or port range Incoming or source interface 156 Fortinet Inc Network configuration Configuring DHCP services Using policy routing you can build a routing policy database RPDB that selects the appropriate route for traffic by applying a set of routing rules To select a route for traffic the FortiGate unit matches the traffic with the policy routes added to the RPDB starting at the top of the list The first policy route that matches is used to set the route for the traffic The route supplies the next hop gateway as well as the FortiGate interface to be used by the traffic Packets are matched with policy routes before they are matched with destination routes If a packet does not match a policy route it is routed using destination routes The gateway added to a policy route must also be added to a destination route When the FortiGate unit matches packets with a route in the RPDB the FortiGate unit looks in the destination routing table for the gateway that was added to the policy route Ifa match is found the FortiGate unit routes the packet using the matched destination route If a match is not found the FortiGate unit routes the packet u
243. ernal interface Otherwise you can reconnect to the web based manager by browsing to https 192 168 1 99 You are now finished the initial configuration of your FortiGate unit and can proceed to Completing the configuration on page 49 FortiGate 800 Installation and Configuration Guide 43 Using the front control buttons and LCD NAT Route mode installation Using the front control buttons and LCD As an alternative to the setup wizard use the information that you recorded in Table 10 on page 42 and Table 12 on page 43 to complete the following procedure Starting with Main Menu displayed on the LCD use the front control buttons and LCD Press Enter three times to configure the internal interface IP address IP Address Set the internal interface IP address 192 168 100 001 Use the up and down arrow keys to increase or decrease the value of each IP address digit Press Enter to move to the next digit Press Esc to move to the previous digit Note When you enter an IP address the LCD always shows three digits for each part of the address For example the IP address 192 168 100 1 appears on the LCD as 192 168 100 001 The IP address 192 168 23 45 appears as 192 168 023 045 After you set the last digit of the IP address press Enter Use the down arrow to highlight Netmask Press Enter and set the internal Netmask After you set the last digit of the Netmask press Enter Press Esc to return to the Main Menu Repeat these
244. es You must include in a single text file all the user defined signatures that you want to upload The file can contain one or more signatures For information about how to write user defined signatures see the FortiGate NIDS Guide Fortinet Inc Network Intrusion Detection System NIDS Detecting attacks To add user defined signatures 1 Go to NIDS gt Detection gt User Defined Signature List 2 Select Upload Ert AS Caution Uploading the user defined signature list overwrites the existing file 3 Type the path and filename of the text file for the user defined signature list or select Browse and locate the file Select OK to upload the text file for the user defined signature list Select Return to display the uploaded user defined signature list Figure 68 Example user defined signature list General xX Signature List A User Defined Signature List _User Defined Signature Detail ID Rule Name Revision 298319873 TFTP GET Admin dll i 113770498 Possible SYN FIN scan il 113770499 CGI PHF access X ak Downloading the user defined signature list You can back up the user defined signature list by downloading it to a text file on the management computer A Note You cannot download individual signatures You must download the entire user defined A signature list To download the user defined signature list 1 Go to NIDS gt Detection gt User Defined Signature List 2 Select Download The Forti
245. essages Customizing alert emails Customize alert emails to control the content displayed in alert email messages sent to system administrators To customize alert emails Go to System gt Config gt Replacement Messages For the alert email message that you want to customize select Modify E In the Message setup dialog box edit the text of the message Table 36 lists the replacement message sections that can be added to alert email messages and describes the tags that can appear in each section In addition to the allowed tags you can add text and HTML code Select OK to save the changes Table 36 Alert email message sections NIDS event Used for NIDS event alert email messages Section Start lt NIDS_EVENT gt Allowed Tags NIDS_EVENT The NIDS attack message Section End lt NIDS_EVENT gt Virus alert Used for virus alert email messages Section Start lt VIRUS_ALERT gt Allowed Tags VIRUS The name of the virus PROTOCOL The service for which the virus was detected SOURCE_IP The IP address from which the virus was received For email this is the IP address of the email server that sent the email containing the virus For HTTP this is the IP address of web page that sent the virus WVDEST_IP The IP address of the computer that would have received the virus For POP3 this is the IP address of the user s computer that att
246. etting started Factory default FortiGate configuration settings Table 2 Factory default NAT Route mode network configuration Continued IP 192 168 100 99 Netmask 255 255 255 0 External interface Default Gateway 192 168 100 1 Primary DNS Server 207 194 200 1 Secondary DNS Server 207 194 200 129 Management Access Ping IP 10 10 10 1 DMZ interface Netmask 255 255 255 0 Management Access HTTPS Ping IP 0 0 0 0 HA interface Netmask 0 0 0 0 Management Access Ping IP 0 0 0 0 Interface 1 Netmask 0 0 0 0 Management Access Ping IP 0 0 0 0 Interface 2 Netmask 0 0 0 0 Management Access Ping IP 0 0 0 0 Interface 3 Netmask 0 0 0 0 Management Access Ping IP 0 0 0 0 Interface 4 Netmask 0 0 0 0 Management Access Ping Factory default Transparent mode network configuration If you switch the FortiGate unit to Transparent mode it has the default network configuration listed in Table 3 Table 3 Factory default Transparent mode network configuration Administrator User name admin account Password none IP 10 10 10 1 Management IP Netmask 255 255 255 0 DNS Primary DNS Server 207 194 200 1 Secondary DNS Server 207 194 200 129 FortiGate 800 Installation and Configuration Guide 31 Factory default FortiGate configuration settings Getting started Table 3 Factory default Transparent mode network configuration Continued
247. etwork of ISP1 e Destination IP 100 100 100 0 e Mask 255 255 255 0 Gateway 1 1 1 1 1 e Gateway 2 2 2 2 1 e Device 1 external e Device 2 dmz 4 Select New to add a route for connections to the network of ISP2 e Destination IP 200 200 200 0 e Mask 255 255 255 0 e Gateway 1 2 2 2 1 e Gateway 2 1 1 1 1 e Device 1 dmz e Device 2 external e Select OK 5 Change the order of the routes in the routing table to move the default route below the other two routes e For the default route select Move to La Type a number in the Move to field to move this route to the bottom of the list If there are only 3 routes type 3 e Select OK To add the routes using the CLI 1 Add the route for connections to the network of ISP2 set system route number 1 dst 100 100 100 0 255 255 255 0 gwl 1 1 1 1 devl external gw2 2 2 2 1 dev2 dmz 2 Add the route for connections to the network of ISP 1 set system route number 2 dst 200 200 200 0 255 255 255 0 gwl 2 2 2 1 devl dmz gw2 1 1 1 1 dev2 external 3 Add the default route for primary and backup links to the Internet set system route number 3 dst 0 0 0 0 0 0 0 0 gwl 1 1 1 1 devl external gw2 2 2 2 1 dev2 dmz The routing table should have routes arranged as shown in Table 15 Table 15 Example combined routing table Destination IP Mask Gateway 1 Device 1 Gateway 2 Device 2 100 100 100 0 255 255 255 0 1 1 1 1 external 2 2 2 1 dmz 200 200 200 0 255 255 255
248. ew to add an address Enter the Address Name IP Address and NetMask for a single computer or for an entire subnetwork on an internal interface of the local VPN peer Select OK to save the source address Fortinet Inc IPSec VPN Configuring encrypt policies Adding a destination address kh O N 5 The destination address can be a VPN client address on the Internet or the address of a network behind a remote VPN gateway To add a destination address Go to Firewall gt Address Select an external interface Select New to add an address Enter the Address Name IP Address and NetMask for a single computer or for an entire subnetwork on an internal interface of the remote VPN peer Select OK to save the destination address Adding an encrypt policy ao a fF WN To add an encrypt policy Go to Firewall gt Policy Select the policy list that you want to add the policy to usually Internal gt External Select New to add a new policy Set Source to the source address Set Destination to the destination address Set Service to control the services allowed over the VPN connection You can select ANY to allow all supported services over the VPN connection or select a specific service or service group to limit the services allowed over the VPN connection Set Action to ENCRYPT Configure the ENCRYPT parameters FortiGate 800 Installation and Configuration Guide 247 Configuring encrypt policies 248
249. f content protection to traffic processed by this policy O Log Traffic Log Traffic is not selected This policy does not record messages to the traffic log for the traffic processed by this policy You can configure FortiGate logging and select Log Traffic to record all connections through the firewall that are accepted by this policy Factory default content profiles You can use content profiles to apply different protection settings for content traffic that is controlled by firewall policies You can use content profiles for e Antivirus protection of HTTP FTP IMAP POP3 and SMTP network traffic e Web content filtering for HTTP network traffic Email filtering for IMAP and POP3 network traffic e Oversized file and email blocking for HTTP FTP POP3 SMTP and IMAP network traffic e Passing fragmented emails in IMAP POP3 and SMTP email traffic Using content profiles you can build protection configurations that can be applied to different types of firewall policies This allows you to customize types and levels of protection for different firewall policies For example while traffic between internal and external addresses might need strict protection traffic between trusted internal addresses might need moderate protection You can configure policies for different traffic services to use the same or different content profiles Content profiles can be added to NAT Route mode and Transparent mode po
250. f the permanent primary unit shuts down one of the other units in the cluster replaces it as the primary unit When the permanent primary unit is restarted it can become the primary unit again only if override is enabled Configuring the priority of each FortiGate unit in the cluster In addition to selecting a permanent primary FortiGate unit you can set the priorities of each of the subordinate units in the cluster to control the failover path For example if you have three FortiGate units in an HA cluster and you configured one as the permanent primary FortiGate unit you might always want the cluster to failover to the same FortiGate unit if the primary unit fails If you have many FortiGate units in the cluster you can assign a different priority to each of them to create a failover path To set the priority of each FortiGate unit in a cluster Connect to the cluster and log into the CLI Select a permanent primary unit by following all the steps in the procedure Selecting a FortiGate unit as a permanent primary unit on page 87 From the primary unit CLI enter the following command to log into a subordinate cluster member execute ha manage lt cluster member int gt Set the priority of the cluster member Enter set system ha priority lt priority int gt Where lt priority int gt is the priority to set for the permanent primary unit The permanent primary unit must have the lowest priority The unit with the second lowest
251. files to policies on page 221 3 Add a subject tag to the unwanted email so that receivers can use their mail client software to filter messages based on the tag See Adding a subject tag on page 308 A Note For information about receiving email filter log messages see Configuring logging in the aN Logging Configuration and Reference Guide For information about email filter log message categories and formats see Log messages in the FortiGate Logging Configuration and Reference Guide FortiGate 800 Installation and Configuration Guide 303 Email banned word list Email filter Email banned word list When the FortiGate unit detects an email that contains a word or phrase in the banned word list the FortiGate unit adds a tag to the subject line of the email and writes a message to the event log Receivers can then use their mail client software to filter messages based on the subject tag You can add banned words to the list in many languages using Western Simplified Chinese Traditional Chinese Japanese or Korean character sets e Adding words and phrases to the email banned word list e Downloading the email banned word list Uploading the email banned word list Adding words and phrases to the email banned word list e E 304 To add a word or phrase to the banned word list Go to Email Filter gt Content Block Select New Type a banned word or phrase e If you type a single word for exa
252. from the cluster which fails over to a new primary unit During the failover service might be interrupted if the cluster is very busy Because of this interruption and in case the firmware upgrade fails you should do this procedure only during off peak times when the cluster is not busy Note if you are upgrading to a new firmware version for example from 2 50 to 2 80 and in some cases if you are upgrading to a new maintenance release of the same firmware version you must remove individual units from the cluster For more information see Changing the FortiGate firmware on page 94 To upgrade the firmware version for all the units in a cluster Copy the firmware image file to your management computer Connect to the cluster and log into the web based manager as the admin administrative user Go to System gt Status Select Firmware Upgrade ie Enter the path and filename of the firmware image file or select Browse and locate the file Select OK The primary FortiGate unit uploads the firmware image file upgrades to the new firmware version and restarts When this happens the primary FortiGate unit is removed from the cluster and one of the subordinate units becomes the new primary unit After the failover occurs you can log into the cluster again to connect to the new primary unit Connect to the cluster and log into the web based manager as the admin administrative user Repeat steps 3 to 7 for each cluster unit On
253. from unwanted addresses See Email block list on page 306 Exempt sender address patterns from email filtering See Email exempt list on page 307 Add a subject tag to email that contains unwanted words or phrases See Email banned word list on page 304 Enable the fragmented email and oversized file and email options that you want Oversized File Email Pass Fragmented Email Select OK Block or pass files and email that exceed thresholds configured as a percent of system memory See Blocking oversized files and emails on page 286 Allow email messages that have been fragmented to bypass antivirus scanning See Exempting fragmented email from blocking on page 287 Figure 51 Example content profile Content Profile A Pass Fragmented E Edit Content Profile Profile Name sc an Options HTTP FTP IMAP POP3 SMTP Anti Virus Scan Vv Vv Vv Vv Vv File Block L m L L T Quarantine C C E E E Web URL Block E Web Content Block L Web Script Filter E Web Exempt List L Email Block List D E Email Exempt List O E Email Content Block T E Oversized File Email block block block block block pass pass pass pass pass mails r E r Fortinet Inc Firewall configuration Content profiles Adding content profiles to policies You can add content profiles to policies with action set to allow or encrypt and with service set to ANY HTTP FTP IMAP POP3 SMTP or a service gr
254. g Synchronize replacement messages changed on the primary unit ca Synchronize CA certificates added to the primary unit localcert Synchronize local certificates added to the primary unit all Synchronize all of the above To manually synchronize the configuration of subordinate units with the primary unit Connect to the cluster and log into the CLI 2 Connect to the CLI of each of the subordinate units in the cluster For information about connecting to subordinate units see Managing individual cluster units on page 83 3 Use the execute ha synchronize command to synchronize the configuration of the subordinate unit FortiGate 800 Installation and Configuration Guide 85 Managing an HA cluster 4 High availability Repeat steps 2 and 3 for all the subordinate units in the HA cluster Upgrading firmware 86 To upgrade the firmware of the FortiGate units in a cluster you must upgrade the firmware of each unit separately In most cases if you are upgrading to a new firmware build within the same firmware version for example upgrading from 2 50 build069 to 2 50 build070 you can do firmware upgrades using the following procedure and without interrupting cluster operation This procedure involves uploading a new firmware image to the primary unit Once the firmware image is uploaded the primary unit restarts running the new firmware version When the primary unit restarts it is removed
255. g the domain name of the reputable company to the exempt list allows IMAP and POP3 traffic from the company to bypass email and content blocking FortiGate 800 Installation and Configuration Guide 307 Adding a subject tag Email filter Adding address patterns to the email exempt list To add an address pattern to the email exempt list Go to Email Filter gt Exempt List Select New Type the address pattern that you want to exempt To exempt email sent from a specific email address type the email address For example sender abccompany com To exempt email sent from a specific domain type the domain name For example abccompany com To exempt email sent from a specific subdomain type the subdomain name For example mail abccompany com e To exempt email sent from an entire organization category type the top level domain name For example type net to exempt email sent from all organizations that use net as the top level domain The pattern can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters hyphen underscore and Spaces and other special characters are not allowed Select OK to add the address pattern to the email exempt list Adding a subject tag 308 When the FortiGate unit receives email from an unwanted address or email that contains an item in the email banned word list the FortiGate unit adds a tag to the subject line and sends the message to the
256. gh a proxy server 122 Q quarantine list filtering 285 sorting 284 viewing 284 quarantining blocked files 283 file 283 infected files 283 quick mode identifier use selectors from policy 241 use wildcard selectors 241 quick mode identity 241 R RADIUS definition 324 example configuration 226 RADIUS server adding server address 226 deleting 226 read amp write access level administrator account 172 read only access level administrator account 172 recording logs 309 recording logs in system memory 312 recording logs on FortiGate hard disk 311 recording logs on NetIQ WebTrends server 310 recovering a lost Fortinet support password 132 FortiGate 800 Installation and Configuration Guide Index recurring schedule 207 creating 207 registered FortiGate units viewing the list of 132 registering FortiGate unit 128 130 131 133 FortiGate unit after an RMA 136 list of registered FortiGate units 133 registration contact information 134 security question 134 updating information 131 relay DHCP 157 158 remote administration 143 144 replacement messages customizing 176 reporting 21 309 reserved IP adding to a DHCP server 160 resolve IP 316 traffic filter 316 restarting 110 restoring system settings 108 restoring system settings to factory default 109 reverting firmware to an older version 99 RIP configuring 161 filters 165 interface configuration 163 settings 161 RMA registering a FortiGate unit 136 rou
257. groups configuring 229 deleting 230 user name and password adding 225 adding user name 224 user defined ICMP services 204 user defined interface configuring 49 user defined IP services 204 user defined signature NIDS 272 user defined TCP services 203 user defined UDP services 203 V Viewing 284 335 Index viewing dialup connection status 255 logs 318 319 logs saved to memory 317 VPN tunnel status 255 virtual domain adding 149 adding a VLAN 150 adding a zone 150 adding firewall addresses 152 adding firewall policies 152 configuring 149 configuring in Transparent mode 147 deleting 153 properties 149 virtual IP 208 adding 209 port forwarding 208 210 static NAT 208 virus definition updates downloading 135 virus definitions updating 117 119 virus incidents enabling alert email 322 virus list displaying 287 viewing 287 virus log 313 virus protection overview 279 worm protection 16 virus status 113 VLAN adding to a virtual domain 150 NAT Route mode 146 overview 145 rules for VLAN IDs 146 rules for VLAN IP addresses 146 VPN configuring L2TP gateway 263 configuring PPTP gateway 258 263 introduction 19 Tunnel 192 viewing dialup connection status 255 VPN events enabling alert email 322 VPN tunnel viewing status 255 336 WwW web content filtering introduction 16 web filtering Activex 299 cookies 299 Java applets 299 overview 289 303 web filtering log 313 web page content blocking 290 304 web p
258. gure addressing add a ping server and configure administrative access to the VLAN subinterface For more information see Configuring interfaces on page 138 7 Select OK to save your changes The FortiGate unit adds the new subinterface to the interface that you selected in step 4 Virtual domains in Transparent mode In Transparent mode The FortiGate unit can apply firewall policies and services such as virus scanning to traffic on an IEEE 802 1 VLAN trunk The FortiGate unit operating in Transparent mode can be inserted into the trunk without making changes to the network In a typical configuration the FortiGate internal interface accepts VLAN packets on a VLAN trunk from a VLAN switch or router connected to internal VLANs The FortiGate external interface forwards tagged packets through the trunk to an external VLAN switch or router This external switch or router could be connected to the Internet The FortiGate unit can be configured to apply different policies for traffic on each VLAN in the trunk FortiGate 800 Installation and Configuration Guide 147 Virtual domains in Transparent mode Network configuration 148 To support VLANs in Transparent mode you add virtual domains to the FortiGate unit A virtual domain contains at least 2 VLAN subinterfaces For VLAN traffic to be able to pass between the FortiGate Internal and external interface you would add a VLAN subinterface to the internal interface and another VLAN subi
259. hanges Configuring routing This section describes how to configure FortiGate routing You can configure routing to add static routes from the FortiGate unit to local routers Using policy routing you can increase the flexibility of FortiGate routing to support more advanced routing functions You can also use routing to create a multiple Internet connection configuration that supports redundancy and load sharing between the two Internet connections This section describes e Adding a default route e Adding destination based routes to the routing table e Adding routes in Transparent mode e Configuring the routing table e Policy routing FortiGate 800 Installation and Configuration Guide 153 Configuring routing Network configuration Adding a default route a Fk WO N 6 we lt You can add a default route for network traffic leaving the external interface To add a default route Go to System gt Network gt Routing Table Select New to add a new route Set the Source IP and Netmask to 0 0 0 0 Set the Destination IP and Netmask to 0 0 0 0 Set Gateway 1 to the IP address of the routing gateway that routes traffic to the Internet Select OK to save the default route Note Only one default route can be active at a time If two default routes are added to the routing table only the default route closest to the top of the routing table is active Adding destination based routes to the routing table kh O
260. he IP MAC address pair of any new computer that you add to your network or the new computer does not have access to or through the FortiGate unit This section describes e Configuring IP MAC binding for packets going through the firewall e Configuring IP MAC binding for packets going to the firewall e Adding IP MAC addresses e Viewing the dynamic IP MAC list e Enabling IP MAC binding Configuring IP MAC binding for packets going through the firewall kh O N Use the following procedure to use IP MAC binding to filter packets that a firewall policy would normally allow through the firewall To configure IP MAC binding for packets going through the firewall Go to Firewall gt IP MAC Binding gt Setting Select the Enable IP MAC binding going through the firewall check box Go to Firewall gt IP MAC Binding gt Static IP MAC Select New to add IP MAC binding pairs to the IP MAC binding list All packets that would normally be allowed through the firewall by a firewall policy are first compared with the entries in the IP MAC binding list If a match is found then the firewall attempts to match the packet with a policy FortiGate 800 Installation and Configuration Guide 215 IP MAC binding Firewall configuration For example if the IP MAC pair IP 1 1 1 1 and 12 34 56 78 90 ab cd is added to the IP MAC binding list A packet with IP address 1 1 1 1 and MAC address 12 34 56 78 90 ab cd is allowed to go on to be matched with
261. hese are used for management access and to allow the unit to receive antivirus and definitions updates Also the unit must have sufficient route information to reach e the management computer e The FortiResponse Distribution Network FDN a DNS server A route is required whenever the FortiGate unit connects to a router to reach a destination If all the destinations are located on the external network you might be required to enter only a single default route If however the network topology is more complex you might be required to enter one or more static routes in addition to the default route 64 Fortinet Inc Transparent mode installation Transparent mode configuration examples This section describes e Default routes and static routes e Example default route to an external network e Example static route to an external destination e Example static route to an internal destination Default routes and static routes To create a route to a destination you need to define an IP prefix which consists of an IP network address and a corresponding netmask value A default route matches any prefix and forwards traffic to the next hop router otherwise known as the default gateway A static route matches a more specific prefix and forwards traffic to the next hop router Default route example IP Prefix 0 0 0 0 IP address 0 0 0 0 Netmask Next Hop 192 168 1 2 Static Route example IP Prefix 172 100 100 0 IP address
262. hich is the alias you added on the FortiGate unit to a user group on the Cerberian server Web policies can be applied only to user groups If you did not enter an alias for a user s IP address on the FortiGate unit the user s IP address is automatically added to the default Cerberian group Create policies by selecting the web categories that you want to block Apply the policy to a user group that contains the user For detailed procedures see the online help on the Cerberian Web Filter web page Enabling Cerberian URL filtering After you add the Cerberian users and groups and configure the Cerberian web filter you can enable Cerberian URL filtering To enable cerberian URL filtering Go to Web Filter gt URL Block gt Cerberian URL Filtering Select the Cerberian URL Filtering option Go to Firewall gt Content Profile Create a new or select an existing content profile and enable Web URL Block Go to Firewall gt Policy Create a new or select an existing policy Select Anti Virus amp Web filter Select the content profile from the Content Profile list Select OK O OO N Oa Fk WO DY a 298 Fortinet Inc Web filtering Script filtering Script filtering You can configure the FortiGate unit to remove Java applets cookies and Activex scripts from the HTML web pages Ks Note Blocking any of these items might prevent some web pages from working properly e Enabling script filtering e Selecting script fil
263. iGate unit product information Product Information Product Model FGT 60 x Serial FGT 60280303002 Number Located on bottom of unit and also on System screen on the web user interface Support pream Contract No 034278334744 _ indicates Required Fields 7 Select Finish If you have not entered a FortiCare Support Contract number SCN you can return to the previous page to enter the number If you do not have a FortiCare Support Contract you can select Continue to complete the registration If you have entered a support contract number a real time validation is performed to verify that the SCN information matches the FortiGate unit If the information does not match you can try entering it again Aweb page is displayed that contains detailed information about the Fortinet technical support services available to you for the registered FortiGate unit Your Fortinet support user name and password is sent to the email address provided with your contact information Updating registration information You can use your Fortinet support user name and password to log on to the Fortinet Support web site at any time to view or update your Fortinet support information This section describes e Recovering a lost Fortinet support password e Viewing the list of registered FortiGate units e Registering a new FortiGate unit e Adding or changing a FortiCare Support Contract number e Changing your Fortinet support passwo
264. iGate unit as a PPTP gateway e Configuring a Windows 98 client for PPTP e Configuring a Windows 2000 client for PPTP e Configuring a Windows XP client for PPTP FortiGate 800 Installation and Configuration Guide 257 Configuring PPTP 258 PPTP and L2TP VPN Configuring the FortiGate unit as a PPTP gateway a fF WO N Use the following procedures to configure the FortiGate unit as a PPTP gateway To add users and user groups Add a user for each PPTP client Go to User gt Local Add and configure PPTP users For information about adding and configuring users see Adding user names and configuring authentication on page 224 Go to User gt User Group Add and configure PPTP user groups For information about adding and configuring user groups see Configuring user groups on page 229 To enable PPTP and specify an address range Go to VPN gt PPTP gt PPTP Range Select Enable PPTP Enter the Starting IP and the Ending IP for the PPTP address range Select the User Group that you added in To add users and user groups on page 258 Select Apply to enable PPTP through the FortiGate unit Figure 64 Example PPTP Range configuration PPTP Range A Enable PPTP Starting IP 192 168 1 100 Ending IP 192 168 1 110 User Group PPTP_users 7 C Disable PPTP To add a source address Add a source address for every address in the PPTP address range Go to Firewall gt Address Selec
265. ic Filter 2 Select the settings that you want to apply to all traffic log messages Resolve IP Select Resolve IP if you want traffic log messages to list the IP address and domain name stored on the DNS server If the primary and secondary DNS server addresses provided to you by your ISP have not already been added go to System gt Network gt DNS and add the addresses Display Select Port Number if you want traffic log messages to list the port number for example 80 tcp Select Service Name if you want traffic log messages to list the name of the service for example TCP 3 Select Apply Figure 80 Example traffic filter list Log Setting Traffic Filter M Resolve IP Type Session Packet Display Port Number Service Name Apply _ Source Address Destination Address Protocol Modify FTP_Main_Office 10 10 10 1 255 255 255 0 10 10 10 2 255 255 255 0 FTP ws All_traffic 192 168 123 111 255 255 255 0 192 168 124 0 255 255 255 0 ANY hi fey Email_Branch_to_Main 10 10 11 0 255 255 255 0 10 10 10 0 255 255 255 0 POPS Te Adding traffic filter entries Add entries to the traffic filter list to filter the messages that are recorded in the traffic log If you do not add any entries to the traffic filter list the FortiGate unit records all traffic log messages You can add entries to the traffic filter list to limit the traffic logs that are recorded You can log traffic with a specified source IP address and netmask to a de
266. if you have added zones and if you have not added firewall addresses for the interface Select OK to save the changes Repeat these steps to add more interfaces or VLAN subinterfaces to zones Configuring an interface with a manual IP address A OO N You can change the static IP address of any FortiGate interface To change an interface with a manual IP address Go to System gt Network gt Interface Choose an interface and select Modify 2 Set Addressing Mode to Manual Change the IP address and Netmask as required The IP address of the interface must be on the same subnet as the network the interface is connecting to Two interfaces cannot have the same IP address and cannot have IP addresses on the same subnet Select OK to save your changes If you changed the IP address of the interface to which you are connecting to manage the FortiGate unit you must reconnect to the web based manager using the new interface IP address Configuring an interface for DHCP You can configure any FortiGate interface to use DHCP If you configure the interface to use DHCP the FortiGate unit automatically broadcasts a DHCP request You can disable connect to server if you are configuring the FortiGate unit offline and you do not want the FortiGate unit to send the DHCP request By default the FortiGate unit also retrieves a default gateway IP address and DNS server IP addresses from the DHCP server You can disable the option
