Fortinet FortiGate FortiGate-3000 Administration Manual
  1. Manuals
  2. Brands
  3. Fortinet Manuals
  4. Firewall
  5. FortiGate 3000
  6. Administration manual

Fortinet FortiGate FortiGate-3000 Administration Manual

Fortinet fortigate fortigate-3000: user guide
Hide thumbs Also See for FortiGate FortiGate-3000:
1
2
Table Of Contents
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
Table of Contents

Advertisement

Quick Links

See also: Installation Manual
FortiGate 3000
Administration Guide
ESC
ENTER
CONSOLE
FortiGate-3000 Administration Guide
Version 2.80 MR6
5 November 2004
01-28006-0010-20041105
1
2
3
POWER
Hi-Temp
4/HA
INT
EXT
1
2
3
4/HA
INTERNAL
EXTERNAL

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the FortiGate FortiGate-3000 and is the answer not in the manual?

Questions and answers

Related Manuals for Fortinet FortiGate FortiGate-3000

Summary of Contents for Fortinet FortiGate FortiGate-3000

  • Page 1 FortiGate 3000 FortiGate-3000 Administration Guide Administration Guide POWER ENTER Hi-Temp CONSOLE 4/HA Version 2.80 MR6 5 November 2004 01-28006-0010-20041105 4/HA INTERNAL EXTERNAL...
  • Page 2 CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS. For technical support, please visit http://www.fortinet.com. Send information about errors or omissions in this document or any Fortinet technical documentation to techdoc@fortinet.com.

  • Page 3: Table Of Contents

    Table of Contents System status... 17 Console access... 17 Status... 17 Viewing system status ... 18 Changing unit information ... 20 To change FortiGate host name ... 20 To update the firmware version... 20 To update the antivirus definitions manually ... 20 To update the attack definitions manually...
  • Page 4 FortiGate IPv6 support... 58 System DHCP ... 59 Service ... 59 DHCP service settings ... 59 To configure an interface as a regular DHCP relay agent ... 60 To configure an interface to be a DHCP server ... 60 01-28006-0010-20041105 Fortinet Inc.
  • Page 5 Server ... 60 DHCP server settings ... 61 To configure a DHCP server for an interface ... 61 To configure multiple DHCP servers for an interface... 62 Exclude range ... 62 DHCP exclude range settings... 62 To add an exclusion range... 63 IP/MAC binding ...
  • Page 6 Contents To add an SNMP community ... 83 FortiGate MIBs... 83 FortiGate traps ... 84 Fortinet MIB fields ... 86 Replacement messages ... 88 Replacement messages list ... 88 To change a replacement message... 89 Changing replacement messages ... 89 FortiManager...
  • Page 7 Support ... 14 Sending a bug report ... 14 To report a bug... 15 To configure a customized mail relay... 15 Registering a FortiGate unit ... 15 To register a FortiGate unit ... 16 Shutdown ... 17 System shutdown... 17 To log out of the system...
  • Page 8 To add a prefix list name... 11 New prefix list entry... 12 To configure a prefix list entry ... 12 Route-map list... 12 New Route-map ... 13 To add a route map name... 13 Route-map list entry... 13 01-28006-0010-20041105 Fortinet Inc.
  • Page 9 Monitor ... 15 Routing monitor list ... 15 To filter the routing monitor display ... 15 CLI configuration... 16 get router info ospf ... 16 get router info protocols ... 16 get router info rip... 17 config router ospf ... 17 config router static6...
  • Page 10 To edit a virtual IP ... 62 IP pool... 63 IP pool list ... 63 IP pool options ... 63 Configuring IP pools... 63 To add an IP pool... 63 To delete an IP pool ... 64 01-28006-0010-20041105 Fortinet Inc.
  • Page 11 To edit a IP pool ... 64 IP Pools for firewall policies that use fixed ports... 64 IP pools and dynamic NAT ... 64 Protection profile ... 65 Protection profile list... 65 Default protection profiles ... 65 Protection profile options ... 66 Configuring protection profiles ...
  • Page 12 To configure an L2TP dialup connection... 29 To disable IPSec ... 30 To connect to the L2TP VPN ... 30 Configuring a Windows XP client for L2TP ... 30 To configure an L2TP VPN dialup connection ... 30 01-28006-0010-20041105 Fortinet Inc.
  • Page 13 To configure the VPN connection ... 31 To disable IPSec ... 31 To connect to the L2TP VPN ... 32 Certificates ... 32 Viewing the certificate list... 33 Generating a certificate request... 33 Installing a signed certificate ... 34 Enabling VPN access for specific certificate holders ... 35 CLI configuration...
  • Page 14 Configuring the web content block list ... 83 To add or edit a banned word ... 83 URL block ... 84 Web URL block list... 84 Web URL block options ... 85 Configuring the web URL block list ... 85 01-28006-0010-20041105 Fortinet Inc.
  • Page 15 To add a URL to the web URL block list ... 85 Web pattern block list... 85 Web pattern block options ... 86 Configuring web pattern block ... 86 To add a pattern to the web pattern block list ... 86 URL exempt ...
  • Page 16 To change the columns in the log message display ... 116 Searching log messages... 117 To perform a simple keyword search ... 117 To perform an advanced search ... 117 CLI configuration... 117 fortilog setting... 117 syslogd setting ... 119 01-28006-0010-20041105 Fortinet Inc.
  • Page 17 Contents FortiGuard categories ... 121 FortiGate maximum values ... 127 Glossary ... 131 Index... 135 FortiGate-3000 Administration Guide 01-28006-0010-20041105...
  • Page 18 Contents 01-28006-0010-20041105 Fortinet Inc.

  • Page 19: About Fortigate Antivirus Firewalls

    • • The FortiGate Antivirus Firewall uses Fortinet’s Accelerated Behavior and Content Analysis System (ABACAS™) technology, which leverages breakthroughs in chip design, networking, security, and content analysis. The unique ASIC-based architecture analyzes content and behavior in real-time, enabling key applications to be deployed right at the network edge, where they are most effective at protecting your networks.

  • Page 20: Antivirus Protection

    PKZip format, detect viruses in email that has been encoded using uuencode format, detect viruses in email that has been encoded using MIME encoding, log all actions taken while scanning. 01-28006-0010-20041105 Introduction POWER Enter Hi-Temp 4/HA 4/HA INTERNAL EXTERNAL Fortinet Inc.

  • Page 21: Web Content Filtering

    Introduction Web content filtering FortiGate web content filtering can scan all HTTP content protocol streams for URLs, URL patterns, and web page content. If there is a match between a URL on the URL block list, or a web page contains a word or phrase that is in the content block list, the FortiGate unit blocks the web page.
  • Page 22 In NAT/Route mode, the FortiGate unit is a Layer 3 device. This means that each of its interfaces is associated with a different IP subnet and that it appears to other devices as a router. This is how a firewall is normally deployed. In NAT/Route mode, you can create NAT mode policies and Route mode policies.

  • Page 23: Vlans And Virtual Domains

    Introduction VLANs and virtual domains Fortigate Antivirus Firewalls support IEEE 802.1Q-compliant virtual LAN (VLAN) tags. Using VLAN technology, a single FortiGate unit can provide security services to, and control connections between, multiple security domains according to the VLAN IDs added to VLAN packets. The FortiGate unit can recognize VLAN IDs and apply security policies to secure network and IPSec VPN traffic between each security domain.

  • Page 24: High Availability

    • High availability Fortinet achieves high availability (HA) using redundant hardware and the FortiGate Clustering Protocol (FGCP). Each FortiGate unit in an HA cluster enforces the same overall security policy and shares the same configuration settings. You can add up to 32 FortiGate units to an HA cluster.

  • Page 25: Command Line Interface

    Introduction Web-based manager Using HTTP or a secure HTTPS connection from any computer running Internet Explorer, you can configure and manage the FortiGate unit. The web-based manager supports multiple languages. You can configure the FortiGate unit for HTTP and HTTPS administration from any FortiGate interface. You can use the web-based manager to configure most FortiGate settings.

  • Page 26: Document Conventions

    Square brackets [ ] to indicate that a keyword or variable is optional. For example: show system interface [<name_str>] To show the settings for all interfaces, you can enter show system interface. To show the settings for the internal interface, you can enter show system interface internal. 01-28006-0010-20041105 Introduction Fortinet Inc.

  • Page 27: Fortigate Documentation

    Introduction • FortiGate documentation Information about FortiGate products is available from the following guides: • • • • • • • FortiGate-3000 Administration Guide A space to separate options that can be entered in any combination and must be separated by spaces. For example: set allowaccess {ping https ssh snmp http telnet} You can enter any of the following:...

  • Page 28: Comments On Fortinet Technical Documentation

    Comments on Fortinet technical documentation Please send information about any errors or omissions in this document, or any Fortinet technical documentation, to techdoc@fortinet.com. Related documentation Additional information about Fortinet products is available from the following related documentation. FortiManager documentation •...

  • Page 29: Fortilog Documentation

    Introduction FortiLog documentation • • FortiGate-3000 Administration Guide FortiLog Administration Guide Describes how to install and configure a FortiLog unit to collect FortiGate and FortiMail log files. It also describes how to view FortiGate and FortiMail log files, generate and view log reports, and use the FortiLog unit as a NAS server. FortiLog online help Provides a searchable version of the Administration Guide in HTML format.

  • Page 30: Customer Service And Technical Support

    Fortinet Technical Support web site at http://support.fortinet.com. You can also register Fortinet products and service contracts from http://support.fortinet.com and change your registration information at any time. Technical support is available through email from any of the following addresses.

  • Page 31: System Status

    System status You can connect to the web-based manager and view the current system status of the FortiGate unit. The status information that is displayed includes the system status, unit information, system resources, and session log. This chapter includes: • •...

  • Page 32: Viewing System Status

    Viewing system status Changing unit information Select to control how often the web-based manager updates the system status display. Select to set the selected automatic refresh interval. Select to manually update the system status display. 01-28006-0010-20041105 119. System status Fortinet Inc.

  • Page 33: Unit Information

    System status System status UP Time System Time Log Disk Notification Unit Information Admin users and administrators whose access profiles contain system configuration read and write privileges can change or update the unit information. For information on access profiles, see Host Name Firmware Version Antivirus Definitions The current installed version of the FortiGate Antivirus Definitions.

  • Page 34: System Resources

    CPU usage for the previous minute. Session history for the previous minute. Network utilization for the previous minute. The virus detection history over the last 20 hours. The intrusion detection history over the last 20 hours. 01-28006-0010-20041105 System status Fortinet Inc.

  • Page 35: Changing Unit Information

    Note: For information about configuring the FortiGate unit for automatic antivirus definitions updates, see Download the latest antivirus definitions update file from Fortinet and copy it to the computer that you use to connect to the web-based manager. FortiGate-3000 Administration Guide The time at which the recent intrusion was detected.

  • Page 36: To Update The Attack Definitions Manually

    Note: For information about configuring the FortiGate unit for automatic attack definitions updates, see Download the latest attack definitions update file from Fortinet and copy it to the computer that you use to connect to the web-based manager. Start the web-based manager and go to System > Status > Status.

  • Page 37: To Change To Nat/Route Mode

    System status Note: If the web-based manager IP address was on a different subnet in NAT/Route mode, you may have to change the IP address of your computer to the same subnet as the management IP address. To change to NAT/Route mode After you change the FortiGate unit from the NAT/Route mode to Transparent mode, most of the configuration resets to Transparent mode factory defaults, except for HA settings (see...

  • Page 38: To View The Session List

    FortiGate administrators whose access profiles contain system configuration read and write privileges and the FortiGate admin user can change the FortiGate firmware. After you download a FortiGate firmware image from Fortinet, you can use the procedures listed in Total number of sessions currently being conducted through the FortiGate unit.

  • Page 39: Upgrading To A New Firmware Version

    System status Table 1: Firmware upgrade procedures Procedure Upgrading to a new firmware version Reverting to a previous firmware version Installing firmware images from a system reboot using the CLI Testing a new firmware image before installing it Installing and using a backup firmware image Upgrading to a new firmware version...

  • Page 40: To Upgrade The Firmware Using The Cli

    Where <name_str> is the name of the firmware image file and <tftp_ip> is the IP address of the TFTP server. For example, if the firmware image file name is FGT_300-v280-build183-FORTINET.out and the IP address of the TFTP server is 192.168.1.168, enter: execute restore image FGT_300-v280-build183-FORTINET.out...

  • Page 41: Reverting To A Previous Firmware Version

    System status The FortiGate unit uploads the firmware image file, upgrades to the new firmware version, and restarts. This process takes a few minutes. Reconnect to the CLI. To confirm that the new firmware image is successfully installed, enter: get system status Use the procedure antivirus and attack definitions, or from the CLI, enter: execute update_now...

  • Page 42: To Revert To A Previous Firmware Version Using The Cli

    “Backing up and Restoring” on page “To update antivirus and attack definitions” on page 129 to update the antivirus and attack definitions. 01-28006-0010-20041105 System status “Backup and restore” on “To update antivirus and 124. to make sure that antivirus execute Fortinet Inc.

  • Page 43: Installing Firmware Images From A System Reboot Using The Cli

    Where <name_str> is the name of the firmware image file and <tftp_ip> is the IP address of the TFTP server. For example, if the firmware image file name is FGT_300-v280-build158-FORTINET.out and the IP address of the TFTP server is 192.168.1.168, enter: execute restore image FGT_300-v280-build158-FORTINET.out...

  • Page 44: To Install Firmware From A System Reboot

    Back up web content and email filtering lists. For information, see “Web filter” on page 329 “To update antivirus and attack definitions” on page 129 01-28006-0010-20041105 System status 124. “Spam filter” on page 343. to make sure that antivirus Fortinet Inc.
  • Page 45 System status Type y. As the FortiGate units starts, a series of system startup messages is displayed. When one of the following messages appears: • • Immediately press any key to interrupt the system startup. Note: You have only 3 seconds to press any key. If you do not press a key soon enough, the FortiGate unit reboots and you must log in and repeat the If you successfully interrupt the startup process, one of the following messages appears:...

