Fortinet FortiGate-50 Series Manuals

Manuals and User Guides for Fortinet FortiGate-50 Series. We have 1 Fortinet FortiGate-50 Series manual available for free PDF download: Administration Manual

Fortinet FortiGate-50 Series Administration Manual (764 pages)

Brand: Fortinet | Category: Firewall | Size: 13.81 MB

Table of Contents
3
Introduction

23
Fortinet Products

23
About this Document

24
Registering Your Fortinet Product

26
Customer Service and Technical Support

26
Training

27
Documentation

27
Scope

27
Conventions

28
- IP Addresses
  28
- Notes, Tips and Cautions
  28
- Typographical Conventions
  29
- Command Syntax Conventions
  29
What's New in Fortios Version 4.0 MR1

33
New SIP ALG Configuration Options

34
- Opening and Closing SIP Register and Non-Register Pinholes
  34
- Support for RFC 2543-Compliant Branch Commands
  34
Easy Forticare and Fortiguard Services Registration and Renewal

35
Endpoint Control Enhancements

35
Per-VDOM Replacement Messages

35
Content Archiving Is Now DLP Archive

36
Topology Viewer Is Now a Custom Web-Based Manager Page

36
Usage Page Shows Application, Policy, and DLP Archive Usage

37
Alert Message Console Enhancements

37
WCCP Widget

37
SSL VPN Enhancements

38
Two-Factor Authentication

43
- Force UTF-8 Login
  44
Fortigate Wireless Controller

44
Interface Status Detection for Gateway Load Balancing

44
Enhanced ECMP Route Failover and Load Balancing

44
SCEP Extensions

44
Dynamic Routing for Ipv6 Traffic

47
- Additions to Router Bgp Command
  47
- Router Access-List6
  51
- Router Ospf6
  52
- Router Prefix-List6
  56
- Router Ripng
  58
- Get Router Info6 {Bgp | Ospf | Protocols | Rip
  62
Ipv6 DNS

63
Ipv6 Transparent Mode

63
Ipv6 Administrative Access

63
- Network Interface Changes for Ipv6
  64
- Administrator Settings
  65
UTM Features Support Ipv6 Traffic

66
HTTP Basic Authentication in Firewall Policies

66
VDOM Dashboard

66
Ipsec Protocol Improvements

67
- Support for IKE V2
  67
- Support for DH-2048 (Group 14)
  67
- Support for SHA256
  68
Auto-Configuration of Ipsec Vpns

69
- Ipsec Phase 1 CLI Configuration for IKE Configuration Method
  69
- Ipsec Phase 2 Configuration for IKE Configuration Method
  71
Integral Basic DNS Server

72
- Creating Local DNS Entries
  72
- Enabling DNS on an Interface
  73
Per-VDOM DNS Configuration

74
Password Policy

75
Use LDAP Groups in Firewall and SSL-VPN Authentication

76
Traffic Shaping Enhancements

77
Logging Enhancements

79
- Support for Per-VDOM Fortianalyzer Units or Syslog Devices
  79
- SQL Log Format for Executive Summary Reports
  81
Antivirus Changes

82
Reliable Syslog

83
Web Filtering Combined Block/Exempt List

83
Web Filtering by Content Header

85
Safe Search

86
Data Leak Prevention Supports International Character Sets

86
Snmpv3 Enhancements

87
- Support for Snmpengineid
  87
- Authentication and Privacy
  87
Schedule Groups

88
Web-Based Manager

89
Common Web-Based Manager Tasks

90
Button Bar Features

93
Contacting Customer Support

93
Backing up Your Fortigate Configuration

94
Using Fortigate Online Help

94
- Searching the Online Help
  96
Logging out

97
Web-Based Manager Pages

97
Web-Based Manager Icons

105
System Status

107
Viewing the System Dashboard

107
- VDOM and Global Dashboards
  108
- Viewing the System Dashboard
  108
- System Information
  109
- License Information
  110
- Unit Operation
  113
- System Resources
  114
- Alert Message Console
  115
- Log and Archive Statistics
  117
- CLI Console
  119
- Top Sessions
  120
- Viewing the Current Sessions List
  122
- Top Viruses
  124
- Top Attacks
  124
- Traffic History
  124
Changing System Information

