High availability | Fortinet 400 manual

Contents

Completing the configuration	64
Setting the date and time	64
Enabling antivirus protection	64
Registering your FortiGate	65
Configuring virus and attack definition updates	65
Connecting the FortiGate unit to your networks	65
Transparent mode configuration examples	66
Default routes and static routes	67
Example default route to an external network	67
Example static route to an external destination	69
Example static route to an internal destination	72
High availability	75
Active-passive HA	75
Active-active HA	76
HA in NAT/Route mode	77
Installing and configuring the FortiGate units	77
Configuring the HA interfaces	77
Configuring the HA cluster	78
Connecting the HA cluster to your network	80
Starting the HA cluster	82
HA in Transparent mode	82
Installing and configuring the FortiGate units	82
Configuring the HA interface and HA IP address	82
Configuring the HA cluster	83
Connecting the HA cluster to your network	85
Starting the HA cluster	86
Managing the HA cluster	86
Viewing the status of cluster members	86
Monitoring cluster members	87
Monitoring cluster sessions	88
Viewing and managing cluster log messages	88
Managing individual cluster units	89
Synchronizing the cluster configuration	89
Returning to standalone configuration	90
Replacing a FortiGate unit after fail-over	90
Advanced HA options	91
Selecting a FortiGate unit to a permanent primary unit	91
Configuring weighted-round-robin weights	92

