Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 400 manual NAT/Route mode installation

Models: 400

1 308

Download 308 pages 48.56 Kb

Page 4

Contents

Planning your FortiGate configuration	39
NAT/Route mode	39
NAT/Route mode with multiple external network connections	40
Transparent mode	41
Configuration options	41
FortiGate model maximum values matrix	42
Next steps	43
NAT/Route mode installation	45
Preparing to configure NAT/Route mode	45
Using the setup wizard	46
Starting the setup wizard	46
Reconnecting to the web-based manager	46
Using the front control buttons and LCD	47
Using the command line interface	47
Configuring the FortiGate unit to operate in NAT/Route mode	47
Connecting the FortiGate unit to your networks	49
Configuring your network	50
Completing the configuration	50
Configuring interface 3	50
Configuring interface 4/HA	51
Setting the date and time	51
Enabling antivirus protection	51
Registering your FortiGate unit	51
Configuring virus and attack definition updates	52
Configuration example: Multiple connections to the Internet	52
Configuring Ping servers	53
Destination based routing examples	54
Policy routing examples	57
Firewall policy example	58
Transparent mode installation	61
Preparing to configure Transparent mode	61
Using the setup wizard	62
Changing to Transparent mode	62
Starting the setup wizard	62
Reconnecting to the web-based manager	62
Using the front control buttons and LCD	63
Using the command line interface	63
Changing to Transparent mode	63
Configuring the Transparent mode management IP address	64
Configure the Transparent mode default gateway	64