  • Page 46: Testing A New Firmware Image Before Installing It

    “Updating antivirus and attack definitions” on page “Upgrading to a new firmware version” on page 01-28006-0010-20041105 “Backup and restore” on page “Backing up and restoring custom signature “Backup and restore” on page “Backup and restore” on page 123. 128. System status 123. 123. Fortinet Inc.

  • Page 47: To Test A New Firmware Image

    System status For this procedure you: • • To test a new firmware image Connect to the CLI using a null-modem cable and FortiGate console port. Make sure the TFTP server is running. Copy the new firmware image file to the root directory of the TFTP server. Make sure that port1 is connected to the same network as the TFTP server.

  • Page 48: Installing And Using A Backup Firmware Image

    FortiGate unit running v3.x BIOS Save as Default firmware/Run image without saving:[D/R] Save as Default firmware/Backup firmware/Run image without saving:[D/B/R] Installing a backup firmware image Switching to the backup firmware image Switching back to the default firmware image 01-28006-0010-20041105 System status Fortinet Inc.

  • Page 49: To Install A Backup Firmware Image

    System status Installing a backup firmware image To run this procedure you: • • To install a backup firmware image Connect to the CLI using the null-modem cable and FortiGate console port. Make sure that the TFTP server is running. Copy the new firmware image file to the root directory of your TFTP server.

  • Page 50: To Switch To The Backup Firmware Image

    Note: You have only 3 seconds to press any key. If you do not press a key soon enough, the FortiGate unit reboots and you must log in and repeat the 01-28006-0010-20041105 System status to switch to a backup execute reboot command. Fortinet Inc.

  • Page 51: To Switch Back To The Default Firmware Image

    System status If you successfully interrupt the startup process, the following message appears: [G]: [F]: [B]: [Q]: [H]: Enter G,F,B,Q,or H: Type B to load the backup firmware image. The FortiGate unit loads the backup firmware image and restarts. When the FortiGate unit restarts, it is running the backup firmware version and the configuration is set to factory default.
  • Page 52 Changing the FortiGate firmware System status 01-28006-0010-20041105 Fortinet Inc.

  • Page 53: System Network

    System network System network settings control how the FortiGate unit connects to and interacts with your network. Basic network settings start with configuring FortiGate interfaces to connect to your network and configuring the FortiGate DNS settings. More advanced network settings include adding VLAN subinterfaces and zones to the FortiGate network configuration.

  • Page 54: Interface Settings

    Bring Down or Bring Up. For more information, “To bring down an interface that is administratively up” on page 60 “To start up an interface that is administratively down” on page Delete, edit, and view icons. 01-28006-0010-20041105 System network “VLAN Fortinet Inc.

  • Page 55: Configuring Interfaces

    System network Figure 6: Interface settings See the following procedures for configuring interfaces: • • • • • • • • • • • • Name The name of the Interface. Interface Select the name of the physical interface to add the VLAN subinterface to. All VLAN subinterfaces must be associated with a physical interface.
  • Page 56 Interface The VLAN ID can be any number between 1 and 4096 and must match the VLAN ID added by the IEEE 802.1Q-compliant router or switch connected to the VLAN subinterface. For more information on VLANs, see Virtual Domain Select a virtual domain to add the interface or VLAN subinterface to this virtual domain.
  • Page 57 System network PPPoE If you configure the interface to use PPPoE, the FortiGate unit automatically broadcasts a PPPoE request. You can disable connect to server if you are configuring the FortiGate unit offline and you do not want the FortiGate unit to send the PPPoE request.
  • Page 58 Ping server Add a ping server to an interface if you want the FortiGate unit to confirm connectivity with the next hop router on the network connected to the interface. Adding a ping server is required for routing failover. See The FortiGate unit uses dead gateway detection to ping the Ping Server IP address to make sure that the FortiGate unit can connect to this IP address.

  • Page 59: To Configure An Interface For Dhcp

    System network SNMP TELNET To improve network performance, you can change the maximum transmission unit (MTU) of the packets that the FortiGate unit transmits from any interface. Ideally, this MTU should be the same as the smallest MTU of all the networks between the FortiGate unit and the destination of the packets.
  • Page 60 64. You cannot add an interface to a zone if you have added firewall policies for “To add a virtual domain” on page 01-28006-0010-20041105 “To add a zone” on 143. You cannot add an interface to a virtual System network Fortinet Inc.
  • Page 61 System network Set Addressing Mode to Manual. Change the IP address and Netmask as required. Select OK to save your changes. If you changed the IP address of the interface to which you are connecting to manage the FortiGate unit, you must reconnect to the web-based manager using the new interface IP address.
  • Page 62 To add a ping server to an interface Go to System > Network > Interface. Choose an interface and select Edit. Set Ping Server to the IP address of the next hop router on the network connected to the interface. Select the Enable check box.

  • Page 63: Zone

    System network Controlling administrative access for an interface connected to the Internet allows remote administration of the FortiGate unit from any location on the Internet. However, allowing remote administration from the Internet could compromise the security of your FortiGate unit. You should avoid allowing administrative access for an interface connected to the Internet unless this is required for your configuration.

  • Page 64: Zone Settings

    Edit/View icons. Select to edit or view a zone. Delete icon. Select to remove a zone. Enter the name to identify the zone. Select Block intra-zone traffic to block traffic between interfaces or VLAN subinterfaces in the same zone. 01-28006-0010-20041105 System network Fortinet Inc.

  • Page 65: To Delete A Zone

    System network Select the Block intra-zone traffic check box if you want to block traffic between interfaces or VLAN subinterfaces in the same zone. Select the names of the interfaces or VLAN subinterfaces to add to the zone. Select OK. To delete a zone You can only delete zones that have the Delete icon beside them in the zone list.

  • Page 66: To Configure The Management Interface

    FortiGate unit from. Enter the default gateway address. Select the virtual domain from which you want to perform system management. 01-28006-0010-20041105 89). This must be a valid IP System network “To Fortinet Inc.

  • Page 67: To Add Dns Server Ip Addresses

    The destination IP address for this route. The netmask for this route. The IP address of the next hop router to which this route directs traffic. The the relative preferability of this route. 1 is most preferred. Delete icon. Select to remove a route.

  • Page 68: Transparent Mode Route Settings

    Enter the destination IP address and netmask for this route. Enter the IP address of the next hop router to which this route directs traffic The the relative preferability of this route. 1 is most preferred.

  • Page 69: Fortigate Units And Vlans

    VLAN tags to packets. Packets passing between devices in the same VLAN can be handled by layer 2 switches. Packets passing between devices in different VLANs must be handled by a layer 3 device such as router, firewall, or layer 3 switch.

  • Page 70: Rules For Vlan Ids

    VLANs in NAT/Route mode In NAT/Route mode, the FortiGate units support VLANs for constructing VLAN trunks between an IEEE 802.1Q-compliant switch (or router) and the FortiGate unit. Normally the FortiGate unit internal interface connects to a VLAN trunk on an internal switch, and the external interface connects to an upstream Internet router untagged.

  • Page 71: Adding Vlan Subinterfaces

    The VLAN ID of each VLAN subinterface must match the VLAN ID added by the IEEE 802.1Q-compliant router. The VLAN ID can be any number between 1 and 4096. Each VLAN subinterface must also be configured with its own IP address and netmask.

  • Page 72: To Add Firewall Policies For Vlan Subinterfaces

    FortiGate internal interface accepts VLAN packets on a VLAN trunk from a VLAN switch or router connected to internal VLANs. The FortiGate external interface forwards tagged packets through the trunk to an external VLAN switch or router which could be connected to the Internet. The FortiGate unit can be configured to apply different policies for traffic on each VLAN in the trunk.
  • Page 73 Figure 17 three VLAN subinterfaces. In this configuration the FortiGate unit could be added to this network to provide virus scanning, web content filtering, and other services to each VLAN. FortiGate-3000 Administration Guide VLAN Switch or router VLAN1 Internal VLAN1 VLAN2...

  • Page 74: Rules For Vlan Ids

    Enter VLAN POWER switch Internet “System virtual domain” on page 139 01-28006-0010-20041105 VLAN 3 VLAN ID = 300 VLAN 1 VLAN 2 VLAN 3 External VLAN 1 VLAN VLAN 2 Trunk VLAN 3 Untagged packets Router System network Fortinet Inc.

  • Page 75: Transparent Mode Vlan List

    System network Transparent mode VLAN list In Transparent mode, go to System > Network > Interface to add VLAN subinterfaces. Figure 18: Sample Transparent mode VLAN list Create New Virtual Domain Select a virtual domain to display the VLAN interfaces added to this virtual Name Access Status...

  • Page 76: To Add A Vlan Subinterface In Transparent Mode

    The VLAN ID of each VLAN subinterface must match the VLAN ID added by the IEEE 802.1Q-compliant router or switch. The VLAN ID can be any number between 1 and 4096. You add VLAN subinterfaces to the physical interface that receives VLAN- tagged packets.

  • Page 77: Fortigate Ipv6 Support

    The interface functions as two interfaces, one for IPv4-addressed packets and another for IPv6-addressed packets. FortiGate units support static routing, periodic router advertisements, and tunneling of IPv6-addressed traffic over an IPv4-addressed network. All of these features must be configured through the Command Line Interface (CLI). See the FortiGate CLI...
  • Page 78 FortiGate IPv6 support System network 01-28006-0010-20041105 Fortinet Inc.

  • Page 79: System Dhcp

    System DHCP You can configure DHCP server or DHCP relay agent functionality on any FortiGate interface or VLAN subinterface. A FortiGate interface can act as either a DHCP server or as a DHCP relay agent. An interface cannot provide both functions at the same time. Note: To configure DHCP server or DHCP relay functionality on an interface, the FortiGate unit must be in NAT/Route mode and the interface must have a static IP address.

  • Page 80: Dhcp Service Settings

    Select DHCP Server if you want the FortiGate unit to be the DHCP server. “To configure an interface to be a DHCP server” on page 01-28006-0010-20041105 System DHCP “To configure an interface as a Fortinet Inc.

  • Page 81: To Configure An Interface To Be A Dhcp Server

    System DHCP Set type to Regular. Enter the DHCP Server IP address. Select OK. To configure an interface to be a DHCP server You can configure a DHCP server for any FortiGate interface. As a DHCP server, the interface dynamically assigns IP addresses to hosts on the network connected to the interface.

  • Page 82: Dhcp Server Settings

    For detailed information about DHCP options, see RFC 2132, DHCP Options and BOOTP Vendor Extensions. 81), you must configure a DHCP server for 01-28006-0010-20041105 System DHCP “To configure Fortinet Inc.

  • Page 83: To Configure Multiple Dhcp Servers For An Interface

    DHCP request was received and uses this DHCP server to assign an IP configuration to the computer that made the DHCP request. The DHCP configuration packets are sent back to the router and the router relays them to the DHCP client.

  • Page 84: Dhcp Exclude Range Settings

    The IP address for the IP and MAC address pair. The IP address must be within the configured IP range. Delete icon. Delete an IP/MAC binding pair. Edit/View icon. View or modify an IP/MAC binding pair. 01-28006-0010-20041105 System DHCP Fortinet Inc.

  • Page 85: Dhcp Ip/Mac Binding Settings

    System DHCP DHCP IP/MAC binding settings Figure 27: IP/MAC binding options Name IP Address MAC Address To add a DHCP IP/MAC binding pair Go to System > DHCP > IP/MAC Binding. Select Create New. Add a name for the IP/MAC pair. Add the IP address and MAC address.
  • Page 86 Dynamic IP System DHCP 01-28006-0010-20041105 Fortinet Inc.

  • Page 87: System Config

    System config Use the System Config page to make any of the following changes to the FortiGate system configuration: • • • • • • System time Go to System > Config > Time to set the FortiGate system time. For effective scheduling and logging, the FortiGate system time must be accurate.

  • Page 88: To Manually Set The Fortigate Date And Time

    FortiGate unit to synchronize its time once a day. Timeout settings including the idle timeout and authentication timeout The language displayed by the web-based manager Front control buttons and LCD PIN protection Dead gateway detection interval and failover detection 01-28006-0010-20041105 System config Fortinet Inc.

  • Page 89: To Set The System Idle Timeout

    System config Figure 29: System config options Idle Timeout Auth Timeout Language LCD Panel Detection Interval Fail-over Detection Set the ping server dead gateway detection failover number. Enter the To set the system idle timeout Go to System > Config > Options. For Idle Timeout, type a number in minutes.

  • Page 90: To Select A Language For The Web-Based Manager

    FortiGate unit assumes that the gateway is no longer functioning. Select Apply. Fortinet achieves high availability (HA) using redundant hardware and the FortiGate Clustering Protocol (FGCP). Each FortiGate unit in an HA cluster enforces the same overall security policy and shares the same configuration settings. You can add up to 32 FortiGate units to an HA cluster.

  • Page 91: Ha Configuration

    System config Link failover Device failover If one of the FortiGate units in an HA cluster fails, all functions, all established HA heartbeat failover a.HA does not provide session failover for PPPoE, DHCP, PPTP, and L2TP services. FortiGate units can be configured to operate in active-passive (A-P) or active-active (A-A) HA mode.

  • Page 92: Standalone Mode

    The primary FortiGate unit in the cluster controls load balancing among all of the cluster units. connections. All other FortiGate units in the cluster passively monitor the cluster status and remain synchronized with the primary FortiGate unit. 01-28006-0010-20041105 System config “To view the status of Fortinet Inc.
  • Page 93 System config Group ID The group ID range is from 0 to 63. All members of the HA cluster must have the same group ID. When the FortiGate units in the cluster are switched to HA mode, all of the interfaces of all of the units in the cluster acquire the same virtual MAC address.
  • Page 94 Random load balancing. If the cluster units are connected using switches, select Random to randomly distribute traffic to cluster units. 01-28006-0010-20041105 System config Fortinet Inc.
  • Page 95 System config IP Port Priorities of Heartbeat Device Enable or disable HA heartbeat communication and set the heartbeat priority for each interface in the cluster. By default HA heartbeat communication is set for two interfaces. You can disable HA heartbeat communication for either of these interfaces or enable HA heartbeat for other interfaces.
  • Page 96 If Override Master is enabled for this FortiGate unit (see becomes the primary unit in the cluster again. Note: Only monitor interfaces that are connected to networks. “Override Master” on page 01-28006-0010-20041105 System config 94), this FortiGate unit Fortinet Inc.

