Fortinet FortiGate 4000 User Manuals

Fortinet

User Manual (English)Quick Setup Guide (English)User Guide (English)

User Manual

Table of Contents

Table of Contents
3
Introduction
15
- Antivirus protection
  16
- Web content filtering
  16
- Email filtering
  17
- Firewall
  17
  - NAT/Route mode
    18
  - Transparent mode
    18
- VLANs and virtual domains
  18
- Network intrusion detection
  18
- VPN
  19
- High availability
  19
- Secure installation, configuration, and management
  20
  - Web-based manager
    20
  - Command line interface
    21
  - Logging and reporting
    21
- Document conventions
  21
- Fortinet documentation
  22
  - Comments on Fortinet technical documentation
    23
- Customer service and technical support
  23
Getting started
25
- Warnings and cautions
  26
  - Warning
    26
- Package contents
  26
- Physical description
  27
- Front panel features
  28
  - FortiBlade-4010 module
    29
  - KVM switch module
    30
- Rear panel features
  31
- Installing hardware
  37
- Turning FortiGate-4000 chassis power on and off
  40
  - Turning on FortiGate-4000 chassis power
    40
  - Turning off FortiGate-4000 chassis power
    41
- Hot swapping modules
  41
- Connecting to the web-based manager
  44
  - Connecting to the FortiGate-4000 internal interface module
    45
  - Connecting to the FortiGate-4000 10/100 out of band management module
    46
- Connecting to the Command Line Interface (CLI)
  47
- Factory default configuration
  48
- Planning the FortiGate configuration
  53
- FortiGate model maximum values matrix
  59
- Next steps
  60
NAT/Route mode installation
61
- Preparing to configure NAT/Route mode
  61
  - Advanced NAT/Route mode settings
    62
  - Out of band management interface
    63
- Using the setup wizard
  63
  - Starting the setup wizard
    63
  - Reconnecting to the web-based manager
    63
- Using the command line interface
  64
  - Configuring the FortiGate unit to operate in NAT/Route mode
    64
    - Configuring NAT/Route mode IP addresses
      64
  - Configuring the out of band management interface
    65
- Connecting the FortiGate unit to your networks
  65
- Configuring your networks
  66
- Completing the configuration
  66
Transparent mode installation
69
- Preparing to configure Transparent mode
  69
  - Out of band management interface
    70
- Using the setup wizard
  70
- Using the command line interface
  71
- Completing the configuration
  72
- Connecting the FortiGate unit to your networks
  73
- Transparent mode configuration examples
  74
High availability
81
- Configuring an HA cluster
  82
- Managing an HA cluster
  87
- Advanced HA options
  95
- Active-Active cluster packet flow
  97
System status
101
- Changing the FortiGate host name
  102
- Changing the FortiGate firmware
  102
- Manual virus definition updates
  114
- Manual attack definition updates
  115
- Displaying the FortiGate serial number
  115
- Displaying the FortiGate up time
  115
- Backing up system settings
  115
- Restoring system settings
  116
- Restoring system settings to factory defaults
  116
- Changing to Transparent mode
  117
- Changing to NAT/Route mode
  117
- Restarting the FortiGate unit
  118
- Shutting down the FortiGate unit
  118
- System status
  118
- Session list
  122
Virus and attack definitions updates and registration
123
- Updating antivirus and attack definitions
  123
- Scheduling updates
  126
- Enabling push updates
  128
- Registering FortiGate units
  133
  - FortiCare Service Contracts
    134
  - Registering the FortiGate unit
    134
- Updating registration information
  136
- Registering a FortiGate unit after an RMA
  140
Network configuration
141
- Configuring zones
  141
  - Adding zones
    142
  - Deleting zones
    142
- Configuring interfaces
  142
- Out of band management
  149
  - Out of band management interface CLI command
    150
    - Syntax description
      150
- VLAN overview
  150
- VLANs in NAT/Route mode
  151
  - Rules for VLAN IDs
    151
  - Rules for VLAN IP addresses
    152
  - Adding VLAN subinterfaces
    152
- Virtual domains in Transparent mode
  153
- Adding DNS server IP addresses
  158
- Configuring routing
  158
- Configuring DHCP services
  162
  - Configuring a DHCP relay agent
    163
  - Configuring a DHCP server
    163
RIP configuration
167
- RIP settings
  167
- Configuring RIP for FortiGate interfaces
  169
- Adding RIP filters
  171
System configuration
175
- Setting system date and time
  175
- Changing system options
  176
  - Modifying the Dead Gateway Detection settings
    177
- Adding and editing administrator accounts
  178
  - Adding new administrator accounts
    178
  - Editing administrator accounts
    179
- Configuring SNMP
  180
  - Configuring the FortiGate unit for SNMP monitoring
    180
  - Configuring FortiGate SNMP support
    180
    - Configuring SNMP access to an interface
      180
    - Configuring SNMP community settings
      181
  - FortiGate MIBs
    182
  - FortiGate traps
    183
