Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 50A user manual Users and authentication

Models: 50A

1 272

Download 272 pages 24.69 Kb

Page 171

FortiGate-50A Installation and Configuration Guide Version 2.50

Users and authentication

FortiGate units support user authentication to the FortiGate user database, a RADIUS server, and an LDAP server. You can add user names to the FortiGate user database and then add a password to allow the user to authenticate using the internal database. You can also add the names of RADIUS and LDAP servers. You can select RADIUS to allow the user to authenticate using the selected RADIUS server or LDAP to allow the user to authenticate using the selected LDAP server. You can disable a user name so that the user cannot authenticate.

To enable authentication, you must add user names to one or more user groups. You can also add RADIUS servers and LDAP servers to user groups. You can then select a user group when you require authentication.

You can select user groups to require authentication for:

•any firewall policy with Action set to ACCEPT

•IPSec dialup user phase 1 configurations

•XAuth functionality for phase 1 IPSec VPN configurations

•PPTP

•L2TP

When a user enters a user name and password, the FortiGate unit searches the internal user database for a matching user name. If Disable is selected for that user name, the user cannot authenticate and the connection is dropped. If Password is selected for that user and the password matches, the connection is allowed. If the password does not match, the connection is dropped.

If RADIUS is selected and RADIUS support is configured and the user name and password match a user name and password on the RADIUS server, the connection is allowed. If the user name and password do not match a user name and password on the RADIUS server, the connection is dropped.

If LDAP is selected and LDAP support is configured and the user name and password match a user name and password on the LDAP server, the connection is allowed. If the user name and password do not match a user name and password on the LDAP server, the connection is dropped.

If the user group contains user names, RADIUS servers, and LDAP servers, the FortiGate unit checks them in the order in which they have been added to the user group.

