Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 3.0 MR7 manual Mail server 135 Main Menu 20 managing firmware

Models: 3.0 MR7

1 234

Download 234 pages 61.67 Kb

Page 228

Index

M

mail server 135 Main Menu 20 managing firmware

backing up configuration using the CLI 170 backing up configuration using web-based manag-

er 170

backing up log files 170 downgrading to FortiLog 1.6 177 downgrading to FortiLog 1.6 using the CLI 178 patch releases 169

restoring configuration using CLI 180 restoring configuration using the CLI 182 restoring configuration using web-based manager

182

testing firmware before upgrading 172 upgrading to FortiAnalyzer 3.0 174 upgrading using the CLI 175 upgrading using web-based manager 174 verifying downgrade to FortiLog 1.6 178 verifying upgrade to FortiAnalyzer 3.0 176

maximum

allowed devices 76 memory status 31 MIB 138

Microsoft Windows 157 mirroring 63

See also RAID

modules, vulnerability. See RVS

N

NAS 53, 54 NAT device 71 NetBIOS 158 NetBIOS. See share network

attached server (NAS) 53, 54 file system (NFS) 53

mask 45, 46 sniffer 144 time protocol 29

network analyzer browse 144 column view 143 delete after download 155 download logs 147 enable 141, 154

filter 149 gzip 155 historical viewer 143 real-time viewer 143

resolve host names 143, 145 roll settings 153

upload to 155 network analyzer logs column view 148

formatted view 148 NFS 53

share 47 NTP 29

O

OFTP 86 override server 71

See also FDS overwrite older messages 82

P

password 48, 49 configuration file 70 log upload 155 share user 54

patch releases 169 PDF objects 127 permissions 19, 56 admin 48, 50 device 74, 83 Guest 159 incorrect 157 share 55, 56

