100 | Fortinet FortiGate-800 manual

Changing the FortiGate firmware	System status

5To confirm that the FortiGate unit can connect to the TFTP server, use the following command to ping the computer running the TFTP server. For example, if the IP address of the TFTP server is 192.168.1.168, enter:

execute ping 192.168.1.168

6Enter the following command to restart the FortiGate unit: execute reboot

As the FortiGate units starts, a series of system startup messages is displayed. When one of the following messages appears:

•FortiGate unit running v2.x BIOS

Press Any Key To Download Boot Image.

...

•FortiGate unit running v3.x BIOS

Press any key to enter configuration menu.....

......

7Immediately press any key to interrupt the system startup.

Note: You have only 3 seconds to press any key. If you do not press a key soon enough, the

FortiGate unit reboots and you must log in and repeat the execute reboot command.

If you successfully interrupt the startup process, one of the following messages appears:

•FortiGate unit running v2.x BIOS

Enter TFTP Server Address [192.168.1.168]:

Go to step 9.

•FortiGate unit running v3.x BIOS

[G]: Get firmware image from TFTP server.

[F]: Format boot device.

[B]: Boot with backup firmware and set as default.

[Q]: Quit menu and continue to boot with default firmware.

[H]: Display this list of options.

Enter G,F,B,Q,or H:

8Type G to get the new firmware image from the TFTP server.

9Type the address of the TFTP server and press Enter. The following message appears:

Enter Local Address [192.168.1.188]:

10Type the address of the internal interface of the FortiGate unit and press Enter.

Note: The local IP address is used only to download the firmware image. After the firmware is installed, the address of this interface is changed back to the default IP address for this interface.

The following message appears:

Enter File Name [image.out]:

100	Fortinet Inc.

Image 100

Fortinet FortiGate-800 manual 100, Press any key to enter configuration menu

Contents

Installation and Configuration Guide January 15 Trademarks Regulatory Compliance Table of Contents NAT/Route mode installation High availability Virus and attack definitions updates and registration 117 Network configuration 137 System configuration 169 Users and authentication 223 IPSec VPN 231 Network Intrusion Detection System Nids 269 Email filter 303 Glossary 323 Index 327 Contents Introduction Flexibility demanded by large enterprises Web content filtering Antivirus protection Email filtering Firewall NAT/Route mode Transparent modeVLANs and virtual domains Network intrusion detection VPN High availability Secure installation, configuration, and management Web-based manager Command line interface Logging and reporting Document conventions Fortinet documentation Customer service and technical support Comments on Fortinet technical documentation Customer service and technical support Getting started Package contents Mounting Powering on Power requirementsEnvironmental specifications To power on the FortiGate-800 unit Connecting to the web-based manager To connect to the web-based manager Connecting to the command line interface CLI To connect to the CLIBits per second 9600 Data bits Parity Stop bits Flow control Factory default FortiGate configuration settings Factory default NAT/Route mode network configurationAccount Internal interface Factory default Transparent mode network configuration Factory default firewall configuration Factory default content profiles Strict content profile Strict content profile Options Scan content profileScan content profile Options Web content profile Unfiltered content profileWeb content profile Options Unfiltered content profile Options Planning the FortiGate configuration Example NAT/Route mode network configuration NAT/Route mode with multiple external network connections Example NAT/Route multiple internet connection configuration Configuration options Setup wizard FortiGate model maximum values matrix Front keypad and LCD Next steps Signatures Antivirus file Block patterns Web filter NAT/Route mode installation Preparing to configure NAT/Route mode Advanced FortiGate NAT/Route mode settings Advanced NAT/Route mode settingsDhcp server Using the setup wizard Starting the setup wizardReconnecting to the web-based manager DMZ and user-defined interfaces Using the front control buttons and LCD Using the command line interfaceConfiguring the FortiGate unit to operate in NAT/Route mode Configuring NAT/Route mode IP addresses Set system interface external mode static ip 204.23.1.5 Connecting the FortiGate unit to your networks To connect the FortiGate unit running in NAT/Route mode FortiGate-800 External To connect to FortiGate-800 user-defined interfaces Configuring your networks Example FortiGate-800 user-defined interface connections Completing the configuration Configuring the DMZ interfaceConfiguring interfaces 1 to Setting the date and time Configuring virus and attack definition updates Configuration example Multiple connections to the InternetRegistering your FortiGate unit Configuring ping servers Internal Using the CLI Primary and backup links to the InternetDestination-based routing examples Go to System Network Routing Table Load sharing Load sharing and primary and secondary connections To add the routes using the CLI Routing table should have routes arranged as shown in Table Routing a service to an external network Policy routing examples Adding a redundant default policy Destination DMZAll Schedule Always ServiceFirewall policy example Adding more firewall policies Restricting access to a single Internet connection Configuration example Multiple connections to the Internet Transparent mode installation Preparing to configure Transparent modeTransparent mode settings Administrator Password DNS Settings Changing to Transparent mode using the web-based manager Go to System Status Changing to Transparent mode using the CLI Operation mode Transparent Configure the Transparent mode default gateway Configuring the Transparent mode management IP addressEnabling antivirus protection Connecting the FortiGate unit to your networks Transparent mode configuration examples FortiGate-800 Default routes and static routes Example default route to an external network General configuration steps Default route to an external network Web-based manager example configuration steps CLI configuration stepsExample static route to an external destination Go to System Network Management DMZ Example static route to an internal destination FortiGate-800 Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples High availability Configuring an HA cluster Configuring FortiGate units for HA operationTo configure a FortiGate unit for HA operation Go to System Config HA Weighted Round Robin NoneHub Least Connection Connecting the cluster Example Active-Active HA configuration HA network configuration To connect the cluster Adding a new FortiGate unit to a functioning cluster Managing an HA clusterTo add a new unit to the cluster Configuring cluster interface monitoring Viewing the status of cluster members Monitoring cluster members To set the update frequency Example cluster CPU, memory, and hard disk display Viewing cluster sessions Viewing and managing cluster log messages Viewing cluster communication sessions Monitoring cluster units for failoverManaging individual