    - General FortiGate traps
      183
    - System traps
      183
    - VPN traps
      184
    - NIDS traps
      184
    - Antivirus traps
      184
    - Logging traps
      184
  - Fortinet MIB fields
    185
    - System configuration and status
      185
    - Firewall configuration
      185
    - Users and authentication configuration
      186
    - VPN configuration and status
      186
    - NIDS configuration
      186
    - Antivirus configuration
      186
    - Web filter configuration
      186
    - Logging and reporting configuration
      187
- Replacement messages
  187
  - Customizing replacement messages
    188
  - Customizing alert emails
    189
Firewall configuration
191
- Default firewall configuration
  192
  - Interfaces
    192
  - VLAN subinterfaces
    193
  - Zones
    193
  - Addresses
    193
  - Services
    194
  - Schedules
    194
  - Content profiles
    194
- Adding firewall policies
  194
  - Firewall policy options
    196
    - Source
      196
    - Destination
      196
    - Schedule
      196
    - Service
      196
    - Action
      196
    - NAT
      197
    - VPN Tunnel
      197
    - Traffic Shaping
      197
    - Authentication
      198
    - Anti-Virus & Web filter
      198
    - Log Traffic
      199
    - Comments
      199
- Configuring policy lists
  200
- Addresses
  202
  - Adding addresses
    202
  - Editing addresses
    203
  - Deleting addresses
    204
  - Organizing addresses into address groups
    204
- Services
  205
  - Predefined services
    205
  - Adding custom TCP and UDP services
    208
  - Adding custom ICMP services
    209
  - Adding custom IP services
    209
  - Grouping services
    209
- Schedules
  210
- Virtual IPs
  213
- IP pools
  218
- IP/MAC binding
  220
- Content profiles
  223
Users and authentication
227
- Setting authentication timeout
  228
- Adding user names and configuring authentication
  228
  - Adding user names and configuring authentication
    228
  - Deleting user names from the internal database
    229
- Configuring RADIUS support
  230
  - Adding RADIUS servers
    230
  - Deleting RADIUS servers
    230
- Configuring LDAP support
  231
  - Adding LDAP servers
    231
  - Deleting LDAP servers
    232
- Configuring user groups
  232
  - Adding user groups
    233
  - Deleting user groups
    234
IPSec VPN
235
- Key management
  236
  - Manual Keys
    236
  - Automatic Internet Key Exchange (AutoIKE) with pre-shared keys or certificates
    236
    - AutoIKE with pre-shared keys
      236
    - AutoIKE with certificates
      236
- Manual key IPSec VPNs
  237
  - General configuration steps for a manual key VPN
    237
  - Adding a manual key VPN tunnel
    237
- AutoIKE IPSec VPNs
  239
- Managing digital certificates
  246
  - Obtaining a signed local certificate
    246
  - Obtaining CA certificates
    249
    - Importing CA certificates
      249
- Configuring encrypt policies
  249
  - Adding a source address
    250
  - Adding a destination address
    251
  - Adding an encrypt policy
    251
- IPSec VPN concentrators
  253
- Monitoring and Troubleshooting VPNs
  257
  - Viewing VPN tunnel status
    257
  - Viewing dialup VPN connection status
    258
  - Testing a VPN
    258
PPTP and L2TP VPN
259
- Configuring PPTP
  259
- Configuring L2TP
  265
Network Intrusion Detection System (NIDS)
271
- Detecting attacks
  271
- Preventing attacks
  276
- Logging attacks
  278
  - Logging attack messages to the attack log
    278
  - Reducing the number of NIDS attack log and email messages
    278
    - Automatic message reduction
      278
    - Manual message reduction
      279
Antivirus protection
281
- General configuration steps
  281
- Antivirus scanning
  282
- File blocking
  283
  - Blocking files in firewall traffic
    284
  - Adding file patterns to block
    284
- Blocking oversized files and emails
  285
  - Configuring limits for oversized files and email
    285
- Exempting fragmented email from blocking
  285
- Viewing the virus list
  286
Web filtering
287
- General configuration steps
  287
- Content blocking
  288
- URL blocking
  291
  - Configuring FortiGate Web URL blocking
    291
  - Configuring FortiGate Web pattern blocking
    294
- Configuring Cerberian URL filtering
  294
- Script filtering
  297
  - Enabling script filtering
    297
  - Selecting script filter options
    297
- Exempt URL list
  298
Email filter
301
- General configuration steps
  301
- Email banned word list
  302
- Email block list
  304
- Email exempt list
  305
  - Adding address patterns to the email exempt list
    306
- Adding a subject tag
  306
Logging and reporting
307
- Recording logs
  307
- Filtering log messages
  310
- Configuring traffic logging
  311
- Viewing logs saved to memory
  314
  - Viewing logs
    314
  - Searching logs
    315
- Configuring alert email
  315
  - Adding alert email addresses
    316
  - Testing alert email
    316
  - Enabling alert email
    317
Glossary
319
Index
323

