Recording logs on the FortiGate hard disk | Fortinet FortiGate-800

Logging and reporting	Recording logs

5Select Config Policy.

To configure the FortiGate unit to filter the types of logs and events to record, use the procedures in “Filtering log messages” on page 313 and “Configuring traffic logging” on page 314.

6Select OK.

7Select Apply.

Recording logs on the FortiGate hard disk

You can record log files on the FortiGate hard disk if a hard disk is installed on your

FortiGate unit.

To record logs on the FortiGate hard disk

1Go to Log&Report > Log Setting.

2Select the Log to Local Disk check box.

3Type a maximum log file size (in MB).

When the log file reaches the maximum log file size, the current log file is closed and saved and a new active log file is started. The default maximum log file size is 10 MB and the maximum allowed is 1 GB.

4Type a log time interval (in days).

After the specified time interval, the current log file is closed and saved and a new one is started. The default log time interval is 10 days.

5Select the severity level for which you want to record log messages.

The FortiGate logs all levels of severity down to, but not lower than, the level you choose. For example, if you want to record emergency, alert, critical, and error messages, select Error.

See “Log message levels” on page 312.

6Select Config Policy.

To configure the FortiGate to filter the types of logs and events to record, use the procedures in “Filtering log messages” on page 313 and “Configuring traffic logging” on page 314.

7Set Log options for when the disk is full to one of the following:

Overwrite	Delete the oldest log file when the hard disk is full. Overwrite is the default
	option.
Block traffic	Block all network traffic when the hard disk is full.
Do not log	Stop logging messages when the hard disk is full.

8Select Apply.

FortiGate-800 Installation and Configuration Guide

311

Image 311

Fortinet FortiGate-800 manual Recording logs on the FortiGate hard disk, 311, Overwrite, Option

