Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 3.0 MR7 manual Rfc, 217

Models: 3.0 MR7

1 234

Download 234 pages 61.67 Kb

Page 229

Index

SFTP 105, 155 SNMP 73 SOAP 46 SSH 46, 58, 160 telnet 46 TFTP 180 UDP 47, 85 VoIP 107

PSK 75

See also IPSec VPN tunnel

Q

quarantine 131 duplicate count 132 from device 73 ticket number 131

quota. See disk space

R

RADIUS 49, 51 RAID 62, 64

hot swap 64 status 32

raid monitor, dashboard 28 RAM usage 31 real-time viewer

log 91

network analyzer 143 reboot 33

refresh interval 35 remote access ports 46 remote administration 46, 73, 81

protocols 45, 46 renaming tabs 27 report

browsing reports 130

configuring data filter templates 121 configuring output templates 123 device registration 79, 91, 114 language customization 126 localization 126

profile 114

remote vulnerability sscan (RVS) 157 report schedules 118 vulnerability 166

reports

editing charts 116 reports in 3.0 MR7

forensic reports 202 FortiClient reports 212 FortiGate reports 185 FortiMail reports 203

reset

configuration 30, 33 resolve host names 35, 60, 108

logs 94, 143

network analyzer 143, 145 See also IP alias

restart 33 restore

configuration file 69

FortiAnalyzer Version 3.0 MR7 Administration Guide

default configuration 33 firmware 180

the FortiAnalyzer unit 180 restoring 2.80MR11 configuration 180 restoring configuration 180

RFC

1213 138

2665 138 roll settings

log 104

network analyzer 153

root (Management Administrative Domain) 23 route

default 47 static 47

RVS 157

job options 164 jobs 162 login 164 modules 161 port range 164 report 166

update immediately 71, 72 update schedule 71, 72 update subscriptions 71 upgrade file 71