125
- Configuring System Time
  125
- Changing the Fortigate Unit Host Name
  126
Changing the Fortigate Firmware

126
- Upgrading to a New Firmware Version
  127
- Reverting to a Previous Firmware Version
  128
Viewing Operational History

129
Manually Updating Fortiguard Definitions

129
Viewing Log and Archive Statistics

130
- Viewing DLP Archive Information on the Statistics Widget
  130
- Viewing the Attack Log
  132
Configuring AMC Modules

133
- Auto-Bypass and Recovery for AMC Bridge Module
  
  134
- Enabling or Disabling Bypass Mode for AMC Bridge Modules
  135
Viewing Application, Policy, and DLP Archive Usage Data

137
- Top Application Usage
  137
- Top Policy Usage
  139
- DLP Archive Usage
  141
Using the Topology Viewer

142
- Adding a Subnet Object
  145
- Customizing the Topology Diagram
  146
Managing Firmware Versions

147
Backing up Your Configuration

148
Testing Firmware before Upgrading

150
Upgrading Your Fortigate Unit

151
Reverting to a Previous Firmware Image

154
Restoring Your Configuration

157
- Restoring Your Configuration Settings in the Web-Based Manager
  157
- Restoring Your Configuration Settings in the CLI
  157
Using Virtual Domains

159
Virtual Domains

159
- Benefits of Vdoms
  159
- VDOM Configuration Settings
  160
- Global Configuration Settings
  163
Enabling Vdoms

164
Configuring Vdoms and Global Settings

165
- VDOM Licenses
  165
- Creating a New VDOM
  166
- Working with Vdoms and Global Settings
  167
- Adding Interfaces to a VDOM
  168
- Inter-VDOM Links
  169
- Assigning an Interface to a VDOM
  170
- Assigning an Administrator to a VDOM
  171
- Changing the Management VDOM
  172
Configuring VDOM Resource Limits

172
- Setting VDOM Global Resource Limits
  173
- Configuring Resource Usage for Individual Vdoms
  174
System Network

177
Configuring Interfaces

177
- Switch Mode
  180
- Interface Settings
  181
- Creating a VLAN Subinterface
  185
- Creating a Loopback Interface
  185
- Creating an 802.3Ad Aggregate Interface
  186
- Creating a Redundant Interface
  187
- Configuring DHCP on an Interface
  188
- Configuring an Interface for Pppoe
  190
- Configuring Dynamic DNS on an Interface
  191
- Configuring a Virtual Ipsec Interface
  191
- Configuring Administrative Access to an Interface
  192
- Interface Status Detection for Gateway Load Balancing
  193
- Interface MTU Packet Size
  195
- Secondary IP Addresses
  196
- Adding a Software Switch Interface
  197
Configuring Zones

198
Configuring the Modem Interface

199
- Configuring Modem Settings
  199
- Redundant Mode Configuration
  201
- Standalone Mode Configuration
  202
- Adding Firewall Policies for Modem Connections
  203
- Connecting and Disconnecting the Modem
  203
- Checking Modem Status
  204
Configuring Networking Options

204
- DNS Servers
  205
Configuring Fortigate DNS Services

205
- About Split DNS
  206
- Configuring Fortigate DNS Services
  206
- Configuring the Fortigate DNS Database
  208
Configuring the Explicit Web Proxy

210
Configuring WCCP

212
Routing Table (Transparent Mode)

213
- Transparent Mode Route Settings
  214
System Wireless

215
Fortiwifi Wireless Interfaces

215
Channel Assignments

216
- IEEE 802.11A Channel Numbers
  216
- IEEE 802.11B Channel Numbers
  216
- IEEE 802.11G Channel Numbers
  217
Wireless Settings

218
- Adding a Wireless Interface
  219
Wireless MAC Filter

221
- Managing the MAC Filter List
  222
Wireless Monitor

223
Rogue AP Detection

224
- Viewing Wireless Access Points
  224
System DHCP

227
Fortigate DHCP Servers and Relays

227
Configuring DHCP Services

228
- Configuring an Interface as a DHCP Relay Agent
  229
- Configuring a DHCP Server
  229
Viewing Address Leases

