High availability, Active-passive HA | Fortinet 400 manual

FortiGate-400 Installation and Configuration Guide Version 2.50 MR2

High availability

Fortinet achieves high availability (HA) using redundant hardware and the FortiGate Clustering Protocol (FGCP). The FortiGate units in the HA cluster enforce the same overall security policy and share the same configuration settings. You can add up to 32 FortiGate units to an HA cluster. Each FortiGate unit in an HA cluster must be the same model and be running the same FortiOS firmware image.

FortiGate HA is device redundant. If one of the FortiGate units in an HA cluster fails, all functions, all established firewall connections, and all IPSec VPN sessions1 are maintained by the other FortiGate units in the HA cluster.

The FortiGate units in the cluster use dedicated HA ethernet interfaces to communicate cluster session information and report individual system status. The units in the cluster are constantly communicating HA status information to make sure the cluster is functioning properly. For this reason, the connection between the HA ports of all of the FortiGate units in the cluster must be well maintained. An interruption of this communication can cause unpredictable results.

You can manage the cluster by connecting to any cluster interface configured for management access.

FortiGate units can be configured to operate in active-passive (A-P) or active-active (A-A) HA mode. Active-active and active-passive HA are supported in both NAT/Route and Transparent modes.

This chapter provides an overview of HA functionality and describes how to configure and manage HA clusters in NAT/Route mode and in Transparent mode.

•Active-passive HA

•Active-active HA

•HA in NAT/Route mode

•HA in Transparent mode

•Managing the HA cluster

•Advanced HA options

Active-passive HA

An Active-passive (A-P) HA cluster, also referred to as hot standby HA, consists of a primary FortiGate unit that is processing traffic and one or more subordinate FortiGate units connected to the network and to the primary FortiGate unit but not processing traffic.

1.HA does not provide session failover for PPPoE, DHCP, PPTP, and L2TP services.

