Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 50A user manual RIP configuration, RIP settings, 113

Models: 50A

1 272

Download 272 pages 24.69 Kb

Page 113

FortiGate-50A Installation and Configuration Guide Version 2.50

RIP configuration

The FortiGate implementation of the Routing Information Protocol (RIP) supports both RIP version 1 as defined by RFC 1058, and RIP version 2 as defined by RFC 2453. RIP version 2 enables RIP messages to carry more information, and to support simple authentication and subnet masks.

RIP is a distance-vector routing protocol intended for small, relatively homogeneous, networks. RIP uses hop count as its routing metric. Each network is usually counted as one hop. The network diameter is limited to 15 hops.

This chapter describes how to configure FortiGate RIP:

•RIP settings

•Configuring RIP for FortiGate interfaces

•Adding RIP filters

RIP settings

To configure RIP on the FortiGate unit

1Go to System > RIP > Settings.

2Select Enable RIP.

When you enable RIP, the Fortigate unit starts the RIP process. The FortiGate unit does not send or receive RIP packets until you enable RIP on at least one interface. For information about configuring RIP, see “Configuring RIP for FortiGate interfaces” on page 115.

3Select Enable Advertise Default if you want RIP to always send the default route to neighbors whether or not the default route is in the static routing table.

If you disable Advertise Default, RIP never sends the default route.

4Change the following RIP default settings, as required.

RIP defaults are effective in most configurations. You should only have to change these settings to troubleshoot problems with the RIP configuration.

