Manuals / Fortinet / Computer Equipment / Network Card

Fortinet FortiLog-400, FortiLog-100 Version 1.6 January 15 05-16000-0082-20050115, Trademarks

Models: FortiLog-100 FortiLog-400 FortiLog-800

1 124

Page 2

No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet Inc.

FortiLog Administration Guide

Version 1.6 January 15, 2005

05-16000-0082-20050115

Trademarks

Products mentioned in this document are trademarks or registered trademarks of their respective holders.

Regulatory Compliance

FCC Class A Part 15, UL, CE

CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS.

For technical support, please visit http://www.fortinet.com.

Send information about errors or omissions in this document or any Fortinet technical documentation to techdoc@fortinet.com.

Page 2

Image 2

Fortinet FortiLog-400, FortiLog-100 manual Version 1.6 January 15 05-16000-0082-20050115, Trademarks, Regulatory Compliance

Contents

FortiLog-100 FortiLog-400 FortiLog-800 January 15, 2004Regulatory Compliance Version 1.6 January 15 05-16000-0082-20050115Trademarks Table of Contents Config Network Managing the FortiLog unitReports 104 Setting folder and file properties103 110Introduction FortiLog-400 FortiLog-100 FortiLog-800Active Mode Operational ModesPassive Mode IntroductionFortiLog documentation Explains how to install and set up the FortiLog unitAbout this guide FortiGate documentation Explains how to configure VPNs using the web-based managerRelated documentation FortiMail documentation FortiManager documentationFortiClient documentation Fortinet Knowledge CenterCustomer service and technical support Customer service and technical support Setting up the FortiLog unit Checking the package contentsFortiLog-100 2.5 kg FortiLog-400 11 kg FortiLog-80014 kg Hardware specifications DimensionsWeight Environmental specifications Planning the installationPower requirements Air flowFortiLog unit Management PC Connecting the FortiLog unitConnecting the FortiLog unit To connect the FortiLog unit to the networkFactory defaults Administrator Configuring the FortiLog unitUsing the web-based manager To connect to the web-based managerTo configure the FortiLog unit using the CLI Using the command line interfaceTo configure the FortiLog unit using the web-based manager Set system interface port1 mode static ip IPaddress netmaskSet system dns primary IPaddress Using the front panel buttons and LCDSet the primary DNS server IP address Configuring the FortiLog unit Go to Log&Report Log Config Connecting to the FortiLog UnitConfiguring FortiGate unit running FortiOS Sending device logs to the FortiLog unitConfiguring FortiGate devices running FortiOS FortiGate 2.8 log settingsConfiguring FortiMail devices FortiGate 2.5 Log settingsGroups from this tab Adding a deviceTo add a device UnregisteredDefining device port interfaces Creating Device Groups To create a device group Go to System Devices GroupsStatus Managing the FortiLog unitStatus Refresh Operating ModeInterval AlertsChanging operating modes To change the operating mode in the CLIChanging the FortiLog host name Set system opmode activepassiveChanging the firmware To change the firmware using the web-based managerViewing system resources information Execute restore image namestr tftpip Installing firmware from a system rebootTo change the firmware using the CLI Execute restore image FortiLog400-v120.outImmediately press any key to interrupt the system startup To install firmware from a system rebootPress any key to enter configuration menu Enter Local AddressFollowing message appears Testing a new firmware imageTo test a new firmware image before installing it Enter File Name image.outGet system status Installing a backup firmware imageSave as Default firmware/Run image without savingD/R You can test the new firmware image as requiredTo install a backup firmware image Type BTo switch to the backup firmware image Switching to a backup firmware imageSwitching to the default firmware image Execute reboot Backing up system settingsTo switch back to the default firmware image To backup up system settings Go to System Status StatusTo restore system settings Go to System Status Status Restoring system settingsRestore factory default system settings Restoring a FortiLog unitTo upload the firmware image to the FortiLog unit Press any key to begin downloadConfig NetworkConfig RAID Log to Host Log settingsConfig Policy PortCSV format Config PolicyLog policy Levels Description Generated byOptions AdminTime LanguageConfigure Administrator access Administrator account levels Administrator optionsTo add an administrator account Go to System Config Admin Devices Active modeChanging the Administrator password Editing device information Device listAdding and registering a device To edit a device Go