Secure installation, configuration, and management | Fortinet 100

Introduction	Web-based manager

•PPTP for easy connectivity with the VPN standard supported by the most popular operating systems.

•L2TP for easy connectivity with a more secure VPN standard also supported by many popular operating systems.

•Firewall policy based control of IPSec VPN traffic.

•IPSec NAT traversal so that remote IPSec VPN gateways or clients behind a NAT can connect to an IPSec VPN tunnel.

•VPN hub and spoke using a VPN concentrator to allow VPN traffic to pass from one tunnel to another tunnel through the FortiGate unit.

•IPSec Redundancy to create a redundant AutoIKE key IPSec VPN connection to a remote network.

Secure installation, configuration, and management

Installation is quick and simple. The first time you turn on the FortiGate unit, it is already configured with default IP addresses and security policies. Connect to the web-based manager, set the operating mode, and use the setup wizard to customize FortiGate IP addresses for your network, and the FortiGate unit is set to protect your network. You can then use the web-based manager to customize advanced FortiGate features to meet your needs.

You can also create a basic configuration using the FortiGate command line interface (CLI).

Web-based manager

Using HTTP or a secure HTTPS connection from any computer running Internet Explorer, you can configure and manage the FortiGate unit. The web-based manager supports multiple languages. You can configure the FortiGate unit for HTTP and HTTPs administration from any FortiGate interface.

You can use the web-based manager for most FortiGate configuration settings. You can also use the web-based manager to monitor the status of the FortiGate unit. Configuration changes made with the web-based manager are effective immediately without the need to reset the firewall or interrupt service. Once a satisfactory configuration has been established, it can be downloaded and saved. The saved configuration can be restored at any time.

FortiGate-100 Installation and Configuration Guide

17

Image 17

Fortinet 100 user manual Secure installation, configuration, and management, Web-based manager