FortiGate-400 Installation and Configuration Guide

5

Image 5

Fortinet 400 manual High availability

Contents

August Installation and Configuration Guide Regulatory Compliance Trademarks Table of Contents NAT/Route mode installation High availability System status Network configuration 133 System configuration 157 Users and authentication 201 IPSec VPN 209 Network Intrusion Detection System Nids 249 Email filter 277 Glossary 295 Index 299 Contents Antivirus protection Introduction Email filtering Web content filtering Firewall NAT/Route mode Network intrusion detection Transparent mode High availability VPN Web-based manager Secure installation, configuration, and management Logging and reporting Command line interface What’s new in Version Firewall Replacement messagesUsers and authentication Email filter AntivirusWeb Filter About this document Document conventions Comments on Fortinet technical documentation Fortinet documentation Customer service and technical support Getting started Mounting Package contents Power requirements Powering onEnvironmental specifications FortiGate-400 LED indicators Connecting to the web-based manager Connecting to the web-based manager Factory default FortiGate configuration settings Connecting to the command line interface CLIBits per second 9600 Data bits Parity Stop bits Flow control Interface Factory default NAT/Route mode network configurationAccount Factory default firewall configuration Factory default Transparent mode network configuration Factory default content profiles Scan content profile Strict content profileStrict content profile Options Scan content profile Options Unfiltered content profile Web content profileWeb content profile Options Unfiltered content profile Options Planning your FortiGate configuration Example NAT/Route mode network configuration NAT/Route mode with multiple external network connections Setup Wizard Configuration options Front keypad and LCD FortiGate model maximum values matrix Next steps Next steps Getting started NAT/Route mode settings Administrator Password Interface NAT/Route mode installationPreparing to configure NAT/Route mode Reconnecting to the web-based manager Using the setup wizardStarting the setup wizard Using the command line interface Using the front control buttons and LCDConfiguring the FortiGate unit to operate in NAT/Route mode Configuring NAT/Route mode IP addresses Set system interface port2 mode static ip IPaddress netmask Connecting the FortiGate unit to your networks Completing the configuration Configuring your networkConfiguring interface Go to System Network Interface Setting the date and time Configuring interface 4/HAEnabling antivirus protection Registering your FortiGate unit Configuring virus and attack definition updates Configuration example Multiple connections to the Internet Example multiple Internet connection configuration Configuring Ping servers Using the CLI Primary and backup links to the InternetDestination based routing examples Go to System Network Routing Table Load sharing and primary and secondary connections Load sharing Routing table should have routes arranged as shown in Table Adding the routes using the CLI Policy routing examples Routing a service to an external network Go to Firewall Policy port1-port3 Adding a redundant default policyFirewall policy example Adding more firewall policies Restricting access to a single Internet connection Configuration example Multiple connections to the Internet Preparing to configure Transparent mode Transparent mode installationTransparent mode settings Administrator Password DNS Settings Go to System Status Changing to Transparent mode Set system opmode transparent Configure the Transparent mode default gateway Configuring the Transparent mode management IP address Registering your FortiGate FortiGate-400 Transparent mode connections Transparent mode configuration examples Default routes and static routes Default route to an external network General configuration steps CLI configuration steps Web-based manager example configuration stepsGo to System Network Management Go to System Network Routing Static route to an external destination Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples Active-passive HA High availability Active-active HA Configuring the HA interfaces HA in NAT/Route modeInstalling and configuring the FortiGate units Go to System Config HA Configuring the HA cluster Least Connection Weighted Round Robin Example Active-Active HA configuration Connecting the HA cluster to your network HA network configuration Starting the HA cluster HA in Transparent modeConfiguring the HA interface and HA IP address HA in Transparent mode None Sample active-passive HA configuration Go to System Status Cluster Members Managing the HA clusterViewing the status of cluster members Go to System Status Monitor Monitoring cluster members Viewing and managing cluster log messages Monitoring cluster sessionsGo to System Status Session Go to Log&Report Logging Managing individual cluster units Synchronizing the cluster configuration Replacing a FortiGate unit after fail-over Returning to standalone configuration Selecting a FortiGate unit to a permanent primary unit Advanced HA options Set system ha weight 1 3 Configuring weighted-round-robin weights System status System status Changing the FortiGate firmware Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name Upgrading the firmware using the CLI Upgrade to a new firmware versionUpgrading the firmware using the web-based manager Revert to a previous firmware version Execute restore image namestr tftpip Reverting to a previous firmware version using the CLI Execute ping To install firmware from a system reboot Install a firmware image from a system reboot using the CLI 100 Execute reboot 101 Test a new firmware image before installing itRestoring your previous configuration 102 103 Installing and using a backup firmware imageInstalling a backup firmware image 104 105 Switching to the backup firmware image 106 Manual virus definition updatesSwitching back to the default firmware image Displaying the FortiGate serial number Manual attack definition updatesDisplaying the FortiGate up time Displaying log hard disk status Restoring system settings Backing up system settingsRestoring system settings to factory defaults 108 Changing