Contents

January 15 Installation and Configuration Guide Regulatory Compliance Trademarks Table of Contents NAT/Route mode installation High availability Virus and attack definitions updates and registration 117 Network configuration 137 System configuration 169 Users and authentication 223 IPSec VPN 231 Network Intrusion Detection System Nids 269 Email filter 303 Glossary 323 Index 327 Contents Flexibility demanded by large enterprises Introduction Antivirus protection Web content filtering Firewall Email filtering Network intrusion detection NAT/Route modeTransparent mode VLANs and virtual domains High availability VPN Web-based manager Secure installation, configuration, and management Logging and reporting Command line interface Fortinet documentation Document conventions Comments on Fortinet technical documentation Customer service and technical support Customer service and technical support Getting started Mounting Package contents To power on the FortiGate-800 unit Powering onPower requirements Environmental specifications To connect to the web-based manager Connecting to the web-based manager Stop bits Flow control Connecting to the command line interface CLITo connect to the CLI Bits per second 9600 Data bits Parity Internal interface Factory default FortiGate configuration settingsFactory default NAT/Route mode network configuration Account Factory default Transparent mode network configuration Factory default firewall configuration Strict content profile Factory default content profiles Scan content profile Options Scan content profileStrict content profile Options Unfiltered content profile Options Web content profileUnfiltered content profile Web content profile Options Example NAT/Route mode network configuration Planning the FortiGate configuration Example NAT/Route multiple internet connection configuration NAT/Route mode with multiple external network connections Setup wizard Configuration options Front keypad and LCD FortiGate model maximum values matrix Signatures Antivirus file Block patterns Web filter Next steps Preparing to configure NAT/Route mode NAT/Route mode installation Dhcp server Advanced NAT/Route mode settingsAdvanced FortiGate NAT/Route mode settings DMZ and user-defined interfaces Using the setup wizardStarting the setup wizard Reconnecting to the web-based manager Configuring NAT/Route mode IP addresses Using the front control buttons and LCDUsing the command line interface Configuring the FortiGate unit to operate in NAT/Route mode Set system interface external mode static ip 204.23.1.5 To connect the FortiGate unit running in NAT/Route mode Connecting the FortiGate unit to your networks To connect to FortiGate-800 user-defined interfaces FortiGate-800 External Example FortiGate-800 user-defined interface connections Configuring your networks Setting the date and time Completing the configurationConfiguring the DMZ interface Configuring interfaces 1 to Registering your FortiGate unit Configuration example Multiple connections to the InternetConfiguring virus and attack definition updates Internal Configuring ping servers Go to System Network Routing Table Using the CLIPrimary and backup links to the Internet Destination-based routing examples Load sharing and primary and secondary connections Load sharing Routing table should have routes arranged as shown in Table To add the routes using the CLI Policy routing examples Routing a service to an external network Adding more firewall policies Adding a redundant default policyDestination DMZAll Schedule Always Service Firewall policy example Restricting access to a single Internet connection Configuration example Multiple connections to the Internet DNS Settings Transparent mode installationPreparing to configure Transparent mode Transparent mode settings Administrator Password Go to System Status Changing to Transparent mode using the web-based manager Operation mode Transparent Changing to Transparent mode using the CLI Enabling antivirus protection Configuring the Transparent mode management IP addressConfigure the Transparent mode default gateway Connecting the FortiGate unit to your networks FortiGate-800 Transparent mode configuration examples Example default route to an external network Default routes and static routes Default route to an external network General configuration steps Go to System Network Management Web-based manager example configuration stepsCLI configuration steps Example static route to an external destination DMZ Example static route to an internal destination FortiGate-800 Set system route number 1 dst 172.16.1.11 255.255.255.0 gw1 Transparent mode configuration examples High availability Go to System Config HA Configuring an HA clusterConfiguring FortiGate units for HA operation To configure a FortiGate unit for HA operation Least Connection Weighted Round RobinNone Hub Example Active-Active HA configuration Connecting the cluster To connect the cluster HA network configuration To add a new unit to the cluster Managing an HA clusterAdding a new FortiGate unit to a functioning cluster Configuring cluster interface monitoring Monitoring cluster members Viewing the status of cluster members Example cluster CPU, memory, and hard disk display To set the update frequency Viewing and managing cluster log messages Viewing cluster sessions Managing individual cluster units Monitoring cluster units for failoverViewing cluster communication sessions To set the host name of each cluster member Changing cluster