FortiGate-50A Installation and Configuration Guide

171

Image 171

Fortinet 50A user manual Users and authentication

Contents

February Installation and Configuration GuideRegulatory Compliance TrademarksTable of Contents Transparent mode installation Virus and attack definitions updates and registration Network configuration Firewall configuration 137 Users and authentication 171 Pptp and L2TP VPN 203 Antivirus protection 225 Glossary 259 Index 263 Contents Introduction NAT/Route mode and Transparent modeNAT/Route mode Transparent modeDocument conventions Comments on Fortinet technical documentation Fortinet documentationCustomer service and technical support Getting started Mounting Package contentsTo power on the FortiGate-50A unit Powering onConnecting to the web-based manager Environmental specificationsTo connect to the web-based manager Connecting to the command line interface CLITo connect to the CLI Bits per second Data bits ParityStop bits Flow control Factory default Dhcp configuration Factory default FortiGate configuration settingsFactory default NAT/Route mode network configuration Factory default Transparent mode network configurationFactory default firewall configuration Content Factory default firewall configuration RecurringService AuthenticationFactory default content profiles Strict content profileStrict content profile Options Web content profile Options Scan content profileWeb content profile Scan content profile OptionsPlanning the FortiGate configuration Unfiltered content profileUnfiltered content profile Options Setup wizard Configuration optionsCLI FortiGate model maximum values matrix Signatures Antivirus file Block patterns Web filter Next stepsNext steps Getting started NAT/Route mode installation Preparing to configure NAT/Route mode Changing the default configurationInternal servers Reconnecting to the web-based manager Using the setup wizardAdvanced NAT/Route mode settings Starting the setup wizardExample Using the command line interfaceConfiguring the FortiGate unit to operate in NAT/Route mode Configuring NAT/Route mode IP addressesConnecting the FortiGate unit to your networks FortiGate-50A ExternalInternal Changing antivirus protection Configuring your networksCompleting the configuration Setting the date and timeRegistering your FortiGate unit Configuring virus and attack definition updatesCompleting the configuration DNS Settings Transparent mode installationPreparing to configure Transparent mode Transparent mode settings Administrator PasswordGo to System Status Changing to Transparent modeConfigure the Transparent mode default gateway Configuring the Transparent mode management IP addressConnecting the FortiGate unit to your networks Enabling antivirus protection Registering your FortiGateGo to Firewall Policy Int-Ext Default routes and static routes Transparent mode configuration examplesDefault route to an external network General configuration stepsGo to System Network Routing Web-based manager example configuration stepsCLI configuration steps Go to System Network ManagementDMZ Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 System status System statusTo change the FortiGate host name Go to System Status Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name Changing the FortiGate firmwareTo upgrade the firmware using the CLI Upgrading the firmware using the web-based managerUpgrading the firmware using the CLI To upgrade the firmware using the web-based managerExecute ping Reverting to a previous firmware versionReverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot Press any key to enter configuration menu Restoring the previous configuration Testing a new firmware image before installing itTo test a new firmware image Save as Default firmware/Run image without savingD/R To update the attack definitions manually Manual virus definition updatesManual attack definition updates To update the antivirus definitions manuallyDisplaying the FortiGate up time Backing up system settingsRestoring system settings Displaying the FortiGate serial numberRestoring system settings to factory defaults Changing to Transparent modeTo change to Transparent mode Go to System Status Shutting down the FortiGate unit Changing to NAT/Route modeTo change to NAT/Route mode Go to System Status Restarting the FortiGate unitSystem status Viewing CPU and memory statusTo view CPU and memory status Go to System Status Monitor CPU and memory status monitor Viewing sessions and network statusSessions and network status monitor Viewing virus and intrusions statusTo view the session list Go to System Status Session Session listExample session list ProtocolSession list Updating antivirus and attack definitions Virus and attack definitions updates and registrationTo make sure the FortiGate unit can connect to the FDN Connecting to the FortiResponse Distribution NetworkGo to System Update Version Expiry date Last update attempt Last update statusManually initiating antivirus and attack definitions updates To configure update logging Go to Log&Report Log Setting Scheduling updatesConfiguring update logging Enabling scheduled updatesAdding an override server To add an override server Go to System UpdateEnabling scheduled updates through a proxy server Enabling push updatesTo enable push updates Go to System Update Enabling push updatesPush updates when FortiGate IP addresses change Enabling push updates through a NAT deviceExample network topology Push updates through a NAT device Example push updates through a NAT deviceGeneral procedure To configure the FortiGate NAT device Schedule Always Service ANY Action AcceptAdding a firewall policy for the port forwarding virtual IP Registering FortiGate units Example push update configurationFortiCare Service Contracts Registering the FortiGate