Size:

6.3 MB
Pages:

332
Language:

English

User Guide

Table of Contents

Table of Contents
3
Introduction
13
- About FortiGate Antivirus Firewalls
  13
  - Antivirus protection
    14
  - Web content filtering
    15
  - Spam filtering
    15
  - Firewall
    15
    - NAT/Route mode
      16
    - Transparent mode
      16
  - VLANs and virtual domains
    17
  - Intrusion Prevention System (IPS)
    17
  - VPN
    18
  - High availability
    18
  - Secure installation, configuration, and management
    19
    - Web-based manager
      19
    - Command line interface
      19
    - Logging and reporting
      20
- Document conventions
  20
- FortiGate documentation
  22
  - Comments on Fortinet technical documentation
    22
- Related documentation
  22
- Customer service and technical support
  24
System status
25
- Console access
  25
- Status
  26
  - Viewing system status
    26
    - System status
      26
    - Unit Information
      27
    - Recent Virus Detections
      27
    - Interface Status
      27
    - System Resources
      27
    - History
      28
    - Recent Intrusion Detections
      28
  - Changing unit information
    29
- Session list
  31
- Changing the FortiGate firmware
  32
System network
47
- Interface
  47
  - Interface settings
    48
    - Name
      49
    - Interface
      49
    - VLAN ID
      49
    - Virtual Domain
      50
    - Addressing mode
      50
    - Manual
      50
    - DHCP
      50
    - PPPoE
      51
    - DDNS
      52
    - Ping server
      52
    - Administrative access
      52
    - MTU
      53
    - Log
      53
  - Configuring interfaces
    53
- Zone
  57
  - Zone settings
    58
- Management
  59
- DNS
  60
- Routing table (Transparent Mode)
  61
  - Routing table list
    61
  - Transparent mode route settings
    62
- VLAN overview
  62
  - FortiGate units and VLANs
    63
- VLANs in NAT/Route mode
  63
- VLANs in Transparent mode
  66
- FortiGate IPv6 support
  71
System DHCP
73
- Service
  73
  - DHCP service settings
    74
- Server
  75
  - DHCP server settings
    76
- Exclude range
  77
  - DHCP exclude range settings
    78
- IP/MAC binding
  78
  - DHCP IP/MAC binding settings
    79
- Dynamic IP
  79
System config
81
- System time
  81
- Options
  82
- HA
  84
  - HA configuration
    85
    - Standalone Mode
      85
    - High Availability
      85
    - Cluster Members
      86
    - Mode
      86
    - Group ID
      86
    - Unit Priority
      86
    - Override Master
      87
    - Password
      87
    - Schedule
      88
    - Priorities of Heartbeat Device
      88
    - Heartbeat device IP addresses
      89
    - Monitor priorities
      90
  - Configuring an HA cluster
    90
  - Managing an HA cluster
    94
- SNMP
  97
  - Configuring SNMP
    98
  - SNMP community
    99
  - FortiGate MIBs
    101
  - FortiGate traps
    102
  - Fortinet MIB fields
    103
- Replacement messages
  106
  - Replacement messages list
    106
  - Changing replacement messages
    107
- FortiManager
  108
System administration
109
- Administrators
  109
  - Administrators list
    110
  - Administrators options
    110
    - Using trusted hosts
      111
- Access profiles
  111
  - Access profile list
    112
  - Access profile options
    112
System maintenance
115
- Backup and restore
  115
  - Backing up and Restoring
    116
- Update center
  118
  - Updating antivirus and attack definitions
    120
  - Enabling push updates
    123
    - Push updates when FortiGate IP addresses change
      123
    - Enabling push updates through a NAT device
      124
- Support
  125
  - Sending a bug report
    126
  - Registering a FortiGate unit
    127
- Shutdown
  129
System virtual domain
131
- Virtual domain properties
  132
- Virtual domains
  134
- Configuring virtual domains
  136
Router
141
- Static
  141
  - Static route list
    143
  - Static route options
    144
- Policy
  145
  - Policy route list
    145
  - Policy route options
    146
- RIP
  146
  - General
