Fortinet 400 manual Switching to the backup firmware image, 105

Page 105

System status	Changing the FortiGate firmware

Switching to the backup firmware image

Use this procedure to switch your FortiGate unit to operating with a backup firmware image that you have previous installed. When you switch the FortiGate unit to the backup firmware image, the FortiGate unit operates using the configuration that was saved with that firmware image.

If you install a new backup image from a reboot the configuration saved with this firmware image is the factory default configuration. If you use the procedure “Switching back to the default firmware image” on page 106 to switch to a backup firmware image that was previously running as the default firmware image, the configuration saved with this firmware image is restored.

1Connect to the CLI using the null modem cable and FortiGate console port.

2Enter the following command to restart the FortiGate unit:

execute reboot

As the FortiGate units starts, a series of system startup messages are displayed. When one of the following messages appears:

Press any key to enter configuration menu.....

......

3Immediately press any key to interrupt the system startup.

I

Note: You only have 3 seconds to press any key. If you do not press any key soon enough, the

FortiGate unit reboots and you must log in and repeat the execute reboot command.

If you successfully interrupt the startup process, one of the following messages appears:

[G]: Get firmware image from TFTP server.

[F]: Format boot device.

[B]: Boot with backup firmware and set as default.

[Q]: Quit menu and continue to boot with default firmware.

[H]: Display this list of options.

Enter G,F,B,Q,or H:

4Type B to load the backup firmware image.

The FortiGate unit loads the backup firmware image and restarts. When the FortiGate unit restarts it is running the backup firmware version and the configuration is set to factory default.