4	Fortinet Inc.

Image 4

Fortinet 400 manual NAT/Route mode installation

Contents

Installation and Configuration Guide AugustTrademarks Regulatory ComplianceTable of Contents NAT/Route mode installation High availability System status Network configuration 133 System configuration 157 Users and authentication 201 IPSec VPN 209 Network Intrusion Detection System Nids 249 Email filter 277 Glossary 295 Index 299 Contents Introduction Antivirus protectionWeb content filtering Email filteringNAT/Route mode FirewallTransparent mode Network intrusion detectionVPN High availabilitySecure installation, configuration, and management Web-based managerCommand line interface Logging and reportingWhat’s new in Version Users and authentication Replacement messagesFirewall Web Filter AntivirusEmail filter About this document Document conventions Fortinet documentation Comments on Fortinet technical documentationCustomer service and technical support Getting started Package contents MountingPowering on Power requirementsEnvironmental specifications FortiGate-400 LED indicatorsConnecting to the web-based manager Connecting to the web-based managerConnecting to the command line interface CLI Factory default FortiGate configuration settingsBits per second 9600 Data bits Parity Stop bits Flow controlAccount Factory default NAT/Route mode network configurationInterface Factory default Transparent mode network configuration Factory default firewall configurationFactory default content profiles Strict content profile Scan content profileStrict content profile Options Scan content profile OptionsWeb content profile Unfiltered content profileWeb content profile Options Unfiltered content profile OptionsPlanning your FortiGate configuration NAT/Route mode with multiple external network connections Example NAT/Route mode network configurationConfiguration options Setup WizardFortiGate model maximum values matrix Front keypad and LCDNext steps Next steps Getting started Preparing to configure NAT/Route mode NAT/Route mode installationNAT/Route mode settings Administrator Password Interface Starting the setup wizard Using the setup wizardReconnecting to the web-based manager Using the front control buttons and LCD Using the command line interfaceConfiguring the FortiGate unit to operate in NAT/Route mode Configuring NAT/Route mode IP addressesSet system interface port2 mode static ip IPaddress netmask Connecting the FortiGate unit to your networks Configuring your network Completing the configurationConfiguring interface Go to System Network InterfaceConfiguring interface 4/HA Setting the date and timeEnabling antivirus protection Registering your FortiGate unitConfiguration example Multiple connections to the Internet Configuring virus and attack definition updatesConfiguring Ping servers Example multiple Internet connection configurationPrimary and backup links to the Internet Using the CLIDestination based routing examples Go to System Network Routing TableLoad sharing Load sharing and primary and secondary connectionsAdding the routes using the CLI Routing table should have routes arranged as shown in TableRouting a service to an external network Policy routing examplesFirewall policy example Adding a redundant default policyGo to Firewall Policy port1-port3 Restricting access to a single Internet connection Adding more firewall policiesConfiguration example Multiple connections to the Internet Transparent mode installation Preparing to configure Transparent modeTransparent mode settings Administrator Password DNS SettingsChanging to Transparent mode Go to System StatusSet system opmode transparent Configuring the Transparent mode management IP address Configure the Transparent mode default gatewayRegistering your FortiGate Transparent mode configuration examples FortiGate-400 Transparent mode connectionsDefault routes and static routes General configuration steps Default route to an external networkWeb-based manager example configuration steps CLI configuration stepsGo to System Network Management Go to System Network RoutingStatic route to an external destination Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples High availability Active-passive HAActive-active HA Installing and configuring the FortiGate units HA in NAT/Route modeConfiguring the HA interfaces Configuring the HA cluster Go to System Config HAWeighted Round Robin Least ConnectionConnecting the HA cluster to your network Example Active-Active HA configurationHA network configuration Configuring the HA interface and HA IP address HA in Transparent modeStarting the HA cluster HA in Transparent mode None Sample active-passive HA configuration Viewing the status of cluster members Managing the HA clusterGo to System Status Cluster Members Monitoring cluster members Go to System Status MonitorMonitoring cluster sessions Viewing and managing cluster log messagesGo to System Status Session Go to Log&Report LoggingSynchronizing the cluster configuration Managing individual cluster unitsReturning to standalone configuration Replacing a FortiGate unit after fail-overAdvanced HA options Selecting a FortiGate unit to a permanent primary unitConfiguring weighted-round-robin weights Set system ha weight 1 3System status System statusChanging the FortiGate host name Firmware upgrade procedures Procedure DescriptionChanging the FortiGate firmware Upgrading the firmware using the web-based manager Upgrade to a new firmware versionUpgrading the firmware using the CLI Execute restore image namestr tftpip Revert to a previous firmware versionReverting to a previous firmware version using the CLI Execute ping Install a firmware image from a system reboot using the CLI To install firmware from a system rebootExecute reboot 100Restoring your previous configuration Test a new firmware image before installing it101 102 Installing a backup firmware image Installing and using a backup firmware image103 104 Switching to the backup firmware image 105Switching back to the default firmware image Manual virus definition updates106 Manual attack definition updates Displaying the FortiGate serial numberDisplaying the FortiGate up time Displaying log hard disk statusBacking up system settings Restoring system settingsRestoring system settings to factory defaults 