cluster units To manage a cluster unit Changing cluster unit host namesTo set the host name of each cluster member Synchronizing the cluster configuration Keyword Description Upgrading firmware Advanced HA options Replacing a FortiGate unit after failoverSelecting a FortiGate unit as a permanent primary unit To select a permanent primary unit Configuring weighted-round-robin weights To set the priority of each FortiGate unit in a cluster Active-Active cluster packet flow Active-active HA packet flow NAT/Route mode packet flow Transparent mode packet flow Active-Active cluster packet flow System status System status Firmware upgrade procedures Procedure Description Changing the FortiGate host nameChanging the FortiGate firmware To change the FortiGate host name Go to System Status Upgrading the firmware using the web-based manager Upgrading the firmware using the CLITo upgrade the firmware using the web-based manager To upgrade the firmware using the CLI Reverting to a previous firmware version Execute ping Reverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot Press any key to enter configuration menu 100 Testing a new firmware image before installing it Restoring the previous configuration101 102 To test a new firmware image Installing a backup firmware image Installing and using a backup firmware image103 To install a backup firmware image 104 To switch to the backup firmware image Switching to the backup firmware image105 Manual virus definition updates Switching back to the default firmware imageTo switch back to the default firmware image To update the antivirus definitions manually Manual attack definition updates To update the attack definitions manuallyDisplaying the FortiGate serial number 107 Backing up system settings Restoring system settingsDisplaying the FortiGate up time Displaying log hard disk status Restoring system settings to factory defaults Changing to Transparent modeTo change to Transparent mode Go to System Status 109 Changing to NAT/Route mode To change to NAT/Route mode Go to System StatusRestarting the FortiGate unit Shutting down the FortiGate unit System status Viewing CPU and memory status111 To view CPU and memory status Go to System Status Monitor Viewing sessions and network status CPU and memory status monitor Viewing virus and intrusions status 113 Session list To view the session list Go to System Status Session 115 Protocol 116 Updating antivirus and attack definitions Virus and attack definitions updates and registration117 Connecting to the FortiResponse Distribution Network Go to System UpdateVersion Expiry date Last update attempt Last update status To make sure the FortiGate unit can connect to the FDN Manually initiating antivirus and attack definitions updates 119 Scheduling updates Configuring update loggingEnabling scheduled updates 120 Adding an override server To add an override server Go to System Update121 Enabling scheduled updates through a proxy server Enabling push updates122 Enabling push updates Push updates when FortiGate IP addresses changeTo enable push updates Go to System Update 123 Example push updates through a NAT device Enabling push updates through a NAT device124 General procedure 125 126 To configure the FortiGate NAT device Schedule Always Service ANY Action AcceptAdding a firewall policy for the port forwarding virtual IP 127 Registering FortiGate units 128 FortiCare Service Contracts 129 Registering the FortiGate unit 130 Updating registration information 131 Viewing the list of registered FortiGate units Recovering a lost Fortinet support password132 Adding or changing a FortiCare Support Contract number Registering a new FortiGate unit133 Changing your contact information or security question Changing your Fortinet support password134 Downloading virus and attack definitions updates 135 Registering a FortiGate unit after an RMA 136 Configuring zones Network configuration137 Configuring interfaces Adding zonesDeleting zones 138 Changing the administrative status of an interface Viewing the interface listAdding an interface to a zone 139 Configuring an interface for Dhcp Configuring an interface with a manual IP address140 Configuring an interface for PPPoE 141 Adding a ping server to an interface Adding a secondary IP address to an interface142 Controlling administrative access to an interface 143 Configuring traffic logging for connections to an interface Configuring the management interface in Transparent modeChanging the MTU size to improve network performance 144 Vlan overview 145 VLANs in NAT/Route mode Rules for Vlan IDsRules for Vlan IP addresses 146 Virtual domains in Transparent mode Adding Vlan subinterfaces147 To add Vlan subinterfaces Go to System Network Interface 148 FortiGate unit with two virtual domains Configuring a virtual domain Virtual domain propertiesAdding a virtual domain 149 Adding zones to virtual domains Adding Vlan subinterfaces to a virtual domain150 151 To add a zone to a virtual domain Go to System Network Zone Adding firewall policies for virtual domains Adding addresses for virtual domains152 Go to Firewall Address Configuring routing Adding DNS server IP addressesDeleting virtual domains 153 Adding a default route To add a default route Go to System Network Routing TableAdding destination-based routes to the routing table 154 Adding routes in Transparent mode 155 Policy routing Configuring the routing table156 Policy routing command syntax Configuring Dhcp services157 Configuring a Dhcp relay