FortiGate-400 Installation and Configuration Guide

105

Image 105

Contents August Installation and Configuration GuideRegulatory Compliance TrademarksTable of Contents NAT/Route mode installation High availability System status Network configuration 133 System configuration 157 Users and authentication 201 IPSec VPN 209 Network Intrusion Detection System Nids 249 Email filter 277 Glossary 295 Index 299 Contents Antivirus protection IntroductionEmail filtering Web content filteringFirewall NAT/Route modeNetwork intrusion detection Transparent modeHigh availability VPNWeb-based manager Secure installation, configuration, and managementLogging and reporting Command line interfaceWhat’s new in Version Replacement messages Users and authenticationFirewall Antivirus Web FilterEmail filter About this document Document conventions Comments on Fortinet technical documentation Fortinet documentationCustomer service and technical support Getting started Mounting Package contentsPower requirements Powering onEnvironmental specifications FortiGate-400 LED indicatorsConnecting to the web-based manager Connecting to the web-based managerFactory default FortiGate configuration settings Connecting to the command line interface CLIBits per second 9600 Data bits Parity Stop bits Flow controlFactory default NAT/Route mode network configuration AccountInterface Factory default firewall configuration Factory default Transparent mode network configurationFactory default content profiles Scan content profile Strict content profileStrict content profile Options Scan content profile OptionsUnfiltered content profile Web content profileWeb content profile Options Unfiltered content profile OptionsPlanning your FortiGate configuration Example NAT/Route mode network configuration NAT/Route mode with multiple external network connectionsSetup Wizard Configuration optionsFront keypad and LCD FortiGate model maximum values matrixNext steps Next steps Getting started NAT/Route mode installation Preparing to configure NAT/Route modeNAT/Route mode settings Administrator Password Interface Using the setup wizard Starting the setup wizardReconnecting to the web-based manager Using the command line interface Using the front control buttons and LCDConfiguring the FortiGate unit to operate in NAT/Route mode Configuring NAT/Route mode IP addressesSet system interface port2 mode static ip IPaddress netmask Connecting the FortiGate unit to your networks Completing the configuration Configuring your networkConfiguring interface Go to System Network InterfaceSetting the date and time Configuring interface 4/HAEnabling antivirus protection Registering your FortiGate unitConfiguring virus and attack definition updates Configuration example Multiple connections to the InternetExample multiple Internet connection configuration Configuring Ping serversUsing the CLI Primary and backup links to the InternetDestination based routing examples Go to System Network Routing TableLoad sharing and primary and secondary connections Load sharingRouting table should have routes arranged as shown in Table Adding the routes using the CLIPolicy routing examples Routing a service to an external networkAdding a redundant default policy Firewall policy exampleGo to Firewall Policy port1-port3 Adding more firewall policies Restricting access to a single Internet connectionConfiguration example Multiple connections to the Internet Preparing to configure Transparent mode Transparent mode installationTransparent mode settings Administrator Password DNS SettingsGo to System Status Changing to Transparent modeSet system opmode transparent Configure the Transparent mode default gateway Configuring the Transparent mode management IP addressRegistering your FortiGate FortiGate-400 Transparent mode connections Transparent mode configuration examplesDefault routes and static routes Default route to an external network General configuration stepsCLI configuration steps Web-based manager example configuration stepsGo to System Network Management Go to System Network RoutingStatic route to an external destination Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples Active-passive HA High availabilityActive-active HA HA in NAT/Route mode Installing and configuring the FortiGate unitsConfiguring the HA interfaces Go to System Config HA Configuring the HA clusterLeast Connection Weighted Round RobinExample Active-Active HA configuration Connecting the HA cluster to your networkHA network configuration HA in Transparent mode Configuring the HA interface and HA IP addressStarting the HA cluster HA in Transparent mode None Sample active-passive HA configuration Managing the HA cluster Viewing the status of cluster membersGo to System Status Cluster Members Go to System Status Monitor Monitoring cluster membersViewing and managing cluster log messages Monitoring cluster sessionsGo to System Status Session Go to Log&Report LoggingManaging individual cluster units Synchronizing the cluster configurationReplacing a FortiGate unit after fail-over Returning to standalone configurationSelecting a FortiGate unit to a permanent primary unit Advanced HA optionsSet system ha weight 1 3 Configuring weighted-round-robin weightsSystem status System statusFirmware upgrade procedures Procedure Description Changing the FortiGate host nameChanging the FortiGate firmware Upgrade to a new firmware version Upgrading the firmware using the web-based managerUpgrading the firmware using the CLI Revert to a previous firmware version Execute restore image namestr tftpipReverting to a previous firmware version using the CLI Execute ping To install firmware from a system reboot Install a firmware image from a system reboot using the CLI100 Execute rebootTest a new firmware image before installing it Restoring your previous configuration101 102 Installing and using a backup firmware image Installing a backup firmware image103 104 105 Switching to the backup firmware imageManual virus definition updates Switching back to the default firmware image106 Displaying the FortiGate serial number Manual attack definition updatesDisplaying the FortiGate up time Displaying log hard disk statusRestoring system settings Backing up system settingsRestoring system settings to factory defaults 108Changing to NAT/Route