Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 3.0 MR7 manual Reports 113, Quarantine 131, Alert 133, Network Analyzer 141

Models: 3.0 MR7

1 234

Download 234 pages 61.67 Kb

Page 6

Contents

Customizing the content archive view	108
Displaying and arranging log columns	109
Filtering logs	110
Filtering tips	110
Searching full email content archives	111
Reports	113
Configuring reports	113
Configuring report layout	114
Editing charts in a report layout	116
Configuring report schedules	118
Configuring data filter templates	121
Configuring report output templates	123
Configuring language	126
Browsing reports	130
Quarantine	131
Viewing quarantined files	131
Alert	133
Alert Events	133
Adding an alert event	133
Output	135
Configuring alerts by email server	135
Testing the mail server configuration	136
Configuring SNMP traps and alerts	136
Adding an SNMP server	137
FortiAnalyzer SNMP support	138
Configuring alerts by Syslog server	140
Adding a Syslog server	140
Network Analyzer	141
Connecting the FortiAnalyzer unit to analyze network traffic	141
Viewing Network Analyzer log messages	142
Viewing current Network Analyzer log messages	143
Viewing historical Network Analyzer log messages	143
Browsing Network Analyzer log files	144
Viewing Network Analyzer log file contents	145
Downloading a Network Analyzer log file	147
Customizing the Network Analyzer log view	148
Displaying and arranging log columns	148
Filtering logs	149
Filtering tips	150

	FortiAnalyzer Version 3.0 MR7 Administration Guide
6	05-30007-0082-20080908

Image 6

Fortinet 3.0 MR7 manual Reports 113, Quarantine 131, Alert 133, Network Analyzer 141