267. iguration Group Name Internal_Group_1 Available Addresses Members User Network User_Network Internal Subnet1 Internal_Subnet1 Internal_Subnet2 Internal_Address Internal_Address2 Services Use services to determine the types of communication accepted or denied by the firewall You can add any of the predefined services to a policy You can also create custom services and add services to service groups This section describes e Predefined services e Adding custom TCP and UDP services e Adding custom ICMP services e Adding custom IP services e Grouping services Predefined services The FortiGate predefined firewall services are listed in Table 38 You can add these services to any policy Table 38 FortiGate predefined services Service name Description Protocol Port ANY Match connections on any port A connection that uses any of the predefined services is allowed through the firewall all all 200 Fortinet Inc Firewall configuration Table 38 FortiGate predefined services Continued Services Service name Description Protocol Port GRE Generic Routing Encapsulation A protocol that allows an arbitrary network protocol to be transmitted over any other arbitrary network protocol by encapsulating the packets of the protocol within GRE packets 47 AH Authentication Header AH provides source host a
268. iguration Figure 41 Adding a Transparent mode policy Policy A Edit Policy internal gt external Source Internal_All Destination External_All z Schedule Always 7 Service ANY Action ACCEPT X eo aping E 100 KBytes s Maximum Bandwidth 100 KBytes s Traffic Priority Medium z V authentication User_Group_1 E M Anti Virus amp Web filter Content Profile Scan 7 l Log Traffic Comments maximum 63 characters Policy Traffic Shaping Authentication and Virus Scanning Log Traffic Select Log Traffic to write messages to the traffic log whenever the policy processes a connection For information about logging see Logging and reporting on page 309 Comments You can add a description or other information about the policy The comment can be up to 63 characters long including spaces 194 Fortinet Inc Firewall configuration Configuring policy lists Configuring policy lists The firewall matches policies by searching for a match starting at the top of the policy list and moving down until it finds the first match You must arrange policies in the policy list from more specific to more general For example the default policy is a very general policy because it matches all connection attempts When you create exceptions to that policy you must add them to the policy list above the default policy No policy below the default policy will ever be matched This sect
269. in Japan Korea China Hong Kong Singapore Malaysia all other Asian countries and Australia eu_support fortinet com For customers in the United Kingdom Scandinavia Mainland Europe Africa and the Middle East For information on Fortinet telephone support see http support fortinet com When requesting technical support please provide the following information Your name Company name Location Email address Telephone number FortiGate unit serial number FortiGate model FortiGate FortiOS firmware version Detailed description of the problem FortiGate 800 Installation and Configuration Guide 23 Customer service and technical support 24 Introduction Fortinet Inc RAT MET Getting started This chapter describes unpacking setting up and powering on a FortiGate Antivirus Firewall unit When you have completed the procedures in this chapter you can proceed to one of the following If you are going to operate the FortiGate unit in NAT Route mode go to NAT Route mode installation on page 41 If you are going to operate the FortiGate unit in Transparent mode go to Transparent mode installation on page 59 If you are going to operate two or more FortiGate units in HA mode go to High availability on page 73 This chapter describes Package contents Mounting Powering on Connecting to the web based manager Connecting to the command line interface CLI Factory default FortiGat
270. in normal network traffic or encrypted IPSec VPN traffic ICSA Labs has certified that FortiGate Antivirus Firewalls e detect 100 of the viruses listed in the current In The Wild List www wildlist org e detect viruses in compressed files using the PKZip format e detect viruses in email that has been encoded using uuencode format e detect viruses in email that has been encoded using MIME encoding e log all actions taken while scanning Web content filtering FortiGate web content filtering can scan all HTTP content protocol streams for URLs or web page content If there is a match between a URL on the URL block list or a web page contains a word or phrase that is in the content block list the FortiGate unit blocks the web page The blocked web page is replaced with a message that you can edit using the FortiGate web based manager You can configure URL blocking to block all or some of the pages on a web site Using this feature you can deny access to parts of a web site without denying access to it completely To prevent unintentionally blocking legitimate web pages you can add URLs to an exempt list that overrides the URL blocking and content blocking lists Web content filtering also includes a script filter feature that can block unsecure web content such as Java applets cookies and Activex You can use the Cerberian URL blocking to block unwanted URLs 16 Fortinet Inc Introduction Email filtering Email filtering
271. ination network For example the real IP address could be the IP address of a web server on an internal network In Map to Port enter the port number to be added to packets when they are forwarded If you do not want to translate the port enter the same number as the External Service Port If you want to translate the port enter the port number to which to translate the destination port of the packets when they are forwarded by the firewall Select the protocol TCP or UDP that you want the forwarded packets to use Select OK to save the port forwarding virtual IP FortiGate 800 Installation and Configuration Guide 211 Virtual IPs Firewall configuration Figure 48 Adding a port forwarding virtual IP Virtual IP y Add New Virtual IP Mapping Name Web_Server External Interface external 7 Type C Static NST Port Forwarding External IP Address 173 87 39 21 External Service Port jo Map to IP 10 10 10 5 Map to Port jo Protocol Tcp C upp Adding policies with virtual IPs Use the following procedure to add a policy that uses a virtual IP to forward packets To add a policy with a virtual IP Go to Firewall gt Policy 2 Select the type of policy that you want to add The source interface must match the interface selected in the External Interface list The destination interface must match the interface connected to the network with the Map to IP address 3 Use the following information to
272. infected with a virus or blocked by antivirus file blocking Backing up system settings kh OO N You can back up system settings by downloading them to a text file on the management computer To back up system settings Go to System gt Status Select System Settings Backup Select Backup System Settings Type a name and location for the file The system settings file is backed up to the management computer Select Return to go back to the Status page Restoring system settings 108 You can restore system settings by uploading a previously downloaded system settings text file To restore system settings Go to System gt Status Select System Settings Restore Enter the path and filename of the system settings file or select Browse and locate the file Select OK to restore the system settings file to the FortiGate unit The FortiGate unit restarts loading the new system settings Reconnect to the web based manager and review your configuration to confirm that the uploaded system settings have taken effect Fortinet Inc System status Restoring system settings to factory defaults Restoring system settings to factory defaults A Use the following procedure to restore system settings to the values set at the factory This procedure does not change the firmware version or the antivirus or attack definitions Caution This procedure deletes all changes that you have made to the FortiGate configuration a
273. ing e Configuring FortiGate Web URL blocking Configuring FortiGate Web pattern blocking e Configuring Cerberian URL filtering Configuring FortiGate Web URL blocking You can configure FortiGate Web URL blocking to block all pages on a website by adding the top level URL or IP address You can also block individual pages on a website by including the full path and filename of the web page to block e Adding URLs to the Web URL block list e Clearing the Web URL block list e Downloading the Web URL block list e Uploading a URL block list Adding URLs to the Web URL block list 1 Go to Web Filter gt Web URL Block Select New to add a URL to the Web URL block list Type the URL the you want to block Type a top level URL or IP address to block access to all pages on a website For example www badsite comor122 133 144 155 blocks access to all pages at this website Type a top level URL followed by the path and filename to block access to a single page on a website For example www badsite com news html or 122 133 144 155 news html blocks the news page on this website To block all pages with a URL that ends with badsite com add badsite com to the block list For example adding badsite com blocks access to www badsite com mail badsite com www finance badsite com and so on ue Note Do not include http in the URL that you want to block FortiGate 800 Installation and Configuration Guide 293 URL blocking Web filtering
274. ing command to restart the FortiGate unit execute reboot As the FortiGate units starts a series of system startup messages are displayed When the following message appears Press any key to enter configuration menu Immediately press any key to interrupt the system startup Note You have only 3 seconds to press any key If you do not press a key soon enough the FortiGate unit reboots and you must log in and repeat the execute reboot command If you successfully interrupt the startup process the following message appears Get firmware image from TFTP server Format boot device Boot with backup firmware and set as default Quit menu and continue to boot with default firmware Display this list of options Enter G F B Q or H Type B to load the backup firmware image The FortiGate unit loads the backup firmware image and restarts When the FortiGate unit restarts it is running the backup firmware version and the configuration is set to factory default FortiGate 800 Installation and Configuration Guide 105 Manual virus definition updates System status Switching back to the default firmware image Use this procedure to switch the FortiGate unit to operating with the backup firmware image that had been running as the default firmware image When you switch to this backup firmware image the configuration saved with this firmware image is restored To switch back to the default firmware image 1 Conn
275. ing in the Sort by list Select Apply 284 Fortinet Inc Antivirus protection Quarantine Filtering the quarantine list kh OO N kh OO N You can filter the quarantine list to e Display only blocked files e Display only infected files e Display blocked and infected files found only in IMAP POP3 SMTP FTP or HTTP traffic To filter the Quarantine list to display blocked or infected files Go to Anti Virus gt Quarantine For Fillter select Status Select either infected or blocked Select Apply To filter the Quarantine list to display blocked or infected files for a service Go to Anti Virus gt Quarantine For Fillter select Service Select IMAP POP3 SMTP FTP or HTTP Select Apply Deleting files from the quarantine list 1 2 To delete a file from the quarantine list Go to Anti Virus gt Quarantine Select Delete jj to remove a quarantined file from the list Downloading quarantined files 1 2 To download quarantined files Go to Anti Virus gt Quarantine Select Download ETE to download a quarantined file in its original format Configuring quarantine options You can specify whether the FortiGate unit quarantines infected files blocked files or both in web FTP and email traffic You can also set the file age limit the maximum file size and the method for handling additional files when the FortiGate hard disk is running out of disk space To configure quarantine options G
276. ing log messages on page 313 For information about traffic logs see Configuring traffic logging on page 314 This section describes e Recording logs on a remote computer e Recording logs on a NetIQ WebTrends server e Recording logs on the FortiGate hard disk e Recording logs in system memory e Log message levels FortiGate 800 Installation and Configuration Guide 309 Recording logs 310 Logging and reporting Recording logs on a remote computer a Ff WOW N You can configure the FortiGate unit to record log messages on a remote computer The remote computer must be configured with a syslog server To record logs on a remote computer Go to Log amp Report gt Log Setting Select the Log to Remote Host check box to send the logs to a syslog server Type the IP address of the remote computer running syslog server software Type the port number of the syslog server Select the severity level for which you want to record log messages The FortiGate unit logs all levels of severity down to but not lower than the level you choose For example if you want to record emergency alert critical and error messages select Error See Log message levels on page 312 Select Config Policy Select the Log type for which you want the FortiGate unit to record logs e For each Log type select the activities for which you want the FortiGate unit to record log messages For information about log types and activi
277. interface Ifthe Gateway 2 IP address is not on the same subnet as a FortiGate interface or VLAN subinterface the system routes the traffic to the external interface using the default route You can use Device 2 to send packets to an interface that is on a different subnet than the destination IP address of the packets without routing them using the default route 8 Select OK to save the route A Note Any two routes in the routing table must differ by something other than just the gateway to S be simultaneously active If two routes added to the routing table are identical except for their gateway IP addresses only the route closer to the top of the routing table can be active A Note Arrange routes in the routing table from more specific to more general For information s about arranging routes in the routing table see Configuring the routing table Adding routes in Transparent mode Use the following procedure to add routes when operating the FortiGate unit in Transparent mode To add a route in Transparent mode Go to System gt Network gt Routing Select New Enter the Destination IP address and Netmask for the route kh OO N Enter the Gateway IP address for the route FortiGate 800 Installation and Configuration Guide 155 Configuring routing Network configuration 5 Select OK to save the new route 6 Repeat steps 1 to 5 to add more routes as required Configuring the routing table The routing t
278. ion describes e Policy matching in detail e Changing the order of policies in a policy list e Enabling and disabling policies Policy matching in detail When the FortiGate unit receives a connection attempt at an interface it must select a policy list to search through for a policy that matches the connection attempt The FortiGate unit chooses the policy list based on the source and destination addresses of the connection attempt The FortiGate unit then starts at the top of the selected policy list and searches down the list for the first policy that matches the connection attempt source and destination addresses service port and time and date at which the connection attempt was received The first policy that matches is applied to the connection attempt If no policy matches the connection is dropped The default policy accepts all connection attempts from the internal network to the Internet From the internal network users can browse the web use POP3 to get email use FTP to download files through the firewall and so on If the default policy is at the top of the internal gt external policy list the firewall allows all connections from the internal network to the Internet because all connections match the default policy If more specific policies are added to the list below the default policy they are never matched A policy that is an exception to the default policy for example a policy to block FTP connections must be plac
279. ion is processed by the primary unit The next three connections are processed by the first subordinate unit e The next three connections are processed by the second subordinate unit The subordinate units process more connections than the primary unit and both subordinate units on average process the same number of connections Active Active cluster packet flow This section describes packet flow through an active active HA cluster The cluster consists of two FortiGate units primary and subordinate Cluster interfaces are connected using switches NAT Route mode packet flow e Configuring switches to work with a NAT Route mode cluster e Transparent mode packet flow Figure 18 Active active HA packet flow Switch 1 Switch 2 HA cluster FortiGate 800 Installation and Configuration Guide 89 Active Active cluster packet flow High availability NAT Route mode packet flow In NAT Route mode five MAC addresses are involved in active active communication between a client and a server if the cluster routes the packets to the subordinate unit in the cluster e Virtual cluster MAC address MAC_V e Client MAC address MAC_C e Server MAC address MAC_S Subordinate unit internal MAC address MAC_S_1 e Subordinate unit external MAC address MAC_S_E In NAT Route mode the HA cluster works as a gateway when it responds to ARP requests Therefore the client and the server only know the gateway MAC address M
280. irst then the FortiGate unit checks for a match with these local users If a match is not found the FortiGate unit checks the RADIUS or LDAP server If a RADIUS or LDAP server is added first the FortiGate unit checks the server and then the local users If the user group contains users RADIUS servers and LDAP servers the FortiGate unit checks them in the order in which they have been added to the user group This section describes e Adding user groups e Deleting user groups Adding user groups Use the following procedure to add user groups to the FortiGate configuration You can add user names RADIUS servers and LDAP servers to user groups To add a user group 1 Go to User gt User Group 2 Select New to add a new user group FortiGate 800 Installation and Configuration Guide 229 Configuring user groups 230 8 Users and authentication Figure 55 Adding a user group User Group N New User Group Group Name PPTP_User_Group Available Users Members Enter a Group Name to identify the user group The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed To add users to the user group select a user from the Available Users list and select the right arrow to add the name to the Members list To add a RADIUS server to the user group select a RADIUS server from the Availabl
281. irtual domain to the FortiGate unit You must add at least one virtual domain to support VLANs in Transparent mode Add more virtual domains to simplify configuration if you are planning to add a large number of VLANs To add a virtual domain Go to System gt Virtual Domain Select New to add a virtual domain Type a Name for the virtual domain kh OO N Select OK to add the virtual domain FortiGate 800 Installation and Configuration Guide 149 Virtual domains in Transparent mode Network configuration Adding VLAN subinterfaces to a virtual domain Use the following procedure to add VLAN subinterfaces to a virtual domain You must add at least two VLAN subinterfaces to each virtual domain In most configurations a virtual domain is used to send VLAN tagged packets received at one FortiGate physical interface to another FortiGate physical interface for example from the internal interface to the external interface For this to occur you must add VLAN subinterfaces to the receiving and sending physical interfaces for example to the internal and external interfaces To add VLAN subinterfaces to a virtual domain Go to System gt Network gt VLAN Select the Virtual Domain to add the VLAN subinterface to Select New to add a VLAN subinterface Type a Name for the VLAN subinterface a Ff O N Select the interface to associate the VLAN subinterface with The VLAN subinterface must be added to the FortiGate interface that
282. irtual domains in Transparent mode on page 147 To add policies that include VLAN subinterfaces you must use the following steps to add the VLAN subinterfaces to the firewall policy grid Add VLAN subinterfaces to the FortiGate configuration Add firewall addresses for the VLAN subinterface See Adding addresses on page 197 You can add zones to the FortiGate configuration to group together related interfaces and VLAN subinterfaces to simplify firewall policy creation For more information about zones see Configuring zones on page 137 To add policies for zones you must use the following steps to add the zones to the firewall policy grid Add zones to the FortiGate configuration See Adding zones on page 138 Add interfaces and VLAN subinterfaces to the zone See Adding an interface to a zone on page 139 Add firewall addresses for the zone See Adding addresses on page 197 FortiGate 800 Installation and Configuration Guide 187 Default firewall configuration Firewall configuration Addresses To add policies between interfaces VLAN subinterfaces and zones the firewall configuration must contain addresses for each interface VLAN subinterface or zone By default the firewall configuration includes the addresses listed in Table 37 Table 37 Default addresses Interface Address Description Internal Internal_All This address matches all addresses on the internal network
283. irus and attack definitions on page 117 You can also configure the management interface to control how administrators connect to the FortiGate unit for administration and the FortiGate interfaces to which administrators can connect Controlling administrative access to a FortiGate interface connected to the Internet allows remote administration of the FortiGate unit from any location on the Internet However allowing remote administration from the Internet could compromise the security of the FortiGate unit You should avoid allowing administrative access for an interface connected to the Internet unless this is required for your configuration To improve the security of a FortiGate unit that allows remote administration from the Internet e Use secure administrative user passwords e Change these passwords regularly Fortinet Inc Network configuration VLAN overview e Enable secure administrative access to this interface using only HTTPS or SSH e Do not change the system idle timeout from the default value of 5 minutes see To set the system idle timeout on page 170 To configure the management interface in Transparent mode Go to System gt Network gt Management Change the Management IP and Netmask as required This must be a valid address for the network that you want to manage the FortiGate unit from Add a default gateway IP address if the FortiGate unit must connect to a default gateway to reach the manageme
284. ist To add a custom IP service Go to Firewall gt Service gt Custom Select IP from the Protocol list Select New kh OO N Type a Name for the new custom IP service This name appears in the service list used when you add a policy The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Specify the IP protocol number for the service Select OK to add the custom service You can now add this custom service to a policy Grouping services To make it easier to add policies you can create groups of services and then add one policy to provide or block access for all the services in the group A service group can contain predefined services and custom services in any combination You cannot add service groups to another service group To group services 1 Go to Firewall gt Service gt Group 2 Select New 204 Fortinet Inc Firewall configuration Schedules 3 Type a Group Name to identify the group This name appears in the service list when you add a policy and cannot be the same as a predefined service name The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed 4 To add services to the service group select a service from the Available Services list and select the right arrow to copy it
285. itor interfaces that are connected to networks You should not configure cluster interface monitoring until the cluster is connected to your network To monitor cluster interfaces Connect to the cluster and log into the web based manager Go to System gt Config gt HA In the Monitor on Interface section select the names of the interfaces that you want to monitor Select Apply The cluster synchronizes this configuration change to all cluster units Viewing the status of cluster members The web based manager lists the serial numbers of all the FortiGate units in the cluster The primary unit is identified as Local For each cluster member the list includes the up time and status for that cluster member To view the status of each cluster member Connect to the cluster and log into the web based manager Go to System gt Status gt Cluster Members Figure 16 Example cluster members list Status oN Cluster Members D Monitor Session N Priority Status Local 16 days 0 hours 27 minutes 0 seconds 0 FP53012803021709 12 days 0 hours 16 minutes 12 seconds Monitoring cluster members To monitor health information for each cluster member Connect to the cluster and log into the web based manager Go to System gt Status gt Monitor The cluster displays CPU memory status and hard disk status for each cluster member The primary unit is identified as Local and the other units in the cluster are listed by serial
286. ivate documents over the Internet using a Web browser FortiGate 800 Installation and Configuration Guide AT MET Internal interface The FortiGate interface that is connected to an internal private network Internet A collection of networks connected together that span the entire globe using the NFSNET as their backbone As a generic term it refers to any collection of interdependent networks ICMP Internet Control Message Protocol Part of the Internet Protocol IP that allows for the generation of error messages test packets and information messages relating to IP This is the protocol used by the ping function when sending ICMP Echo Requests to a network host IKE Internet Key Exchange A method of automatically exchanging authentication and encryption keys between two secure servers IMAP Internet Message Access Protocol An Internet email protocol that allows access to your email from any IMAP compatible browser With IMAP your mail resides on the server IP Internet Protocol The component of TCP IP that handles routing IP Address An identifier for a computer or device on a TCP IP network An IP address is a 32 bit numeric address written as four numbers separated by periods Each number can be zero to 255 L2TP Layer Two 2 Tunneling Protocol An extension to the PPTP protocol that enables ISPs to operate Virtual Private Networks VPNs L2TP merges PPTP from Microsoft and L2F from Cisco Systems To
287. ize a replacement message Go to System gt Config gt Replacement Messages For the replacement message that you want to customize select Modify E In the Message setup dialog box edit the content of the message Table 35 lists the replacement message sections that can be added to replacement messages and describes the tags that can appear in each section In addition to the allowed tags you can add text For mail and HTTP messages you can also add HTML code 4 Select OK to save the changes Table 35 Replacement message sections File blocking Used for file blocking all services Section Start lt BLOCKED gt Allowed Tags FILE The name of the file that was blocked WVURL The URL of the blocked web page Section End lt BLOCKED gt Scanning Used for virus scanning all services Section Start lt INFECTED gt Allowed Tags FILE The name of the file that was infected VUWVIRUS The name of the virus infecting the file WVURL The URL of the blocked web page or file Section End lt INFECTED gt Quarantine Used when quarantine is enabled permitted for all scan services and block services for email only Section Start lt QUARANTINE gt Allowed Tag QUARFILE The name of the file that was quarantined NAME Section End lt QUARANTINE gt 182 Fortinet Inc System configuration Replacement m
288. k gt Interface Choose the interface that the SNMP manager connects to and select Modify E For Administrative Access select SNMP Select OK To configure SNMP access to an interface in Transparent mode Go to System gt Network gt Management Choose the interface that the SNMP manager connects to and select SNMP Select Apply Configuring SNMP community settings You can configure a single SNMP community for each FortiGate device An SNMP community consists of identifying information about the FortiGate unit your SNMP get community and trap community strings and the IP addresses of up to three SNMP managers that can receive traps sent by the FortiGate SNMP agent Fortinet Inc System configuration Configuring SNMP To configure SNMP community settings 1 Go to System gt Config gt SNMP v1 v2c Select the Enable SNMP check box Configure the following SNMP settings System Name Automatically set to the FortiGate host name To change the System Name see Changing the FortiGate host name on page 94 System Location Describe the physical location of the FortiGate unit The system location description can be up to 31 characters long and can contain spaces numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ The lt gt amp characters are not allowed Contact Information Add the contact information for the person responsible for this FortiGate unit The contact info
289. k E Web Script Filter i Web Exempt List Email Block List E E Email Exempt List B E Email Content Block E E C block C block C block C block C block pass pass pass pass pass Pass Fragmented Emails T D E Oversized File Email File blocking Enable file blocking to remove all files that are a potential threat and to provide the best protection from active computer virus attacks Blocking files is the only protection from a virus that is so new that antivirus scanning cannot detect it You would not normally operate the FortiGate unit with blocking enabled However it is available for extremely high risk situations in which there is no other way to prevent viruses from entering your network On a FortiGate unit with a hard disk if quarantining is enabled for blocked files for the matching traffic protocol the FortiGate unit adds the file to the quarantine list File blocking deletes all files that match a list of enabled file patterns The FortiGate unit replaces the file with an alert message that is forwarded to the user The FortiGate unit also writes a message to the virus log and sends an alert email if it is configured to do so se Note If both blocking and scanning are enabled the FortiGate unit blocks files that match a enabled file patterns and does not scan these files for viruses FortiGate 800 Installation and Configuration Guide 281 File blocking Blocking files Antivirus protection By default
290. k definition and antivirus engine updates from the FDN Push updates from the FDN Update status including version numbers expiry dates and update dates and times Push updates through a NAT device FortiGate 800 Installation and Configuration Guide 117 Updating antivirus and attack definitions Virus and attack definitions updates and registration The Update page on the web based manager displays the following antivirus and attack definition update information Version Current antivirus engine virus definition and attack definition version numbers Expiry date Expiry date of your license for antivirus engine virus definition and attack definition updates Last update Date and time on which the FortiGate unit last attempted to download attempt antivirus engine virus definition and attack definition updates Last update Success or failure of the last update attempt No updates means the last status update attempt was successful but no new updates were available Update succeeded or similar messages mean the last update attempt was successful and new updates were installed Other messages can indicate that the FortiGate was not able to connect to the FDN and other error conditions This section describes Connecting to the FortiResponse Distribution Network e Manually initiating antivirus and attack definitions updates e Configuring update logging Connecting to the FortiResponse Distribution Network Before the For
291. le at http mail abuse org rbl as a starting point for creating your own email block list You can upload blacklists to the FortiGate unit as text files with only minimal editing to remove comments at the top of each list and to combine the lists that you want into a single file A Note All changes made to the email block list using the web based manager are lost when you x upload a new list However you can download your current email block list add more patterns Me to it using a text editor and then upload the edited list to the FortiGate unit To upload the email block list In a text editor create the list of patterns to block Using the web based manager go to Email Filter gt Block List Select Upload kh OO N Type the path and filename of your email block list text file or select Browse and locate the file Select OK to upload the file to the FortiGate unit Select Return to display the updated email block list a You can continue to maintain the email block list by making changes to the text file and uploading it again Email exempt list Add address patterns to the exempt list to allow legitimate IMAP and POP3 traffic that might otherwise be tagged by email or content blocking For example if the email banned word list is set to block email that contains pornography related words and a reputable company sends email that contains these words the FortiGate unit would normally add a subject tag to the email Addin
