Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 50A user manual

Models: 50A

1 272

Download 272 pages 24.69 Kb

Page 106

Configuring DHCP services	Network configuration

3Select an interface.

You must configure the interface as a DHCP server before it can be selected.

4Select New to add an address scope.

5Configure the address scope.

Scope Name	Enter the address scope name.
IP Pool	Enter the starting IP and ending IP for the range of IP addresses that this
	DHCP server assigns to DHCP clients.
Netmask	Enter the netmask that the DHCP server assigns to the DHCP clients.
Lease Duration	Enter the interval, in days, hours and minutes, after which a DHCP client
	must ask the DHCP server for a new address.
	If you select Unlimited, DHCP leases never expire.
Domain	Optionally enter in the domain that the DHCP server assigns to the DHCP
	clients.
Default Route	Enter the default route to be assigned to DHCP clients. The default route
	must be on the same subnet as the IP pool.

6Select Advanced if you want to configure Advanced Options.

DNS IP	Enter the addresses of up to 3 DNS servers that the DHCP server assigns
	to the DHCP clients.

WINS Server IP Add the IP addresses of one or two WINS servers to be assigned to DHCP clients.

Exclusion Range Optionally enter up to 4 exclusion ranges of IP addresses within the IP pool that cannot be assigned to DHCP clients.

7Select OK.

Adding a reserve IP to a DHCP server

If you have configured an interface as a DHCP server, you can reserve an IP address for a particular device on the network according to the MAC address of the device. When you add the MAC address of a device and an IP address to the reserve IP list, the DHCP server always assigns this IP address to the device.

To add a reserve IP you must first select the interface and scope to which you want to add the reserve IP.

To add a reserve IP to a DHCP server

1Go to System > Network > DHCP.

2Select Reserve IP.

3Select an interface.

You must configure the interface as a DHCP server before you can select it.

4Select a scope.

You must configure an address scope for the interface before you can select it.

5Select New to add a reserved IP.

6Configure the reserved IP.