version 71 See also FDN

See also FortiGuard Center Rx. See device permissions 74

S

scan

report 162 target 164

SCP

upload to 105, 155 search

content archive 107 download results 103, 153 logs 100

Network Analyzer logs 141, 150 tips 102, 152

user data 107

secure connection 57, 74, 86, 131 icon 74

security policy, Microsoft Windows 159 serial number 29

See also Device ID session 32, 35 sessions 35

SFTP

upload to 105, 155 share

group 54 NFS 47, 53 permissions 55, 56 users 53 Windows 53, 54

shut down 33 SMB 53 SMTP 135

05-30007-0082-20080908

217

Image 229

Fortinet 3.0 MR7 manual Rfc, 217

Contents

M I N I S T R a T I O N G U I D E Regulatory compliance TrademarksFCC Class a Part 15 CSA/CUS Contents Viewing session information Filtering session information Radius Server Administrator SettingsLog Receive Monitor Intrusion Activity Adding a routeDevice Content Archive 107Log Quarantine 131 Reports 113Alert 133 Network Analyzer 141Managing firmware versions 169 Tools 157Index 213 Appendix FortiAnalyzer reports in 3.0 MR7 185About this document IntroductionFortinet documentation Describes how to install and set up the FortiAnalyzer unitFortinet Tools and Documentation CD Customer service and technical supportFortinet Knowledge Center Comments on Fortinet technical documentationCustomer service and technical support High-end FortiAnalyzer units support additional What’s new for 3.0 MR7FortiAnalyzerVersion 3.0 MR7 Administration Guide Power supply monitoring for FortiAnlayzer-2000A and 4000A MR7 new features and changesRegistered devices’ hard limits CLI displays the tasks in the upload queueConfig log settings Set custom-field1-5 Report configuration enhancementsCustom fields for log messages ReportsAll other reports, for example VoIP reportsReportHeadquarters-2008-05-26-1030 Alert email configuration changes About administrative domains ADOMs Administrative Domains ADOMsAbout administrative domains ADOMs FortiAnalyzer Model Number of Administrative Domains To enable ADOMs Configuring ADOMsGo to System Admin Settings Enable Admin Domain Configuration Select OK Message appearsGo to Global Configuration System Admin Settings To disable ADOMsTo add or edit an Adom Select OK FortiAnalyzer unit logs you outAssigning administrators to an Adom Accessing ADOMs as the admin administratorTo access an Adom To assign an administrator to an AdomDashboard SystemSystem Information To refresh a Dashboard widget Go to System Dashboard To rearrange a Dashboard widget Go to System DashboardTo include a Dashboard widget Go to System Dashboard TabsTo omit a Dashboard widget Go to System Dashboard To add a tab Go to System DashboardRAID Monitor Double-click on the name of the tab and select the X symbolEnter a new name and press Enter To delete a tab Go to System DashboardRebuilding icon System Information05-30007-0082-20080908 Setting the timeChanging the firmware Changing the host nameLicense Information To change the host name Go to System DashboardViewing operational history System ResourcesRVS Plug-ins Device License Memory UsageFormatting the log disks System OperationTo format the log disks Go to System Dashboard Systems Operations area, select Format Log Disks Select OKAlert Message Console Resetting to the default configurationViewing alert console messages To view alert console messages Go to System DashboardViewing session information StatisticsSelect the delete icon ConnectionsReport Engine Filtering session informationTo view the session information Go to System Dashboard Statistics area, next to Connections, select DetailsType Log Receive MonitorTop N PeriodVirus Activity Intrusion ActivityDisplay by Virus Activity widget Top FTP TrafficTop Email Traffic, select Edit Top Email TrafficTop IM/P2P Traffic, select Edit in the title bar area Top IM/P2P TrafficTo edit information for Top Traffic Go to System Dashboard Top TrafficTop Traffic, select Edit in the title bar area Top Web Traffic, select Edit Top Web TrafficInterface NetworkAdministrative Changing interface settingsStatus ModifyAbout Fortinet Discovery Protocol To configure DNS settings Go to System Network DNSRouting Enter an IP address for a primary and secondary DNS serverSelect Create New Configure the following options AdminAdding a route To add a static route Go to System Network RoutingAdding or editing an administrator account Access Profile Changing an administrator’s passwordAccess Profile Admin DomainAuth Group To add a group Go to System Admin Auth GroupNone Read OnlyTo add a Radius server Go to System Admin Radius Server Administrator SettingsSelect Create New Configure the following and select OK Radius ServerMonitor Network SharingAdding share users To add a user account Go to System Network Sharing UserAdding share groups Configuring Windows sharesTo add a user group Go to System Network Sharing Group Permissions Assigning user permissionsRemote Clients Configuring NFS sharesDefault file permissions on NFS shares ConfigAutomatic file deletion and local log settings Log Level Allocated Disk Space MB FortiAnalyzer unit log settings Log LocallyConfiguring log aggregation FortiAnalyzer-800/800B