Manuals / Fortinet / Computer Equipment / Network Card

Fortinet FortiGate-800 manual Vpn, High availability

Models: FortiGate-800

1 336

Download 336 pages 18.65 Kb

Page 19

Introduction	VPN

VPN

Using FortiGate virtual private networking (VPN), you can provide a secure connection between widely separated office networks or securely link telecommuters or travellers to an office network. Service providers can also use the FortiGate unit to provide VPN services for their clients.

FortiGate VPN features include the following:

•Industry standard and ICSA-certified IPSec VPN, including:

•IPSec, ESP security in tunnel mode,

•DES, 3DES (triple-DES), and AES hardware accelerated encryption,

•HMAC MD5 and HMAC SHA1 authentication and data integrity,

•AutoIKE key based on pre-shared key tunnels,

•IPSec VPN using local or CA certificates,

•Manual Keys tunnels,

•Diffie-Hellman groups 1, 2, and 5,

•Aggressive and Main Mode,

•Replay Detection,

•Perfect Forward Secrecy,

•XAuth authentication,

•Dead peer detection.

•PPTP for easy connectivity with the VPN standard supported by the most popular operating systems.

•L2TP for easy connectivity with a more secure VPN standard, also supported by many popular operating systems.

•Firewall policy based control of IPSec VPN traffic.

•IPSec NAT traversal so that remote IPSec VPN gateways or clients behind a NAT can connect to an IPSec VPN tunnel.

•VPN hub and spoke using a VPN concentrator to allow VPN traffic to pass from one tunnel to another through the FortiGate unit.

•IPSec Redundancy to create a redundant AutoIKE key IPSec VPN connection to a remote network.

High availability

High Availability (HA) provides failover between two or more FortiGate units. Fortinet achieves HA by using redundant hardware: matching FortiGate models running in NAT/Route mode. You can configure the FortiGate units for either active-passive (A-P) or active-active (A-A) HA.

Both A-P and A-A HA use similar redundant hardware configurations. High availability software guarantees that if one of the FortiGate units in the HA group fails, all functions, established firewall connections, and IPSec VPN sessions are maintained.