231
- Reserving IP Addresses for Specific Clients
  231
Ha

233
System Config

233
- HA Options
  233
- Cluster Members List
  236
- Viewing HA Statistics
  238
- Changing Subordinate Unit Host Name and Device Priority
  239
- Disconnecting a Cluster Unit from a Cluster
  240
Snmp

241
- Configuring SNMP
  242
- Configuring an SNMP Community
  242
- Fortinet Mibs
  244
- Fortinet and Fortigate Traps
  245
- Fortinet and Fortigate MIB Fields
  248
Replacement Messages

250
- VDOM and Global Replacement Messages
  251
- Viewing the Replacement Messages List
  251
- Changing Replacement Messages
  252
- Mail Replacement Messages
  254
- HTTP Replacement Messages
  254
- FTP Replacement Messages
  255
- NNTP Replacement Messages
  256
- Alert Mail Replacement Messages
  256
- Spam Replacement Messages
  257
- Administration Replacement Message
  257
- Authentication Replacement Messages
  258
- Fortiguard Web Filtering Replacement Messages
  259
- IM and P2P Replacement Messages
  260
- Endpoint NAC Replacement Message
  261
- NAC Quarantine Replacement Messages
  261
- Traffic Quota Control Replacement Messages
  262
- SSL VPN Replacement Message
  262
- Replacement Message Tags
  262
Operation Mode and VDOM Management Access

263
- Changing Operation Mode
  263
- Management Access
  264
System Admin

267
Administrators

267
Admin Profiles

280
- Viewing the Admin Profiles List
  283
- Configuring an Admin Profile
  284
Central Management

285
Settings

286
Monitoring Administrators

289
Fortigate Ipv6 Support

289
Customizable Web-Based Manager

290
System Certificates

301
Local Certificates

302
Remote Certificates

306
- Importing Remote (OCSP) Certificates
  307
CA Certificates

307
- Importing CA Certificates
  308
Crl

309
- Importing a Certificate Revocation List
  309
System Maintenance

311
About the Maintenance Menu

311
Backing up and Restoring

312
Managing Configuration Revisions

319
Using Script Files

320
- Creating Script Files
  321
- Uploading Script Files
  321
Configuring Fortiguard Services

322
Troubleshooting FDN Connectivity

328
Updating Antivirus and Attack Definitions

328
Enabling Push Updates

330
- Enabling Push Updates When a Fortigate Unit IP Address Changes
  330
- Enabling Push Updates through a NAT Device
  331
Adding VDOM Licenses

333
Router Static

335
Routing Concepts

335
- How the Routing Table Is Built
  336
- How Routing Decisions Are Made
  336
- Multipath Routing and Determining the Best Route
  336
- Route Priority
  337
- Blackhole Route
  337
Static Route

338
ECMP Route Failover and Load Balancing

344
- Configuring Spill-Over or Usage-Based ECMP
  346
- Configuring Weighted Static Route Load Balancing
  348
Policy Route

351
- Adding a Policy Route
  352
- Moving a Policy Route
  354
Router Dynamic

357
Rip

357
Ospf

362
- Defining an OSPF AS-Overview
  363
- Configuring Basic OSPF Settings
  364
- Selecting Advanced OSPF Options
  366
- Defining OSPF Areas
  367
- Specifying OSPF Networks
  368
- Selecting Operating Parameters for an OSPF Interface
  369
Bgp

370
- Viewing and Editing BGP Settings
  371
Multicast

372
Bi-Directional Forwarding Detection (BFD)

375
- Configuring BFD
  375
Customizable Routing Widgets

377
- Access List
  377
- Distribute List
  378
- Key Chain
  378
- Offset List
  379
- Prefix List
  380
- Route Map
  380
Router Monitor

383
Viewing Routing Information

383
Searching the Fortigate Routing Table

385
Firewall Policy

387
How List Order Affects Policy Matching

387
- Moving a Policy to a Different Position in the Policy List
  388
- Enabling and Disabling Policies
  389
Multicast Policies

389
Viewing the Firewall Policy List

390
Configuring Firewall Policies

391
Using Dos Policies to Detect and Prevent Attacks

404
- Viewing the Dos Policy List
  404
- Configuring Dos Policies
  406
Using One-Arm Sniffer Policies to Detect Network Attacks