Contents

M I N I S T R a T I O N G U I D E Trademarks Regulatory complianceFCC Class a Part 15 CSA/CUS Contents Log Receive Monitor Intrusion Activity Radius Server Administrator SettingsViewing session information Filtering session information Adding a routeContent Archive 107 DeviceLog Alert 133 Reports 113Quarantine 131 Network Analyzer 141Tools 157 Managing firmware versions 169Appendix FortiAnalyzer reports in 3.0 MR7 185 Index 213Introduction About this documentDescribes how to install and set up the FortiAnalyzer unit Fortinet documentationFortinet Knowledge Center Customer service and technical supportFortinet Tools and Documentation CD Comments on Fortinet technical documentationCustomer service and technical support What’s new for 3.0 MR7 High-end FortiAnalyzer units support additionalFortiAnalyzerVersion 3.0 MR7 Administration Guide Registered devices’ hard limits MR7 new features and changesPower supply monitoring for FortiAnlayzer-2000A and 4000A CLI displays the tasks in the upload queueCustom fields for log messages Report configuration enhancementsConfig log settings Set custom-field1-5 ReportsVoIP reports All other reports, for exampleReportHeadquarters-2008-05-26-1030 Alert email configuration changes Administrative Domains ADOMs About administrative domains ADOMsAbout administrative domains ADOMs FortiAnalyzer Model Number of Administrative Domains Go to System Admin Settings Configuring ADOMsTo enable ADOMs Enable Admin Domain Configuration Select OK Message appearsTo add or edit an Adom To disable ADOMsGo to Global Configuration System Admin Settings Select OK FortiAnalyzer unit logs you outTo access an Adom Accessing ADOMs as the admin administratorAssigning administrators to an Adom To assign an administrator to an AdomSystem DashboardSystem Information To rearrange a Dashboard widget Go to System Dashboard To refresh a Dashboard widget Go to System DashboardTo omit a Dashboard widget Go to System Dashboard TabsTo include a Dashboard widget Go to System Dashboard To add a tab Go to System DashboardEnter a new name and press Enter Double-click on the name of the tab and select the X symbolRAID Monitor To delete a tab Go to System DashboardSystem Information Rebuilding iconSetting the time 05-30007-0082-20080908License Information Changing the host nameChanging the firmware To change the host name Go to System DashboardRVS Plug-ins Device License System ResourcesViewing operational history Memory UsageTo format the log disks Go to System Dashboard System OperationFormatting the log disks Systems Operations area, select Format Log Disks Select OKViewing alert console messages Resetting to the default configurationAlert Message Console To view alert console messages Go to System DashboardSelect the delete icon StatisticsViewing session information ConnectionsTo view the session information Go to System Dashboard Filtering session informationReport Engine Statistics area, next to Connections, select DetailsTop N Log Receive MonitorType PeriodIntrusion Activity Virus ActivityDisplay by Top FTP Traffic Virus Activity widgetTop Email Traffic Top Email Traffic, select EditTop IM/P2P Traffic Top IM/P2P Traffic, select Edit in the title bar areaTop Traffic To edit information for Top Traffic Go to System DashboardTop Traffic, select Edit in the title bar area Top Web Traffic Top Web Traffic, select EditNetwork InterfaceStatus Changing interface settingsAdministrative ModifyRouting To configure DNS settings Go to System Network DNSAbout Fortinet Discovery Protocol Enter an IP address for a primary and secondary DNS serverAdding a route AdminSelect Create New Configure the following options To add a static route Go to System Network RoutingAdding or editing an administrator account Access Profile Changing an administrator’s passwordAccess Profile Admin DomainNone To add a group Go to System Admin Auth GroupAuth Group Read OnlySelect Create New Configure the following and select OK Administrator SettingsTo add a Radius server Go to System Admin Radius Server Radius ServerAdding share users Network SharingMonitor To add a user account Go to System Network Sharing UserConfiguring Windows shares Adding share groupsTo add a user group Go to System Network Sharing Group Assigning user permissions PermissionsConfiguring NFS shares Remote ClientsConfig Default file permissions on NFS sharesAutomatic file deletion and local log settings FortiAnalyzer unit log settings Log Locally Log Level Allocated Disk Space MBConfiguring log aggregation FortiAnalyzer-2000/2000A FortiAnalyzer-400FortiAnalyzer-800/800B FortiAnalyzer-4000/4000AConfiguring log forwarding Configuring an aggregation clientConfiguring an aggregation server To forward log events Go to System Config Log ForwardingTo edit an IP alias Go to System Config IP Alias Configuring IP aliasesTo add an IP alias Go to System Config IP Alias To import the alias file Go to System Config IP AliasConfiguring RAID IP