FortiGate-50A Installation and Configuration Guide

113

Image 113

Fortinet 50A user manual RIP configuration, RIP settings, 113

Contents

February Installation and Configuration GuideRegulatory Compliance TrademarksTable of Contents Transparent mode installation Virus and attack definitions updates and registration Network configuration Firewall configuration 137 Users and authentication 171 Pptp and L2TP VPN 203 Antivirus protection 225 Glossary 259 Index 263 Contents NAT/Route mode NAT/Route mode and Transparent modeTransparent mode IntroductionDocument conventions Comments on Fortinet technical documentation Fortinet documentationCustomer service and technical support Getting started Mounting Package contentsConnecting to the web-based manager Powering onEnvironmental specifications To power on the FortiGate-50A unitTo connect to the web-based manager Connecting to the command line interface CLIStop bits Flow control To connect to the CLIBits per second Data bits Parity Factory default Dhcp configuration Factory default FortiGate configuration settingsFactory default firewall configuration Factory default NAT/Route mode network configurationFactory default Transparent mode network configuration Service Factory default firewall configuration RecurringAuthentication ContentStrict content profile Options Factory default content profilesStrict content profile Web content profile Scan content profileScan content profile Options Web content profile OptionsUnfiltered content profile Options Planning the FortiGate configurationUnfiltered content profile Setup wizard Configuration optionsCLI FortiGate model maximum values matrix Signatures Antivirus file Block patterns Web filter Next stepsNext steps Getting started NAT/Route mode installation Internal servers Preparing to configure NAT/Route modeChanging the default configuration Advanced NAT/Route mode settings Using the setup wizardStarting the setup wizard Reconnecting to the web-based managerConfiguring the FortiGate unit to operate in NAT/Route mode Using the command line interfaceConfiguring NAT/Route mode IP addresses ExampleInternal Connecting the FortiGate unit to your networksFortiGate-50A External Completing the configuration Configuring your networksSetting the date and time Changing antivirus protectionRegistering your FortiGate unit Configuring virus and attack definition updatesCompleting the configuration Preparing to configure Transparent mode Transparent mode installationTransparent mode settings Administrator Password DNS SettingsGo to System Status Changing to Transparent modeConfigure the Transparent mode default gateway Configuring the Transparent mode management IP addressConnecting the FortiGate unit to your networks Go to Firewall Policy Int-Ext Enabling antivirus protectionRegistering your FortiGate Default routes and static routes Transparent mode configuration examplesDefault route to an external network General configuration stepsCLI configuration steps Web-based manager example configuration stepsGo to System Network Management Go to System Network RoutingDMZ Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 System status System statusChanging the FortiGate host name Firmware upgrade procedures Procedure DescriptionChanging the FortiGate firmware To change the FortiGate host name Go to System StatusUpgrading the firmware using the CLI Upgrading the firmware using the web-based managerTo upgrade the firmware using the web-based manager To upgrade the firmware using the CLIExecute ping Reverting to a previous firmware versionReverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot Press any key to enter configuration menu To test a new firmware image Restoring the previous configurationTesting a new firmware image before installing it Save as Default firmware/Run image without savingD/R Manual attack definition updates Manual virus definition updatesTo update the antivirus definitions manually To update the attack definitions manuallyRestoring system settings Backing up system settingsDisplaying the FortiGate serial number Displaying the FortiGate up timeTo change to Transparent mode Go to System Status Restoring system settings to factory defaultsChanging to Transparent mode To change to NAT/Route mode Go to System Status Changing to NAT/Route modeRestarting the FortiGate unit Shutting down the FortiGate unitTo view CPU and memory status Go to System Status Monitor System statusViewing CPU and memory status CPU and memory status monitor Viewing sessions and network statusSessions and network status monitor Viewing virus and intrusions statusTo view the session list Go to System Status Session Session listExample session list ProtocolSession list Updating antivirus and attack definitions Virus and attack definitions updates and registrationGo to System Update Connecting to the FortiResponse Distribution NetworkVersion Expiry date Last update attempt Last update status To make sure the FortiGate unit can connect to the FDNManually initiating antivirus and attack definitions updates Configuring update logging Scheduling updatesEnabling scheduled updates To configure update logging Go to Log&Report Log SettingAdding an override server To add an override server Go to System UpdateEnabling scheduled updates through a proxy server Enabling push updatesPush updates when FortiGate IP addresses change Enabling push updatesEnabling push updates through a NAT device To enable push updates Go to System UpdateExample network topology Push updates through a NAT device Example push updates through a NAT deviceGeneral procedure Adding a firewall policy for the port forwarding virtual IP To configure the FortiGate NAT deviceSchedule Always Service ANY Action Accept Registering FortiGate units Example push update configurationFortiCare Service Contracts