Manuals / Fortinet / Computer Equipment / Network Card

Fortinet 50A user manual 272

Models: 50A

1 272

Download 272 pages 24.69 Kb

Page 272

Index

272	Fortinet Inc.

Image 272

Fortinet 50A user manual 272

Contents

Installation and Configuration Guide FebruaryTrademarks Regulatory ComplianceTable of Contents Transparent mode installation Virus and attack definitions updates and registration Network configuration Firewall configuration 137 Users and authentication 171 Pptp and L2TP VPN 203 Antivirus protection 225 Glossary 259 Index 263 Contents NAT/Route mode and Transparent mode NAT/Route modeTransparent mode IntroductionDocument conventions Fortinet documentation Comments on Fortinet technical documentationCustomer service and technical support Getting started Package contents MountingPowering on Connecting to the web-based managerEnvironmental specifications To power on the FortiGate-50A unitConnecting to the command line interface CLI To connect to the web-based managerStop bits Flow control To connect to the CLIBits per second Data bits Parity Factory default FortiGate configuration settings Factory default Dhcp configurationFactory default firewall configuration Factory default NAT/Route mode network configurationFactory default Transparent mode network configuration Factory default firewall configuration Recurring ServiceAuthentication ContentStrict content profile Options Factory default content profilesStrict content profile Scan content profile Web content profileScan content profile Options Web content profile OptionsUnfiltered content profile Options Planning the FortiGate configurationUnfiltered content profile Configuration options Setup wizardCLI FortiGate model maximum values matrix Next steps Signatures Antivirus file Block patterns Web filterNext steps Getting started NAT/Route mode installation Internal servers Preparing to configure NAT/Route modeChanging the default configuration Using the setup wizard Advanced NAT/Route mode settingsStarting the setup wizard Reconnecting to the web-based managerUsing the command line interface Configuring the FortiGate unit to operate in NAT/Route modeConfiguring NAT/Route mode IP addresses ExampleInternal Connecting the FortiGate unit to your networksFortiGate-50A External Configuring your networks Completing the configurationSetting the date and time Changing antivirus protectionConfiguring virus and attack definition updates Registering your FortiGate unitCompleting the configuration Transparent mode installation Preparing to configure Transparent modeTransparent mode settings Administrator Password DNS SettingsChanging to Transparent mode Go to System StatusConfiguring the Transparent mode management IP address Configure the Transparent mode default gatewayConnecting the FortiGate unit to your networks Go to Firewall Policy Int-Ext Enabling antivirus protectionRegistering your FortiGate Transparent mode configuration examples Default routes and static routesGeneral configuration steps Default route to an external networkWeb-based manager example configuration steps CLI configuration stepsGo to System Network Management Go to System Network RoutingDMZ Set system route number 1 dst 24.102.233.5 255.255.255.0 gw1 Example static route to an internal destination Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 System status System statusFirmware upgrade procedures Procedure Description Changing the FortiGate host nameChanging the FortiGate firmware To change the FortiGate host name Go to System StatusUpgrading the firmware using the web-based manager Upgrading the firmware using the CLITo upgrade the firmware using the web-based manager To upgrade the firmware using the CLIReverting to a previous firmware version Execute pingReverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot Press any key to enter configuration menu To test a new firmware image Restoring the previous configurationTesting a new firmware image before installing it Save as Default firmware/Run image without savingD/R Manual virus definition updates Manual attack definition updatesTo update the antivirus definitions manually To update the attack definitions manuallyBacking up system settings Restoring system settingsDisplaying the FortiGate serial number Displaying the FortiGate up timeTo change to Transparent mode Go to System Status Restoring system settings to factory defaultsChanging to