alias rangesRAID levels Linear RAIDHot swapping hard disks RAID 5 with hot spareFortiAnalyzer-400 disk drive configuration FortiAnalyzer-800/800B disk drive configurationTo swap a hard disk Go to System Config RAID FortiAnalyzer-2000/2000A disk drive configurationFortiAnalyzer-4000 disk drive configuration FortiAnalyzer-800/800B Configuring RAID on the FortiAnalyzer-400As well as from System Config RAID Level 1Configuring Ldap connections Size GBTo define an Ldap server query Go to System Config Ldap Select Create New. Complete the followingMaintenance Backup & RestoreBackup Back up the current configuration FortiGuard Center 10.10.1.108889 Every UpdateScheduled DailyMaintenance Device Viewing the device listUnregistered Device Options Add DeviceShow HardwareSecure Connection Disk Space MB Used/Allocated ActionMaximum number of devices To delete a device Go to Device All DeviceUnregistered vs. registered devices Configuring unregistered device connection attempt handling Or the following options for unknown device types Manually adding a device Mode Device NameDevice ID Member IDsWhen Allocated Disk Space is All Used Devices Privileges Group Membership FortiGate Interface SpecificationClassifying FortiGate network interfaces Configure the FortiGate device For more information, see Manually adding a device onTo enable the FortiAnalyzer unit to reply to FDP packets On the FortiAnalyzer unit, go to Device AllGo to System Network Blocking device connection attempts Hardware ModelConfiguring device groups To block a device Go to Device All DeviceTo unblock a device Go to Device All Blocked Device Group Name To configure a device group Go to Device Group Device GroupTo delete a device group Go to Device Group Device Group MembersLog Viewing log messagesViewing current log messages Viewing historical log messages Settings ColumnBrowsing log files To view historical logs Go to Log Log Viewer HistoricalImport Viewing log file contents Importing a log file To import a log file Go to Log BrowseTo download a partial log file Go to Log Browse Downloading a log fileTo download a whole log file Go to Log Browse Convert to CSV format Compress with gzipDisplaying and arranging log columns Select Download Current View Configure the followingCustomizing the log view To display logs in Raw or Formatted viewFiltering logs To display or hide columnsTo change the order of the columns To filter log messages by column contents To disable a filterFiltering tips Searching the logs 101Searching the logs FromSearch tips To search the logs Go to Log Search103 192.168.* action=login Printing the search resultsDownloading the search results Rolling and uploading logs To download log search results Go to Log Search105 Server IP address ExceedNot exceeded Username107 108 Content Archive Viewing content archivesView per page Page n of n Column Settings Printable Version Delete associated content archive filesTimeframe Customizing the content archive view 109Filter icons in the content logs 111 Searching full email content archives Last activity 113114 Configuring reports ReportsConfiguring report layout To configure a report layout Go to Report Config Layout Name Enter a name for the report Description115 Title Page Logo Header LogoCategory Editing charts in a report layout 117To edit a chart Maximum Entries Top N Time Scale AdvancedTo edit section Configuring report schedulesTo edit text 119Report layout Name To configure a report schedule Go to Report ScheduleSchedule Name ScheduleTime Period Log Data FilteringData Filter 121Configuring data filter templates Data filter templatesFilter logic Sources123 Policy IDs DestinationsInterfaces Day of the WeekConfiguring report output templates 125FTP/SFTP/SCP Server Action Output template127 Configuring language Nomatch=No matching log data for this reportComment is # Localization uses a Latin character set129 Languages FontLanguage file error messages Error message Description Save the format file131 Browsing reports 133 134 Quarantined files for a specific device QuarantineViewing quarantined files SeeChecksum ServiceDate & Time Status DescriptionAlert Alert EventsTriggers Adding an alert event To add a new alert event Go to Alert Alert EventTo Email Address Configuring alerts by email serverOutput AddEnable Testing the mail server configurationConfiguring Snmp traps and alerts Smtp Server137 Adding an Snmp server FortiAnalyzer Snmp supportFortinet MIB Logging Traps Fortinet MIB Administrator AccountsFortinet MIB System Traps Fortinet MIB VPN TrapsRFC-1213 MIB Configuring alerts by Syslog serverAdding a Syslog server RFC-2665 Ethernet-like MIBConfigure the following options, and select OK 141142 Config log settings Set enableanalyzer yes End Network AnalyzerExample network topology for Network Analyzer use Viewing Network Analyzer log messages Viewing current Network Analyzer log messages143 Protocol Protocol used when sending the traffic Message Viewing