  • Page 97: Configuring An Ha Cluster

    System config Note: You can monitor physical interfaces, but not VLAN subinterfaces. Increase the priority of interfaces connected to higher priority networks or networks with more traffic. The monitor priority range is 0 to 512. If a high priority interface on the primary cluster unit fails, one of the other units in the cluster becomes the new primary unit to provide better service to the high priority network.

  • Page 98: To Connect A Fortigate Ha Cluster

    Then you must connect these interfaces to their networks using the same hub or switch. Fortinet recommends using switches for all cluster connections for the best performance. The FortiGate units in the cluster use cluster ethernet interfaces to communicate cluster session information, synchronize the cluster configuration, and report individual cluster member status.
  • Page 99 Connect the 4/HA interfaces of the FortiGate units to another switch or hub. Hub or Switch 01-28006-0010-20041105 Internal External POWER Enter Hi-Temp 4/HA 4/HA INTERNAL EXTERNAL Hub or Switch POWER Enter Hi-Temp 4/HA 4/HA INTERNAL EXTERNAL Internal External Internet Router...

  • Page 100: To Add A New Unit To A Functioning Cluster

    The first connection is processed by the primary unit (priority 0, weight 1) The next three connections are processed by the first subordinate unit (priority 1, weight 3) The next three connections are processed by the second subordinate unit (priority 2, weight 3) 01-28006-0010-20041105 System config Fortinet Inc.

  • Page 101: To View The Status Of Each Cluster Member

    System config You can also use SNMP to manage the cluster by configuring a cluster interface for SNMP administrative access. Using an SNMP manager you can get cluster configuration information and receive traps. For a list of HA MIB fields, see fields”...
  • Page 102 The number of packets that have been processed by the cluster unit since it last started up. The number of viruses detected by the cluster unit. interfaces. The number of bytes that have been processed by the cluster unit since it last started up. 01-28006-0010-20041105 System config Fortinet Inc.
  • Page 103 System config To monitor cluster units for failover If the primary unit in the cluster fails, the units in the cluster renegotiate to select a new primary unit. Failure of the primary unit results in the following: • • • •...

  • Page 104: Snmp

    FortiGate system information and can receive FortiGate traps. To monitor FortiGate system information and receive FortiGate traps you must compile Fortinet proprietary MIBs as well as Fortinet-supported standard MIBs into your SNMP manager. RFC support includes support for most of RFC 2665 (Ethernet-like MIB) and most of...

  • Page 105: Snmp Community

    System config Communities Name Queries Traps Enable Delete icon Edit/View icon SNMP community An SNMP community is a grouping of equipment for network administration purposes. Add SNMP communities so that SNMP managers can connect to the FortiGate unit to view system information and receive SNMP traps. You can add up to three SNMP communities.

  • Page 106: To Configure Snmp Access To An Interface In Nat/Route Mode

    SNMP manager is not on the same subnet as the FortiGate unit. This can occur if the SNMP manager is on the Internet or behind a router. Select Add to add more SNMP managers. You can add up to 8 SNMP managers to a single community.

  • Page 107: To Configure Snmp Access To An Interface In Transparent Mode

    Your SNMP manager might already include standard and private MIBs in a compiled database that is ready to use. You must add the Fortinet proprietary MIBs to this database. If the standard MIBs used by the Fortinet SNMP agent are already compiled into your SNMP manager you do not have to compile them again.

  • Page 108: Fortigate Traps

    SNMP Table 6: FortiGate MIBs MIB file name or RFC Description fortinet.trap.2.80.mib The Fortinet trap MIB is a proprietary MIB that is required for your RFC-1213 (MIB II) RFC-2665 (Ethernet- like MIB) FortiGate traps The FortiGate agent can send traps to SNMP managers that you have added to SNMP communities.
  • Page 109 System config Table 8: FortiGate system traps Trap message CPU usage high (SysCpuHigh) Disk low <FortiGate_serial_no> <interface_name> HA state HA switch Memory low (SysMemLow) The <interface_name> Interface IP is changed to <new_IP> (Serial No.: <FortiGate_serial_no>) (IntfIpChange) Table 9: FortiGate VPN traps Trap message VPN tunnel is up (VpnTunnelUp)

  • Page 110: Fortinet Mib Fields

    The tables below list the names of the MIB fields and describe the status information available for each one. You can view more details about the information available from all Fortinet MIB fields by compiling the fortinet.2.80.mib file into your SNMP manager and browsing the Fortinet MIB fields.
  • Page 111 System config Table 15: HA MIB fields MIB field groupId priority override autoSync schedule stats Table 16: Administrator accounts MIB field index name addr mask perm Table 17: Local users MIB field index name auth state FortiGate-3000 Administration Guide Description HA group ID.

  • Page 112: Replacement Messages

    The source port of the active IP session. The destination IP address of the active IP session. The destination port of the active IP session. The expiry time or time-to-live in seconds for the session. 01-28006-0010-20041105 System config Fortinet Inc.

  • Page 113: Replacement Messages List

    System config Replacement messages list Figure 36: Replacement messages list Name Description To change a replacement message Go to System > Config > Replacement Messages. Select the category of replacement message to edit by clicking on the blue triangle for that category.

  • Page 114: Changing Replacement Messages

    For email this is the IP address of the email server that sent the email containing the virus. For HTTP this is the IP address of web page that sent the virus. 01-28006-0010-20041105 System config Table 20 lists the Fortinet Inc.

  • Page 115: Fortimanager

    The name of the web filtering service. The name of the content category of the web site. The Fortinet logo. and a FortiManager Server. The remote ID of the FortiManager IPSec tunnel. The IP Address of the FortiManager Server.
  • Page 116 FortiManager System config 01-28006-0010-20041105 Fortinet Inc.

  • Page 117: System Administration

    System administration When the FortiGate unit is first installed, it is configured with a single administrator account with the user name admin. From this administrator account, you can add and edit administrator accounts. You can also control the access level of each of these administrator accounts and control the IP address from which the administrator account can connect to the FortiGate unit.

  • Page 118: Administrators List

    Setting trusted hosts for all of your administrators can enhance the security of your system. For more information, see profiles, see “Access profile list” on page 01-28006-0010-20041105 System administration “Using trusted hosts” on page 119. 120. Fortinet Inc.

  • Page 119: To Change An Administrator Password

    System administration Type a login name for the administrator account. Type and confirm a password for the administrator account. Optionally type a Trusted Host IP address and netmask from which the administrator can log into the web-based manager. Select the access profile for the administrator. Select OK.

  • Page 120: Access Profile List

    Allow or deny access to the authorized users feature. Allow or deny access to the administrative users feature. Allow or deny access to the FortiProtect Distribution Network update feature. Allow or deny access to the system shutdown and reboot functionality. 01-28006-0010-20041105 System administration Fortinet Inc.

  • Page 121: To Configure An Access Profile

    System administration To configure an access profile Go to System > Admin > Access Profile. Select Create New to add an access profile, or select the edit icon to edit an existing access profile. Enter a name for the access profile. Select or clear the Access Control check boxes as required.
  • Page 122 Access profiles System administration 01-28006-0010-20041105 Fortinet Inc.

  • Page 123: System Maintenance

    System maintenance Use the web-based manager to maintain the FortiGate unit. Backup and restore You can back up system configuration, VPN certificate, web and spam filtering files to the management computer. You can also restore system configuration, VPN certificate, web and spam filtering files from previously downloaded backup files. Figure 44: Backup and restore list Category Latest Backup...

  • Page 124: Backing Up And Restoring

    IPS User-Defined Upload or download IPS signatures. Signatures All Certificates Restore or back up all VPN certificates in a single password- protected file. See VPN certificates” on page 01-28006-0010-20041105 System maintenance “To restore VPN certificates” “To back up 125. Fortinet Inc.

  • Page 125: To Back Up Individual Categories

    System maintenance Select OK to restore all configuration files to the FortiGate unit. The FortiGate unit restarts, loading the new configuration files. Reconnect to the web-based manager and review your configuration to confirm that the uploaded configuration files have taken effect. To back up individual categories Go to System >...

  • Page 126: Update Center

    • • • To receive scheduled updates and push updates, you must register the FortiGate unit on the Fortinet support web page. “To enable scheduled updates” on page 131. User-initiated updates from the FDN, Hourly, daily, or weekly scheduled antivirus and attack definition and antivirus...
  • Page 127 System maintenance Figure 45: Update center FortiProtect Distribution Network Push Update Refresh Use override server address FortiGate-3000 Administration Guide The status of the connection to the FortiProtect Distribution Network (FDN). Available means that the FortiGate unit can connect to the FDN. You can configure the FortiGate unit for scheduled updates.

  • Page 128: Updating Antivirus And Attack Definitions

    The update attempt occurs at a randomly determined time within the selected hour. Select Update Now to manually initiate an update. Select Apply to save update settings. 01-28006-0010-20041105 System maintenance Fortinet Inc.

  • Page 129: To Update Antivirus And Attack Definitions

    System maintenance To update antivirus and attack definitions Go to System > Maintenance > Update center. Select Update Now to update the antivirus and attack definitions and engines. If the connection to the FDN or override server is successful, the web-based manager displays a message similar to the following: Your update request has been sent.

  • Page 130: To Enable Scheduled Updates Through A Proxy Server

    <proxy-address_ip> set port <proxy-port> set username <username_str> set password <password_str> set status enable config system autoupdate tunneling set address 67.35.50.34 set port 8080 set username proxy_user set password proxy_pwd set status enable 01-28006-0010-20041105 System maintenance Fortinet Inc.

  • Page 131: Enabling Push Updates

    System maintenance There are no special tunneling requirements if you have configured an override server address to connect to the FDN. Enabling push updates The FDN can push updates to FortiGate units to provide the fastest possible response to critical situations. You must register the FortiGate unit before it can receive push updates.

  • Page 132: General Procedure

    In the External Interface section, select the external interface that the FDN connects In the Type section, select Port Forwarding. In the External IP Address section, type the external IP address that the FDN connects to. Type the External Service Port that the FDN connects to. 01-28006-0010-20041105 System maintenance Fortinet Inc.

  • Page 133: To Add A Firewall Policy To The Fortigate Nat Device

    You can select Refresh to make sure that push updates work. Push Update changes to Available. Support You can use the Support page to report problems with the FortiGate unit to Fortinet Support or to register your FortiGate unit with the FortiProtect Distribution Server (FDS).

  • Page 134: Sending A Bug Report

    Test Select Report Bug to submit problems with the FortiGate unit to Fortinet Support. Enter the contact information so that FortiNet support can reply to your bug report. Items marked with an * are required. unit. Send diagnostic information about the FortiGate unit, including its current configuration, to Fortinet for analysis.

  • Page 135: To Report A Bug

    FortiGate units that you or your organization purchased. You can register multiple FortiGate units in a single session without re-entering your contact information. Once registration is completed, Fortinet sends a Support Login user name and password to your email address. You can use this user name and password to log on to the Fortinet support web site to: •...

  • Page 136: To Register A Fortigate Unit

    For maximum network protection, Fortinet strongly recommends that all customers purchase a service contract that covers antivirus and attack definition updates. See your Fortinet reseller or distributor for details of packages and pricing. To activate the FortiCare Support Contract, you must register the FortiGate unit and add the FortiCare Support Contract number to the registration information.

  • Page 137: Shutdown

    A web page is displayed that contains detailed information about the Fortinet technical support services available to you for the registered FortiGate unit. Your Fortinet support user name and password is sent to the email address provided with your contact information.

  • Page 138: To Shut Down The System

    The FortiGate unit restarts with the configuration that it had when it was first powered Reconnect to the web-based manager and review the system configuration to confirm that it has been reset to the default settings. 01-28006-0010-20041105 System maintenance Fortinet Inc.

  • Page 139: System Virtual Domain

    System virtual domain FortiGate virtual domains provide multiple logical firewalls and routers in a single FortiGate unit. Using virtual domains, one FortiGate unit can provide exclusive firewall and routing services to multiple networks so that traffic from each network is effectively separated from every other network.

  • Page 140: Virtual Domain Properties

    System virtual domain 145) “To select a management virtual 144) “To configure routing for a virtual 146) “To configure the routing 146) 146) “To add IP pools to a virtual “To add Virtual IPs to a virtual 148) Fortinet Inc. 147)

  • Page 141: Shared Configuration Settings

    System virtual domain Shared configuration settings The following configuration settings are shared by all virtual domains. Even if you have configured multiple virtual domains, there are no changes to how you configure the following settings. • • • • • •...

  • Page 142: Administration And Management

    A check mark icon in this column indicates that this is the domain used for system management. Delete icon. Select to delete a virtual domain. You cannot delete the root virtual domain or a domain that is used for system management. 01-28006-0010-20041105 System virtual domain Fortinet Inc.

  • Page 143: Adding A Virtual Domain

    Selecting a management virtual domain In NAT/Router mode, you select a virtual domain to be used for system management. In Transparent mode, you must also define a management IP. The interface that you want to use for management access must have Administrative Access enabled. See “To control administrative access to an interface”...

  • Page 144: To Select A Management Virtual Domain

    Go to System > Network > Interface. Adding interfaces, VLAN subinterfaces, and zones to a virtual domain Configuring routing for a virtual domain Configuring firewall policies for a virtual domain Configuring IPSec VPN for a virtual domain 01-28006-0010-20041105 System virtual domain Fortinet Inc.

  • Page 145: To Add Vlan Subinterfaces To A Virtual Domain

    System virtual domain Set Virtual domain to All or to the name of the virtual domain that currently contains the interface. Select Edit for the physical interface you want to move. Choose the Virtual Domain to which to move the interface. Select OK.

  • Page 146: Configuring Routing For A Virtual Domain

    63. Any zones that you add are added to the current virtual “Router” on page 149. Network traffic entering this virtual domain is routed only “Routing table (Transparent Mode)” on page 01-28006-0010-20041105 System virtual domain 67. Network traffic entering this Fortinet Inc.

  • Page 147: To Add Firewall Addresses To A Virtual Domain

    System virtual domain Select Create new to add firewall policies to the current virtual domain. interfaces, VLAN subinterfaces, or zones added to the current virtual domain. The firewall policies that you add are only visible when you are viewing the current virtual domain.