to NAT/Route mode Changing to Transparent modeRestarting the FortiGate unit 109 Viewing CPU and memory status Shutting down the FortiGate unitSystem status 111 Viewing sessions and network status Sessions and network status monitor Viewing virus and intrusions status Viewing the session list Go to System Status Session Session list113 114 115 Virus and attack definitions updates and registrationUpdating antivirus and attack definitions Version Expiry date Last update attempt Last update status Connecting to the FortiResponse Distribution Network 117 Configuring scheduled updatesGo to System Update Successful Update FDN error Configuring update loggingGo to Log&Report Log Setting Adding an override server Configuring push updatesManually updating antivirus and attack definitions 119 About push updates To enable push updatesPush updates through a NAT device Example push updates through a NAT device 121 General procedure Go to Firewall Virtual IP 122 Adding a firewall policy for the port forwarding virtual IP Schedule Always Service ANY Action Accept123 124 Scheduled updates through a proxy server 125 FortiCare Service ContractsRegistering FortiGate units 126 Registering the FortiGate unit Registering a FortiGate unit product information 127 Updating registration information Recovering a lost Fortinet support passwordViewing the list of registered FortiGate units 128 129 Registering a new FortiGate unitAdding or changing a FortiCare Support Contract number Downloading virus and attack definitions updates Changing your Fortinet support passwordChanging your contact information or security question 130 131 Registering a FortiGate unit after an RMA 132 Configuring zones Network configurationAdding zones 133 Adding Vlan subinterfaces to a zone Adding interfaces to a zoneRenaming zones 134 Deleting zones Configuring interfacesViewing the interface list Bringing up an interface Adding a secondary IP address to an interface Changing an interface static IP addressAdding a ping server to an interface 136 Configuring traffic logging for connections to an interface Controlling management access to an interfaceChanging the MTU size to improve network performance 137 Configuring port4/ha for HA mode Configuring port4/haConfiguring port4/ha as a firewall interface Configuring the management interface Transparent mode 139 Configuring VLANsVlan network configuration 140 Typical Vlan network configuration Rules for Vlan IDs Adding Vlan subinterfacesRules for Vlan IP addresses Adding a Vlan subinterface Adding a Vlan subinterface 142 Adding a default route Configuring routingAdding destination-based routes to the routing table 143 144 145 Adding routes in Transparent modeConfiguring the routing table 146 Policy routing command syntaxPolicy routing 147 Providing Dhcp services to your internal networkSet system dhcpserver command syntax Keywords Description 148 149 RIP configuration 150 RIP settingsGo to System RIP Settings 151 Configuring RIP settings Password Configuring RIP for FortiGate interfaces152 Mode Adding RIP neighbors Go to System RIP Neighbor Adding RIP neighbors153 Adding a single RIP filter Adding RIP filters154 Go to System RIP Filter 155 Adding a RIP filter listAdd the IP address of the route Mask Add the netmask of the route Action 156 Adding a neighbors filterAdding a routes filter Setting system date and time System configurationTo set the date and time Go to System Config Time 157 158 To set the system idle timeoutChanging web-based manager options To modify the Dead Gateway Detection settings To set the Auth timeout159 To select a language for the web-based manager Adding new administrator accounts Adding and editing administrator accountsGo to System Config Admin 160 161 Editing administrator accountsTo edit an administrator account Go to System Config Admin Configuring the FortiGate unit for Snmp monitoring Configuring SnmpConfiguring FortiGate Snmp support Go to System Config Snmp v1/v2c 163 FortiGate MIBsTrap Community Trap Receiver IP Addresses FortiGate MIBs MIB file name Description EtherLike.mib FortiGate traps Customizing replacement messages164 FortiGate traps Trap message Description 165 Customizing replacement messagesGo to System Config Replacement Messages Alert email message sections Customizing alert emails166 Alert email message sections 167 168 169 Firewall configuration Interfaces Default firewall configurationVlan subinterfaces 170 Zones Default addresses Interface Address DescriptionAddresses 171 Content profiles ServicesAdding firewall policies Schedules Source Firewall policy optionsDestination 173 Schedule ServiceAction VPN Tunnel 175 AuthenticationTraffic Shaping 176 Anti-Virus & Web filter Log Traffic Configuring policy listsComments Policy matching in detail Enabling and disabling policies Changing the order of policies in a policy listDisabling a policy Enabling a policy Adding addresses Addresses179 Go to Firewall Address 180 Editing addressesDeleting addresses Go to Firewall Address Group Organizing addresses into address groups181 182 ServicesPredefined services Https 183 184 Providing access to custom servicesGo to Firewall Service Custom 185 Grouping servicesGo to Firewall Service Group Creating one-time schedules Schedules186 Go to Firewall Schedule One-time Go to Firewall Schedule Recurring Creating recurring schedules187 188 Virtual IPsAdding a schedule to a policy 189 Adding static NAT virtual IPs 190 Adding port forwarding virtual IPs 191 Adding policies with virtual IPs Adding an IP pool IP pools192 Go to Firewall IP Pool IP Pools for firewall policies that use fixed ports IP/MAC bindingIP pools and dynamic NAT 193 Go to Firewall IP/MAC Binding Static IP/MAC Go to Firewall IP/MAC Binding Setting194 195 Adding IP/MAC addresses Enabling IP/MAC binding Viewing the dynamic IP/MAC list196 Go to Firewall IP/MAC Binding Dynamic IP/MAC Default content profiles Content profilesAdding a content profile Go to Firewall Content Profile File Block 198Quarantine Oversized File/Email Block Pass Fragmented Email 199 Adding a content profile to a policy 200 201 Users and authentication Adding user names and configuring authentication Setting authentication timeoutAdding user names and configuring authentication 202 203 Deleting user names from the internal database Adding Radius servers Configuring Radius supportDeleting