Contents

August Installation and Configuration Guide Regulatory Compliance Trademarks Table of Contents NAT/Route mode installation System status Virus and attack definitions updates and registration RIP configuration 121 Users and authentication 173 IPSec VPN 181 Network Intrusion Detection System Nids 221 Glossary 259 Index 263 Contents Antivirus protection Introduction Email filtering Web content filtering Firewall NAT/Route mode Network intrusion detection Transparent mode Web-based manager Secure installation, configuration, and management FortiGate web-based manager and setup wizard Command line interface Network configuration System administrationWhat’s new in Version Logging and reporting Users and authentication Replacement messagesDhcp server Firewall Email filter AntivirusWeb Filter About this document Document conventions Comments on Fortinet technical documentation Fortinet documentation Customer service and technical support Comments on Fortinet technical documentation Getting started Mounting Package contents Environmental specifications Powering on Connecting to the web-based manager Connecting to the web-based manager Factory default FortiGate configuration settings Connecting to the command line interface CLIBits per second 9600 Data bits Parity Stop bits Flow control Account Factory default NAT/Route mode network configurationInternal interface External interface Factory default firewall configuration Factory default Transparent mode network configuration Factory default firewall configuration Traffic Shaping Factory default content profilesAuthentication Antivirus & Web Filter Scan content profile Strict content profileStrict content profile Options Scan content profile Options Unfiltered content profile Web content profileWeb content profile Options Unfiltered content profile Options Example NAT/Route mode network configuration Planning your FortiGate configuration Example NAT/Route multiple internet connection configuration NAT/Route mode with multiple external network connections Setup Wizard Configuration options FortiGate model maximum values matrix Next steps Configuration options Getting started Internal servers NAT/Route mode installationPreparing to configure NAT/Route mode Advanced FortiGate NAT/Route mode settings Advanced NAT/Route mode settingsDMZ interface Dhcp server Using the command line interface Using the setup wizard Set system interface external mode static ip 204.23.1.5 FortiGate-100 NAT/Route mode connections Connecting the FortiGate unit to your networks Completing the configuration Configuring your networksConfiguring the DMZ interface Setting the date and time Configuring virus and attack definition updates Configuration example Multiple connections to the InternetEnabling antivirus protection Registering your FortiGate Example multiple Internet connection configuration Primary and backup links to the Internet Configuring Ping serversUsing the CLI Destination based routing examples Load sharing and primary and secondary connections Load sharing Routing table should have routes arranged as shown in Table Adding the routes using the CLI Policy routing examples Routing a service to an external network Firewall policy example Adding a redundant default policyAdding more firewall policies Action Accept Restricting access to a single Internet connection Preparing to configure Transparent mode Transparent mode installationTransparent mode settings Administrator Password DNS Settings Go to System Status Changing to Transparent mode Configure the Transparent mode default gateway Configuring the Transparent mode management IP address FortiGate-100 Transparent mode connections Setting the date and time Default routes and static routes Transparent mode configuration examples Default route to an external network General configuration steps CLI configuration steps Web-based manager example configuration stepsGo to System Network Management Go to System Network Routing Static route to an external destination Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 System status System status Changing the FortiGate firmware Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name Upgrading the firmware using the CLI Upgrade to a new firmware versionUpgrading the firmware using the web-based manager Revert to a previous firmware version Execute restore image namestr tftpip Reverting to a previous firmware version using the CLI Execute ping To install firmware from a system reboot Install a firmware image from a system reboot using the CLI Press Any Key To Download Boot Image Restoring your previous configuration Test a new firmware image before installing it Test a new firmware image before installing it Installing a backup firmware image Installing and using a backup firmware image Installing and using a backup firmware image Switching to the backup firmware image Switching back to the default firmware image Manual virus definition updates Backing up system settings Manual attack definition updatesDisplaying the FortiGate serial number Displaying the FortiGate up time Restoring system settings to factory defaults Restoring system settings Restarting the FortiGate unit Changing to Transparent modeChanging to NAT/Route mode Viewing CPU and memory status Shutting down the FortiGate unitSystem status Go to System Status Monitor Viewing sessions and network status Sessions and network status monitor Viewing virus and intrusions status Viewing the session list Go to System Status Session Session list To IP Updating antivirus and attack definitions Virus and attack definitions updates and