IPSec VPN concentrators, 196 | Fortinet 50A instruction

IPSec VPN concentrators	IPSec VPN

To make sure that the encrypt policy is matched for VPN connections, arrange the encrypt policy above other policies with similar source and destination addresses and services in the policy list.

Figure 25: Adding an encrypt policy

IPSec VPN concentrators

In a hub-and-spoke network, all VPN tunnels terminate at a single VPN peer called a hub. The peers that connect to the hub are known as spokes. The hub functions as a concentrator on the network, managing the VPN connections between the spokes.

The advantage of a hub-and-spoke network is that the spokes are simpler to configure because they require fewer policy rules. Also, a hub-and-spoke network provides some processing efficiencies, particularly on the spokes. The disadvantage of a hub- and-spoke network is its reliance on a single peer to handle management of all VPNs. If this peer fails, encrypted communication in the network is impossible.

A hub-and-spoke VPN network requires a special configuration. Setup varies depending on the role of the VPN peer.

196	Fortinet Inc.

Image 196

Fortinet 50A user manual IPSec VPN concentrators, 196

Contents

Installation and Configuration Guide February Trademarks Regulatory Compliance Table of Contents Transparent mode installation Virus and attack definitions updates and registration Network configuration Firewall configuration 137 Users and authentication 171 Pptp and L2TP VPN 203 Antivirus protection 225 Glossary 259 Index 263 Contents NAT/Route mode and Transparent mode NAT/Route modeTransparent mode Introduction Document conventions Fortinet documentation Comments on Fortinet technical documentation Customer service and technical support Getting started Package contents Mounting Powering on Connecting to the web-based managerEnvironmental specifications To power on the FortiGate-50A unit Connecting to the command line interface CLI To connect to the web-based manager Bits per second Data bits Parity To connect to the CLIStop bits Flow control Factory default FortiGate configuration settings Factory default Dhcp configuration Factory default Transparent mode network configuration Factory default NAT/Route mode network configurationFactory default firewall configuration Factory default firewall configuration Recurring ServiceAuthentication Content Strict content profile Factory default content profilesStrict content profile Options Scan content profile Web content profileScan content profile Options Web content profile Options Unfiltered content profile Planning the FortiGate configurationUnfiltered content profile Options Configuration options Setup wizard CLI FortiGate model maximum values matrix Next steps Signatures Antivirus file Block patterns Web filter Next steps Getting started NAT/Route mode installation Changing the default configuration Preparing to configure NAT/Route modeInternal servers Using the setup wizard Advanced NAT/Route mode settingsStarting the setup wizard Reconnecting to the web-based manager Using the command line interface Configuring the FortiGate unit to operate in NAT/Route modeConfiguring NAT/Route mode IP addresses Example FortiGate-50A External Connecting the FortiGate unit to your networksInternal Configuring your networks Completing the configurationSetting the date and time Changing antivirus protection Configuring virus and attack definition updates Registering your FortiGate unit Completing the configuration Transparent mode installation Preparing to configure Transparent modeTransparent mode settings Administrator Password DNS Settings Changing to Transparent mode Go to System Status Configuring the Transparent mode management IP address Configure the Transparent mode default gateway Connecting the FortiGate unit to your networks Registering your FortiGate Enabling antivirus protectionGo to Firewall Policy Int-Ext Transparent mode configuration examples Default routes and static routes General configuration steps Default route to an external network Web-based manager example configuration steps CLI configuration stepsGo to System Network Management Go to System Network Routing DMZ Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 System status System status Firmware upgrade procedures Procedure Description Changing the FortiGate host nameChanging the FortiGate firmware To change the FortiGate host name Go to System Status Upgrading the firmware using the web-based manager Upgrading the firmware using the CLITo upgrade the firmware using the web-based manager To upgrade the firmware using the CLI Reverting to a previous firmware version Execute ping Reverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot Press any key to enter configuration menu Testing a new firmware image before installing it Restoring the previous configurationTo test a new firmware image Save as Default firmware/Run image without savingD/R Manual virus definition updates Manual attack definition updatesTo update the antivirus definitions manually To update the attack definitions manually Backing up system settings Restoring system settingsDisplaying the FortiGate serial number Displaying the FortiGate up time Changing to Transparent mode Restoring system settings to factory defaultsTo change to Transparent mode Go to System Status Changing to NAT/Route mode To change to NAT/Route mode Go to System StatusRestarting the FortiGate unit Shutting down the FortiGate unit Viewing CPU and memory status System statusTo view CPU and memory status Go to System Status Monitor Viewing sessions and network status CPU and memory status monitor Viewing virus and intrusions status Sessions and network status monitor Session list To view the session list Go to System Status Session Protocol Example session list Session list Virus and attack definitions updates and registration Updating antivirus and attack definitions Connecting to the FortiResponse Distribution Network Go to System UpdateVersion Expiry date Last update attempt Last update status To make sure the FortiGate unit can connect to the FDN Manually initiating antivirus and attack definitions updates Scheduling updates Configuring update loggingEnabling scheduled updates To configure update logging Go to Log&Report Log Setting To add an override server Go to System Update Adding an override server Enabling push updates Enabling scheduled updates through a proxy server Enabling push updates Push updates when FortiGate IP addresses changeEnabling push updates through a NAT device To enable push updates Go to System Update Example push updates through a NAT device Example network topology Push updates through a NAT device General procedure Schedule Always Service ANY Action Accept To configure the FortiGate NAT deviceAdding a firewall policy for the port forwarding virtual IP Example push update configuration Registering FortiGate units FortiCare Service Contracts Registering the FortiGate unit Recovering a lost Fortinet support password Updating registration information Viewing the list of registered FortiGate units Registering a new FortiGate unit Adding or changing a FortiCare Support Contract number Changing your Fortinet support password Changing your contact information or security question Downloading virus and attack definitions updates Downloading virus and attack definition updates Registering a FortiGate unit after an RMA Registering a FortiGate unit after an RMA Network configuration Configuring interfaces Changing the administrative status of an interface Configuring an interface with a manual IP addressTo stop an interface that is administratively up Viewing the interface list Configuring an interface for Dhcp ConnectingInitializing Connected Configuring an interface for PPPoE Adding a secondary IP address to an interface Controlling administrative access to an interface Adding a ping server to an interface Configuring traffic logging for connections to an interface Changing the MTU size to improve network performance Configuring the management interface in Transparent mode Configuring routing Adding a default routeAdding DNS server IP addresses 100 Adding destination-based routes to the routing table 101 Configuring the routing table Adding routes in Transparent mode102 Policy routing 103 Configuring Dhcp services Policy routing command syntaxConfiguring a Dhcp relay agent 104 Configuring a Dhcp server Adding a Dhcp server to an interfaceAdding scopes to a Dhcp server 105 Adding a reserve IP to a Dhcp server 106Scope Name IP Pool Viewing a Dhcp server dynamic IP list Configuring the modem interface107 Connecting a modem to the FortiGate unit Configuring modem settingsTo configure modem settings Go to System Network Modem 108 Connecting to a dialup account Disconnecting the modem109 To connect to a dialup account Go to System Network Modem Backup mode configuration Standalone mode configurationTo configure backup mode Go to System Network Modem Viewing modem status Adding firewall policies for modem connections To operate in standalone mode Go to System Network Modem111 112 RIP settings RIP configuration113 Holddown InvalidFlush Configuring RIP for FortiGate interfaces 115 116 Adding RIP filters Adding a RIP filter list117 To add a RIP filter list Go to System RIP Filter Assigning a RIP filter list to the