Antivirus scanning, 260 | Fortinet 400 manual

Antivirus scanning	Antivirus protection

6Configure the FortiGate unit to send an alert email when it blocks or deletes an infected file. See “Configuring alert email” in the Logging and Message Reference Guide.

Note: To receive virus log messages, see “Configuring logging”, and for information about log message content and format, see “Virus log messages” in the Logging Configuration and Reference Guide

Antivirus scanning

Virus scanning intercepts most files (including files compressed with up to 12 layers of compression using zip, rar, gzip, tar, upx, and OLE) in the content streams for which antivirus protection as been enabled. Each file is tested to determine the file type and to determine the most effective method of scanning the file for viruses. For example, binary files are scanned using binary virus scanning and Microsoft Office files containing macros are scanned for macro viruses.

FortiGate virus scanning does not scan the following file types:

•cdimage

•floppy image

•.ace

•.bzip2

•.Tar+Gzip+Bzip2

If a file is found to contain a virus it is removed from the content stream and replaced with a replacement message.

If your FortiGate unit includes a hard disk and if quarantine is enabled for infected files for the matching traffic protocol, the FortiGate unit adds the file to the quarantine list.

To scan FortiGate firewall traffic for viruses

1Select antivirus scanning in a content profile. See “Adding a content profile” on page 197.

2Optionally select Quarantine in this content profile.

3Add this content profile to firewall policies to apply virus scanning to the traffic controlled by the firewall policy.

See “Adding a content profile to a policy” on page 199.

4Configure file quarantine settings to control the quarantining of infected files. See “Configuring quarantine options” on page 265.

260	Fortinet Inc.

Image 260

Fortinet 400 manual Antivirus scanning, 260, To scan FortiGate firewall traffic for viruses

