Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 50A user manual Pptp and L2TP VPN, Configuring Pptp, 203, To add users and user groups

Models: 50A

1 272

Download 272 pages 24.69 Kb

Page 203

FortiGate-50A Installation and Configuration Guide Version 2.50

PPTP and L2TP VPN

You can use PPTP and L2TP to create a virtual private network (VPN) between a remote client computer that is running Windows and your internal network. Because PPTP and L2TP are supported by Windows you do not require third-party software on the client computer. Provided your ISP supports PPTP and L2TP connections, you can create a secure connection by making some configuration changes to the client computer and the FortiGate unit.

This chapter provides an overview of how to configure FortiGate PPTP and L2TP VPN. For a complete description of FortiGate PPTP and L2TP, see the FortiGate VPN Guide.

This chapter describes:

•Configuring PPTP

•Configuring L2TP

Configuring PPTP

Point-to-Point protocol (PPTP) packages data within PPP packets and then encapsulates the PPP packets within IP packets for transmission through a VPN tunnel.

Note: PPTP VPNs are supported only in NAT/Route mode.

This section describes:

•Configuring the FortiGate unit as a PPTP gateway

•Configuring a Windows 98 client for PPTP

•Configuring a Windows 2000 client for PPTP

•Configuring a Windows XP client for PPTP

Configuring the FortiGate unit as a PPTP gateway

Use the following procedures to configure the FortiGate unit as a PPTP gateway:

To add users and user groups

Add a user for each PPTP client.

1 Go to User > Local.

FortiGate-50A Installation and Configuration Guide

203

Image 203

Fortinet 50A user manual Pptp and L2TP VPN, Configuring Pptp, Configuring the FortiGate unit as a Pptp gateway, 203