Transparent mode Changing to NAT/Route mode To change to NAT/Route mode Go to System StatusRestarting the FortiGate unit Shutting down the FortiGate unitTo view CPU and memory status Go to System Status Monitor System statusViewing CPU and memory status Viewing sessions and network status CPU and memory status monitorViewing virus and intrusions status Sessions and network status monitorSession list To view the session list Go to System Status SessionProtocol Example session listSession list Virus and attack definitions updates and registration Updating antivirus and attack definitionsConnecting to the FortiResponse Distribution Network Go to System UpdateVersion Expiry date Last update attempt Last update status To make sure the FortiGate unit can connect to the FDNManually initiating antivirus and attack definitions updates Scheduling updates Configuring update loggingEnabling scheduled updates To configure update logging Go to Log&Report Log SettingTo add an override server Go to System Update Adding an override serverEnabling push updates Enabling scheduled updates through a proxy serverEnabling push updates Push updates when FortiGate IP addresses changeEnabling push updates through a NAT device To enable push updates Go to System UpdateExample push updates through a NAT device Example network topology Push updates through a NAT deviceGeneral procedure Adding a firewall policy for the port forwarding virtual IP To configure the FortiGate NAT deviceSchedule Always Service ANY Action Accept Example push update configuration Registering FortiGate unitsFortiCare Service Contracts Registering the FortiGate unit Recovering a lost Fortinet support password Updating registration informationViewing the list of registered FortiGate units Registering a new FortiGate unit Adding or changing a FortiCare Support Contract numberChanging your Fortinet support password Changing your contact information or security questionDownloading virus and attack definitions updates Downloading virus and attack definition updatesRegistering a FortiGate unit after an RMA Registering a FortiGate unit after an RMA Network configuration Configuring interfacesChanging the administrative status of an interface Configuring an interface with a manual IP addressTo stop an interface that is administratively up Viewing the interface listConfiguring an interface for Dhcp ConnectingInitializing ConnectedConfiguring an interface for PPPoE Adding a secondary IP address to an interfaceControlling administrative access to an interface Adding a ping server to an interfaceConfiguring traffic logging for connections to an interface Changing the MTU size to improve network performanceConfiguring the management interface in Transparent mode Configuring routing Adding a default routeAdding DNS server IP addresses 100Adding destination-based routes to the routing table 101102 Adding routes in Transparent modeConfiguring the routing table Policy routing 103Configuring Dhcp services Policy routing command syntaxConfiguring a Dhcp relay agent 104Configuring a Dhcp server Adding a Dhcp server to an interfaceAdding scopes to a Dhcp server 105Adding a reserve IP to a Dhcp server 106Scope Name IP Pool107 Configuring the modem interfaceViewing a Dhcp server dynamic IP list Connecting a modem to the FortiGate unit Configuring modem settingsTo configure modem settings Go to System Network Modem 108Connecting to a dialup account Disconnecting the modem109 To connect to a dialup account Go to System Network ModemBackup mode configuration Standalone mode configurationTo configure backup mode Go to System Network Modem Viewing modem status111 To operate in standalone mode Go to System Network ModemAdding firewall policies for modem connections 112 113 RIP configurationRIP settings Flush InvalidHolddown Configuring RIP for FortiGate interfaces 115116 Adding RIP filters Adding a RIP filter list117 To add a RIP filter list Go to System RIP FilterAssigning a RIP filter list to the neighbors filter Assigning a RIP filter list to the incoming filterAssigning a RIP filter list to the outgoing filter 119120 System configuration Setting system date and timeTo set the date and time Go to System Config Time 121To set the system idle timeout Go to System Config Options To set the Auth timeout Go to System Config OptionsChanging system options 122123 Adding and editing administrator accountsModifying the