Contents

Installation and Configuration Guide August Trademarks Regulatory Compliance Table of Contents NAT/Route mode installation High availability System status Network configuration 133 System configuration 157 Users and authentication 201 IPSec VPN 209 Network Intrusion Detection System Nids 249 Email filter 277 Glossary 295 Index 299 Contents Introduction Antivirus protection Web content filtering Email filtering NAT/Route mode Firewall Transparent mode Network intrusion detection VPN High availability Secure installation, configuration, and management Web-based manager Command line interface Logging and reporting What’s new in Version Firewall Replacement messagesUsers and authentication Email filter AntivirusWeb Filter About this document Document conventions Fortinet documentation Comments on Fortinet technical documentation Customer service and technical support Getting started Package contents Mounting Powering on Power requirementsEnvironmental specifications FortiGate-400 LED indicators Connecting to the web-based manager Connecting to the web-based manager Connecting to the command line interface CLI Factory default FortiGate configuration settingsBits per second 9600 Data bits Parity Stop bits Flow control Interface Factory default NAT/Route mode network configurationAccount Factory default Transparent mode network configuration Factory default firewall configuration Factory default content profiles Strict content profile Scan content profileStrict content profile Options Scan content profile Options Web content profile Unfiltered content profileWeb content profile Options Unfiltered content profile Options Planning your FortiGate configuration NAT/Route mode with multiple external network connections Example NAT/Route mode network configuration Configuration options Setup Wizard FortiGate model maximum values matrix Front keypad and LCD Next steps Next steps Getting started NAT/Route mode settings Administrator Password Interface NAT/Route mode installationPreparing to configure NAT/Route mode Reconnecting to the web-based manager Using the setup wizardStarting the setup wizard Using the front control buttons and LCD Using the command line interfaceConfiguring the FortiGate unit to operate in NAT/Route mode Configuring NAT/Route mode IP addresses Set system interface port2 mode static ip IPaddress netmask Connecting the FortiGate unit to your networks Configuring your network Completing the configurationConfiguring interface Go to System Network Interface Configuring interface 4/HA Setting the date and timeEnabling antivirus protection Registering your FortiGate unit Configuration example Multiple connections to the Internet Configuring virus and attack definition updates Configuring Ping servers Example multiple Internet connection configuration Primary and backup links to the Internet Using the CLIDestination based routing examples Go to System Network Routing Table Load sharing Load sharing and primary and secondary connections Adding the routes using the CLI Routing table should have routes arranged as shown in Table Routing a service to an external network Policy routing examples Go to Firewall Policy port1-port3 Adding a redundant default policyFirewall policy example Restricting access to a single Internet connection Adding more firewall policies Configuration example Multiple connections to the Internet Transparent mode installation Preparing to configure Transparent modeTransparent mode settings Administrator Password DNS Settings Changing to Transparent mode Go to System Status Set system opmode transparent Configuring the Transparent mode management IP address Configure the Transparent mode default gateway Registering your FortiGate Transparent mode configuration examples FortiGate-400 Transparent mode connections Default routes and static routes General configuration steps Default route to an external network Web-based manager example configuration steps CLI configuration stepsGo to System Network Management Go to System Network Routing Static route to an external destination Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples High availability Active-passive HA Active-active HA Configuring the HA interfaces HA in NAT/Route modeInstalling and configuring the FortiGate units Configuring the HA cluster Go to System Config HA Weighted Round Robin Least Connection Connecting the HA cluster to your network Example Active-Active HA configuration HA network configuration Starting the HA cluster HA in Transparent modeConfiguring the HA interface and HA IP address HA in Transparent mode None Sample active-passive HA configuration Go to System Status Cluster Members Managing the HA clusterViewing the status of cluster members Monitoring cluster members Go to System Status Monitor Monitoring cluster sessions Viewing and managing cluster log messagesGo to System Status Session Go to Log&Report Logging Synchronizing the cluster configuration Managing individual cluster units Returning to standalone configuration Replacing a FortiGate unit after fail-over Advanced HA options Selecting a FortiGate unit to a permanent primary unit Configuring weighted-round-robin weights Set system ha weight 1 3 System status System status Changing the FortiGate firmware Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name Upgrading the firmware using the CLI Upgrade to a new firmware versionUpgrading the firmware using the web-based manager Execute restore image namestr tftpip Revert to a previous firmware version Reverting to a previous firmware version using the CLI Execute ping Install a firmware image from a system reboot using the CLI To install firmware from a system reboot Execute reboot 100 101 Test a new firmware image before installing itRestoring your previous configuration 102 103 Installing and using a backup firmware imageInstalling a backup firmware image 104 Switching to the backup firmware image 105 106 Manual virus definition updatesSwitching back to the default firmware image Manual attack definition updates Displaying the FortiGate serial numberDisplaying the FortiGate up time Displaying log hard disk status Backing up system settings Restoring system settingsRestoring system settings to factory defaults 108 Changing to Transparent mode Changing to NAT/Route modeRestarting the FortiGate