防火墙配置

IP 池

 

 

动作

动作 设置为 接受以接受到内部网络服务器的连接。也可以选择

 

以拒绝对服务器的访问。

NAT

如果防火墙对于源地址网络隐藏了目的网络上的有地址,则选择

 

NAT。

认证

可选项。选择认证并选择一个用户组可以要求用户在使用端口转发访

 

问服务器的时候先取得防火墙的认证。

记录流通日志

可以选中此项启用对端口转发的数据流记录日志,并启用对数据流应

病毒防护与 Web 过滤器

用防病毒保护、Web 内容过滤功能。

4 单击 以保存这个策略。

IP

一个 IP 池 (也称做动态 IP 池)是一个添加到防火墙网络接口的 IP 地址范围。如 果您为一个接口添加了 IP 池,当配置一个其目的地址设为此接口的策略时可以选择动 态 IP 池。如果您希望添加一个 NAT 模式的策略,以将源地址转换为从 IP 池中随机选 择的地址,而不仅仅是使用目的接口的地址,您也可以添加一个 IP 池。

IP 池中的地址必须和此网络接口的 IP 地址在同一子网内。例如,如果一个 FortiGate 网络接口是 192.168.1.99,那么一个有效的 IP 池可以是从 192.168.1.10 到 192.168.1.20 的 IP 地址。这个 IP 池可以为防火墙提供 11 个可选的 IP 地址,供防 火墙在转换源地址时候使用。

IP 池地址范围中的地址不能和所添加到的那个网络接口位于同一网络中的其它地 址突。

您可以在任何接口上添加多个 IP 池,但是只有 IP 池被防火墙使用。 本节描述了以下内容:

·添加 IP 池

·使用固定端口的防火墙策略的 IP 池

·IP 池和动态 NAT

添加 IP

以下操作用于添加 IP 池:

1 进入 防火墙 > IP 池

2 选择要添加 IP 池的 网络接口

您可以选择一个防火墙接口或一个 VLAN 子网络接口。

3 单击 以将新的 IP 池添加到选中的网络接口。

4 输入这个 IP 池的地址范围的 起点 IP 地址 终点 IP 地址

这个起点 IP 和终点 IP 须用来定义 IP 池的 IP 地址范围的起止点地址。其中,起点 IP 地址必须小于终点 IP 地址。起点 IP 地址和终点 IP 地址必须有相同的子网地址,并且 都 IP 地址池添加到的那个网络接口所在的子网内。

5 单击 以保存这个 IP 池。

FortiGate-500 安装和配置指南

165

Page 177
Image 177
Fortinet 500 manual 165, ·添加 Ip 池 ·使用固定端口的防火墙策略的 Ip 池 ·Ip 池和动态 Nat, 进入 防火墙 Ip 池。

500 specifications

Fortinet 500 is a next-generation firewall (NGFW) that is part of Fortinet's acclaimed FortiGate family, designed to provide advanced security for medium to large enterprises. This appliance is known for its high performance, flexibility, and ability to protect networks from a variety of cyber threats through its robust features and technologies.

One of the main features of the Fortinet 500 is its integrated security capabilities. It combines multiple security functions into a single device, allowing organizations to manage everything from intrusion prevention and antivirus to web filtering and application control. This integration leads to simplified management and increased efficiency, as users can address multiple security needs without deploying multiple devices.

The Fortinet 500 runs on the FortiOS operating system, which is known for its simplicity and user-friendliness. FortiOS provides a centralized management interface that allows for the easy configuration and monitoring of security policies across the entire network. Additionally, the Fortinet management tools, such as FortiManager and FortiAnalyzer, enable detailed insights and reporting capabilities, helping organizations stay compliant with their security mandates.

Another characteristic that sets Fortinet 500 apart is its advanced threat intelligence, powered by the FortiGuard Labs. This global threat intelligence system continuously updates the firewall with the latest threat signatures and attack vectors, ensuring that organizations stay ahead of emerging threats. The firewall also employs machine learning and artificial intelligence to detect and mitigate sophisticated attacks in real-time.

Performance is crucial in any security appliance, and the Fortinet 500 does not disappoint. With hardware acceleration and purpose-built security processors, it delivers high throughput levels, enabling organizations to maintain productivity without sacrificing security. This level of performance is particularly beneficial in environments with heavy traffic and bandwidth demands.

In addition to these core features, the Fortinet 500 supports seamless integration with other security solutions within the Fortinet Security Fabric. This comprehensive approach allows for greater visibility and control over the entire security posture of an organization.

Overall, the Fortinet 500 is a powerful NGFW that offers a blend of advanced security features, ease of management, top-notch performance, and robust threat intelligence. Its ability to adapt to the ever-evolving landscape of cybersecurity makes it a valuable asset for businesses seeking to safeguard their digital assets and ensure seamless network operation.