mode Changing to Transparent modeRestarting the FortiGate unit 109Shutting down the FortiGate unit System statusViewing CPU and memory status 111 Viewing sessions and network statusSessions and network status monitor Viewing virus and intrusions statusSession list 113Viewing the session list Go to System Status Session 114 Virus and attack definitions updates and registration Updating antivirus and attack definitions115 Version Expiry date Last update attempt Last update status Connecting to the FortiResponse Distribution NetworkConfiguring scheduled updates Go to System Update117 Configuring update logging Go to Log&Report Log SettingSuccessful Update FDN error Adding an override server Configuring push updatesManually updating antivirus and attack definitions 119About push updates To enable push updatesPush updates through a NAT device Example push updates through a NAT device121 General procedureGo to Firewall Virtual IP 122Schedule Always Service ANY Action Accept 123Adding a firewall policy for the port forwarding virtual IP 124 Scheduled updates through a proxy serverFortiCare Service Contracts Registering FortiGate units125 126 Registering the FortiGate unitRegistering a FortiGate unit product information 127Updating registration information Recovering a lost Fortinet support passwordViewing the list of registered FortiGate units 128Registering a new FortiGate unit Adding or changing a FortiCare Support Contract number129 Downloading virus and attack definitions updates Changing your Fortinet support passwordChanging your contact information or security question 130131 Registering a FortiGate unit after an RMA132 Configuring zones Network configurationAdding zones 133Adding Vlan subinterfaces to a zone Adding interfaces to a zoneRenaming zones 134Deleting zones Configuring interfacesViewing the interface list Bringing up an interfaceAdding a secondary IP address to an interface Changing an interface static IP addressAdding a ping server to an interface 136Configuring traffic logging for connections to an interface Controlling management access to an interfaceChanging the MTU size to improve network performance 137Configuring port4/ha for HA mode Configuring port4/haConfiguring port4/ha as a firewall interface Configuring the management interface Transparent modeConfiguring VLANs Vlan network configuration139 140 Typical Vlan network configurationRules for Vlan IDs Adding Vlan subinterfacesRules for Vlan IP addresses Adding a Vlan subinterfaceAdding a Vlan subinterface 142Adding a default route Configuring routingAdding destination-based routes to the routing table 143144 Adding routes in Transparent mode Configuring the routing table145 Policy routing command syntax Policy routing146 Providing Dhcp services to your internal network Set system dhcpserver command syntax Keywords Description147 148 149 RIP configurationRIP settings Go to System RIP Settings150 151 Configuring RIP settingsPassword Configuring RIP for FortiGate interfaces152 ModeAdding RIP neighbors 153Adding RIP neighbors Go to System RIP Neighbor Adding a single RIP filter Adding RIP filters154 Go to System RIP Filter155 Adding a RIP filter listAdd the IP address of the route Mask Add the netmask of the route ActionAdding a neighbors filter Adding a routes filter156 Setting system date and time System configurationTo set the date and time Go to System Config Time 157To set the system idle timeout Changing web-based manager options158 To modify the Dead Gateway Detection settings To set the Auth timeout159 To select a language for the web-based managerAdding new administrator accounts Adding and editing administrator accountsGo to System Config Admin 160Editing administrator accounts To edit an administrator account Go to System Config Admin161 Configuring the FortiGate unit for Snmp monitoring Configuring SnmpConfiguring FortiGate Snmp support Go to System Config Snmp v1/v2c163 FortiGate MIBsTrap Community Trap Receiver IP Addresses FortiGate MIBs MIB file name Description EtherLike.mibFortiGate traps Customizing replacement messages164 FortiGate traps Trap message DescriptionCustomizing replacement messages Go to System Config Replacement Messages165 Customizing alert emails 166Alert email message sections Alert email message sections 167168 169 Firewall configurationInterfaces Default firewall configurationVlan subinterfaces 170Zones Default addresses Interface Address DescriptionAddresses 171Content profiles ServicesAdding firewall policies SchedulesSource Firewall policy optionsDestination 173Schedule ServiceAction VPN TunnelAuthentication Traffic Shaping175 176 Anti-Virus & Web filterLog Traffic Configuring policy listsComments Policy matching in detailEnabling and disabling policies Changing the order of policies in a policy listDisabling a policy Enabling a policyAdding addresses Addresses179 Go to Firewall AddressEditing addresses Deleting addresses180 Organizing addresses into address groups 181Go to Firewall Address Group Services Predefined services182 Https 183Providing access to custom services Go to Firewall Service Custom184 Grouping services Go to Firewall Service Group185 Creating one-time schedules Schedules186 Go to Firewall Schedule One-timeCreating recurring schedules 187Go to Firewall Schedule Recurring Virtual IPs Adding a schedule to a policy188 189 Adding static NAT virtual IPs190 Adding port forwarding virtual IPs191 Adding policies with virtual IPsAdding an IP pool IP pools192 Go to Firewall IP PoolIP Pools for firewall policies that use fixed ports IP/MAC bindingIP pools and dynamic NAT 193Go to Firewall IP/MAC Binding Setting 194Go to Firewall IP/MAC Binding Static IP/MAC 195 Adding IP/MAC addressesEnabling IP/MAC binding Viewing the dynamic IP/MAC list196 Go to Firewall IP/MAC Binding Dynamic IP/MACDefault content profiles Content profilesAdding a content profile Go to Firewall Content ProfileFile Block 198Quarantine Oversized File/Email Block Pass Fragmented Email199 Adding a content profile to a policy200 201 Users and authenticationAdding user names and configuring authentication Setting authentication timeoutAdding user names and configuring authentication 202203 Deleting user names from the internal databaseAdding Radius servers Configuring Radius supportDeleting Radius servers 204Adding