agent Configuring a Dhcp serverAdding a Dhcp server to an interface Adding scopes to a Dhcp server 159 To add a scope to a Dhcp server Go to System Network Dhcp Adding a reserve IP to a Dhcp server Viewing a Dhcp server dynamic IP list160 Selected scope RIP settings RIP configuration161 162 InvalidHolddown Flush Configuring RIP for FortiGate interfaces 163 Example RIP configuration for an internal interface 164 Adding RIP filters Adding a RIP filter list165 To add a RIP filter list Go to System RIP Filter Assigning a RIP filter list to the incoming filter Assigning a RIP filter list to the neighbors filter166 Assigning a RIP filter list to the outgoing filter 167 168 System configuration Setting system date and timeTo set the date and time Go to System Config Time 169 To set the system idle timeout Go to System Config Options To set the Auth timeout Go to System Config OptionsChanging system options 170 Modifying the Dead Gateway Detection settings 171 Adding and editing administrator accounts Adding new administrator accountsTo add an administrator account Go to System Config Admin 172 Configuring Snmp Editing administrator accountsTo edit an administrator account Go to System Config Admin 173 Configuring the FortiGate unit for Snmp monitoring Configuring FortiGate Snmp supportConfiguring Snmp access to an interface Configuring Snmp community settings System Name 175System Location FortiGate MIBs 176 FortiGate traps General FortiGate trapsSystem traps 177 VPN traps Nids trapsAntivirus traps Logging traps System configuration and status Firewall configurationFortinet MIB fields 179 180 Logging and reporting configuration Replacement messages181 Customizing replacement messages 182 183 Customizing alert emailsAlert email message sections 184 Alert email message sections Firewall configuration 185 Default firewall configuration 186 Interfaces Vlan subinterfacesZones 187 Services Default addresses Interface Address DescriptionAddresses Schedules Content profiles Adding firewall policies189 To add a firewall policy Go to Firewall Policy Source Firewall policy options190 Service DestinationSchedule Action VPN Tunnel Traffic Shaping192 Dynamic IP Pool Fixed Port Authentication Anti-Virus & Web filter193 Maximum Bandwidth Traffic Priority Comments Log Traffic194 Policy matching in detail Configuring policy lists195 Changing the order of policies in a policy list Enabling and disabling policiesDisabling policies Enabling policies Addresses Adding addresses197 To add an address Go to Firewall Address 198 Editing addressesTo edit an address Go to Firewall Address Deleting addresses Organizing addresses into address groups199 To delete an address Go to Firewall Address Predefined services Services200 201 GRE 202 Ldap Adding custom TCP and UDP services 203 Adding custom Icmp services Adding custom IP servicesGrouping services 204 Schedules 205 Creating one-time schedules 206 Creating recurring schedules 207 Virtual IPs Adding schedules to policies208 To add a schedule to a policy Go to Firewall Policy Adding static NAT virtual IPs 209To add a static NAT virtual IP Go to Firewall Virtual IP Virtual IP External Interface examples Description Internal Adding port forwarding virtual IPs 210 211 212 Adding policies with virtual IPsTo add a policy with a virtual IP Go to Firewall Policy IP pools Adding an IP pool213 To add an IP pool Go to Firewall IP Pool IP/MAC binding IP Pools for firewall policies that use fixed portsIP pools and dynamic NAT 214 215 Go to Firewall IP/MAC Binding Static IP/MAC Adding IP/MAC addresses 216 Enabling IP/MAC binding Viewing the dynamic IP/MAC list217 Content profiles 218 Default content profiles Adding content profilesTo add a content profile Go to Firewall Content Profile 219 220 Oversized File/Email Pass Fragmented Email To add a content profile to a policy Go to Firewall Policy Adding content profiles to policies221 222 Users and authentication 223 Setting authentication timeout Adding user names and configuring authenticationAdding user names and configuring authentication To set authentication timeout Go to System Config Options Deleting user names from the internal database 225 Configuring Radius support Adding Radius serversDeleting Radius servers 226 Configuring Ldap support Adding Ldap servers227 To add an Ldap server Go to User Ldap 228 Deleting Ldap serversTo delete an Ldap server Go to User Ldap Configuring user groups Adding user groups229 To add a user group Go to User User Group 230 Deleting user groupsTo delete a user group Go to User User Group IPSec VPN 231 Key management Manual KeysAutoIKE with pre-shared keys AutoIKE with certificates General configuration steps for a manual key VPN Manual key IPSec VPNsAdding a manual key VPN tunnel 233 234 AES128AES192 AES256 General configuration steps for an AutoIKE VPN Adding a phase 1 configuration for an AutoIKE VPNAutoIKE IPSec VPNs 235 Remote Gateway Static IP Address 236Remote Gateway Dialup User To configure phase 1 advanced options Configuring advanced options237 238 Adding a phase 1 configuration Standard options 239 To add a phase 2 configuration Go to VPN Ipsec Phase Adding a phase 2 configuration for an AutoIKE VPN240 Use selectors from policy 241Use wildcard selectors Managing digital certificates Obtaining a signed local certificateGenerating the certificate request 242 Key Type 243Key Size Importing the signed local certificate Downloading the certificate request244 Configuring encrypt policies Obtaining CA