Registering the FortiGate unit Updating registration information Recovering a lost Fortinet support passwordViewing the list of registered FortiGate units Adding or changing a FortiCare Support Contract number Registering a new FortiGate unitChanging your contact information or security question Changing your Fortinet support passwordDownloading virus and attack definition updates Downloading virus and attack definitions updatesRegistering a FortiGate unit after an RMA Registering a FortiGate unit after an RMA Configuring interfaces Network configurationConfiguring an interface with a manual IP address Changing the administrative status of an interfaceTo stop an interface that is administratively up Viewing the interface listConnecting Configuring an interface for DhcpInitializing ConnectedAdding a secondary IP address to an interface Configuring an interface for PPPoEAdding a ping server to an interface Controlling administrative access to an interfaceChanging the MTU size to improve network performance Configuring traffic logging for connections to an interfaceConfiguring the management interface in Transparent mode Adding a default route Configuring routingAdding DNS server IP addresses 100101 Adding destination-based routes to the routing table102 Adding routes in Transparent modeConfiguring the routing table 103 Policy routingPolicy routing command syntax Configuring Dhcp servicesConfiguring a Dhcp relay agent 104Adding a Dhcp server to an interface Configuring a Dhcp serverAdding scopes to a Dhcp server 105106 Adding a reserve IP to a Dhcp serverScope Name IP Pool107 Configuring the modem interfaceViewing a Dhcp server dynamic IP list Configuring modem settings Connecting a modem to the FortiGate unitTo configure modem settings Go to System Network Modem 108Disconnecting the modem Connecting to a dialup account109 To connect to a dialup account Go to System Network ModemStandalone mode configuration Backup mode configurationTo configure backup mode Go to System Network Modem Viewing modem status111 To operate in standalone mode Go to System Network ModemAdding firewall policies for modem connections 112 113 RIP configurationRIP settings Flush InvalidHolddown 115 Configuring RIP for FortiGate interfaces116 Adding a RIP filter list Adding RIP filters117 To add a RIP filter list Go to System RIP FilterAssigning a RIP filter list to the incoming filter Assigning a RIP filter list to the neighbors filter119 Assigning a RIP filter list to the outgoing filter120 Setting system date and time System configurationTo set the date and time Go to System Config Time 121To set the Auth timeout Go to System Config Options To set the system idle timeout Go to System Config OptionsChanging system options 122123 Adding and editing administrator accountsModifying the Dead Gateway Detection settings Editing administrator accounts Adding new administrator accountsTo add an administrator account Go to System Config Admin 124125 Configuring SnmpTo edit an administrator account Go to System Config Admin Configuring FortiGate Snmp support Configuring the FortiGate unit for Snmp monitoringConfiguring Snmp access to an interface Configuring Snmp community settingsSystem Location 127System Name 128 FortiGate MIBsGeneral FortiGate traps FortiGate trapsSystem traps 129130 Firewall configuration System configuration and statusUsers and authentication configuration 131132 133 Replacement messagesCustomizing replacement messages 134 Customizing alert emailsNids event 135Critical event 136137 Firewall configuration138 Default firewall configurationAddresses Content profiles ServicesSchedules 139140 Adding firewall policies141 ActionTraffic Shaping VPN Tunnel142 Dynamic IP Pool Fixed PortAnti-Virus & Web filter Authentication143 Maximum Bandwidth Traffic PriorityLog Traffic Configuring policy listsComments 144145 Policy matching in detailChanging the order of policies in a policy list Enabling and disabling policies AddressesDisabling policies Enabling policiesTo add an address Go to Firewall Address Adding addresses147 Deleting addresses Editing addressesOrganizing addresses into address groups 148149 ServicesPredefined services GRE 150Ldap 151152 Adding custom TCP and UDP servicesAdding custom IP services Adding custom Icmp servicesGrouping services 153154 Schedules155 Creating one-time schedulesCreating recurring schedules 156 Adding schedules to policiesTo add a schedule to a policy Go to Firewall Policy Virtual IPs157 158 Adding static NAT virtual IPsTo add a static NAT virtual IP Go to Firewall Virtual IP Virtual IP External Interface examples Description Internal159 Adding port forwarding virtual IPsAdding a port forwarding virtual IP 160Adding policies with virtual IPs IP pools161 To add a policy with a virtual IP Go to Firewall PolicyIP Pools for firewall policies that use fixed ports Adding an IP poolIP pools and dynamic NAT 162Go to Firewall IP/MAC Binding Static IP/MAC IP/MAC binding163 164 Configuring IP/MAC binding for packets going to the firewallViewing the dynamic IP/MAC list Adding IP/MAC addressesEnabling IP/MAC binding 165166 Content profilesAdding content profiles Default content profilesTo add a content profile Go to Firewall Content Profile 167Oversized File/Email Pass Fragmented Email 168169 Adding content profiles to policiesTo add a content profile to a policy Go to Firewall Policy 170 171 Users and authenticationAdding user names and configuring authentication Setting authentication timeoutAdding user names and configuring authentication To set authentication timeout Go to System Config Options173 Deleting user names from the internal databaseAdding Radius servers Configuring Radius supportDeleting Radius servers 174Adding Ldap servers Configuring Ldap support175 To add an Ldap server Go to User LdapTo delete an Ldap server