Ldap servers Configuring Ldap support205 Go to User Ldap206 Deleting Ldap serversAdding user groups Configuring user groups207 Go to User User Group208 Deleting user groups209 IPSec VPNManual Keys Key managementAutoIKE with pre-shared keys AutoIKE with certificatesManual key IPSec VPNs General configuration steps for a manual key VPNAdding a manual key VPN tunnel 211212 Adding a phase 1 configuration for an AutoIKE VPN General configuration steps for an AutoIKE VPNGo to VPN Ipsec Phase AutoIKE IPSec VPNs214 Remote Gateway Static IP AddressRemote Gateway Dialup User 215 Configuring advanced options216 217 Adding a phase 2 configuration for an AutoIKE VPN218 Managing digital certificates Obtaining a signed local certificate219 Generating the certificate request 220Go to VPN Local Certificates Downloading the certificate request Requesting the signed local certificate221 Retrieving the signed local certificate Importing the signed local certificate222 Retrieving a CA certificate Obtaining a CA certificateImporting a CA certificate 223224 Configuring encrypt policiesAdding a destination address Adding a source addressAdding an encrypt policy 225Adding an encrypt policy 226VPN concentrator hub general configuration steps IPSec VPN concentrators227 Source InternalAll Destination VPN spoke address Action 228Adding a VPN concentrator 229Go to VPN IPSec Concentrator 230 VPN spoke general configuration stepsVPN Tunnel PoliciesConfiguring redundant IPSec VPN Redundant IPSec VPNs231 232 See Adding a phase 1 configuration for an AutoIKE VPN onViewing VPN tunnel status Monitoring and Troubleshooting VPNsViewing dialup VPN connection status 233Testing a VPN 234Go to VPN IPSec Dialup Configuring Pptp Pptp and L2TP VPN235 Adding users and user groups Configuring the FortiGate unit as a Pptp gatewayEnabling Pptp and specifying an address range 236237 Adding an address groupInstalling Pptp support Configuring a Windows 98 client for PptpGo to Start Settings Control Panel Network Adding a firewall policyConnecting to the Pptp VPN Configuring a Pptp dialup connectionConfiguring a Windows 2000 client for Pptp 239Configuring the VPN connection Configuring a Windows XP client for Pptp240 Go to Start Control Panel241 Configuring L2TPEnabling L2TP and specifying an address range Configuring the FortiGate unit as a L2TP gateway242 Go to VPN L2TP L2TP Range243 Sample L2TP address range configuration244 Configuring an L2TP dialup connection Configuring a Windows 2000 client for L2TPDisabling IPSec 245Configuring a Windows XP client for L2TP Connecting to the L2TP VPNConfiguring an L2TP VPN dialup connection Go to Start Settings247 248 Network Intrusion Detection System Nids Detecting attacks249 Selecting the interfaces to monitor Configuring checksum verificationDisabling the Nids 250Viewing attack descriptions Viewing the signature list251 Go to Nids Detection Signature ListAdding user-defined signatures Enabling and disabling Nids attack signatures252 Go to Nids Detection User Defined Signature ListDownloading the user-defined signature list Preventing attacksEnabling Nids attack prevention 253Setting signature threshold values Enabling Nids attack prevention signatures254 255 Value Description Minimum Maximum Default Configuring synflood signature valuesLogging attacks Logging attack messages to the attack logAutomatic message reduction Reducing the number of Nids attack log and email messagesManual message reduction 257258 General configuration steps Antivirus protection259 Antivirus scanning 260To scan FortiGate firewall traffic for viruses 261 File blockingAdding file patterns to block Blocking files in firewall traffic262 Go to Anti-Virus File BlockQuarantine Go to Anti-Virus Quarantine Quarantine ConfigQuarantining infected files Quarantining blocked filesSorting the quarantine list Viewing the quarantine list264 Go to Anti-Virus QuarantineFiltering the quarantine list Configuring quarantine optionsDeleting files from quarantine Downloading quarantined filesBlocking oversized files and emails Configuring limits for oversized files and emailExempting fragmented email from blocking Viewing the virus list267 Web filteringGo to Web Filter Content Block Content blockingAdding words and phrases to the banned word list 268URL blocking Using the FortiGate web filterAdding URLs or URL patterns to the block list 269270 Clearing the URL block listDownloading the URL block list Uploading a URL block list271 Installing a Cerberian license key on the FortiGate unit Using the Cerberian web filterAdding a Cerberian user to the FortiGate unit 272About the default group and policy Configuring Cerberian web filterTo configure the Cerberian web filtering Enabling Cerberian URL filteringEnabling the script filter Script filteringSelecting script filter options 274Adding URLs to the exempt URL list Exempt URL list275 Go to Web Filter Exempt URLExample exempt URL list 276277 Email filterGo to Email Filter Content Block Email banned word list278 Email exempt list Email block listAdding address patterns to the email block list 279Adding a subject tag To add a subject tag Go to Email Filter ConfigAdding address patterns to the email exempt list 280Logging and reporting Recording logs281 Recording logs on a remote computer Recording logs on a NetIQ WebTrends server282 283 Recording logs on the FortiGate hard diskOverwrite OptionFiltering log messages Recording logs in system memory284 285 Example log filter configurationEnabling traffic logging Configuring traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a Vlan subinterfaceGo to Log&Report Log Setting Traffic Filter Configuring traffic filter settingsEnabling traffic logging for a firewall policy 287Destination IP Address Destination Netmask Service Adding traffic filter entries288 Viewing logs Viewing logs saved to memorySearching logs 289290 Viewing and managing logs saved to the hard diskDownloading a log file to the management computer Deleting all messages in an active log291 Deleting a saved log file Configuring alert emailAdding alert email addresses 292Enabling alert email Testing alert email293 Go to Log&Report Alert Mail Categories294 295 Glossary296 297 298 Index Numerics299 Index 300FDS 301Ldap 302MIB 303304 RMA 305TCP 306VPN 307308

Related manuals

Manual 2 pages 1.18 Kb