Dead Gateway Detection settings Adding new administrator accounts Editing administrator accountsTo add an administrator account Go to System Config Admin 124125 Configuring SnmpTo edit an administrator account Go to System Config Admin Configuring the FortiGate unit for Snmp monitoring Configuring FortiGate Snmp supportConfiguring Snmp access to an interface Configuring Snmp community settingsSystem Location 127System Name FortiGate MIBs 128FortiGate traps General FortiGate trapsSystem traps 129130 System configuration and status Firewall configurationUsers and authentication configuration 131132 133 Replacement messagesCustomizing replacement messages Customizing alert emails 134135 Nids event136 Critical eventFirewall configuration 137138 Default firewall configurationAddresses Services Content profilesSchedules 139Adding firewall policies 140Action 141VPN Tunnel Traffic Shaping142 Dynamic IP Pool Fixed PortAuthentication Anti-Virus & Web filter143 Maximum Bandwidth Traffic PriorityConfiguring policy lists Log TrafficComments 144145 Policy matching in detailChanging the order of policies in a policy list Addresses Enabling and disabling policiesDisabling policies Enabling policiesTo add an address Go to Firewall Address Adding addresses147 Editing addresses Deleting addressesOrganizing addresses into address groups 148149 ServicesPredefined services 150 GRE151 LdapAdding custom TCP and UDP services 152Adding custom Icmp services Adding custom IP servicesGrouping services 153Schedules 154155 Creating one-time schedulesCreating recurring schedules Adding schedules to policies 156To add a schedule to a policy Go to Firewall Policy Virtual IPs157 Adding static NAT virtual IPs 158To add a static NAT virtual IP Go to Firewall Virtual IP Virtual IP External Interface examples Description InternalAdding port forwarding virtual IPs 159160 Adding a port forwarding virtual IPIP pools Adding policies with virtual IPs161 To add a policy with a virtual IP Go to Firewall PolicyAdding an IP pool IP Pools for firewall policies that use fixed portsIP pools and dynamic NAT 162Go to Firewall IP/MAC Binding Static IP/MAC IP/MAC binding163 Configuring IP/MAC binding for packets going to the firewall 164Adding IP/MAC addresses Viewing the dynamic IP/MAC listEnabling IP/MAC binding 165Content profiles 166Default content profiles Adding content profilesTo add a content profile Go to Firewall Content Profile 167168 Oversized File/Email Pass Fragmented Email169 Adding content profiles to policiesTo add a content profile to a policy Go to Firewall Policy 170 Users and authentication 171Setting authentication timeout Adding user names and configuring authenticationAdding user names and configuring authentication To set authentication timeout Go to System Config OptionsDeleting user names from the internal database 173Configuring Radius support Adding Radius serversDeleting Radius servers 174Configuring Ldap support Adding Ldap servers175 To add an Ldap server Go to User LdapTo delete an Ldap server Go to User Ldap Deleting Ldap servers176 Configuring user groups Adding user groups177 To add a user group Go to User User GroupTo delete a user group Go to User User Group Deleting user groups178 IPSec VPN 179Key management Manual KeysAutoIKE with pre-shared keys AutoIKE with certificatesGeneral configuration steps for a manual key VPN Manual key IPSec VPNsAdding a manual key VPN tunnel 181AutoIKE IPSec VPNs 182AES128 AES192General configuration steps for an AutoIKE VPN Adding a phase 1 configuration for an AutoIKE VPNTo create an AutoIKE VPN configuration To add a phase 1 configuration Go to VPN Ipsec PhaseRemote Gateway Dialup User 184Remote Gateway Static IP Address 185 Configuring advanced optionsTo configure phase 1 advanced options 186 Adding a phase 1 configuration Standard options 187188 Adding a phase 2 configuration for an AutoIKE VPNTo add a phase 2 configuration Go to VPN Ipsec Phase Use wildcard selectors 189Use selectors from policy Managing digital certificates Obtaining a signed local certificateGenerating the certificate request 190Key Size 191Key Type Downloading the certificate request Importing the signed local certificateObtaining CA certificates 192193 Configuring encrypt policiesImporting CA certificates Adding a source address Adding a destination address194 To add a source address Go to Firewall AddressTo add an encrypt policy Go to Firewall