unit 109 Viewing CPU and memory status Shutting down the FortiGate unitSystem status Viewing sessions and network status 111 Viewing virus and intrusions status Sessions and network status monitor Viewing the session list Go to System Status Session Session list113 114 115 Virus and attack definitions updates and registrationUpdating antivirus and attack definitions Connecting to the FortiResponse Distribution Network Version Expiry date Last update attempt Last update status 117 Configuring scheduled updatesGo to System Update Successful Update FDN error Configuring update loggingGo to Log&Report Log Setting Configuring push updates Adding an override serverManually updating antivirus and attack definitions 119 To enable push updates About push updatesPush updates through a NAT device Example push updates through a NAT device General procedure 121 122 Go to Firewall Virtual IP Adding a firewall policy for the port forwarding virtual IP Schedule Always Service ANY Action Accept123 Scheduled updates through a proxy server 124 125 FortiCare Service ContractsRegistering FortiGate units Registering the FortiGate unit 126 127 Registering a FortiGate unit product information Recovering a lost Fortinet support password Updating registration informationViewing the list of registered FortiGate units 128 129 Registering a new FortiGate unitAdding or changing a FortiCare Support Contract number Changing your Fortinet support password Downloading virus and attack definitions updatesChanging your contact information or security question 130 Registering a FortiGate unit after an RMA 131 132 Network configuration Configuring zonesAdding zones 133 Adding interfaces to a zone Adding Vlan subinterfaces to a zoneRenaming zones 134 Configuring interfaces Deleting zonesViewing the interface list Bringing up an interface Changing an interface static IP address Adding a secondary IP address to an interfaceAdding a ping server to an interface 136 Controlling management access to an interface Configuring traffic logging for connections to an interfaceChanging the MTU size to improve network performance 137 Configuring port4/ha Configuring port4/ha for HA modeConfiguring port4/ha as a firewall interface Configuring the management interface Transparent mode 139 Configuring VLANsVlan network configuration Typical Vlan network configuration 140 Adding Vlan subinterfaces Rules for Vlan IDsRules for Vlan IP addresses Adding a Vlan subinterface 142 Adding a Vlan subinterface Configuring routing Adding a default routeAdding destination-based routes to the routing table 143 144 145 Adding routes in Transparent modeConfiguring the routing table 146 Policy routing command syntaxPolicy routing 147 Providing Dhcp services to your internal networkSet system dhcpserver command syntax Keywords Description 148 RIP configuration 149 150 RIP settingsGo to System RIP Settings Configuring RIP settings 151 Configuring RIP for FortiGate interfaces Password152 Mode Adding RIP neighbors Go to System RIP Neighbor Adding RIP neighbors153 Adding RIP filters Adding a single RIP filter154 Go to System RIP Filter Adding a RIP filter list 155Add the IP address of the route Mask Add the netmask of the route Action 156 Adding a neighbors filterAdding a routes filter System configuration Setting system date and timeTo set the date and time Go to System Config Time 157 158 To set the system idle timeoutChanging web-based manager options To set the Auth timeout To modify the Dead Gateway Detection settings159 To select a language for the web-based manager Adding and editing administrator accounts Adding new administrator accountsGo to System Config Admin 160 161 Editing administrator accountsTo edit an administrator account Go to System Config Admin Configuring Snmp Configuring the FortiGate unit for Snmp monitoringConfiguring FortiGate Snmp support Go to System Config Snmp v1/v2c FortiGate MIBs 163Trap Community Trap Receiver IP Addresses FortiGate MIBs MIB file name Description EtherLike.mib Customizing replacement messages FortiGate traps164 FortiGate traps Trap message Description 165 Customizing replacement messagesGo to System Config Replacement Messages Alert email message sections Customizing alert emails166 167 Alert email message sections 168 Firewall configuration 169 Default firewall configuration InterfacesVlan subinterfaces 170 Default addresses Interface Address Description ZonesAddresses 171 Services Content profilesAdding firewall policies Schedules Firewall policy options SourceDestination 173 Service ScheduleAction VPN Tunnel 175 AuthenticationTraffic Shaping Anti-Virus & Web filter 176 Configuring policy lists Log TrafficComments Policy matching in detail Changing the order of policies in a policy list Enabling and disabling policiesDisabling a policy Enabling a policy Addresses Adding addresses179 Go to Firewall Address 180 Editing addressesDeleting addresses Go to Firewall Address Group Organizing addresses into address groups181 182 ServicesPredefined services 183 Https 184 Providing access to custom servicesGo to Firewall Service Custom 185 Grouping servicesGo to Firewall Service Group Schedules Creating one-time schedules186 Go to Firewall Schedule One-time Go to Firewall Schedule Recurring Creating recurring schedules187 188 Virtual IPsAdding a schedule to a policy Adding static NAT virtual IPs 189 Adding port forwarding virtual IPs 190 Adding policies with virtual IPs 191 IP pools Adding an IP pool192 Go to Firewall IP Pool IP/MAC binding IP Pools for firewall policies that use fixed portsIP pools and dynamic NAT 193 Go to Firewall IP/MAC Binding Static IP/MAC Go to Firewall IP/MAC Binding Setting194 Adding IP/MAC addresses 195 Viewing the dynamic IP/MAC list Enabling IP/MAC binding196 Go to Firewall IP/MAC Binding Dynamic IP/MAC Content profiles Default content profilesAdding a content profile Go to Firewall Content Profile 198 File BlockQuarantine Oversized File/Email Block Pass Fragmented Email Adding a content profile to a policy 199 200 Users and authentication 201 Setting authentication timeout Adding user names and configuring authenticationAdding user names and configuring authentication 202 Deleting user names from the internal database 203 Configuring Radius support Adding Radius serversDeleting Radius servers 204 Configuring Ldap