Contents

February Installation and Configuration GuideRegulatory Compliance TrademarksTable of Contents Transparent mode installation Virus and attack definitions updates and registration Network configuration Firewall configuration 137 Users and authentication 171 Pptp and L2TP VPN 203 Antivirus protection 225 Glossary 259 Index 263 Contents Introduction NAT/Route mode and Transparent modeNAT/Route mode Transparent modeDocument conventions Comments on Fortinet technical documentation Fortinet documentationCustomer service and technical support Getting started Mounting Package contentsTo power on the FortiGate-50A unit Powering onConnecting to the web-based manager Environmental specificationsTo connect to the web-based manager Connecting to the command line interface CLIStop bits Flow control To connect to the CLIBits per second Data bits Parity Factory default Dhcp configuration Factory default FortiGate configuration settingsFactory default firewall configuration Factory default NAT/Route mode network configurationFactory default Transparent mode network configuration Content Factory default firewall configuration RecurringService AuthenticationStrict content profile Options Factory default content profilesStrict content profile Web content profile Options Scan content profileWeb content profile Scan content profile OptionsUnfiltered content profile Options Planning the FortiGate configurationUnfiltered content profile Setup wizard Configuration optionsCLI FortiGate model maximum values matrix Signatures Antivirus file Block patterns Web filter Next stepsNext steps Getting started NAT/Route mode installation Internal servers Preparing to configure NAT/Route modeChanging the default configuration Reconnecting to the web-based manager Using the setup wizardAdvanced NAT/Route mode settings Starting the setup wizardExample Using the command line interfaceConfiguring the FortiGate unit to operate in NAT/Route mode Configuring NAT/Route mode IP addressesInternal Connecting the FortiGate unit to your networksFortiGate-50A External Changing antivirus protection Configuring your networksCompleting the configuration Setting the date and timeRegistering your FortiGate unit Configuring virus and attack definition updatesCompleting the configuration DNS Settings Transparent mode installationPreparing to configure Transparent mode Transparent mode settings Administrator PasswordGo to System Status Changing to Transparent modeConfigure the Transparent mode default gateway Configuring the Transparent mode management IP addressConnecting the FortiGate unit to your networks Go to Firewall Policy Int-Ext Enabling antivirus protectionRegistering your FortiGate Default routes and static routes Transparent mode configuration examplesDefault route to an external network General configuration stepsGo to System Network Routing Web-based manager example configuration stepsCLI configuration steps Go to System Network ManagementDMZ Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 System status System statusTo change the FortiGate host name Go to System Status Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name Changing the FortiGate firmwareTo upgrade the firmware using the CLI Upgrading the firmware using the web-based managerUpgrading the firmware using the CLI To upgrade the firmware using the web-based managerExecute ping Reverting to a previous firmware versionReverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot Press any key to enter configuration menu To test a new firmware image Restoring the previous configurationTesting a new firmware image before installing it Save as Default firmware/Run image without savingD/R To update the attack definitions manually Manual virus definition updatesManual attack definition updates To update the antivirus definitions manuallyDisplaying the FortiGate up time Backing up system settingsRestoring system settings Displaying the FortiGate serial numberTo change to Transparent mode Go to System Status Restoring system settings to factory defaultsChanging to Transparent mode Shutting down the FortiGate unit Changing to NAT/Route modeTo change to NAT/Route mode Go to System Status Restarting the FortiGate unitTo view CPU and memory status Go to System Status Monitor System statusViewing CPU and memory status CPU and memory status monitor Viewing sessions and network statusSessions and network status monitor Viewing virus and intrusions statusTo view the session list Go to System Status Session Session listExample session list ProtocolSession list Updating antivirus and attack definitions Virus and attack definitions updates and registrationTo make sure the FortiGate unit can connect to the FDN Connecting to the FortiResponse Distribution NetworkGo to System Update Version Expiry date Last update attempt Last update statusManually initiating antivirus and attack definitions updates To configure update logging Go to Log&Report Log Setting Scheduling updatesConfiguring update logging Enabling scheduled updatesAdding an override server To add an override server Go to System UpdateEnabling scheduled updates through a proxy server Enabling push updatesTo enable push updates Go to System Update Enabling push updatesPush updates when FortiGate IP addresses change Enabling push updates through a NAT deviceExample network topology Push updates through a NAT device Example push updates through a NAT deviceGeneral procedure Adding a firewall policy for the port forwarding virtual IP To configure the FortiGate NAT deviceSchedule Always Service ANY Action Accept Registering FortiGate units Example push update configurationFortiCare Service Contracts Registering the FortiGate unit Updating registration information Recovering a lost Fortinet support