  • Page 148: Configuring Ipsec Vpn For A Virtual Domain

    Select Change following the current virtual domain name above the table. Choose the virtual domain for which to configure VPN. Select OK. Go to VPN. Configure IPSec VPN, PPTP, L2TP, and certificates as required. See page 253. 01-28006-0010-20041105 System virtual domain “VPN” on Fortinet Inc.

  • Page 149: Router

    You configure routes by defining the destination IP address and netmask of packets that the FortiGate unit is intended to intercept, and specifying a (gateway) IP address for those packets. The gateway address specifies the next hop router to which traffic will be routed.
  • Page 150 • • • The Gateway setting specifies the IP address of the next hop router interface to the FortiGate external interface. The interface behind the router (192.168.10.1) is the default gateway for FortiGate_1. In some cases, there may be routers behind the FortiGate unit. If the destination IP address of a packet is not on the local network but is on a network behind one of those routers, the FortiGate routing table must include a static route to that network.

  • Page 151: Static Route List

    Router Figure 51: Destinations on networks behind internal routers To route packets from Network_1 to Network_2, Router_1 must be configured to use the FortiGate internal interface as its default gateway. On the FortiGate unit, you would create a new static route with these settings: Destination IP/mask: 192.168.30.0/24...

  • Page 152: Static Route Options

    The destination IP address for this route. The netmask for this route. The IP address of the first next hop router to which this route directs traffic. The name of the FortiGate interface through which to route traffic. The administrative distance for the route.

  • Page 153: Policy

    Router Figure 54: Move a static route For Move to, select either Before or After and type the number that you want to place this route before or after. Select OK. The route is displayed in the new location on the static route list.

  • Page 154: Policy Route Options

    Match packets that have this destination IP address and netmask. Match packets that have this destination port range. To match a single port, enter the same port number for both From and To. Send packets that match this policy route to this next hop router. 01-28006-0010-20041105 Router...

  • Page 155: General

    Router RIP is a distance-vector routing protocol intended for small, relatively homogeneous, networks. RIP uses hop count as its routing metric. Each network is usually counted as one hop. The network diameter is limited to 15 hops. General Figure 57: RIP General settings...

  • Page 156: To Configure Rip General Settings

    Static Metric Route-map To configure RIP general settings Go to Router > RIP > General. Select the default RIP Version. Change the Default Metric if required. Select Enable Default-information-originate if the configuration requires advertising a default static route into RIP.

  • Page 157: Networks Options

    Figure 59: RIP Networks configuration To configure a RIP network Go to Router > RIP > Networks. Select Create New to add a new RIP network or select the edit icon beside an existing RIP network to edit that RIP network.

  • Page 158: Interface Options

    In text mode the key is sent in clear text over the network. Text mode is usually used only to prevent network problems that can occur if an unwanted or misconfigured router is mistakenly added to the network. 01-28006-0010-20041105 Router...

  • Page 159: To Configure A Rip Interface

    Password Key-chain To configure a RIP interface Go to Router > RIP > Interface. Select the edit icon beside an Interface to configure that interface. Select a Send Version if you want to override the default send version for this interface.

  • Page 160: Distribute List Options

    Interface Enable To configure a distribute list Go to Router > RIP > Distribute List. Select Create New to add a new distribute list or select the edit icon beside an existing distribute list to edit that distribute list. Set Direction to In or Out.

  • Page 161: Offset List

    Interface Enable To configure an offset list Go to Router > RIP > Offset List. Select Create New to add a new offset list or select the edit icon beside an existing offset list to edit that offset list. FortiGate-3000 Administration Guide Add a new offset list.

  • Page 162: Router Objects

    Check or clear the Enable check box to enable or disable this offset list. Select OK. Router objects Router objects are a set of tools used by routing protocols and features. Access list Access lists are filters used by FortiGate routing features.

  • Page 163: To Add An Access List Name

    Router To add an access list name Go to Router > Router Objects > Access List. Select Create New. Enter a name for the access list. Select OK. New access list entry Figure 68: Access list entry configuration list Entry...

  • Page 164: New Prefix List

    Prefix New Prefix list Figure 70: Prefix list name configuration To add a prefix list name Go to Router > Router Objects > Prefix List. Select Create New. Enter a name for the prefix list. Select OK. Add a new prefix list name. An access list and a prefix list cannot have the same name.

  • Page 165: New Prefix List Entry

    Less or equal to To configure a prefix list entry Go to Router > Router Objects > Prefix List. Select the Add prefix-list entry icon to add a new prefix list entry or select the edit icon beside an existing prefix list entry to edit that entry.

  • Page 166: New Route-Map

    Route-map rules New Route-map Figure 73: Route map name configuration To add a route map name Go to Router > Router Objects > Route-map. Select Create New. Enter a name for the route map. Select OK. Add a new route map name.

  • Page 167: To Configure A Route Map Entry

    Match a route if the destination address is included in the selected access list or prefix list. Match a route that has a next hop router address included in the selected access list or prefix list. Match a route with the specified metric. The metric can be a number from 1 to 16.

  • Page 168: Key Chain List

    New key chain Figure 76: Key chain name configuration To add a key chain name Go to Router > Router Objects > Key-chain. Select Create New. for information on setting the FortiGate system date and Add a new key chain.

  • Page 169: Key Chain List Entry

    Start To configure a key chain entry Go to Router > Router Objects > Key-chain. Select the Add key-chain entry icon to add a new key chain entry or select the Edit icon beside an existing key chain entry to edit that entry.

  • Page 170: Monitor

    Up Time To filter the routing monitor display Go to Router > Monitor > Routing Monitor. Select a type of route to display or select all to display routes of all types. For example, select Connected to display all the directly connected routes, or select RIP to display all the routes learned from RIP.

  • Page 171: Cli Configuration

    Show the current state of active routing protocols. Command syntax FortiGate-3000 Administration Guide get router info ospf {border-routers | database | interface | neighbor | route | virtual-links} Show OSPF routing table entries that have an Area Border Router (ABR) or Autonomous System Boundary Router (ASBR) as a destination.

  • Page 172: Get Router Info Rip

    An OSPF autonomous system (AS) or routing domain is a group of areas connected to a backbone area. A router connected to more than one area is an area border router (ABR). Routing information is contained in a link state database. Routing information is communicated between routers using link state advertisements (LSAs).
  • Page 173 Router Note: In the following table, only the router-id keyword is required. All other keywords are optional. ospf command keywords and variables Keywords and variables abr-type {cisco | ibm | shortcut | standard} database-overflow {disable | enable} database-overflow- max-lsas <lsas_integer>...
  • Page 174 <address_ipv4> spf-timers <delay_integer> <hold_integer> Example This example shows how to set the OSPF router ID to 1.1.1.1: This example shows how to display the OSPF settings. Description Specify the default metric that OSPF should use for redistributed routes. The valid range for metric_integer is 1 to 16777214.
  • Page 175 This example shows how to display the OSPF configuration. config area Access the config area subcommand using the config router ospf command. Use this command to set OSPF area related parameters. Routers in an OSPF autonomous system (AS) or routing domain are organized into logical groupings called areas.
  • Page 176 Enable or disable redistributing routes into a NSSA area. 01-28006-0010-20041105 Router Default Availability All models. none All models. All models. disable All models. All models. All models. enable Fortinet Inc.
  • Page 177 This example shows how to display the settings for area 15.1.1.1. FortiGate-3000 Administration Guide Description A NSSA border router can translate the Type 7 LSAs used for external route information within the NSSA to Type 5 LSAs used for distributing external route information to other parts of the OSPF routing domain.
  • Page 178 Set the direction for the filter. Enter in to filter incoming packets. Enter out to filter outgoing packets. Enter the name of the access list or prefix list to use for this filter list. 01-28006-0010-20041105 Router 163. Default Availability All models. All models. default. Fortinet Inc.
  • Page 179 The range id_integer can be 0 to 4294967295. FortiGate-3000 Administration Guide config router ospf config area edit 15.1.1.1 config filter-list config router ospf config area edit 15.1.1.1...
  • Page 180 Enable or disable using a substitute prefix. disable All models. config router ospf config area edit 15.1.1.1 config range config router ospf config area edit 15.1.1.1 01-28006-0010-20041105 Default enable default default. edit 1 set prefix 1.1.0.0 255.255.0.0 Router Availability All models. All models. All models. Fortinet Inc.
  • Page 181 Virtual links can only be set up between two area border routers (ABRs). config virtual link command syntax pattern Note: Only the peer keyword is required. All other keywords are optional. FortiGate-3000 Administration Guide config router ospf config area edit 15.1.1.1 show config virtual-link edit <name_str>...
  • Page 182 15 characters. The time, in seconds, to wait for a hello packet before declaring a router down. The value of the dead- interval should be four times the value of the hello-interval. Both ends of the virtual link must use the same value for dead- interval.
  • Page 183 This example shows how to configure a virtual link. This example shows how to display the settings for area 15.1.1.1. This example shows how to display the configuration for area 15.1.1.1. config distribute-list Access the config distribute-list subcommand using the config router ospf command. FortiGate-3000 Administration Guide Description The time, in seconds, to wait before sending a LSA retransmission.
  • Page 184 Enter the name of the access list to use for this distribute list. Advertise only the routes discovered by the specified protocol and that are permitted by the named access list. 01-28006-0010-20041105 Router Default Availability No default. All models. All models. connected Fortinet Inc.
  • Page 185 This example shows how to display the settings for distribute list 2. This example shows how to display the configuration for distribute list 2. config neighbor Access the config neighbor subcommand using the config router ospf command. Use this command to manually configure an OSPF neighbor on nonbroadcast networks.
  • Page 186 1 set ip 192.168.21.63 config router ospf config neighbor edit 1 config router ospf config neighbor edit 1 show 01-28006-0010-20041105 Router Default Availability All models. 0.0.0.0 All models. All models. All models. Fortinet Inc.

  • Page 187: Config Network

    Router config network Access the config network subcommand using the config router ospf command. Use this command to identify the interfaces to include in the specified OSPF area. The prefix keyword can define one or multiple interfaces. config network command syntax pattern...
  • Page 188 This example shows how to display the settings for network 2. This example shows how to display the configuration for network 2. config ospf-interface Access the config ospf-interface subcommand using the config router ospf command. Use this command to change interface related OSPF settings.
  • Page 189 Enable or disable flooding LSAs out of this interface. The time, in seconds, to wait for a hello packet before declaring a router down. The value of the dead-interval should be four times the value of the hello-interval. All routers on the network must use the same value for dead- interval.
  • Page 190 MTUs so that they match. 01-28006-0010-20041105 Router Default Availability All models. No default. All models. No default. All models. No default. All models. authentication must be set to md5. 1500 All models. All models. disable Fortinet Inc.
  • Page 191 “config neighbor” on page 185. Set the router priority for this interface. Router priority is used during the election of a designated router (DR) and backup designated router (BDR). An interface with router priority set to 0 can not be elected DR or BDR.

  • Page 192: Config Redistribute

    This example shows how to display the configuration for the OSPF interface configuration named test. config redistribute Access the config redistribute subcommand using the config router ospf command. Use the config redistribute command to advertise routes learned from RIP, static routes, or a direct connection to the destination network.
  • Page 193 This example shows how to display the OSPF settings. This example shows how to display the OSPF configuration. config summary-address Access the config summary-address subcommand using the config router ospf command. FortiGate-3000 Administration Guide config redistribute {connected | static | rip} set <keyword>...
  • Page 194 Use this command to summarize external routes for redistribution into OSPF. This command works only for summarizing external routes on an Autonomous System Boundary Router (ASBR). For information on summarization between areas, see “config range” on page route, you reduce the size of the OSPF link-state database.

  • Page 195: Config Router Static6

    Enter ::/0 for the destination IPV6 address and netmask to add a default route. The IPV6 address of the first next hop router to which this route directs traffic. 01-28006-0010-20041105 CLI configuration Default Availability All models.
  • Page 196 This example shows how to display the configuration for IPV6 static route 2. config router static6 edit 2 set dev internal set dst 12AB:0:0:CD30::/60 set gateway 12AB:0:0:CD30:123:4567:89AB:CDEF get router static6 get router static6 2 show router static6 show router static6 2 01-28006-0010-20041105 Router Fortinet Inc.

  • Page 197: Firewall

    Firewall Firewall policies control all traffic passing through the FortiGate unit. Firewall policies are instructions that the FortiGate unit uses to decide what to do with a connection request. When the firewall receives a connection request in the form of a packet, it analyzes the packet to extract its source address, destination address, and service (by port number).

  • Page 198: Policy

    Policy list You can add, delete, edit, re-order, enable, and disable policies in the policy list. Figure 79: Sample policy list How policy matching works Policy list Policy options Advanced policy options Configuring firewall policies 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 199: Policy Options

    Firewall The policy list has the following icons and features. Create new Source Dest Schedule Service Action Enable source -> destination (n) Policy list headings indicating the traffic to which the policy Figure 80: Move to options Policy options Policy options are configurable when creating or editing a firewall policy. FortiGate-3000 Administration Guide Select Create New to add a firewall policy.
  • Page 200 Select a service or protocol to which the policy will apply. You can select from a wide range of predefined services or add custom services and service groups. See 01-28006-0010-20041105 Firewall “Addresses” on page “Virtual IP” on page 206. “Schedule” on page 218. “Service” on page 210. Fortinet Inc. 222.
  • Page 201 Firewall Action VPN Tunnel Protection Profile Log Traffic Advanced FortiGate-3000 Administration Guide Select how you want the firewall to respond when the policy matches a connection attempt. • ACCEPT: Select accept to accept connections matched by the policy. You can also configure NAT and Authentication for the policy. •...

  • Page 202: Advanced Policy Options

    HTTP, Telnet, and FTP. Then users could authenticate with the policy using HTTP, Telnet, or FTP before using the other service. 247. 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 203: Traffic Shaping

    Firewall In most cases you should make sure that users can use DNS through the firewall without authentication. If DNS is not available users cannot connect to a web, FTP, or Telnet server using a domain name. Traffic Shaping Traffic Shaping controls the bandwidth available to and sets the priority of the traffic processed by the policy.