neighbors filter Assigning a RIP filter list to the incoming filter Assigning a RIP filter list to the outgoing filter 119 120 System configuration Setting system date and timeTo set the date and time Go to System Config Time 121 To set the system idle timeout Go to System Config Options To set the Auth timeout Go to System Config OptionsChanging system options 122 Modifying the Dead Gateway Detection settings Adding and editing administrator accounts123 Adding new administrator accounts Editing administrator accountsTo add an administrator account Go to System Config Admin 124 To edit an administrator account Go to System Config Admin Configuring Snmp125 Configuring the FortiGate unit for Snmp monitoring Configuring FortiGate Snmp supportConfiguring Snmp access to an interface Configuring Snmp community settings System Name 127System Location FortiGate MIBs 128 FortiGate traps General FortiGate trapsSystem traps 129 130 System configuration and status Firewall configurationUsers and authentication configuration 131 132 Customizing replacement messages Replacement messages133 Customizing alert emails 134 135 Nids event 136 Critical event Firewall configuration 137 Addresses Default firewall configuration138 Services Content profilesSchedules 139 Adding firewall policies 140 Action 141 VPN Tunnel Traffic Shaping142 Dynamic IP Pool Fixed Port Authentication Anti-Virus & Web filter143 Maximum Bandwidth Traffic Priority Configuring policy lists Log TrafficComments 144 Changing the order of policies in a policy list Policy matching in detail145 Addresses Enabling and disabling policiesDisabling policies Enabling policies 147 Adding addressesTo add an address Go to Firewall Address Editing addresses Deleting addressesOrganizing addresses into address groups 148 Predefined services Services149 150 GRE 151 Ldap Adding custom TCP and UDP services 152 Adding custom Icmp services Adding custom IP servicesGrouping services 153 Schedules 154 Creating recurring schedules Creating one-time schedules155 Adding schedules to policies 156 157 Virtual IPsTo add a schedule to a policy Go to Firewall Policy Adding static NAT virtual IPs 158To add a static NAT virtual IP Go to Firewall Virtual IP Virtual IP External Interface examples Description Internal Adding port forwarding virtual IPs 159 160 Adding a port forwarding virtual IP IP pools Adding policies with virtual IPs161 To add a policy with a virtual IP Go to Firewall Policy Adding an IP pool IP Pools for firewall policies that use fixed portsIP pools and dynamic NAT 162 163 IP/MAC bindingGo to Firewall IP/MAC Binding Static IP/MAC Configuring IP/MAC binding for packets going to the firewall 164 Adding IP/MAC addresses Viewing the dynamic IP/MAC listEnabling IP/MAC binding 165 Content profiles 166 Default content profiles Adding content profilesTo add a content profile Go to Firewall Content Profile 167 168 Oversized File/Email Pass Fragmented Email To add a content profile to a policy Go to Firewall Policy Adding content profiles to policies169 170 Users and authentication 171 Setting authentication timeout Adding user names and configuring authenticationAdding user names and configuring authentication To set authentication timeout Go to System Config Options Deleting user names from the internal database 173 Configuring Radius support Adding Radius serversDeleting Radius servers 174 Configuring Ldap support Adding Ldap servers175 To add an Ldap server Go to User Ldap 176 Deleting Ldap serversTo delete an Ldap server Go to User Ldap Configuring user groups Adding user groups177 To add a user group Go to User User Group 178 Deleting user groupsTo delete a user group Go to User User Group IPSec VPN 179 Key management Manual KeysAutoIKE with pre-shared keys AutoIKE with certificates General configuration steps for a manual key VPN Manual key IPSec VPNsAdding a manual key VPN tunnel 181 AutoIKE IPSec VPNs 182AES128 AES192 General configuration steps for an AutoIKE VPN Adding a phase 1 configuration for an AutoIKE VPNTo create an AutoIKE VPN configuration To add a phase 1 configuration Go to VPN Ipsec Phase Remote Gateway Static IP Address 184Remote Gateway Dialup User To configure phase 1 advanced options Configuring advanced options185 186 Adding a phase 1 configuration Standard options 187 To add a phase 2 configuration Go to VPN Ipsec Phase Adding a phase 2 configuration for an AutoIKE VPN188 Use selectors from policy 189Use wildcard selectors Managing digital certificates Obtaining a signed local certificateGenerating the certificate request 190 Key Type 191Key Size Downloading the certificate request Importing the signed local certificateObtaining CA