passwordViewing the list of registered FortiGate units Adding or changing a FortiCare Support Contract number Registering a new FortiGate unitChanging your contact information or security question Changing your Fortinet support passwordDownloading virus and attack definition updates Downloading virus and attack definitions updatesRegistering a FortiGate unit after an RMA Registering a FortiGate unit after an RMA Configuring interfaces Network configurationViewing the interface list Changing the administrative status of an interfaceConfiguring an interface with a manual IP address To stop an interface that is administratively upConnected Configuring an interface for DhcpConnecting InitializingAdding a secondary IP address to an interface Configuring an interface for PPPoEAdding a ping server to an interface Controlling administrative access to an interfaceChanging the MTU size to improve network performance Configuring traffic logging for connections to an interfaceConfiguring the management interface in Transparent mode 100 Configuring routingAdding a default route Adding DNS server IP addresses101 Adding destination-based routes to the routing table102 Adding routes in Transparent modeConfiguring the routing table 103 Policy routing104 Configuring Dhcp servicesPolicy routing command syntax Configuring a Dhcp relay agent105 Configuring a Dhcp serverAdding a Dhcp server to an interface Adding scopes to a Dhcp serverIP Pool Adding a reserve IP to a Dhcp server106 Scope Name107 Configuring the modem interfaceViewing a Dhcp server dynamic IP list 108 Connecting a modem to the FortiGate unitConfiguring modem settings To configure modem settings Go to System Network ModemTo connect to a dialup account Go to System Network Modem Connecting to a dialup accountDisconnecting the modem 109Viewing modem status Backup mode configurationStandalone mode configuration To configure backup mode Go to System Network Modem111 To operate in standalone mode Go to System Network ModemAdding firewall policies for modem connections 112 113 RIP configurationRIP settings Flush InvalidHolddown 115 Configuring RIP for FortiGate interfaces116 To add a RIP filter list Go to System RIP Filter Adding RIP filtersAdding a RIP filter list 117Assigning a RIP filter list to the incoming filter Assigning a RIP filter list to the neighbors filter119 Assigning a RIP filter list to the outgoing filter120 121 System configurationSetting system date and time To set the date and time Go to System Config Time122 To set the system idle timeout Go to System Config OptionsTo set the Auth timeout Go to System Config Options Changing system options123 Adding and editing administrator accountsModifying the Dead Gateway Detection settings 124 Adding new administrator accountsEditing administrator accounts To add an administrator account Go to System Config Admin125 Configuring SnmpTo edit an administrator account Go to System Config Admin Configuring Snmp community settings Configuring the FortiGate unit for Snmp monitoringConfiguring FortiGate Snmp support Configuring Snmp access to an interfaceSystem Location 127System Name 128 FortiGate MIBs129 FortiGate trapsGeneral FortiGate traps System traps130 131 System configuration and statusFirewall configuration Users and authentication configuration132 133 Replacement messagesCustomizing replacement messages 134 Customizing alert emailsNids event 135Critical event 136137 Firewall configuration138 Default firewall configurationAddresses 139 ServicesContent profiles Schedules140 Adding firewall policies141 ActionDynamic IP Pool Fixed Port VPN TunnelTraffic Shaping 142Maximum Bandwidth Traffic Priority AuthenticationAnti-Virus & Web filter 143144 Configuring policy listsLog Traffic Comments145 Policy matching in detailChanging the order of policies in a policy list Enabling policies AddressesEnabling and disabling policies Disabling policiesTo add an address Go to Firewall Address Adding addresses147 148 Editing addressesDeleting addresses Organizing addresses into address groups149 ServicesPredefined services GRE 150Ldap 151152 Adding custom TCP and UDP services153 Adding custom Icmp servicesAdding custom IP services Grouping services154 Schedules155 Creating one-time schedulesCreating recurring schedules 156 Adding schedules to policiesTo add a schedule to a policy Go to Firewall Policy Virtual IPs157 Virtual IP External Interface examples Description Internal Adding static NAT virtual IPs158 To add a static NAT virtual IP Go to Firewall Virtual IP159 Adding port forwarding virtual IPsAdding a port forwarding virtual IP 160To add a policy with a virtual IP Go to Firewall Policy IP poolsAdding policies with virtual IPs 161162 Adding an IP poolIP Pools for firewall policies that use fixed ports IP pools and dynamic NATGo to Firewall IP/MAC Binding Static IP/MAC IP/MAC binding163 164 Configuring IP/MAC binding for packets going to the firewall165 Adding IP/MAC addressesViewing the dynamic IP/MAC list Enabling IP/MAC binding166 Content profiles167 Default content profilesAdding content profiles To add a content profile Go to Firewall Content ProfileOversized File/Email Pass Fragmented Email 168169 Adding content profiles to policiesTo add a content profile to a policy Go to Firewall Policy 170 171 Users and authenticationTo set authentication timeout Go to System Config Options Setting authentication timeoutAdding user names and configuring authentication Adding user names and configuring authentication173 Deleting user names from the internal database174 Configuring Radius supportAdding Radius servers Deleting Radius serversTo add an Ldap server Go to User Ldap Configuring Ldap supportAdding Ldap servers 175To delete an Ldap server Go to User Ldap Deleting Ldap servers176 To add a