Manuals / Fortinet / Computer Equipment / Network Card

Fortinet FortiLog-100, FortiLog-800, FortiLog-400 manual 123

Models: FortiLog-100 FortiLog-400 FortiLog-800

1 124

Page 123

Index

web-based manager	windows shares 81
connecting 19
idle timeout 46
introduction 19
language 46, 109

FortiLog Administration Guide

05-16000-0082-20050115

123

Page 123

Image 123

Fortinet FortiLog-100, FortiLog-800, FortiLog-400 manual 123

Contents

January 15, 2004 FortiLog-100 FortiLog-400 FortiLog-800Version 1.6 January 15 05-16000-0082-20050115 TrademarksRegulatory Compliance Table of Contents Managing the FortiLog unit Config NetworkReports 110 Setting folder and file properties103 104FortiLog-400 FortiLog-100 FortiLog-800 IntroductionOperational Modes Active ModeIntroduction Passive ModeExplains how to install and set up the FortiLog unit About this guideFortiLog documentation Explains how to configure VPNs using the web-based manager Related documentationFortiGate documentation Fortinet Knowledge Center FortiManager documentationFortiClient documentation FortiMail documentationCustomer service and technical support Customer service and technical support Checking the package contents Setting up the FortiLog unitHardware specifications Dimensions WeightFortiLog-100 2.5 kg FortiLog-400 11 kg FortiLog-80014 kg Air flow Planning the installationPower requirements Environmental specificationsTo connect the FortiLog unit to the network Connecting the FortiLog unitConnecting the FortiLog unit FortiLog unit Management PCTo connect to the web-based manager Configuring the FortiLog unitUsing the web-based manager Factory defaults AdministratorSet system interface port1 mode static ip IPaddress netmask Using the command line interfaceTo configure the FortiLog unit using the web-based manager To configure the FortiLog unit using the CLIUsing the front panel buttons and LCD Set the primary DNS server IP addressSet system dns primary IPaddress Configuring the FortiLog unit Sending device logs to the FortiLog unit Connecting to the FortiLog UnitConfiguring FortiGate unit running FortiOS Go to Log&Report Log ConfigFortiGate 2.8 log settings Configuring FortiGate devices running FortiOSFortiGate 2.5 Log settings Configuring FortiMail devicesUnregistered Adding a deviceTo add a device Groups from this tabDefining device port interfaces To create a device group Go to System Devices Groups Creating Device GroupsManaging the FortiLog unit StatusStatus Alerts Operating ModeInterval RefreshSet system opmode activepassive To change the operating mode in the CLIChanging the FortiLog host name Changing operating modesTo change the firmware using the web-based manager Viewing system resources informationChanging the firmware Execute restore image FortiLog400-v120.out Installing firmware from a system rebootTo change the firmware using the CLI Execute restore image namestr tftpipEnter Local Address To install firmware from a system rebootPress any key to enter configuration menu Immediately press any key to interrupt the system startupEnter File Name image.out Testing a new firmware imageTo test a new firmware image before installing it Following message appearsYou can test the new firmware image as required Installing a backup firmware imageSave as Default firmware/Run image without savingD/R Get system statusType B To install a backup firmware imageSwitching to a backup firmware image Switching to the default firmware imageTo switch to the backup firmware image To backup up system settings Go to System Status Status Backing up system settingsTo switch back to the default firmware image Execute rebootRestoring a FortiLog unit Restoring system settingsRestore factory default system settings To restore system settings Go to System Status StatusPress any key to begin download To upload the firmware image to the FortiLog unitNetwork ConfigConfig RAID Port Log settingsConfig Policy Log to HostLevels Description Generated by Config PolicyLog policy CSV formatLanguage AdminTime OptionsConfigure Administrator access Administrator options Administrator account levelsDevices Active mode Changing the Administrator passwordTo add an administrator account Go to System Config Admin Device list Adding and registering a deviceEditing device information Alert Email ServerTo edit a device Go to System Devices Device Active mode LocalCreating a new device alert Attack Type Entry and listing Level of wait interval Attack TypeAlerts To add a device alert Go to System Alert Email DeviceVirus Type Network Sharing Defining