FortiAnalyzer-400FortiAnalyzer-2000/2000A FortiAnalyzer-4000/4000AConfiguring an aggregation server Configuring an aggregation clientConfiguring log forwarding To forward log events Go to System Config Log ForwardingTo add an IP alias Go to System Config IP Alias Configuring IP aliasesTo edit an IP alias Go to System Config IP Alias To import the alias file Go to System Config IP AliasIP alias ranges Configuring RAIDRAID levels RAID LinearRAID 5 with hot spare Hot swapping hard disksFortiAnalyzer-800/800B disk drive configuration FortiAnalyzer-400 disk drive configurationFortiAnalyzer-2000/2000A disk drive configuration To swap a hard disk Go to System Config RAIDFortiAnalyzer-4000 disk drive configuration As well as from System Config RAID Configuring RAID on the FortiAnalyzer-400FortiAnalyzer-800/800B Level 1Size GB Configuring Ldap connectionsSelect Create New. Complete the following To define an Ldap server query Go to System Config LdapBackup & Restore MaintenanceBackup Back up the current configuration FortiGuard Center 10.10.1.108889 Scheduled UpdateEvery DailyMaintenance Viewing the device list DeviceShow Add DeviceUnregistered Device Options HardwareAction Secure Connection Disk Space MB Used/AllocatedTo delete a device Go to Device All Device Maximum number of devicesUnregistered vs. registered devices Configuring unregistered device connection attempt handling Or the following options for unknown device types Manually adding a device Device ID Device NameMode Member IDsGroup Membership FortiGate Interface Specification When Allocated Disk Space is All Used Devices PrivilegesClassifying FortiGate network interfaces For more information, see Manually adding a device on Configure the FortiGate deviceOn the FortiAnalyzer unit, go to Device All To enable the FortiAnalyzer unit to reply to FDP packetsGo to System Network Hardware Model Blocking device connection attemptsTo block a device Go to Device All Device Configuring device groupsTo unblock a device Go to Device All Blocked Device To delete a device group Go to Device Group Device Group To configure a device group Go to Device Group Device GroupGroup Name MembersViewing log messages LogViewing current log messages Viewing historical log messages Column SettingsTo view historical logs Go to Log Log Viewer Historical Browsing log filesImport Viewing log file contents To import a log file Go to Log Browse Importing a log fileTo download a whole log file Go to Log Browse Downloading a log fileTo download a partial log file Go to Log Browse Convert to CSV format Compress with gzipCustomizing the log view Select Download Current View Configure the followingDisplaying and arranging log columns To display logs in Raw or Formatted viewTo display or hide columns Filtering logsTo change the order of the columns To disable a filter To filter log messages by column contentsFiltering tips 101 Searching the logsFrom Searching the logsTo search the logs Go to Log Search Search tips103 Printing the search results 192.168.* action=loginDownloading the search results To download log search results Go to Log Search Rolling and uploading logs105 Not exceeded ExceedServer IP address Username107 108 Viewing content archives Content ArchivePrintable Version Delete associated content archive files View per page Page n of n Column SettingsTimeframe 109 Customizing the content archive viewFilter icons in the content logs 111 Searching full email content archives 113 Last activity114 Reports Configuring reportsConfiguring report layout Name Enter a name for the report Description To configure a report layout Go to Report Config Layout115 Header Logo Title Page LogoCategory 117 Editing charts in a report layoutMaximum Entries Top N Time Scale Advanced To edit a chartTo edit text Configuring report schedulesTo edit section 119Schedule Name To configure a report schedule Go to Report ScheduleReport layout Name ScheduleData Filter Log Data FilteringTime Period 121Data filter templates Configuring data filter templatesSources Filter logic123 Interfaces DestinationsPolicy IDs Day of the Week125 Configuring report output templatesOutput template FTP/SFTP/SCP Server Action127 Nomatch=No matching log data for this report Configuring language# Localization uses a Latin character set Comment is129 Font LanguagesSave the format file Language file error messages Error message Description131 Browsing reports 133 134 Viewing quarantined files QuarantineQuarantined files for a specific device SeeDate & Time ServiceChecksum Status DescriptionAlert Events AlertTriggers To add a new alert event Go to Alert Alert Event Adding an alert eventOutput Configuring alerts by email serverTo Email Address AddConfiguring Snmp traps and alerts Testing the mail server configurationEnable Smtp Server137 FortiAnalyzer Snmp support Adding an Snmp serverFortinet MIB System Traps Fortinet MIB Administrator AccountsFortinet MIB Logging Traps Fortinet MIB VPN TrapsAdding a Syslog server Configuring alerts by Syslog serverRFC-1213 MIB RFC-2665 Ethernet-like MIB141 Configure the following options, and select OK142 Network Analyzer Config log settings Set enableanalyzer yes