Policy Adding an encrypt policy195 IPSec VPN concentrators 196197 VPN concentrator hub general configuration stepsTo create a VPN concentrator configuration Source InternalAll Destination VPN spoke address Action Adding a VPN concentrator198 199 VPN spoke general configuration stepsTo create a VPN spoke configuration Policies 200VPN Tunnel Monitoring and Troubleshooting VPNs To view VPN tunnel status Go to VPN Ipsec PhaseViewing VPN tunnel status Viewing dialup VPN connection statusTesting a VPN 202Configuring Pptp Configuring the FortiGate unit as a Pptp gatewayPptp and L2TP VPN 203204 To add a source address205 To add a source address groupTo add a destination address To add a firewall policyTo connect to the Pptp VPN Configuring a Windows 98 client for Pptp206 207 Configuring a Windows 2000 client for PptpConfiguring a Windows XP client for Pptp Select Properties Security To configure the VPN connection208 209 Configuring L2TPConfiguring the FortiGate unit as an L2TP gateway 210 To add source addressesConfiguring a Windows 2000 client for L2TP 211To connect to the L2TP VPN To disable IPSec212 Configuring a Windows XP client for L2TP 213214 215 Network Intrusion Detection System NidsDetecting attacks Configuring checksum verification Selecting the interfaces to monitorDisabling monitoring interfaces 216217 Viewing the signature listViewing attack descriptions 218 Disabling Nids attack signaturesAdding user-defined signatures Downloading the user-defined signature list 219To enable Nids attack prevention Go to Nids Prevention Preventing attacksEnabling Nids attack prevention Enabling Nids attack prevention signaturesSetting signature threshold values 221Logging attacks Logging attack messages to the attack logReducing the number of Nids attack log and email messages Automatic message reductionManual message reduction 223224 225 General configuration stepsAntivirus protection To scan FortiGate firewall traffic for viruses Antivirus scanning226 File blocking Blocking files in firewall trafficAdding file patterns to block 227Configuring limits for oversized files and email Blocking oversized files and emailsExempting fragmented email from blocking 228229 To view the virus list Go to Anti-Virus Config Virus ListViewing the virus list 230 Web filtering 231Content blocking Go to Web Filter Content BlockAdding words and phrases to the Banned Word list 232Clearing the Banned Word list Backing up the Banned Word listRestoring the Banned Word list 233234 Example Banned Word List text fileConfiguring FortiGate Web URL blocking URL blockingAdding URLs to the Web URL block list 235Clearing the Web URL block list Downloading the Web URL block listUploading a URL block list 236To upload a URL block list Configuring FortiGate Web pattern blocking237 Configuring Cerberian URL filtering Installing a Cerberian license keyAdding a Cerberian user 238Configuring Cerberian web filter About the default group and policyTo configure Cerberian web filtering Enabling Cerberian URL filteringScript filtering Enabling script filteringSelecting script filter options 240Exempt URL list Adding URLs to the URL Exempt list241 Go to Web Filter URL Exempt242 Downloading the URL Exempt ListUploading a URL Exempt List 243 244 Email filter 245246 Email banned word listAdding words and phrases to the email banned word list 247 Downloading the email banned word listUploading the email banned word list Email block list Adding address patterns to the email block listDownloading the email block list 248Email exempt list Uploading an email block list249 To upload the email block listTo add a subject tag Go to Email Filter Config Adding a subject tagAdding address patterns to the email exempt list 250Logging and reporting Recording logsRecording logs on a remote computer 251Recording logs on a NetIQ WebTrends server 252To filter log entries Go to Log&Report Log Setting Filtering log messagesLog message levels 253Configuring traffic logging 254Configuring traffic filter settings Enabling traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a firewall policy256 Destination IP Address Destination Netmask ServiceAdding traffic filter entries Configuring alert email Adding alert email addresses257 To add a DNS server Go to System Network DNS258 Testing alert emailEnabling alert email Glossary 259260 261 262 Index 263264 Index265 DNS266 Http267 NAT268 269 RMA270 TCP271 VPN272