    147
  - Networks list
    148
  - Networks options
    149
  - Interface list
    149
  - Interface options
    150
  - Distribute list
    151
  - Distribute list options
    152
  - Offset list
    153
  - Offset list options
    153
- Router objects
  154
  - Access list
    154
  - New access list
    154
  - New access list entry
    155
  - Prefix list
    155
  - New Prefix list
    156
  - New prefix list entry
    157
  - Route-map list
    157
  - New Route-map
    158
  - Route-map list entry
    159
  - Key chain list
    160
  - New key chain
    160
  - Key chain list entry
    161
- Monitor
  162
  - Routing monitor list
    162
- CLI configuration
  163
  - get router info ospf
    163
    - Command syntax
      163
    - Examples
      163
  - get router info protocols
    163
    - Command syntax
      163
  - get router info rip
    164
    - Command syntax
      164
    - Examples
      164
  - config router ospf
    164
    - Command syntax pattern
      164
    - Example
      166
    - config area
      167
    - config area command syntax pattern
      167
    - Example
      169
    - config filter-list
      170
    - config filter-list command syntax pattern
      170
    - Example
      171
    - config range
      171
    - config range command syntax pattern
      171
    - Example
      172
    - config virtual-link
      173
    - config virtual link command syntax pattern
      173
    - Example
      175
    - config distribute-list
      175
    - config distribute-list command syntax pattern
      176
    - Example
      176
    - config neighbor
      177
    - config neighbor command syntax pattern
      177
    - Example
      178
    - config network
      179
    - config network command syntax pattern
      179
    - Example
      179
    - config ospf-interface
      180
    - config ospf-interface command syntax pattern
      180
    - Example
      184
    - config redistribute
      184
    - config redistribute command syntax pattern
      185
    - Example
      185
    - config summary-address
      185
    - config summary-address command syntax pattern
      186
    - Example
      186
  - config router static6
    187
    - Command syntax pattern
      187
    - Example
      188
Firewall
189
- Policy
  190
  - How policy matching works
    190
  - Policy list
    190
  - Policy options
    191
  - Advanced policy options
    194
    - Authentication
      194
    - Traffic Shaping
      195
    - Differentiated Services
      195
    - Comments
      196
  - Configuring firewall policies
    196
  - Policy CLI configuration
    197
    - Command syntax pattern
      197
- Address
  198
  - Address list
    199
  - Address options
    199
  - Configuring addresses
    200
  - Address group list
    201
  - Address group options
    201
  - Configuring address groups
    202
- Service
  202
  - Predefined service list
    203
  - Custom service list
    206
  - Custom service options
    206
  - Configuring custom services
    208
  - Service group list
    209
  - Service group options
    209
  - Configuring service groups
    210
- Schedule
  210
  - One-time schedule list
    211
  - One-time schedule options
    211
  - Configuring one-time schedules
    212
  - Recurring schedule list
    212
  - Recurring schedule options
    213
  - Configuring recurring schedules
    213
- Virtual IP
  214
  - Virtual IP list
    215
  - Virtual IP options
    215
  - Configuring virtual IPs
    216
- IP pool
  218
  - IP pool list
    219
  - IP pool options
    219
  - Configuring IP pools
    220
  - IP Pools for firewall policies that use fixed ports
    220
  - IP pools and dynamic NAT
    221
- Protection profile
  221
  - Protection profile list
    222
  - Default protection profiles
    222
  - Protection profile options
    222
  - Configuring protection profiles
    227
  - CLI configuration
    228
    - profile
      228
    - Command syntax pattern
      228
Users and authentication
233