106	Fortinet Inc.

Image 106

Fortinet 50A user manual

Contents

Installation and Configuration Guide FebruaryTrademarks Regulatory ComplianceTable of Contents Transparent mode installation Virus and attack definitions updates and registration Network configuration Firewall configuration 137 Users and authentication 171 Pptp and L2TP VPN 203 Antivirus protection 225 Glossary 259 Index 263 Contents Transparent mode NAT/Route mode and Transparent modeNAT/Route mode IntroductionDocument conventions Fortinet documentation Comments on Fortinet technical documentationCustomer service and technical support Getting started Package contents MountingEnvironmental specifications Powering onConnecting to the web-based manager To power on the FortiGate-50A unitConnecting to the command line interface CLI To connect to the web-based managerBits per second Data bits Parity To connect to the CLIStop bits Flow control Factory default FortiGate configuration settings Factory default Dhcp configurationFactory default Transparent mode network configuration Factory default NAT/Route mode network configurationFactory default firewall configuration Authentication Factory default firewall configuration RecurringService ContentStrict content profile Factory default content profilesStrict content profile Options Scan content profile Options Scan content profileWeb content profile Web content profile OptionsUnfiltered content profile Planning the FortiGate configurationUnfiltered content profile Options Configuration options Setup wizardCLI FortiGate model maximum values matrix Next steps Signatures Antivirus file Block patterns Web filterNext steps Getting started NAT/Route mode installation Changing the default configuration Preparing to configure NAT/Route modeInternal servers Starting the setup wizard Using the setup wizardAdvanced NAT/Route mode settings Reconnecting to the web-based managerConfiguring NAT/Route mode IP addresses Using the command line interfaceConfiguring the FortiGate unit to operate in NAT/Route mode ExampleFortiGate-50A External Connecting the FortiGate unit to your networksInternal Setting the date and time Configuring your networksCompleting the configuration Changing antivirus protectionConfiguring virus and attack definition updates Registering your FortiGate unitCompleting the configuration Transparent mode settings Administrator Password Transparent mode installationPreparing to configure Transparent mode DNS SettingsChanging to Transparent mode Go to System StatusConfiguring the Transparent mode management IP address Configure the Transparent mode default gatewayConnecting the FortiGate unit to your networks Registering your FortiGate Enabling antivirus protectionGo to Firewall Policy Int-Ext Transparent mode configuration examples Default routes and static routesGeneral configuration steps Default route to an external networkGo to System Network Management Web-based manager example configuration stepsCLI configuration steps Go to System Network RoutingDMZ Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 System status System statusChanging the FortiGate firmware Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name To change the FortiGate host name Go to System StatusTo upgrade the firmware using the web-based manager Upgrading the firmware using the web-based managerUpgrading the firmware using the CLI To upgrade the firmware using the CLIReverting to a previous firmware version Execute pingReverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot Press any key to enter configuration menu Testing a new firmware image before installing it Restoring the previous configurationTo test a new firmware image Save as Default firmware/Run image without savingD/R To update the antivirus definitions manually Manual virus definition updatesManual attack definition updates To update the attack definitions manuallyDisplaying the FortiGate serial number Backing up system settingsRestoring system settings Displaying the FortiGate up timeChanging to Transparent mode Restoring system settings to factory defaultsTo change to Transparent mode Go to System Status Restarting the FortiGate unit Changing to NAT/Route modeTo change to NAT/Route mode Go to System Status Shutting down the FortiGate unitViewing CPU and memory status System statusTo view CPU and memory status Go to System Status Monitor Viewing sessions and network status CPU and memory status monitorViewing virus and intrusions status Sessions and network status monitorSession list To view the session list Go to System Status SessionProtocol Example session listSession list Virus and attack definitions updates and registration Updating antivirus and attack definitionsVersion Expiry date Last update attempt Last update status Connecting to the FortiResponse Distribution NetworkGo to System Update To make sure the FortiGate unit can connect to the FDNManually initiating antivirus and attack definitions updates Enabling scheduled updates Scheduling updatesConfiguring update logging To configure update logging Go to Log&Report Log SettingTo add an override server Go to System Update Adding an override serverEnabling push updates Enabling scheduled updates through a proxy serverEnabling push updates through a NAT device Enabling push updatesPush updates when FortiGate IP addresses change To enable push updates Go to System UpdateExample push updates through a NAT device Example network topology Push updates through a NAT deviceGeneral procedure Schedule Always Service ANY Action Accept To configure the FortiGate NAT deviceAdding a firewall policy for the port forwarding virtual IP Example push update configuration Registering FortiGate unitsFortiCare Service Contracts Registering the FortiGate unit Recovering a lost Fortinet support