support Adding Ldap servers205 Go to User Ldap Deleting Ldap servers 206 Configuring user groups Adding user groups207 Go to User User Group Deleting user groups 208 IPSec VPN 209 Key management Manual KeysAutoIKE with pre-shared keys AutoIKE with certificates General configuration steps for a manual key VPN Manual key IPSec VPNsAdding a manual key VPN tunnel 211 212 General configuration steps for an AutoIKE VPN Adding a phase 1 configuration for an AutoIKE VPNGo to VPN Ipsec Phase AutoIKE IPSec VPNs Remote Gateway Dialup User 214Remote Gateway Static IP Address Configuring advanced options 215 216 Adding a phase 2 configuration for an AutoIKE VPN 217 218 219 Managing digital certificatesObtaining a signed local certificate Go to VPN Local Certificates Generating the certificate request220 221 Downloading the certificate requestRequesting the signed local certificate 222 Retrieving the signed local certificateImporting the signed local certificate Obtaining a CA certificate Retrieving a CA certificateImporting a CA certificate 223 Configuring encrypt policies 224 Adding a source address Adding a destination addressAdding an encrypt policy 225 226 Adding an encrypt policy 227 VPN concentrator hub general configuration stepsIPSec VPN concentrators 228 Source InternalAll Destination VPN spoke address Action Go to VPN IPSec Concentrator Adding a VPN concentrator229 VPN spoke general configuration steps 230VPN Tunnel Policies 231 Configuring redundant IPSec VPNRedundant IPSec VPNs See Adding a phase 1 configuration for an AutoIKE VPN on 232 Monitoring and Troubleshooting VPNs Viewing VPN tunnel statusViewing dialup VPN connection status 233 Go to VPN IPSec Dialup Testing a VPN234 235 Configuring PptpPptp and L2TP VPN Configuring the FortiGate unit as a Pptp gateway Adding users and user groupsEnabling Pptp and specifying an address range 236 Adding an address group 237 Configuring a Windows 98 client for Pptp Installing Pptp supportGo to Start Settings Control Panel Network Adding a firewall policy Configuring a Pptp dialup connection Connecting to the Pptp VPNConfiguring a Windows 2000 client for Pptp 239 Configuring a Windows XP client for Pptp Configuring the VPN connection240 Go to Start Control Panel Configuring L2TP 241 Configuring the FortiGate unit as a L2TP gateway Enabling L2TP and specifying an address range242 Go to VPN L2TP L2TP Range Sample L2TP address range configuration 243 244 Configuring a Windows 2000 client for L2TP Configuring an L2TP dialup connectionDisabling IPSec 245 Connecting to the L2TP VPN Configuring a Windows XP client for L2TPConfiguring an L2TP VPN dialup connection Go to Start Settings 247 248 249 Network Intrusion Detection System NidsDetecting attacks Configuring checksum verification Selecting the interfaces to monitorDisabling the Nids 250 Viewing the signature list Viewing attack descriptions251 Go to Nids Detection Signature List Enabling and disabling Nids attack signatures Adding user-defined signatures252 Go to Nids Detection User Defined Signature List Preventing attacks Downloading the user-defined signature listEnabling Nids attack prevention 253 254 Setting signature threshold valuesEnabling Nids attack prevention signatures 255 Configuring synflood signature values Value Description Minimum Maximum DefaultLogging attacks Logging attack messages to the attack log Reducing the number of Nids attack log and email messages Automatic message reductionManual message reduction 257 258 259 General configuration stepsAntivirus protection To scan FortiGate firewall traffic for viruses Antivirus scanning260 File blocking 261 Blocking files in firewall traffic Adding file patterns to block262 Go to Anti-Virus File Block Go to Anti-Virus Quarantine Quarantine Config QuarantineQuarantining infected files Quarantining blocked files Viewing the quarantine list Sorting the quarantine list264 Go to Anti-Virus Quarantine Configuring quarantine options Filtering the quarantine listDeleting files from quarantine Downloading quarantined files Configuring limits for oversized files and email Blocking oversized files and emailsExempting fragmented email from blocking Viewing the virus list Web filtering 267 Content blocking Go to Web Filter Content BlockAdding words and phrases to the banned word list 268 Using the FortiGate web filter URL blockingAdding URLs or URL patterns to the block list 269 Clearing the URL block list 270 271 Downloading the URL block listUploading a URL block list Using the Cerberian web filter Installing a Cerberian license key on the FortiGate unitAdding a Cerberian user to the FortiGate unit 272 Configuring Cerberian web filter About the default group and policyTo configure the Cerberian web filtering Enabling Cerberian URL filtering Script filtering Enabling the script filterSelecting script filter options 274 Exempt URL list Adding URLs to the exempt URL list275 Go to Web Filter Exempt URL 276 Example exempt URL list Email filter 277 278 Go to Email Filter Content BlockEmail banned word list Email block list Email exempt listAdding address patterns to the email block list 279 To add a subject tag Go to Email Filter Config Adding a subject tagAdding address patterns to the email exempt list 280 281 Logging and reportingRecording logs 282 Recording logs on a remote computerRecording logs on a NetIQ WebTrends server Recording logs on the FortiGate hard disk 283Overwrite Option 284 Filtering log messagesRecording logs in system memory Example log filter configuration 285 Configuring traffic logging Enabling traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a Vlan subinterface Configuring traffic filter settings Go to Log&Report Log Setting Traffic FilterEnabling traffic logging for a firewall policy 287 288 Destination IP Address Destination Netmask ServiceAdding traffic filter entries Viewing logs saved to memory Viewing logsSearching logs 289 Viewing and managing logs saved to the hard disk 290 291 Downloading a log file to the management computerDeleting all messages in an active log Configuring alert email Deleting a saved log fileAdding alert email addresses 292 Testing alert email Enabling alert email293 Go to Log&Report Alert Mail Categories 294 Glossary 295 296 297 298 299 IndexNumerics 300 Index 301 FDS 302 Ldap 303 MIB 304 305 RMA 306 TCP 307 VPN 308