FortiGate-800 Installation and Configuration Guide

19

Image 19

Fortinet FortiGate-800 manual Vpn, High availability

Contents

January 15 Installation and Configuration GuideRegulatory Compliance TrademarksTable of Contents NAT/Route mode installation High availability Virus and attack definitions updates and registration 117 Network configuration 137 System configuration 169 Users and authentication 223 IPSec VPN 231 Network Intrusion Detection System Nids 269 Email filter 303 Glossary 323 Index 327 Contents Flexibility demanded by large enterprises IntroductionAntivirus protection Web content filteringFirewall Email filteringNetwork intrusion detection NAT/Route modeTransparent mode VLANs and virtual domainsHigh availability VPNWeb-based manager Secure installation, configuration, and managementLogging and reporting Command line interfaceFortinet documentation Document conventionsComments on Fortinet technical documentation Customer service and technical supportCustomer service and technical support Getting started Mounting Package contentsTo power on the FortiGate-800 unit Powering onPower requirements Environmental specificationsTo connect to the web-based manager Connecting to the web-based managerStop bits Flow control Connecting to the command line interface CLITo connect to the CLI Bits per second 9600 Data bits ParityInternal interface Factory default FortiGate configuration settingsFactory default NAT/Route mode network configuration AccountFactory default Transparent mode network configuration Factory default firewall configuration Strict content profile Factory default content profilesStrict content profile Options Scan content profileScan content profile Options Unfiltered content profile Options Web content profileUnfiltered content profile Web content profile OptionsExample NAT/Route mode network configuration Planning the FortiGate configurationExample NAT/Route multiple internet connection configuration NAT/Route mode with multiple external network connectionsSetup wizard Configuration optionsFront keypad and LCD FortiGate model maximum values matrixSignatures Antivirus file Block patterns Web filter Next stepsPreparing to configure NAT/Route mode NAT/Route mode installationAdvanced FortiGate NAT/Route mode settings Advanced NAT/Route mode settingsDhcp server DMZ and user-defined interfaces Using the setup wizardStarting the setup wizard Reconnecting to the web-based managerConfiguring NAT/Route mode IP addresses Using the front control buttons and LCDUsing the command line interface Configuring the FortiGate unit to operate in NAT/Route modeSet system interface external mode static ip 204.23.1.5 To connect the FortiGate unit running in NAT/Route mode Connecting the FortiGate unit to your networksTo connect to FortiGate-800 user-defined interfaces FortiGate-800 ExternalExample FortiGate-800 user-defined interface connections Configuring your networksSetting the date and time Completing the configurationConfiguring the DMZ interface Configuring interfaces 1 toConfiguring virus and attack definition updates Configuration example Multiple connections to the InternetRegistering your FortiGate unit Internal Configuring ping serversGo to System Network Routing Table Using the CLIPrimary and backup links to the Internet Destination-based routing examplesLoad sharing and primary and secondary connections Load sharingRouting table should have routes arranged as shown in Table To add the routes using the CLIPolicy routing examples Routing a service to an external networkAdding more firewall policies Adding a redundant default policyDestination DMZAll Schedule Always Service Firewall policy exampleRestricting access to a single Internet connection Configuration example Multiple connections to the Internet DNS Settings Transparent mode installationPreparing to configure Transparent mode Transparent mode settings Administrator PasswordGo to System Status Changing to Transparent mode using the web-based managerOperation mode Transparent Changing to Transparent mode using the CLIConfigure the Transparent mode default gateway Configuring the Transparent mode management IP addressEnabling antivirus protection Connecting the FortiGate unit to your networks FortiGate-800 Transparent mode configuration examplesExample default route to an external network Default routes and static routesDefault route to an external network General configuration stepsGo to System Network Management Web-based manager example configuration stepsCLI configuration steps Example static route to an external destinationDMZ Example static route to an internal destination FortiGate-800 Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples High availability Go to System Config HA Configuring an HA clusterConfiguring FortiGate units for HA operation To configure a FortiGate unit for HA operationLeast Connection Weighted Round RobinNone HubExample Active-Active HA configuration Connecting the clusterTo connect the cluster HA network configurationAdding a new FortiGate unit to a functioning cluster Managing an HA clusterTo add a new unit to the cluster Configuring cluster interface monitoring Monitoring cluster members Viewing the status of cluster membersExample cluster CPU, memory, and hard disk display To set the update frequencyViewing and managing cluster log messages Viewing cluster sessionsViewing cluster communication sessions Monitoring cluster units for