unit host namesTo manage a cluster unit Keyword Description Synchronizing the cluster configuration Upgrading firmware To select a permanent primary unit Advanced HA optionsReplacing a FortiGate unit after failover Selecting a FortiGate unit as a permanent primary unit To set the priority of each FortiGate unit in a cluster Configuring weighted-round-robin weights Active-active HA packet flow Active-Active cluster packet flow NAT/Route mode packet flow Transparent mode packet flow Active-Active cluster packet flow System status System status To change the FortiGate host name Go to System Status Firmware upgrade procedures Procedure DescriptionChanging the FortiGate host name Changing the FortiGate firmware To upgrade the firmware using the CLI Upgrading the firmware using the web-based managerUpgrading the firmware using the CLI To upgrade the firmware using the web-based manager Execute ping Reverting to a previous firmware version Reverting to a previous firmware version using the CLI To revert to a previous firmware version using the CLI To install firmware from a system reboot 100 Press any key to enter configuration menu 101 Restoring the previous configurationTesting a new firmware image before installing it To test a new firmware image 102 103 Installing and using a backup firmware imageInstalling a backup firmware image 104 To install a backup firmware image 105 Switching to the backup firmware imageTo switch to the backup firmware image To update the antivirus definitions manually Manual virus definition updatesSwitching back to the default firmware image To switch back to the default firmware image 107 Manual attack definition updatesTo update the attack definitions manually Displaying the FortiGate serial number Displaying log hard disk status Backing up system settingsRestoring system settings Displaying the FortiGate up time 109 Restoring system settings to factory defaultsChanging to Transparent mode To change to Transparent mode Go to System Status Shutting down the FortiGate unit Changing to NAT/Route modeTo change to NAT/Route mode Go to System Status Restarting the FortiGate unit To view CPU and memory status Go to System Status Monitor System statusViewing CPU and memory status 111 CPU and memory status monitor Viewing sessions and network status 113 Viewing virus and intrusions status To view the session list Go to System Status Session Session list Protocol 115 116 117 Virus and attack definitions updates and registrationUpdating antivirus and attack definitions To make sure the FortiGate unit can connect to the FDN Connecting to the FortiResponse Distribution NetworkGo to System Update Version Expiry date Last update attempt Last update status 119 Manually initiating antivirus and attack definitions updates 120 Scheduling updatesConfiguring update logging Enabling scheduled updates 121 To add an override server Go to System UpdateAdding an override server 122 Enabling push updatesEnabling scheduled updates through a proxy server 123 Enabling push updatesPush updates when FortiGate IP addresses change To enable push updates Go to System Update 124 Enabling push updates through a NAT deviceExample push updates through a NAT device 125 General procedure 126 127 To configure the FortiGate NAT deviceSchedule Always Service ANY Action Accept Adding a firewall policy for the port forwarding virtual IP 128 Registering FortiGate units 129 FortiCare Service Contracts 130 Registering the FortiGate unit 131 Updating registration information 132 Recovering a lost Fortinet support passwordViewing the list of registered FortiGate units 133 Registering a new FortiGate unitAdding or changing a FortiCare Support Contract number 134 Changing your Fortinet support passwordChanging your contact information or security question 135 Downloading virus and attack definitions updates 136 Registering a FortiGate unit after an RMA 137 Network configurationConfiguring zones 138 Configuring interfacesAdding zones Deleting zones 139 Changing the administrative status of an interfaceViewing the interface list Adding an interface to a zone 140 Configuring an interface with a manual IP addressConfiguring an interface for Dhcp 141 Configuring an interface for PPPoE 142 Adding a secondary IP address to an interfaceAdding a ping server to an interface 143 Controlling administrative access to an interface 144 Configuring traffic logging for connections to an interfaceConfiguring the management interface in Transparent mode Changing the MTU size to improve network performance 145 Vlan overview 146 VLANs in NAT/Route modeRules for Vlan IDs Rules for Vlan IP addresses To add Vlan subinterfaces Go to System Network Interface Virtual domains in Transparent modeAdding Vlan subinterfaces 147 FortiGate unit with two virtual domains 148 149 Configuring a virtual domainVirtual domain properties Adding a virtual domain 150 Adding Vlan subinterfaces to a virtual domainAdding zones to virtual domains To add a zone to a virtual domain Go to System Network Zone 151 Go to Firewall Address Adding firewall policies for virtual domainsAdding addresses for virtual domains 152 153 Configuring routingAdding DNS server IP addresses Deleting virtual domains 154 Adding a default routeTo add a default route Go to System Network Routing Table Adding destination-based routes to the routing table 155 Adding routes in Transparent mode 156 Configuring the routing tablePolicy routing 157 Configuring Dhcp servicesPolicy routing command syntax Adding scopes