unit Updating registration information Recovering a lost Fortinet support passwordViewing the list of registered FortiGate units Adding or changing a FortiCare Support Contract number Registering a new FortiGate unitChanging your contact information or security question Changing your Fortinet support passwordDownloading virus and attack definition updates Downloading virus and attack definitions updatesRegistering a FortiGate unit after an RMA Registering a FortiGate unit after an RMA Configuring interfaces Network configurationViewing the interface list Changing the administrative status of an interfaceConfiguring an interface with a manual IP address To stop an interface that is administratively upConnected Configuring an interface for DhcpConnecting InitializingAdding a secondary IP address to an interface Configuring an interface for PPPoEAdding a ping server to an interface Controlling administrative access to an interfaceChanging the MTU size to improve network performance Configuring traffic logging for connections to an interfaceConfiguring the management interface in Transparent mode 100 Configuring routingAdding a default route Adding DNS server IP addresses101 Adding destination-based routes to the routing tableAdding routes in Transparent mode Configuring the routing table102 103 Policy routing104 Configuring Dhcp servicesPolicy routing command syntax Configuring a Dhcp relay agent105 Configuring a Dhcp serverAdding a Dhcp server to an interface Adding scopes to a Dhcp serverIP Pool Adding a reserve IP to a Dhcp server106 Scope NameConfiguring the modem interface Viewing a Dhcp server dynamic IP list107 108 Connecting a modem to the FortiGate unitConfiguring modem settings To configure modem settings Go to System Network ModemTo connect to a dialup account Go to System Network Modem Connecting to a dialup accountDisconnecting the modem 109Viewing modem status Backup mode configurationStandalone mode configuration To configure backup mode Go to System Network ModemTo operate in standalone mode Go to System Network Modem Adding firewall policies for modem connections111 112 RIP configuration RIP settings113 Invalid HolddownFlush 115 Configuring RIP for FortiGate interfaces116 To add a RIP filter list Go to System RIP Filter Adding RIP filtersAdding a RIP filter list 117Assigning a RIP filter list to the incoming filter Assigning a RIP filter list to the neighbors filter119 Assigning a RIP filter list to the outgoing filter120 121 System configurationSetting system date and time To set the date and time Go to System Config Time122 To set the system idle timeout Go to System Config OptionsTo set the Auth timeout Go to System Config Options Changing system optionsAdding and editing administrator accounts Modifying the Dead Gateway Detection settings123 124 Adding new administrator accountsEditing administrator accounts To add an administrator account Go to System Config AdminConfiguring Snmp To edit an administrator account Go to System Config Admin125 Configuring Snmp community settings Configuring the FortiGate unit for Snmp monitoringConfiguring FortiGate Snmp support Configuring Snmp access to an interface127 System NameSystem Location 128 FortiGate MIBs129 FortiGate trapsGeneral FortiGate traps System traps130 131 System configuration and statusFirewall configuration Users and authentication configuration132 Replacement messages Customizing replacement messages133 134 Customizing alert emailsNids event 135Critical event 136137 Firewall configurationDefault firewall configuration Addresses138 139 ServicesContent profiles Schedules140 Adding firewall policies141 ActionDynamic IP Pool Fixed Port VPN TunnelTraffic Shaping 142Maximum Bandwidth Traffic Priority AuthenticationAnti-Virus & Web filter 143144 Configuring policy listsLog Traffic CommentsPolicy matching in detail Changing the order of policies in a policy list145 Enabling policies AddressesEnabling and disabling policies Disabling policiesAdding addresses 147To add an address Go to Firewall Address 148 Editing addressesDeleting addresses Organizing addresses into address groupsServices Predefined services149 GRE 150Ldap 151152 Adding custom TCP and UDP services153 Adding custom Icmp servicesAdding custom IP services Grouping services154 SchedulesCreating one-time schedules Creating recurring schedules155 156 Adding schedules to policiesVirtual IPs 157To add a schedule to a policy Go to Firewall Policy Virtual IP External Interface examples Description Internal Adding static NAT virtual IPs158 To add a static NAT virtual IP Go to Firewall Virtual IP159 Adding port forwarding virtual IPsAdding a port forwarding virtual IP 160To add a policy with a virtual IP Go to Firewall Policy IP poolsAdding policies with virtual IPs 161162 Adding an IP poolIP Pools for firewall policies that use fixed ports IP pools and dynamic NATIP/MAC binding 163Go to Firewall IP/MAC Binding Static IP/MAC 164 Configuring IP/MAC binding for packets going to the firewall165 Adding IP/MAC addressesViewing the dynamic IP/MAC list Enabling IP/MAC binding166 Content profiles167 Default content profilesAdding content profiles To add a content profile Go to Firewall Content ProfileOversized File/Email Pass Fragmented Email 168Adding content profiles to policies To add a content profile to a policy Go to Firewall Policy169 170 171 Users and authenticationTo set authentication timeout Go to System Config Options Setting authentication timeoutAdding user names and configuring authentication Adding user names and configuring authentication173 Deleting user names from the internal database174 Configuring Radius supportAdding Radius servers Deleting Radius serversTo add an Ldap server Go to User Ldap Configuring Ldap supportAdding Ldap servers 175Deleting Ldap servers 176To delete