failoverManaging individual cluster units To manage a cluster unit Changing cluster unit host namesTo set the host name of each cluster member Keyword Description Synchronizing the cluster configurationUpgrading firmware To select a permanent primary unit Advanced HA optionsReplacing a FortiGate unit after failover Selecting a FortiGate unit as a permanent primary unitTo set the priority of each FortiGate unit in a cluster Configuring weighted-round-robin weightsActive-active HA packet flow Active-Active cluster packet flowNAT/Route mode packet flow Transparent mode packet flow Active-Active cluster packet flow System status System statusTo change the FortiGate host name Go to System Status Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name Changing the FortiGate firmwareTo upgrade the firmware using the CLI Upgrading the firmware using the web-based managerUpgrading the firmware using the CLI To upgrade the firmware using the web-based managerExecute ping Reverting to a previous firmware versionReverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot 100 Press any key to enter configuration menuTesting a new firmware image before installing it Restoring the previous configuration101 To test a new firmware image 102Installing a backup firmware image Installing and using a backup firmware image103 104 To install a backup firmware imageTo switch to the backup firmware image Switching to the backup firmware image105 To update the antivirus definitions manually Manual virus definition updatesSwitching back to the default firmware image To switch back to the default firmware image107 Manual attack definition updatesTo update the attack definitions manually Displaying the FortiGate serial numberDisplaying log hard disk status Backing up system settingsRestoring system settings Displaying the FortiGate up time109 Restoring system settings to factory defaultsChanging to Transparent mode To change to Transparent mode Go to System StatusShutting down the FortiGate unit Changing to NAT/Route modeTo change to NAT/Route mode Go to System Status Restarting the FortiGate unitTo view CPU and memory status Go to System Status Monitor System statusViewing CPU and memory status 111CPU and memory status monitor Viewing sessions and network status113 Viewing virus and intrusions statusTo view the session list Go to System Status Session Session listProtocol 115116 Updating antivirus and attack definitions Virus and attack definitions updates and registration117 To make sure the FortiGate unit can connect to the FDN Connecting to the FortiResponse Distribution NetworkGo to System Update Version Expiry date Last update attempt Last update status119 Manually initiating antivirus and attack definitions updates120 Scheduling updatesConfiguring update logging Enabling scheduled updatesAdding an override server To add an override server Go to System Update121 Enabling scheduled updates through a proxy server Enabling push updates122 123 Enabling push updatesPush updates when FortiGate IP addresses change To enable push updates Go to System UpdateExample push updates through a NAT device Enabling push updates through a NAT device124 125 General procedure126 127 To configure the FortiGate NAT deviceSchedule Always Service ANY Action Accept Adding a firewall policy for the port forwarding virtual IP128 Registering FortiGate units129 FortiCare Service Contracts130 Registering the FortiGate unit131 Updating registration informationViewing the list of registered FortiGate units Recovering a lost Fortinet support password132 Adding or changing a FortiCare Support Contract number Registering a new FortiGate unit133 Changing your contact information or security question Changing your Fortinet support password134 135 Downloading virus and attack definitions updates136 Registering a FortiGate unit after an RMAConfiguring zones Network configuration137 138 Configuring interfacesAdding zones Deleting zones139 Changing the administrative status of an interfaceViewing the interface list Adding an interface to a zoneConfiguring an interface for Dhcp Configuring an interface with a manual IP address140 141 Configuring an interface for PPPoEAdding a ping server to an interface Adding a secondary IP address to an interface142 143 Controlling administrative access to an interface144 Configuring traffic logging for connections to an interfaceConfiguring the management interface in Transparent mode Changing the MTU size to improve network performance145 Vlan overview146 VLANs in NAT/Route modeRules for Vlan IDs Rules for Vlan IP addressesTo add Vlan subinterfaces Go to System Network Interface Virtual domains in Transparent modeAdding Vlan subinterfaces 147FortiGate unit with two virtual domains 148149 Configuring a virtual domainVirtual domain properties Adding a virtual domainAdding zones to virtual domains Adding Vlan subinterfaces to a virtual domain150 To add a zone to a virtual domain Go to System Network Zone 151Go to Firewall Address Adding firewall policies for virtual domainsAdding addresses for virtual domains 152153 Configuring routingAdding DNS server IP addresses Deleting virtual domains154 Adding a default routeTo add a default route Go to System Network Routing Table Adding destination-based routes to the routing table155 Adding routes in Transparent modePolicy routing Configuring the routing table156 Policy routing command syntax Configuring Dhcp services157 Adding