to a Dhcp server Configuring a Dhcp relay agentConfiguring a Dhcp server Adding a Dhcp server to an interface To add a scope to a Dhcp server Go to System Network Dhcp 159 Selected scope Adding a reserve IP to a Dhcp serverViewing a Dhcp server dynamic IP list 160 161 RIP configurationRIP settings Flush 162Invalid Holddown 163 Configuring RIP for FortiGate interfaces 164 Example RIP configuration for an internal interface To add a RIP filter list Go to System RIP Filter Adding RIP filtersAdding a RIP filter list 165 166 Assigning a RIP filter list to the neighbors filterAssigning a RIP filter list to the incoming filter 167 Assigning a RIP filter list to the outgoing filter 168 169 System configurationSetting system date and time To set the date and time Go to System Config Time 170 To set the system idle timeout Go to System Config OptionsTo set the Auth timeout Go to System Config Options Changing system options 171 Modifying the Dead Gateway Detection settings 172 Adding and editing administrator accountsAdding new administrator accounts To add an administrator account Go to System Config Admin 173 Configuring SnmpEditing administrator accounts To edit an administrator account Go to System Config Admin Configuring Snmp community settings Configuring the FortiGate unit for Snmp monitoringConfiguring FortiGate Snmp support Configuring Snmp access to an interface System Location 175System Name 176 FortiGate MIBs 177 FortiGate trapsGeneral FortiGate traps System traps Logging traps VPN trapsNids traps Antivirus traps 179 System configuration and statusFirewall configuration Fortinet MIB fields 180 181 Replacement messagesLogging and reporting configuration 182 Customizing replacement messages Alert email message sections Customizing alert emails183 Alert email message sections 184 185 Firewall configuration 186 Default firewall configuration 187 InterfacesVlan subinterfaces Zones Schedules ServicesDefault addresses Interface Address Description Addresses To add a firewall policy Go to Firewall Policy Content profilesAdding firewall policies 189 190 Firewall policy optionsSource Action ServiceDestination Schedule Dynamic IP Pool Fixed Port VPN TunnelTraffic Shaping 192 Maximum Bandwidth Traffic Priority AuthenticationAnti-Virus & Web filter 193 194 Log TrafficComments 195 Configuring policy listsPolicy matching in detail Enabling policies Changing the order of policies in a policy listEnabling and disabling policies Disabling policies To add an address Go to Firewall Address AddressesAdding addresses 197 To edit an address Go to Firewall Address Editing addresses198 To delete an address Go to Firewall Address Deleting addressesOrganizing addresses into address groups 199 200 ServicesPredefined services GRE 201 Ldap 202 203 Adding custom TCP and UDP services 204 Adding custom Icmp servicesAdding custom IP services Grouping services 205 Schedules 206 Creating one-time schedules 207 Creating recurring schedules To add a schedule to a policy Go to Firewall Policy Virtual IPsAdding schedules to policies 208 Virtual IP External Interface examples Description Internal Adding static NAT virtual IPs209 To add a static NAT virtual IP Go to Firewall Virtual IP 210 Adding port forwarding virtual IPs 211 To add a policy with a virtual IP Go to Firewall Policy Adding policies with virtual IPs212 To add an IP pool Go to Firewall IP Pool IP poolsAdding an IP pool 213 214 IP/MAC bindingIP Pools for firewall policies that use fixed ports IP pools and dynamic NAT Go to Firewall IP/MAC Binding Static IP/MAC 215 216 Adding IP/MAC addresses 217 Viewing the dynamic IP/MAC listEnabling IP/MAC binding 218 Content profiles 219 Default content profilesAdding content profiles To add a content profile Go to Firewall Content Profile Oversized File/Email Pass Fragmented Email 220 221 Adding content profiles to policiesTo add a content profile to a policy Go to Firewall Policy 222 223 Users and authentication To set authentication timeout Go to System Config Options Setting authentication timeoutAdding user names and configuring authentication Adding user names and configuring authentication 225 Deleting user names from the internal database 226 Configuring Radius supportAdding Radius servers Deleting Radius servers To add an Ldap server Go to User Ldap Configuring Ldap supportAdding Ldap servers 227 To delete an Ldap server Go to User Ldap Deleting Ldap servers228 To add a user group Go to User User Group Configuring user groupsAdding user groups 229 To delete a user group Go to User User Group Deleting user groups230 231 IPSec VPN AutoIKE with certificates Key managementManual Keys AutoIKE with pre-shared keys 233 General configuration steps for a manual key VPNManual key IPSec VPNs Adding a manual key VPN tunnel AES256 234AES128 AES192 235 General configuration steps for an AutoIKE VPNAdding a phase 1 configuration for an AutoIKE VPN AutoIKE IPSec VPNs Remote Gateway Dialup User 236Remote Gateway Static IP Address 237 Configuring advanced optionsTo configure phase 1 advanced options 238 239 Adding a phase 1 configuration Standard options 240 Adding a phase 2 configuration for an AutoIKE VPNTo add a phase 2 configuration Go to VPN Ipsec Phase Use wildcard selectors 241Use selectors from policy 242 Managing digital certificatesObtaining a signed local certificate Generating the certificate request Key Size 243Key Type 244 Downloading the certificate requestImporting the signed local certificate 245 Configuring encrypt policiesObtaining CA