- Setting authentication timeout
  234
- Local
  234
  - Local user list
    234
  - Local user options
    234
- RADIUS
  235
  - RADIUS server list
    235
  - RADIUS server options
    236
- LDAP
  236
  - LDAP server list
    237
  - LDAP server options
    237
- User group
  239
  - User group list
    239
  - User group options
    240
- CLI configuration
  241
  - peer
    241
    - Command syntax pattern
      241
    - Example
      241
  - peergrp
    242
    - Command syntax pattern
      242
    - Example
      242
VPN
245
- Phase 1
  246
  - Phase 1 list
    246
  - Phase 1 basic settings
    247
  - Phase 1 advanced options
    248
  - Configuring XAuth
    249
- Phase 2
  250
  - Phase 2 list
    250
  - Phase 2 basic settings
    251
  - Phase 2 advanced options
    252
- Manual key
  253
  - Manual key list
    254
  - Manual key options
    254
- Concentrator
  255
  - Concentrator list
    255
  - Concentrator options
    256
- Ping Generator
  256
  - Ping generator options
    257
- Monitor
  257
  - Dialup monitor
    258
  - Static IP and dynamic DNS monitor
    258
- PPTP
  259
  - Setting up a PPTP-based VPN
    259
  - Enabling PPTP and specifying a PPTP range
    260
  - Configuring a Windows 2000 client for PPTP
    261
  - Configuring a Windows XP client for PPTP
    261
  - PPTP passthrough
    262
- L2TP
  263
  - Setting up a L2TP-based VPN
    264
  - Enabling L2TP and specifying an L2TP range
    264
  - Configuring a Windows 2000 client for L2TP
    265
  - Configuring a Windows XP client for L2TP
    266
- Certificates
  268
  - Viewing the certificate list
    269
  - Generating a certificate request
    269
  - Installing a signed certificate
    271
  - Enabling VPN access for specific certificate holders
    272
- CLI configuration
  273
  - ipsec phase1
    273
    - Command syntax pattern
      273
    - Example
      275
  - ipsec phase2
    275
    - Command syntax pattern
      275
    - Example
      276
  - ipsec vip
    276
    - Command syntax pattern
      276
    - Example
      277
- Authenticating peers with preshared keys
  278
- Gateway-to-gateway VPN
  278
- Dialup VPN
  279
- Dynamic DNS VPN
  279
- Manual key IPSec VPN
  280
- Adding firewall policies for IPSec VPN tunnels
  280
  - Setting the encryption policy direction
    280
  - Setting the source address for encrypted traffic
    280
  - Setting the destination address for encrypted traffic
    281
  - Adding an IPSec firewall encryption policy
    281
- Internet browsing through a VPN tunnel
  281
  - Configuring Internet browsing through a VPN tunnel
    282
- IPSec VPN in Transparent mode
  283
  - Special rules
    283
- Hub and spoke VPNs
  284
  - Configuring the hub
    284
    - Adding a VPN concentrator
      285
  - Configuring spokes
    286
- Redundant IPSec VPNs
  287
  - Configuring redundant IPSec VPNs
    287
- Configuring IPSec virtual IP addresses
  288
- Troubleshooting
  290
IPS
291
- Protection profile configuration
  291
- IPS updates and information
  291
- Signature
  292
  - Predefined
    292
  - Custom
    296
- Anomaly
  298
  - Anomaly list
    298
  - Configuring an anomaly
    299
  - Anomaly CLI configuration
    301
    - (config ips anomaly) config limit
      301
    - Command syntax pattern
      301
    - Example
      301
- Configuring IPS logging and alert email
  302
- Default fail open setting
  302
Antivirus
303
- Protection profile configuration
  304
- Order of antivirus operations
  304
- Virus list updates and information
  304
- File block
  304
  - File block list
    305
  - Configuring the file block list
    306
- Quarantine
  306
  - Quarantined files list
    306
  - Quarantined files list options
    307
  - AutoSubmit list
    308
  - AutoSubmit list options
    308
  - Configuring the AutoSubmit list
    308
  - Config
    309
- Config
  310
  - Virus list
    310
  - Config
    310
  - Grayware
    311
  - Grayware options
    311
- CLI configuration
  312
  - system global av_failopen