IP aliasesWindow IP aliases To set host alias names Go to Reports IP AliasesSelect New and enter a name for the report To create a report Go to Reports ConfigReports Creating and generating a reportSelect Run now Configuring report parametersTo define report parameters Go to Reports Config Set the followingSelect a report from the list Select Queries Configuring a report queryTo set the report queries Go to Reports Config Resolve Service Names Ranked Reports show topTo create a query profile To select the devices Go to Reports ConfigCreating a query profile Selecting the devices for the reportTo create a device profile To set the filtering on a log report Go to Reports ConfigCreating a device profile Select filtering optionsTo create a report filter profile Setting a report scheduleTo create a scheduled report Go to Reports Config Creating a filter profileTo create a report schedule profile Creating a report schedule profileChoosing the report destination and format Select Schedule Select a day from the followingTo create a pre-defined output selection To generate a report on demand Go to Reports ConfigCreating a report destination and format profile Reports on demandTo view a generated report Go to File Browse Reports Viewing reportsIndividual reports Roll up reportTo create a report Go to Reports Config Vulnerability Vulnerability reportsCreating and generating a report Per device Resolve Host Names Resolve Service Names Selecting report result parametersSelecting plug-ins To create a plug-in profile To select the plug-ins Go to Reports Config VulnerabilitiesCreating a plug-in profile Selecting the scan targets for the reportCreating a scan target profile To add additional devicesTo create a scan target profile As an email attachment FileBrowse/Reports hard disk Email listSelect the report name from the list of completed reports Viewing the vulnerability reportUsing Logs Viewing logs Log view interfaceAscending and descending order Finding log informationTo view the device log files Go to File Browse Logs Select the column header to change the sort order betweenBasic log filter Match Up and Down arrows Importing log filesAlert level To import a log file Go to File Browse LogsShow Up and Down arrows Log watch Active modeLog Search To set log watching Go to File Browse LogsSort list Event correlation Active modeEvent correlation Active mode Connecting to the FortiLog file system Using the FortiLog unit as a NASAdding and modifying user accounts Providing access to the FortiLog hard diskSelect Enable for a file sharing protocol Selecting a file sharing protocolSelect Create New Assigning access to foldersAdding and modifying group accounts To add a user group Go to Network Sharing GroupsWindows sharing configuration NFS share configuration Modifying the user or group folder accessSetting folder and file properties To set file and folder permissions Go to File Browse FilesOwner CLI documentation conventions FortiLog CLI referenceTo connect to the FortiLog-800 console Connecting to the CLIConnecting to the FortiLog-800 console FortiLog-800 loginSetting administrative access for SSH or Telnet To use the CLI to configure SSH or Telnet accessWelcome To connect to the CLI using Telnet Connecting to the FortiLog CLI using SSHConnecting to the FortiLog CLI using Telnet To connect to the CLI using SSHCLI commands FortiLog CLI commands includeExecute branch Use get to display settings, logs, or system information Get command architectureGet branch Get report aliases Get log logsettingGet system admin Get report resolveSet branch Use set to configure settings, logs, or system informationUse set alertemail to configure alert mails Set alertemail command architectureSet alertmail local time 0.5 1.0 3.0 6.0 String is the passwordNamestr is the user name BelowCLI commands Set alertmail device enable add leveltimeSettings originate from a singe source IP Set console Use set console to set console configurationUse set log to configure log settings Set log command architectureSet log YY-MM-DD 100 101 102 103 Set NAS104 Set report command architectureSet report Set system105 106 107 Netmaskstr is the netmask 1080.0 Trusthoststr is trusted host IP address109 Unset branch 111 112 113 Appendix a Log Report TypesNetwork Activity Web ActivityFTP Activity Mail activity reports record Email traffic and connections Terminal ActivityMail Activity 115Intrusion Activity Antivirus ActivityWeb Filter Activity 117 Mail Filter ActivityVPN Activity Content Activity119 120 121 IndexIndex 122123 124