registration Version Expiry date Last update attempt Last update status Connecting to the FortiResponse Distribution Network Go to System Update Configuring scheduled updates Successful Update FDN error Configuring update loggingGo to Log&Report Log Setting Manually updating antivirus and attack definitions Configuring push updatesAdding an override server About push updates To enable push updatesPush updates and external dynamic IP addresses Push updates through a NAT device Example network topology Push updates through a NAT device Example push updates through a NAT device Go to Firewall Virtual IP General procedure Adding a firewall policy for the port forwarding virtual IP Schedule Always Service ANY Action Accept 100 Scheduled updates through a proxy server 101 FortiCare Service ContractsRegistering FortiGate units 102 Registering the FortiGate unit Registering a FortiGate unit product information 103 Updating registration information Recovering a lost Fortinet support passwordViewing the list of registered FortiGate units 104 105 Registering a new FortiGate unitAdding or changing a FortiCare Support Contract number Downloading virus and attack definitions updates Changing your Fortinet support passwordChanging your contact information or security question 106 107 Registering a FortiGate unit after an RMA 108 109 Network configurationConfiguring interfaces Bringing up an interface Viewing the interface listChanging an interface static IP address Adding a secondary IP address to an interface 111 Controlling management access to an interfaceAdding a ping server to an interface Configuring the external interface for Dhcp Configuring traffic logging for connections to an interfaceConfiguring the external interface with a static IP address 113 Configuring the external interface for PPPoE Configuring the management interface Transparent mode Adding DNS server IP addresses Configuring routing115 Go to System Network DNS Adding destination-based routes to the routing table Adding a default route 117 Adding routes in Transparent mode Policy routing Configuring the routing table Policy routing command syntax Providing Dhcp services to your internal network119 Go to System Network Dhcp 120 Viewing the dynamic IP list 121 RIP configuration 122 RIP settingsGo to System RIP Settings 123 UpdateInvalid Holddown Password Configuring RIP for FortiGate interfaces124 Mode Adding RIP neighbors Go to System RIP Neighbor Adding RIP neighbors125 Adding a single RIP filter Adding RIP filters126 Go to System RIP Filter 127 Adding a RIP filter listAdd the IP address of the route Mask Add the netmask of the route Action 128 Adding a neighbors filterAdding a routes filter Setting system date and time System configurationTo set the date and time Go to System Config Time 129 130 To set the system idle timeoutChanging web-based manager options To modify the Dead Gateway Detection settings To set the Auth timeout131 To select a language for the web-based manager Adding new administrator accounts Adding and editing administrator accountsGo to System Config Admin 132 133 Editing administrator accountsTo edit an administrator account Go to System Config Admin Configuring the FortiGate unit for Snmp monitoring Configuring SnmpConfiguring FortiGate Snmp support Go to System Config Snmp v1/v2c 135 FortiGate MIBsTrap Community Trap Receiver IP Addresses FortiGate MIBs MIB file name Description EtherLike.mib FortiGate traps Customizing replacement messages136 FortiGate traps Trap message Description 137 Customizing replacement messagesGo to System Config Replacement Messages Alert email message sections Customizing alert emails138 Alert email message sections 139 140 141 Firewall configuration 142 Default firewall configurationAddresses Content profiles ServicesSchedules 143 Go to Firewall Policy Adding firewall policies144 145 Traffic Shaping VPN Tunnel146 Dynamic IP Pool Fixed Port 147 AuthenticationAnti-Virus & Web filter 148 Log TrafficComments Policy matching in detail Configuring policy listsChanging the order of policies in a policy list 149 Enabling and disabling policies AddressesDisabling a policy Enabling a policy Go to Firewall Address Adding addresses151 Deleting addresses Editing addressesOrganizing addresses into address groups 152 153 ServicesPredefined services ANY 154 IRC 155 Grouping services Providing access to custom servicesGo to Firewall Service Custom Go to Firewall Service Group 157 Schedules Creating recurring schedules Creating one-time schedules158 Go to Firewall Schedule One-time 159 Adding a schedule to a policy 160 Virtual IPsAdding static NAT virtual IPs 161 Adding port forwarding virtual IPs 162 163 Adding policies with virtual IPs Adding an IP pool IP pools164 Go to Firewall IP Pool 165 IP Pools for firewall policies that use fixed portsIP pools and dynamic NAT IP/MAC binding Go to Firewall IP/MAC Binding Setting166 Go to Firewall IP/MAC Binding Static IP/MAC 167 Adding IP/MAC addresses Enabling IP/MAC binding Viewing the dynamic IP/MAC list168 Go to Firewall IP/MAC Binding Dynamic IP/MAC 169 Content profiles Adding a content profile Default content profilesGo to Firewall Content Profile 170 Oversized File/Email Block Pass Fragmented Email Adding a content profile to a policy171 172 173 Users and authentication Adding user names and configuring authentication Setting authentication timeoutAdding user names and configuring authentication 174 175 Deleting user names from the internal database Adding Radius servers Configuring Radius supportDeleting Radius servers 176 Adding Ldap servers Configuring Ldap support177 Go to User