PIN 52

PING 46 port

12329

2246, 58

2346

3000 46

38968

44346

51486

69180

8046

8080 46 destination 143 device 84 scan 157, 164

port address translation (PAT) 158 port forwarding 158

port scan 157 power cycle 33 power off 33

pre-shared secret (PSK) 75 primary unit 82, 83

privileges, admin. See also permissions, admin 50 profile, report 114

protocol 73 ESP 86

FDP 46, 47, 85

FTP 105, 155 HTTP 46 HTTPS 46 ICMP (ping) 46

ICQ See content archive IKE 86

LDAP 68 NetBIOS 158 NetBIOS. See share NFS 54

NTP 29

OFTP 86 RADIUS 49 SCP 105, 155

FortiAnalyzer Version 3.0 MR7 Administration Guide

216	05-30007-0082-20080908

Image 228

Fortinet 3.0 MR7 manual Mail server 135 Main Menu 20 managing firmware

Contents

M I N I S T R a T I O N G U I D E Trademarks Regulatory complianceFCC Class a Part 15 CSA/CUS Contents Radius Server Administrator Settings Viewing session information Filtering session informationLog Receive Monitor Intrusion Activity Adding a routeContent Archive 107 DeviceLog Reports 113 Quarantine 131Alert 133 Network Analyzer 141Tools 157 Managing firmware versions 169Appendix FortiAnalyzer reports in 3.0 MR7 185 Index 213Introduction About this documentDescribes how to install and set up the FortiAnalyzer unit Fortinet documentationCustomer service and technical support Fortinet Tools and Documentation CDFortinet Knowledge Center Comments on Fortinet technical documentationCustomer service and technical support What’s new for 3.0 MR7 High-end FortiAnalyzer units support additionalFortiAnalyzerVersion 3.0 MR7 Administration Guide MR7 new features and changes Power supply monitoring for FortiAnlayzer-2000A and 4000ARegistered devices’ hard limits CLI displays the tasks in the upload queueReport configuration enhancements Config log settings Set custom-field1-5Custom fields for log messages ReportsVoIP reports All other reports, for exampleReportHeadquarters-2008-05-26-1030 Alert email configuration changes Administrative Domains ADOMs About administrative domains ADOMsAbout administrative domains ADOMs FortiAnalyzer Model Number of Administrative Domains Configuring ADOMs To enable ADOMsGo to System Admin Settings Enable Admin Domain Configuration Select OK Message appearsTo disable ADOMs Go to Global Configuration System Admin SettingsTo add or edit an Adom Select OK FortiAnalyzer unit logs you outAccessing ADOMs as the admin administrator Assigning administrators to an AdomTo access an Adom To assign an administrator to an AdomSystem DashboardSystem Information To rearrange a Dashboard widget Go to System Dashboard To refresh a Dashboard widget Go to System DashboardTabs To include a Dashboard widget Go to System DashboardTo omit a Dashboard widget Go to System Dashboard To add a tab Go to System DashboardDouble-click on the name of the tab and select the X symbol RAID MonitorEnter a new name and press Enter To delete a tab Go to System DashboardSystem Information Rebuilding iconSetting the time 05-30007-0082-20080908Changing the host name Changing the firmwareLicense Information To change the host name Go to System DashboardSystem Resources Viewing operational historyRVS Plug-ins Device License Memory UsageSystem Operation Formatting the log disksTo format the log disks Go to System Dashboard Systems Operations area, select Format Log Disks Select OKResetting to the default configuration Alert Message ConsoleViewing alert console messages To view alert console messages Go to System DashboardStatistics Viewing session informationSelect the delete icon ConnectionsFiltering session information Report EngineTo view the session information Go to System Dashboard Statistics area, next to Connections, select DetailsLog Receive Monitor TypeTop N PeriodIntrusion Activity Virus ActivityDisplay by Top FTP Traffic Virus Activity widgetTop Email Traffic Top Email Traffic, select EditTop IM/P2P Traffic Top IM/P2P Traffic, select Edit in the title bar areaTop Traffic To edit information for Top Traffic Go to System DashboardTop Traffic, select Edit in the title bar area Top Web Traffic Top Web Traffic, select EditNetwork InterfaceChanging interface settings AdministrativeStatus ModifyTo configure DNS settings Go to System Network DNS About Fortinet Discovery ProtocolRouting Enter an IP address for a primary and secondary DNS serverAdmin Select Create New Configure the following optionsAdding a route To add a static route Go to System Network RoutingAdding or editing an administrator account Changing an administrator’s password Access ProfileAccess Profile Admin DomainTo add a group Go to System Admin Auth Group Auth GroupNone Read OnlyAdministrator Settings To add a Radius server Go to System Admin Radius ServerSelect Create New Configure the following and select OK Radius ServerNetwork Sharing MonitorAdding share users To add a user account Go to System Network Sharing UserConfiguring Windows shares Adding share groupsTo add a user group Go to System Network Sharing Group Assigning user permissions PermissionsConfiguring NFS shares Remote ClientsConfig Default file permissions on NFS sharesAutomatic file deletion and local log settings FortiAnalyzer unit log settings Log Locally Log Level Allocated