292. lect a new primary unit Failure of the primary unit results in the following e If SNMP is enabled the new primary FortiGate unit sends the trap message HA switch This trap indicates that the primary unit in an HA cluster has failed and has been replaced with a new primary unit The cluster contains fewer FortiGate units The failed primary unit no longer appears on the Cluster Members list The host name and serial number of the primary cluster unit changes The new primary unit logs the following messages to the event log HA slave became master Detected HA member dead If a subordinate unit fails the cluster continues to function normally Failure of a subordinate unit results in the following e The cluster contains fewer FortiGate units The failed unit no longer appears on the Cluster Members list e The master unit logs the following message to the event log Detected HA member dead Viewing cluster communication sessions 1 2 Connect to the cluster and log into the web based manager Go to System gt Status gt Session The session table displays the sessions processed by the primary unit in the cluster including HA communication sessions between the primary unit and the subordinate units HA communications use e Port 702 as the destination port From and To IP address on the 10 0 0 0 subnet During cluster negotiation the HA interface of each cluster unit is assigned an IP address The IP a
293. les Use content profiles to apply different protection settings for content traffic that is controlled by firewall policies You can use content profiles to e Configure antivirus protection for HTTP FTP POP3 SMTP and IMAP policies Configure web filtering for HTTP policies e Configure email filtering for IMAP and POP3 policies e Configure oversized file and email blocking for HTTP FTP POP3 SMTP and IMAP policies e Pass fragmented email for POP3 SMTP and IMAP policies Using content profiles you can build protection configurations that can be applied to different types of firewall policies This allows you to customize types and levels of protection for different firewall policies For example while traffic between internal and external addresses might need strict protection traffic between trusted internal addresses might need moderate protection You can configure policies for different traffic services to use the same or different content profiles Content profiles can be added to NAT Route mode and Transparent mode policies e Default content profiles e Adding content profiles e Adding content profiles to policies 218 Fortinet Inc Firewall configuration Content profiles Default content profiles The FortiGate unit has the following four default content profiles that are displayed on the Firewall Content Profile page You can use the default content profiles or create your own Strict To apply maximum con
294. licies Strict content profile Use the strict content profile to apply maximum content protection to HTTP FTP IMAP POP3 and SMTP content traffic You do not need to use the strict content profile under normal circumstances but it is available if you have extreme problems with viruses and require maximum content screening protection FortiGate 800 Installation and Configuration Guide 33 Factory default FortiGate configuration settings 34 Getting started Table 5 Strict content profile Options HTTP FTP IMAP POP3 SMTP Antivirus Scan m m l MV MV File Block Mw Mw Mw MV MV Quarantine Mw Mw M i i Web URL Block m Web Content Block m Web Script Filter m Web Exempt List m Email Block List m MV Email Exempt List m MV Email Content Block Mw M Oversized File Email Block block block block block block Pass Fragmented Emails O O O Scan content profile Use the scan content profile to apply antivirus scanning to HTTP FTP IMAP POP3 and SMTP content traffic Quarantine is also selected for all content services On FortiGate models with a hard drive if antivirus scanning finds a virus in a file the file is quarantined on the FortiGate hard disk If required system administrators can recover quarantined files Table 6 Scan content profile Options HTTP FTP IMAP POP3 SMTP Antivirus Scan MV Mw l M
295. list to the neighbors filter eee cceeeeeeeeeeeeeeeeteeeeeeeenteeeeeeeaas 166 Assigning a RIP filter list to the incoming filter e ce eeeeeceeeeeeeteeeeeeeeneeeeeeeenaeeeeeeeaas 166 Assigning a RIP filter list to the outgoing filter ee eeceeceeeeeneeeeeeeeetteeeeeeentaeeeeeeeaas 167 System COTE NIN sis cess casera i cacnca td ccintideacacieseleciniceeectcbcbninade 169 Setting system date and MEanna iini 169 Changing System Options sesionin tates EE E A 170 Adding and editing administrator accounts eeeesssseseeesserrreseerrsstttrrrstttrnnssrennnnseen nns 172 Adding new administrator aACCOuUntS eecceeceeeeeeeeee eee eecneee eee eaaeeeeeeenaeeeeeeenaeeeeeeenaaes 172 Editing administrator ACCOUNTS sessiones nenni EEan Ean ATEENA EEEN 173 Configuring SNMP senscinicenenienarnn aaa a a a nice 173 Configuring the FortiGate unit for SNMP monitoring seeesesseeeeeeseeerrssseerrresserrrrsssrees 174 Configuring FortiGate SNMP support 0 eee ceeeeeteeee eee e entree tere tates eee taaeeeeeetaeeeeeeead 174 FortiGate MIBS ccc cceceeeee eect terete en nee etre ee eee ieee eee nieeee eee neeeeeeneeeeeeenieeeseneaa 176 FOMmMIG Ale TADS ich ctccs cectewdacsadeas cocks cecivaas lt al ancech acess cosuauesnwestededdvenedddcesaunanedtenstedadvscerdeces 177 Fortinet MIB TelAS a ccccies iecckttvas gaceceiih E E aed ane 179 Replacement messages ci cieccci cciecctedes ananira A EEE AR 181 Customizing replacemen
296. ly start an antivirus definitions update by going to System gt Update and selecting Update Now To update the antivirus definitions manually 1 Download the latest antivirus definitions update file from Fortinet and copy it to the computer that you use to connect to the web based manager Start the web based manager and go to System gt Status In the Antivirus Definitions Version section select Definitions Update SE 106 Fortinet Inc System status Manual attack definition updates Type the path and filename for the antivirus definitions update file or select Browse and locate the antivirus definitions update file Select OK to copy the antivirus definitions update file to the FortiGate unit The FortiGate unit updates the antivirus definitions This takes about 1 minute Go to System gt Status to confirm that the Antivirus Definitions Version information has updated Manual attack definition updates Displaying the 1 The Status page of the FortiGate web based manager displays the current installed versions of the FortiGate Attack Definitions used by the Network Intrusion Detection System NIDS Note For information about configuring the FortiGate unit for automatic attack definitions updates see Virus and attack definitions updates and registration on page 117 You can also manually start an attack definitions update by going to System gt Update and selecting Update Now To update the attack definitions
297. m any interface Ideally this MTU should be the same as the smallest MTU of all the networks between the FortiGate unit and the destination of the packets If the packets that the FortiGate unit sends are larger they are broken up or fragmented which slows down transmission Experiment by lowering the MTU to find an MTU size for best network performance To change the MTU size of the packets leaving an interface Go to System gt Network gt Interface Choose an interface and select Modify Fey Select Override default MTU value 1500 Set the MTU size Set the maximum packet size For manual and DHCP addressing mode the MTU size can be from 576 to 1500 bytes For PPPoE addressing mode the MTU size can be from 576 to 1492 bytes Configuring traffic logging for connections to an interface 4 To configure traffic logging for connections to an interface Go to System gt Network gt Interface Choose an interface and select Modify z Select the Log check box to record log messages whenever a firewall policy accepts a connection to this interface Select OK to save the changes Configuring the management interface in Transparent mode Configure the management interface in Transparent mode to set the management IP address of the FortiGate unit Administrators connect to this IP address to administer the FortiGate unit The FortiGate also uses this IP address to connect to the FDN for virus and attack updates see Updating antiv
298. m the VPN concentrator select the tunnel in the Members list and select the left arrow 6 Select OK to add the VPN concentrator Figure 61 Adding a VPN concentrator Manual Key xJ Phase 2 a Phase 1 N Concentrator D Dialup Monitor A New YPN Concentrator Concentrator Name Concentrator_1 Available Tunnels Members Certificate_1_tunnel Certificate_2 tunnel Preshared_key_1_tun Preshared_key_2_tuni Manual _key_1_ tunnel Certificate_1_tunnel Certificate_2 tunnel Preshared_key_2_tuni Manual_key_1_tunnel FortiGate 800 Installation and Configuration Guide 251 IPSec VPN concentrators IPSec VPN VPN spoke general configuration steps A remote VPN peer that functions as a spoke requires the following configuration e A tunnel AutolIKE phase 1 and phase 2 configuration or manual key configuration for the hub e The source address of the local VPN spoke The destination address of each remote VPN spoke A separate outbound encrypt policy for each remote VPN spoke These policies allow the local VPN spoke to initiate encrypted connections A single inbound encrypt policy This policy allows the local VPN spoke to accept encrypted connections To create a VPN spoke configuration 1 Configure a tunnel between the spoke and the hub Choose between a manual key tunnel or an AutolKE tunnel e To add a manual key tunnel see Manual key IPSec VPNs on page 233 e To add an AutolKE tu
299. ministrator enables the SNMP agent or changes FortiGate SNMP settings This trap is sent when the agent starts during system startup System Down The SNMP agent stops because the FortiGate unit shuts down Agent Down An administrator disables the SNMP agent Agent Up An administrator enables the SNMP agent This trap is also sent when the agent starts during system startup The lt interface_name gt The IP address of an interface of a FortiGate unit changes The trap Interface IP is changed message includes the name of the interface the new IP address of to lt new_IP gt Serial the interface and the serial number of the FortiGate unit This trap No can be used to track interface IP address changes for interfaces lt FortiGate_serial_no gt configured with dynamic IP addresses set using DHCP or PPPoE System traps Table 22 FortiGate system traps Trap message Description interface An interface changes from the up state to the running state indicating lt interface_name gt is that the interface has been connected to a network up When the interface is up it is administratively up but not connected to a network When the interface is running it is administratively up and connected to a network interface An interface changes from the running state to the up state indicating lt interface_name gt is that the interface has been disconnected from a network down CPU usag
300. mple banned the FortiGate unit tags all IMAP and POP3 email that contains that word e Ifyou type a phrase for example banned phrase the FortiGate unit tags email that contains both words When this phrase appears on the banned word list the FortiGate unit inserts plus signs in place of spaces for example banned phrase If you type a phrase in quotes for example banned word the FortiGate unit tags all email in which the words are found together as a phrase Content filtering is not case sensitive You cannot include special characters in banned words Select the Language for the banned word or phrase You can choose Western Chinese Simplified Chinese Traditional Japanese or Korean Your computer and web browser must be configured to enter characters in the language that you select Select OK The word or phrase is added to the banned word list Note Email Content Block must be selected in the content profile for IMAP or POP3 email containing banned words to be tagged Fortinet Inc Email filter Email banned word list Downloading the email banned word list You can back up the banned word list by downloading it to a text file on the management computer To download the banned word list 1 Go to Email Filter gt Content Block 2 Select Download The FortiGate unit downloads the banned word list to a text file on the management computer You can specify a location to which to download the tex
301. mplified Chinese Traditional Chinese Japanese or Korean character sets e Adding words and phrases to the Banned Word list e Clearing the Banned Word list e Backing up the Banned Word list e Restoring the Banned Word list Adding words and phrases to the Banned Word list 1 2 3 Go to Web Filter gt Content Block Select New to add a word or phrase to the Banned Word list Choose a language or character set for the banned word or phrase You can choose Western Chinese Simplified Chinese Traditional Japanese or Korean Your computer and web browser must be configured to enter characters in the character set that you choose Fortinet Inc Web filtering we gt Content blocking Type a banned word or phrase If you type a single word for example banned the FortiGate unit blocks all web pages that contain that word If you type a phrase for example banned phrase the FortiGate unit blocks web pages that contain both words When this phrase appears on the banned word list the FortiGate unit inserts plus signs in place of spaces for example banned phrase If you type a phrase in quotes for example banned word the FortiGate unit blocks all web pages in which the words are found together as a phrase Content filtering is not case sensitive You cannot include special characters in banned words To enable the banned word ensure that the Enable checkbox is selected Select OK The
302. n agreed upon format for transmitting data between two devices The protocol determines the type of error checking to be used the data compression method if any how the sending device indicates that it has finished sending a message and how the receiving device indicates that it has received a message RADIUS Remote Authentication Dial In User Service An authentication and accounting system used by many Internet Service Providers ISPs When users dial into an ISP they enter a user name and password This information is passed to a RADIUS server which checks that the information is correct and then authorizes access to the ISP system Router A device that connects LANs into an internal network and routes traffic between them Routing The process of determining a path to use to send data to its destination Routing table A list of valid paths through which data can be transmitted Server An application that answers requests from other devices clients Used as a generic term for any device that provides services to the rest of the network such as printing high capacity storage and network access SMTP Simple Mail Transfer Protocol In TCP IP networks this is an application for providing mail delivery services SNMP Simple Network Management Protocol A set of protocols for managing networks SNMP works by sending messages to different parts of a network SNMP compliant devices called agents store data about th
303. n of the BIOS running on the FortiGate unit is displayed when you restart the FortiGate unit using the CLI through a console connection S To perform this procedure you access the CLI by connecting to the FortiGate console port using a null modem cable e install a TFTP server that you can connect to from the FortiGate internal interface The TFTP server should be on the same subnet as the internal interface Before beginning this procedure you can e Back up the FortiGate unit configuration For information see Backing up system settings on page 108 e Back up the NIDS user defined signatures For information see the FortiGate NIDS Guide e Back up web content and email filtering lists For information see the FortiGate Content Protection Guide If you are reverting to a previous FortiOS version for example reverting from FortiOS v2 50 to FortiOS v2 36 you might not be able to restore your previous configuration from the backup configuration file lt Note Installing firmware replaces the current antivirus and attack definitions with the definitions E included with the firmware release that you are installing After you install new firmware use the procedure Manually initiating antivirus and attack definitions updates on page 119 to make sure that antivirus and attack definitions are up to date To install firmware from a system reboot Connect to the CLI using the null modem cable and FortiGate console
304. n override FortiResponse server To add an override server Go to System gt Update Select the Use override server address check box Type the IP address of a FortiResponse server kh ON Select Apply The FortiGate unit tests the connection to the override server If the FortiResponse Distribution Network setting changes to available the FortiGate unit has successfully connected to the override server If the FortiResponse Distribution Network stays set to not available the FortiGate unit cannot connect to the override server Check the FortiGate configuration and network configuration for settings that would prevent the FortiGate unit connecting to the override FortiResponse server FortiGate 800 Installation and Configuration Guide 121 Enabling push updates Virus and attack definitions updates and registration Enabling scheduled updates through a proxy server If your FortiGate unit must connect to the Internet through a proxy server you can use the set system autoupdate tunneling command to allow the FortiGate unit to connect or tunnel to the FDN using the proxy server Using this command you can specify the IP address and port of the proxy server As well if the proxy server requires authentication you can add the user name and password required for the proxy server to the autoupdate configuration The full syntax for enabling updates through a proxy server is set system autoupdate tunneling enable address l
305. n page 313 and Configuring traffic logging on page 314 Select OK Select Apply Recording logs on the FortiGate hard disk You can record log files on the FortiGate hard disk if a hard disk is installed on your FortiGate unit To record logs on the FortiGate hard disk 1 Go to Log amp Report gt Log Setting Select the Log to Local Disk check box Type a maximum log file size in MB When the log file reaches the maximum log file size the current log file is closed and saved and a new active log file is started The default maximum log file size is 10 MB and the maximum allowed is 1 GB 4 Type a log time interval in days After the specified time interval the current log file is closed and saved and a new one is started The default log time interval is 10 days 5 Select the severity level for which you want to record log messages The FortiGate logs all levels of severity down to but not lower than the level you choose For example if you want to record emergency alert critical and error messages select Error See Log message levels on page 312 6 Select Config Policy To configure the FortiGate to filter the types of logs and events to record use the procedures in Filtering log messages on page 313 and Configuring traffic logging on page 314 7 Set Log options for when the disk is full to one of the following Overwrite Delete the oldest log file when the hard disk is full Overwrite is the
306. n to make sure that the cluster is operating properly For this reason the connection between the HA interface of all the FortiGate units in the cluster must be well maintained An interruption of this communication can have unpredictable results A Note The HA interfaces of the FortiGate units in a cluster are assigned IP addresses during o cluster negotiation These IP addresses cannot be viewed using the web based manager or the CLI Attempting to change the IP address of an HA interface using the web based manager or the CLI has no effect on the IP address assigned during cluster negotiation HA interfaces only accept connections used for HA communication between units in the cluster You cannot connect to the HA interfaces to manage the cluster or to manage individual FortiGate units in the cluster FortiGate units can be configured to operate in active passive A P or active active A A HA mode Active active and active passive clusters can run in either NAT Route or Transparent mode 1 HA does not provide session failover for PPPoE DHCP PPTP and L2TP services FortiGate 800 Installation and Configuration Guide 73 Configuring an HA cluster High availability An active passive A P HA cluster also referred to as hot standby HA consists of a primary FortiGate unit that processes traffic and one or more subordinate FortiGate units The subordinate FortiGate units are connected to the network and to the primary FortiGate unit
307. nabling 322 hard disk full 322 intrusion attempts 322 reducing messages 272 testing 321 virus incidents 322 allow inbound encrypt policy 192 allow outbound encrypt policy 192 allow traffic IP MAC binding 216 Anti Virus amp Web filter policy 193 antivirus definition updates manual 106 antivirus definitions updating 117 antivirus updates 120 configuring 121 through a proxy server 122 attack definition updates downloading 135 manual 107 attack definitions updating 117 119 attack detection checksum verification 270 disabling the NIDS 270 enabling and disabling signatures 272 selecting interfaces to monitor 270 viewing the signature list 271 attack log 313 content of messages 276 reducing messages 272 attack prevention configuring signature threshold values 275 enabling prevention signatures 274 NIDS 274 327 Index attack updates configuring 121 scheduling 120 through a proxy server 122 authentication 193 223 configuring 224 enabling 229 LDAP server 227 RADIUS server 226 timeout 170 auto device in route 155 AutolKE 232 certificates 232 introduction 232 pre shared keys 232 automatic antivirus and attack definition updates configuring 121 B backing up system settings 108 bandwidth guaranteed 192 maximum 193 banned word list adding words 290 304 restoring 305 blacklist URL 295 307 block traffic IP MAC binding 216 log option 311 blocking access to Internet sites 293 306 access to URLs 293 306
308. ncryption method used between the XAuth client the FortiGate unit and the authentication server PAP Password Authentication Protocol CHAP Challenge Handshake Authentication Protocol MIXED Select MIXED to use PAP between the XAuth client and the FortiGate unit and CHAP between the FortiGate unit and the authentication server Use CHAP whenever possible Use PAP if the authentication server does not support CHAP Use PAP with all implementations of LDAP and some implementations of Microsoft RADIUS Use MIXED if the authentication server supports CHAP but the XAuth client does not Use MIXED with the Fortinet Remote VPN Client Select a group of users to be authenticated by XAuth The individual users within the group can be authenticated locally or by one or more LDAP or RADIUS servers The user group must be added to the FortiGate configuration before it can be selected here 4 Optionally configure NAT Traversal Enable Keepalive Frequency Select Enable if you expect the IPSec VPN traffic to go through a gateway that performs NAT If no NAT device is detected enabling NAT traversal has no effect Both ends of the VPN both VPN peers must have the same NAT traversal setting If you enable NAT traversal you can change the number of seconds in the Keepalive Frequency field This number specifies in seconds how frequently empty UDP packets are sent through the NAT device to ensure that the NAT mapping does not cha
309. nd reverts the system to its original configuration including resetting interface addresses To restore system settings to factory defaults Go to System gt Status Select Restore Factory Defaults Select OK to confirm The FortiGate unit restarts with the configuration that it had when it was first powered on Reconnect to the web based manager and review the system configuration to confirm that it has been reset to the default settings For information about restoring system settings see Restoring system settings on page 108 Changing to Transparent mode kh OO N Use the following procedure to change the FortiGate unit from NAT Route mode to Transparent mode After you change the FortiGate unit to Transparent mode most of the configuration resets to Transparent mode factory defaults The following items are not set to Transparent mode factory defaults The admin administrator account password see Adding and editing administrator accounts on page 172 e HA settings see High availability on page 73 e Custom replacement messages see Replacement messages on page 181 To change to Transparent mode Go to System gt Status Select Change to Transparent Mode Select Transparent in the operation mode list Select OK The FortiGate unit changes operation mode To reconnect to the web based manager connect to the interface configured for Transparent mode management access and browse to https
310. nd the IP address of an NTP server that you can use see http Awww ntp org 7 Enter the IP address or domain name of the NTP server that the FortiGate unit can use to set its time and date 8 Specify how often the FortiGate unit should synchronize its time with the NTP server A typical Syn Interval would be 1440 minutes for the FortiGate unit to synchronize its time once a day FortiGate 800 Installation and Configuration Guide 169 Changing system options System configuration Select Apply Figure 36 Example date and time setting System Time Tue Jun 24 07 18 53 2003 Time Zone GMT 8 00 Pacific Time US amp Canada he I Automatically adjust clock for daylight saving changes SetTime Hour 7 x Minute 18 Second 53 7 Month un 7 Day 24 7 Year 2003 x C Synchronize with NTP Server Server 132 246 168 148 Syn Interval eo mins Changing system options 170 On the System Config Options page you can Set the system idle timeout e Set the authentication timeout e Select the language for the web base manager e Modify the dead gateway detection settings You can also restrict access to the control buttons and LCD by requiring a PIN Personal Identification Number To set the system idle timeout Go to System gt Config gt Options For Idle Timeout type a number in minutes Select Apply Idle Timeout controls the amount of inactive time that the web based manager waits
311. necting to the web based manager see Connecting to the web based manager on page 28 Changing to Transparent mode using the web based manager kh OO N The first time that you connect to the FortiGate unit it is configured to run in NAT Route mode To switch to Transparent mode using the web based manager Go to System gt Status Select Change to Transparent Mode Select Transparent in the Operation Mode list Select OK To reconnect to the web based manager change the IP address of the management computer to 10 10 10 2 Connect to the internal or DMZ interface and browse to https followed by the Transparent mode management IP address The default FortiGate Transparent mode management IP address is 10 10 10 1 Starting the setup wizard 1 3 Select Easy Setup Wizard the middle button in the upper right corner of the web based manager Use the information that you gathered in Table 16 on page 59 to fill in the wizard fields Select the Next button to step through the wizard pages Confirm your configuration settings and then select Finish and Close Reconnecting to the web based manager 60 If you changed the IP address of the management interface while you were using the setup wizard you must reconnect to the web based manager using the new IP address Browse to https followed by the new IP address of the management interface Otherwise you can reconnect to the web based manager by browsing to https
312. neeeeeaeeeeeneeeesuaeeneeneees 283 Quarantining blocked TICS isniiiciiismiiiendiiin annii adiri aidia eaeidladeaslieees 283 Viewing the quarantine list cece ceeeeeeeeeeeeeeeeeeeeeaaaeeeeeeeaaaeeeeeeeaaeeeeeeenaeeeeeesenas 284 Sorting the quarantine list sec cieei case tees tees ae eeeeaded need danerd ded edevananeeed dees eeeaeetetee 284 Filtering the quarantine liSt cee ee cece essence ee eeeeene eee eeeeaeeeeeeeeaeeeeeeeeaeeeeseenaeeeeeseaaas 285 Deleting files from the quarantine liSt ec ee ceeeeeeeeeeeeeeeeeeeeaeeeeeeeaaeeeeetenaeeeeeeeaaas 285 Downloading quarantined files 0 2 2 eee eeeeeee eee eecne eee ee eeaeee eee eaaeeeeeeeeaeeeeeeeesaeeeeeeeeaas 285 Configuring quarantine Options 0 0 0 eceeeeeeeeeeeee eee enee nett ee tenee eter eeaeeeeeeeaaeeeeeetnieeeeere 285 Blocking oversized files ANd emails 0 cc eceeeeeseeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeaaeeeeeeenaeeees 286 Configuring limits for oversized files and Email ccceeeeeeeeeeeeeeeeeetteeeeeeeteteeeeetens 286 Exempting fragmented email from DIOCKING ccceceeeeeeetee cette eeneeee eee titieeeeeeetnaeeeeenes 287 Viewing the virus elresto seid ddaveageh dled aAA TE abhi eae 287 Web TRG T AG einari Ean Eaa ea jass ces Ai 289 General configuration Step 2 cccecceeneeeeeeeeneeeeeeeeneneeeecaueeeeeedeauenseseedeneneeseeeeenenees 289 Content BIOCKING esiis op avocuees fe deaecsis ypu de daysgeuueadersaayateetta a
313. neeeeeeteteeeeeeeea 69 High availabilty eas see chtgc eta cicden mad bnaaai nan Enni 73 Contiguning aM HA CUSTER serenan E sans eddeueden eevee ae one 74 Configuring FortiGate units for HA Operation eee eeeeeeeee eee eeteeee eee eaeeeeeettaeeeeereea 74 Connecting he Cl ste sessir EAEE 76 Adding a new FortiGate unit to a functioning cluster cee eeeeeeeeeeeneeeeeeeentaeeeeeeeaes 78 Managing an HA CIUStED cc etree eee tne eter ete eerie ee eee eie eee eee neeeeeeeneeeeereneeeeertea 78 Configuring cluster interface monitoring ccc eee eect eee eetee eee ee eeteeeeeetaaeeeeeettaeeeeere 79 Viewing the status of cluster members eect eeeeeeeeeeeeeeeeeeeeseeeeeeeeeseeeeaaeeeseeenaaees 80 Monitoring cluster Members 4 0f002 acide ciseceteneaedievpradiens wate eeiaieetines wets 80 Viewing CIUSTEr SCSSIONS 2 szectesecdcectivesGoteseGa sue Magee aes Aegalasuadd ideas ahd ideas ANAA NANA bodes 82 Viewing and managing cluster log MESSAGES cceeeeeeeeteeeneeeeeeeeecaeeeeseeenaeeeeeeeeaaas 82 Monitoring cluster units for failover cc eee eeeeceeeee ee eetie seer eteeeeeeetiieeeeeetinieeeerenea 83 Viewing cluster communication SESSIONS cceeeeeeeeeeeeeeeeeeeeeaeeeeeeetaaeeeeeeenaeeeeeeeaaas 83 Managing individual cluster Units 0 ce eeeceeceeeeeceeeeeeeeeeneeeeeeeeaeeeeeeeeaeeeeeeenaaeeeeeeenaas 83 Changing cluster unit WOStinames vciis icatedesiveateedectaevaeer vehtecedaceanieeedie
314. network administrator to distribute and manage matching information at the VPN peer sites Whenever a pre shared key changes the administrator must update both sites AutolKE with certificates This method of key management involves a trusted third party the certificate authority CA Each peer in a VPN is first required to generate a set of keys known as a public private key pair The CA signs the public key for each peer creating a signed digital certificate The peer then contacts the CA to retrieve their own certificates plus that of the CA After the certificates are uploaded to the FortiGate units and appropriate IPSec tunnels and policies are configured the peers are ready to communicate As they do IKE manages the exchange of certificates sending signed digital certificates from one peer to another The signed digital certificates are validated by the presence of the CA certificate at each end With authentication complete the IPSec tunnel is then established Fortinet Inc IPSec VPN Manual key IPSec VPNs In some respects certificates are simpler to manage than manual keys or pre shared keys For this reason certificates are best suited to large network deployments Manual key IPSec VPNs When using manual keys complementary security parameters must be entered at both ends of the tunnel In addition to encryption and authentication algorithms and keys the security parameter index SPI is required The SPI is an arbitrary
315. nfigure the encrypt policy for e Inbound NAT to translate the source of incoming packets e Outbound NAT to translate the source address of outgoing packets e Traffic shaping to control the bandwidth available to the VPN and the priority of the VPN e Content profiles to apply antivirus protection web filtering and email filtering to web file transfer and email services in the VPN Logging so that the FortiGate unit logs all connections that use the VPN The policy must also include the VPN tunnel that you created to communicate with the remote FortiGate VPN gateway When users on your internal network attempt to connect to the network behind the remote VPN gateway the encrypt policy intercepts the connection attempt and starts the VPN tunnel added to the policy The tunnel uses the remote gateway added to its configuration to connect to the remote VPN gateway When the remote VPN gateway receives the connection attempt it checks its own policy gateway and tunnel configuration If the configuration is allowed an IPSec VPN tunnel is negotiated between the two VPN peers e Adding a source address e Adding a destination address e Adding an encrypt policy Adding a source address kh O N The source address is located within the internal network of the local VPN peer It can be a single computer address or the address of a network To add a source address Go to Firewall gt Address Select an internal interface Select N
316. ng IPSec redundancy For information about IPSec redundancy see Redundant IPSec VPNs on page 253 Configure the P2 Proposal Select up to three encryption and authentication algorithm combinations to propose for phase 2 The VPN peers must use the same P2 proposal settings Optionally enable Replay Detection Replay detection protects the VPN tunnel from replay attacks Note Do not select replay detection if you have also selected Null Authentication for the P2 Proposal Optionally enable Perfect Forward Secrecy PFS PFS improves security by forcing a new Diffie Hellman exchange whenever keylife expires Select the DH Group s The VPN peers must use the same DH Group settings Enter the Keylife The keylife causes the phase 2 key to expire after a specified time after a specified number of Kbytes of data have been processed by the VPN tunnel or both If you select both the key does not expire until both the time has passed and the number of Kbytes have been processed When the key expires a new key is generated without interrupting service P2 proposal keylife can be from 120 to 172800 seconds or from 5120 to 99999 Kbytes Fortinet Inc IPSec VPN AutolIKE IPSec VPNs 10 Enable Autokey Keep Alive if you want to keep the VPN tunnel running even if no data is being processed 11 Select a concentrator if you want the tunnel to be part of a hub and spoke VPN configuration If you use the procedure Adding