FortiGate-400 Installation and Configuration Guide

75

Image 75

Fortinet 400 manual High availability, Active-passive HA

Contents

August Installation and Configuration Guide Regulatory Compliance Trademarks Table of Contents NAT/Route mode installation High availability System status Network configuration 133 System configuration 157 Users and authentication 201 IPSec VPN 209 Network Intrusion Detection System Nids 249 Email filter 277 Glossary 295 Index 299 Contents Antivirus protection Introduction Email filtering Web content filtering Firewall NAT/Route mode Network intrusion detection Transparent mode High availability VPN Web-based manager Secure installation, configuration, and management Logging and reporting Command line interface What’s new in Version Replacement messages Users and authenticationFirewall Antivirus Web FilterEmail filter About this document Document conventions Comments on Fortinet technical documentation Fortinet documentation Customer service and technical support Getting started Mounting Package contents FortiGate-400 LED indicators Powering onPower requirements Environmental specifications Connecting to the web-based manager Connecting to the web-based manager Stop bits Flow control Connecting to the command line interface CLIFactory default FortiGate configuration settings Bits per second 9600 Data bits Parity Factory default NAT/Route mode network configuration AccountInterface Factory default firewall configuration Factory default Transparent mode network configuration Factory default content profiles Scan content profile Options Strict content profileScan content profile Strict content profile Options Unfiltered content profile Options Web content profileUnfiltered content profile Web content profile Options Planning your FortiGate configuration Example NAT/Route mode network configuration NAT/Route mode with multiple external network connections Setup Wizard Configuration options Front keypad and LCD FortiGate model maximum values matrix Next steps Next steps Getting started NAT/Route mode installation Preparing to configure NAT/Route modeNAT/Route mode settings Administrator Password Interface Using the setup wizard Starting the setup wizardReconnecting to the web-based manager Configuring NAT/Route mode IP addresses Using the front control buttons and LCDUsing the command line interface Configuring the FortiGate unit to operate in NAT/Route mode Set system interface port2 mode static ip IPaddress netmask Connecting the FortiGate unit to your networks Go to System Network Interface Configuring your networkCompleting the configuration Configuring interface Registering your FortiGate unit Configuring interface 4/HASetting the date and time Enabling antivirus protection Configuring virus and attack definition updates Configuration example Multiple connections to the Internet Example multiple Internet connection configuration Configuring Ping servers Go to System Network Routing Table Primary and backup links to the InternetUsing the CLI Destination based routing examples Load sharing and primary and secondary connections Load sharing Routing table should have routes arranged as shown in Table Adding the routes using the CLI Policy routing examples Routing a service to an external network Adding a redundant default policy Firewall policy exampleGo to Firewall Policy port1-port3 Adding more firewall policies Restricting access to a single Internet connection Configuration example Multiple connections to the Internet DNS Settings Transparent mode installationPreparing to configure Transparent mode Transparent mode settings Administrator Password Go to System Status Changing to Transparent mode Set system opmode transparent Configure the Transparent mode default gateway Configuring the Transparent mode management IP address Registering your FortiGate FortiGate-400 Transparent mode connections Transparent mode configuration examples Default routes and static routes Default route to an external network General configuration steps Go to System Network Routing Web-based manager example configuration stepsCLI configuration steps Go to System Network Management Static route to an external destination Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples Active-passive HA High availability Active-active HA HA in NAT/Route mode Installing and configuring the FortiGate unitsConfiguring the HA interfaces Go to System Config HA Configuring the HA cluster Least Connection Weighted Round Robin Example Active-Active HA configuration Connecting the HA cluster to your network HA network configuration HA in Transparent mode Configuring the HA interface and HA IP addressStarting the HA cluster HA in Transparent mode None Sample active-passive HA configuration Managing the HA cluster Viewing the status of cluster membersGo to System Status Cluster Members Go to System Status Monitor Monitoring cluster members Go to Log&Report Logging Monitoring cluster sessionsViewing and managing cluster log messages Go to System Status Session Managing individual cluster units Synchronizing the cluster configuration Replacing a FortiGate unit after fail-over Returning to standalone configuration Selecting a FortiGate unit to a permanent primary unit Advanced HA options Set system ha weight 1 3 Configuring weighted-round-robin weights System status System status Firmware upgrade procedures Procedure Description Changing the FortiGate host nameChanging the FortiGate firmware Upgrade to a new firmware version Upgrading the firmware using the web-based managerUpgrading the firmware using the CLI Revert to a previous firmware version Execute restore image namestr tftpip Reverting to a previous firmware version using the CLI Execute ping To install firmware from a system reboot Install a firmware image from a system reboot using the CLI 100 Execute reboot Test a new firmware image before installing it Restoring your previous configuration101 102 Installing and using a backup firmware image Installing a backup firmware image103 104 105 Switching to the backup firmware image Manual virus definition updates Switching back to the default firmware image106 Displaying log hard disk status Manual attack definition updatesDisplaying the FortiGate serial number Displaying the FortiGate up time 108 Backing up system settingsRestoring system settings Restoring system settings to factory