    312
    - Command syntax pattern
      313
    - Example
      313
  - system global optimize
    313
    - Command syntax pattern
      313
    - Example
      314
  - heuristic
    314
    - Command syntax pattern
      314
    - Example
      315
  - quarantine
    315
    - Command syntax pattern
      315
    - antivirus quarantine command keywords and variables
      316
  - service http
    316
    - Command syntax pattern
      316
    - Example
      316
  - service ftp
    317
    - Command syntax pattern
      317
    - Example
      317
  - service pop3
    318
    - Command syntax pattern
      318
    - Example
      318
  - service imap
    318
    - Command syntax pattern
      319
    - Example
      319
  - service smtp
    319
    - Command syntax pattern
      320
    - Example
      320
Web filter
321
- Protection profile configuration
  322
- Order of web filter operations
  322
- Content block
  322
- URL block
  324
  - Web URL block list
    325
  - Web URL block options
    325
  - Configuring the web URL block list
    325
  - Web pattern block list
    326
  - Web pattern block options
    327
  - Configuring web pattern block
    327
- URL exempt
  327
  - URL exempt list
    328
  - URL exempt list options
    328
  - Configuring URL exempt
    328
- Category block
  329
  - FortiGuard managed web filtering service
    329
    - FortiGuard categories and ratings
      329
    - FortiGuard Service Points
      329
    - FortiGuard licensing
      330
    - FortiGuard configuration
      330
  - Category block configuration options
    330
  - Configuring web category block
    331
  - Category block reports
    331
  - Category block reports options
    332
  - Generating a category block report
    332
  - Category block CLI configuration
    332
    - Command syntax pattern
      333
    - Example
      333
- Script filter
  333
  - Web script filter options
    334
Spam filter
335
- Protection profile configuration
  336
- Order of spam filter operations
  337
- FortiShield IP address black list and spam filter
  337
- IP address
  338
  - IP address list
    338
  - IP address options
    338
  - Configuring the IP address list
    338
- RBL & ORDBL
  339
  - RBL & ORDBL list
    340
  - RBL & ORDBL options
    340
  - Configuring the RBL & ORDBL list
    340
- Email address
  341
  - Email address list
    341
  - Email address options
    341
  - Configuring the email address list
    341
- MIME headers
  342
  - MIME headers list
    343
  - MIME headers options
    343
  - Configuring the MIME headers list
    343
- Banned word
  344
  - Banned word list
    344
  - Banned word options
    345
  - Configuring the banned word list
    346
- Using Perl regular expressions
  346
  - Regular expression vs. wildcard match pattern
    346
  - Word boundary
    347
  - Case sensitivity
    347
  - Examples
    348
Log & Report
349
- Log config
  350
  - Log Setting options
    350
    - FortiLog settings
      351
    - Disk settings
      352
    - Memory settings
      353
    - Syslog settings
      353
    - WebTrends settings
      353
  - Alert E-mail options
    354
  - Log filter options
    355
    - Traffic log
      356
    - Event log
      356
    - Anti-virus log
      357
    - Web filter log
      357
    - Attack log
      358
    - Spam filter log
      358
  - Configuring log filters
    358
  - Enabling traffic logging
    358
- Log access
  360
  - Disk log file access
    360
  - Viewing log messages
    361
    - Choosing columns
      362
  - Searching log messages
    364
- CLI configuration
  365
  - fortilog setting
    365
    - Command syntax pattern
      365
    - Example
      366
  - syslogd setting
    366
    - Command syntax pattern
      366
    - Example
      368
FortiGuard categories
369
FortiGate maximum values
375
Glossary
379
Index
383

Size:

5.4 MB
Pages:

390
Language:

English

Quick Setup Guide

Quick Setup Guide

Size:

975 KB
Pages:

2
Language:

English