317. ng them To delete a user name from the internal database Go to User gt Local Select Delete User Jff for the user name that you want to delete 3 Select OK ue Note Deleting the user name deletes the authentication configured for the user FortiGate 800 Installation and Configuration Guide 225 Configuring RADIUS support Users and authentication Configuring RADIUS support If you have configured RADIUS support and a user is required to authenticate using a RADIUS server the FortiGate unit contacts the RADIUS server for authentication This section describes e Adding RADIUS servers e Deleting RADIUS servers Adding RADIUS servers To add a RADIUS server 1 Go to User gt RADIUS Select New to add a new RADIUS server Type the Name of the RADIUS server You can type any name The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Enter the Server Name or IP address of the RADIUS server Enter the RADIUS server secret Select OK Figure 53 Example RADIUS configuration Radius i Name Radius 1 Server Name IP 23 64 67 47 Server Secret Secret 1 Deleting RADIUS servers You cannot delete a RADIUS server that has been added to a user group To delete a RADIUS server 1 Go to User gt RADIUS Select Delete fj beside the RADIUS server name that you want to delete Select OK 226 F
318. nge until P1 and P2 keylife expires The keepalive frequency can be from 0 to 900 seconds 5 Optionally configure Dead Peer Detection Use these settings to monitor the status of the connection between VPN peers DPD allows dead connections to be cleaned up and new VPN tunnels established DPD is not supported by all vendors Enable Short Idle Retry Count Retry Interval Long Idle Select Enable to enable DPD between the local and remote peers Set the time in seconds that a link must remain unused before the local VPN peer considers it to be idle After this period of time expires whenever the local peer sends traffic to the remote VPN peer it also sends a DPD probe to determine the status of the link To control the length of time that the FortiGate unit takes to detect a dead peer with DPD probes configure the Retry Count and the Retry Interval Set the number of times that the local VPN peer retries the DPD probe before it considers the channel to be dead and tears down the security association SA To avoid false negatives because of congestion or other transient failures set the retry count to a sufficiently high value for your network Set the time in seconds that the local VPN peer unit waits between retrying DPD probes Set the time in seconds that a link must remain unused before the local VPN peer pro actively probes its state After this period of time expires the local peer sends a DPD probe to determine th
319. ngs and select OK Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None Press Enter to connect to the FortiGate CLI The following prompt is displayed FortiGate 800 login Type admin and press Enter twice The following prompt is displayed Type for a list of commands For information about how to use the CLI see the FortiGate CLI Reference Guide FortiGate 800 Installation and Configuration Guide 29 Factory default FortiGate configuration settings Getting started Factory default FortiGate configuration settings The FortiGate unit is shipped with a factory default configuration The default configuration allows you to connect to and use the FortiGate web based manager to configure the FortiGate unit onto the network To configure the FortiGate unit onto the network you add an administrator password change network interface IP addresses add DNS server IP addresses and configure routing if required If you plan to operate the FortiGate unit in Transparent mode you can switch to Transparent mode from the factory default configuration and then configure the FortiGate unit onto the network in Transparent mode Once the network configuration is complete you can perform additional configuration tasks such as setting system time configuring virus and attack definition updates and registering the FortiGate unit The factory default firewall configuration includes a single network address translation
320. nistratively up To start up an interface that is administratively down 1 Go to System gt Network gt Interface The interface list is displayed 2 Select Bring Up for the interface that you want to start To stop an interface that is administratively up 1 From the FortiGate CLI enter the command set system interface lt intf str gt config status down You can only stop an interface that is administratively up from the FortiGate command line interface CLI Adding an interface to a zone If you have added zones to the FortiGate unit you can use the following procedure to add an interface or VLAN subinterface to a zone You must delete any firewall addresses added to an interface or VLAN subinterface before adding the interface or VLAN subinterface to a zone For information about deleting addresses see Deleting addresses on page 199 When you add an interface or VLAN subinterface to a zone you cannot add firewall addresses to the interface or VLAN subinterface and the interface or VLAN subinterface does not appear on the policy grid FortiGate 800 Installation and Configuration Guide 139 Configuring interfaces Network configuration 140 To add an interface to a zone Go to System gt Network gt Interface Choose the interface or VLAN subinterface to add to a zone and select Modify 24 From the Belong to Zone list select the zone that you want to add the interface to The belong to zone list only appears
321. nit Internal External in NAT Route mode 192 168 1 1 204 23 1 5 Route mode policies Internet controlling traffic between NS internal networks _ Port 1 64 83 32 45 DMZ DMZ network 10 10 10 2 NAT mode policies controlling traffic between internal and external networks omen 10 10 10 23 Transparent mode In Transparent mode the FortiGate unit is invisible to the network Similar to a network bridge all FortiGate interfaces must be on the same subnet You only have to configure a management IP address so that you can make configuration changes The management IP address is also used for antivirus and attack definition updates You typically use the FortiGate unit in Transparent mode on a private network behind an existing firewall or behind a router The FortiGate unit performs firewall functions as well as antivirus and content scanning but not VPN FortiGate 800 Installation and Configuration Guide 37 Planning the FortiGate configuration Getting started 38 Figure 6 Example Transparent mode network configuration FortiGate 800 Unit Gateway to in Transparent mode public network 204 23 1 5 10 10 10 2 pate Dale Be OL Internet si Bo COCOA Steere S 10 10 10 3 lt firewall router External 10 10 10 1 Internal Management IP Transparent mode policies controlling traffic between internal and external networks You can connect up to 8 network segments to the
322. nnections to and through the interface To configure traffic filtering see Adding traffic filter entries on page 316 Record management and activity events in the event log Management events include changes to the system configuration as well as administrator and user logins and logouts Activity events include system activities such as VPN tunnel establishment and HA failover events Record virus intrusion events such as when the FortiGate unit detects a virus blocks a file type or blocks an oversized file or email Record activity events such as URL and content blocking and exemption of URLs from blocking Record attacks detected by the NIDS and prevented by the NIDS Prevention module Record activity events such as detection of email that contains unwanted content and email from unwanted senders Record log messages when the FortiGate connects to the FDN to download antivirus and attack updates 4 Select the message categories that you want the FortiGate unit to record if you selected Event Log Virus Log Web Filtering Log Attack Log Email Filter Log or Update in step 3 5 Select OK FortiGate 800 Installation and Configuration Guide 313 Configuring traffic logging Logging and reporting Figure 79 Example log filter configuration Log Setting l Traffic Log I Web Filtering Log l Event Log l Content block l When configuration has changed I URL block IPSec negotiation event M URL exempt I
323. nnel see AutolKE IPSec VPNs on page 235 2 Add the source address One source address is required for the local VPN spoke See Adding a source address on page 246 3 Add a destination address for each remote VPN spoke The destination address is the address of the spoke either a client on the Internet or a network located behind a gateway See Adding a destination address on page 247 4 Add a separate outbound encrypt policy for each remote VPN spoke These policies control the encrypted connections initiated by the local VPN spoke The encrypt policy must include the appropriate source and destination addresses and the tunnel added in step 1 Use the following configuration Source The local VPN spoke address Destination The remote VPN spoke address Action ENCRYPT VPN Tunnel i ies tunnel name added in step 1 Use the same tunnel for all encrypt policies Allow inbound Do not enable Allow outbound Select allow outbound Inbound NAT Select inbound NAT if required Outbound NAT Select outbound NAT if required See Adding an encrypt policy on page 247 5 Add an inbound encrypt policy This policy controls the encrypted connections initiated by the remote VPN spokes The encrypt policy for the hub must include the appropriate source and destination addresses and the tunnel added in step 1 Use the following configuration Source The local VPN spoke address Destination External_All 252 Fortinet
324. nstalled enter get system status Use the procedure Manually initiating antivirus and attack definitions updates on page 119 to update antivirus and attack definitions or from the CLI enter execute updatecenter updatenow To confirm that the antivirus and attack definitions are succesfully updated enter the following command to display the antivirus engine virus and attack definitions version contract expiry and last update attempt information get system objver Reverting to a previous firmware version Use the following procedures to revert your FortiGate unit to a previous firmware version Reverting to a previous firmware version using the web based manager The following procedures revert the FortiGate unit to its factory default configuration and delete NIDS user defined signatures web content lists email filtering lists and changes to replacement messages Before beginning this procedure you can e Back up the FortiGate unit configuration For information see Backing up system settings on page 108 e Back up the NIDS user defined signatures For information see the FortiGate NIDS Guide e Back up web content and email filtering lists For information see the FortiGate Content Protection Guide Fortinet Inc System status Changing the FortiGate firmware If you are reverting to a previous FortiOS version for example reverting from FortiOS v2 50 to FortiOS v2 36 you might not be able to restore
325. nt computer Select the administrative access methods for each interface HTTPS To allow secure HTTPS connections to the web based manager through this interface PING If you want this interface to respond to pings Use this setting to verify your installation and for testing HTTP To allow HTTP connections to the web based manager through this interface HTTP connections are not secure and can be intercepted by a third party SSH To allow SSH connections to the CLI through this interface SNMP To allow a remote SNMP manager to request SNMP information by connecting to this interface See Configuring SNMP on page 173 TELNET To allow Telnet connections to the CLI through this interface Telnet connections are not secure and can be intercepted by a third party Select Log for each interface that you want to record log messages whenever a firewall policy accepts a connection to this interface Select Apply to save the changes VLAN overview FortiGate units support IEEE 802 1Q Virtual LAN VLAN technology A VLAN is group of PCs servers and other network devices that communicate as if they were on the same LAN segment even though they may not be For example the workstations and servers for an accounting department could be scattered throughout an office connected to numerous network segments but they can still belong to the same VLAN A VLAN segregates devices logically instead of physically Each VLAN is treated as a
326. nt for the algorithm a management system to control the key IPSec provides two ways to handle key exchange and management e Manual Keys e Automatic Internet Key Exchange AutoIKE with pre shared keys or certificates When using manual keys matching security settings must be entered at both ends of the tunnel These settings which include both the encryption and authentication keys must be kept secret so that unauthorized parties cannot decrypt the data even if they know which encryption algorithm is being used Automatic Internet Key Exchange AutolKE with pre shared keys or certificates For using multiple tunnels an automated system of key management is required IPSec supports the automated generation and negotiation of keys using the Internet Key Exchange protocol This method of key management is referred to as AutolKE Fortinet supports AutolKE with pre shared keys and AutolKE with certificates AutolKE with pre shared keys If both peers in a session are configured with the same pre shared key they can use it to authenticate themselves to each other The peers do not send the key to each other Instead as part of the security negotiation process they use it in combination with a Diffie Hellman group to create a session key The session key is used for encryption and authentication and is automatically regenerated by IKE during the communication session Pre shared keys are similar to manual keys in that they require the
327. nteed You can use traffic shaping to guarantee the amount of bandwidth available Bandwidth through the firewall for a policy Guarantee bandwidth in Kbytes to make sure that there is enough bandwidth available for a high priority service Fortinet Inc Firewall configuration Adding firewall policies Maximum You can also use traffic shaping to limit the amount of bandwidth available Bandwidth through the firewall for a policy Limit bandwidth to keep less important services from using bandwidth needed for more important services Traffic Priority Select High Medium or Low Select Traffic Priority so that the FortiGate unit manages the relative priorities of different types of traffic For example a policy for connecting to a secure web server needed to support e commerce traffic should be assigned a high traffic priority Less important services should be assigned a low priority The firewall provides bandwidth to low priority connections only when bandwidth is not needed for high priority connections Authentication Select Authentication and select a user group to require users to enter a user name and password before the firewall accepts the connection Select the user group to control the users that can authenticate with this policy For information about adding and configuring user groups see Configuring user groups on page 229 You must add user groups before you can select Authentication You can select Authentication fo
328. nterface to the external interface If these VLAN subinterfaces have the same VLAN IDs the FortiGate unit applies firewall policies to the traffic on this VLAN If these VLAN subinterfaces have different VLAN IDs or if you add more than two VLAN subinterfaces to the virtual domain you can also use firewall policies to control connections between VLANs When the FortiGate unit receives a VLAN tagged packet at an interface the packet is directed to the VLAN subinterface with matching VLAN ID The VLAN subinterface removes the VLAN tag and assigns a destination interface to the packet based on its destination MAC address The firewall policies for this source and destination VLAN subinterface pair are applied to the packet If the packet is accepted by the firewall the FortiGate unit forwards the packet to the destination VLAN subinterface The destination VLAN ID is added to the packet and it is sent to the VLAN trunk When a packet enters a virtual domain on the FortiGate unit it is confined to that virtual domain In a given domain you can only create firewall policies for connections between VLAN subinterfaces or zones in the virtual domain The packet never crosses the virtual domain border The FortiGate 800 supports 64 virtual domains e Virtual domain properties e Configuring a virtual domain e Adding firewall policies for virtual domains e Deleting virtual domains Figure 31 FortiGate unit with two virtual domains VLAN Switch or
329. ntivirus protection and full scan content filtering FortiGate Antivirus Firewalls improve network security reduce network misuse and abuse and help you use communications resources more efficiently without compromising the performance of your network FortiGate Antivirus Firewalls are CSA certified for firewall IPSec and antivirus services The FortiGate Antivirus Firewall is a dedicated easily managed security device that delivers a full suite of capabilities that include e application level services such as virus protection and content filtering e network level services such as firewall intrusion detection VPN and traffic shaping The FortiGate Antivirus Firewall uses Fortinet s Accelerated Behavior and Content Analysis System ABACAS technology which leverages breakthroughs in chip design networking security and content analysis The unique ASIC based architecture analyzes content and behavior in real time enabling key applications to be deployed right at the network edge where they are most effective at protecting your networks The FortiGate series complements existing solutions such as host based antivirus protection and enables new applications and services while greatly lowering costs for equipment administration and maintenance The FortiGate 800 model provides the levels of performance reliability and flexibility demanded by large enterprises With high throughput a total of 8 network connections 4 user
330. ntteeducranteaee 84 Synchronizing the cluster configuration cceceeeeeeeee eee eeeee eee ee eeteeeeeeeaeeeeeetnaeeeeenees 85 Upgrading MWA yw icc sits axetees teceaedens heed i tin eeacdeb ited i tedelec tia eect etait 86 Replacing a FortiGate unit after failover ccc eee crete reese eenneeeeeeetieeeeeetiteeeeeteea 87 Advanced HA Optlons nanena A alvin eee eae headed 87 Selecting a FortiGate unit as a permanent primary Unit ceeeeeeeeeeeeeeeeettteeeeeeees 87 Configuring the priority of each FortiGate unit in the cluster c eeeeseeceeeeeeeeeees 88 Configuring weighted round robin weights ceeeeeeeeeeeeee eee tecteeeeeetaeeeeeeetnaeeeeeee 88 Active Active cluster packet flOW cec ceeeccecceeeeeeeeeeeteeseceaeaaecaeceeeeeeeeeeeeteseenennsanaeeees 89 NAT Route mode packet flow c ccccccecceceeeeeeeeeeeceneeaaeeeceeeeeeeeeeeeseesenaaaeseeeeeeeeeeess 90 Configuring switches to work with a NAT Route mode cluster 0 e ceeeeeeeeeees 90 Transparent mode packet flow ccc ceeeeeeeceeceeeeeeeeeeeseecnaaecaecaeeeeeeeeeeetetenesncniaeeees 91 System STATUS va sinrinncvvnsssvassessssexqeavsctoeccdesspescecnenaudacsdubovernsepenvedeciueansuaupeansuepeacenantes 93 Changing the FortiGate host NAME ceeeeeeeeeeeee eee eeeeeee eee teeeeeeeeeseeeeeeeeeteeeeaeeeeseeenaeeees 94 Changing the FortiGate firmware ccccccccceeeescccceeeeecceneeeneceaenenendencene
331. o to Anti Virus gt Quarantine gt Quarantine Config For each traffic protocol select the applicable Quarantine Infected Files and Quarantine Blocked Files check boxes The FortiGate unit quarantines infected and blocked files for the selected traffic FortiGate 800 Installation and Configuration Guide 285 Blocking oversized files and emails Antivirus protection gt 3 Note The Quarantine Blocked Files option is not available for HTTP or FTP because a filename is blocked at request time and the file is not downloaded to the FortiGate unit Type the Age Limit TTL in hours to specify how long files are left in quarantine The maximum number of hours is 480 The FortiGate unit automatically deletes a file when the TTL reaches 00 00 Type the maximum file size in MB to quarantine The FortiGate unit keeps the existing quarantined files that are larger than the file size limit The FortiGate unit does not quarantine new files that are larger than the file size limit The file size range is 1 499 MBytes Enter 0 for unlimited file size Select a Low Disk Space option to specify the method for handling additional files when the FortiGate hard disk is running out of disk space You can select overwrite oldest file or drop new quarantine files Select Apply Blocking oversized files and emails 286 You can configure the FortiGate unit to buffer 1 to 15 percent of available memory to store oversized files and email The For
332. o to Web Filter gt URL Exempt Select Download URL Exempt List Ese The FortiGate unit downloads the list to a text file on the management computer You can specify a location to which to download the text file as well as a name for the text file Uploading a URL Exempt List e ae You can create a URL Exempt list in a text editor and then upload the text file to the FortiGate unit Add one URL or pattern to each line of the text file The word or phrase should be followed by a parameter specifying the status of the entry If you do not add this information to the text file the FortiGate unit automatically enables all URLs and patterns that are followed with a 1 or no number when you upload the text file Table 42 URL Exempt list configuration parameters Parameter Setting Description Status 0 Disabled 1 Enabled Figure 76 Example URL Emempt list text file www goodsite com 1 www goodsite com index 1 127 33 44 55 1 Note All changes made to the URL block list using the web based manager are lost when you upload a new list However you can download your current URL block list add more items to it using a text editor and then upload the edited list to the FortiGate unit In a text editor create the list of URLs to exempt Using the web based manager go to Web Filter gt URL Exempt FortiGate 800 Installation and Configuration Guide 301 Exempt URL list Web filtering Select Upload
333. oE or if the remote VPN peer has a static IP address that is not required in the peer identification process select Dialup User Depending on the Remote Gateway address type you selected other fields become available Remote Gateway Static IP Address IP Address If you select Static IP Address the IP Address field appears Enter the IP address of the remote IPSec VPN gateway or client that can connect to the FortiGate unit This is a mandatory entry Remote Gateway Dialup User Peer Options If you select Dialup User the Peer Options become available under Advanced Options Use the Peer Options to authenticate remote VPN peers with peer IDs during phase 1 negotiations Select Aggressive or Main ID Protection mode When using aggressive mode the VPN peers exchange identifying information in the clear When using main mode identifying information is hidden The VPN peers must use the same mode Configure the P1 Proposal Select up to three encryption and authentication algorithm combinations to propose for phase 1 The VPN peers must use the same P1 proposal settings Select the DH Group s Select one or more Diffie Hellman groups to propose for phase 1 As a general rule the VPN peers should use the same DH Group settings Enter the Keylife The keylife is the amount of time in seconds before the phase 1 encryption key expires When the key expires a new key is generated without interrupting service P1 propos
334. of the user computers You can enter the IP address of a single user For example 192 168 100 19 255 255 255 255 You can also enter a subnet of a group of users For example 192 168 100 0 255 255 255 0 5 Enter an alias for the user The alias is used as the user name when you add the user to a user group on the Cerberian server If you do not enter an alias the user s IP is used and added to the default group on the Cerberian server 6 Select OK Configuring Cerberian web filter After you add the Cerberian web filter users on the FortiGate unit you can add these users to the user groups on the Cerberian web filter server Then you can create policies and apply these policies to the user groups About the default group and policy There is a default user group which is associated with a default policy that exists on the Cerberian web filter server FortiGate 800 Installation and Configuration Guide 297 Configuring Cerberian URL filtering Web filtering You can add users to the default group and apply any policies to the group Use the default group to add e All the users who are not assigned alias names on the FortiGate unit e All the users who are not assigned to other user groups The Cerberian web filter groups URLs into 53 categories The default policy blocks the URLs of 12 categories You can modify the default policy and apply it to any user groups To configure Cerberian web filtering 1 Add the user name w
335. olKE IPSec VPNs AutolKE IPSec VPNs FortiGate units support two methods of Automatic Internet Key Exchange AutolKE for establishing IPSec VPN tunnels AutolKE with pre shared keys and AutolKE with digital certificates e General configuration steps for an AutolIKE VPN e Adding a phase 1 configuration for an AutolKE VPN e Adding a phase 2 configuration for an AutolKE VPN General configuration steps for an AutolIKE VPN Je S An AutolKE VPN configuration consists of phase 1 and phase 2 configuration parameters the source and destination addresses for both ends of the tunnel and an encrypt policy to control access to the VPN tunnel To create an AutolKE VPN configuration Note Prior to configuring an AutolKE VPN that uses digital certificates you must add the CA and local certificates to the FortiGate unit For information about digital certificates see Managing digital certificates on page 242 Add the phase 1 parameters See Adding a phase 1 configuration for an AutolKE VPN on page 235 Add the phase 2 parameters See Adding a phase 2 configuration for an AutolKE VPN on page 240 Configure an encrypt policy that includes the tunnel source address and destination address for both ends of the tunnel See Configuring encrypt policies on page 245 Adding a phase 1 configuration for an AutolIKE VPN When you add a phase 1 configuration you define the terms by which the FortiGate unit and a remote VPN
336. omatically In some situations you might want to control which unit becomes the primary unit You can select a FortiGate unit as the permanent primary unit by changing its priority and configuring it to override any other primary unit To select a permanent primary unit 1 Connect to the CLI of the FortiGate unit that you want to become the permanent primary unit 2 Set the priority of the permanent primary unit Enter set system ha priority lt priority int gt Where lt priority int gt is the priority to set for the permanent primary unit The unit with the lowest priority becomes the primary unit The default priority is 128 Set the priority of the permanent primary unit to a number lower than 128 For example to set the priority of the permanent primary unit to 10 enter the command set system ha priority 10 3 Make sure that the priority of all the other units in the cluster is higher than the priority of the permanent primary unit The command get system ha mode displays the current priority of the FortiGate unit that you are connected to 4 Configure the permanent primary unit to override an existing primary unit when it joins the cluster Use the following command to configure primary unit override FortiGate 800 Installation and Configuration Guide 87 Advanced HA options High availability set system ha overrid nabl Enable override so that the permanent primary unit overrides any other primary unit For example i
337. on Accept NAT Select NAT Select OK to save the changes Adding more firewall policies In most cases your firewall configuration includes more than the default policy However the basic premise of creating redundant policies applies even as the firewall configuration becomes more complex To configure the FortiGate unit to use multiple Internet connections you must add duplicate policies for connections between the internal network and both interfaces connected to the Internet As well as you add redundant policies you must arrange them in both policy lists in the same order Fortinet Inc NAT Route mode installation Configuration example Multiple connections to the Internet Restricting access to a single Internet connection In some cases you might want to limit some traffic to being able to use only one Internet connection For example in the topology shown in Figure 9 on page 51 the organization might want its mail server to be able to connect to only the SMTP mail server of ISP1 To do this you add a single Internal gt External firewall policy for SMTP connections Because redundant policies have not been added SMTP traffic from the Internet network is always connected to ISP1 If the connection to ISP1 fails the SMTP connection is not available FortiGate 800 Installation and Configuration Guide 57 Configuration example Multiple connections to the Internet NAT Route mode installation 58 Fortinet Inc RAT MET Trans
338. on Guide 111 System status System status Figure 19 CPU and memory status monitor Automatic Refresh Interval 5 seconds 7 CPU amp Memory Sessions amp Network Virus amp Intrusions CPU Usage CPU Usage History LJ EE last 1 min Memory Usage Memory Usage History LJ Ferrer eereeee last 1 min Viewing sessions and network status 112 Use the session and network status display to track how many network sessions the FortiGate unit is processing and to see what effect the number of sessions has on the available network bandwidth Also by comparing CPU and memory usage with session and network status you can see how much demand network traffic is putting on system resources The Sessions section displays the total number of sessions being processed by the FortiGate unit on all interfaces It also displays the sessions as a percentage of the maximum number of sessions that the FortiGate unit is designed to support The Network utilization section displays the total network bandwidth being used through all FortiGate interfaces It also displays network utilization as a percentage of the maximum network bandwidth that can be processed by the FortiGate unit To view sessions and network status Go to System gt Status gt Monitor Select Sessions amp Network Sessions and network status is displayed The display includes bar graphs of the current number of sessions and current network utilization as
339. onfiguration Cluster synchronization keeps all units in the cluster synchronized with the master unit This includes e System configuration e Virus definition updates e Attack definition updates e Web filter lists e Email filter lists e Replacement messages e CA certificates e Local certificates Synchronization with all cluster members occurs in real time as the administrator changes or adds configuration settings to the primary unit When the primary unit downloads antivirus or attack definition updates all cluster members also receive these updates From each subordinate unit you can also use the execute ha synchronize command to manually synchronize its configuration with the primary unit Using this command you can synchronize the following Table 17 execute ha synchronize keywords Keyword Description config Synchronize the FortiGate configuration This includes normal system configuration firewall configuration VPN configuration and so on stored in the FortiGate configuration file avupd Synchronize the antivirus engine and antivirus definitions received by the primary unit from the FortiResponse Distribution Network FDN attackdef Synchronize NIDS attack definition updates received by the primary unit from the FDN weblists Synchronize web filter lists added to or changed on the primary unit emaillists Synchronize email filter lists added to or changed on the primary unit resms
340. onizing a tcp 123 computer s time with a time server OSPF Open Shortest Path First OSPF routing 89 protocol OSPF is a common link state routing protocol PC Anywhere PC Anywhere is a remote control and file udp 5632 transfer protocol PING ICMP echo request reply for testing icmp 8 connections to other devices TIMESTAMP ICMP timestamp request messages icmp 13 INFO_REQUEST ICMP information request messages icmp 15 INFO_ADDRESS ICMP address mask request messages icmp 17 POP3 Post office protocol email protocol for tcp 110 downloading email from a POPS server PPTP Point to Point Tunneling Protocol is a tcp 1723 protocol that allows corporations to extend their own corporate network through private tunnels over the public Internet QUAKE For connections used by the popular Quake udp 26000 multi player computer game 27000 27910 27960 RAUDIO For streaming real audio multimedia traffic udp 7070 RLOGIN Rlogin service for remotely logging into a tcp 513 server RIP Routing Information Protocol is a common udp 520 distance vector routing protocol SMTP For sending mail between email servers on tcp 25 the Internet SNMP Simple Network Management Protocol is a tcp 161 162 pe ieee for managing complex udp 161 162 SSH SSH service for secure connections to tcp 22 computers for remote management udp 22 SYSLOG Syslog service for remote logging udp 514 TALK A protocol supporting conversations between udp 517 518 two or more use