406
- Viewing the Sniffer Policy List
  407
- Configuring Sniffer Policies
  409
How Fortios Selects Unused NAT Ports

410
- Global Pool
  411
- Global Per-Protocol Pool
  411
- Per NAT IP Pool
  411
- Per NAT IP, Destination IP, Port, and Protocol Pool
  412
Firewall Policy Examples

414
- Scenario One: SOHO-Sized Business
  414
- Scenario Two: Enterprise-Sized Business
  417
Firewall Address

421
About Firewall Addresses

421
Viewing the Firewall Address List

422
Configuring Addresses

423
Configuring Address Groups

424
Viewing the Address Group List

424
Firewall Service

427
Viewing the Predefined Service List

427
Viewing the Custom Service List

432
Configuring Custom Services

433
Viewing the Service Group List

435
Configuring Service Groups

435
Firewall Schedule

437
Viewing the Recurring Schedule List

437
Configuring Recurring Schedules

438
Viewing the One-Time Schedule List

438
Configuring One-Time Schedules

439
Configuring Schedule Groups

439
Traffic Shaping

441
Guaranteed Bandwidth and Maximum Bandwidth

441
Traffic Priority

442
Traffic Shaping Considerations

442
Configuring Shared Traffic Shapers

443
Configuring Per IP Traffic Shaping

444
Accounting and Quota Enforcement

445
Firewall Virtual IP

447
How Virtual Ips Map Connections through Fortigate Units

447
- Inbound Connections
  447
- Outbound Connections
  450
- VIP Requirements
  451
Viewing the Virtual IP List

451
Configuring Virtual Ips

452
Virtual IP Groups

462
Viewing the VIP Group List

462
Configuring VIP Groups

462
IP Pools

463
Viewing the IP Pool List

465
Configuring IP Pools

465
Double NAT: Combining IP Pool with Virtual IP

466
Adding NAT Firewall Policies in Transparent Mode

468
Firewall Load Balance

471
How Load Balancer Works

471
Configuring Virtual Servers

472
Configuring Real Servers

475
Configuring Health Check Monitors

476
Monitoring the Servers

478
Firewall Protection Profile

479
What Is a Protection Profile

479
Adding a Protection Profile to a Firewall Policy

480
Default Protection Profiles

480
Viewing the Protection Profile List

481
SSL Content Scanning and Inspection

481
Configuring a Protection Profile

486
- Protocol Recognition Options
  487
- Anti-Virus Options
  489
- IPS Options
  492
- Web Filtering Options
  493
- Fortiguard Web Filtering Options
  495
- Email Filtering Options
  498
- Data Leak Prevention Sensor Options
  501
- Application Control Options
  502
- Logging Options
  503
SIP Support

505
Voip and SIP

505
The Fortigate Unit and Voip Security

507
- Sip Nat
  507
How SIP Support Works

509
Configuring SIP

510
Antivirus

517
Order of Operations

517
Antivirus Tasks

518
- Fortiguard Antivirus
  519
Antivirus Settings and Controls

519
File Filter

521
File Quarantine

524
- Viewing the Autosubmit List
  525
- Configuring the Autosubmit List
  525
- Configuring Quarantine Options
  525
Selecting the Virus Database

527
Antivirus CLI Configuration

528
Intrusion Protection

531
About Intrusion Protection

531
- Intrusion Protection Settings and Controls
  532
- When to Use Intrusion Protection
  532
Signatures

532
- Viewing the Predefined Signature List
  533
- Using Display Filters
  534
Custom Signatures

535
- Viewing the Custom Signature List
  535
- Creating Custom Signatures
  535
Protocol Decoders

536
- Viewing the Protocol Decoder List
  536
- Upgrading the IPS Protocol Decoder List
  537
IPS Sensors

537
- Viewing the IPS Sensor List
  537
- Adding an IPS Sensor
  538
- Configuring IPS Sensors
  538
- Configuring Filters
  540
- Configuring Pre-Defined and Custom Overrides
  541
- Packet Logging
  543
Dos Sensors

545
- Viewing the Dos Sensor List
  546
- Configuring Dos Sensors
  546
- Understanding the Anomalies
  547
Intrusion Protection CLI Configuration