  • Page 204: Configuring Firewall Policies

    Set the DSCP value for reply packets. For example, for an Internal -> External policy the value is applied to incoming reply packets before they exit the internal interface and returned to the originator. 198. 01-28006-0010-20041105 Firewall “Policy options” on page 199. “How policy matching Fortinet Inc.

  • Page 205: To Disable A Policy

    Firewall Select the position for the policy. Select OK. To disable a policy Disable a policy to temporarily prevent the firewall from selecting the policy. Disabling a policy does not stop active communications sessions that have been allowed by the policy.

  • Page 206: Address

    192.168.110.* to represent all addresses on the subnet Address list Address options Configuring addresses Address group list Address group options Configuring address groups 01-28006-0010-20041105 Firewall Default Availability All models. 0.0.0.0 0.0.0.0 Encrypt policy, with outbound enabled. Fortinet Inc.

  • Page 207: Address List

    Firewall Address list You can add addresses to the list and edit existing addresses. The FortiGate unit comes configured with the default ‘All’ address which represents any IP address on the network. Figure 84: Sample address list The address list has the following icons and features. Create New Name Address...

  • Page 208: Configuring Addresses

    The netmask for a class B subnet should be 255.255.0.0. The netmask for a class C subnet should be 255.255.255.0. The netmask for all addresses should be 0.0.0.0 A range of IP addresses in a subnet (for example, 192.168.20.1 to 192.168.20.10) 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 209: Address Group List

    Firewall Select OK. Address group list You can organize related addresses into address groups to make it easier to configure policies. For example, if you add three addresses and then configure them in an address group, you can configure a single policy using all three addresses. Note: If an address group is included in a policy, it cannot be deleted unless it is first removed from the policy.

  • Page 210: Configuring Address Groups

    The list of configured and default firewall addresses. Use the arrows to move addresses between the lists. The list of addresses in the group. Use the arrows to move addresses between the lists. 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 211: Predefined Service List

    Firewall This section describes: • • • • • • • Predefined service list Figure 88: Predefined service list The predefined services list has the following icons and features. Name Detail Table 21 to any policy. Table 21: FortiGate predefined services Service name FortiGate-3000 Administration Guide Predefined service list...
  • Page 212 NetMeeting allows users to teleconference using the Internet as the transmission medium. Network File System allows network users to access shared files stored on computers of different types. 01-28006-0010-20041105 Firewall Protocol Port 5190-5194 1720, 1503 6660-6669 1701 1720 111, 2049 Fortinet Inc.
  • Page 213 Firewall Table 21: FortiGate predefined services (Continued) Service name NNTP OSPF PC-Anywhere ICMP_ANY PING TIMESTAMP INFO_REQUEST ICMP information request messages. INFO_ADDRESS ICMP address mask request messages. POP3 PPTP QUAKE RAUDIO RLOGIN SIP- MSNmessenger SMTP SNMP SYSLOG TALK FortiGate-3000 Administration Guide Description Network News Transport Protocol is a protocol used to post, distribute, and retrieve...

  • Page 214: Custom Service List

    Select a protocol and then Create New to add a custom service. The name of the custom service. The protocol and port numbers for each custom service. The Delete and Edit/View icons. 01-28006-0010-20041105 Firewall Protocol Port 0-65535 7000-7010 1494 6000-6063 Fortinet Inc.
  • Page 215 Firewall TCP and UDP custom service options Figure 90: TCP and UDP custom service options Name Protocol Type Source Port Destination Port Specify the Destination Port number range for the service by entering the ICMP custom service options Figure 91: ICMP custom service options Name Protocol Type Type...

  • Page 216: To Add A Custom Tcp Or Udp Service

    Go to Firewall > Service > Custom. Select the Delete icon beside the service you want to delete. Select OK. The name of the IP custom service. Select the protocol type of the service you are adding: IP. 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 217: To Edit A Custom Service

    Firewall To edit a custom service Go to Firewall > Service > Custom. Select the Edit icon beside the service you want to edit. Modify the custom service as required. Note: To change the custom service name you must delete the service and add it with a new name.

  • Page 218: Configuring Service Groups

    Enter a name to identify the address group. The list of configured and predefined services. Use the arrows to move services between the lists. The list of services in the group. Use the arrows to move services between the lists. 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 219: One-Time Schedule List

    Firewall This section describes: • • • • • • One-time schedule list You can create a one-time schedule that activates or deactivates a policy for a specified period of time. For example, your firewall might be configured with the default policy that allows access to all services on the Internet at all times.

  • Page 220: Configuring One-Time Schedules

    You can also create a recurring schedule that runs for 24 hours by setting the start and stop times to the same time. Figure 97: Sample recurring schedule list 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 221: Recurring Schedule Options

    Firewall The recurring schedule list has the following icons and features. Create New Name Start Stop Recurring schedule options Figure 98: Recurring schedule options Recurring schedule has the following options. Name Select Start Stop Configuring recurring schedules To add a recurring schedule Go to Firewall >...

  • Page 222: To Edit A Recurring Schedule

    Similar to port forwarding, dynamic port forwarding is used to translate any address and a specific port number on a source network to a hidden address and, optionally a different port number on a destination network. Virtual IP list Virtual IP options Configuring virtual IPs 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 223: Virtual Ip List

    Firewall Virtual IP list Figure 99: Sample virtual IP list The virtual IP list has the following icons and features. Create New Name Service Port Map to IP Map to Port Virtual IP options Different options appear depending on the type of virtual IP you want to define. Choose from Static NAT or port forwarding.

  • Page 224: Configuring Virtual Ips

    Enter the port number to be added to packets when they are forwarded. (Port forwarding only.) Select the protocol (TCP or UDP) that you want the forwarded packets to use. (Port forwarding only.) Table 22 on page 225 contains example virtual IP external interface settings 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 225: To Add Port Forwarding Virtual Ips

    Firewall You can now add the virtual IP to firewall policies. Table 22: Virtual IP external interface examples External Interface Description internal external To add port forwarding virtual IPs Go to Firewall > Virtual IP. Select Create New. Enter a name for the port forwarding virtual IP. Select the virtual IP External Interface from the list.

  • Page 226: To Add A Dynamic Port Forwarding Virtual Ip

    IP pool. An IP pool list appears when the policy destination interface is the same as the IP pool interface. “PPTP passthrough” on page 270 01-28006-0010-20041105 for more information. Fortinet Inc. Firewall...

  • Page 227: Ip Pool List

    Firewall You can add an IP pool if you want to add NAT mode policies that translate source addresses to addresses randomly selected from the IP pool rather than being limited to the IP address of the destination interface. If you add an IP pool to the internal interface, you can select Dynamic IP pool for policies with the internal interface as the destination.

  • Page 228: Configuring Ip Pools

    IP pool and assigns it to each connection. In this case the number of connections that the firewall can support is limited by the number of IP addresses in the IP pool. Select the interface to which to add an IP pool. Enter a name for the IP pool. 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 229: Ip Pools And Dynamic Nat

    Firewall IP pools and dynamic NAT You can use IP pools for dynamic NAT. For example, your organization might have purchased a range of Internet addresses but you might have only one Internet connection on the external interface of your FortiGate unit. You can assign one of your organization’s Internet IP addresses to the external interface of the FortiGate unit.

  • Page 230: Protection Profile List

    You can add this protection profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected. 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 231: Protection Profile Options

    Enable or disable quarantining for each protocol. You can quarantine suspect files to view them or submit files to Fortinet for analysis. 01-28006-0010-20041105 Protection profile 231.

  • Page 232: Configuring Web Filtering Options

    Enabling this option will prevent the unintentional download of virus files hidden in fragmented files. Note that some types of files, such as PDF, fragment files to increase download speed and enabling this option can cause download interruptions. 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 233: Configuring Web Category Filtering Options

    Firewall Configuring web category filtering options Figure 108:Protection profile web category filtering options (FortiGuard) The following options are available for web category filtering through the protection profile. See options. Enable category block (HTTP only) Block unrated websites (HTTP only) Provide details for blocked HTTP 4xx and 5xx errors (HTTP only) Allow websites when a rating...

  • Page 234: Configuring Spam Filtering Options

    Enable or disable checking traffic against configured Real-time Blackhole List and Open Relay Database List servers. Enable or disable the Fortinet spam filtering IP address blacklist: FortiShield. See on page 345 Enable or disable looking up the source domain name (from the SMTP HELO command) in the Domain Name Server.

  • Page 235: Configuring Protection Profiles

    Firewall Note: Some popular email clients cannot filter messages based on the MIME header. Check your email client features before deciding how to tag spam. Configuring IPS options Figure 110:Protection profile IPS options The following options are available for IPS through the protection profile. See page 299 IPS Signature IPS Anomaly...

  • Page 236: To Delete A Protection Profile

    Note: This guide only describes Command Line Interface (CLI) commands, keywords, or variables (in bold) that are not represented in the web-based manager. For complete descriptions and examples of how to use CLI commands see the FortiGate CLI Reference Guide. 01-28006-0010-20041105 Firewall Fortinet Inc.
  • Page 237 Firewall profile Use this command to add, edit or delete protection profiles. Use protection profiles to apply different protection settings for traffic controlled by firewall policies. Command syntax pattern FortiGate-3000 Administration Guide config firewall profile edit <profilename_str> set <keyword> <variable> config firewall profile edit <profilename_str>...
  • Page 238 If you want to remove an option from the list or add an option to the list, you must retype the list with the option removed or added. 01-28006-0010-20041105 Firewall Default Availability No default. All models. Fortinet Inc.
  • Page 239 Firewall firewall profile command keywords and variables (Continued) Keywords and variables http {bannedword block catblock chunkedbypass content_log oversize quarantine scan scriptfilter urlblock urlexempt} smtp {bannedword block content_log fragmail oversize quarantine scan spamemailbwl spamhdrcheck spamhelodns spamipbwl spamraddrdns spamrbl splice} FortiGate-3000 Administration Guide Description Select the actions that this profile will use for filtering HTTP traffic for a...
  • Page 240 This example shows how to display the configuration for the firewall profile command. This example shows how to display the configuration for the spammail profile. get firewall profile get firewall profile spammail show firewall profile show firewall profile spammail 01-28006-0010-20041105 Firewall Fortinet Inc.

  • Page 241: Users And Authentication

    Users and authentication You can control access to network resources by defining lists of authorized users, called user groups. To use a particular resource, such as a network or a VPN tunnel, the user must belong to one of the user groups that is allowed access. The user then must correctly enter a user name and password to prove his or her identity.

  • Page 242: Setting Authentication Timeout

    Select Disable to prevent this user from authenticating. Select Password to require the user to authenticate using a password. Enter the password that this user must use to authenticate. The password should be at least six characters long. 01-28006-0010-20041105 Users and authentication Fortinet Inc.

  • Page 243: To Add A User Name And Configure Authentication

    Users and authentication LDAP Radius To add a user name and configure authentication Go to User > Local. Select Create New to add a new user name or select the Edit icon to edit an existing configuration. Type the User Name. Select the authentication type for this user.

  • Page 244: Radius Server Options

    FortiGate unit. If the LDAP server cannot authenticate the user, the connection is refused by the FortiGate unit. The Delete and Edit icons. Enter a name to identify the RADIUS server. Enter the RADIUS server secret. 01-28006-0010-20041105 Users and authentication Fortinet Inc.

  • Page 245: Ldap Server List

    Users and authentication The FortiGate unit supports LDAP protocol functionality defined in RFC2251 for looking up and validating user names and passwords. FortiGate LDAP supports all LDAP servers compliant with LDAP v3. FortiGate LDAP support does not extend to proprietary functionality, such as notification of password expiration, that is available from some LDAP servers.

  • Page 246: To Configure The Fortigate Unit For Ldap Authentication

    For example, you could use the following base distinguished name: ou=marketing,dc=fortinet,dc=com where ou is organization unit and dc is domain component. You can also specify multiple instances of the same field in the distinguished name, for example, to specify multiple organization units: ou=accounts,ou=marketing,dc=fortinet,dc=com 01-28006-0010-20041105 Users and authentication Fortinet Inc.

  • Page 247: User Group

    Users and authentication User group To enable authentication, you must add user names, RADIUS servers, and LDAP servers to one or more user groups. You can then assign a firewall protection profile to the user group. You can configure authentication as follows: •...

  • Page 248: User Group Options

    The list of users, RADIUS servers, or LDAP servers that can be added to a user group. The list of users, RADIUS servers, or LDAP servers added to a user group. Select a protection profile for this user group. 01-28006-0010-20041105 Users and authentication Fortinet Inc.

  • Page 249: Cli Configuration

    Users and authentication Select Delete beside the user group that you want to delete. Select OK. CLI configuration This guide only covers Command Line Interface (CLI) commands that are not represented in the web-based manager. For complete descriptions and examples of how to use CLI commands see the FortiGate CLI Reference Guide.

  • Page 250: Peergrp

    EU_branches set member Sophia_branch Valencia_branch Cardiff_branch get user peergrp 01-28006-0010-20041105 Users and authentication Default Availability No default. All models. Fortinet Inc.
  • Page 251 Users and authentication This example shows how to display the configuration for all the peers groups. This example shows how to display the configuration for the peergrp EU_branches. FortiGate-3000 Administration Guide get user peergrp EU_branches show user peergrp show user peergrp EU_branches 01-28006-0010-20041105 CLI configuration...
  • Page 252 CLI configuration Users and authentication 01-28006-0010-20041105 Fortinet Inc.

  • Page 253: Vpn

    FortiGate units support the following protocols to authenticate and encrypt traffic: • • • This chapter contains information about the following VPN topics: • • • • • • • • • • • • • • • • • •...

  • Page 254: Phase 1

    1, Dialup if this is a dialup Phase 1 configuration, and the domain name if this is a dynamic DNS phase 1. Main mode or Aggressive mode. The names of the encryption and authentication algorithms used by each phase 1 configuration. Edit, view, or delete phase 1 configurations. 01-28006-0010-20041105 Fortinet Inc.

  • Page 255: Phase 1 Basic Settings

    Phase 1 basic settings Figure 121:Phase 1 basic settings Gateway Name Type a name for the remote VPN peer. The remote peer can be either a Remote Gateway IP Address Dynamic DNS Mode Authentication Method FortiGate-3000 Administration Guide gateway to another network or an individual client on the Internet. Select a Remote Gateway address type.