341. ontrol how often the web based manager updates the display More frequent updates use system resources and increase network traffic However this only occurs when you are viewing the display using the web based manager The line graph scales are shown on the upper right corner of the graph Select Refresh to manually update the information displayed FortiGate 800 Installation and Configuration Guide 113 Session list Session list 114 System status Figure 21 Sessions and network status monitor Automatic Refresh Interval 20 seconds 7 CPU amp Memory Sessions amp Network Virus amp Intrusions Virus Virus History LJ P last 20 hours Intrusions Intrusion History LJ PE last 20 hours The session list displays information about the communications sessions currently being processed by the FortiGate unit You can use the session list to view current sessions FortiGate administrators with read and write permission and the FortiGate admin user can also stop active communication sessions To view the session list Go to System gt Status gt Session The web based manager displays the total number of active sessions in the FortiGate unit session table and lists the top 16 To navigate the list of sessions select Page Up PA or Page Down Select Refresh A to update the session list If you are logged in as an administrative user with read and write privileges or as the admin user you
342. or your SNMP manager to receive traps from the FortiGate SNMP agent For more information about FortiGate traps see FortiGate traps on page 177 fortinet mib The Fortinet MIB is a proprietary MIB that includes detailed FortiGate system configuration information Add this MIB to your SNMP manager to monitor all FortiGate configuration settings RFC 1213 MIB Il The FortiGate SNMP agent supports MIB II groups with the following exceptions No support for the EGP group from MIB II RFC 1213 section 3 11 and 6 10 Protocol statistics returned for MIB II groups IP ICMP TCP UDP etc do not accurately capture all FortiGate traffic activity More accurate infor mation can be obtained from the information reported by the Fortinet MIB RFC 2665 Ethernet like MIB The FortiGate SNMP agent supports Ethernet like MIB information with the following exception No support for the dot3Tests and dot3Errors groups 176 Fortinet Inc System configuration Configuring SNMP FortiGate traps The FortiGate agent can send traps to up to three SNMP trap receivers on your network that are configured to receive traps from the FortiGate unit For these SNMP managers to receive traps you must load and compile the Fortinet trap MIB onto the SNMP manager General FortiGate traps Table 21 General FortiGate traps Trap message Description Cold Start The FortiGate unit starts or restarts An ad
343. ormally the FortiGate unit internal interface connects to a VLAN trunk on an internal switch and the external interface connects to an upstream Internet router untagged The FortiGate unit can then apply different policies for traffic on each VLAN that connects to the internal interface In this configuration you add VLAN subinterfaces to the FortiGate internal interface that have VLAN IDs that match the VLAN IDs of packets in the VLAN trunk The FortiGate unit directs packets with VLAN IDs to subinterfaces with matching VLAN IDs You can also define VLAN subinterfaces on all FortiGate interfaces The FortiGate unit can add VLAN tags to packets leaving a VLAN subinterface or remove VLAN tags from incoming packets and add different VLAN tags to outgoing packets Rules for VLAN IDs Two VLAN subinterfaces added to the same physical interface cannot have the same VLAN ID However you can add two or more VLAN subinterfaces with the same VLAN IDs to different physical interfaces There is no internal connection or link between two VLAN subinterfaces with same VLAN ID Their relationship is the same as the relationship between any two FortiGate network interfaces Rules for VLAN IP addresses e gt IP addresses of all FortiGate interfaces cannot overlap That is the IP addresses of all interfaces must be on different subnets This rule applies to both physical interfaces and to VLAN subinterfaces Note You can enter the CLI command se
344. ortiGate unit is to running at full capacity The web based manager displays CPU and memory usage for core processes only CPU and memory use for management processes for example for HTTPS connections to the web based manager is excluded If CPU and memory use is low the FortiGate unit is able to process much more network traffic than is currently running If CPU and memory use is high the FortiGate unit is performing near its full capacity Putting additional demands on the system might cause traffic processing delays CPU and memory intensive processes such as encrypting and decrypting IPSec VPN traffic virus scanning and processing high levels of network traffic containing small packets increase CPU and memory usage To view CPU and memory status 1 Go to System gt Status gt Monitor CPU amp Memory status is displayed The display includes bar graphs of current CPU and memory usage as well as line graphs of CPU and memory usage for the previous minute If your FortiGate unit contains a hard disk CPU memory and hard disk status are displayed 2 Set the automatic refresh interval and select Go to control how often the web based manager updates the display More frequent updates use system resources and increase network traffic However this occurs only when you are viewing the display using the web based manager 3 Select Refresh to manually update the information displayed FortiGate 800 Installation and Configurati
345. ortinet Inc Users and authentication Configuring LDAP support Configuring LDAP support If you have configured LDAP support and a user is required to authenticate using an LDAP server the FortiGate unit contacts the LDAP server for authentication To authenticate with the FortiGate unit the user enters a user name and password The FortiGate unit sends this user name and password to the LDAP server If the LDAP server can authenticate the user the user is successfully authenticated with the FortiGate unit If the LDAP server cannot authenticate the user the connection is refused by the FortiGate unit The FortiGate unit supports LDAP protocol functionality defined in RFC2251 for looking up and validating user names and passwords ForitGate LDAP supports all LDAP servers compliant with LDAP v3 FortiGate LDAP support does not extend to proprietary functionality such as notification of password expiration that is available from some LDAP servers FortiGate LDAP support does not supply information to the user about why authentication failed LDAP user authentication is supported for PPTP L2TP IPSec VPN and firewall authentication With PPTP L2TP and IPSec VPN PAP packet authentication protocol is supported and CHAP Challenge Handshake Authentication Protocol is not This section describes e Adding LDAP servers e Deleting LDAP servers Adding LDAP servers To add an LDAP server 1 Go to User gt LDAP Select New to add
346. otocol FGCP Each FortiGate unit in an HA cluster uses the same overall security policy and shares the same configuration settings You can add up to 32 FortiGate units to an HA cluster Each FortiGate unit in an HA cluster must be the same model and must run the same FortiOS firmware image FortiGate HA is device redundant If one of the FortiGate units in an HA cluster fails all functions all established firewall connections and all IPSec VPN sessions are maintained by the other FortiGate units in the HA cluster You manage the cluster by connecting to the cluster web based manager from any cluster interface configured for HTTPS administrative access You can also manage the cluster by connecting to the cluster CLI from any cluster interface configured for SSH administrative access All configuration changes made to the cluster are automatically synchronized to all cluster members From the web based manager you can monitor the status and log messages of the cluster and of each of the FortiGate units in the cluster You can also monitor the cluster by using an SNMP manager to get SNMP information from or receive traps for any cluster interface configured for SNMP administrative access The FortiGate units in the cluster use dedicated HA ethernet interfaces to communicate cluster session information synchronize the cluster configuration and report individual system status The units in the cluster constantly communicate HA status informatio
347. oup that includes these services To add a content profile to a policy 1 Go to Firewall gt Policy 2 Select a policy list that contains policies that you want to add a content profile to For example to enable network protection for files downloaded by internal network users from the web select an internal to external policy list Select New to add a new policy or choose a policy and select Edit E Select the Anti Virus amp Web filter check box Select a content profile from the list Configure the remaining policy settings if required Select OK Repeat this procedure for any policies that you want to enable network protection for Oo N Oo a Re W FortiGate 800 Installation and Configuration Guide 221 Content profiles Firewall configuration 222 Fortinet Inc AT MET Users and authentication FortiGate units support user authentication to the FortiGate user database a RADIUS server and an LDAP server You can add user names to the FortiGate user database and then add a password to allow the user to authenticate using the internal database You can also add the names of RADIUS and LDAP servers You can select RADIUS to allow the user to authenticate using the selected RADIUS server or LDAP to allow the user to authenticate using the selected LDAP server You can disable a user name so that the user cannot authenticate To enable authentication you must add user names to one or more user groups You can also add
348. ownload updates This section describes e Enabling push updates e Push updates when FortiGate IP addresses change Enabling push updates through a NAT device Enabling push updates To enable push updates 1 Go to System gt Update Select Allow Push Update Select Apply Push updates when FortiGate IP addresses change The SETUP message that the FortiGate unit sends when you enable push updates includes the IP address of the FortiGate interface that the FDN connects to If your FortiGate unit is running in NAT Route mode the SETUP message includes the FortiGate external IP address If your FortiGate unit is running in Transparent mode the SETUP message includes the FortiGate management IP address The FDN must be able to connect to this IP address for your FortiGate unit to be able to receive push update messages If your FortiGate unit is behind a NAT device see Enabling push updates through a NAT device on page 124 Whenever the external IP address of the FortiGate unit changes the FortiGate unit sends a new SETUP message to notify the FDN of the address change As long as the FortiGate unit sends this SETUP message and the FDN receives it the FDN can maintain the most up to date external IP address for the FortiGate unit The FortiGate unit sends the SETUP message if you change the external IP address manually or if you have set the external interface addressing mode to DHCP or PPPoE and your DHCP or PPPoE server change
349. parent mode installation This chapter describes how to install your FortiGate unit in Transparent mode If you want to install the FortiGate unit in NAT Route mode see NAT Route mode installation on page 41 If you want to install two or more FortiGate units in HA mode see High availability on page 73 This chapter describes Preparing to configure Transparent mode Using the setup wizard Using the front control buttons and LCD Using the command line interface Completing the configuration Connecting the FortiGate unit to your networks Transparent mode configuration examples Preparing to configure Transparent mode Use Table 16 to gather the information that you need to customize Transparent mode settings Table 16 Transparent mode settings Administrator Password Management IP IP Netmask Default Gateway The management IP address and netmask must be valid for the network from which you will manage the FortiGate unit Add a default gateway if the FortiGate unit must connect to a router to reach the management computer DNS Settings Primary DNS Server Secondary DNS Server FortiGate 800 Installation and Configuration Guide 59 Using the setup wizard Transparent mode installation Using the setup wizard From the web based manager you can use the setup wizard to begin the initial configuration of the FortiGate unit For information about con
350. pdates The default is 30 seconds The time interval in seconds after which a route is declared invalid Invalid should be at least three times the value of Update During the invalid interval after the first update is missed and before the invalid timer expires the route is marked inaccessible and advertised as unreachable however the route is still used for forwarding packets The invalid interval allows for the loss of one or more update packets before RIP considers the route unusable If RIP receives an update for a route before the invalid timer expires it resets the invalid timer to 0 The default for Invalid is 180 seconds The time interval in seconds during which RIP ignores routing information for a route Holddown should be at least three times the value Update A route enters the holddown state when RIP receives an update packet indicating that a route is unreachable or when the invalid timer for the route expires The holddown interval allows time for bad routing information to clear the network during network convergence The route is marked inaccessible and advertised as unreachable and is no longer used for forwarding packets The default for Holddown is 180 seconds The time in seconds that must elapse after the last update for a route before RIP removes the route from the routing table Flush should be greater than the value of Invalid to allow the route to go into the holddown state The default for Flush is 240 seconds
351. pe the IP addresses of up to three trap receivers on your network that Addresses are configured to receive traps from your FortiGate unit Traps are only sent to the configured addresses 4 Select Apply FortiGate 800 Installation and Configuration Guide 175 Configuring SNMP System configuration Figure 37 Sample SNMP configuration Enable SNMP System Name System Location Contact Information Phone 555 1234 Get Community Trap Community First Trap Receiver IP Address 192 168 100 3 Second Trap Receiver IP Address 192 168 23 7 Third Trap Receiver IP Address 54 67 23 45 FortiGate MIBs IV jF ortigate Server Room Jour_get_com four_trap_com The FortiGate SNMP agent supports FortiGate proprietary MIBs as well as standard RFC 1213 and RFC 2665 MIBs The FortiGate MIBs are listed in Table 20 You can obtain these MIB files from Fortinet technical support To be able to communicate with the SNMP agent you must compile all of these MIBs into your SNMP manager Your SNMP manager might already include standard and private MIBs in a compiled database that is ready to use You must add the Fortinet proprietary MIBs to this database If the standard MIBs used by the Fortinet SNMP agent are already compiled into your SNMP manager you do not have to compile them again Table 20 FortiGate MIBs MIB file name or RFC Description fortinet trap mib The Fortinet trap MIB is a proprietary MIB that is required f
352. peer gateway or client authenticate themselves to each other prior to establishing an IPSec VPN tunnel The phase 1 configuration is related to the phase 2 configuration In phase 1 the VPN peers are authenticated in phase 2 the tunnel is established You have the option to use the same phase 1 parameters to establish multiple tunnels In other words the same remote VPN peer gateway or client can have multiple tunnels to the local VPN peer the FortiGate unit When the FortiGate unit receives an IPSec VPN connection request it authenticates the VPN peers according to the phase 1 parameters Then depending on the source and destination addresses of the request it starts an IPSec VPN tunnel and applies an encrypt policy To add a phase 1 configuration Go to VPN gt IPSEC gt Phase 1 Select New to add a new phase 1 configuration FortiGate 800 Installation and Configuration Guide 235 AutolKE IPSec VPNs 236 IPSec VPN Type a Gateway Name for the remote VPN peer The remote VPN peer can be either a gateway to another network or an individual client on the Internet The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select a Remote Gateway address type If the remote VPN peer has a static IP address select Static IP Address Ifthe remote VPN peer has a dynamically assigned IP address DHCP or PPP
353. popular operating systems e L2TP for easy connectivity with a more secure VPN standard also supported by many popular operating systems e Firewall policy based control of IPSec VPN traffic e IPSec NAT traversal so that remote IPSec VPN gateways or clients behind a NAT can connect to an IPSec VPN tunnel VPN hub and spoke using a VPN concentrator to allow VPN traffic to pass from one tunnel to another through the FortiGate unit IPSec Redundancy to create a redundant AutolIKE key IPSec VPN connection to a remote network High availability High Availability HA provides failover between two or more FortiGate units Fortinet achieves HA by using redundant hardware matching FortiGate models running in NAT Route mode You can configure the FortiGate units for either active passive A P or active active A A HA Both A P and A A HA use similar redundant hardware configurations High availability software guarantees that if one of the FortiGate units in the HA group fails all functions established firewall connections and IPSec VPN sessions are maintained FortiGate 800 Installation and Configuration Guide 19 Secure installation configuration and management Introduction Secure installation configuration and management The first time you power on the FortiGate unit it is already configured with default IP addresses and security policies Connect to the web based manager set the operating mode and use the Setup wizard to cu
354. port Login Enter your Fortinet support user name and password Select Login a Fk WO N Select View Products The list of FortiGate products that you have registered is displayed For each FortiGate unit the list includes the serial number and current support options for that unit 132 Fortinet Inc Virus and attack definitions updates and registration Updating registration information Figure 29 Sample list of registered FortiGate units View Product Support Serial Number FGT 602803030020 Support Type Hours Activation Date Expiration Date Hardware Coverage 5 12 2003 5 11 2004 Firmware Updates 5 12 2003 8 10 2003 Telephone Support 5 12 2003 8 10 2003 Virus Definitions Updates 5 12 2003 8 10 2003 Attack Definitions Updates 5 12 2003 8 10 2003 Serial Number FGT1002801021024 Support Type Hours Activation Date Expiration Date Hardware Coverage 5 7 2003 5 6 2004 Firmware Updates 5 7 2003 8 5 2003 Telephone Support 5 7 2003 8 5 2003 Virus Definitions Updates 5 7 2003 8 5 2003 Attack Definitions Updates 5 7 2003 8 5 2003 Registering a new FortiGate unit oN Oa fF WwW DY To register a new FortiGate unit Go to System gt Update gt Support Select Support Login Enter your Fortinet support user name and password Select Login Select Add Registration Select the model number of the product model that you want to register Enter the serial number of the FortiGate unit If you have
355. pport Contract you must register the FortiGate unit and add the FortiCare Support Contract number to the registration information You can also register the FortiGate unit without purchasing a FortiCare Support Contract In that case when you purchase a FortiCare Support Contract you can update the registration information to add the support contract number A single FortiCare Support Contract can cover multiple FortiGate units You must enter the same service contract number for each of the FortiGate models covered by the service contract FortiGate 800 Installation and Configuration Guide 129 Registering FortiGate units Virus and attack definitions updates and registration Registering the FortiGate unit Before registering a FortiGate unit you require the following information e Your contact information including e First and last name Company name e Email address Your Fortinet support login user name and password will be sent to this email address e Address e Contact phone number e A security question and an answer to the security question This information is used for password recovery The security question should be a simple question that only you know the answer to The answer should not be easy to guess e The product model and serial number for each FortiGate unit that you want to register The serial number is located on a label on the bottom of the FortiGate unit You can view the Serial number from the web base
356. ptions HTTP FTP IMAP POP3 SMTP Antivirus Scan O Oo O O m File Block O O O o o Quarantine O O oO m o Web URL Block O Web Content Block O Web Script Filter O Web Exempt List MV Email Block List O O m Email Exempt List l A Email Content Block O Oo Oversized File Email Block pass pass pass pass pass Pass Fragmented Emails Mw MV MV 35 Planning the FortiGate configuration Getting started Planning the FortiGate configuration Before you configure the FortiGate unit you need to plan how to integrate the unit into the network Among other things you must decide whether you want the unit to be visible to the network which firewall functions you want it to provide and how you want it to control the traffic flowing between its interfaces Your configuration plan depends on the operating mode that you select The FortiGate unit can be configured in one of two modes NAT Route mode the default or Transparent mode NAT Route mode In NAT Route mode the unit is visible to the network Like a router all its interfaces are on different subnets The following interfaces are available in NAT Route mode e External is the interface to the external network usually the Internet Internal is the interface to the internal network e DMZ is the interface to the DMZ network HA is the interface used to connect to other FortiGate 500s if you are installing an HA cluster Interfaces 1 to 4 can be connected to other networks
357. r any service Users can authenticate with the firewall using HTTP Telnet or FTP For users to be able to authenticate you must add an HTTP Telnet or FTP policy that is configured for authentication When users attempt to connect through the firewall using this policy they are prompted to enter a firewall username and password If you want users to authenticate to use other services for example POP3 or IMAP you can create a service group that includes the services for which you want to require authentication as well as HTTP Telnet and FTP Then users could authenticate with the policy using HTTP Telnet or FTP before using the other service In most cases you should make sure that users can use DNS through the firewall without authentication If DNS is not available users cannot connect to a web FTP or Telnet server using a domain name Anti Virus amp Web filter Enable antivirus protection and web filter content filtering for traffic controlled by this policy You can select Anti Virus amp Web filter if Service is set to ANY HTTP SMTP POP3 IMAP or FTP or to a service group that includes the HTTP SMTP POP3 IMAP or FTP services Select a content profile to configure how antivirus protection and content filtering is applied to the policy For information about selecting a content profile see Content profiles on page 218 FortiGate 800 Installation and Configuration Guide 193 Adding firewall policies Firewall conf
358. r each cluster unit includes the unit serial number and host name of the unit Complete the command with the number of the subordinate unit to log into For example to log into subordinate unit 1 enter the following command execute ha manage 1 Press Enter and you are connected to and logged into the CLI of the selected subordinate unit If this subordinate unit has a different host name the CLI prompt changes to this host name You can use CLI commands to manage this subordinate unit Enter the following command to return to the primary unit CLI exit You can use the execute ha manage command to log into the CLI of any of the other subordinate units in the cluster Changing cluster unit host names 84 You can identify individual cluster units by giving each unit a unique host name The host name is the only configuration setting not synchronized by the cluster To set the host name of each cluster member Use SSH to connect to the cluster and log into the CLI Enter the following command to change the host name of the primary unit set system hostname lt hostname_str gt Use the information in Managing individual cluster units on page 83 to log into each cluster member Enter the following command to change the host name of the cluster member set system hostname lt hostname_str gt Repeat steps 3 and 4 for each cluster member Fortinet Inc High availability Managing an HA cluster Synchronizing the cluster c
359. r multiple Internet connections you must create firewall policies Firewall policies control which traffic is allowed through the FortiGate unit and the interfaces that this traffic can connect through For traffic originating on the internal network to be able to connect to the Internet through both Internet connections you must add redundant policies from the internal interface to each interface that connects to the Internet After you add these policies the routing configuration controls which Internet connection is used Adding a redundant default policy Figure 9 on page 51 shows a FortiGate unit connected to the Internet using its internal and DMZ interfaces The default policy allows all traffic from the internal network to connect to the Internet through the external interface If you add a similar policy to the internal to DMZ policy list this policy allows all traffic from the internal network to connect to the Internet through the DMZ interface With both these policies added to the firewall configuration the routing configuration determines which Internet connection the traffic from the internal network uses For more information about the default policy see Default firewall configuration on page 186 To add a redundant default policy Go to Firewall gt Policy gt Internal gt DMZ Select New Configure the policy to match the default policy Source Internal_All Destination DMZ AIl Schedule Always Service ANY Acti
360. r the example topology enter 192 168 1 99 Set the Map to Port to 9443 Set Protocol to UDP Select OK Fortinet Inc Virus and attack definitions updates and registration Figure 25 Push update port forwarding virtual IP Virtual IP A Enabling push updates Name Push_VIP External Interface external x Type C Static NAT Port Forwarding External IP Address 64 230 123 149 External Service Port 45001 Map to IP 192 168 1 99 Map to Port 9443 Protocol C TCP UDP Add New Virtual IP Mapping Adding a firewall policy for the port forwarding virtual IP To configure the FortiGate NAT device Add a new external to internal firewall policy Configure the policy with the following settings Source External_All Destination The virtual IP added above Schedule Always Service ANY Action Accept NAT Selected Select OK Configuring the FortiGate unit with an override push IP and port To configure the FortiGate unit on the internal network Go to System gt Update Select the Allow Push Update check box Select the Use override push check box FortiGate 800 Installation and Configuration Guide 127 Registering FortiGate units Virus and attack definitions updates and registration Set IP to the external IP address added to the virtual IP For the example topology enter 64 230 123 149 Set Port to the external service port added to the virtual IP For the example topology enter 45001
361. r the schedule The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed 4 Set the Start date and time for the schedule Set Start and Stop times to 00 for the schedule to be active for the entire day 5 Set the Stop date and time for the schedule One time schedules use a 24 hour clock 6 Select OK to add the one time schedule Figure 45 Adding a one time schedule Notes start time should be earlier than stop time 206 Fortinet Inc Firewall configuration Schedules Creating recurring schedules You can create a recurring schedule that activates or deactivates policies at specified times of the day or on specified days of the week For example you might want to prevent Internet use outside working hours by creating a recurring schedule If you create a recurring schedule with a stop time that occurs before the start time the schedule starts at the start time and finishes at the stop time on the next day You can use this technique to create recurring schedules that run from one day to the next You can also create a recurring schedule that runs for 24 hours by setting the start and stop times to the same time To create a recurring schedule 1 Go to Firewall gt Schedule gt Recurring Select New to create a new schedule Type a Name for the schedule The name can contain number
362. raffic that connects to the firewall e report network services used report traffic that was permitted by firewall policies report traffic that was denied by firewall policies report events such as configuration changes and other management events IPSec tunnel negotiation virus detection attacks and web page blocking report attacks detected by the NIDS e send alert email to system administrators to report virus incidents intrusions and firewall or VPN events or violations Logs can be sent to a remote syslog server or a WebTrends NetIQ Security Reporting Center and Firewall Suite server using the WebTrends enhanced log format Some models can also save logs to an optional internal hard drive If a hard drive is not installed you can configure most FortiGate units to log the most recent events and attacks detected by the NIDS to the system memory FortiGate 800 Installation and Configuration Guide 21 Document conventions Introduction Document conventions This guide uses the following conventions to describe CLI command syntax e angle brackets lt gt to indicate variable keywords For example xecute restore config lt filename_str gt You enter restore config myfile bak lt xxx_str gt indicates an ASCII string variable keyword lt xxx_integer gt indicates an integer variable keyword lt xxx_ip gt indicates an IP address variable keyword e vertical bar and curly brackets to separate alternati
363. rch for messages that match one or more of the specified search criteria 6 Select either of the following search criteria Keyword To search for any text in a log message Keyword searching is case sensitive Time To search log messages created during the selected year month day and hour 7 Select OK to run the search The web based manager displays the messages that match the search criteria You can scroll through the messages or run another search sA Note After you run a search if you want to display all log messages again run another search ex but leave all the search fields blank Viewing and managing logs saved to the hard disk If your FortiGate unit contains a hard disk for recording logs you can use the following procedures to view search and maintain logs e Viewing logs e Searching logs e Downloading a log file to the management computer e Deleting all messages from an active log e Deleting a saved log file 318 Fortinet Inc Logging and reporting Viewing logs 8 Viewing and managing logs saved to the hard disk Log messages are listed with the most recent message at the top To view the active or saved logs Go to Log amp Report gt Logging Select Traffic Log Event Log Attack Log Antivirus Log Web Filter Log or Email Filter Log The web based manager lists all saved logs of the selected type with the active log at the top of the list For each log the list shows the date and time
364. rd e Changing your contact information or security question e Downloading virus and attack definitions updates FortiGate 800 Installation and Configuration Guide 131 Updating registration information Virus and attack definitions updates and registration Recovering a lost Fortinet support password If you provided a security question and answer when you registered on the Fortinet support web site you can use the following procedure to receive a replacement password If you did not provide a security question and answer contact Fortinet technical support To recover a lost Fortinet support password Go to System gt Update gt Support Select Support Login Enter your Fortinet support user name Select Forgot your password a Fk WOW N Enter your email address and select Submit The security question that you entered when you registered is displayed 6 Enter the answer to your security question and select Get Password If you entered the correct answer to the security question an email containing a new password is sent to your email address You can use your current user name and this password to log into the Fortinet support web site Select Support Login When you receive your new password enter your user name and new password to log into the Fortinet support web site Viewing the list of registered FortiGate units To view the list of registered FortiGate units Go to System gt Update gt Support Select Sup
365. re FortiGate logging to record log messages when the FortiGate unit updates antivirus and attack definitions The update log messages are recorded on the FortiGate Event log To configure update logging 1 Go to Log amp Report gt Log Setting 2 Select Config Policy for the type of logs that the FortiGate unit is configured to record For information about recording logs see Recording logs on page 309 3 Select Update to record log messages when the FortiGate unit updates antivirus and attack definitions 4 Select any of the following update log options Failed Update Records a log message whenever an update attempt fails Successful Records a log message whenever an update attempt is successful Update FDN error Records a log message whenever it cannot connect to the FDN or whenever it receives an error message from the FDN 5 Select OK Scheduling updates The FortiGate unit can check for and download updated definitions hourly daily or weekly according to a schedule that you specify This section describes e Enabling scheduled updates e Adding an override server Enabling scheduled updates through a proxy server Enabling scheduled updates To enable scheduled updates 1 Go to System gt Update Select the Scheduled Update check box Select one of the following to check for and download updates Hourly Once every 1 to 23 hours Select the number of hours and minutes between each update request Daily Once a