548
Web Filter

549
Order of Web Filtering

549
How Web Filtering Works

550
Web Filter Controls

550
Web Content Filter

552
URL Filter

555
- Viewing the URL Filter List Catalog
  556
- Creating a New URL Filter List
  556
- Viewing the URL Filter List
  556
- Configuring the URL Filter List
  557
- URL Formats
  558
- Moving Urls in the URL Filter List
  559
Fortiguard - Web Filter

559
- Configuring Fortiguard Web Filtering
  560
- Viewing the Override List
  560
- Configuring Administrative Override Rules
  561
- Creating Local Categories
  563
- Viewing the Local Ratings List
  563
- Configuring Local Ratings
  564
Category Block CLI Configuration

565
Fortiguard Web Filtering Reports

565
Email Filtering

567
Fortiguard Email Filtering (also Called the Fortiguard Antispam Service)

567
- Order of Email Filtering
  567
- Email Filter Controls
  568
Banned Word

570
IP Address and Email Address Black/White Lists

573
Advanced Email Filter Configuration

577
- Config Spamfilter Mheader
  577
- Config Spamfilter Dnsbl
  578
Using Wildcards and Perl Regular Expressions

578
- Perl Regular Expression Formats
  579
- Example Regular Expressions
  580
Data Leak Prevention

583
DLP Sensors

583
DLP Archiving

588
- Configuring DLP Archiving
  589
- Configuring Spam Email Message Archiving
  593
- Viewing DLP Archives
  594
DLP Rules

594
- Viewing the DLP Rule List
  594
- Adding or Configuring DLP Rules
  596
DLP Compound Rules

599
- Viewing the DLP Compound Rule List
  599
- Adding and Configuring DLP Compound Rules
  600
Application Control

603
What Is Application Control

603
Fortiguard Application Control Database

603
Viewing the Application Control Black/White Lists

604
Creating a New Application Control Black/White List

605
Configuring an Application Control Black/White List

605
Adding or Configuring an Application Control Black/White List Entry

606
Application Control Statistics

608
Ipsec VPN

611
Overview of Ipsec VPN Configuration

611
Policy-Based Versus Route-Based Vpns

612
Auto Key

613
Manual Key

622
- Creating a New Manual Key Configuration
  622
Internet Browsing Configuration

624
Concentrator

625
- Defining Concentrator Options
  625
Monitoring Vpns

626
Pptp Vpn

629
PPTP Configuration Using Fortigate Web-Based Manager

629
PPTP Configuration Using CLI Commands

631
Ssl Vpn

633
Ssl.root

634
Configuring SSL VPN

634
SSL VPN Web Portal

635
- Default Web Portal Configurations
  636
- Configuring Web Portal Settings
  638
- Configuring the Virtual Desktop
  638
- Configuring Security Control
  639
- Configuring Web Portal Layout
  640
- Session Information Widget
  641
- Bookmarks Widget
  641
- Connection Tool Widget
  644
- Tunnel Mode Widget
  645
Virtual Desktop Application Control

647
Host Check List

648
SSL VPN Monitor List

649
User

651
Getting Started - User Authentication

651
Local User Accounts

652
- Configuring Local User Accounts
  652
Remote

655
Radius

655
- Configuring a RADIUS Server
  656
Ldap

657
- Configuring an LDAP Server
  658
Tacacs

661
- Configuring TACACS+ Servers
  661
Directory Service

662
- Configuring a Directory Service Server
  663
Pki

664
- Configuring Peer Users and Peer Groups
  665
User Group

666
Options

675
Monitor

676
- Firewall User Monitor List
  676
- IM User Monitor List
  677
NAC Quarantine and the Banned User List

678
- NAC Quarantine and DLP
  678
- NAC Quarantine and DLP Replacement Messages
  679
- Configuring NAC Quarantine
  679
- The Banned User List
  680
WAN Optimization and Web Caching

683
Configuring WAN Optimization

683
- Moving a Rule to a Different Position in the Rule List
  685
Configuring a WAN Optimization Rule