certificates 192 Importing CA certificates Configuring encrypt policies193 Adding a source address Adding a destination address194 To add a source address Go to Firewall Address 195 Adding an encrypt policyTo add an encrypt policy Go to Firewall Policy IPSec VPN concentrators 196 To create a VPN concentrator configuration VPN concentrator hub general configuration steps197 198 Adding a VPN concentratorSource InternalAll Destination VPN spoke address Action To create a VPN spoke configuration VPN spoke general configuration steps199 VPN Tunnel 200Policies Monitoring and Troubleshooting VPNs To view VPN tunnel status Go to VPN Ipsec PhaseViewing VPN tunnel status Viewing dialup VPN connection status Testing a VPN 202 Configuring Pptp Configuring the FortiGate unit as a Pptp gatewayPptp and L2TP VPN 203 204 To add a source address 205 To add a source address groupTo add a destination address To add a firewall policy 206 Configuring a Windows 98 client for PptpTo connect to the Pptp VPN Configuring a Windows XP client for Pptp Configuring a Windows 2000 client for Pptp207 208 To configure the VPN connectionSelect Properties Security Configuring the FortiGate unit as an L2TP gateway Configuring L2TP209 210 To add source addresses Configuring a Windows 2000 client for L2TP 211 212 To disable IPSecTo connect to the L2TP VPN Configuring a Windows XP client for L2TP 213 214 Detecting attacks Network Intrusion Detection System Nids215 Configuring checksum verification Selecting the interfaces to monitorDisabling monitoring interfaces 216 Viewing attack descriptions Viewing the signature list217 Adding user-defined signatures Disabling Nids attack signatures218 Downloading the user-defined signature list 219 To enable Nids attack prevention Go to Nids Prevention Preventing attacksEnabling Nids attack prevention Enabling Nids attack prevention signatures Setting signature threshold values 221 Logging attacks Logging attack messages to the attack logReducing the number of Nids attack log and email messages Automatic message reduction Manual message reduction 223 224 Antivirus protection General configuration steps225 226 Antivirus scanningTo scan FortiGate firewall traffic for viruses File blocking Blocking files in firewall trafficAdding file patterns to block 227 Configuring limits for oversized files and email Blocking oversized files and emailsExempting fragmented email from blocking 228 Viewing the virus list To view the virus list Go to Anti-Virus Config Virus List229 230 Web filtering 231 Content blocking Go to Web Filter Content BlockAdding words and phrases to the Banned Word list 232 Clearing the Banned Word list Backing up the Banned Word listRestoring the Banned Word list 233 234 Example Banned Word List text file Configuring FortiGate Web URL blocking URL blockingAdding URLs to the Web URL block list 235 Clearing the Web URL block list Downloading the Web URL block listUploading a URL block list 236 237 Configuring FortiGate Web pattern blockingTo upload a URL block list Configuring Cerberian URL filtering Installing a Cerberian license keyAdding a Cerberian user 238 Configuring Cerberian web filter About the default group and policyTo configure Cerberian web filtering Enabling Cerberian URL filtering Script filtering Enabling script filteringSelecting script filter options 240 Exempt URL list Adding URLs to the URL Exempt list241 Go to Web Filter URL Exempt Uploading a URL Exempt List Downloading the URL Exempt List242 243 244 Email filter 245 Adding words and phrases to the email banned word list Email banned word list246 Uploading the email banned word list Downloading the email banned word list247 Email block list Adding address patterns to the email block listDownloading the email block list 248 Email exempt list Uploading an email block list249 To upload the email block list To add a subject tag Go to Email Filter Config Adding a subject tagAdding address patterns to the email exempt list 250 Logging and reporting Recording logsRecording logs on a remote computer 251 Recording logs on a NetIQ WebTrends server 252 To filter log entries Go to Log&Report Log Setting Filtering log messagesLog message levels 253 Configuring traffic logging 254 Configuring traffic filter settings Enabling traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a firewall policy Adding traffic filter entries Destination IP Address Destination Netmask Service256 Configuring alert email Adding alert email addresses257 To add a DNS server Go to System Network DNS Enabling alert email Testing alert email258 Glossary 259 260 261 262 Index 263 264 Index 265 DNS 266 Http 267 NAT 268 269 RMA 270 TCP 271 VPN 272