366. re for which you want to set the Threshold value Signatures that do not have threshold values do not have Modify z4 icons Type the Threshold value Select the Enable check box Select OK Logging attacks 276 Whenever the NIDS detects or prevents an attack it generates an attack message You can configure the system to add the message to the attack log e Logging attack messages to the attack log e Reducing the number of NIDS attack log and email messages Logging attack messages to the attack log a Fk WO N To log attack messages to the attack log Go to Log amp Report gt Log Setting Select Config Policy for the log locations you have set Select Attack Log Select Attack Detection and Attack Prevention Select OK Note For information about log message content and formats and about log locations see the FortiGate Logging and Message Reference Guide Reducing the number of NIDS attack log and email messages Intrusion attempts might generate an excessive number of attack messages Based on the frequency that messages are generated the FortiGate unit automatically deletes duplicates If you still receive an excessive number of unnecessary messages you can manually disable message generation for unneeded signature groups Automatic message reduction The attack log and alert email messages that the NIDS produces include the ID number and name of the attack that generated the message The attack ID number and
367. receives the VLAN tagged packets 6 Enter a VLAN ID for the VLAN subinterface The VLAN ID can be any number between 1 and 4095 7 Optionally select a zone to add the VLAN subinterface to a zone To add a zone to a virtual domain see Adding zones to virtual domains on page 150 Select OK to add the VLAN subinterface Repeat these steps to add more VLAN subinterfaces to the virtual domain To configure management access and traffic logging for VLAN subinterfaces 1 Go to System gt Network gt Management 2 Configure management access as required for the VLAN subinterfaces that you have added You can select HTTPS PING SSH SNMP HTTP or TELNET 3 Select Log to configure traffic logging for the VLAN subinterfaces that you have added Adding zones to virtual domains Add zones to a virtual domain to group together related VLAN subinterfaces Use zones to simplify firewall policy creation if you have many VLAN subinterfaces in a virtual domain For more information about zones see Configuring zones on page 137 Use the following procedure to add a zone to a virtual domain 150 Fortinet Inc Network configuration a Ff WOW N Virtual domains in Transparent mode Figure 32 FortiGate unit containing a virtual domain with zones VLAN Switch or router FortiGate unit VLAN1 Internal Virtual Domain mar VLAN1 VLAN2 VLAN4 VLAN1 VLAN2 VLAN3 VLAN3 VLAN Switch I VLAN2 nternet VLAN trunk router VLAN tr
368. resses on these networks can use the VPN A VPN requires only one encrypt policy to control both inbound and outbound connections Depending on how you configure it the policy controls whether users on your internal network can establish a tunnel to the remote network the outbound connection and whether users on the remote network can establish a tunnel to your internal network the inbound connection This flexibility allows one encrypt policy to do the same function as two regular firewall policies Although the encrypt policy controls both incoming and outgoing connections it must always be configured as an outgoing policy An outgoing policy has a source address on an internal network and a destination address on an external network The source address identifies the addresses on the internal network that are part of the VPN The destination address identifies the addresses on the remote network that are part of the VPN FortiGate 800 Installation and Configuration Guide 245 Configuring encrypt policies 246 gt IPSec VPN Note The destination address can be a VPN client address on the Internet or the address of a network behind a remote VPN gateway In addition to defining membership in the VPN by address you can configure the encrypt policy for services such as DNS FTP and POP3 and to allow connections according to a predefined schedule by the time of the day or the day of the week month or year You can also co
369. rmation can be up to 31 characters long and can contain spaces numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ The lt gt amp characters are not allowed Get Community Also called read community get community is a password to identify SNMP get requests sent to the FortiGate unit When an SNMP manager sends a get request to the FortiGate unit it must include the correct get community string The default get community string is public Change the default get community string to keep intruders from using get requests to retrieve information about your network configuration The get community string must be used in your SNMP manager to enable it to access FortiGate SNMP information The get community string can be up to 31 characters long and can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Spaces and the lt gt amp characters are not allowed Trap Community The trap community string functions like a password that is sent with SNMP traps The default trap community string is public Change the trap community string to the one accepted by your trap receivers The trap community string can be up to 31 characters long and can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Spaces and the lt gt amp characters are not allowed Trap Receiver IP Ty
370. rmware image using the current configuration If the new firmware image operates successfully you can install it permanently using the procedure Upgrading to a new firmware version on page 95 FortiGate 800 Installation and Configuration Guide 101 Changing the FortiGate firmware System status 102 kh O N A cx To run this procedure you access the CLI by connecting to the FortiGate console port using a null modem cable e install a TFTP server that you can connect to from the FortiGate internal interface The TFTP server should be on the same subnet as the internal interface To test a new firmware image Connect to the CLI using a null modem cable and FortiGate console port Make sure the TFTP server is running Copy the new firmware image file to the root directory of the TFTP server Make sure that the internal interface is connected to the same network as the TFTP server You can use the following command to ping the computer running the TFTP server For example if the TFTP server s IP address is 192 168 1 168 execute ping 192 168 1 168 Enter the following command to restart the FortiGate unit execute reboot As the FortiGate unit reboots press any key to interrupt the system startup As the FortiGate units starts a series of system startup messages are displayed When one of the following messages appears e FortiGate unit running v2 x BIOS Press Any Key To Download Boot Image e FortiGate unit running v
371. rofiles on page 219 2 Select the Anti Virus amp Web filter option in firewall policies that allow HTTP connections through the FortiGate unit e Select a content profile that provides the web filtering options that you want to apply to a policy See Adding content profiles to policies on page 221 FortiGate 800 Installation and Configuration Guide 289 Content blocking Web filtering Configure web filtering settings to control how the FortiGate unit applies web filtering to the HTTP traffic allowed by policies See e URL blocking on page 293 e Configuring Cerberian URL filtering on page 296 e Content blocking on page 290 Script filtering on page 299 e Exempt URL list on page 300 Configure the messages that users receive when the FortiGate unit blocks unwanted content or unwanted URLs See Replacement messages on page 181 Configure the FortiGate unit to record log messages when it blocks unwanted content or unwanted URLs See Recording logs on page 309 Configure the FortiGate unit to send an alert email when it blocks unwanted content or unwanted URLs See Configuring alert email on page 321 Content blocking 290 When the FortiGate unit blocks a web page the user who requested the blocked page receives a block message and the FortiGate unit writes a message to the web filtering log You can add banned words to the list in many languages using Western Si
372. route back out the interface from which it received those routes Split horizon is enabled by default You should only disable split horizon if there is no possibility of creating a counting to infinity loop when network topology changes Authentication Enables authentication for RIP version 2 packets sent and received by an interface Because the original RIP standard does not support authentication authentication is only available for RIP version 2 FortiGate 800 Installation and Configuration Guide 163 Configuring RIP for FortiGate interfaces Password Mode Metric RIP configuration Enter the password to be used for RIP version 2 authentication The password can be up to 16 characters long Defines the authentication used for RIP version 2 packets sent and received by this interface If you select Clear the password is sent as plain text If you select MD5 the password is used to generate an MD5 hash MD5 only guarantees the authenticity of the update packet not the confidentiality of the routing information in the packet Changes the metric for routes sent by this interface All routes sent from this interface have this metric added to their current metric value You can change the interface metric to give a higher priority to an interface For example if you have two interfaces that can be used to route packets to the same destination and you set the metric of one interface higher than the other the routes to the interf
373. rs Fortinet Inc Firewall configuration Services Table 38 FortiGate predefined services Continued Service name Description Protocol Port TCP All TCP ports tcp 0 65535 TELNET Telnet service for connecting to a remote tcp 23 computer to run commands TFTP Trivial file transfer protocol a simple file udp 69 transfer protocol similar to FTP but with no security features UDP All UDP ports udp 0 65535 UUCP Unix to Unix copy utility a simple file copying udp 540 protocol VDOLIVE For VDO Live streaming multimedia traffic tcp 7000 7010 WAIS Wide Area Information Server An Internet tcp 210 search protocol WINFRAME For WinFrame communications between tcp 1494 computers running Windows NT X WINDOWS For remote communications between an tcp 6000 6063 X Window server and X Window clients Adding custom TCP and UDP services kh OO N Add a custom TCP or UDP service if you need to create a policy for a service that is not in the predefined service list To add a custom TCP or UDP service Go to Firewall gt Service gt Custom Select TCP UDP from the Protocol list Select New Type a Name for the new custom TCP or UDP service This name appears in the service list used when you add a policy The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allow
374. rt emails Section Start lt CRITICAL_EVENT gt Allowed Tags CRITICAL_EVENT The firewall critical event message A Section End lt CRITICAL_EVENT gt Fortinet Inc AT MET Firewall configuration Firewall policies control all traffic passing through the FortiGate unit Firewall policies are instructions that the FortiGate unit uses to decide what to do with a connection request When the firewall receives a connection request in the form of a packet it analyzes the packet to extract its source address destination address and service port number For the packet to be connected through the FortiGate unit a firewall policy must be in place that matches the source address destination address and service of the packet The policy directs the firewall action on the packet The action can be to allow the connection deny the connection require authentication before the connection is allowed or process the packet as an IPSec VPN packet You can also add schedules to policies so that the firewall can process connections differently depending on the time of day or the day of the week month or year Each policy can be individually configured to route connections or apply network address translation NAT to translate source and destination IP addresses and ports You can add IP pools to use dynamic NAT when the firewall translates source addresses You can use policies to configure port address
375. rwarded to the destination network You can select any firewall interface or a VLAN subinterface In the Type section select Port Forwarding Fortinet Inc Firewall configuration 10 11 Virtual IPs Enter the External IP Address that you want to map to an address on the destination zone You can set the external IP address to the IP address of the external interface selected in step 4 or to any other address If the IP address of the external interface selected in step 4 is set using PPPoE or DHCP you can enter 0 0 0 0 for the External IP Address The FortiGate unit substitutes the IP address set for this external interface using PPPoE or DHCP For example if the virtual IP provides access from the Internet to a server on your internal network the external IP address must be a static IP address obtained from your ISP for this server This address must be a unique address that is not used by another host However this address must be routed to the external interface selected in step 4 The virtual IP address and the external IP address can be on different subnets Enter the External Service Port number that you want to configure port forwarding for The external service port number must match the destination port of the packets to be forwarded For example if the virtual IP provides access from the Internet to a web server the external service port number is 80 the HTTP port In Map to IP enter the real IP address on the dest
376. s 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select the days of the week that you want the schedule to be active on Set the Start and Stop hours in between which you want the schedule to be active Recurring schedules use a 24 hour clock 6 Select OK to save the recurring schedule Figure 46 Adding a recurring schedule ie time N Recurring N New Recurring Schedule working _Week Minute Minute Notes If the stop time is set earlier than the start time the stop time will be during next day If the start time is equal to the stop time the schedule will run for 24 hours FortiGate 800 Installation and Configuration Guide 207 Virtual IPs Firewall configuration Adding schedules to policies Virtual IPs 208 ao a fF WN After you create schedules you can add them to policies to schedule when the policies are active You can add the new schedules to policies when you create the policy or you can edit existing policies and add a new schedule to them To add a schedule to a policy Go to Firewall gt Policy Create a new policy or edit a policy to change its schedule Configure the policy as required Add a schedule by selecting it from the Schedule list Select OK to save the policy Arrange the policy in the policy list to have the effect that you expect For example
377. s update the attack definitions download or upload system settings restore the FortiGate unit to factory defaults restart the FortiGate unit and shut down the FortiGate unit There is only one admin user Read amp Write Can view and change the FortiGate configuration Can view but cannot add edit or delete administrator accounts Can change own administrator account password Cannot make changes to system settings from the System Status page Read Only Can view the FortiGate configuration Adding new administrator accounts From the admin account use the following procedure to add new administrator accounts and control their permission levels To add an administrator account Go to System gt Config gt Admin Select New to add an administrator account Type a login name for the administrator account The login name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Type and confirm a password for the administrator account For improved security the password should be at least 6 characters long The password can contain any characters except spaces Optionally type a Trusted Host IP address and netmask for the location from which the administrator can log into the web based manager If you want the administrator to be able to access the FortiGate unit from any address set the trusted host to 0 0 0 0 and the netma
378. s ceeesstaedvecdvanasceddesanves 290 Adding words and phrases to the Banned Word list 290 Clearing the Banned Word list cceeeeeeeeeeee eee etcneee eee eicieee eee eaeeeeeetieeeeereiaeeeeeee 291 Backing up the Banned Word liSt cecccceeeeseeeeeeeeeeeneeeeeeeeeaaeeeeeeeeaeeeeeeenaeeeeeeeaas 292 Restoring the Banned Word list cceeceeeeeeeeeeeeeeeeeeceeeeeeeaeeeeeeeiaeeeeseenaeeeeeneaas 292 FortiGate 800 Installation and Configuration Guide 11 Contents URL DIOCKING 00 eee tr nn eee ee ered eres ere EE EAEE 293 Configuring FortiGate Web URL DIOCKING cceceeeeeeeeeeeneeeeeeteeeeeeeeteeeaeeeeeeeaaeees 293 Configuring FortiGate Web pattern DIOCKING cccceceeseeeeneeeeseeeeeeeeeseeeeeeeeeseeenaanees 296 Configuring Cerberian URL filtering 0 0 eee eeeeeee eee eeeeeeeeeeeeeaaeeeeeeeaeeeeeeenaeeeeesenaaes 296 Installing a Cerberian license Key cecccccccesseecccceeteeeeceeeeseseececeeenseeceeeensnescecentnenenes 297 Adding a Cerberiain USEP esras nnana iaaa ANa NAA E RANNER AAA 297 Configuring Cerberian web filter oo ee ceeeeeeeeennneeeeeeeaeeeeeeeeaeeeeseeaaaeeeseeenaaeeeeeeeaes 297 Enabling Cerberian URL filtering cccceeccccceeeeecceeeeeeeeceeeeeeesecaeeeeneeeecneeeeeseeaeneneeees 298 SCHIP TCSII accan a a dasneeeecteala T eee adees 299 Enabling Script filtering ccccci cccectecsscneccetessinceeceessanecuee eesantuecessaeecueeasaneceeceesseneeeeesteane 299 Selecting
379. s only one Internet connection In the case of an asymmetrical configuration the level of redundancy varies from one end of the VPN to the other A Note IPSec Redundancy is only available to VPN peers that have static IP addresses and that authenticate themselves to each other with pre shared keys or digital certificates It is not available to VPN peers that have dynamically assigned IP addresses dialup users Nor is it available to VPN peers that use manual keys FortiGate 800 Installation and Configuration Guide 253 Redundant IPSec VPNs IPSec VPN Configuring redundant IPSec VPNs Prior to configuring the VPN make sure that both FortiGate units have multiple connections to the Internet For each unit first add multiple two or more external interfaces Then assign each interface to an external zone Finally add a route to the Internet through each interface Configure the two FortiGate units with symmetrical settings for their connections to the Internet For example if the remote FortiGate unit has two external interfaces grouped in one zone then the local FortiGate unit should have two external interfaces grouped in one zone Similarly if the remote FortiGate has two external interfaces in separate zones then the local FortiGate unit should have two external interfaces in separate zones The configuration is simpler if all external interfaces are grouped in one zone rather than multiple zones However this might not always
380. s policy processes connections for all services Action ACCEPT The policy action ACCEPT means that the policy allows connections M NAT NAT is selected for the NAT Route mode default policy so that the policy applies network address translation to the traffic processed by the policy NAT is not available for Transparent mode policies O Traffic Shaping Traffic shaping is not selected The policy does not apply traffic shaping to the traffic controlled by the policy You can select this option to control the maximum or minimum amount of bandwidth available to traffic processed by the policy Fortinet Inc Getting started Factory default FortiGate configuration settings Table 4 Factory default firewall configuration Continued O Authentication Authentication is not selected Users do not have to authenticate with the firewall before connecting to their destination address You can configure user groups and select this option to require users to authenticate with the firewall before they can connect through the firewall M Antivirus amp Web Filter Antivirus amp Web Filter is selected Content Scan The scan content profile is selected The policy Profile scans all HTTP FTP SMTP POP3 and IMAP traffic for viruses See Scan content profile on page 34 for more information about the scan content profile You can select one of the other content profiles to apply different levels o
381. s the IP address If you have redundant connections to the Internet the FortiGate unit also sends the SETUP message when one Internet connection goes down and the FortiGate unit fails over to the other Internet connection In Transparent mode if you change the management IP address the FortiGate unit also sends the SETUP message to notify the FDN of the address change FortiGate 800 Installation and Configuration Guide 123 Enabling push updates Virus and attack definitions updates and registration 124 Enabling push updates through a NAT device A Oa If the FDN can connect to the FortiGate unit only through a NAT device you must configure port forwarding on the NAT device and add the port forwarding information to the push update configuration Using port forwarding the FDN connects to the FortiGate unit using either port 9443 or an override push port that you specify Note You cannot receive push updates through a NAT device if the external IP address of the NAT device is dynamic for example set using PPPoE or DHCP Example push updates through a NAT device This example describes how to configure a FortiGate NAT device to forward push updates to a FortiGate unit installed on its internal network For the FortiGate unit on the internal network to receive push updates the FortiGate NAT device must be configured with a port forwarding virtual IP This virtual IP maps the IP address of the external interface of the FortiGate N
382. scanning and Microsoft Office files containing macros are scanned for macro viruses FortiGate virus scanning does not scan the following file types cdimage floppy image ace e bzip2 e Tar Gzipt Bzip2 If a file is found to contain a virus the FortiGate unit removes the file from the content stream and replaces it with a replacement message If your FortiGate unit includes a hard disk and if quarantine is enabled for infected files for the matching traffic protocol the FortiGate unit adds the file to the quarantine list To scan FortiGate firewall traffic for viruses Select antivirus scanning in a content profile For information about content profiles see Adding content profiles on page 219 Optionally select Quarantine in this content profile Add this content profile to firewall policies to apply virus scanning to the traffic controlled by the firewall policy See Adding content profiles to policies on page 221 Configure file quarantine settings to control the quarantining of infected files For information about configuring quarantine options see Configuring quarantine options on page 285 Fortinet Inc Antivirus protection File blocking Figure 69 Example content profile for virus scanning Content Profile New Content Profile Profile Name Virus scanning Options HTTP FTP IMAP POP3 SMTP Anti Virus Scan Iv Iv Vv Vv Iv File Block L r L E L Web URL Block E Web Content Bloc
383. sing normal routing To find a route with a matching gateway the FortiGate unit starts at the top of the destination routing table and searches until it finds the first matching destination route This matched route is used to route the packet For policy routing examples see Policy routing examples on page 55 Policy routing command syntax Configure policy routing using the following CLI command set system route policy lt route_int gt src lt source_ ip gt lt source mask gt iifname lt source interface name gt dst lt destination ip gt lt destination_mask gt oifname lt destination interface name gt protocol lt protocol int gt port lt low port int gt lt high port int gt gw lt gateway ip gt Complete policy routing command syntax is described in Volume 6 FortiGate CLI Reference Guide Configuring DHCP services You can configure DHCP server or DHCP relay agent functionality on any FortiGate interface A FortiGate interface can act as either a DHCP server or as a DHCP relay agent An interface cannot provide both functions sA Note To configure DHCP server or DHCP relay functionality on an interface the FortiGate unit ee must be in NAT Route mode and the interface must have a static IP address This section describes the following e Configuring a DHCP relay agent e Configuring a DHCP server FortiGate 800 Installation and Configuration Guide 157 Configuring DHCP services Network configuration
384. situations You must register the FortiGate unit before it can receive push updates See Registering the FortiGate unit on page 130 When you configure a FortiGate unit to allow push updates the FortiGate unit sends a SETUP message to the FDN The next time a new antivirus engine new antivirus definitions or new attack definitions are released the FDN notifies all FortiGate units that are configured for push updates that a new update is available Within 60 seconds of receiving a push notification the FortiGate unit requests an update from the FDN Note Push updates are not supported if the FortiGate unit must use a proxy server to connect to the FDN For more information see Enabling scheduled updates through a proxy server on page 122 Fortinet Inc Virus and attack definitions updates and registration Enabling push updates When the network configuration permits configuring push updates is recommended in addition to configuring scheduled updates On average the FortiGate unit receives new updates sooner through push updates than if the FortiGate unit receives only scheduled updates However scheduled updates make sure that the FortiGate unit receives the latest updates Enabling push updates is not recommended as the only method for obtaining updates The FortiGate unit might not receive the push notification Also when the FortiGate unit receives a push notification it makes only one attempt to connect to the FDN and d
385. sk to 0 0 0 0 To limit the administrator to only access the FortiGate unit from a specific network set the trusted host to the address of the network and set the netmask to the netmask for the network For example to limit an administrator to accessing the FortiGate unit from your internal network set the trusted host to the address of your internal network for example 192 168 1 0 and set the netmask to 255 255 255 0 Set the Permission level for the administrator Select OK to add the administrator account Fortinet Inc System configuration Configuring SNMP Editing administrator accounts The admin account user can change individual administrator account passwords configure the IP addresses from which administrators can access the web based manager and change the administrator permission levels Administrator account users with Read amp Write access can change their own administrator passwords To edit an administrator account Go to System gt Config gt Admin To change an administrator account password select Change Password gyl Type the Old Password kh OO N Type and confirm a new password For improved security the password should be at least 6 characters long The password can contain any characters except spaces If you enter a password that is less than 6 characters long the system displays a warning message but still accepts the password 5 Select OK To edit the settings of an administrator a
386. splays the messages that match the search criteria You can scroll through the messages or run another search FortiGate 800 Installation and Configuration Guide 319 Viewing and managing logs saved to the hard disk Logging and reporting 320 A gt 5 Note After you run a search if you want to display all log messages again run another search but leave all the search fields blank Downloading a log file to the management computer You can download log files to the management computer as plain text files or comma separated value CSV files After downloading you can view the text file with a text editor or the CSV file using a spreadsheet program To download log files Go to Log amp Report gt Logging Select Traffic Log Event Log Attack log Antivirus Log Web Filter Log or Email Filter Log Select Download Ee for the log file to the management computer Select a format for the log file e Select Download file in the normal format to download the log messages to a text file Each line of the text file consists of a log message The messages are formatted the same way as they appear on the web based manager e Select Download file in CSV format to download the log messages to a text file in CSV format In this format a comma is added between each field in each message If you open this file in a spreadsheet each message field appears in a separate column Select Save Deleting all messages from an active log
387. ssernnnatinnnsenennaaatnnnunataannnaanannnnaaeanne 153 CONMGUMMNG TOUNO serer shee d jedeeesa peeesen add ides nia eeeeash aed cae aaeetedeiebeeeeda tees 153 Adding a default route ccceeceieeeneeeeeeeenneeeeeseeaeeeeseeaaeeeeseeaaeeeeseeaaeeeeeeenaeeeeeseaas 154 Adding destination based routes to the routing table eeeeeeeeseeeeeeeentteeeeeeeaes 154 Adding routes in Transparent MOdC cccccceceeeeeeeeeeeeeeeeeeeenaeeeeeeeenaeeeeseeeaeeeeeeenaaes 155 Configuring the routing table cece eeeeeee eee eene eee eee a Anin tenes eetaeeeeeeenaeeeeeee 156 Policy routing oo eee eet ee eette eee eee tn eee eee AE EEEE AAEE ENEEK KEKEE 156 Configuring DACP SCrVICOS eiiciaste fsdeeetecnd uetevetvsdecnondecdedelnteecguanebedecsccenscdveedensbodsstebiptesd 157 Configuring a DHCP relay agent eee eecceeeeeeeeeeeeeee eee a 158 Configuring a DACP Server eesin aa ede weiceeei eden ie eeedn ieee eee 158 RIP CONnNQUIAUON cain A 161 RIP SQttin Sic cieatssedeecives scenes vansdecensstuanectepsuiscenesdatase EEE EE i EAEE E SARETE 161 Configuring RIP for FortiGate interfaces seeesseeeessssesesrnnsseernnesessnnaasnenneaatnsnnaaenennaaaas 163 FortiGate 800 Installation and Configuration Guide 7 Contents Adding RIP filters 20 0 ecceeeeee settee eee ee te eee serene eee runian ENAK KANANEN EEANN AAAA K ENEAN 165 Adding a RIP Rer WStisiss sccedeisagicedels Ave cageds vdehsavishediachas ceded Gaaiideva iediectibaeeiane 165 Assigning a RIP filter
388. ssword adding 224 changing administrator account 173 Fortinet support 134 recovering a lost Fortinet support 132 PAT 210 pattern web pattern blocking 296 permission administrator account 173 ping server adding to an interface 142 policy accept 191 adding for a virtual domain 152 Anti Virus amp Web filter 193 arranging in policy list 195 Comments 194 deny 191 disabling 196 enabling 196 enabling authentication 229 fixed port 192 guaranteed bandwidth 192 Log Traffic 194 matching 195 maximum bandwidth 193 policy list configuring 195 policy routing 156 POP3 202 324 port address translation 210 port forwarding 210 adding virtual IP 210 virtual IP 208 port number traffic filter display 316 power requirements 27 powering on 27 PPPoE interface addressing mode 141 PPTP 229 324 configuring gateway 258 263 configuring Windows 2000 client 261 configuring Windows 98 client 260 configuring Windows XP client 261 enabling 258 263 ending IP address 258 263 starting IP 258 263 Fortinet Inc PPTP dialup connection configuring Windows 2000 client 261 configuring Windows 98 client 260 configuring Windows XP client 261 PPTP gateway configuring 258 predefined services 200 pre shared keys introduction 232 prevention NIDS 274 protocol service 200 system status 115 proxy server 122 push updates 122 push update configuring 122 external IP address changes 123 management IP address changes 123 through a NAT device 124 throu
389. stination IP address and netmask and for a specified service A traffic filter entry can include any combination of source and destination addresses and services To add an entry to the traffic filter list Go to Log amp Report gt Log Setting gt Traffic Filter Select New Configure the traffic filter for the type of traffic that you want to record on the traffic log Name Type a name to identify the traffic filter entry The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Spaces and other special characters are not allowed Source IP Address Type the source IP address and netmask for which you want the Source Netmask FortiGate unit to log traffic messages The address can be an individual computer subnetwork or network 316 Fortinet Inc Logging and reporting Viewing logs saved to memory Destination IP Address Type the destination IP address and netmask for which you want the Destination Netmask FortiGate unit to log traffic messages The address can be an individual computer subnetwork or network Service Select the service group or individual service for which you want the FortiGate unit to log traffic messages Select OK The traffic filter list displays the new traffic address entry with the settings that you selected in Enabling traffic logging on page 315 Figure 81 Example new traffic address entry if Log Setting A Traffic Filter A Name
390. stomize FortiGate IP addresses for your network and the FortiGate unit is ready to protect your network You can then use the web based manager to customize advanced FortiGate features You can also create a basic configuration using the FortiGate front panel control buttons and LCD Web based manager Using HTTP or a secure HTTPS connection from any computer running Internet Explorer you can configure and manage the FortiGate unit The web based manager supports multiple languages You can configure the FortiGate unit for HTTP and HTTPS administration from any FortiGate interface You can use the web based manager to configure most FortiGate settings You can also use the web based manager to monitor the status of the FortiGate unit Configuration changes made using the web based manager are effective immediately without resetting the firewall or interrupting service Once you are satisfied with a configuration you can download and save it The saved configuration can be restored at any time Figure 1 The FortiGate web based manager and setup wizard Phase 2 New VPN Tunnel Tunnel Name Remote Gateway STATIC x ic P2 Proposal 1 Encryption 3DES z Authentication SHA1 z 2 Encryption 3DES x Authentication M05 z E E A 5 ae E Fortinet Firewall Setup Wizard Microsoft Internet Explorer F ioj xi Configure External Interface Address IP Pool IP Mac Binding Content Profile Keylife Since yo