Ldap 178 Deleting Ldap servers Adding user groups Configuring user groups179 Go to User User Group 180 Deleting user groups 181 IPSec VPN Manual Keys Key managementAutoIKE with pre-shared keys AutoIKE with certificates Manual key IPSec VPNs General configuration steps for a manual key VPNAdding a manual key VPN tunnel 183 184 Adding a phase 1 configuration for an AutoIKE VPN General configuration steps for an AutoIKE VPNGo to VPN Ipsec Phase AutoIKE IPSec VPNs Remote Gateway Dialup User 186Remote Gateway Static IP Address 187 Configuring advanced options 188 189 Adding a phase 2 configuration for an AutoIKE VPN 190 191 Managing digital certificatesObtaining a signed local certificate Go to VPN Local Certificates Generating the certificate request192 193 Downloading the certificate requestRequesting the signed local certificate 194 Retrieving the signed local certificateImporting the signed local certificate Retrieving a CA certificate Obtaining a CA certificateImporting a CA certificate 195 196 Configuring encrypt policies Adding a destination address Adding a source addressAdding an encrypt policy 197 Adding an encrypt policy 198 199 VPN concentrator hub general configuration stepsIPSec VPN concentrators Source InternalAll Destination VPN spoke address Action 200 Go to VPN IPSec Concentrator Adding a VPN concentrator201 202 VPN spoke general configuration stepsVPN Tunnel Policies 203 Configuring redundant IPSec VPNRedundant IPSec VPNs 204 See Adding a phase 1 configuration for an AutoIKE VPN on Viewing VPN tunnel status Monitoring and Troubleshooting VPNsViewing dialup VPN connection status 205 Go to VPN IPSec Dialup Testing a VPN206 207 Configuring PptpPptp and L2TP VPN Adding users and user groups Configuring the FortiGate unit as a Pptp gatewayEnabling Pptp and specifying an address range 208 209 Adding an address group Installing Pptp support Configuring a Windows 98 client for PptpGo to Start Settings Control Panel Network Adding a firewall policy Connecting to the Pptp VPN Configuring a Pptp dialup connectionConfiguring a Windows 2000 client for Pptp 211 Configuring the VPN connection Configuring a Windows XP client for Pptp212 Go to Start Control Panel 213 Configuring L2TP Enabling L2TP and specifying an address range Configuring the FortiGate unit as a L2TP gateway214 Go to VPN L2TP L2TP Range 215 Sample L2TP address range configuration 216 Configuring an L2TP dialup connection Configuring a Windows 2000 client for L2TPDisabling IPSec 217 Configuring a Windows XP client for L2TP Connecting to the L2TP VPNConfiguring an L2TP VPN dialup connection Go to Start Settings 219 220 221 Network Intrusion Detection System NidsDetecting attacks Selecting the interfaces to monitor Configuring checksum verificationDisabling the Nids 222 Viewing attack descriptions Viewing the signature list223 Go to Nids Detection Signature List Adding user-defined signatures Enabling and disabling Nids attack signatures224 Go to Nids Detection User Defined Signature List Downloading the user-defined signature list Preventing attacksEnabling Nids attack prevention 225 226 Setting signature threshold valuesEnabling Nids attack prevention signatures 227 Value Description Minimum Maximum Default Configuring synflood signature valuesLogging attacks Logging attack messages to the attack log Automatic message reduction Reducing the number of Nids attack log and email messagesManual message reduction 229 230 231 General configuration stepsAntivirus protection To scan FortiGate firewall traffic for viruses Antivirus scanning232 Blocking files in firewall traffic File blockingAdding file patterns to block 233 Blocking oversized files and emails Configuring limits for oversized files and emailExempting fragmented email from blocking Viewing the virus list 235 Web filtering Go to Web Filter Content Block Content blockingAdding words and phrases to the banned word list 236 URL blocking Using the FortiGate web filterAdding URLs or URL patterns to the block list 237 238 Clearing the URL block list 239 Downloading the URL block listUploading a URL block list Installing a Cerberian license key on the FortiGate unit Using the Cerberian web filterAdding a Cerberian user to the FortiGate unit 240 About the default group and policy Configuring Cerberian web filterTo configure the Cerberian web filtering Enabling Cerberian URL filtering Enabling the script filter Script filteringSelecting script filter options 242 Adding URLs to the exempt URL list Exempt URL list243 Go to Web Filter Exempt URL 244 245 Email filter 246 Go to Email Filter Content BlockEmail banned word list Email exempt list Email block listAdding address patterns to the email block list 247 Adding a subject tag To add a subject tag Go to Email Filter ConfigAdding address patterns to the email exempt list 248 249 Logging and reportingRecording logs 250 Recording logs on a remote computerRecording logs on a NetIQ WebTrends server 251 Filtering log messagesRecording logs in system memory 252 Example log filter configuration Enabling traffic logging Configuring traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a firewall policy Go to Log&Report Log Setting Traffic Filter Configuring traffic filter settingsAdding traffic filter entries 254 Viewing logs saved to memory Destination IP Address Destination Netmask ServiceViewing logs 255 Searching logs Configuring alert emailAdding alert email addresses 256 Enabling alert email Testing alert email257 Go to Log&Report Alert Mail Categories 258 259 Glossary 260 261 262 263 Index Index 264 FDS 265 Ldap 266 MIB 267 RMA 268 TCP 269 UDP 270 271 272