Go to User Ldap Deleting Ldap servers176 Adding user groups Configuring user groups177 To add a user group Go to User User GroupTo delete a user group Go to User User Group Deleting user groups178 179 IPSec VPNManual Keys Key managementAutoIKE with pre-shared keys AutoIKE with certificatesManual key IPSec VPNs General configuration steps for a manual key VPNAdding a manual key VPN tunnel 181182 AutoIKE IPSec VPNsAES128 AES192Adding a phase 1 configuration for an AutoIKE VPN General configuration steps for an AutoIKE VPNTo create an AutoIKE VPN configuration To add a phase 1 configuration Go to VPN Ipsec PhaseRemote Gateway Dialup User 184Remote Gateway Static IP Address 185 Configuring advanced optionsTo configure phase 1 advanced options 186 187 Adding a phase 1 configuration Standard options188 Adding a phase 2 configuration for an AutoIKE VPNTo add a phase 2 configuration Go to VPN Ipsec Phase Use wildcard selectors 189Use selectors from policy Obtaining a signed local certificate Managing digital certificatesGenerating the certificate request 190Key Size 191Key Type Importing the signed local certificate Downloading the certificate requestObtaining CA certificates 192193 Configuring encrypt policiesImporting CA certificates Adding a destination address Adding a source address194 To add a source address Go to Firewall AddressTo add an encrypt policy Go to Firewall Policy Adding an encrypt policy195 196 IPSec VPN concentrators197 VPN concentrator hub general configuration stepsTo create a VPN concentrator configuration Source InternalAll Destination VPN spoke address Action Adding a VPN concentrator198 199 VPN spoke general configuration stepsTo create a VPN spoke configuration Policies 200VPN Tunnel To view VPN tunnel status Go to VPN Ipsec Phase Monitoring and Troubleshooting VPNsViewing VPN tunnel status Viewing dialup VPN connection status202 Testing a VPNConfiguring the FortiGate unit as a Pptp gateway Configuring PptpPptp and L2TP VPN 203To add a source address 204To add a source address group 205To add a destination address To add a firewall policyTo connect to the Pptp VPN Configuring a Windows 98 client for Pptp206 207 Configuring a Windows 2000 client for PptpConfiguring a Windows XP client for Pptp Select Properties Security To configure the VPN connection208 209 Configuring L2TPConfiguring the FortiGate unit as an L2TP gateway To add source addresses 210211 Configuring a Windows 2000 client for L2TPTo connect to the L2TP VPN To disable IPSec212 213 Configuring a Windows XP client for L2TP214 215 Network Intrusion Detection System NidsDetecting attacks Selecting the interfaces to monitor Configuring checksum verificationDisabling monitoring interfaces 216217 Viewing the signature listViewing attack descriptions 218 Disabling Nids attack signaturesAdding user-defined signatures 219 Downloading the user-defined signature listPreventing attacks To enable Nids attack prevention Go to Nids PreventionEnabling Nids attack prevention Enabling Nids attack prevention signatures221 Setting signature threshold valuesLogging attack messages to the attack log Logging attacksReducing the number of Nids attack log and email messages Automatic message reduction223 Manual message reduction224 225 General configuration stepsAntivirus protection To scan FortiGate firewall traffic for viruses Antivirus scanning226 Blocking files in firewall traffic File blockingAdding file patterns to block 227Blocking oversized files and emails Configuring limits for oversized files and emailExempting fragmented email from blocking 228229 To view the virus list Go to Anti-Virus Config Virus ListViewing the virus list 230 231 Web filteringGo to Web Filter Content Block Content blockingAdding words and phrases to the Banned Word list 232Backing up the Banned Word list Clearing the Banned Word listRestoring the Banned Word list 233Example Banned Word List text file 234URL blocking Configuring FortiGate Web URL blockingAdding URLs to the Web URL block list 235Downloading the Web URL block list Clearing the Web URL block listUploading a URL block list 236To upload a URL block list Configuring FortiGate Web pattern blocking237 Installing a Cerberian license key Configuring Cerberian URL filteringAdding a Cerberian user 238About the default group and policy Configuring Cerberian web filterTo configure Cerberian web filtering Enabling Cerberian URL filteringEnabling script filtering Script filteringSelecting script filter options 240Adding URLs to the URL Exempt list Exempt URL list241 Go to Web Filter URL Exempt242 Downloading the URL Exempt ListUploading a URL Exempt List 243 244 245 Email filter246 Email banned word listAdding words and phrases to the email banned word list 247 Downloading the email banned word listUploading the email banned word list Adding address patterns to the email block list Email block listDownloading the email block list 248Uploading an email block list Email exempt list249 To upload the email block listAdding a subject tag To add a subject tag Go to Email Filter ConfigAdding address patterns to the email exempt list 250Recording logs Logging and reportingRecording logs on a remote computer 251252 Recording logs on a NetIQ WebTrends serverFiltering log messages To filter log entries Go to Log&Report Log SettingLog message levels 253254 Configuring traffic loggingEnabling traffic logging Configuring traffic filter settingsEnabling traffic logging for an interface Enabling traffic logging for a firewall policy256 Destination IP Address Destination Netmask ServiceAdding traffic filter entries Adding alert email addresses Configuring alert email257 To add a DNS server Go to System Network DNS258 Testing alert emailEnabling alert email 259 Glossary260 261 262 263 IndexIndex 264DNS 265Http 266NAT 267268 RMA 269TCP 270VPN 271272