password Updating registration informationViewing the list of registered FortiGate units Registering a new FortiGate unit Adding or changing a FortiCare Support Contract numberChanging your Fortinet support password Changing your contact information or security questionDownloading virus and attack definitions updates Downloading virus and attack definition updatesRegistering a FortiGate unit after an RMA Registering a FortiGate unit after an RMA Network configuration Configuring interfacesTo stop an interface that is administratively up Changing the administrative status of an interfaceConfiguring an interface with a manual IP address Viewing the interface listInitializing Configuring an interface for DhcpConnecting ConnectedConfiguring an interface for PPPoE Adding a secondary IP address to an interfaceControlling administrative access to an interface Adding a ping server to an interfaceConfiguring traffic logging for connections to an interface Changing the MTU size to improve network performanceConfiguring the management interface in Transparent mode Adding DNS server IP addresses Configuring routingAdding a default route 100Adding destination-based routes to the routing table 101Configuring the routing table Adding routes in Transparent mode102 Policy routing 103Configuring a Dhcp relay agent Configuring Dhcp servicesPolicy routing command syntax 104Adding scopes to a Dhcp server Configuring a Dhcp serverAdding a Dhcp server to an interface 105Scope Name Adding a reserve IP to a Dhcp server106 IP PoolViewing a Dhcp server dynamic IP list Configuring the modem interface107 To configure modem settings Go to System Network Modem Connecting a modem to the FortiGate unitConfiguring modem settings 108109 Connecting to a dialup accountDisconnecting the modem To connect to a dialup account Go to System Network ModemTo configure backup mode Go to System Network Modem Backup mode configurationStandalone mode configuration Viewing modem statusAdding firewall policies for modem connections To operate in standalone mode Go to System Network Modem111 112 RIP settings RIP configuration113 Holddown InvalidFlush Configuring RIP for FortiGate interfaces 115116 117 Adding RIP filtersAdding a RIP filter list To add a RIP filter list Go to System RIP FilterAssigning a RIP filter list to the neighbors filter Assigning a RIP filter list to the incoming filterAssigning a RIP filter list to the outgoing filter 119120 To set the date and time Go to System Config Time System configurationSetting system date and time 121Changing system options To set the system idle timeout Go to System Config OptionsTo set the Auth timeout Go to System Config Options 122Modifying the Dead Gateway Detection settings Adding and editing administrator accounts123 To add an administrator account Go to System Config Admin Adding new administrator accountsEditing administrator accounts 124To edit an administrator account Go to System Config Admin Configuring Snmp125 Configuring Snmp access to an interface Configuring the FortiGate unit for Snmp monitoringConfiguring FortiGate Snmp support Configuring Snmp community settingsSystem Name 127System Location FortiGate MIBs 128System traps FortiGate trapsGeneral FortiGate traps 129130 Users and authentication configuration System configuration and statusFirewall configuration 131132 Customizing replacement messages Replacement messages133 Customizing alert emails 134135 Nids event136 Critical eventFirewall configuration 137Addresses Default firewall configuration138 Schedules ServicesContent profiles 139Adding firewall policies 140Action 141142 VPN TunnelTraffic Shaping Dynamic IP Pool Fixed Port143 AuthenticationAnti-Virus & Web filter Maximum Bandwidth Traffic PriorityComments Configuring policy listsLog Traffic 144Changing the order of policies in a policy list Policy matching in detail145 Disabling policies AddressesEnabling and disabling policies Enabling policies147 Adding addressesTo add an address Go to Firewall Address Organizing addresses into address groups Editing addressesDeleting addresses 148Predefined services Services149 150 GRE151 LdapAdding custom TCP and UDP services 152Grouping services Adding custom Icmp servicesAdding custom IP services 153Schedules 154Creating recurring schedules Creating one-time schedules155 Adding schedules to policies 156157 Virtual IPsTo add a schedule to a policy Go to Firewall Policy To add a static NAT virtual IP Go to Firewall Virtual IP Adding static NAT virtual IPs158 Virtual IP External Interface examples Description InternalAdding port forwarding virtual IPs 159160 Adding a port forwarding virtual IP161 IP poolsAdding policies with virtual IPs To add a policy with a virtual IP Go to Firewall PolicyIP pools and dynamic NAT Adding an IP poolIP Pools for firewall policies that use fixed ports 162163 IP/MAC bindingGo to Firewall IP/MAC Binding Static IP/MAC Configuring IP/MAC binding for packets going to the firewall 164Enabling IP/MAC binding Adding IP/MAC addressesViewing the dynamic IP/MAC list 165Content profiles 166To add a content profile Go to Firewall Content Profile Default content profilesAdding content profiles 167168 Oversized File/Email Pass Fragmented EmailTo add a content profile to a policy Go to Firewall Policy Adding content profiles to policies169 170 Users and authentication 171Adding user names and configuring authentication Setting authentication timeoutAdding user names and configuring authentication To set authentication timeout Go to System Config OptionsDeleting user names from the internal database 173Deleting Radius servers Configuring Radius supportAdding Radius servers 174175 Configuring Ldap supportAdding Ldap servers To add an Ldap server Go to User Ldap176 Deleting Ldap serversTo delete an Ldap server Go to