user group Go to User User Group Configuring user groupsAdding user groups 177To delete a user group Go to User User Group Deleting user groups178 179 IPSec VPNAutoIKE with certificates Key managementManual Keys AutoIKE with pre-shared keys181 General configuration steps for a manual key VPNManual key IPSec VPNs Adding a manual key VPN tunnelAES192 AutoIKE IPSec VPNs182 AES128To add a phase 1 configuration Go to VPN Ipsec Phase General configuration steps for an AutoIKE VPNAdding a phase 1 configuration for an AutoIKE VPN To create an AutoIKE VPN configurationRemote Gateway Dialup User 184Remote Gateway Static IP Address 185 Configuring advanced optionsTo configure phase 1 advanced options 186 187 Adding a phase 1 configuration Standard options188 Adding a phase 2 configuration for an AutoIKE VPNTo add a phase 2 configuration Go to VPN Ipsec Phase Use wildcard selectors 189Use selectors from policy 190 Managing digital certificatesObtaining a signed local certificate Generating the certificate requestKey Size 191Key Type 192 Downloading the certificate requestImporting the signed local certificate Obtaining CA certificates193 Configuring encrypt policiesImporting CA certificates To add a source address Go to Firewall Address Adding a source addressAdding a destination address 194To add an encrypt policy Go to Firewall Policy Adding an encrypt policy195 196 IPSec VPN concentrators197 VPN concentrator hub general configuration stepsTo create a VPN concentrator configuration Source InternalAll Destination VPN spoke address Action Adding a VPN concentrator198 199 VPN spoke general configuration stepsTo create a VPN spoke configuration Policies 200VPN Tunnel Viewing dialup VPN connection status Monitoring and Troubleshooting VPNsTo view VPN tunnel status Go to VPN Ipsec Phase Viewing VPN tunnel status202 Testing a VPN203 Configuring PptpConfiguring the FortiGate unit as a Pptp gateway Pptp and L2TP VPNTo add a source address 204To add a firewall policy 205To add a source address group To add a destination addressTo connect to the Pptp VPN Configuring a Windows 98 client for Pptp206 207 Configuring a Windows 2000 client for PptpConfiguring a Windows XP client for Pptp Select Properties Security To configure the VPN connection208 209 Configuring L2TPConfiguring the FortiGate unit as an L2TP gateway To add source addresses 210211 Configuring a Windows 2000 client for L2TPTo connect to the L2TP VPN To disable IPSec212 213 Configuring a Windows XP client for L2TP214 215 Network Intrusion Detection System NidsDetecting attacks 216 Configuring checksum verificationSelecting the interfaces to monitor Disabling monitoring interfaces217 Viewing the signature listViewing attack descriptions 218 Disabling Nids attack signaturesAdding user-defined signatures 219 Downloading the user-defined signature listEnabling Nids attack prevention signatures To enable Nids attack prevention Go to Nids PreventionPreventing attacks Enabling Nids attack prevention221 Setting signature threshold valuesAutomatic message reduction Logging attacksLogging attack messages to the attack log Reducing the number of Nids attack log and email messages223 Manual message reduction224 225 General configuration stepsAntivirus protection To scan FortiGate firewall traffic for viruses Antivirus scanning226 227 File blockingBlocking files in firewall traffic Adding file patterns to block228 Configuring limits for oversized files and emailBlocking oversized files and emails Exempting fragmented email from blocking229 To view the virus list Go to Anti-Virus Config Virus ListViewing the virus list 230 231 Web filtering232 Content blockingGo to Web Filter Content Block Adding words and phrases to the Banned Word list233 Clearing the Banned Word listBacking up the Banned Word list Restoring the Banned Word listExample Banned Word List text file 234235 Configuring FortiGate Web URL blockingURL blocking Adding URLs to the Web URL block list236 Clearing the Web URL block listDownloading the Web URL block list Uploading a URL block listTo upload a URL block list Configuring FortiGate Web pattern blocking237 238 Configuring Cerberian URL filteringInstalling a Cerberian license key Adding a Cerberian userEnabling Cerberian URL filtering Configuring Cerberian web filterAbout the default group and policy To configure Cerberian web filtering240 Script filteringEnabling script filtering Selecting script filter optionsGo to Web Filter URL Exempt Exempt URL listAdding URLs to the URL Exempt list 241242 Downloading the URL Exempt ListUploading a URL Exempt List 243 244 245 Email filter246 Email banned word listAdding words and phrases to the email banned word list 247 Downloading the email banned word listUploading the email banned word list 248 Email block listAdding address patterns to the email block list Downloading the email block listTo upload the email block list Email exempt listUploading an email block list 249250 To add a subject tag Go to Email Filter ConfigAdding a subject tag Adding address patterns to the email exempt list251 Logging and reportingRecording logs Recording logs on a remote computer252 Recording logs on a NetIQ WebTrends server253 To filter log entries Go to Log&Report Log SettingFiltering log messages Log message levels254 Configuring traffic loggingEnabling traffic logging for a firewall policy Configuring traffic filter settingsEnabling traffic logging Enabling traffic logging for an interface256 Destination IP Address Destination Netmask ServiceAdding traffic filter entries To add a DNS server Go to System Network DNS Configuring alert emailAdding alert email addresses 257258 Testing alert emailEnabling alert email 259 Glossary260 261 262 263 IndexIndex 264DNS 265Http 266NAT 267268 RMA 269TCP 270VPN 271272