scopes to a Dhcp server Configuring a Dhcp relay agentConfiguring a Dhcp server Adding a Dhcp server to an interfaceTo add a scope to a Dhcp server Go to System Network Dhcp 159Selected scope Adding a reserve IP to a Dhcp serverViewing a Dhcp server dynamic IP list 160RIP settings RIP configuration161 Flush 162Invalid Holddown163 Configuring RIP for FortiGate interfaces164 Example RIP configuration for an internal interfaceTo add a RIP filter list Go to System RIP Filter Adding RIP filtersAdding a RIP filter list 165Assigning a RIP filter list to the incoming filter Assigning a RIP filter list to the neighbors filter166 167 Assigning a RIP filter list to the outgoing filter168 169 System configurationSetting system date and time To set the date and time Go to System Config Time170 To set the system idle timeout Go to System Config OptionsTo set the Auth timeout Go to System Config Options Changing system options171 Modifying the Dead Gateway Detection settings172 Adding and editing administrator accountsAdding new administrator accounts To add an administrator account Go to System Config Admin173 Configuring SnmpEditing administrator accounts To edit an administrator account Go to System Config AdminConfiguring Snmp community settings Configuring the FortiGate unit for Snmp monitoringConfiguring FortiGate Snmp support Configuring Snmp access to an interfaceSystem Name 175System Location 176 FortiGate MIBs177 FortiGate trapsGeneral FortiGate traps System trapsLogging traps VPN trapsNids traps Antivirus traps179 System configuration and statusFirewall configuration Fortinet MIB fields180 Logging and reporting configuration Replacement messages181 182 Customizing replacement messages183 Customizing alert emailsAlert email message sections Alert email message sections 184185 Firewall configuration186 Default firewall configuration187 InterfacesVlan subinterfaces ZonesSchedules ServicesDefault addresses Interface Address Description AddressesTo add a firewall policy Go to Firewall Policy Content profilesAdding firewall policies 189Source Firewall policy options190 Action ServiceDestination ScheduleDynamic IP Pool Fixed Port VPN TunnelTraffic Shaping 192Maximum Bandwidth Traffic Priority AuthenticationAnti-Virus & Web filter 193Comments Log Traffic194 Policy matching in detail Configuring policy lists195 Enabling policies Changing the order of policies in a policy listEnabling and disabling policies Disabling policiesTo add an address Go to Firewall Address AddressesAdding addresses 197198 Editing addressesTo edit an address Go to Firewall Address To delete an address Go to Firewall Address Deleting addressesOrganizing addresses into address groups 199Predefined services Services200 GRE 201Ldap 202203 Adding custom TCP and UDP services204 Adding custom Icmp servicesAdding custom IP services Grouping services205 Schedules206 Creating one-time schedules207 Creating recurring schedulesTo add a schedule to a policy Go to Firewall Policy Virtual IPsAdding schedules to policies 208Virtual IP External Interface examples Description Internal Adding static NAT virtual IPs209 To add a static NAT virtual IP Go to Firewall Virtual IP210 Adding port forwarding virtual IPs211 212 Adding policies with virtual IPsTo add a policy with a virtual IP Go to Firewall Policy To add an IP pool Go to Firewall IP Pool IP poolsAdding an IP pool 213214 IP/MAC bindingIP Pools for firewall policies that use fixed ports IP pools and dynamic NATGo to Firewall IP/MAC Binding Static IP/MAC 215216 Adding IP/MAC addressesEnabling IP/MAC binding Viewing the dynamic IP/MAC list217 218 Content profiles219 Default content profilesAdding content profiles To add a content profile Go to Firewall Content ProfileOversized File/Email Pass Fragmented Email 220To add a content profile to a policy Go to Firewall Policy Adding content profiles to policies221 222 223 Users and authenticationTo set authentication timeout Go to System Config Options Setting authentication timeoutAdding user names and configuring authentication Adding user names and configuring authentication225 Deleting user names from the internal database226 Configuring Radius supportAdding Radius servers Deleting Radius serversTo add an Ldap server Go to User Ldap Configuring Ldap supportAdding Ldap servers 227228 Deleting Ldap serversTo delete an Ldap server Go to User Ldap To add a user group Go to User User Group Configuring user groupsAdding user groups 229230 Deleting user groupsTo delete a user group Go to User User Group 231 IPSec VPNAutoIKE with certificates Key managementManual Keys AutoIKE with pre-shared keys233 General configuration steps for a manual key VPNManual key IPSec VPNs Adding a manual key VPN tunnelAES256 234AES128 AES192235 General configuration steps for an AutoIKE VPNAdding a phase 1 configuration for an AutoIKE VPN AutoIKE IPSec VPNsRemote Gateway Static IP Address 236Remote Gateway Dialup User To configure phase 1 advanced options Configuring advanced options237 238 239 Adding a phase 1 configuration Standard optionsTo add a phase 2 configuration Go to VPN Ipsec Phase Adding a phase 2 configuration for an AutoIKE VPN240 Use selectors from policy 241Use wildcard selectors 242 Managing digital certificatesObtaining a signed local certificate Generating the certificate requestKey Type 243Key Size Importing the signed local certificate Downloading the certificate request244 245 Configuring encrypt