to System Devices Alert EmailServer Creating a new device alert Device Active modeLocal Attack Type Attack Type Entry and listing Level of wait intervalVirus Type AlertsTo add a device alert Go to System Alert Email Device Window Network SharingDefining IP aliases To set host alias names Go to Reports IP Aliases IP aliasesCreating and generating a report To create a report Go to Reports ConfigReports Select New and enter a name for the reportSet the following Configuring report parametersTo define report parameters Go to Reports Config Select Run nowResolve Service Names Ranked Reports show top Configuring a report queryTo set the report queries Go to Reports Config Select a report from the list Select QueriesSelecting the devices for the report To select the devices Go to Reports ConfigCreating a query profile To create a query profileSelect filtering options To set the filtering on a log report Go to Reports ConfigCreating a device profile To create a device profileCreating a filter profile Setting a report scheduleTo create a scheduled report Go to Reports Config To create a report filter profileSelect Schedule Select a day from the following Creating a report schedule profileChoosing the report destination and format To create a report schedule profileReports on demand To generate a report on demand Go to Reports ConfigCreating a report destination and format profile To create a pre-defined output selectionViewing reports To view a generated report Go to File Browse ReportsRoll up report Individual reportsCreating and generating a report To create a report Go to Reports Config VulnerabilityVulnerability reports Selecting plug-ins Per device Resolve Host Names Resolve Service NamesSelecting report result parameters Selecting the scan targets for the report To select the plug-ins Go to Reports Config VulnerabilitiesCreating a plug-in profile To create a plug-in profileTo create a scan target profile Creating a scan target profileTo add additional devices Email list FileBrowse/Reports hard disk As an email attachmentViewing the vulnerability report Select the report name from the list of completed reportsUsing Logs Log view interface Viewing logsSelect the column header to change the sort order between Finding log informationTo view the device log files Go to File Browse Logs Ascending and descending orderBasic log filter To import a log file Go to File Browse Logs Importing log filesAlert level Match Up and Down arrowsTo set log watching Go to File Browse Logs Log watch Active modeLog Search Show Up and Down arrowsEvent correlation Active mode Sort listEvent correlation Active mode Using the FortiLog unit as a NAS Connecting to the FortiLog file systemSelecting a file sharing protocol Providing access to the FortiLog hard diskSelect Enable for a file sharing protocol Adding and modifying user accountsTo add a user group Go to Network Sharing Groups Assigning access to foldersAdding and modifying group accounts Select Create NewWindows sharing configuration Modifying the user or group folder access NFS share configurationOwner Setting folder and file propertiesTo set file and folder permissions Go to File Browse Files FortiLog CLI reference CLI documentation conventionsFortiLog-800 login Connecting to the CLIConnecting to the FortiLog-800 console To connect to the FortiLog-800 consoleWelcome Setting administrative access for SSH or TelnetTo use the CLI to configure SSH or Telnet access To connect to the CLI using SSH Connecting to the FortiLog CLI using SSHConnecting to the FortiLog CLI using Telnet To connect to the CLI using TelnetExecute branch CLI commandsFortiLog CLI commands include Get branch Use get to display settings, logs, or system informationGet command architecture Get report resolve Get log logsettingGet system admin Get report aliasesSet alertemail command architecture Use set to configure settings, logs, or system informationUse set alertemail to configure alert mails Set branchBelow String is the passwordNamestr is the user name Set alertmail local time 0.5 1.0 3.0 6.0Settings originate from a singe source IP CLI commandsSet alertmail device enable add leveltime Use set console to set console configuration Set consoleSet log Use set log to configure log settingsSet log command architecture YY-MM-DD 100 101 102 Set NAS 103Set system Set report command architectureSet report 104105 106 107 Trusthoststr is trusted host IP address 1080.0 Netmaskstr is the netmask109 Unset branch 111 112 Web Activity Appendix a Log Report TypesNetwork Activity 113FTP Activity 115 Terminal ActivityMail Activity Mail activity reports record Email traffic and connectionsWeb Filter Activity Intrusion ActivityAntivirus Activity Mail Filter Activity 117Content Activity VPN Activity119 120 Index 121122 Index123 124