certificates Importing CA certificates To add a source address Go to Firewall Address Adding a source address246 To add a destination address Go to Firewall Address Adding a destination addressAdding an encrypt policy 247 248 249 IPSec VPN concentrators 250 VPN concentrator hub general configuration stepsTo create a VPN concentrator configuration 251 Adding a VPN concentrator 252 VPN spoke general configuration stepsTo create a VPN spoke configuration 253 Redundant IPSec VPNs 254 Configuring redundant IPSec VPNsTo configure a redundant IPSec VPN Viewing dialup VPN connection status Monitoring and Troubleshooting VPNsTo view VPN tunnel status Go to VPN Ipsec Phase Viewing VPN tunnel status 256 Testing a VPN 257 Configuring PptpPptp and L2TP VPN To add a source address Configuring the FortiGate unit as a Pptp gateway258 To add users and user groups To add a firewall policy 259To add a source address group To add a destination address 260 Configuring a Windows 98 client for Pptp To connect to the Pptp VPN Configuring a Windows 2000 client for PptpConfiguring a Windows XP client for Pptp 261 Select Properties Security To configure the VPN connection262 263 Configuring L2TPConfiguring the FortiGate unit as an L2TP gateway To add source addresses 264 265 Configuring a Windows 2000 client for L2TP To connect to the L2TP VPN To disable IPSec266 267 Configuring a Windows XP client for L2TP 268 269 Network Intrusion Detection System NidsDetecting attacks 270 Configuring checksum verificationSelecting the interfaces to monitor Disabling monitoring interfaces 271 Viewing the signature listViewing attack descriptions 272 Disabling Nids attack signaturesAdding user-defined signatures 273 Downloading the user-defined signature list Enabling Nids attack prevention signatures To enable Nids attack prevention Go to Nids PreventionPreventing attacks Enabling Nids attack prevention 275 Setting signature threshold values Automatic message reduction Logging attacksLogging attack messages to the attack log Reducing the number of Nids attack log and email messages 277 Manual message reduction 278 279 General configuration stepsAntivirus protection To scan FortiGate firewall traffic for viruses Antivirus scanning280 281 File blocking To block files in firewall traffic Blocking files in firewall trafficAdding file patterns to block 282 283 QuarantineQuarantining infected files Quarantining blocked files To view the quarantine list Go to Anti-Virus Quarantine Viewing the quarantine listSorting the quarantine list 284 Downloading quarantined files Configuring quarantine optionsFiltering the quarantine list Deleting files from the quarantine list 286 Configuring limits for oversized files and emailBlocking oversized files and emails 287 To view the virus list Go to Anti-Virus Config Virus ListExempting fragmented email from blocking Viewing the virus list 288 289 Web filtering 290 Content blockingGo to Web Filter Content Block Adding words and phrases to the Banned Word list 291 Clearing the Banned Word list 292 Backing up the Banned Word listRestoring the Banned Word list 293 Configuring FortiGate Web URL blockingURL blocking Adding URLs to the Web URL block list 294 Clearing the Web URL block list To upload a URL block list Downloading the Web URL block listUploading a URL block list 295 296 Configuring Cerberian URL filteringConfiguring FortiGate Web pattern blocking Adding a Cerberian user Installing a Cerberian license keyConfiguring Cerberian web filter About the default group and policy 298 To configure Cerberian web filteringEnabling Cerberian URL filtering 299 Script filteringEnabling script filtering Selecting script filter options Go to Web Filter URLExempt Exempt URL listAdding URLs to the URL Exempt list 300 Go to Web Filter URL Exempt Downloading the URL Exempt ListUploading a URL Exempt List 301 302 303 Email filter 304 Email banned word listAdding words and phrases to the email banned word list 305 Downloading the email banned word listUploading the email banned word list 306 Email block listAdding address patterns to the email block list Downloading the email block list To upload the email block list Email exempt listUploading an email block list 307 308 To add a subject tag Go to Email Filter ConfigAdding a subject tag Adding address patterns to the email exempt list 309 Logging and reportingRecording logs 310 Recording logs on a remote computerRecording logs on a NetIQ WebTrends server Option Recording logs on the FortiGate hard disk311 Overwrite 312 Recording logs in system memoryLog message levels 313 To filter log entries Go to Log&Report Log SettingFiltering log messages 314 Configuring traffic logging Enabling traffic logging for a firewall policy Enabling traffic loggingEnabling traffic logging for an interface Enabling traffic logging for a Vlan subinterface Resolve IP Configuring traffic filter settingsAdding traffic filter entries 316 317 Destination IP Address Destination Netmask ServiceViewing logs saved to memory Viewing logs Keyword Viewing and managing logs saved to the hard diskSearching logs 318 To view the active or saved logs Go to Log&Report Logging 319 320 Downloading a log file to the management computerDeleting all messages from an active log Deleting a saved log file 321 Configuring alert emailTesting alert email Adding alert email addresses 322 Enabling alert email 323 Glossary 324 325 326 327 Index Index 328 Dialup Pptp 329 Http 330 Ldap 331 332 Pptp dialup connection 333 334 TCP 335 Vlan 336