685
- About WAN Optimization Addresses
  687
Configuring WAN Optimization Peers

688
Configuring Authentication Groups

689
WAN Optimization Monitoring

690
Changing Web Cache Settings

692
Endpoint NAC

695
Configuring Endpoint NAC Overview

695
Configuring Forticlient Installer Download and Version Enforcement

696
Configuring Application Detection Lists

697
- Viewing the Application List
  699
Configuring Endpoint NAC Profiles

699
Monitoring Endpoints

700
Wireless Controller

703
Configuration Overview

703
Enabling the Wireless Controller

703
Configuring Fortiwifi Units as Managed Access Points

704
Configuring a Virtual Wireless Access Point

704
Configuring a Physical Access Point

705
Configuring DHCP for Your Wireless LAN

707
Configuring Firewall Policies for the Wireless LAN

707
Monitoring Wireless Clients

707
Monitoring Rogue Aps

707
Log&Report

709
Configuring How a Fortigate Unit Stores Logs

710
Configuring Alert Email

715
Configuring Event Logging

717
- Data Leak Prevention Log
  718
- Application Control Log
  718
- Antivirus Log
  719
- Web Filter Log
  719
- Spam Filter Log
  719
- Attack Log (IPS)
  720
Accessing and Viewing Log Messages

720
Viewing DLP Archives

725
Viewing the File Quarantine List

726
Configuring Fortianalyzer Report Schedules

727
Viewing Executive Summary Reports from SQL Logs

730
Viewing Fortianalyzer Reports

730
- Printing Your Fortianalyzer Report
  731
Viewing Basic Traffic Reports

731
Log Severity Levels

733
Log Types

734
- Traffic Log
  734
Example Configuration: Logging All Fortigate Traffic

735
Index

737

Fortinet Categories

Firewall Network Hardware Wireless Access Point

Telephone

Switch

More Fortinet Manuals

Fortinet FortiGate-50 Series Manuals

Fortinet FortiGate-50 Series Administration Manual (764 pages)

Table of Contents

Introduction

Fortinet Products

About this Document

Registering Your Fortinet Product

Customer Service and Technical Support

Training

Documentation

Scope

Conventions

What's New in Fortios Version 4.0 MR1

New SIP ALG Configuration Options

Easy Forticare and Fortiguard Services Registration and Renewal

Endpoint Control Enhancements

Per-VDOM Replacement Messages

Content Archiving Is Now DLP Archive

Topology Viewer Is Now a Custom Web-Based Manager Page

Usage Page Shows Application, Policy, and DLP Archive Usage

Alert Message Console Enhancements

WCCP Widget

SSL VPN Enhancements

Two-Factor Authentication

Fortigate Wireless Controller

Interface Status Detection for Gateway Load Balancing

Enhanced ECMP Route Failover and Load Balancing

SCEP Extensions

Dynamic Routing for Ipv6 Traffic

Ipv6 DNS

Ipv6 Transparent Mode

Ipv6 Administrative Access

UTM Features Support Ipv6 Traffic

HTTP Basic Authentication in Firewall Policies

VDOM Dashboard

Ipsec Protocol Improvements

Auto-Configuration of Ipsec Vpns

Integral Basic DNS Server

Per-VDOM DNS Configuration

Password Policy

Use LDAP Groups in Firewall and SSL-VPN Authentication

Traffic Shaping Enhancements

Logging Enhancements

Antivirus Changes

Reliable Syslog

Web Filtering Combined Block/Exempt List

Web Filtering by Content Header

Safe Search

Data Leak Prevention Supports International Character Sets

Snmpv3 Enhancements

Schedule Groups

Web-Based Manager

Common Web-Based Manager Tasks

Button Bar Features

Contacting Customer Support

Backing up Your Fortigate Configuration

Using Fortigate Online Help

Logging out

Web-Based Manager Pages

Web-Based Manager Icons

System Status

Viewing the System Dashboard

Changing System Information

Changing the Fortigate Firmware

Viewing Operational History

Manually Updating Fortiguard Definitions

Viewing Log and Archive Statistics

Configuring AMC Modules

Auto-Bypass and Recovery for AMC Bridge Module

Viewing Application, Policy, and DLP Archive Usage Data

Using the Topology Viewer

Managing Firmware Versions

Backing up Your Configuration

Testing Firmware before Upgrading

Upgrading Your Fortigate Unit

Reverting to a Previous Firmware Image

Restoring Your Configuration

Using Virtual Domains

Virtual Domains

Enabling Vdoms