an Ldap server Go to User Ldap To add a user group Go to User User Group Configuring user groupsAdding user groups 177Deleting user groups 178To delete a user group Go to User User Group 179 IPSec VPNAutoIKE with certificates Key managementManual Keys AutoIKE with pre-shared keys181 General configuration steps for a manual key VPNManual key IPSec VPNs Adding a manual key VPN tunnelAES192 AutoIKE IPSec VPNs182 AES128To add a phase 1 configuration Go to VPN Ipsec Phase General configuration steps for an AutoIKE VPNAdding a phase 1 configuration for an AutoIKE VPN To create an AutoIKE VPN configuration184 Remote Gateway Static IP AddressRemote Gateway Dialup User Configuring advanced options To configure phase 1 advanced options185 186 187 Adding a phase 1 configuration Standard optionsAdding a phase 2 configuration for an AutoIKE VPN To add a phase 2 configuration Go to VPN Ipsec Phase188 189 Use selectors from policyUse wildcard selectors 190 Managing digital certificatesObtaining a signed local certificate Generating the certificate request191 Key TypeKey Size 192 Downloading the certificate requestImporting the signed local certificate Obtaining CA certificatesConfiguring encrypt policies Importing CA certificates193 To add a source address Go to Firewall Address Adding a source addressAdding a destination address 194Adding an encrypt policy 195To add an encrypt policy Go to Firewall Policy 196 IPSec VPN concentratorsVPN concentrator hub general configuration steps To create a VPN concentrator configuration197 Adding a VPN concentrator 198Source InternalAll Destination VPN spoke address Action VPN spoke general configuration steps To create a VPN spoke configuration199 200 VPN TunnelPolicies Viewing dialup VPN connection status Monitoring and Troubleshooting VPNsTo view VPN tunnel status Go to VPN Ipsec Phase Viewing VPN tunnel status202 Testing a VPN203 Configuring PptpConfiguring the FortiGate unit as a Pptp gateway Pptp and L2TP VPNTo add a source address 204To add a firewall policy 205To add a source address group To add a destination addressConfiguring a Windows 98 client for Pptp 206To connect to the Pptp VPN Configuring a Windows 2000 client for Pptp Configuring a Windows XP client for Pptp207 To configure the VPN connection 208Select Properties Security Configuring L2TP Configuring the FortiGate unit as an L2TP gateway209 To add source addresses 210211 Configuring a Windows 2000 client for L2TPTo disable IPSec 212To connect to the L2TP VPN 213 Configuring a Windows XP client for L2TP214 Network Intrusion Detection System Nids Detecting attacks215 216 Configuring checksum verificationSelecting the interfaces to monitor Disabling monitoring interfacesViewing the signature list Viewing attack descriptions217 Disabling Nids attack signatures Adding user-defined signatures218 219 Downloading the user-defined signature listEnabling Nids attack prevention signatures To enable Nids attack prevention Go to Nids PreventionPreventing attacks Enabling Nids attack prevention221 Setting signature threshold valuesAutomatic message reduction Logging attacksLogging attack messages to the attack log Reducing the number of Nids attack log and email messages223 Manual message reduction224 General configuration steps Antivirus protection225 Antivirus scanning 226To scan FortiGate firewall traffic for viruses 227 File blockingBlocking files in firewall traffic Adding file patterns to block228 Configuring limits for oversized files and emailBlocking oversized files and emails Exempting fragmented email from blockingTo view the virus list Go to Anti-Virus Config Virus List Viewing the virus list229 230 231 Web filtering232 Content blockingGo to Web Filter Content Block Adding words and phrases to the Banned Word list233 Clearing the Banned Word listBacking up the Banned Word list Restoring the Banned Word listExample Banned Word List text file 234235 Configuring FortiGate Web URL blockingURL blocking Adding URLs to the Web URL block list236 Clearing the Web URL block listDownloading the Web URL block list Uploading a URL block listConfiguring FortiGate Web pattern blocking 237To upload a URL block list 238 Configuring Cerberian URL filteringInstalling a Cerberian license key Adding a Cerberian userEnabling Cerberian URL filtering Configuring Cerberian web filterAbout the default group and policy To configure Cerberian web filtering240 Script filteringEnabling script filtering Selecting script filter optionsGo to Web Filter URL Exempt Exempt URL listAdding URLs to the URL Exempt list 241Downloading the URL Exempt List Uploading a URL Exempt List242 243 244 245 Email filterEmail banned word list Adding words and phrases to the email banned word list246 Downloading the email banned word list Uploading the email banned word list247 248 Email block listAdding address patterns to the email block list Downloading the email block listTo upload the email block list Email exempt listUploading an email block list 249250 To add a subject tag Go to Email Filter ConfigAdding a subject tag Adding address patterns to the email exempt list251 Logging and reportingRecording logs Recording logs on a remote computer252 Recording logs on a NetIQ WebTrends server253 To filter log entries Go to Log&Report Log SettingFiltering log messages Log message levels254 Configuring traffic loggingEnabling traffic logging for a firewall policy Configuring traffic filter settingsEnabling traffic logging Enabling traffic logging for an interfaceDestination IP Address Destination Netmask Service Adding traffic filter entries256 To add a DNS server Go to System Network DNS Configuring alert emailAdding alert email addresses 257Testing alert email Enabling alert email258 259 Glossary260 261 262 263 IndexIndex 264DNS 265Http 266NAT 267268 RMA 269TCP 270VPN 271272