certificatesImporting CA certificates 245 246 Adding a source addressTo add a source address Go to Firewall Address Adding a destination address Adding an encrypt policy247 To add a destination address Go to Firewall Address 248 IPSec VPN concentrators 249 To create a VPN concentrator configuration VPN concentrator hub general configuration steps250 Adding a VPN concentrator 251 To create a VPN spoke configuration VPN spoke general configuration steps252 Redundant IPSec VPNs 253 To configure a redundant IPSec VPN Configuring redundant IPSec VPNs254 Monitoring and Troubleshooting VPNs To view VPN tunnel status Go to VPN Ipsec PhaseViewing VPN tunnel status Viewing dialup VPN connection status Testing a VPN 256 Pptp and L2TP VPN Configuring Pptp257 Configuring the FortiGate unit as a Pptp gateway 258To add users and user groups To add a source address 259 To add a source address groupTo add a destination address To add a firewall policy Configuring a Windows 98 client for Pptp 260 Configuring a Windows 2000 client for Pptp Configuring a Windows XP client for Pptp261 To connect to the Pptp VPN 262 To configure the VPN connectionSelect Properties Security Configuring the FortiGate unit as an L2TP gateway Configuring L2TP263 264 To add source addresses Configuring a Windows 2000 client for L2TP 265 266 To disable IPSecTo connect to the L2TP VPN Configuring a Windows XP client for L2TP 267 268 Detecting attacks Network Intrusion Detection System Nids269 Configuring checksum verification Selecting the interfaces to monitorDisabling monitoring interfaces 270 Viewing attack descriptions Viewing the signature list271 Adding user-defined signatures Disabling Nids attack signatures272 Downloading the user-defined signature list 273 To enable Nids attack prevention Go to Nids Prevention Preventing attacksEnabling Nids attack prevention Enabling Nids attack prevention signatures Setting signature threshold values 275 Logging attacks Logging attack messages to the attack logReducing the number of Nids attack log and email messages Automatic message reduction Manual message reduction 277 278 Antivirus protection General configuration steps279 280 Antivirus scanningTo scan FortiGate firewall traffic for viruses File blocking 281 Blocking files in firewall traffic Adding file patterns to block282 To block files in firewall traffic Quarantine Quarantining infected filesQuarantining blocked files 283 Viewing the quarantine list Sorting the quarantine list284 To view the quarantine list Go to Anti-Virus Quarantine Configuring quarantine options Filtering the quarantine listDeleting files from the quarantine list Downloading quarantined files Blocking oversized files and emails Configuring limits for oversized files and email286 To view the virus list Go to Anti-Virus Config Virus List Exempting fragmented email from blockingViewing the virus list 287 288 Web filtering 289 Content blocking Go to Web Filter Content BlockAdding words and phrases to the Banned Word list 290 Clearing the Banned Word list 291 Restoring the Banned Word list Backing up the Banned Word list292 Configuring FortiGate Web URL blocking URL blockingAdding URLs to the Web URL block list 293 Clearing the Web URL block list 294 Downloading the Web URL block list Uploading a URL block list295 To upload a URL block list Configuring FortiGate Web pattern blocking Configuring Cerberian URL filtering296 Installing a Cerberian license key Configuring Cerberian web filterAbout the default group and policy Adding a Cerberian user Enabling Cerberian URL filtering To configure Cerberian web filtering298 Script filtering Enabling script filteringSelecting script filter options 299 Exempt URL list Adding URLs to the URL Exempt list300 Go to Web Filter URLExempt Downloading the URL Exempt List Uploading a URL Exempt List301 Go to Web Filter URL Exempt 302 Email filter 303 Adding words and phrases to the email banned word list Email banned word list304 Uploading the email banned word list Downloading the email banned word list305 Email block list Adding address patterns to the email block listDownloading the email block list 306 Email exempt list Uploading an email block list307 To upload the email block list To add a subject tag Go to Email Filter Config Adding a subject tagAdding address patterns to the email exempt list 308 Recording logs Logging and reporting309 Recording logs on a NetIQ WebTrends server Recording logs on a remote computer310 Recording logs on the FortiGate hard disk 311Overwrite Option Log message levels Recording logs in system memory312 Filtering log messages To filter log entries Go to Log&Report Log Setting313 Configuring traffic logging 314 Enabling traffic logging Enabling traffic logging for an interfaceEnabling traffic logging for a Vlan subinterface Enabling traffic logging for a firewall policy Configuring traffic filter settings Adding traffic filter entries316 Resolve IP Destination IP Address Destination Netmask Service Viewing logs saved to memoryViewing logs 317 Viewing and managing logs saved to the hard disk Searching logs318 Keyword 319 To view the active or saved logs Go to Log&Report Logging Downloading a log file to the management computer Deleting all messages from an active logDeleting a saved log file 320 Configuring alert email Testing alert emailAdding alert email addresses 321 Enabling alert email 322 Glossary 323 324 325 326 Index 327 328 Index 329 Dialup Pptp 330 Http 331 Ldap 332 333 Pptp dialup connection 334 335 TCP 336 Vlan