  • Page 256: Phase 1 Advanced Options

    The group must be added to the FortiGate configuration through the config user peer and config user peergrp CLI commands before it can be selected here. For more information, see the “config user” chapter of the CLI Reference Guide. 01-28006-0010-20041105 “Enabling VPN access for 280. Fortinet Inc.

  • Page 257: Configuring Xauth

    Encryption Authentication The FortiGate unit supports the following authentication methods: DH Group Keylife Local ID XAuth Nat-traversal Keepalive Frequency Dead Peer Detection Configuring XAuth XAuth authenticates users in a separate exchange held between Phases 1 and 2. XAuth: Enable as Client Username Password FortiGate-3000 Administration Guide...

  • Page 258: Phase 2

    Microsoft RADIUS). Use MIXED if the authentication server supports CHAP but the XAuth client does not. (Use MIXED with the Fortinet Remote VPN Client.). Select a group of users to be authenticated by XAuth. The individual users within the group can be authenticated locally or by one or more LDAP or RADIUS servers.

  • Page 259: Phase 2 Basic Settings

    Status Timeout Phase 2 basic settings Figure 124:Phase 2 basic settings Tunnel Name Remote Gateway Concentrator FortiGate-3000 Administration Guide The current status of the tunnel. Down, tunnel is not processing traffic. Up, the tunnel is currently processing traffic. Unknown, status of Dialup tunnels.

  • Page 260: Phase 2 Advanced Options

    You can configure the FortiGate unit to send an alert email when it detects a replay packet. For more information, see Perfect forward secrecy (PFS) improves security by forcing a new Diffie-Hellman exchange whenever keylife expires. 01-28006-0010-20041105 “Alert E-mail options” on page 362. Fortinet Inc.

  • Page 261: Manual Key

    DH Group Keylife Autokey Keep Alive DHCP-IPSec Internet browsing Quick Mode Identities Manual key Configure a manual key tunnel to create an IPSec VPN tunnel between the FortiGate unit and a remote VPN peer that uses a manual key. The FortiGate unit must be configured to use the same encryption and authentication algorithms used by the remote peer.

  • Page 262: Manual Key List

    Enter the external IP address of the FortiGate unit or other IPSec gateway at the opposite end of the tunnel. Select an Encryption Algorithm from the list. Use the same algorithm at both ends of the tunnel. 01-28006-0010-20041105 Fortinet Inc.

  • Page 263: Concentrator

    Encryption Key Enter the Encryption Key. Authentication Algorithm Authentication Concentrator Concentrator Configure IPSec VPN concentrators to create hub and spoke configurations. IPSec VPN concentrators are only available in NAT/Route mode. To configure a concentrator Go to VPN > IPSEC > Concentrator and add a concentrator. Add the required Phase 2 configurations to the concentrator.

  • Page 264: Concentrator Options

    A concentrator can have more than one tunnel in its list of members. Provides a list of tunnels that are members of the concentrator. To remove a tunnel from the list, select the tunnel in the Members list and select the left arrow. 01-28006-0010-20041105 Fortinet Inc.

  • Page 265: Ping Generator Options

    Ping generator options Figure 130:Ping generator Enable Source IP 1 Destination IP 1 Source IP 2 Destination IP 2 To configure the ping generator Go to VPN > IPSEC > Ping Generator. Select Enable. In the Source IP 1 box, type the private IP address from which traffic may originate locally.

  • Page 266: Dialup Monitor

    The IP address range from which the dialup user can connect. This is usually the current IP address of the dialup user’s computer. Stop the current dialup tunnel. The dialup user may have to reconnect to establish a new VPN session. 01-28006-0010-20041105 Fortinet Inc.

  • Page 267: Pptp

    Name Remote gateway The IP address and UDP port of the remote gateway. For dynamic DNS Timeout Proxy ID Source The IP address range that VPN users of this tunnel can connect to. Proxy ID Destination Bring down tunnel icon Bring up tunnel icon PPTP...

  • Page 268: Enabling Pptp And Specifying A Pptp Range

    The start of the IP range. For example, 192.168.1.10. The end of the IP range. For example, 192.168.1.20. Select the user group that contains the remote PPTP VPN clients. Select this option to disable the PPTP support. 01-28006-0010-20041105 208. 204. PPTP. PPTP. Fortinet Inc.

  • Page 269: Configuring A Windows 2000 Client For Pptp

    Configuring a Windows 2000 client for PPTP To configure a PPTP dialup connection Go to Start > Settings > Network and Dial-up Connections. Double-click Make New Connection to start the Network Connection Wizard and select Next. For Network Connection Type, select Connect to a private network through the Internet and select Next.

  • Page 270: To Connect To The Pptp Vpn

    Go to Firewall > Virtual IP. Select Create New. Enter a name for the virtual IP, for example PPTP_pass. Set the External Interface to external. TCP/IP QoS Packet Scheduler File and Printer Sharing for Microsoft Networks Client for Microsoft Networks 01-28006-0010-20041105 Fortinet Inc.

  • Page 271: To Configure The Firewall Policy

    Select Port Forwarding. Set the External IP Address to 0.0.0.0. The 0.0.0.0 External IP Address matches any IP address. Alternatively, if PPTP users always connect to the same IP address, you can specify that IP address. Set the External Service Port to 1723. Set the Map to IP address to 192.168.23.1.

  • Page 272: L2Tp

    “To add an address” on page “To add a firewall policy” on page Configuring a Windows 2000 client for Configuring a Windows XP client for 01-28006-0010-20041105 “To add an address” on page 208. 204. L2TP. L2TP. “Users and 272. 208. Fortinet Inc.

  • Page 273: Configuring A Windows 2000 Client For L2Tp

    Figure 134:L2TP range Enable L2TP Starting IP Ending IP User Group Disable L2TP To enable L2TP on the FortiGate unit Go to VPN > L2TP > L2TP Range. Select Enable L2TP. Complete the fields as required. Select Apply. Configuring a Windows 2000 client for L2TP To configure an L2TP dialup connection Go to Start >...

  • Page 274: To Connect To The L2Tp Vpn

    Select Create a connection to the network of your workplace and select Next. Select Virtual Private Network Connection and select Next. Name the connection and select Next. If the Public Network dialog box appears, choose the appropriate initial connection and select Next. 01-28006-0010-20041105 Fortinet Inc.

  • Page 275: To Configure The Vpn Connection

    In the VPN Server Selection dialog, enter the IP address or host name of the FortiGate unit to connect to and select Next. Select Finish. To configure the VPN connection Right-click the icon that you have created. Select Properties > Security. Select Typical to configure typical settings.

  • Page 276: To Connect To The L2Tp Vpn

    FortiGate unit for decrypting messages sent by the remote peer. Conversely, the remote peer provides its public key to the FortiGate unit, which uses the key to encrypt messages destined for the remote peer. 01-28006-0010-20041105 Fortinet Inc.

  • Page 277: Viewing The Certificate List

    Details are provided in the following sections: • • • • Viewing the certificate list Initially, no certificates are installed. To view the certificate list Go to VPN > Certificates > Local Certificates. Figure 135:Certificate list Generate Import Name Subject Status Generating a certificate request To obtain a personal or site certificate, you must send the request to a CA that...
  • Page 278 Follow the CA instructions to place a base-64 encoded PKCS#10 certificate request and upload the certificate request. Follow the CA instructions to download their root certificate, and then install the root certificate on the FortiGate unit. 01-28006-0010-20041105 further identify the object being certified. Fortinet Inc.

  • Page 279: Installing A Signed Certificate

    Figure 136:Generating a certificate signing request Certificate Name Type a certificate name. Subject Information Optional Information Key Type Key Size Installing a signed certificate Your CA provides you with a digital certificate to install on the FortiGate unit. You must also obtain and install the CA’s root certificate on the FortiGate unit.

  • Page 280: Enabling Vpn Access For Specific Certificate Holders

    To enable access for a specific certificate holder or a group of certificate holders Use this procedure to enhance access security if you are using digital certificates to authenticate peers. Go to VPN > IPSEC > Phase 1. “Backing up and Restoring” on page 01-28006-0010-20041105 124. Fortinet Inc.

  • Page 281: Cli Configuration

    Under Peer Options, select one of these options: • • If you want to define the DN of the FortiGate unit, select Advanced, and from the Local ID list, select the DN of the FortiGate unit. Select OK. CLI configuration This guide only covers Command Line Interface (CLI) commands, keywords, or variables (in bold) that are not represented in the web-based manager.
  • Page 282 01-28006-0010-20041105 Default Availability All models. seconds dpd must be set to enable. All models. seconds dpd must be set to enable. All models. dpd must be set to enable. All models. seconds dpd must be set to enable. Fortinet Inc.

  • Page 283: Ipsec Phase2

    Example Use the following command to edit an IPSec VPN phase 1 configuration with the following characteristics: • • • • • • • • • • • ipsec phase2 In addition to the advanced IPSec Phase 2 settings, the config vpn ipsec phase2 CLI command provides a way to bind the VPN tunnel selected in a Phase 2 configuration to a specific network interface.

  • Page 284: Ipsec Vip

    Type the name of the local FortiGate interface. config vpn ipsec phase2 edit Tunnel_1 set bindtoif internal “Configuring IPSec virtual IP addresses” on page config vpn ipsec vip edit <vip_integer> set <keyword> <variable> 01-28006-0010-20041105 Default Availability All models. default. 296. Fortinet Inc.
  • Page 285 ipsec vip command keywords and variables Keywords and variables ip <address_ipv4> out-interface <interface-name_str> Example The following commands add IPSec VIP entries for two remote hosts that can be accessed by a FortiGate unit through an IPSec VPN tunnel on the external interface of the FortiGate unit.

  • Page 286: Authenticating Peers With Preshared Keys

    “Phase 1” on page 254. “Adding firewall policies for IPSec VPN tunnels” on page “Phase 1” on page 254. “Phase 2” on page 258. “Adding firewall policies for IPSec VPN tunnels” on page 01-28006-0010-20041105 “Phase 2” on page 258. 288. 288. Fortinet Inc.

  • Page 287: Dialup Vpn

    Dialup VPN Dialup VPN allows remote users with dynamic IP addresses to use VPN to connect to a private network. Dialup VPNs use AutoIKE and can be preshared key or certificate VPNs. To configure dialup VPN Add a phase 1 configuration to define the parameters used to authenticate the remote VPN peer.

  • Page 288: Manual Key Ipsec Vpn

    To add a source address, see page “Manual key” on page 261. “Manual key” on page 261. “Adding firewall policies for IPSec VPN tunnels” on page “Policy” on page 198 208. 01-28006-0010-20041105 288. for information about firewall policies. “To add an address” on Fortinet Inc.

  • Page 289: Setting The Destination Address For Encrypted Traffic

    Setting the destination address for encrypted traffic The destination address determines which remote peers and clients will be allowed to access the specified source address. In general: • • • To add a destination address, see Adding an IPSec firewall encryption policy Use the following procedure to add an IPSec firewall encryption policy.

  • Page 290: Configuring Internet Browsing Through A Vpn Tunnel

    If required, add additional firewall policies to support internet browsing. Configure the remote VPN clients to deny split tunneling. “Phase 1” on page 254. “Phase 2” on page 288. 01-28006-0010-20041105 258. “System DHCP” on page “Adding firewall policies for IPSec Fortinet Inc.

  • Page 291: Ipsec Vpn In Transparent Mode

    The unit must have sufficient routing information to reach the management station. For any traffic to reach external destinations, a static (default) route to the router must be present in the FortiGate routing table. The router forwards packets to the Internet.

  • Page 292: Hub And Spoke Vpns

    The source address must be Internal_All. Use the following configuration for the encrypt policies: add the VPN tunnels. add a VPN concentrator. add a firewall policy. “To add an address” on page “To add an address” on page 01-28006-0010-20041105 208. 208. Fortinet Inc.

  • Page 293: Adding A Vpn Concentrator

    Source Destination Action VPN Tunnel Allow inbound Allow outbound Select allow outbound. Inbound NAT Outbound NAT Select outbound NAT if required. Arrange the policies in the following order: • • Adding a VPN concentrator The VPN concentrator collects the hub-and-spoke tunnels into a group. This allows VPN traffic to pass from one tunnel to the other through the FortiGate unit.

  • Page 294: Configuring Spokes

    The remote VPN spoke address. ENCRYPT The VPN tunnel name added in step 1. (Use the same tunnel for all encrypt policies.) Do not enable. Select inbound NAT if required. “To add a firewall policy” on page 01-28006-0010-20041105 208. 208. 204. Fortinet Inc.

  • Page 295: Redundant Ipsec Vpns

    Source Destination Action VPN Tunnel Allow inbound Allow outbound Do not enable. Inbound NAT Outbound NAT Select outbound NAT if required. Arrange the policies in the following order: • • • Note: The default non-encrypt policy is required to allow the VPN spoke to access other networks, such as the Internet.

  • Page 296: Configuring Ipsec Virtual Ip Addresses

    The source and destination of both policies must be the same. Add a different AutoIKE key tunnel to each policy. “To add a firewall policy” on page 01-28006-0010-20041105 254. “To add an address” on page 204. 208. Fortinet Inc.
  • Page 297 Consider the following example, which shows two physically separate networks. The IP addresses of the computers on both networks are in the 192.168.12.0/24 range, but no two IP addresses are the same. An IPSec VPN has been configured between FortiGate_1 and FortiGate_2. The FortiGate configuration permits Host_1 on the Finance network to transmit data to Host_2 on the HR network through the IPSec VPN tunnel.

  • Page 298: Troubleshooting

    Make sure you select the correct DH group on both ends. Enable PFS. Change the policy to internal-to-external. Re-enter the source and destination address. The encryption policy must be placed above other non-encryption policies. “ipsec Fortinet Inc.

  • Page 299: Ips

    IPS (attack) engines and definitions through the FortiProtect Distribution Network (FDN). The FortiProtect Center also provides the FortiProtect virus and attack encyclopedia and the FortiProtect Bulletin. Visit the FortiProtect Center at http://www.fortinet.com/FortiProtectCenter/. To set up automatic and push updates see FortiGate-3000 Administration Guide FortiGate-3000 Administration Guide Version 2.80 MR6...