EndExample network topology for Network Analyzer use Viewing current Network Analyzer log messages Viewing Network Analyzer log messages143 Viewing historical Network Analyzer log messages Protocol Protocol used when sending the traffic MessageBrowsing Network Analyzer log files Viewing Network Analyzer log file contentsPrintable Version Download Current View Resolve Service View n per page Page n of n Column Settings147 Downloading a Network Analyzer log fileDisplaying and arranging Network Analyzer log columns Customizing the Network Analyzer log view149 Filter icons in Network Analyzer150 Keywords Searching the Network Analyzer logsQuick Search Full SearchOther To search the logs Go to Tools Network Analyzer Search153 172.20.120.127 tcpSelect the download options that you want, then select OK Rolling and uploading Network Analyzer logs155 Log file should be rolled... even if size is not exceededSelect the protocol to use when uploading to the server Preparing for the vulnerability scan job Tools157 Preparing Windows target hosts 159 To enable NetBIOS Go to Start Control Panel Preparing Unix target hosts Viewing vulnerability scan modules161 Vulnerability Scan modules View modules with severity Details Configuring vulnerability scan jobs163 Target Job NameSelect Create New Complete the following Remote Authentication User NameScan Targets Quick ScanEmail Attachment File outputEmail Body 167 Viewing vulnerability scan reportsEnd Time File ExplorerFormats 169 File Explorer with Storage directory expanded170 Managing firmware versions Backing up your configurationBacking up your configuration using the CLI Backing up your configuration using the web-based managerTo back up your configuration file using the CLI Execute backup config filename addressip passwd171 Press any key to display configuration menu… Testing firmware before upgradingTo test the firmware image before upgrading Enter Local Address Enter Tftp server addressEnter firmware image file name image.out 173Upgrading your FortiAnalyzer unit Upgrading using the web-based managerUpgrading to FortiAnalyzer OnlyTo upgrade to FortiAnalyzer 3.0 using the web-based manager Upgrading using the CLITo upgrade to FortiAnalyzer 3.0 using the CLI Execute restore image namestr tftpip4Get system status Verifying the upgradeDowngrading to FortiLog Reverting to a previous firmware versionSelect OK Following message appears 177To downgrade using the CLI Downgrading to FortiLog 1.6 using the CLIExecute restore image tftp namestr tftpipv4 Execute restore image tftp image.out179 Restoring configuration settings on a FortiAnalyzer unit Restoring your configurationTo restore a firmware image to the FortiAnalyzer unit Execute rebootPress any key to display configuration menu When this message appearsEnter File Name image.out 181To restore configuration settings using the CLI Restoring your configuration settings using the CLIExecute restore config namestr tftpipv4 passwrd Execute restore config confall 192.168.1.168 ghrffdt123183 184 FortiGate reports Appendix FortiAnalyzer reports in 3.0 MR7185 Intrusion Activity reports MR6 reports MR7 reports Antivirus ActivityAntivirus Activity reports MR6 reports MR7 reports 187 Antivirus Activity reportsTop Virus Destinations over POP3 WebFilter Activity reports MR6 reports MR7 reports Webfilter Activity189 WebFilter Activity reports Antispam ActivityAntispam Activity reports MR6 reports MR7 reports Antispam Activity reports IM ActivityIM reports MR6 reports MR7 reports 191VoIP reports MR7 reports IM reportsVoIP reports Content Activity193 Network Activity Content Activity reports MR6 reports MR7 reportsNetwork Activity reports MR6 reports MR7 reports Network Activity reports Web Activity195 FTP Activity Mail ActivityReport, Top Mail Servers Connections remains unchanged VPN Activity Terminal ActivityFTP Activity reports Terminal Activity reports MR6 reports MR7 reportsVPN Activity reports MR6 reports MR7 reports Event ActivityEvent Activity reports MR6 reports MR7 reports Report, Top Event Categories by Status, was removed P2P ActivityEvent Activity reports P2P Activity reports MR6 reports MR7 reportsP2P Activity reports Audit Activity201 Summary ReportsAudit Forensic ReportsDetailed Report, Top Client Requests to Permitted Sites, was removedSummary FortiMail ReportsMail High Level 203Mail High Level reports Mail Sender reports MR6 reports MR7 reports Mail Sender205 Mail Destination IP Mail Recipient ActivityMail Sender reports Mail Recipient Activity reports MR6 reports MR7 reportsMail Destination IP reports MR6 reports MR7 reports Spam SenderSpam Sender reports MR6 reports MR7 reports 207Spam Sender reports Spam RecipientSpam Recipient reports MR6 reports MR7 reports Virus Sender Spam Destination IPSpam Recipient reports Spam Destination IP reports MR6 reports MR7 reportsVirus Sender reports MR6 reports MR7 reports Virus Sender reports Virus RecipientVirus Recipient reports MR6 reports MR7 reports 211Virus Destination IP FortiClient Reports213 IndexFDN 215 FTPMail server 135 Main Menu 20 managing firmware 217 RFCSee also protocol test 219 Index FortiAnalyzer Version 3.0 MR7 Administration Guide