FortiGate-500 安装和配置指南 2.50

IPSec VPN

虚拟专用网络 (VPN)是一个拓展的私有网络,它由穿过共享或公共网络,例如互 联网,的连接组成。例如,某公司有两个办公室分别在两个不同的城市,每个都有它 自己的专用网络。这两个办公室可以通过 VPN 在彼此之间创建一个安全的通道。类似 地,一个电话拨号用户可以使用他的 VPN 客户端获得对他的专用办公网络的远程访问 权。在这两种情况下,在用户看来安全连接如同一个专用的网络通讯,即使这个通讯 是通过一个公共网络来传输的。

可以将通道、数据加密和认证结合起来以实现安全的 VPN 连接。通道封装数据,以 使得它可以通过公共网络传播。数据帧并不是以它原始的格式发送的,而是用一个附 加的头部进行封装并在通道的两个端点之间路由。在到达目的端点之后,数据被解封 并转发到它在专用网络中的目的地址。

加密将数据流从明文 (一些人类或程序能看的东西)转换成密文 (看不的东 西)。这些信息根据已知的密钥使用数学算法加密和解密。

认证能够校验数据包的来源和它内容的完整性。认证使用带有密钥的 hash 功能算 法计算校验和。

本章提供了关于如何配置 FortiGate IPSec VPN 的概述。关于 FortiGate VPN 的详 细信息,请见 FortiGate VPN 指南。

·密钥管理

·手工密钥 IPSec VPN ·自动 IKE IPSec VPN ·管理数字证书 ·配置加密策略 ·IPSec VPN 集中器 ·冗余 IPSec VPN ·VPN 监视和问题解答

密钥管理

任何加密系统都有三个基本的元

·一个将信息变成编码的算法,

·一个作为这个算法的密起点的密钥, ·一个控制这个密钥的管理系统。

FortiGate-500 安装和配置指南

181

Page 193
Image 193
Fortinet 500 manual 密钥管理, 181

500 specifications

Fortinet 500 is a next-generation firewall (NGFW) that is part of Fortinet's acclaimed FortiGate family, designed to provide advanced security for medium to large enterprises. This appliance is known for its high performance, flexibility, and ability to protect networks from a variety of cyber threats through its robust features and technologies.

One of the main features of the Fortinet 500 is its integrated security capabilities. It combines multiple security functions into a single device, allowing organizations to manage everything from intrusion prevention and antivirus to web filtering and application control. This integration leads to simplified management and increased efficiency, as users can address multiple security needs without deploying multiple devices.

The Fortinet 500 runs on the FortiOS operating system, which is known for its simplicity and user-friendliness. FortiOS provides a centralized management interface that allows for the easy configuration and monitoring of security policies across the entire network. Additionally, the Fortinet management tools, such as FortiManager and FortiAnalyzer, enable detailed insights and reporting capabilities, helping organizations stay compliant with their security mandates.

Another characteristic that sets Fortinet 500 apart is its advanced threat intelligence, powered by the FortiGuard Labs. This global threat intelligence system continuously updates the firewall with the latest threat signatures and attack vectors, ensuring that organizations stay ahead of emerging threats. The firewall also employs machine learning and artificial intelligence to detect and mitigate sophisticated attacks in real-time.

Performance is crucial in any security appliance, and the Fortinet 500 does not disappoint. With hardware acceleration and purpose-built security processors, it delivers high throughput levels, enabling organizations to maintain productivity without sacrificing security. This level of performance is particularly beneficial in environments with heavy traffic and bandwidth demands.

In addition to these core features, the Fortinet 500 supports seamless integration with other security solutions within the Fortinet Security Fabric. This comprehensive approach allows for greater visibility and control over the entire security posture of an organization.

Overall, the Fortinet 500 is a powerful NGFW that offers a blend of advanced security features, ease of management, top-notch performance, and robust threat intelligence. Its ability to adapt to the ever-evolving landscape of cybersecurity makes it a valuable asset for businesses seeking to safeguard their digital assets and ensure seamless network operation.