  • Page 300: Signature

    The FortiGate IPS matches network traffic against patterns contained in attack signatures. Attack signatures reliably protect your network from known attacks. Fortinet’s FortiProtect infrastructure ensures the rapid identification of new threats and the development of new attack signatures. You can configure the FortiGate unit to automatically check for and download an updated attack definition file containing the latest signatures, or you can manually download the updated attack definition file.

  • Page 301: Predefined Signature List

    If logging is disabled and action is set to Pass, the signature is effectively disabled. The FortiGate unit drops the packet that triggered the signature. Fortinet recommends using an action other than Drop for TCP connection based attacks.

  • Page 302: To Enable Or Disable Predefined Signature Groups

    The FortiGate unit drops the packet that triggered the signature, removes the session from the FortiGate session table, and does not send a reset. The FortiGate unit lets the packet that triggered the signature and all other packets in the session pass through the firewall. 01-28006-0010-20041105 Fortinet Inc.

  • Page 303: To Restore The Recommended Settings Of A Signature

    Select the Enable box to enable the signature or clear the Enable box to disable the signature. Select the Logging box to enable logging for this signature or clear the Logging box to disable logging for this signature. Select the Action for the FortiGate unit to take when traffic matches this signature. (See Select OK.

  • Page 304: Custom

    (the default) no change is made to the codepoint in the IP header. Select the Enable custom signature box to enable the custom signature group or clear the Enable custom signature box to disable the custom signature group. Select Create New to create a new custom signature. 01-28006-0010-20041105 Fortinet Inc.

  • Page 305: To Add A Custom Signature

    Clear all custom signatures Reset to recommended settings? Name Revision Enable Logging Action Modify Adding custom signatures To add a custom signature Go to IPS > Signature > Custom. Select Create New to add a new custom signature or select the Edit icon to edit an existing custom signature.

  • Page 306: Anomaly

    The logging status for each anomaly. A white check mark in a green circle indicates logging is enabled for the anomaly. A white X in a grey circle indicates logging is disabled for the anomaly. 01-28006-0010-20041105 “Anomaly CLI configuration” on Fortinet Inc.

  • Page 307: Configuring An Anomaly

    If logging is disabled and action is set to Pass, the anomaly is effectively disabled. Drop The FortiGate unit drops the packet that triggered the anomaly. Fortinet recommends using an action other than Drop for TCP connection based attacks.

  • Page 308: To Configure The Settings Of An Anomaly

    FortiGate session table, and does not send a reset. Session Pass The FortiGate unit lets the packet that triggered the anomaly and all other packets in the session pass through the firewall. Session Traffic over the specified threshold triggers the anomaly. 01-28006-0010-20041105 Fortinet Inc.

  • Page 309: Anomaly Cli Configuration

    Anomaly CLI configuration Note: This guide only covers Command Line Interface (CLI) commands that are not represented in the web-based manager. For complete descriptions and examples of how to use CLI commands see the FortiGate CLI Reference Guide. (config ips anomaly) config limit Note: This command has more keywords than are listed in this Guide.

  • Page 310: Configuring Ips Logging And Alert Email

    You can change the default fail open setting using the CLI: Enable ips_open to cause the IPS to fail open and disable ips_open to cause the IPS to fail closed. “Log & Report” on page config sys global set ips-open [enable | disable] 01-28006-0010-20041105 357. Fortinet Inc.

  • Page 311: Antivirus

    Antivirus > Quarantine View and sort the list of quarantined files, configure file patterns to upload automatically to Fortinet for analysis, and configure quarantining options in AntiVirus. Antivirus > Config > Config Set the size thresholds for files and emails for each protocol in Antivirus.

  • Page 312: File Block

    IPS (attack) engines and definitions, as well as the local spam RBL, through the FortiProtect Distribution Network (FDN). The FortiProtect Center also provides the FortiProtect virus and attack encyclopedia and the FortiProtect Bulletin. Visit the FortiProtect Center at http://www.fortinet.com/FortiProtectCenter/. To set up automatic and push updates see This chapter describes: •...

  • Page 313: File Block List

    Antivirus This section describes: • • File block list The file block list is preconfigured with a default list of file patterns: • • • • • • • • • Figure 151:Default file block list File block list has the following icons and features: Create New Apply Pattern...

  • Page 314: To Add A File Name Or File Pattern To The File Block List

    You can also submit specific files and add file patterns to the AutoSubmit list so they will automatically be uploaded to FortiNet for analysis. This section describes: •...

  • Page 315: Quarantined Files List Options

    EXP under the TTL heading. In the case of duplicate files, each duplicate found refreshes the TTL. Y indicates the file has been uploaded to Fortinet for analysis, N indicates the file has not been uploaded.

  • Page 316: Autosubmit List

    (* or ?). File patterns are applied for AutoSubmit regardless of file blocking settings. You can also upload files to Fortinet based on status (blocked or heuristics) or submit individual files directly from the quarantined files list. The FortiGate unit uses encrypted email to autosubmit files to an SMTP server through port 25.
  • Page 317 Antivirus Config Go to Config to set quarantine configuration options including whether to quarantine blocked or infected files and from which service. You can also configure the time to live and file size values, and enable AutoSubmit settings. Figure 155:Quarantine configuration Quarantine configuration has the following options: Options Age limit...

  • Page 318: Config

    1 to 25 MB. The range for each FortiGate unit is displayed in the web-based manager as shown in Virus list Config Grayware Grayware options 35. To find out how to use the Fortinet Update Center, see 126. Figure 01-28006-0010-20041105 “Changing unit 157.

  • Page 319: Grayware Options

    Antivirus You can enable oversized file blocking in a firewall protection profile. To access protection profiles go to Firewall > Protection Profile, select Anti-Virus > Oversized File/Email and choose to pass or block oversized email and files for each protocol. Grayware Grayware programs are unsolicited commercial software programs that get installed on computers, often without the user’s consent or knowledge.

  • Page 320: Cli Configuration

    Select enable to block download programs. Download components are usually run at Windows startup and are designed to install or download other software, especially advertising and dial software. 01-28006-0010-20041105 Antivirus Fortinet Inc.

  • Page 321: System Global Optimize

    Antivirus For more information see the FortiGate Antivirus Optimization and Operation Technical Note. Command syntax pattern Keywords and variables av_failopen {off | one-shot | pass} Example This example shows how to set av_failopen to use one-shot and bypass the antivirus system when memory is low.

  • Page 322: Heuristic

    Optimize the firmware for either antivirus performance or throughput performance. config system global set optimize antivirus config antivirus heuristic set <keyword> <variable> config antivirus heuristic unset <keyword> get antivirus heuristic show antivirus heuristic 01-28006-0010-20041105 Antivirus Default Availability No default. All models. Fortinet Inc.

  • Page 323: Quarantine

    Antivirus Table 26: antivirus heuristic command keywords and variables Keywords and variables mode {pass | block | disable} Example This example shows how to disable heuristic scanning. This example shows how to display the settings for the antivirus heuristic command. This example shows how to display the configuration for the antivirus heuristic command.

  • Page 324: Service Http

    70 set port 90 set port 443 01-28006-0010-20041105 Antivirus Default Availability FortiGate imap models smtp numbered pop3 200 and http higher. FortiGate default. models numbered 200 and higher. Default Availability All models. Fortinet Inc.

  • Page 325: Service Ftp

    Antivirus This example shows how to display the antivirus HTTP traffic settings. This example shows how to display the configuration for antivirus HTTP traffic. service ftp Use this command to configure how the FortiGate unit handles antivirus scanning of large files, how the FortiGate unit handles the buffering and uploading of files to an FTP server, and what ports the FortiGate unit virus scans for FTP traffic.

  • Page 326: Service Pop3

    You can use ports from the range 1-65535. You can add up to 20 ports. config antivirus service pop3 set port 992 set port 993 get antivirus service pop3 show antivirus service pop3 01-28006-0010-20041105 Antivirus Default Availability All models. Fortinet Inc.

  • Page 327: Service Smtp

    Antivirus Note: This command has more keywords than are listed in this Guide. See the FortiGate CLI Reference Guide for a complete list of commands and keywords. Command syntax pattern Table 30: antivirus service imap command keywords and variables Keywords and variables port <port_integer>...
  • Page 328 SMTP. You can use ports from the range 1-65535. You can add up to 20 ports. config antivirus service smtp set port 465 get antivirus service smtp show antivirus service smtp 01-28006-0010-20041105 Antivirus Default Availability All models. Fortinet Inc.

  • Page 329: Web Filter

    Web filter Web filter provides configuration access to the Web filtering and Web category filtering options you enable when you create a firewall Protection Profile. To access protection profile web filter options go to Firewall > Protection Profile, select edit or Create New, and select Web Filtering or Web Category Filtering. See “Protection profile options”...

  • Page 330: Content Block

    “Using Perl regular expressions” on page 01-28006-0010-20041105 Web Filter setting Web Filter > Category Block > Configuration Enable or disable FortiGuard and enable and set the size limit for the cache. “Protection profile” on 236. 354. Web filter “To Fortinet Inc.

  • Page 331: Web Content Block List

    Web filter Note: Perl regular expression patterns are case sensitive for Web Filter content block. To make a word or phrase case insensitive, use the regular expression /i. For example, /bad language/i will block all instances of bad language regardless of case. Wildcard patterns are not case sensitive.

  • Page 332: Configuring The Web Content Block List

    “Using Perl regular expressions” on page Select the character set for the banned word. Choose from: Chinese Simplified, Chinese Traditional, French, Japanese, Korean, Thai, or Western. Select Enable to activate the banned word in the list. 01-28006-0010-20041105 Web filter 354. Fortinet Inc.

  • Page 333: Web Url Block List

    Web filter Note: URL blocking does not block access to other services that users can access with a web browser. For example, URL blocking does not block access to ftp://ftp.badsite.com. Instead, you can use firewall policies to deny FTP connections. This section describes: •...

  • Page 334: To Add A Url To The Web Url Block List

    FortiGate web pattern blocking supports standard regular expressions. You can add up to 20 patterns to the web pattern block list. Note: Enable Web filtering > Web URL Block in your firewall Protection Profile to activate the web pattern block settings. 01-28006-0010-20041105 Web filter Fortinet Inc.

  • Page 335: Web Pattern Block Options

    Web filter Figure 163:Sample web pattern block list Web pattern block options Web pattern block has the following icons and features: Create New Pattern Configuring web pattern block To add a pattern to the web pattern block list Go to Web Filter > URL Block. Select Web Pattern Block.

  • Page 336: Url Exempt List

    Select this icon to scroll the URL exempt list down. Select this icon to delete the entire URL exempt list. The current list of exempt URLs. Select the check box to enable all the URLs in the list. The Delete and Edit/View icons. 01-28006-0010-20041105 Web filter Fortinet Inc.

  • Page 337: Category Block

    • FortiGuard managed web filtering service FortiGuard is a managed web filtering solution provided by Fortinet. FortiGuard sorts hundreds of millions of web pages into a wide range of categories that users can allow, block, or monitor. The FortiGate unit accesses the nearest FortiGuard Service Point to determine the category of a requested web page and then follows the firewall policy configured for that user or interface.

  • Page 338: Category Block Configuration Options

    FortiGuard licensing Every FortiGate unit comes with a free 30-day FortiGuard trial license. FortiGuard license management is done by Fortinet servers, so there is no need to enter a license number. The FortiGate unit will then automatically contact a FortiGuard Service Point when you enable FortiGuard category blocking.

  • Page 339: Configuring Web Category Block

    Web filter To have a URL’s... Apply Configuring web category block To enable FortiGuard web filtering Go to Web Filter > Category Block. Select Enable Service. Select Check status to make sure the FortiGate unit can access the FortiGuard server. After a moment, the FortiGuard status should change from Unknown to Available.

  • Page 340: Category Block Reports Options

    The number of allowed web addresses accessed in the selected time frame. The number of blocked web addresses accessed in the selected time frame. The number of monitored web addresses accessed in the selected time frame. 01-28006-0010-20041105 Web filter Fortinet Inc.

  • Page 341: Script Filter

    Use this command only if you need to change the host name. config webfilter catblock set ftgd_hostname guard.example.net get webfilter catblock show webfilter catblock 01-28006-0010-20041105 Script filter Default Availability guard.fortinet.com All models. service fortiguar d only.

  • Page 342: Web Script Filter Options

    You can configure the following options for script filtering: Javascript Cookies ActiveX Select Javascript to block all Javascript-based pages or applications. Select Cookies to block web sites from placing cookies on individual computers. Select ActiveX to block all ActiveX applications. 01-28006-0010-20041105 Web filter Fortinet Inc.

  • Page 343: Spam Filter

    Real-time Blackhole List and Open Relay Database List servers. IP address FortiShield check Enable or disable Fortinet’s antispam IP address black list: FortiShield. This service works like an RBL server and is continuously updated to block spam sources. See “FortiShield IP address black list and spam...
  • Page 344 You can configure the language and whether to search the email body, subject, or both. You can configure the action to take as spam or clear for each word. “Protection profile” on 236. Spam filter “To Fortinet Inc.

  • Page 345: Order Of Spam Filter Operations

    Both FortiShield antispam processes are completely automated and configured by Fortinet. With constant monitoring and dynamic updates, FortiShield is always current. You can enable or disable FortiShield in a firewall protection profile. See spam filtering options” on page This chapter describes: •...

  • Page 346: Ip Address

    Mark as Spam to apply the spam action configured in the protection profile, Mark as Clear to let the email pass to the next filter, or Mark as Reject (SMTP only) to drop the session. The Delete and Edit/View icons. 01-28006-0010-20041105 Spam filter Fortinet Inc.

  • Page 347: Rbl & Ordbl

    Spam filter Select Create New. Figure 171:Adding an IP address Enter the IP address/mask you want to add. If required, select before or after another IP address in the list to place the new IP address in the correct position. Select the action to take on email from the IP address.

  • Page 348: Rbl & Ordbl List

    The action to take on email matched by the RBLs and ORDBLs. Actions are: Mark as Spam to apply the spam action configured in the protection profile, or Mark as Reject to drop the session. The Delete and Edit/View icons. 01-28006-0010-20041105 Spam filter Fortinet Inc.