defaults 109 Changing to Transparent modeChanging to NAT/Route mode Restarting the FortiGate unit Shutting down the FortiGate unit System statusViewing CPU and memory status 111 Viewing sessions and network status Sessions and network status monitor Viewing virus and intrusions status Session list 113Viewing the session list Go to System Status Session 114 Virus and attack definitions updates and registration Updating antivirus and attack definitions115 Version Expiry date Last update attempt Last update status Connecting to the FortiResponse Distribution Network Configuring scheduled updates Go to System Update117 Configuring update logging Go to Log&Report Log SettingSuccessful Update FDN error 119 Configuring push updatesAdding an override server Manually updating antivirus and attack definitions Example push updates through a NAT device To enable push updatesAbout push updates Push updates through a NAT device 121 General procedure Go to Firewall Virtual IP 122 Schedule Always Service ANY Action Accept 123Adding a firewall policy for the port forwarding virtual IP 124 Scheduled updates through a proxy server FortiCare Service Contracts Registering FortiGate units125 126 Registering the FortiGate unit Registering a FortiGate unit product information 127 128 Recovering a lost Fortinet support passwordUpdating registration information Viewing the list of registered FortiGate units Registering a new FortiGate unit Adding or changing a FortiCare Support Contract number129 130 Changing your Fortinet support passwordDownloading virus and attack definitions updates Changing your contact information or security question 131 Registering a FortiGate unit after an RMA 132 133 Network configurationConfiguring zones Adding zones 134 Adding interfaces to a zoneAdding Vlan subinterfaces to a zone Renaming zones Bringing up an interface Configuring interfacesDeleting zones Viewing the interface list 136 Changing an interface static IP addressAdding a secondary IP address to an interface Adding a ping server to an interface 137 Controlling management access to an interfaceConfiguring traffic logging for connections to an interface Changing the MTU size to improve network performance Configuring the management interface Transparent mode Configuring port4/haConfiguring port4/ha for HA mode Configuring port4/ha as a firewall interface Configuring VLANs Vlan network configuration139 140 Typical Vlan network configuration Adding a Vlan subinterface Adding Vlan subinterfacesRules for Vlan IDs Rules for Vlan IP addresses Adding a Vlan subinterface 142 143 Configuring routingAdding a default route Adding destination-based routes to the routing table 144 Adding routes in Transparent mode Configuring the routing table145 Policy routing command syntax Policy routing146 Providing Dhcp services to your internal network Set system dhcpserver command syntax Keywords Description147 148 149 RIP configuration RIP settings Go to System RIP Settings150 151 Configuring RIP settings Mode Configuring RIP for FortiGate interfacesPassword 152 Adding RIP neighbors 153Adding RIP neighbors Go to System RIP Neighbor Go to System RIP Filter Adding RIP filtersAdding a single RIP filter 154 Mask Add the netmask of the route Action Adding a RIP filter list155 Add the IP address of the route Adding a neighbors filter Adding a routes filter156 157 System configurationSetting system date and time To set the date and time Go to System Config Time To set the system idle timeout Changing web-based manager options158 To select a language for the web-based manager To set the Auth timeoutTo modify the Dead Gateway Detection settings 159 160 Adding and editing administrator accountsAdding new administrator accounts Go to System Config Admin Editing administrator accounts To edit an administrator account Go to System Config Admin161 Go to System Config Snmp v1/v2c Configuring SnmpConfiguring the FortiGate unit for Snmp monitoring Configuring FortiGate Snmp support FortiGate MIBs MIB file name Description EtherLike.mib FortiGate MIBs163 Trap Community Trap Receiver IP Addresses FortiGate traps Trap message Description Customizing replacement messagesFortiGate traps 164 Customizing replacement messages Go to System Config Replacement Messages165 Customizing alert emails 166Alert email message sections Alert email message sections 167 168 169 Firewall configuration 170 Default firewall configurationInterfaces Vlan subinterfaces 171 Default addresses Interface Address DescriptionZones Addresses Schedules ServicesContent profiles Adding firewall policies 173 Firewall policy optionsSource Destination VPN Tunnel ServiceSchedule Action Authentication Traffic Shaping175 176 Anti-Virus & Web filter Policy matching in detail Configuring policy listsLog Traffic Comments Enabling a policy Changing the order of policies in a policy listEnabling and disabling policies Disabling a policy Go to Firewall Address AddressesAdding addresses 179 Editing addresses Deleting addresses180 Organizing addresses into address groups 181Go to Firewall Address Group Services Predefined services182 Https 183 Providing access to custom services Go to Firewall Service Custom184 Grouping services Go to Firewall Service Group185 Go to Firewall Schedule One-time SchedulesCreating one-time schedules 186 Creating recurring schedules 187Go to Firewall Schedule Recurring Virtual IPs Adding a schedule to a policy188 189 Adding static NAT virtual IPs 190 Adding port forwarding virtual IPs 191 Adding policies with virtual IPs Go to Firewall IP Pool IP poolsAdding an IP pool 192 193 IP/MAC bindingIP Pools for firewall policies that use fixed ports IP pools and dynamic NAT Go to Firewall IP/MAC Binding Setting 194Go to Firewall IP/MAC Binding Static IP/MAC 195 Adding IP/MAC addresses Go to Firewall IP/MAC Binding Dynamic IP/MAC Viewing the dynamic IP/MAC listEnabling IP/MAC binding 196 Go to Firewall Content Profile Content profilesDefault content profiles Adding a content profile Oversized File/Email Block Pass Fragmented Email 198File Block Quarantine 199 Adding a content profile to a policy 200 201 Users and authentication 202 Setting authentication timeoutAdding user names and configuring authentication Adding user names and configuring authentication 203 Deleting user names from the internal database 204 Configuring Radius supportAdding Radius servers Deleting