historical Network Analyzer log messagesViewing Network Analyzer log file contents Browsing Network Analyzer log filesResolve Service View n per page Page n of n Column Settings Printable Version Download Current ViewDownloading a Network Analyzer log file 147Customizing the Network Analyzer log view Displaying and arranging Network Analyzer log columnsFilter icons in Network Analyzer 149150 Quick Search Searching the Network Analyzer logsKeywords Full SearchTo search the logs Go to Tools Network Analyzer Search Other172.20.120.127 tcp 153Rolling and uploading Network Analyzer logs Select the download options that you want, then select OKLog file should be rolled... even if size is not exceeded 155Select the protocol to use when uploading to the server Tools Preparing for the vulnerability scan job157 Preparing Windows target hosts 159 To enable NetBIOS Go to Start Control Panel Viewing vulnerability scan modules Preparing Unix target hosts161 Vulnerability Scan modules View modules with severity Configuring vulnerability scan jobs Details163 Job Name TargetScan Targets Remote Authentication User NameSelect Create New Complete the following Quick ScanFile output Email AttachmentEmail Body Viewing vulnerability scan reports 167File Explorer End TimeFormats File Explorer with Storage directory expanded 169170 Backing up your configuration Managing firmware versionsTo back up your configuration file using the CLI Backing up your configuration using the web-based managerBacking up your configuration using the CLI Execute backup config filename addressip passwd171 Testing firmware before upgrading Press any key to display configuration menu…To test the firmware image before upgrading Enter firmware image file name image.out Enter Tftp server addressEnter Local Address 173Upgrading to FortiAnalyzer Upgrading using the web-based managerUpgrading your FortiAnalyzer unit OnlyTo upgrade to FortiAnalyzer 3.0 using the CLI Upgrading using the CLITo upgrade to FortiAnalyzer 3.0 using the web-based manager Execute restore image namestr tftpip4Verifying the upgrade Get system statusSelect OK Following message appears Reverting to a previous firmware versionDowngrading to FortiLog 177Execute restore image tftp namestr tftpipv4 Downgrading to FortiLog 1.6 using the CLITo downgrade using the CLI Execute restore image tftp image.out179 To restore a firmware image to the FortiAnalyzer unit Restoring your configurationRestoring configuration settings on a FortiAnalyzer unit Execute rebootEnter File Name image.out When this message appearsPress any key to display configuration menu 181Execute restore config namestr tftpipv4 passwrd Restoring your configuration settings using the CLITo restore configuration settings using the CLI Execute restore config confall 192.168.1.168 ghrffdt123183 184 Appendix FortiAnalyzer reports in 3.0 MR7 FortiGate reports185 Antivirus Activity Intrusion Activity reports MR6 reports MR7 reportsAntivirus Activity reports MR6 reports MR7 reports Antivirus Activity reports 187Top Virus Destinations over POP3 Webfilter Activity WebFilter Activity reports MR6 reports MR7 reports189 Antispam Activity WebFilter Activity reportsAntispam Activity reports MR6 reports MR7 reports IM reports MR6 reports MR7 reports IM ActivityAntispam Activity reports 191IM reports VoIP reports MR7 reportsContent Activity VoIP reports193 Content Activity reports MR6 reports MR7 reports Network ActivityNetwork Activity reports MR6 reports MR7 reports Web Activity Network Activity reports195 Mail Activity FTP ActivityReport, Top Mail Servers Connections remains unchanged FTP Activity reports Terminal ActivityVPN Activity Terminal Activity reports MR6 reports MR7 reportsEvent Activity VPN Activity reports MR6 reports MR7 reportsEvent Activity reports MR6 reports MR7 reports Event Activity reports P2P ActivityReport, Top Event Categories by Status, was removed P2P Activity reports MR6 reports MR7 reportsAudit Activity P2P Activity reportsSummary Reports 201Detailed Forensic ReportsAudit Report, Top Client Requests to Permitted Sites, was removedMail High Level FortiMail ReportsSummary 203Mail High Level reports Mail Sender Mail Sender reports MR6 reports MR7 reports205 Mail Sender reports Mail Recipient ActivityMail Destination IP Mail Recipient Activity reports MR6 reports MR7 reportsSpam Sender reports MR6 reports MR7 reports Spam SenderMail Destination IP reports MR6 reports MR7 reports 207Spam Recipient Spam Sender reportsSpam Recipient reports MR6 reports MR7 reports Spam Recipient reports Spam Destination IPVirus Sender Spam Destination IP reports MR6 reports MR7 reportsVirus Sender reports MR6 reports MR7 reports Virus Recipient reports MR6 reports MR7 reports Virus RecipientVirus Sender reports 211FortiClient Reports Virus Destination IPIndex 213FDN FTP 215Mail server 135 Main Menu 20 managing firmware RFC 217See also protocol test 219 Index FortiAnalyzer Version 3.0 MR7 Administration Guide