User Ldap 177 Configuring user groupsAdding user groups To add a user group Go to User User Group178 Deleting user groupsTo delete a user group Go to User User Group IPSec VPN 179AutoIKE with pre-shared keys Key managementManual Keys AutoIKE with certificatesAdding a manual key VPN tunnel General configuration steps for a manual key VPNManual key IPSec VPNs 181AES128 AutoIKE IPSec VPNs182 AES192To create an AutoIKE VPN configuration General configuration steps for an AutoIKE VPNAdding a phase 1 configuration for an AutoIKE VPN To add a phase 1 configuration Go to VPN Ipsec PhaseRemote Gateway Static IP Address 184Remote Gateway Dialup User To configure phase 1 advanced options Configuring advanced options185 186 Adding a phase 1 configuration Standard options 187To add a phase 2 configuration Go to VPN Ipsec Phase Adding a phase 2 configuration for an AutoIKE VPN188 Use selectors from policy 189Use wildcard selectors Generating the certificate request Managing digital certificatesObtaining a signed local certificate 190Key Type 191Key Size Obtaining CA certificates Downloading the certificate requestImporting the signed local certificate 192Importing CA certificates Configuring encrypt policies193 194 Adding a source addressAdding a destination address To add a source address Go to Firewall Address195 Adding an encrypt policyTo add an encrypt policy Go to Firewall Policy IPSec VPN concentrators 196To create a VPN concentrator configuration VPN concentrator hub general configuration steps197 198 Adding a VPN concentratorSource InternalAll Destination VPN spoke address Action To create a VPN spoke configuration VPN spoke general configuration steps199 VPN Tunnel 200Policies Viewing VPN tunnel status Monitoring and Troubleshooting VPNsTo view VPN tunnel status Go to VPN Ipsec Phase Viewing dialup VPN connection statusTesting a VPN 202Pptp and L2TP VPN Configuring PptpConfiguring the FortiGate unit as a Pptp gateway 203204 To add a source addressTo add a destination address 205To add a source address group To add a firewall policy206 Configuring a Windows 98 client for PptpTo connect to the Pptp VPN Configuring a Windows XP client for Pptp Configuring a Windows 2000 client for Pptp207 208 To configure the VPN connectionSelect Properties Security Configuring the FortiGate unit as an L2TP gateway Configuring L2TP209 210 To add source addressesConfiguring a Windows 2000 client for L2TP 211212 To disable IPSecTo connect to the L2TP VPN Configuring a Windows XP client for L2TP 213214 Detecting attacks Network Intrusion Detection System Nids215 Disabling monitoring interfaces Configuring checksum verificationSelecting the interfaces to monitor 216Viewing attack descriptions Viewing the signature list217 Adding user-defined signatures Disabling Nids attack signatures218 Downloading the user-defined signature list 219Enabling Nids attack prevention To enable Nids attack prevention Go to Nids PreventionPreventing attacks Enabling Nids attack prevention signaturesSetting signature threshold values 221Reducing the number of Nids attack log and email messages Logging attacksLogging attack messages to the attack log Automatic message reductionManual message reduction 223224 Antivirus protection General configuration steps225 226 Antivirus scanningTo scan FortiGate firewall traffic for viruses Adding file patterns to block File blockingBlocking files in firewall traffic 227Exempting fragmented email from blocking Configuring limits for oversized files and emailBlocking oversized files and emails 228Viewing the virus list To view the virus list Go to Anti-Virus Config Virus List229 230 Web filtering 231Adding words and phrases to the Banned Word list Content blockingGo to Web Filter Content Block 232Restoring the Banned Word list Clearing the Banned Word listBacking up the Banned Word list 233234 Example Banned Word List text fileAdding URLs to the Web URL block list Configuring FortiGate Web URL blockingURL blocking 235Uploading a URL block list Clearing the Web URL block listDownloading the Web URL block list 236237 Configuring FortiGate Web pattern blockingTo upload a URL block list Adding a Cerberian user Configuring Cerberian URL filteringInstalling a Cerberian license key 238To configure Cerberian web filtering Configuring Cerberian web filterAbout the default group and policy Enabling Cerberian URL filteringSelecting script filter options Script filteringEnabling script filtering 240241 Exempt URL listAdding URLs to the URL Exempt list Go to Web Filter URL ExemptUploading a URL Exempt List Downloading the URL Exempt List242 243 244 Email filter 245Adding words and phrases to the email banned word list Email banned word list246 Uploading the email banned word list Downloading the email banned word list247 Downloading the email block list Email block listAdding address patterns to the email block list 248249 Email exempt listUploading an email block list To upload the email block listAdding address patterns to the email exempt list To add a subject tag Go to Email Filter ConfigAdding a subject tag 250Recording logs on a remote computer Logging and reportingRecording logs 251Recording logs on a NetIQ WebTrends server 252Log message levels To filter log entries Go to Log&Report Log SettingFiltering log messages 253Configuring traffic logging 254Enabling traffic logging for an interface Configuring traffic filter settingsEnabling traffic logging Enabling traffic logging for a firewall policyAdding traffic filter entries Destination IP Address Destination Netmask Service256 257 Configuring alert emailAdding alert email addresses To add a DNS server Go to System Network DNSEnabling alert email Testing alert email258 Glossary 259260 261 262 Index 263264 Index265 DNS266 Http267 NAT268 269 RMA270 TCP271 VPN272