108Changing to Transparent mode Changing to NAT/Route modeRestarting the FortiGate unit 109System status Shutting down the FortiGate unitViewing CPU and memory status Viewing sessions and network status 111Viewing virus and intrusions status Sessions and network status monitor113 Session listViewing the session list Go to System Status Session 114 Updating antivirus and attack definitions Virus and attack definitions updates and registration115 Connecting to the FortiResponse Distribution Network Version Expiry date Last update attempt Last update statusGo to System Update Configuring scheduled updates117 Go to Log&Report Log Setting Configuring update loggingSuccessful Update FDN error Configuring push updates Adding an override serverManually updating antivirus and attack definitions 119To enable push updates About push updatesPush updates through a NAT device Example push updates through a NAT deviceGeneral procedure 121122 Go to Firewall Virtual IP123 Schedule Always Service ANY Action AcceptAdding a firewall policy for the port forwarding virtual IP Scheduled updates through a proxy server 124Registering FortiGate units FortiCare Service Contracts125 Registering the FortiGate unit 126127 Registering a FortiGate unit product informationRecovering a lost Fortinet support password Updating registration informationViewing the list of registered FortiGate units 128Adding or changing a FortiCare Support Contract number Registering a new FortiGate unit129 Changing your Fortinet support password Downloading virus and attack definitions updatesChanging your contact information or security question 130Registering a FortiGate unit after an RMA 131132 Network configuration Configuring zonesAdding zones 133Adding interfaces to a zone Adding Vlan subinterfaces to a zoneRenaming zones 134Configuring interfaces Deleting zonesViewing the interface list Bringing up an interfaceChanging an interface static IP address Adding a secondary IP address to an interfaceAdding a ping server to an interface 136Controlling management access to an interface Configuring traffic logging for connections to an interfaceChanging the MTU size to improve network performance 137Configuring port4/ha Configuring port4/ha for HA modeConfiguring port4/ha as a firewall interface Configuring the management interface Transparent modeVlan network configuration Configuring VLANs139 Typical Vlan network configuration 140Adding Vlan subinterfaces Rules for Vlan IDsRules for Vlan IP addresses Adding a Vlan subinterface142 Adding a Vlan subinterfaceConfiguring routing Adding a default routeAdding destination-based routes to the routing table 143144 Configuring the routing table Adding routes in Transparent mode145 Policy routing Policy routing command syntax146 Set system dhcpserver command syntax Keywords Description Providing Dhcp services to your internal network147 148 RIP configuration 149Go to System RIP Settings RIP settings150 Configuring RIP settings 151Configuring RIP for FortiGate interfaces Password152 Mode153 Adding RIP neighborsAdding RIP neighbors Go to System RIP Neighbor Adding RIP filters Adding a single RIP filter154 Go to System RIP FilterAdding a RIP filter list 155Add the IP address of the route Mask Add the netmask of the route ActionAdding a routes filter Adding a neighbors filter156 System configuration Setting system date and timeTo set the date and time Go to System Config Time 157Changing web-based manager options To set the system idle timeout158 To set the Auth timeout To modify the Dead Gateway Detection settings159 To select a language for the web-based managerAdding and editing administrator accounts Adding new administrator accountsGo to System Config Admin 160To edit an administrator account Go to System Config Admin Editing administrator accounts161 Configuring Snmp Configuring the FortiGate unit for Snmp monitoringConfiguring FortiGate Snmp support Go to System Config Snmp v1/v2cFortiGate MIBs 163Trap Community Trap Receiver IP Addresses FortiGate MIBs MIB file name Description EtherLike.mibCustomizing replacement messages FortiGate traps164 FortiGate traps Trap message DescriptionGo to System Config Replacement Messages Customizing replacement messages165 166 Customizing alert emailsAlert email message sections 167 Alert email message sections168 Firewall configuration 169Default firewall configuration InterfacesVlan subinterfaces 170Default addresses Interface Address Description ZonesAddresses 171Services Content profilesAdding firewall policies SchedulesFirewall policy options SourceDestination 173Service ScheduleAction VPN TunnelTraffic Shaping Authentication175 Anti-Virus & Web filter 176Configuring policy lists Log TrafficComments Policy matching in detailChanging the order of policies in a policy list Enabling and disabling policiesDisabling a policy Enabling a policyAddresses Adding addresses179 Go to Firewall AddressDeleting addresses Editing addresses180 181 Organizing addresses into address groupsGo to Firewall Address Group Predefined services Services182 183 HttpsGo to Firewall Service Custom Providing access to custom services184 Go to Firewall Service Group Grouping services185 Schedules Creating one-time schedules186 Go to Firewall Schedule One-time187 Creating recurring schedulesGo to Firewall Schedule Recurring Adding a schedule to a policy Virtual IPs188 Adding static NAT virtual IPs 189Adding port forwarding virtual IPs 190Adding policies with virtual IPs 191IP pools Adding an IP pool192 Go to Firewall IP PoolIP/MAC binding IP Pools for firewall policies that use fixed portsIP pools and dynamic NAT 193194 Go to Firewall IP/MAC Binding SettingGo to Firewall IP/MAC Binding Static IP/MAC Adding IP/MAC addresses 195Viewing the dynamic IP/MAC list Enabling IP/MAC binding196 Go to Firewall IP/MAC Binding Dynamic IP/MACContent profiles Default content profilesAdding a content profile Go to Firewall Content Profile198 File BlockQuarantine Oversized File/Email Block Pass Fragmented EmailAdding a content profile to a policy 199200 Users and authentication 201Setting authentication timeout Adding user names and configuring authenticationAdding user names and configuring authentication 202Deleting user names from the internal database 203Configuring Radius support Adding Radius serversDeleting