391. t you can register the unit by going to the System Update Support page or using a web browser to connect to http support fortinet com and selecting Product Registration To register enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased You can register multiple FortiGate units in a single session without re entering your contact information For more information about registration see Registering FortiGate units on page 128 Configuring virus and attack definition updates You can configure the FortiGate unit to automatically check whether new versions of the virus definitions and attack definitions are available If it finds new versions the FortiGate unit automatically downloads and installs the updated definitions The FortiGate unit uses HTTPS on port 8890 to check for updates The FortiGate external interface must have a path to the FortiResponse Distribution Network FDN using port 8890 For information about configuring automatic virus and attack updates see Updating antivirus and attack definitions on page 117 Connecting the FortiGate unit to your networks After you complete the initial configuration of the FortiGate 800 unit you can connect the FortiGate 800 between your internal network and the Internet and to other networks There are 4 10 100 1000 Base TX connectors on the FortiGate 800 e Internal for connecting to your internal net
392. t MESSAGES ssseessseseesesrneesssrrnasrrnnneastsnnaaaennnenetannnaannenneaeat 182 CustomiZing Alert eMaAllS sensasie A remees 183 Firewall COMMQUIATO Ma iisiicsssnisicccsnserssctuncsnscssasassanaeeisevsnacssaaseaanevinsscccaoenananancniss 185 Default firewall CONFIQUIATION e acssissrinn 186 TMMOM ACCS a cnx died cada vvawencddavhgins EN E 187 VLAN subinterfaces 00 0 2 cceceeeeeee eee eete eee teeter nese etne eee e ee eneeeeeeeteeeseetieeeeeeeniieeeeeeenaa 187 LOONES 3 ace ssid save avid gfeceecida aecueh cua dayaevevi gasdenead a decade ci gadsceteteses 187 ACOlOSSES occian n R TEE AEE 188 OMICS serian aA E E A iad 188 SCNCCUICS wuscotscedttectecceeescieecentuen cxedenuendardedaunne Jcoby vets cadets yebacdedeynneccadaVhndaedelssaemecedstyenes 188 Content profiles cceceeecceeceecce eee eeeeeee teste ceaeaaecaeeeeeeeeeeeeeseneaaaaaeaeeeeeeeeeeeteteeeeensaaeeees 189 Adding firewall PoliCi S eccceeecceeeeeeeeeeee eee eeeeeeeeeeeeneeeeeeeseneaeeeeeseceaeeeeseeeaaeeeseeenateees 189 Firewall POlCY OPWONS cick codec haces dertwasneced aana a a reckacudnsengd caddehadeadectas execs 190 Configuring policy lists s 2ci 0 eileen senvectenh eoedati eveeeds dedbesd Hisaseedvsunhs deestolvee A nndeeeeviian ce 195 Policy matching in detalll cccc cccccci ssececceissaceccerssasheuees ts sadeectesisdedeceeasinceceeesigiecereanenels 195 Changing the order of policies in a policy liSt ec eeceeeeeeeeeeeeeeeeeeetteeeeeeetteeeeeer
393. t boot device B Boot with backup firmware and set as default Q Quit menu and continue to boot with default firmware H Display this list of options Enter G F B Q or H Type G to get the new firmware image from the TFTP server Type the address of the TFTP server and press Enter The following message appears Enter Local Address 192 168 1 188 Type the address of the internal interface of the FortiGate unit and press Enter Note The local IP address is used only to download the firmware image After the firmware is installed the address of this interface is changed back to the default IP address for this interface The following message appears Enter File Name image out Fortinet Inc System status Changing the FortiGate firmware 11 Enter the firmware image filename and press Enter The TFTP server uploads the firmware image file to the FortiGate unit and messages similar to the following are displayed e FortiGate unit running v2 x BIOS Do You Want To Save The Image Y n Type Y e FortiGate unit running v3 x BIOS Save as Default firmware Run image without saving D R Save as Default firmware Backup firmware Run image without saving D B R Type D The FortiGate unit installs the new firmware image and restarts The installation might take a few minutes to complete Restoring the previous configuration Change the internal interface addresses if required You can do this from the CL
394. t computer running Windows XP so that it can connect to a FortiGate L2TP VPN To configure an L2TP VPN dialup connection Go to Start gt Settings Select Network and Internet Connections Select Create a connection to the network of your workplace and select Next Select Virtual Private Network Connection and select Next Name the connection and select Next If the Public Network dialog box appears choose the appropriate initial connection and select Next In the VPN Server Selection dialog enter the IP address or host name of the FortiGate unit to connect to and select Next Select Finish To configure the VPN connection Right click the icon that you created Select Properties gt Security Select Typical to configure typical settings Select Require data encryption Note If a RADIUS server is used for authentication do not select Require data encryption L2TP encryption is not supported for RADIUS server authentication Select Advanced to configure advanced settings Select Settings Select Challenge Handshake Authentication Protocol CHAP Make sure that none of the other settings are selected Select the Networking tab Make sure that the following options are selected e TCP IP e QoS Packet Scheduler Make sure that the following options are not selected e File and Printer Sharing for Microsoft Networks e Client for Microsoft Networks FortiGate 800 Installation and Configuration Guide 267 Configuring L
395. t connection to distribute traffic to the cluster unit with the fewest concurrent connections Round Robin Round robin load balancing If the FortiGate units are connected using switches select round robin to distribute traffic to the next available cluster unit Weighted Round Weighted round robin load balancing Similar to round robin but Robin weighted values are assigned to each of the units in a cluster based on their capacity and on how many connections they are currently processing For example the primary unit should have a lower weighted value because it handles scheduling and forwards traffic Weighted round robin distributes traffic more evenly because units that are not processing traffic will be more likely to receive new connections than units that are very busy Random Random load balancing If the FortiGate units are connected using switches select random to randomly distribute traffic to cluster units IP Load balancing according to IP address If the FortiGate units are connected using switches select IP to distribute traffic to units in a cluster based on the Source IP and Destination IP of the packet IP Port Load balancing according to IP address and port If the FortiGate units are connected using switches select IP Port to distribute traffic to units in a cluster based on the Source IP Source Port Destination IP and Destination port of the packet sA Note Do not configure Monitor on Interface until the FortiG
396. t file as well as a name for the text file Uploading the email banned word list You can create or edit a banned word list in a text file and upload it from your management computer to the FortiGate unit Each banned word or phrase must appear on a separate line in the text file Use ASCII Western Chinese Simplified Chinese Traditional Japanese or Korean characters Your computer and web browser must be configured to enter characters in the character set that you use All words are enabled by default Optionally you can enter a space and a 1 after the word to enable it and another space and a number to indicate the language 0 Western 1 Chinese Simplified 2 Chinese Traditional 3 Japanese 4 Korean If you do not add this information to all items in the text file the FortiGate unit automatically enables all banned words and phrases that are followed with a 1 or no number in the Western language when you upload the text file Figure 77 Example Western email banned word list text file banned 1 0 banned phraset l 1 0 banned phrase 2 1 0 To upload the banned word list 1 Go to Email Filter gt Content Block Select Upload Type the path and filename of the banned word list text file or select Browse and locate the file 4 Select OK to upload the banned word list text file Select Return to display the banned word list FortiGate 800 Installation and Configuration Guide 305 Email block list Email
397. t mode installation Transparent mode configuration examples Web based manager example configuration steps To configure basic Transparent mode settings and a default route using the web based manager 1 Go to System gt Status e Select Change to Transparent Mode e Select Transparent in the Operation Mode list e Select OK The FortiGate unit changes to Transparent mode 2 Goto System gt Network gt Management e Change the Management IP and Netmask IP 192 168 1 1 Mask 255 255 255 0 e Select Apply 3 Goto System gt Network gt Routing e Select New to add the default route to the external network Destination IP 0 0 0 0 Mask 0 0 0 0 Gateway 192 168 1 2 e Select OK CLI configuration steps To configure the Fortinet basic settings and a default route using the CLI 1 Change the system to operate in Transparent Mode set system opmode transparent 2 Add the Management IP address and Netmask set system management ip 192 168 1 1 255 255 255 0 3 Add the default route to the external network set system route number 1 gwl 192 168 1 2 Example static route to an external destination Figure 12 shows a FortiGate unit that requires routes to the FDN located on the external network The Fortigate unit does not require routes to the DNS servers or management computer because they are located on the internal network To connect to the FDN you typically enter a single default route to the external network However
398. t proxy address ip gt port lt proxy port gt username lt username_ str gt password lt password str gt For example if the IP address of the proxy server is 64 23 6 89 and its port is 8080 enter the following command set system autouopdate tunneling enable address 64 23 6 89 port 8080 For more information about the set system autoupdate command see Volume 6 FortiGate CLI Reference Guide The FortiGate unit connects to the proxy server using the HTTP CONNECT method as described in RFC 2616 The FortiGate unit sends an HTTP CONNECT request to the proxy server optionally with authentication information specifying the IP address and port required to connect to the FDN The proxy server establishes the connection to the FDN and passes information between the FortiGate unit and the FDN The CONNECT method is used mostly for tunneling SSL traffic Some proxy servers do not allow the CONNECT to connect to any port they restrict the allowed ports to the well known ports for HTTPS and perhaps some other similar services Because FortiGate autoupdates use HTTPS on port 8890 to connect to the FDN your proxy server might have to be configured to allow connections on this port There are no special tunneling requirements if you have configured an override server address to connect to the FDN Enabling push updates 122 oe a The FDN can push updates to FortiGate units to provide the fastest possible response to critical
399. t stop active communications sessions that have been allowed by the policy For information about stopping active communication sessions see System status on page 111 To disable a policy Go to Firewall gt Policy Select the policy list that contains the policy that you want to disable Clear the check box of the policy to disable it Enabling policies Enable a policy that has been disabled so that the firewall can match connections with the policy To enable a policy Go to Firewall gt Policy Select the policy list that contains the policy that you want to enable Select the check box of the policy to enable it Fortinet Inc Firewall configuration Addresses Addresses All policies require source and destination addresses To add addresses to a policy you must first add addresses to the address list for the interfaces zones or VLAN subinterfaces of the policy You can add edit and delete all firewall addresses as required You can also organize related addresses into address groups to simplify policy creation A firewall address consists of an IP address and a netmask This information can represent The address of a subnet for example for a class C subnet IP address 192 168 20 0 and Netmask 255 255 255 0 A single IP address for example IP Address 192 168 20 1 and Netmask 255 255 255 255 All possible IP addresses represented by IP Address 0 0 0 0 and Netmask 0 0 0 0 ve Note
400. t system ip overlap enable to allow IP address overlap If you enter this command multiple VLAN interfaces can have an IP address that is part of a subnet used by another interface This command is recommended for advanced users only Fortinet Inc Network configuration Virtual domains in Transparent mode Adding VLAN subinterfaces The VLAN ID of each VLAN subinterface must match the VLAN ID added by the IEEE 802 1Q compliant router The VLAN ID can be any number between 1 and 4096 Each VLAN subinterface must also be configured with its own IP address and netmask You add VLAN subinterfaces to the physical interface that receives VLAN tagged packets To add VLAN subinterfaces 1 Go to System gt Network gt Interface Select New VLAN to add a VLAN subinterface Enter a Name to identify the VLAN subinterface The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed 4 Select the interface that receives the VLAN packets intended for this VLAN subinterface 5 Enter the VLAN ID that matches the VLAN ID of the packets to be received by this VLAN subinterface The VLAN ID can be any number between 1 and 4096 but must match the VLAN ID added by the IEEE 802 1Q compliant router or switch 6 Configure the VLAN subinterface settings as you would for any FortiGate interface You can add the VLAN subinterface to a zone confi
401. t the interface to which PPTP clients connect This can be an interface VLAN subinterface or zone Fortinet Inc PPTP and L2TP VPN kh OO N a fF OO N Configuring PPTP Select New to add an address Enter the Address Name IP Address and NetMask for an address in the PPTP address range Select OK to save the source address Repeat for all addresses in the PPTP address range Note If the PPTP address range is comprised of an entire subnet add an address for this subnet Do not add an address group To add a source address group Organize the source addresses into an address group Go to Firewall gt Address gt Group Add a new address group to the interface to which PPTP clients connect This can be an interface VLAN subinterface or zone Enter a Group Name to identify the address group The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed To add addresses to the address group select an address from the Available Addresses list and select the right arrow to add it to the Members list To remove addresses from the address group select an address from the Members list and select the left arrow to remove it from the group Select OK to add the address group To add a destination address Add an address to which PPTP users can connect Go to Firewall gt Address Select the internal interfa
402. te adding default 154 adding to routing table 154 adding to routing table Transparent mode 155 destination 154 device 155 router next hop 142 routing 324 adding static routes 154 configuring 153 configuring routing table 156 policy 156 routing table 324 adding default route 154 adding routes 154 adding routes Transparent mode 155 configuring 156 S scanning antivirus 280 333 Index schedule 205 applying to policy 208 automatic antivirus and attack definition updates 120 creating one time 206 creating recurring 207 one time 206 policy option 191 recurring 207 scheduled antivirus and attack updates 122 scheduled updates through a proxy server 122 scheduling 120 scope adding a DHCP scope 158 script filter 299 example settings 299 scripts removing from web pages 299 308 searching logs 318 319 logs saved to FortiGate hard disk 319 logs saved to memory 317 secondary IP interface 142 security question registration 134 serial number displaying 107 108 server DHCP 157 158 service 200 custom ICMP 204 custom IP 204 custom TCP 203 custom UDP 203 group 204 policy option 191 predefined 200 service name 200 user defined ICMP 204 user defined IP 204 user defined TCP 203 user defined UDP 203 service contracts Forticare 129 service group adding 205 service name traffic filter display 316 session clearing 114 session list 114 session status 112 set time 169 setup wizard 43 60 starting 43 60 shutting
403. te unit in Transparent mode go to Transparent mode installation on page 59 If you are going to operate two or more FortiGate units in HA mode go to High availability on page 73 Fortinet Inc RAT MET NAT Route mode installation This chapter describes how to install the FortiGate unit in NAT Route mode For information about installing a FortiGate unit in Transparent mode see Transparent mode installation on page 59 For information about installing two or more FortiGate units in HA mode see High availability on page 73 For more information about installing the FortiGate unit in NAT Route mode see Planning the FortiGate configuration on page 36 This chapter describes Preparing to configure NAT Route mode Using the setup wizard Using the front control buttons and LCD Using the command line interface Completing the configuration Connecting the FortiGate unit to your networks Configuring your networks Completing the configuration Configuration example Multiple connections to the Internet Preparing to configure NAT Route mode Use Table 10 to gather the information that you need to customize NAT Route mode settings FortiGate 800 Installation and Configuration Guide 41 Preparing to configure NAT Route mode 42 NAT Route mode installation Table 10 NAT Route mode settings Administrator Password Internal interface IP Netmask External interface IP
404. tent protection to HTTP FTP IMAP POP3 and SMTP content traffic You would not use the strict content profile under normal circumstances but it is available if you have extreme problems with viruses and require maximum content screening protection Scan To apply antivirus scanning to HTTP FTP IMAP POP3 and SMTP content traffic Quarantine is also selected for all content services On FortiGate models with a hard disk if antivirus scanning finds a virus in a file the file is quarantined on the FortiGate hard disk If required system administrators can recover quarantined files Web To apply antivirus scanning and web content blocking to HTTP content traffic You can add this content profile to firewall policies that control HTTP traffic Unfiltered Use if you do not want to apply content protection to content traffic You can add this content profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected Adding content profiles kh OO N If the default content profiles do not provide the protection that you require you can create custom content profiles To add a content profile Go to Firewall gt Content Profile Select New Type a Profile Name Enable the antivirus protection options that you want Anti Virus Scan Scan web FTP and email traffic for viruses and worms See Antivirus scanning on page 280 File Block Delete files with
405. ter options Enabling script filtering 1 Go to Firewall gt Content Profile 2 Select the content profile for which you want to enable script filtering 3 Select Script Filter 4 Select OK Selecting script filter options 1 Go to Web Filter gt Script Filter 2 Select the script filter options that you want to enable You can block Java applets cookies and Activex 3 Select Apply Figure 74 Example script filter settings to block Java applets and ActiveX Script Filter y Filtering Options M Java Applet C Cookie M Activex FortiGate 800 Installation and Configuration Guide 299 Exempt URL list Web filtering Exempt URL list Add URLs to the exempt URL list to allow legitimate traffic that might otherwise be blocked by content or URL blocking For example if content blocking is set to block pornography related words and a reputable website runs a story on pornography web pages from the reputable website are blocked Adding the address of the reputable website to the exempt URL list allows the content of the website to bypass content blocking sA Note Content downloaded from exempt web pages is not blocked or scanned by antivirus 5 protection Adding URLs to the URL Exempt list e Downloading the URL Exempt List e Uploading a URL Exempt List Adding URLs to the URL Exempt list 1 Go to Web Filter gt URLExempt 2 Select New to add an item to the URL Exempt list 3 Type the URL to exempt Type
406. ter specifies the status of the entry The second parameter specifies the language of the entry Table 41 Banned Word list configuration parameters Parameter Setting Description Status 0 Disabled 1 Enabled Language O ASCII 1 Simplfied Chinese 2 Traditional Chinese 3 Japanese 4 Korean Figure 71 Example Banned Word List text file banned 1 0 banned phrasetl 1 3 banned phrase 2 1 1 Note All changes made to the banned word list using the web based manager are lost when you upload a new list However you can download your current banned word list add more items to it using a text editor and then upload the edited list to the FortiGate unit To restore the banned word list Go to Web Filter gt Content Block Select Restore Banned Word List Elt Type the path and filename of the banned word list text file or select Browse and locate the file Select OK to upload the file to the FortiGate unit Fortinet Inc Web filtering URL blocking Select Return to display the updated Banned Word List You can continue to maintain the Banned Word List by making changes to the text file and uploading it again as necessary sA Note Banned Word must be selected in the content profile for web pages containing banned Z words to be blocked URL blocking You can block the unwanted web URLs using FortiGate Web URL blocking FortiGate Web pattern blocking and Cerberian web filter
407. tering functionality with your FortiGate unit use the following configuration procedures to configure FortiGate support for Cerberian web filtering e Installing a Cerberian license key e Adding a Cerberian user e Configuring Cerberian web filter e Enabling Cerberian URL filtering Fortinet Inc Web filtering Configuring Cerberian URL filtering Installing a Cerberian license key Before you can use the Cerberian web filter you must install a license key The license key determines the number of end users allowed to use Cerberian web filtering through the FortiGate unit To install a Cerberian licence key 1 Go to Web Filter gt URL Block 2 Select Cerberian URL Filtering 3 Enter the license number 4 Select Apply Adding a Cerberian user The Cerberian web policies can be applied only to user groups You can add users on the FortiGate unit and then add the users to user groups on the Cerberian administration web site When the end user tries to access a URL the FortiGate unit checks whether the user s IP address is in the IP address list on the FortiGate unit If the user s IP address is in the list the request is sent to the Cerberian server Otherwise an error message is sent to the user saying that the user does not have authorized access to the Cerberian web filter To add a Cerberian user Go to Web Filter gt URL Block Select Cerberian URL Filtering Select New kh ON Enter the IP address and netmask
408. ternal network with an override push IP and port FortiGate 800 Installation and Configuration Guide 125 Enabling push updates 126 A Ts kh OO N a 10 11 Virus and attack definitions updates and registration Note Before completing the following procedure you should register the internal network FortiGate unit so that it can receive push updates Adding a port forwarding virtual IP to the FortiGate NAT device Use the following procedure to configure a FortiGate NAT device to use port forwarding to forward push update connections from the FDN to a FortiGate unit on the internal network To configure the FortiGate NAT device Go to Firewall gt Virtual IP Select New Type a name for the virtual IP In the External Interface section select the external interface that the FDN connects to For the example topology select the external interface In the Type section select Port Forwarding In the External IP Address section type the external IP address that the FDN connects to For the example topology enter 64 230 123 149 Type the External Service Port that the FDN connects to For the example topology enter 45001 In the Map to IP section type the IP address of the FortiGate unit on the internal network If the FortiGate unit is operating in NAT Route mode enter the IP address of the external interface If the FortiGate unit is operating in Transparent mode enter the management IP address Fo
409. ternet For example if the internal network includes the subnets 192 168 10 0 and 192 168 20 0 you can enter the following policy routes 1 Enter the following command to route traffic from the 192 168 10 0 subnet to the 100 100 100 0 external network set system route policy 1 sre 192 168 10 0 255 255 255 0 dst 100 100 200 0 255 255 2550 gw 1 121 1 2 Enter the following command to route traffic from the 192 168 20 0 subnet to the 200 200 200 0 external network set system route policy 2 src 192 168 20 0 255 255 255 0 dst 200 200 200 0 255 255 255 0 gw 2 2 2 1 Routing a service to an external network You can use the following policy routes to direct all HTTP traffic using port 80 to one external network and all other traffic to the other external network 1 Enter the following command to route all HTTP traffic using port 80 to the next hop gateway with IP address 1 1 1 1 set system route policy 1 src 0 0 0 0 0 0 0 0 dst 0 0 0 0 0 0 0 0 protocol 6 port 80 80 gw 1 1 1 1 2 Enter the following command to route all other traffic to the next hop gateway with IP address 2 2 2 1 Set system route policy 2 src 0 0 0 0 0 0 0 0 dst 0 0 0 0 0 0 0 0 gw 2 2 2 1 FortiGate 800 Installation and Configuration Guide 55 56 Configuration example Multiple connections to the Internet NAT Route mode installation Firewall policy example Firewall policies control how traffic flows through the FortiGate unit After you configure routing fo
410. teway 1 is the primary link to the Internet and gateway 2 is the backup link Go to System gt Network gt Routing Table Select New e Destination IP 0 0 0 0 e Mask 0 0 0 0 e Gateway 1 1 1 1 1 e Gateway 2 2 2 2 1 e Device 1 external e Device 2 dmz e Select OK Using the CLI Add the route to the routing table set system route number 0 dst 0 0 0 0 0 0 0 0 gwl 1 1 1 1 devl external gw2 2 2 2 1 dev2 dmz Table 13 Route for primary and backup links Destination IP Mask Gateway 1 Device 1 Gateway 2 Device 2 0 0 0 0 0 0 0 0 1 1 1 1 external 2 2 2 1 dmz Fortinet Inc NAT Route mode installation Configuration example Multiple connections to the Internet Load sharing You can also configure destination routing to direct traffic through both gateways at the same time If users on the internal network connect to the networks of ISP1 and ISP2 you can add routes for each of these destinations Each route can include a backup destination to the network of the other ISP Table 14 Load sharing routes Destination IP Mask Gateway 1 Device 1 Gateway 2 Device 2 100 100 100 0 255 255 255 0 1 1 1 1 external 2 2 2 1 dmz 200 200 200 0 255 255 255 0 2 2 2 1 dmz 1 1 1 1 external The first route directs all traffic destined for the 100 100 100 0 network out the external interface to gateway 1 with the IP address 1 1 1 1 If this router
411. th policies must be the same Add a different AutolKE key tunnel to each policy See Adding an encrypt policy on page 247 254 Fortinet Inc IPSec VPN Monitoring and Troubleshooting VPNs Monitoring and Troubleshooting VPNs e Viewing VPN tunnel status e Viewing dialup VPN connection status e Testing a VPN Viewing VPN tunnel status You can use the IPSec VPN tunnel list to view the status of all IPSec AutolKE key VPN tunnels For each tunnel the list shows the status and the tunnel time out To view VPN tunnel status 1 Go to VPN gt IPSEC gt Phase 2 2 View the status and timeout for each VPN tunnel Status The status of each tunnel If Status is Up the tunnel is active If Status is Down the tunnel is not active If Status is Connecting the tunnel is attempting to start a VPN connection with a remote VPN gateway or client Timeout The time before the next key exchange The time is calculated by subtracting the time elapsed since the last key exchange from the keylife Figure 62 AutolKE key tunnel status Manual Key D Phase 2 D Phase 1 Concentrator NY Dialup Monitor Remote Gateway Lifetime sec kb A anaana aa AutoIKE_tunnel_1 66 34 23 78 30 0 10240 Up ES AutoIKE_tunnel_2 55 66 77 88 300 NA Down T Viewing dialup VPN connection status You can use the dialup monitor to view the status of dialup VPNs The dialup monitor lists the remote gateways and the active VPN tunnels for each gateway
412. the connections denied by this policy ENCRYPT Make this policy an IPSec VPN policy If you select ENCRYPT you can select an AutolKE Key or Manual Key VPN tunnel for the policy and configure other IPSec settings You cannot add authentication to an ENCRYPT policy ENCRYPT is not available in Transparent mode See Configuring encrypt policies on page 245 FortiGate 800 Installation and Configuration Guide 191 Adding firewall policies 192 Firewall configuration NAT Configure the policy for NAT NAT translates the source address and the source port of packets accepted by the policy If you select NAT you can also select Dynamic IP Pool and Fixed Port NAT is not available in Transparent mode Dynamic IP Select Dynamic IP Pool to translate the source address to an address Pool randomly selected from an IP pool The IP pool must be added to the destination interface or VLAN subinterface of the policy or to an interface or VLAN subinterface in the destination zone of the policy You cannot select Dynamic IP Pool if the destination interface or VLAN subinterface is configured using DHCP or PPPoE For information about adding IP pools see IP pools on page 213 Fixed Port Select Fixed Port to prevent NAT from translating the source port Some applications do not function correctly if the source port is changed If you select Fixed Port you must also select Dynamic IP Pool and add a dynamic IP pool address range to the destin
413. the filter list entry matches the interface that the packet is received or sent on If both prefix and interface match RIP takes the action specified If no match is found the default action is allow e For the neighbors filter RIP attempts to match prefixes in the filter list against the source address in the update packet For the incoming filter RIP attempts to match prefixes in the filter list against prefixes in the routing table entries in the update packet For the outgoing filter RIP attempts to match prefixes in the filter list against prefixes in the RIP routing table You can add up to four RIP filter lists to the FortiGate RIP configuration You can then select one RIP filter list for each RIP filter type neighbors incoming routes outgoing routes If you do not select a RIP filter list for any of the RIP filter types no filtering is applied Note To block all updates not specifically allowed in a filter list create an entry at the bottom of the filter list with a prefix with 0 0 0 0 for the IP address 0 0 0 0 for the netmask and action set to deny Because RIP uses the first match it finds in a top down search of the filter list all the allowed entries are matched first and all other entries for the specified interface are matched by the last entry and denied Create a separate entry at the bottom of the filter list for each interface for which you want to deny all updates not specifically allowed This section
414. tiGate unit can receive antivirus and attack updates it must be able to connect to the FortiResponse Distribution Network FDN The FortiGate unit uses HTTPS on port 8890 to connect to the FDN The FortiGate external interface must have a path to the Internet using port 8890 For information about configuring scheduled updates see Scheduling updates on page 120 You can also configure the FortiGate unit to allow push updates Push updates are provided to the FortiGate unit from the FDN using HTTPS on UDP port 9443 To receive push updates the FDN must have a path to the FortiGate external interface using UDP port 9443 For information about configuring push updates see Enabling push updates on page 122 The FDN is a world wide network of FortiResponse Distribution Servers FDSs When the FortiGate unit connects to the FDN it connects to the nearest FDS To do this all FortiGate units are programmed with a list of FDS addresses sorted by nearest time zone according to the time zone configured for the FortiGate unit To make sure the FortiGate unit receives updates from the nearest FDS check that you have selected the correct time zone for your area To make sure the FortiGate unit can connect to the FDN 1 Go to System gt Config gt Time and make sure the time zone is set to the time zone for the region in which your FortiGate unit is located 2 Go to System gt Update Select Refresh The FortiGate unit tests its conne
