Connecting the FortiLog unit

Connecting the FortiLog unit	Setting up the FortiLog unit

Figure 6: FortiLog connection option
FortiMail unit	FortiGate units

Internal Network	FortiGate unit

FortiLog unit

Management PC

Internet

Management PC

FortiGate unit

You can install the FortiLog unit as a free-standing appliance on any stable surface.

You can mount the FortiLog-800 unit in a standard 19-inch rack. It requires 1 U of vertical space in the rack.

To connect the FortiLog unit to the network

1Place the unit on a stable surface.

2If you have a FortiLog-800 unit, you can also mount it in a 19-inch rack. The units require 1.5 inches (3.75 cm) clearance on each side to allow for cooling.

3Make sure the power of the unit is turned off.

4Connect the network cable to the LAN interface.

5Connect the power cable to a power outlet.

6Turn on the power switch.

05-16000-0082-20050115

Fortinet Inc.

Page 18

Image 18

Fortinet FortiLog-100, FortiLog-800, FortiLog-400 manual Connecting the FortiLog unit, FortiLog unit Management PC

Contents

FortiLog-100 FortiLog-400 FortiLog-800 January 15, 2004 Version 1.6 January 15 05-16000-0082-20050115 TrademarksRegulatory Compliance Table of Contents Config Network Managing the FortiLog unit Reports 104 Setting folder and file properties103 110 Introduction FortiLog-400 FortiLog-100 FortiLog-800 Active Mode Operational Modes Passive Mode Introduction Explains how to install and set up the FortiLog unit About this guideFortiLog documentation Explains how to configure VPNs using the web-based manager Related documentationFortiGate documentation FortiMail documentation FortiManager documentationFortiClient documentation Fortinet Knowledge Center Customer service and technical support Customer service and technical support Setting up the FortiLog unit Checking the package contents Hardware specifications Dimensions WeightFortiLog-100 2.5 kg FortiLog-400 11 kg FortiLog-80014 kg Environmental specifications Planning the installationPower requirements Air flow FortiLog unit Management PC Connecting the FortiLog unitConnecting the FortiLog unit To connect the FortiLog unit to the network Factory defaults Administrator Configuring the FortiLog unitUsing the web-based manager To connect to the web-based manager To configure the FortiLog unit using the CLI Using the command line interfaceTo configure the FortiLog unit using the web-based manager Set system interface port1 mode static ip IPaddress netmask Using the front panel buttons and LCD Set the primary DNS server IP addressSet system dns primary IPaddress Configuring the FortiLog unit Go to Log&Report Log Config Connecting to the FortiLog UnitConfiguring FortiGate unit running FortiOS Sending device logs to the FortiLog unit Configuring FortiGate devices running FortiOS FortiGate 2.8 log settings Configuring FortiMail devices FortiGate 2.5 Log settings Groups from this tab Adding a deviceTo add a device Unregistered Defining device port interfaces Creating Device Groups To create a device group Go to System Devices Groups Managing the FortiLog unit StatusStatus Refresh Operating ModeInterval Alerts Changing operating modes To change the operating mode in the CLIChanging the FortiLog host name Set system opmode activepassive To change the firmware using the web-based manager Viewing system resources informationChanging the firmware Execute restore image namestr tftpip Installing firmware from a system rebootTo change the firmware using the CLI Execute restore image FortiLog400-v120.out Immediately press any key to interrupt the system startup To install firmware from a system rebootPress any key to enter configuration menu Enter Local Address Following message appears Testing a new firmware imageTo test a new firmware image before installing it Enter File Name image.out Get system status Installing a backup firmware imageSave as Default firmware/Run image without savingD/R You can test the new firmware image as required To install a backup firmware image Type B Switching to a backup firmware image Switching to the default firmware imageTo switch to the backup firmware image Execute reboot Backing up system settingsTo switch back to the default firmware image To backup up system settings Go to System Status Status To restore system settings Go to System Status Status Restoring system settingsRestore factory default system settings Restoring a FortiLog unit To upload the firmware image to the FortiLog unit Press any key to begin download Config Network Config RAID Log to Host Log settingsConfig Policy Port CSV format Config PolicyLog policy Levels Description Generated by Options AdminTime Language Configure Administrator access Administrator account levels Administrator options Devices Active mode Changing the Administrator passwordTo add an administrator account Go to System Config Admin Device list Adding and registering a deviceEditing device information Alert Email ServerTo edit a