policiesObtaining CA certificates Importing CA certificates246 Adding a source addressTo add a source address Go to Firewall Address To add a destination address Go to Firewall Address Adding a destination addressAdding an encrypt policy 247248 249 IPSec VPN concentratorsTo create a VPN concentrator configuration VPN concentrator hub general configuration steps250 251 Adding a VPN concentratorTo create a VPN spoke configuration VPN spoke general configuration steps252 253 Redundant IPSec VPNsTo configure a redundant IPSec VPN Configuring redundant IPSec VPNs254 Viewing dialup VPN connection status Monitoring and Troubleshooting VPNsTo view VPN tunnel status Go to VPN Ipsec Phase Viewing VPN tunnel status256 Testing a VPNPptp and L2TP VPN Configuring Pptp257 To add a source address Configuring the FortiGate unit as a Pptp gateway258 To add users and user groupsTo add a firewall policy 259To add a source address group To add a destination address260 Configuring a Windows 98 client for PptpTo connect to the Pptp VPN Configuring a Windows 2000 client for PptpConfiguring a Windows XP client for Pptp 261262 To configure the VPN connectionSelect Properties Security Configuring the FortiGate unit as an L2TP gateway Configuring L2TP263 To add source addresses 264265 Configuring a Windows 2000 client for L2TP266 To disable IPSecTo connect to the L2TP VPN 267 Configuring a Windows XP client for L2TP268 Detecting attacks Network Intrusion Detection System Nids269 270 Configuring checksum verificationSelecting the interfaces to monitor Disabling monitoring interfacesViewing attack descriptions Viewing the signature list271 Adding user-defined signatures Disabling Nids attack signatures272 273 Downloading the user-defined signature listEnabling Nids attack prevention signatures To enable Nids attack prevention Go to Nids PreventionPreventing attacks Enabling Nids attack prevention275 Setting signature threshold valuesAutomatic message reduction Logging attacksLogging attack messages to the attack log Reducing the number of Nids attack log and email messages277 Manual message reduction278 Antivirus protection General configuration steps279 280 Antivirus scanningTo scan FortiGate firewall traffic for viruses 281 File blockingTo block files in firewall traffic Blocking files in firewall trafficAdding file patterns to block 282283 QuarantineQuarantining infected files Quarantining blocked filesTo view the quarantine list Go to Anti-Virus Quarantine Viewing the quarantine listSorting the quarantine list 284Downloading quarantined files Configuring quarantine optionsFiltering the quarantine list Deleting files from the quarantine listBlocking oversized files and emails Configuring limits for oversized files and email286 287 To view the virus list Go to Anti-Virus Config Virus ListExempting fragmented email from blocking Viewing the virus list288 289 Web filtering290 Content blockingGo to Web Filter Content Block Adding words and phrases to the Banned Word list291 Clearing the Banned Word listRestoring the Banned Word list Backing up the Banned Word list292 293 Configuring FortiGate Web URL blockingURL blocking Adding URLs to the Web URL block list294 Clearing the Web URL block listTo upload a URL block list Downloading the Web URL block listUploading a URL block list 295Configuring FortiGate Web pattern blocking Configuring Cerberian URL filtering296 Adding a Cerberian user Installing a Cerberian license keyConfiguring Cerberian web filter About the default group and policyEnabling Cerberian URL filtering To configure Cerberian web filtering298 299 Script filteringEnabling script filtering Selecting script filter optionsGo to Web Filter URLExempt Exempt URL listAdding URLs to the URL Exempt list 300Go to Web Filter URL Exempt Downloading the URL Exempt ListUploading a URL Exempt List 301302 303 Email filterAdding words and phrases to the email banned word list Email banned word list304 Uploading the email banned word list Downloading the email banned word list305 306 Email block listAdding address patterns to the email block list Downloading the email block listTo upload the email block list Email exempt listUploading an email block list 307308 To add a subject tag Go to Email Filter ConfigAdding a subject tag Adding address patterns to the email exempt listRecording logs Logging and reporting309 Recording logs on a NetIQ WebTrends server Recording logs on a remote computer310 Option Recording logs on the FortiGate hard disk311 OverwriteLog message levels Recording logs in system memory312 Filtering log messages To filter log entries Go to Log&Report Log Setting313 314 Configuring traffic loggingEnabling traffic logging for a firewall policy Enabling traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a Vlan subinterfaceResolve IP Configuring traffic filter settingsAdding traffic filter entries 316317 Destination IP Address Destination Netmask ServiceViewing logs saved to memory Viewing logsKeyword Viewing and managing logs saved to the hard diskSearching logs 318To view the active or saved logs Go to Log&Report Logging 319320 Downloading a log file to the management computerDeleting all messages from an active log Deleting a saved log file321 Configuring alert emailTesting alert email Adding alert email addresses322 Enabling alert email323 Glossary324 325 326 327 IndexIndex 328Dialup Pptp 329Http 330Ldap 331332 Pptp dialup connection 333334 TCP 335Vlan 336