Radius servers Go to User Ldap Configuring Ldap supportAdding Ldap servers 205 206 Deleting Ldap servers Go to User User Group Configuring user groupsAdding user groups 207 208 Deleting user groups 209 IPSec VPN AutoIKE with certificates Key managementManual Keys AutoIKE with pre-shared keys 211 General configuration steps for a manual key VPNManual key IPSec VPNs Adding a manual key VPN tunnel 212 AutoIKE IPSec VPNs General configuration steps for an AutoIKE VPNAdding a phase 1 configuration for an AutoIKE VPN Go to VPN Ipsec Phase 214 Remote Gateway Static IP AddressRemote Gateway Dialup User 215 Configuring advanced options 216 217 Adding a phase 2 configuration for an AutoIKE VPN 218 Managing digital certificates Obtaining a signed local certificate219 Generating the certificate request 220Go to VPN Local Certificates Downloading the certificate request Requesting the signed local certificate221 Retrieving the signed local certificate Importing the signed local certificate222 223 Obtaining a CA certificateRetrieving a CA certificate Importing a CA certificate 224 Configuring encrypt policies 225 Adding a source addressAdding a destination address Adding an encrypt policy Adding an encrypt policy 226 VPN concentrator hub general configuration steps IPSec VPN concentrators227 Source InternalAll Destination VPN spoke address Action 228 Adding a VPN concentrator 229Go to VPN IPSec Concentrator Policies VPN spoke general configuration steps230 VPN Tunnel Configuring redundant IPSec VPN Redundant IPSec VPNs231 232 See Adding a phase 1 configuration for an AutoIKE VPN on 233 Monitoring and Troubleshooting VPNsViewing VPN tunnel status Viewing dialup VPN connection status Testing a VPN 234Go to VPN IPSec Dialup Configuring Pptp Pptp and L2TP VPN235 236 Configuring the FortiGate unit as a Pptp gatewayAdding users and user groups Enabling Pptp and specifying an address range 237 Adding an address group Adding a firewall policy Configuring a Windows 98 client for PptpInstalling Pptp support Go to Start Settings Control Panel Network 239 Configuring a Pptp dialup connectionConnecting to the Pptp VPN Configuring a Windows 2000 client for Pptp Go to Start Control Panel Configuring a Windows XP client for PptpConfiguring the VPN connection 240 241 Configuring L2TP Go to VPN L2TP L2TP Range Configuring the FortiGate unit as a L2TP gatewayEnabling L2TP and specifying an address range 242 243 Sample L2TP address range configuration 244 245 Configuring a Windows 2000 client for L2TPConfiguring an L2TP dialup connection Disabling IPSec Go to Start Settings Connecting to the L2TP VPNConfiguring a Windows XP client for L2TP Configuring an L2TP VPN dialup connection 247 248 Network Intrusion Detection System Nids Detecting attacks249 250 Configuring checksum verificationSelecting the interfaces to monitor Disabling the Nids Go to Nids Detection Signature List Viewing the signature listViewing attack descriptions 251 Go to Nids Detection User Defined Signature List Enabling and disabling Nids attack signaturesAdding user-defined signatures 252 253 Preventing attacksDownloading the user-defined signature list Enabling Nids attack prevention Setting signature threshold values Enabling Nids attack prevention signatures254 255 Logging attack messages to the attack log Configuring synflood signature valuesValue Description Minimum Maximum Default Logging attacks 257 Reducing the number of Nids attack log and email messagesAutomatic message reduction Manual message reduction 258 General configuration steps Antivirus protection259 Antivirus scanning 260To scan FortiGate firewall traffic for viruses 261 File blocking Go to Anti-Virus File Block Blocking files in firewall trafficAdding file patterns to block 262 Quarantining blocked files Go to Anti-Virus Quarantine Quarantine ConfigQuarantine Quarantining infected files Go to Anti-Virus Quarantine Viewing the quarantine listSorting the quarantine list 264 Downloading quarantined files Configuring quarantine optionsFiltering the quarantine list Deleting files from quarantine Viewing the virus list Configuring limits for oversized files and emailBlocking oversized files and emails Exempting fragmented email from blocking 267 Web filtering 268 Content blockingGo to Web Filter Content Block Adding words and phrases to the banned word list 269 Using the FortiGate web filterURL blocking Adding URLs or URL patterns to the block list 270 Clearing the URL block list Downloading the URL block list Uploading a URL block list271 272 Using the Cerberian web filterInstalling a Cerberian license key on the FortiGate unit Adding a Cerberian user to the FortiGate unit Enabling Cerberian URL filtering Configuring Cerberian web filterAbout the default group and policy To configure the Cerberian web filtering 274 Script filteringEnabling the script filter Selecting script filter options Go to Web Filter Exempt URL Exempt URL listAdding URLs to the exempt URL list 275 Example exempt URL list 276 277 Email filter Go to Email Filter Content Block Email banned word list278 279 Email block listEmail exempt list Adding address patterns to the email block list 280 To add a subject tag Go to Email Filter ConfigAdding a subject tag Adding address patterns to the email exempt list Logging and reporting Recording logs281 Recording logs on a remote computer Recording logs on a NetIQ WebTrends server282 Option Recording logs on the FortiGate hard disk283 Overwrite Filtering log messages Recording logs in system memory284 285 Example log filter configuration Enabling traffic logging for a Vlan subinterface Configuring traffic loggingEnabling traffic logging Enabling traffic logging for an interface 287 Configuring traffic filter settingsGo to Log&Report Log Setting Traffic Filter Enabling traffic logging for a firewall policy Destination IP Address Destination Netmask Service Adding traffic filter entries288 289 Viewing logs saved to memoryViewing logs Searching logs 290 Viewing and managing logs saved to the hard disk Downloading a log file to the management computer Deleting all messages in an active log291 292 Configuring alert emailDeleting a saved log file Adding alert email addresses Go to Log&Report Alert Mail Categories Testing alert emailEnabling alert email 293 294 295 Glossary 296 297 298 Index Numerics299 Index 300 FDS 301 Ldap 302 MIB 303 304 RMA 305 TCP 306 VPN 307 308