Radius servers 204Configuring Ldap support Adding Ldap servers205 Go to User LdapDeleting Ldap servers 206Configuring user groups Adding user groups207 Go to User User GroupDeleting user groups 208IPSec VPN 209Key management Manual KeysAutoIKE with pre-shared keys AutoIKE with certificatesGeneral configuration steps for a manual key VPN Manual key IPSec VPNsAdding a manual key VPN tunnel 211212 General configuration steps for an AutoIKE VPN Adding a phase 1 configuration for an AutoIKE VPNGo to VPN Ipsec Phase AutoIKE IPSec VPNsRemote Gateway Static IP Address 214Remote Gateway Dialup User Configuring advanced options 215216 Adding a phase 2 configuration for an AutoIKE VPN 217218 Obtaining a signed local certificate Managing digital certificates219 220 Generating the certificate requestGo to VPN Local Certificates Requesting the signed local certificate Downloading the certificate request221 Importing the signed local certificate Retrieving the signed local certificate222 Obtaining a CA certificate Retrieving a CA certificateImporting a CA certificate 223Configuring encrypt policies 224Adding a source address Adding a destination addressAdding an encrypt policy 225226 Adding an encrypt policyIPSec VPN concentrators VPN concentrator hub general configuration steps227 228 Source InternalAll Destination VPN spoke address Action229 Adding a VPN concentratorGo to VPN IPSec Concentrator VPN spoke general configuration steps 230VPN Tunnel PoliciesRedundant IPSec VPNs Configuring redundant IPSec VPN231 See Adding a phase 1 configuration for an AutoIKE VPN on 232Monitoring and Troubleshooting VPNs Viewing VPN tunnel statusViewing dialup VPN connection status 233234 Testing a VPNGo to VPN IPSec Dialup Pptp and L2TP VPN Configuring Pptp235 Configuring the FortiGate unit as a Pptp gateway Adding users and user groupsEnabling Pptp and specifying an address range 236Adding an address group 237Configuring a Windows 98 client for Pptp Installing Pptp supportGo to Start Settings Control Panel Network Adding a firewall policyConfiguring a Pptp dialup connection Connecting to the Pptp VPNConfiguring a Windows 2000 client for Pptp 239Configuring a Windows XP client for Pptp Configuring the VPN connection240 Go to Start Control PanelConfiguring L2TP 241Configuring the FortiGate unit as a L2TP gateway Enabling L2TP and specifying an address range242 Go to VPN L2TP L2TP RangeSample L2TP address range configuration 243244 Configuring a Windows 2000 client for L2TP Configuring an L2TP dialup connectionDisabling IPSec 245Connecting to the L2TP VPN Configuring a Windows XP client for L2TPConfiguring an L2TP VPN dialup connection Go to Start Settings247 248 Detecting attacks Network Intrusion Detection System Nids249 Configuring checksum verification Selecting the interfaces to monitorDisabling the Nids 250Viewing the signature list Viewing attack descriptions251 Go to Nids Detection Signature ListEnabling and disabling Nids attack signatures Adding user-defined signatures252 Go to Nids Detection User Defined Signature ListPreventing attacks Downloading the user-defined signature listEnabling Nids attack prevention 253Enabling Nids attack prevention signatures Setting signature threshold values254 255 Configuring synflood signature values Value Description Minimum Maximum DefaultLogging attacks Logging attack messages to the attack logReducing the number of Nids attack log and email messages Automatic message reductionManual message reduction 257258 Antivirus protection General configuration steps259 260 Antivirus scanningTo scan FortiGate firewall traffic for viruses File blocking 261Blocking files in firewall traffic Adding file patterns to block262 Go to Anti-Virus File BlockGo to Anti-Virus Quarantine Quarantine Config QuarantineQuarantining infected files Quarantining blocked filesViewing the quarantine list Sorting the quarantine list264 Go to Anti-Virus QuarantineConfiguring quarantine options Filtering the quarantine listDeleting files from quarantine Downloading quarantined filesConfiguring limits for oversized files and email Blocking oversized files and emailsExempting fragmented email from blocking Viewing the virus listWeb filtering 267Content blocking Go to Web Filter Content BlockAdding words and phrases to the banned word list 268Using the FortiGate web filter URL blockingAdding URLs or URL patterns to the block list 269Clearing the URL block list 270Uploading a URL block list Downloading the URL block list271 Using the Cerberian web filter Installing a Cerberian license key on the FortiGate unitAdding a Cerberian user to the FortiGate unit 272Configuring Cerberian web filter About the default group and policyTo configure the Cerberian web filtering Enabling Cerberian URL filteringScript filtering Enabling the script filterSelecting script filter options 274Exempt URL list Adding URLs to the exempt URL list275 Go to Web Filter Exempt URL276 Example exempt URL listEmail filter 277Email banned word list Go to Email Filter Content Block278 Email block list Email exempt listAdding address patterns to the email block list 279To add a subject tag Go to Email Filter Config Adding a subject tagAdding address patterns to the email exempt list 280Recording logs Logging and reporting281 Recording logs on a NetIQ WebTrends server Recording logs on a remote computer282 Recording logs on the FortiGate hard disk 283Overwrite OptionRecording logs in system memory Filtering log messages284 Example log filter configuration 285Configuring traffic logging Enabling traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a Vlan subinterfaceConfiguring traffic filter settings Go to Log&Report Log Setting Traffic FilterEnabling traffic logging for a firewall policy 287Adding traffic filter entries Destination IP Address Destination Netmask Service288 Viewing logs saved to memory Viewing logsSearching logs 289Viewing and managing logs saved to the hard disk 290Deleting all messages in an active log Downloading a log file to the management computer291 Configuring alert email Deleting a saved log fileAdding alert email addresses 292Testing alert email Enabling alert email293 Go to Log&Report Alert Mail Categories294 Glossary 295296 297 298 Numerics Index299 300 Index301 FDS302 Ldap303 MIB304 305 RMA306 TCP307 VPN308