415. tiGate unit then blocks a file or email that exceeds this limit instead of bypassing antivirus scanning and sending the file or email directly to the server or receiver The FortiGate unit sends a replacement message for an oversized file or email attachment to the HTTP or email proxy client Configuring limits for oversized files and email To configure limits for oversized files and email Go to Anti Virus gt Config gt Config Type the size limit in MB Select Apply Fortinet Inc Antivirus protection Exempting fragmented email from blocking Exempting fragmented email from blocking A fragmented email is a large email message that has been split into smaller messages that are sent individually and recombined when they are received By default when antivirus protection is enabled the FortiGate unit blocks fragmented emails and replaces them with an email block message that is forwarded to the receiver It is recommended that you disable the fragmenting of email messages in the client email software To exempt fragmented emails from automatic antivirus blocking f Caution The FortiGate unit cannot scan fragmented emails for viruses or use file pattern blocking to remove files from these email messages 1 Enable Pass Fragmented Emails for IMAP POP3 and SMTP traffic in a content profile 2 Select Anti Virus amp Web filter in a firewall policy For example to pass fragmented emails that internal users send to the external ne
416. ties see Filtering log messages on page 313 and Configuring traffic logging on page 314 Select OK Select Apply Recording logs on a NetIQ WebTrends server kh OO N Use the following procedure to configure the FortiGate unit to record logs on a remote NetIQ WebTrends firewall reporting server for storage and analysis FortiGate log formats comply with WebTrends Enhanced Log Format WELF and are compatible with WebTrends NetIQ Security Reporting Center 2 0 and Firewall Suite 4 1 For more information see the Security Reporting Center and Firewall Suite documentation Note FortiGate traffic log messages include sent and received fields which are optional but required for drawing a WebTrends graph To record logs on a NetIQ WebTrends server Go to Log amp Report gt Log Setting Select the Log in WebTrends Enhanced Log Format check box Type the IP address of the NetIQ WebTrends firewall reporting server Select the severity level for which you want to record log messages The FortiGate logs all levels of severity down to but not lower than the level you choose For example if you want to record emergency alert critical and error messages select Error See Log message levels on page 312 Fortinet Inc Logging and reporting Recording logs 5 Select Config Policy To configure the FortiGate unit to filter the types of logs and events to record use the procedures in Filtering log messages o
417. to connect to the Internet The FortiGate unit is connected to the Internet using the external and DMZ interfaces The external interface connects to gateway 1 operated by ISP1 and the DMZ interface connects to gateway 2 operated by ISP2 You can add ping servers to interfaces and configure routing to control how traffic uses each Internet connection With this routing configuration you can create firewall policies to support multiple Internet connections This section provides some examples of routing and firewall configurations for the FortiGate unit for multiple Internet connections To use the information in this section you should be familiar with FortiGate routing see Configuring routing on page 153 and FortiGate firewall configuration see Firewall configuration on page 185 The examples below show how to configure destination based routing and policy routing to control different traffic patterns e Configuring ping servers e Destination based routing examples e Policy routing examples e Firewall policy example Fortinet Inc NAT Route mode installation Configuration example Multiple connections to the Internet Figure 9 Example multiple Internet connection configuration Internal Network 192 168 1 0 2 Internal 192 168 1 99 External FortiGate 800 Port 1 1 1 2 2 2 2 2 amp e o a a amp eS e a o es a Gatewa
418. to make changes to your network or its components However VPN and some advanced firewall features are available only in NAT Route mode VLANs and virtual domains Fortigate Antivirus Firewalls support IEEE 802 1Q compliant virtual LAN VLAN tags Using VLAN technology a single FortiGate unit can provide security services to and control connections between multiple security domains according to the VLAN IDs added to VLAN packets The FortiGate unit can recognize VLAN IDs and apply security policies to secure network and IPSec VPN traffic between each security domain The FortiGate unit can also apply authentication content filtering and antivirus protection to VLAN tagged network and VPN traffic The FortiGate unit supports VLANs in NAT Route and Transparent mode In NAT Route mode you enter VLAN subinterfaces to receive and send VLAN packets In Transparent mode you create virtual domains and then add VLAN subinterfaces to those virtual domains Network intrusion detection 18 The FortiGate Network Intrusion Detection System NIDS is a real time network intrusion detection sensor that detects and prevents a variety of suspicious network activity NIDS uses attack signatures to identify more than 1000 attacks You can enable and disable the attacks that the NIDS detects You can also write user defined detection attack signatures NIDS prevention detects and prevents many common denial of service and packet based attacks You can
419. to port system status 115 traffic configuring global settings 315 316 filtering 314 logging 314 traffic filter adding entries 316 display 316 log setting 316 port number 316 resolve IP 316 service name 316 traffic log 313 deleting all messages 320 Traffic Priority 193 Traffic Shaping 192 Transparent mode 18 adding routes 155 changing to 61 109 configuring the default gateway 62 management interface 144 management IP address 62 virtual domains 147 trap community SNMP 175 traps SNMP 177 troubleshooting 255 trusted host administrator account 172 173 FortiGate 800 Installation and Configuration Guide Index U UDP configuring checksum verification 270 custom service 203 unwanted content blocking 290 304 update 313 attack 121 push 122 updated antivirus 121 updating attack definitions 117 119 virus definitions 117 119 upgrade firmware 95 upgrading firmware 94 firmware using the CLI 95 97 firmware using the web based manager 95 96 URL adding to exempt URL list 300 308 adding to URL block list 296 306 blocking access 293 306 URL block list adding URL 296 306 clearing 294 downloading 292 295 301 306 uploading 292 295 301 307 URL block message 290 URL blocking 293 exempt URL list 300 307 web pattern blocking 296 URL exempt list see also exempt URL list 300 307 use selectors from policy quick mode identifier 241 use wildcard selectors quick mode identifier 241 user authentication 223 user
420. to run Checksum Verifications on Select Apply Figure 66 Example NIDS detection configuration General D Attack List Monitored Interface none internal external dmz ha poti porte ports porte Checksum Verifications 1 IP OO tcp O upp OC Icmp 270 Fortinet Inc Network Intrusion Detection System NIDS Detecting attacks Viewing the signature list You can display the current list of NIDS signature groups and the members of a signature group To view the signature list Go to NIDS gt Detection gt Signature List View the names and action status of the signature groups in the list The NIDS detects attacks listed in all the signature groups that have check marks in the Enable column Note The user defined signature group is the last item in the signature list See Adding user defined signatures on page 272 Select View Details GE to display the members of a signature group The Signature Group Members list displays the attack ID Rule Name and Revision number for each group member Viewing attack descriptions kh OO N Fortinet provides online information for all NIDS attacks You can view the FortiResponse Attack Analysis web page for an attack listed on the signature list To view attack descriptions Go to NIDS gt Detection gt Signature List Select View Details gE to display the members of a signature group Select a signature and copy its attack ID
421. translation PAT through the FortiGate You can add content profiles to policies to apply antivirus protection web filtering and email filtering to web file transfer and email services You can create content profiles that perform one or any combination of the following actions Apply antivirus protection to HTTP FTP SMTP IMAP or POP3 services Quarantine files that are infected or that might be infected by a virus e Apply web filtering to HTTP services e Apply email filtering to IMAP and POP3 services You can also add logging to a firewall policy so that the FortiGate unit logs all connections that use this policy FortiGate 800 Installation and Configuration Guide 185 Default firewall configuration Firewall configuration This chapter describes e Default firewall configuration e Adding firewall policies e Configuring policy lists e Addresses e Services e Schedules e Virtual IPs IP pools IP MAC binding e Content profiles Default firewall configuration 186 By default the users on your internal network can connect through the FortiGate unit to the Internet The firewall blocks all other connections The firewall is configured with a default policy that matches any connection request received from the internal network and instructs the firewall to forward the connection to the Internet The default policy also applies virus scanning to all HTTP FTP SMTP POP3 and IMAP traffic matched by th
422. twork select an internal to external policy 3 Select a content profile that has Pass Fragmented Emails enabled for the traffic that you want the FortiGate unit to scan Viewing the virus list You can view the names of the viruses and worms in the current virus definition list To view the virus list 1 Go to Anti Virus gt Config gt Virus List 2 Scroll through the virus and worm list to view the names of all viruses and worms in the list FortiGate 800 Installation and Configuration Guide 287 Viewing the virus list Antivirus protection 288 Fortinet Inc RAT MET Web filtering When you enable Anti Virus amp Web filter in a firewall policy you select a content profile that controls how web filtering behaves for HTTP traffic Content profiles control the following types of content filtering e blocking unwanted URLs e blocking unwanted content removing scripts from web pages exempting URLs from blocking You can also use the Cerberian URL filtering to block unwanted URLs For more information see Configuring Cerberian URL filtering on page 296 This chapter describes e General configuration steps e Content blocking e URL blocking e Configuring Cerberian URL filtering Script filtering e Exempt URL list General configuration steps Configuring web filtering involves the following general steps 1 Select web filtering options in a new or existing content profile See Adding content p
423. twork traffic control encrypted VPN traffic apply antivirus protection and web content filtering block or allow access for all policy options e control when individual policies are in effect accept or deny traffic to and from individual addresses e control standard and user defined network services individually or in groups e require users to authenticate before gaining access e include traffic shaping to set access priorities and guarantee or limit bandwidth for each policy e include logging to track connections for individual policies e include Network Address Translation NAT mode and Route mode policies e include mixed NAT and Route mode policies The FortiGate firewall can operate in NAT Route mode or Transparent mode FortiGate 800 Installation and Configuration Guide 17 VLANs and virtual domains Introduction NAT Route mode In NAT Route mode you can create NAT mode policies and Route mode policies NAT mode policies use network address translation to hide the addresses in a more secure network from users in a less secure network e Route mode policies accept or deny connections between networks without performing address translation Transparent mode Transparent mode provides the same basic firewall protection as NAT mode Packets that the FortiGate unit receives are forwarded or blocked according to firewall policies The FortiGate unit can be inserted in the network at any point without having
424. u choose Manual as the external addressing mode please input your external interface information Autokey a provided by your ISP IPSEC PPTP L2TP o External Interface IP 192 168 100 99 _ Certificates nternal Interface SHAME 192 168 100 99 External Interface Netmask 255 255 255 0 DH Default gateway 192 168 110 3 i Primary DNS Server 207 194 200 1 Secondary DNS Server 207 194 200 129 Cancel lt Back Next gt 20 Fortinet Inc Introduction Secure installation configuration and management Command line interface You can access the FortiGate command line interface CLI by connecting a management computer serial port to the FortiGate RS 232 serial console connector You can also use Telnet or a secure SSH connection to connect to the CLI from any network that is connected to the FortiGate unit including the Internet The CLI supports the same configuration and monitoring functionality as the web based manager In addition you can use the CLI for advanced configuration options that are not available from the web based manager This Installation and Configuration Guide contains information about basic and advanced CLI commands For a more complete description about connecting to and using the FortiGate CLI see the FortiGate CLI Reference Guide Logging and reporting The FortiGate unit supports logging for various categories of traffic and configuration changes You can configure logging to e report t
425. unit by going to the System Update Support page or using a web browser to connect to http support fortinet com and selecting Product Registration To register enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased You can register multiple FortiGate units in a single session without re entering your contact information For more information about registration see Registering FortiGate units on page 128 Configuring virus and attack definition updates You can go to the System Update page to configure the FortiGate unit to automatically check whether new versions of the virus definitions and attack definitions are available If it finds new versions the FortiGate unit automatically downloads and installs the updated definitions The FortiGate unit uses HTTPS on port 8890 to check for updates The FortiGate external interface must have a path to the FortiResponse Distribution Network FDN using port 8890 For information about configuring automatic virus and attack updates see Updating antivirus and attack definitions on page 117 Configuration example Multiple connections to the Internet 50 This section describes some basic routing and firewall policy configuration examples for a FortiGate unit with multiple connections to the Internet see Figure 9 In this topology the organization operating the FortiGate unit uses two Internet service providers
426. unk zone1 zone2 g VLAN2 VLAN2 VLAN3 VLAN3 VLAN3 Multiple zones in a single virtual domain cannot be connected to a single VLAN trunk This configuration is correct because each zone is connected to a different VLAN trunk zone1 connected to the VLAN trunk on the internal interface and zone2 connected to the VLAN trunk on the external interface If you were to add another zone for example zone3 connected to the VLAN trunk on the internal interface the FortiGate unit would not be able to successfully differentiate between traffic for zone1 and zone3 This is the case because both zone 1 and zone3 traffic would be routed to the same MAC address To add a zone to a virtual domain Go to System gt Network gt Zone Select New to add a zone Type a Name for the zone Select the Virtual Domain to add the zone to Optionally select Block intra zone traffic to block traffic between VLAN subinterfaces in the same zone Select OK to add the zone To add VLAN subinterfaces to a zone Go to System gt Network gt VLAN Set Virtual Domain to All or to the virtual domain containing the VLAN subinterfaces to add to a zone Select List to list all of VLAN subinterfaces added to the FortiGate unit or to the selected virtual domain For a VLAN subinterface to add to a zone select Modify i From the zone list select the name of the zone to add the VLAN subinterface to Select OK to save your changes You can also use the procedur
427. up and restore the local certificate and private key For more information see the FortiGate CLI Reference Guide Fortinet Inc IPSec VPN Configuring encrypt policies Obtaining CA certificates For the VPN peers to authenticate themselves to each other they must both obtain a CA certificate from the same certificate authority The CA certificate provides the VPN peers with a means to validate the digital certificates that they receive from other devices The FortiGate unit obtains the CA certificate to validate the digital certificate that it receives from the remote VPN peer The remote VPN peer obtains the CA certificate to validate the digital certificate that it receives from the FortiGate unit oe Note The CA certificate must adhere to the X 509 standard Importing CA certificates Import the CA certificate from the management computer to the FortiGate unit To import the CA certificate Go to VPN gt Certificates gt CA Certificates Select Import Enter the path or browse to locate the CA certificate on the management computer Select OK The CA is displayed on the CA Certificates list The system assigns a unique name to each CA certificate The names are numbered consecutively CA_Cert_1 CA_Cert_2 CA_Cert_3 and so on kh O N Configuring encrypt policies A VPN connects the local internal network to a remote external network The principal role of the encrypt policy is to define and limit which add
428. uration or the manual key configuration See Adding a VPN concentrator on page 251 Note Add the concentrator configuration to the central FortiGate unit the hub after adding the tunnels for all spokes Add an encrypt policy for each spoke Encrypt policies control the direction of traffic through the hub and allow inbound and outbound VPN connections between the hub and the spokes The encrypt policy for each spoke must include the tunnel name of the spoke The source address must be Internal_All Use the following configuration for the encrypt policies Fortinet Inc IPSec VPN IPSec VPN concentrators Source Internal_All Destination The VPN spoke address Action ENCRYPT VPN Tunnel The VPN spoke tunnel name Allow inbound Select allow inbound Allow outbound Select allow outbound Inbound NAT Select inbound NAT if required Outbound NAT Select outbound NAT if required See Adding an encrypt policy on page 247 5 Arrange the policies in the following order encrypt policies e default non encrypt policy Internal_All gt External_All Adding a VPN concentrator To add a VPN concentrator configuration Go to VPN gt IPSec gt Concentrator Select New to add a VPN concentrator Enter the name of the new concentrator in the Concentrator Name field kh OO N To add tunnels to the VPN concentrator select a VPN tunnel from the Available Tunnels list and select the right arrow 5 To remove tunnels fro
429. ure the interface as a DHCP server before it can be selected Select New to add an address scope Configure the address scope Scope Name Enter the address scope name IP Pool Enter the starting IP and ending IP for the range of IP addresses that this DHCP server assigns to DHCP clients Netmask Enter the netmask that the DHCP server assigns to the DHCP clients Lease Duration Enter the interval in days hours and minutes after which a DHCP client must ask the DHCP server for a new address If you select Unlimited DHCP leases never expire Domain Optionally enter in the domain that the DHCP server assigns to the DHCP clients Default Route Enter the default route to be assigned to DHCP clients The default route must be on the same subnet as the IP pool Select Advanced if you want to configure Advanced Options DNS IP Enter the addresses of up to 3 DNS servers that the DHCP server assigns to the DHCP clients WINS Server IP Add the IP addresses of one or two WINS servers to be assigned to DHCP clients Exclusion Range Optionally enter up to 4 exclusion ranges of IP addresses within the IP pool that cannot be assigned to DHCP clients Select OK FortiGate 800 Installation and Configuration Guide 159 Configuring DHCP services Network configuration Adding a reserve IP to a DHCP server If you have configured an interface as a DHCP server you can reserve an IP address for a particular device on the network according to
430. us and attack definitions For information about antivirus and attack definitions see Manually initiating antivirus and attack definitions updates on page 119 Reverting to a previous firmware version using the CLI This procedure reverts your FortiGate unit to its factory default configuration and deletes NIDS user defined signatures web content lists email filtering lists and changes to replacement messages Before beginning this procedure you can e Back up the FortiGate unit configuration using the command execute backup config e Back up the NIDS user defined signatures using the command execute backup nidsuserdefsig e Back up web content and email filtering lists For information see the FortiGate Content Protection Guide FortiGate 800 Installation and Configuration Guide 97 Changing the FortiGate firmware System status 98 kh OO N 10 If you are reverting to a previous FortiOS version for example reverting from FortiOS v2 50 to FortiOS v2 36 you might not be able to restore your previous configuration from the backup configuration file Note Installing firmware replaces the current antivirus and attack definitions with the definitions included with the firmware release that you are installing After you install new firmware use the procedure Manually initiating antivirus and attack definitions updates on page 119 to make sure that antivirus and attack definitions are up to date You can also use the
431. us procedure Enter your L2TP VPN User Name and Password Select Connect a Fk WOW N In the connect window enter the User Name and Password that you use to connect to your dialup network connection This user name and password is not the same as your VPN user name and password 268 Fortinet Inc sRTINET Network Intrusion Detection System NIDS The FortiGate NIDS is a real time network intrusion detection sensor that uses attack signature definitions to both detect and prevent a wide variety of suspicious network traffic and direct network based attacks Also whenever an attack occurs the FortiGate NIDS can record the event in a log and send an alert email to the system administrator This chapter describes Detecting attacks Preventing attacks Logging attacks Detecting attacks The NIDS Detection module detects a wide variety of suspicious network traffic and network based attacks Use the following procedures to configure the general NIDS settings and the NIDS Detection module Signature List For the general NIDS settings you must select which interfaces you want to be monitored for network based attacks You also need to decide whether to enable checksum verification Checksum verification tests the integrity of packets received at the monitored interfaces This section describes Selecting the interfaces to monitor Disabling monitoring interfaces Configuring checksum verification Viewing the signatur
432. uthentication and data integrity but not secrecy This protocol is used for authentication by IPSec remote gateways set to aggressive mode 51 ESP Encapsulating Security Payload This service is used by manual key and AutolKE VPN tunnels for communicating encrypted data AutolKE key VPN tunnels use ESP after establishing the tunnel using IKE 50 AOL AOL instant messenger protocol tcp 5190 5194 BGP Border Gateway Protocol routing protocol BGP is an interior exterior routing protocol tcp 179 DHCP Relay Dynamic Host Configuration Protocol DHCP allocates network addresses and delivers configuration parameters from DHCP servers to hosts udp 67 DNS Domain name service for translating domain names into IP addresses cp 53 udp 53 FINGER A network service that provides information about users tcp 79 FTP FTP service for transferring files tcp 21 GOPHER Gopher communication service Gopher organizes and displays Internet server contents as a hierarchically structured list of files tcp 70 H323 H 323 multimedia protocol H 323 is a standard approved by the International Telecommunication Union ITU that defines how audiovisual conferencing data is transmitted across networks tcp 1720 1503 HTTP HTTP is the protocol used by the word wide web for transferring data for web pages tcp 80 HTTPS
433. ve mutually exclusive required keywords For example set system opmode nat transparent You can enter set system opmode nat Orset system opmode transparent e square brackets to indicate that a keyword is optional For example get firewall ipmacbinding dhcpipmac You can enter get firewall ipmacbinding or get firewall ipmacbinding dhcpipmac Fortinet documentation Information about FortiGate products is available from the following FortiGate User Manual volumes Volume 1 FortiGate Installation and Configuration Guide Describes installation and basic configuration for the FortiGate unit Also describes how to use FortiGate firewall policies to control traffic flow through the FortiGate unit and how to use firewall policies to apply antivirus protection web content filtering and email filtering to HTTP FTP and email content passing through the FortiGate unit Volume 2 FortiGate VPN Guide Contains in depth information about FortiGate IPSec VPN using certificates pre shared keys and manual keys for encryption Also contains basic configuration information for the Fortinet Remote VPN Client detailed configuration information for FortiGate PPTP and L2TP VPN and VPN configuration examples e Volume 3 FortiGate Content Protection Guide Describes how to configure antivirus protection web content filtering and email filtering to protect content as it passes through the FortiGate unit 22 Fortinet
434. wer on the FortiGate unit that you want to configure Connect to the web based manager Give the FortiGate unit a unique host name See Changing the FortiGate host name on page 94 Use host names to identify individual cluster units Go to System gt Config gt HA Select HA Fortinet Inc High availability Configuring an HA cluster 6 Select the HA mode Select Active Active mode to create an Active Active HA cluster Select Active Passive mode to create an Active Passive HA cluster The HA mode must be the same for all FortiGate units in the HA cluster 7 Enter and confirm a password for the HA cluster The password must be the same for all FortiGate units in the HA cluster 8 Select a Group ID for the HA cluster The Group ID must be the same for all FortiGate units in the HA cluster 9 If you are configuring Active Active HA select a schedule The schedule controls load balancing among the FortiGate units in the active active HA cluster The schedule must be the same for all FortiGate units in the HA cluster None No load balancing Select None when the cluster interfaces are connected to load balancing switches Hub Load balancing for hubs Select Hub if the cluster interfaces are connected to a hub Traffic is distributed to units in a cluster based on the Source IP and Destination IP of the packet Least Connection Least connection load balancing If the FortiGate units are connected using switches select Leas
435. work e External for connecting to your public switch or router and the Internet e DMZ and HA for connecting other networks e HA is also used to connect to another FortiGate 500 for high availability see High availability on page 73 There are 4 10 100 Base TX connectors on the FortiGate 800 e Interfaces 1 to 4 for connecting up to four additional networks to your FortiGate 800 To connect the FortiGate 800 unit running in Transparent mode 1 Connect the Internal interface to the hub or switch connected to your internal network 2 Connect the External interface to the public switch or router provided by your Internet Service Provider 3 Optionally connect the DMZ and HA interfaces and interfaces 1 to 4 to hubs or switches connected to your other networks FortiGate 800 Installation and Configuration Guide 63 Transparent mode configuration examples Transparent mode installation Figure 10 FortiGate 800 Transparent mode connections Internal Network Other Network Hub or Switch Internal DMZ reel FortiGate 800 External ntorntace amp Public Switch Emau or Router ete Internet y Other Network Transparent mode configuration examples A FortiGate unit operating in Transparent mode still requires a basic configuration to operate as a node on the IP network As a minimum the FortiGate unit must be configured with an IP address and subnet mask T
436. work configuration The new zone does not appear in the policy grid until you add an interface to it see To add an interface to a zone below and add a firewall address for it see Adding addresses on page 197 To add a zone Go to System gt Network gt Zone Select New Type a name for the zone The name can contain numbers 0 9 uppercase and lowercase letters A Z a z and the special characters and _ Other special characters and spaces are not allowed Select the Block intra zone traffic check box if you want to block traffic between interfaces in the same zone Select OK Deleting zones You must remove all interfaces and VLAN subinterfaces from a zone before you can delete the zone You can only delete zones that have the Delete icon 1 beside them in the zone list To delete a zone Go to System gt Network gt Zone Select Delete 1 to remove a zone from the list Select OK to delete the zone Configuring interfaces 138 Use the following procedures to configure FortiGate interfaces and VLAN subinterfaces All of these procedures can be used for physical FortiGate interfaces and for VLAN subinterfaces e Viewing the interface list e Changing the administrative status of an interface e Adding an interface to a zone e Configuring an interface with a manual IP address e Configuring an interface for DHCP e Configuring an interface for PPPoE e Adding a secondary IP address to an interface e
437. y For Interface enter the name of the interface to which to apply the entry Select OK to add the entry to the RIP filter list Repeat steps 2 to 6 to add entries to the RIP filter list Assigning a RIP filter list to the neighbors filter 4 The neighbors filter allows or denies updates from other routers You can assign a single RIP filter list to the neighbors filter To assign a RIP filter list to the neighbors filter Go to System gt RIP gt Filter Add RIP filter lists as required For Neighbors Filter select the name of the RIP filter list to assign to the neighbors filter Select Apply Assigning a RIP filter list to the incoming filter The incoming filter accepts or rejects routes in an incoming RIP update packet You can assign a single RIP filter list to the incoming filter To assign a RIP filter list to the incoming filter Go to System gt RIP gt Filter Add RIP filter lists as required For Incoming Routes Filter select the name of the RIP filter list to assign to the incoming filter Select Apply Fortinet Inc RIP configuration Adding RIP filters Assigning a RIP filter list to the outgoing filter The outgoing filter allows or denies adding routes to outgoing RIP update packets You can assign a single RIP filter list to the outgoing filter To assign a RIP filter list to the outgoing filter 1 Go to System gt RIP gt Filter Add RIP filter lists as required For Outgoing Routes Filter s
438. y 1 1 1 1 1 Gateway 2 2 2 2 1 ae SP1 Q ISP2 e e e External Network 1 External Network 2 100 100 100 0 k 200 200 200 0 e f e Internet SS Configuring ping servers Use the following procedure to make gateway 1 the ping server for the external interface and gateway 2 the ping server for the DMZ interface 1 Go to System gt Network gt Interface 2 For the external interface select Modify z4 e Ping Server 1 1 1 1 e Select Enable Ping Server Select OK 3 For the DMZ interface select Modify z4 e Ping Server 2 2 2 1 e Select Enable Ping Server e Select OK FortiGate 800 Installation and Configuration Guide 51 52 Configuration example Multiple connections to the Internet NAT Route mode installation Using the CLI Add a ping server to the external interface set system interfac xternal config detectserver 1 1 1 1 gwdetect enable Add a ping server to the DMZ interface set system interface dmz config detectserver 2 2 2 1 gwdetect enable Destination based routing examples This section describes the following destination based routing examples e Primary and backup links to the Internet e Load sharing e Load sharing and primary and secondary connections Primary and backup links to the Internet Use the following procedure to add a default destination based route that directs all outgoing traffic to gateway 1 If gateway 1 fails all connections are redirected to gateway 2 Ga
439. you can use the execute ha manage command to connect to the CLI of each unit in the cluster You can also manage individual cluster units by using a null modem cable to connect to the primary cluster unit From there you can also use the execute ha manage command to connect to the CLI of each unit in the cluster See Managing individual cluster units on page 83 for more information This section describes e Configuring cluster interface monitoring e Viewing the status of cluster members e Monitoring cluster members e Viewing cluster sessions e Viewing and managing cluster log messages e Monitoring cluster units for failover e Viewing cluster communication sessions e Managing individual cluster units e Changing cluster unit host names e Synchronizing the cluster configuration e Upgrading firmware e Replacing a FortiGate unit after failover Configuring cluster interface monitoring Monitor FortiGate interfaces to make sure that they are functioning properly and that they are connected to their networks If a monitored interface fails or is disconnected from its network the FortiGate unit stops processing traffic and is removed from the cluster If you can re establish traffic flow through the interface for example if you reconnect a disconnected network cable the FortiGate unit rejoins the cluster FortiGate 800 Installation and Configuration Guide 79 Managing an HA cluster 80 cs High availability Note Only mon

Fortinet FortiGate-800 User's Manual

Contents

Download Pdf Manuals

Related Search

Related Contents