防火墙配置

添加防火墙策略

 

 

流量控制

流量控制功能控制可以使用的带宽并设置被策略处理的数据流的优先权。在大量的 数据通过 FortiGate 时,流量控制可以控制哪个策略具有更高的优先权。例如,为网 页服务器设定的策略可能被分配比大多数为员电脑设定的策略更高的优先级。当一 个员需要非同寻常的对互联网的高速访问的时候,可以为他设置一个具有较高带宽 的特定的向外连接策略。

如果设置保证带宽和最大带宽均为 0,策略将拒绝所有流通流量。

保证带宽 使用 流量控制可以保证策略允许经过防火墙的通讯享有一定的带宽。 保证

带宽 ( 以 kbps 为单位 ) 确保对优先级高的服务有足够的带宽可用。

最大带宽 您还可以使用 流量控制 限制某个策略经过防火墙的带宽的限度。限制带宽

可以限制重要程度较低的服务使用更为重要的服务所需要带宽。

数据流优先级 可以选择高、中、低。选择数据流优先级可以使 FortiGate 管理不同类型的 数据流的优先权关系。例如,连接到一个安全的网页服务器的策略用于支持 电子商务通讯,应当被分配给一个较高的优先权。而对于重要程度较低的服 务应当标上较低的优先权。只有当高优先级的连接不再需要带宽时,防火墙 才会将带宽分配给低优先级的连接。

认证

选择认证并选择一个用户组可以要求用户在防火墙接受连接请求之前输入用户名和 密码。选择用户组可以控制哪些用户可以通过认证使用这个策略。要添加和配置一个 用户组,见 第 178 页 配置用户组。您必须在选择认证之前添加用户组。

您可以选择对任何服务的认证。用户可以在防火墙上使用 HTTP、Telnet 或者 FTP 认证。为了让用户能够认证,必须添加为认证配置的 HTTP、Telnet 或者 FTP 策略。当 用户试图通过防火墙使用这个策略连接时,他们将会被提示输入防火墙用户的用户名 和密码。

如果您希望用户在使用其它服务时认证 (例如,POP3 或者 IMAP),可以创建一个 包含了您想要进行认证的服务和 HTTP、Telnet 或 FTP 服务的服务组。用户可以在使用 这个策略的其它服务之前先使用 HTTP、Telnet 或 FPT 认证。

在大多数情况下,您必须确定用户无须认证就可以通过防火墙使用 DNS。如果 DNS 不可用,用户将无法使用域名访问网页服务、FTP 或者 Telnet 服务。

病毒防护与 Web 过滤器

启用防病毒保护和网页内容过滤功能可以过滤由这个策略控制的通讯。如果服务类 型是 任意、HTTP、SMTP、POP3 或者 IMAP,或者是一个包含了 HTTP、SMTP、POP3 或 IMAP 的服务组,您可以选择病毒防护和网页过滤。

选择一个内容配置文件以配置应用到这个策略的防病毒保护和内容过滤功能。请见 第 169 页 内容配置文件

FortiGate-500 安装和配置指南

149

Page 161
Image 161
Fortinet 500 manual 流量控制, 149, 病毒防护与 Web 过滤器

500 specifications

Fortinet 500 is a next-generation firewall (NGFW) that is part of Fortinet's acclaimed FortiGate family, designed to provide advanced security for medium to large enterprises. This appliance is known for its high performance, flexibility, and ability to protect networks from a variety of cyber threats through its robust features and technologies.

One of the main features of the Fortinet 500 is its integrated security capabilities. It combines multiple security functions into a single device, allowing organizations to manage everything from intrusion prevention and antivirus to web filtering and application control. This integration leads to simplified management and increased efficiency, as users can address multiple security needs without deploying multiple devices.

The Fortinet 500 runs on the FortiOS operating system, which is known for its simplicity and user-friendliness. FortiOS provides a centralized management interface that allows for the easy configuration and monitoring of security policies across the entire network. Additionally, the Fortinet management tools, such as FortiManager and FortiAnalyzer, enable detailed insights and reporting capabilities, helping organizations stay compliant with their security mandates.

Another characteristic that sets Fortinet 500 apart is its advanced threat intelligence, powered by the FortiGuard Labs. This global threat intelligence system continuously updates the firewall with the latest threat signatures and attack vectors, ensuring that organizations stay ahead of emerging threats. The firewall also employs machine learning and artificial intelligence to detect and mitigate sophisticated attacks in real-time.

Performance is crucial in any security appliance, and the Fortinet 500 does not disappoint. With hardware acceleration and purpose-built security processors, it delivers high throughput levels, enabling organizations to maintain productivity without sacrificing security. This level of performance is particularly beneficial in environments with heavy traffic and bandwidth demands.

In addition to these core features, the Fortinet 500 supports seamless integration with other security solutions within the Fortinet Security Fabric. This comprehensive approach allows for greater visibility and control over the entire security posture of an organization.

Overall, the Fortinet 500 is a powerful NGFW that offers a blend of advanced security features, ease of management, top-notch performance, and robust threat intelligence. Its ability to adapt to the ever-evolving landscape of cybersecurity makes it a valuable asset for businesses seeking to safeguard their digital assets and ensure seamless network operation.