  • Page 349: Email Address

    Spam filter Email address The FortiGate unit uses the email address list to filter incoming email. The FortiGate unit compares the email address or domain of the sender to the list in sequence. If a match is found, the corresponding protection profile action is taken. If no match is found, the email is passed on to the next spam filter.

  • Page 350: Mime Headers

    You can use Perl regular expressions or wildcards to add MIME header patterns to the list. See Note: MIME header entries are case sensitive. X-mailer: outgluck X-Distribution: bulk Content_Type: text/html Content_Type: image/jpg “Using Perl regular expressions” on page 01-28006-0010-20041105 Spam filter 354. Fortinet Inc.

  • Page 351: Mime Headers List

    Spam filter This section describes: • • • MIME headers list You can configure the FortiGate unit to filter email with specific MIME header key-value pairs. You can mark each MIME header as clear or spam. Figure 176:Sample MIME headers list MIME headers options MIME headers list has the following icons and features: Create New...

  • Page 352: Banned Word

    Perl regular expressions. See expressions” on page “Using Perl regular expressions” on page Banned word list Banned word options Configuring the banned word list 354. 01-28006-0010-20041105 Spam filter 354. “Using Perl regular Fortinet Inc.

  • Page 353: Banned Word Options

    Spam filter Figure 178:Sample banned word List Banned word options Banned word has the following icons and features: Create new Total Pattern Pattern Type Language Where Action When you select Create New or Edit you can configure the following settings for the banned word.

  • Page 354: Configuring The Banned Word List

    Mark as Clear to allow the email (since Banned Word is the last filter). Select to enable scanning for the banned word. fortinet.com not only matches fortinet.com but also matches fortinetacom, fortinetbcom, fortinetccom and so on. To mach fortinet.com, the regular expression should be: fortinet\.com forti*\.com matches fortiiii.com but does not match fortinet.com...
  • Page 355 Spam filter Word boundary In Perl regular expressions, the pattern does not have an implicit word boundary. For example, the regular expression “test” not only matches the word “test” but also matches any word that contains the “test” such as “atest”, “mytest”, “testimony”, “atestb”.

  • Page 356: To Block Any Word In A Phrase

    ‘/’ will be parsed as a list of regexp options ('i', 'x', etc). An error occurs If the second '/' is missing. In regular expressions, the leading and trailing space is treated as part of the regular expression. 01-28006-0010-20041105 Spam filter Fortinet Inc.

  • Page 357: Log & Report

    FortiGate-3000 Administration Guide Version 2.80 MR6 Log & Report FortiGate units provide extensive logging capabilities for traffic, system and network protection functions. You can set the severity level of the messages that are logged, and you can choose the types of events that are logged. All types of log messages, except traffic and content, can be saved in internal memory.

  • Page 358: Log Config

    A FortiLog unit. The FortiLog unit is a log analyzer and manager that can combine the log information from various FortiGate units and other firewall units. To enable content archiving with a firewall to select the FortiLog option and define its IP address. 01-28006-0010-20041105 Log & Report Protection profile, you need Fortinet Inc.

  • Page 359: To Configure Log Setting

    Log & Report Disk Memory Syslog WebTrends Figure 181:Log setting options for all log locations To configure Log Setting Go to Log&Report > Log Config > Log Setting. Select the check box to enable logging to a location. Select the blue arrow beside the location. The setting options appear.
  • Page 360 Select the log files to upload to the FTP server. You can upload the Traffic Log file, Event Log file, Antivirus Log file, Web Filter Log file, Attack Log file, Spam Filter Log file, and Content Archive file. 01-28006-0010-20041105 Log & Report Table 36, “Logging Fortinet Inc.

  • Page 361: Syslog Settings

    Log & Report To configure log file uploading Select the blue arrow to expand Log file upload settings. Select Upload When Rolling. Enter the IP address of the logging server. Enter the port number on the logging server. The default is 21 (FTP). Enter the Username and Password required on the logging server.

  • Page 362: Alert E-Mail Options

    The interval to wait before sending an alert e-mail for error level log messages. The interval to wait before sending an alert e-mail for warning level log messages. The interval to wait before sending an alert e-mail for notification level log messages. 01-28006-0010-20041105 Log & Report Fortinet Inc.

  • Page 363: To Configure Alert Email

    Log & Report Information Apply Note: If more than one log message is collected before an interval is reached, the messages are combined and sent out as one alert email. You can select specific events to trigger alert email in Log Filter, described in filter options”...

  • Page 364: Traffic Log

    You can apply the following filters: The FortiGate unit logs all traffic that is allowed according to the firewall policy settings. The FortiGate unit logs all traffic that violates the firewall policy settings. for more information. 01-28006-0010-20041105 Log & Report “Enabling Fortinet Inc.
  • Page 365 Log & Report System Activity event IPSec negotiation event DHCP service event L2TP/PPTP/PPPoE service event Admin event HA activity event Firewall authentication event Pattern update event Anti-virus log The Anti-virus Log records virus incidents in Web, FTP, and email traffic, such as when the FortiGate unit detects an infected file, blocks a file type, or blocks an oversized file or email.

  • Page 366: Configuring Log Filters

    The FortiGate unit logs all instances of blocked email in SMTP traffic. The FortiGate unit logs all instances of blocked email in POP3 traffic. The FortiGate unit logs all instances of blocked email in IMAP traffic. 01-28006-0010-20041105 Log & Report Fortinet Inc.

  • Page 367: To Enable Traffic Logging For A Firewall Policy

    Log & Report To enable traffic logging for a firewall policy You can enable traffic logging for a firewall policy. All connections accepted by the firewall policy are recorded in the traffic log. Go to Firewall > Policy. Select the Edit icon for a policy. Select Log Traffic.

  • Page 368: Log Access

    Clear log icon. Delete the log entries from the log file (but not the file). Download icon. Download the log as a text or CSV file. View icon. Display the log file through the web-based manager. 01-28006-0010-20041105 Log & Report Fortinet Inc.

  • Page 369: To Download Log Files From The Fortigate Disk

    Log & Report Select the log type you wish to access. Select Disk from the Type list. You can clear or delete, download, or view the log files by selecting the corresponding icon. To download log files from the FortiGate disk When downloading a log file, you can save the log in plain text or CSV format.

  • Page 370: To View Log Messages In The Fortigate Memory Buffer

    Type a search word and select Go. Column settings button. Select to choose columns for log display. Select Raw to switch to an unformatted log message display. Select Formatted to switch to a log message display organized into columns. 01-28006-0010-20041105 Log & Report Fortinet Inc.

  • Page 371: The Detailed Information Column Provides The Entire Raw Log Entry And Is Not Needed Unless The Log Contains Information Not Available In Any Of The Other, More Specific Columns

    Log & Report Figure 186:Column settings for viewing log messages Available fields The fields that you can add to the log message display. Show these fields in this order Move up Move down The Detailed Information column provides the entire raw log entry and is not needed unless the log contains information not available in any of the other, more specific columns.

  • Page 372: Searching Log Messages

    The log message list shows only the logs that meet your log search criteria. 369. 369. The message must contain all of the keywords The message must contain at least one of the keywords The message must contain none of the keywords 01-28006-0010-20041105 Log & Report “Viewing log “Viewing log Fortinet Inc.

  • Page 373: Cli Configuration

    Log & Report CLI configuration This guide only covers Command Line Interface (CLI) commands and command keywords that are not represented in the web-based manager. For complete descriptions of working with CLI commands see the FortiGate CLI Reference Guide. fortilog setting Note: The command keywords for fortilog setting that are not represented in the web- based manager are localid and psksecret.

  • Page 374: Syslogd Setting

    Enter enable to enable the FortiGate unit to produce the log in Comma Separated Value (CSV) format. If you do not enable CSV format the FortiGate unit produces plain text files. 01-28006-0010-20041105 Log & Report Default Availability All models. disable Fortinet Inc.
  • Page 375 Log & Report log syslogd setting command keywords and variables Keywords and variables facility {alert | audit | auth | authpriv | clock | cron | daemon | ftp | kernel | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 | lpr | mail | news...
  • Page 376 If the show command returns you to the prompt, the settings are at default. config log syslogd setting set status enable set server 220.210.200.190 set port 601 set facility user get log syslogd setting show log syslogd setting 01-28006-0010-20041105 Log & Report Fortinet Inc.

  • Page 377: Fortiguard Categories

    FortiGuard categories FortiGuard is a web filtering solution provided by Fortinet. FortiGuard sorts thousands of Web pages into a wide variety of categories that users can allow, block, or monitor. The FortiGate unit accesses the nearest FortiGuard server to determine the category of a requested Web page and then follows the policy configured for that user or interface.
  • Page 378 Sites with content that is gratuitously offensive or shocking, but not violent or frightening. Includes sites devoted in part or whole to scatology and similar topics or to improper language, humor, or behavior. 01-28006-0010-20041105 FortiGuard categories Fortinet Inc.
  • Page 379 FortiGuard categories Table 38: FortiGuard categories Category name 16. Weapons Potentially Non-productive 17. Advertisement 18. Brokerage and Trading 19. Freeware and Software Download 20. Games 21. Internet Communication 22. Pay to Surf 23. Web-based Email Potentially Bandwidth Consuming 24. File Sharing and Storage 25.
  • Page 380 Political Organizations -- Sites sponsored by or providing information about political parties and interest groups focused on elections or legislation. 01-28006-0010-20041105 FortiGuard categories Fortinet Inc.
  • Page 381 FortiGuard categories Table 38: FortiGuard categories Category name 39. Reference Materials 40. Religion 41. Search Engines and Portals 42. Shopping and Auction 43. Social Organizations 44. Society and Lifestyles 45. Special Events 46. Sports 47. Travel 48. Vehicles FortiGate-3000 Administration Guide Description Sites that offer reference-shelf content such as atlases, dictionaries, encyclopedias, formularies,...
  • Page 382 IP addresses. Private IP Addresses -- IP addresses defined in RFC 1918, 'Address Allocation for Private Intranets. Web Hosting -- Sites of organizations that provide hosting services, or top-level domain pages of Web communities. 01-28006-0010-20041105 FortiGuard categories Fortinet Inc.

  • Page 383: Fortigate Maximum Values

    FortiGate maximum values The following table contains the maximum number of table, field, and list entries for FortiGate features. Feature system vdom (NAT/Route) system vdom (Transparent) system zone** system interface system interface secondaryip system interface ip6 prefix list system ipv6_tunnel system accprofile system admin system snmp...
  • Page 384 1000 1000 6000 6000 10000 10000 10000 10000 10000 1024 1024 2000 2000 5000 5000 5000 8000 20000 30000 50000 50000 50000 50000 3000 3000 5000 5000 5000 4000 5000 1000 1000 1024 1024 5000 5000 5000 5000 Fortinet Inc.
  • Page 385 key**...
  • Page 386 2, 25, 50, 100, or 250 VDOMs, determined by firmware. FortiGate model 100A 200A 300A 400A 10, 25, 50, 100, or 250 VDOMs, determined by firmware. 01-28006-0010-20041105 FortiGate maximum values 1000 3000 3600 500A 1000 1000 1000 4000 5000 1000 1000 Fortinet Inc.
  • Page 387 Glossary Connection: A link between machines, applications, processes, and so on that can be logical, physical, or both. DMZ, Demilitarized Zone: Used to host Internet services without allowing unauthorized access to an internal (private) network. Typically, the DMZ contains servers accessible to Internet traffic, such as Web (HTTP) servers, FTP servers, SMTP (email) servers and DNS servers.
  • Page 388 ISP system. Router: A device that connects LANs into an internal network and routes traffic between them. Routing: The process of determining a path to use to send data to its destination.
  • Page 389 SSH, Secure shell: A secure Telnet replacement that you can use to log into another computer over a network and run commands. SSH provides strong secure authentication and secure communications over insecure channels. Subnet: A portion of a network that shares a common address component.
  • Page 390 Glossary 01-28006-0010-20041105 Fortinet Inc.
  • Page 391 Index abr-type 173 access-list 184 active sessions HA monitor 102 address 206 virtual IP 222 administrator account netmask 118, 119 trusted host 119 advertise 180, 194 alert email enabling 363 options 362 anomaly 306 list 306 antivirus 311 antivirus updates 129 through a proxy server 130 area 187 attack updates...
  • Page 392 39 upgrading using the CLI 40, 42 upgrading using the web-base manager 39, 41 Fortilog logging settings 359 fortilog setting 373 Fortinet customer service 30 FortiProtect Distribution Network 126 FortiProtect Distribution Server 126 from IP system status 38...
  • Page 393 Gateway Name 254, 255 HA monitor 102 GRE protocol 270 group ID HA 93 grouping services 217 groups user 247 guaranteed bandwidth 203, 204 HA 90, 92 add a new unit to a functioning cluster 100 cluster ID 102 cluster members 92 configuration 91 configure a FortiGate unit for HA operation 97 configure weighted-round-robin weights 100...
  • Page 394 NTP server 88 setting system date and time 87 one-time schedule creating 219, 221 optimize 322 Optional Information 279 options changing system options 88 OSPF 172 out-interface 285 override master HA 94 P2 Proposal 260 passive-interface 174 01-28006-0010-20041105 Fortinet Inc.
  • Page 395 43 rfc1583-compatible 174 Round-Robin HA schedule 94 routemap 193 router next hop 62 router-id 174 routing 388 configuring 67 policy 153 routing table 388 schedule 218 automatic antivirus and attack definition updates 129 creating one-time 219, 221...
  • Page 396 214, 215 unit priority HA 93 up time HA monitor 102 update push 131 upgrade firmware 39 upgrading firmware using the CLI 40, 42 firmware using the web-based manager 39, 41 Uploading a local certificate 279 01-28006-0010-20041105 Fortinet Inc.

  • Page 397: Vlan Overview

    URL block 332 URL exempt 335 URL options 333 User Group 258 user groups configuring 247 User-defined signatures 304 user-defined TCP services 214, 215 user-defined UDP services 214, 215 Username 257, 266 virtual domain properties 140 virtual IP 222 dynamic port forwarding 226 port forwarding 222 static NAT 222 virus detected...
  • Page 398 Index 01-28006-0010-20041105 Fortinet Inc.

Table of Contents

Save PDF