Disk Space MBConfiguring log aggregation FortiAnalyzer-400 FortiAnalyzer-800/800BFortiAnalyzer-2000/2000A FortiAnalyzer-4000/4000AConfiguring an aggregation client Configuring an aggregation serverConfiguring log forwarding To forward log events Go to System Config Log ForwardingConfiguring IP aliases To add an IP alias Go to System Config IP AliasTo edit an IP alias Go to System Config IP Alias To import the alias file Go to System Config IP AliasConfiguring RAID IP alias rangesRAID levels Linear RAIDHot swapping hard disks RAID 5 with hot spareFortiAnalyzer-400 disk drive configuration FortiAnalyzer-800/800B disk drive configurationTo swap a hard disk Go to System Config RAID FortiAnalyzer-2000/2000A disk drive configurationFortiAnalyzer-4000 disk drive configuration Configuring RAID on the FortiAnalyzer-400 As well as from System Config RAIDFortiAnalyzer-800/800B Level 1Configuring Ldap connections Size GBTo define an Ldap server query Go to System Config Ldap Select Create New. Complete the followingMaintenance Backup & RestoreBackup Back up the current configuration FortiGuard Center 10.10.1.108889 Update ScheduledEvery DailyMaintenance Device Viewing the device listAdd Device ShowUnregistered Device Options HardwareSecure Connection Disk Space MB Used/Allocated ActionMaximum number of devices To delete a device Go to Device All DeviceUnregistered vs. registered devices Configuring unregistered device connection attempt handling Or the following options for unknown device types Manually adding a device Device Name Device IDMode Member IDsWhen Allocated Disk Space is All Used Devices Privileges Group Membership FortiGate Interface SpecificationClassifying FortiGate network interfaces Configure the FortiGate device For more information, see Manually adding a device onTo enable the FortiAnalyzer unit to reply to FDP packets On the FortiAnalyzer unit, go to Device AllGo to System Network Blocking device connection attempts Hardware ModelConfiguring device groups To block a device Go to Device All DeviceTo unblock a device Go to Device All Blocked Device To configure a device group Go to Device Group Device Group To delete a device group Go to Device Group Device GroupGroup Name MembersLog Viewing log messagesViewing current log messages Viewing historical log messages Settings ColumnBrowsing log files To view historical logs Go to Log Log Viewer HistoricalImport Viewing log file contents Importing a log file To import a log file Go to Log BrowseDownloading a log file To download a whole log file Go to Log BrowseTo download a partial log file Go to Log Browse Convert to CSV format Compress with gzipSelect Download Current View Configure the following Customizing the log viewDisplaying and arranging log columns To display logs in Raw or Formatted viewFiltering logs To display or hide columnsTo change the order of the columns To filter log messages by column contents To disable a filterFiltering tips Searching the logs 101Searching the logs FromSearch tips To search the logs Go to Log Search103 192.168.* action=login Printing the search resultsDownloading the search results Rolling and uploading logs To download log search results Go to Log Search105 Exceed Not exceededServer IP address Username107 108 Content Archive Viewing content archivesView per page Page n of n Column Settings Printable Version Delete associated content archive filesTimeframe Customizing the content archive view 109Filter icons in the content logs 111 Searching full email content archives Last activity 113114 Configuring reports ReportsConfiguring report layout To configure a report layout Go to Report Config Layout Name Enter a name for the report Description115 Title Page Logo Header LogoCategory Editing charts in a report layout 117To edit a chart Maximum Entries Top N Time Scale AdvancedConfiguring report schedules To edit textTo edit section 119To configure a report schedule Go to Report Schedule Schedule NameReport layout Name ScheduleLog Data Filtering Data FilterTime Period 121Configuring data filter templates Data filter templatesFilter logic Sources123 Destinations InterfacesPolicy IDs Day of the WeekConfiguring report output templates 125FTP/SFTP/SCP Server Action Output template127 Configuring language Nomatch=No matching log data for this reportComment is # Localization uses a Latin character set129 Languages FontLanguage file error messages Error message Description Save the format file131 Browsing reports 133 134 Quarantine Viewing quarantined filesQuarantined files for a specific device SeeService Date & TimeChecksum Status DescriptionAlert Alert EventsTriggers Adding an alert event To add a new alert event Go to Alert Alert EventConfiguring alerts by email server OutputTo Email Address AddTesting the mail server configuration Configuring Snmp traps and alertsEnable Smtp Server137 Adding an Snmp server FortiAnalyzer Snmp supportFortinet MIB Administrator Accounts Fortinet MIB System TrapsFortinet MIB Logging Traps Fortinet MIB VPN TrapsConfiguring alerts by Syslog server Adding a Syslog serverRFC-1213 MIB RFC-2665 Ethernet-like MIBConfigure the following options, and select OK 141142 Config log settings Set