Radius servers 204 Adding Ldap servers Configuring Ldap support205 Go to User Ldap 206 Deleting Ldap servers Adding user groups Configuring user groups207 Go to User User Group 208 Deleting user groups 209 IPSec VPN Manual Keys Key managementAutoIKE with pre-shared keys AutoIKE with certificates Manual key IPSec VPNs General configuration steps for a manual key VPNAdding a manual key VPN tunnel 211 212 Adding a phase 1 configuration for an AutoIKE VPN General configuration steps for an AutoIKE VPNGo to VPN Ipsec Phase AutoIKE IPSec VPNs Remote Gateway Dialup User 214Remote Gateway Static IP Address 215 Configuring advanced options 216 217 Adding a phase 2 configuration for an AutoIKE VPN 218 219 Managing digital certificatesObtaining a signed local certificate Go to VPN Local Certificates Generating the certificate request220 221 Downloading the certificate requestRequesting the signed local certificate 222 Retrieving the signed local certificateImporting the signed local certificate Retrieving a CA certificate Obtaining a CA certificateImporting a CA certificate 223 224 Configuring encrypt policies Adding a destination address Adding a source addressAdding an encrypt policy 225 Adding an encrypt policy 226 227 VPN concentrator hub general configuration stepsIPSec VPN concentrators Source InternalAll Destination VPN spoke address Action 228 Go to VPN IPSec Concentrator Adding a VPN concentrator229 230 VPN spoke general configuration stepsVPN Tunnel Policies 231 Configuring redundant IPSec VPNRedundant IPSec VPNs 232 See Adding a phase 1 configuration for an AutoIKE VPN on Viewing VPN tunnel status Monitoring and Troubleshooting VPNsViewing dialup VPN connection status 233 Go to VPN IPSec Dialup Testing a VPN234 235 Configuring PptpPptp and L2TP VPN Adding users and user groups Configuring the FortiGate unit as a Pptp gatewayEnabling Pptp and specifying an address range 236 237 Adding an address group Installing Pptp support Configuring a Windows 98 client for PptpGo to Start Settings Control Panel Network Adding a firewall policy Connecting to the Pptp VPN Configuring a Pptp dialup connectionConfiguring a Windows 2000 client for Pptp 239 Configuring the VPN connection Configuring a Windows XP client for Pptp240 Go to Start Control Panel 241 Configuring L2TP Enabling L2TP and specifying an address range Configuring the FortiGate unit as a L2TP gateway242 Go to VPN L2TP L2TP Range 243 Sample L2TP address range configuration 244 Configuring an L2TP dialup connection Configuring a Windows 2000 client for L2TPDisabling IPSec 245 Configuring a Windows XP client for L2TP Connecting to the L2TP VPNConfiguring an L2TP VPN dialup connection Go to Start Settings 247 248 249 Network Intrusion Detection System NidsDetecting attacks Selecting the interfaces to monitor Configuring checksum verificationDisabling the Nids 250 Viewing attack descriptions Viewing the signature list251 Go to Nids Detection Signature List Adding user-defined signatures Enabling and disabling Nids attack signatures252 Go to Nids Detection User Defined Signature List Downloading the user-defined signature list Preventing attacksEnabling Nids attack prevention 253 254 Setting signature threshold valuesEnabling Nids attack prevention signatures 255 Value Description Minimum Maximum Default Configuring synflood signature valuesLogging attacks Logging attack messages to the attack log Automatic message reduction Reducing the number of Nids attack log and email messagesManual message reduction 257 258 259 General configuration stepsAntivirus protection To scan FortiGate firewall traffic for viruses Antivirus scanning260 261 File blocking Adding file patterns to block Blocking files in firewall traffic262 Go to Anti-Virus File Block Quarantine Go to Anti-Virus Quarantine Quarantine ConfigQuarantining infected files Quarantining blocked files Sorting the quarantine list Viewing the quarantine list264 Go to Anti-Virus Quarantine Filtering the quarantine list Configuring quarantine optionsDeleting files from quarantine Downloading quarantined files Blocking oversized files and emails Configuring limits for oversized files and emailExempting fragmented email from blocking Viewing the virus list 267 Web filtering Go to Web Filter Content Block Content blockingAdding words and phrases to the banned word list 268 URL blocking Using the FortiGate web filterAdding URLs or URL patterns to the block list 269 270 Clearing the URL block list 271 Downloading the URL block listUploading a URL block list Installing a Cerberian license key on the FortiGate unit Using the Cerberian web filterAdding a Cerberian user to the FortiGate unit 272 About the default group and policy Configuring Cerberian web filterTo configure the Cerberian web filtering Enabling Cerberian URL filtering Enabling the script filter Script filteringSelecting script filter options 274 Adding URLs to the exempt URL list Exempt URL list275 Go to Web Filter Exempt URL Example exempt URL list 276 277 Email filter 278 Go to Email Filter Content BlockEmail banned word list Email exempt list Email block listAdding address patterns to the email block list 279 Adding a subject tag To add a subject tag Go to Email Filter ConfigAdding address patterns to the email exempt list 280 281 Logging and reportingRecording logs 282 Recording logs on a remote computerRecording logs on a NetIQ WebTrends server 283 Recording logs on the FortiGate hard diskOverwrite Option 284 Filtering log messagesRecording logs in system memory 285 Example log filter configuration Enabling traffic logging Configuring traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a Vlan subinterface Go to Log&Report Log Setting Traffic Filter Configuring traffic filter settingsEnabling traffic logging for a firewall policy 287 288 Destination IP Address Destination Netmask ServiceAdding traffic filter entries Viewing logs Viewing logs saved to memorySearching logs 289 290 Viewing and managing logs saved to the hard disk 291 Downloading a log file to the management computerDeleting all messages in an active log Deleting a saved log file Configuring alert emailAdding alert email addresses 292 Enabling alert email Testing alert email293 Go to Log&Report Alert Mail Categories 294 295 Glossary 296 297 298 299 IndexNumerics Index 300 FDS 301 Ldap 302 MIB 303 304 RMA 305 TCP 306 VPN 307 308