device Go to System Devices Device Active mode LocalCreating a new device alert Attack Type Attack Type Entry and listing Level of wait interval Alerts To add a device alert Go to System Alert Email DeviceVirus Type Network Sharing Defining IP aliasesWindow To set host alias names Go to Reports IP Aliases IP aliases Creating and generating a report To create a report Go to Reports ConfigReports Select New and enter a name for the report Set the following Configuring report parametersTo define report parameters Go to Reports Config Select Run now Resolve Service Names Ranked Reports show top Configuring a report queryTo set the report queries Go to Reports Config Select a report from the list Select Queries Selecting the devices for the report To select the devices Go to Reports ConfigCreating a query profile To create a query profile Select filtering options To set the filtering on a log report Go to Reports ConfigCreating a device profile To create a device profile Creating a filter profile Setting a report scheduleTo create a scheduled report Go to Reports Config To create a report filter profile Select Schedule Select a day from the following Creating a report schedule profileChoosing the report destination and format To create a report schedule profile Reports on demand To generate a report on demand Go to Reports ConfigCreating a report destination and format profile To create a pre-defined output selection Viewing reports To view a generated report Go to File Browse Reports Roll up report Individual reports To create a report Go to Reports Config Vulnerability Vulnerability reportsCreating and generating a report Per device Resolve Host Names Resolve Service Names Selecting report result parametersSelecting plug-ins Selecting the scan targets for the report To select the plug-ins Go to Reports Config VulnerabilitiesCreating a plug-in profile To create a plug-in profile Creating a scan target profile To add additional devicesTo create a scan target profile Email list FileBrowse/Reports hard disk As an email attachment Viewing the vulnerability report Select the report name from the list of completed reports Using Logs Log view interface Viewing logs Select the column header to change the sort order between Finding log informationTo view the device log files Go to File Browse Logs Ascending and descending order Basic log filter To import a log file Go to File Browse Logs Importing log filesAlert level Match Up and Down arrows To set log watching Go to File Browse Logs Log watch Active modeLog Search Show Up and Down arrows Event correlation Active mode Sort list Event correlation Active mode Using the FortiLog unit as a NAS Connecting to the FortiLog file system Selecting a file sharing protocol Providing access to the FortiLog hard diskSelect Enable for a file sharing protocol Adding and modifying user accounts To add a user group Go to Network Sharing Groups Assigning access to foldersAdding and modifying group accounts Select Create New Windows sharing configuration Modifying the user or group folder access NFS share configuration Setting folder and file properties To set file and folder permissions Go to File Browse FilesOwner FortiLog CLI reference CLI documentation conventions FortiLog-800 login Connecting to the CLIConnecting to the FortiLog-800 console To connect to the FortiLog-800 console Setting administrative access for SSH or Telnet To use the CLI to configure SSH or Telnet accessWelcome To connect to the CLI using SSH Connecting to the FortiLog CLI using SSHConnecting to the FortiLog CLI using Telnet To connect to the CLI using Telnet CLI commands FortiLog CLI commands includeExecute branch Use get to display settings, logs, or system information Get command architectureGet branch Get report resolve Get log logsettingGet system admin Get report aliases Set alertemail command architecture Use set to configure settings, logs, or system informationUse set alertemail to configure alert mails Set branch Below String is the passwordNamestr is the user name Set alertmail local time 0.5 1.0 3.0 6.0 CLI commands Set alertmail device enable add leveltimeSettings originate from a singe source IP Use set console to set console configuration Set console Use set log to configure log settings Set log command architectureSet log YY-MM-DD 100 101 102 Set NAS 103 Set system Set report command architectureSet report 104 105 106 107 Trusthoststr is trusted host IP address 1080.0 Netmaskstr is the netmask 109 Unset branch 111 112 Web Activity Appendix a Log Report TypesNetwork Activity 113 FTP Activity 115 Terminal ActivityMail Activity Mail activity reports record Email traffic and connections Intrusion Activity Antivirus ActivityWeb Filter Activity Mail Filter Activity 117 Content Activity VPN Activity 119 120 Index 121 122 Index 123 124

Fortinet FortiLog-100, FortiLog-800 Connecting the FortiLog unit, FortiLog unit Management PC

Models: FortiLog-100 FortiLog-400 FortiLog-800