enableanalyzer yes End Network AnalyzerExample network topology for Network Analyzer use Viewing Network Analyzer log messages Viewing current Network Analyzer log messages143 Protocol Protocol used when sending the traffic Message Viewing historical Network Analyzer log messagesViewing Network Analyzer log file contents Browsing Network Analyzer log filesResolve Service View n per page Page n of n Column Settings Printable Version Download Current ViewDownloading a Network Analyzer log file 147Customizing the Network Analyzer log view Displaying and arranging Network Analyzer log columnsFilter icons in Network Analyzer 149150 Searching the Network Analyzer logs KeywordsQuick Search Full SearchTo search the logs Go to Tools Network Analyzer Search Other172.20.120.127 tcp 153Rolling and uploading Network Analyzer logs Select the download options that you want, then select OKLog file should be rolled... even if size is not exceeded 155Select the protocol to use when uploading to the server Tools Preparing for the vulnerability scan job157 Preparing Windows target hosts 159 To enable NetBIOS Go to Start Control Panel Viewing vulnerability scan modules Preparing Unix target hosts161 Vulnerability Scan modules View modules with severity Configuring vulnerability scan jobs Details163 Job Name TargetRemote Authentication User Name Select Create New Complete the followingScan Targets Quick ScanFile output Email AttachmentEmail Body Viewing vulnerability scan reports 167File Explorer End TimeFormats File Explorer with Storage directory expanded 169170 Backing up your configuration Managing firmware versionsBacking up your configuration using the web-based manager Backing up your configuration using the CLITo back up your configuration file using the CLI Execute backup config filename addressip passwd171 Testing firmware before upgrading Press any key to display configuration menu…To test the firmware image before upgrading Enter Tftp server address Enter Local AddressEnter firmware image file name image.out 173Upgrading using the web-based manager Upgrading your FortiAnalyzer unitUpgrading to FortiAnalyzer OnlyUpgrading using the CLI To upgrade to FortiAnalyzer 3.0 using the web-based managerTo upgrade to FortiAnalyzer 3.0 using the CLI Execute restore image namestr tftpip4Verifying the upgrade Get system statusReverting to a previous firmware version Downgrading to FortiLogSelect OK Following message appears 177Downgrading to FortiLog 1.6 using the CLI To downgrade using the CLIExecute restore image tftp namestr tftpipv4 Execute restore image tftp image.out179 Restoring your configuration Restoring configuration settings on a FortiAnalyzer unitTo restore a firmware image to the FortiAnalyzer unit Execute rebootWhen this message appears Press any key to display configuration menuEnter File Name image.out 181Restoring your configuration settings using the CLI To restore configuration settings using the CLIExecute restore config namestr tftpipv4 passwrd Execute restore config confall 192.168.1.168 ghrffdt123183 184 Appendix FortiAnalyzer reports in 3.0 MR7 FortiGate reports185 Antivirus Activity Intrusion Activity reports MR6 reports MR7 reportsAntivirus Activity reports MR6 reports MR7 reports Antivirus Activity reports 187Top Virus Destinations over POP3 Webfilter Activity WebFilter Activity reports MR6 reports MR7 reports189 Antispam Activity WebFilter Activity reportsAntispam Activity reports MR6 reports MR7 reports IM Activity Antispam Activity reportsIM reports MR6 reports MR7 reports 191IM reports VoIP reports MR7 reportsContent Activity VoIP reports193 Content Activity reports MR6 reports MR7 reports Network ActivityNetwork Activity reports MR6 reports MR7 reports Web Activity Network Activity reports195 Mail Activity FTP ActivityReport, Top Mail Servers Connections remains unchanged Terminal Activity VPN ActivityFTP Activity reports Terminal Activity reports MR6 reports MR7 reportsEvent Activity VPN Activity reports MR6 reports MR7 reportsEvent Activity reports MR6 reports MR7 reports P2P Activity Report, Top Event Categories by Status, was removedEvent Activity reports P2P Activity reports MR6 reports MR7 reportsAudit Activity P2P Activity reportsSummary Reports 201Forensic Reports AuditDetailed Report, Top Client Requests to Permitted Sites, was removedFortiMail Reports SummaryMail High Level 203Mail High Level reports Mail Sender Mail Sender reports MR6 reports MR7 reports205 Mail Recipient Activity Mail Destination IPMail Sender reports Mail Recipient Activity reports MR6 reports MR7 reportsSpam Sender Mail Destination IP reports MR6 reports MR7 reportsSpam Sender reports MR6 reports MR7 reports 207Spam Recipient Spam Sender reportsSpam Recipient reports MR6 reports MR7 reports Spam Destination IP Virus SenderSpam Recipient reports Spam Destination IP reports MR6 reports MR7 reportsVirus Sender reports MR6 reports MR7 reports Virus Recipient Virus Sender reportsVirus Recipient reports MR6 reports MR7 reports 211FortiClient Reports Virus Destination IPIndex 213FDN FTP 215Mail server 135 Main Menu 20 managing firmware RFC 217See also protocol test 219 Index FortiAnalyzer Version 3.0 MR7 Administration Guide