Fortinet Gate 60D Administration Manual

FortiGate™

Version 4.0

Administration Guide

Visit http://support.fortinet.com to register your FortiGate product. By registering you can

receive product updates, technical support, and FortiGuard services.

FortiGate Administration Guide

Version 4.0

24 April 2009

01-400-89802-20090424

diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means,

electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of

Fortinet, Inc.

Trademarks

Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,

FortiGate®, FortiGate Unified Threat Management System, FortiGuard®, FortiGuard-Antispam,

FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager,

Fortinet®, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and

FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual

companies and products mentioned herein may be the trademarks of their respective owners.

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 3

http://docs.fortinet.com/ • Feedback

Contents

Introduction............................................................................................ 21

Fortinet products .......................................................................................................... 21

About this document .................................................................................................... 21

Document conventions ................................................................................................ 24

IP addresses............................................................................................................. 24

CLI constraints.......................................................................................................... 24

Cautions, Notes and Tips ......................................................................................... 24

Typographical conventions....................................................................................... 25

Registering your Fortinet product............................................................................... 25

Customer service and technical support.................................................................... 25

Training.......................................................................................................................... 26

Fortinet documentation ............................................................................................... 26

Tools and Documentation CD................................................................................... 26

Fortinet Knowledge Center ...................................................................................... 26

Comments on Fortinet technical documentation ..................................................... 26

What’s new in FortiOS 4.0..................................................................... 27

FortiOS 4.0 FortiGate models and features supported ............................................. 28

UTM features grouped under new UTM menu............................................................ 29

Data Leak Prevention.................................................................................................... 29

Application Control....................................................................................................... 29

SSL content scanning and inspection........................................................................ 29

WAN Optimization......................................................................................................... 30

Endpoint control ........................................................................................................... 30

Network Access Control (NAC) quarantine................................................................ 30

IPS extensions............................................................................................................... 31

DoS policies for applying IPS sensors...................................................................... 31

NAC quarantine in DoS Sensors.............................................................................. 31

Adding IPS sensors to a DoS policy from the CLI.................................................... 32

One-arm IDS (sniffer mode) ..................................................................................... 32

IPS interface policies for IPv6 ............................................................................... 33

IPS Packet Logging.................................................................................................. 33

Enhanced Antispam Engine (ASE).............................................................................. 33

WCCP v2 support.......................................................................................................... 33

“Any” interface for firewall policies ............................................................................ 35

Global view of firewall policies.................................................................................... 35

Identity-based firewall policies.................................................................................... 35

Web filtering HTTP upload enhancements................................................................. 36

Contents

FortiGate Version 4.0 Administration Guide

401-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Traffic shaping enhancements .................................................................................... 36

Firewall load balancing virtual IP changes................................................................. 36

User session persistence.......................................................................................... 36

Health Check Monitor............................................................................................... 36

Load balancing server monitor ................................................................................. 36

Per-firewall policy session TTL ................................................................................... 37

Gratuitous ARP for virtual IPs ..................................................................................... 37

Changes to protection profiles.................................................................................... 37

Changes to content archiving...................................................................................... 37

Customizable web-based manager pages.................................................................. 37

Administration over modem ........................................................................................ 38

Auto-bypass and recovery for AMC bridge module .................................................. 38

Rogue Wireless Access Point detection..................................................................... 38

Configurable VDOM and global resource limits......................................................... 38

User authentication monitor ........................................................................................ 39

OCSP and SCEP certificate over HTTPS .................................................................... 39

Adding non-standard ports for firewall authentication............................................. 39

Dynamically assigning VPN client IP addresses from a RADIUS record ................ 40

DHCP over route-based IPSec VPNs........................................................................... 40

SNMP upgraded to v3.0................................................................................................ 40

File Quarantine.............................................................................................................. 41

Customizable SSL VPN web portals ........................................................................... 41

Logging improvements ................................................................................................ 41

Web filtering HTTP POST traffic (blocking or comforting

HTTP post traffic).......................................................................................................... 41

Web-based manager.............................................................................. 43

Common web-based manager tasks........................................................................... 44

Connecting to the web-based manager.................................................................... 44

Changing your FortiGate administrator password.................................................... 45

Changing the web-based manager language........................................................... 46

Changing administrative access to your FortiGate unit............................................ 46

Changing the web-based manager idle timeout....................................................... 47

Connecting to the FortiGate CLI from the web-based manager............................... 47

Button bar features....................................................................................................... 47

Contacting Customer Support..................................................................................... 48

Backing up your FortiGate configuration................................................................... 48

Using FortiGate Online Help ........................................................................................ 49

Searching the online help......................................................................................... 50

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 5

http://docs.fortinet.com/ • Feedback

Logging out ................................................................................................................... 52

Web-based manager pages.......................................................................................... 52

Using the web-based manager menu....................................................................... 52

Using web-based manager lists................................................................................ 53

Adding filters to web-based manager lists................................................................ 53

Using page controls on web-based manager lists.................................................... 57

Using column settings to control the columns displayed.......................................... 58

Using filters with column settings.............................................................................. 59

Web-based manager icons........................................................................................... 60

System Status ........................................................................................ 63

Status page.................................................................................................................... 63

Viewing system status.............................................................................................. 63

Changing system information ..................................................................................... 78

Configuring system time........................................................................................... 78

Changing the FortiGate unit host name.................................................................... 78

Changing the FortiGate firmware ................................................................................ 79

Upgrading to a new firmware version....................................................................... 80

Reverting to a previous firmware version ................................................................. 80

Viewing operational history ......................................................................................... 81

Manually updating FortiGuard definitions.................................................................. 82

Viewing Statistics.......................................................................................................... 83

Viewing the session list............................................................................................. 83

Viewing Content Archive information on the Statistics widget.................................. 84

Viewing the Attack Log............................................................................................. 85

Topology........................................................................................................................ 87

Adding a subnet object............................................................................................. 89

Customizing the topology diagram ........................................................................... 90

Managing firmware versions................................................................. 91

Backing up your configuration.................................................................................... 92

Backing up your configuration through the web-based manager ............................. 92

Backing up your configuration through the CLI......................................................... 92

Backing up your configuration to a USB key ............................................................ 93

Testing firmware before upgrading............................................................................. 94

Upgrading your FortiGate unit..................................................................................... 95

Upgrading to FortiOS 4.0 through the web-based manager..................................... 95

Upgrading to FortiOS 4.0 through the CLI................................................................ 96

Verifying the upgrade................................................................................................ 97

Reverting to a previous firmware image..................................................................... 98

Downgrading to a previous firmware through the web-based manager................... 98

Verifying the downgrade........................................................................................... 99

Downgrading to a previous firmware through the CLI .............................................. 99

Contents

FortiGate Version 4.0 Administration Guide

601-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Restoring your configuration..................................................................................... 101

Restoring your configuration settings in the web-based manager.......................... 101

Restoring your configuration settings in the CLI..................................................... 101

Using virtual domains.......................................................................... 103

Virtual domains........................................................................................................... 103

Benefits of VDOMs................................................................................................. 103

VDOM configuration settings.................................................................................. 104

Global configuration settings .................................................................................. 107

Enabling VDOMs ......................................................................................................... 108

Configuring VDOMs and global settings .................................................................. 109

VDOM licenses....................................................................................................... 109

Creating a new VDOM............................................................................................ 110

Working with VDOMs and global settings............................................................... 111

Adding interfaces to a VDOM................................................................................. 113

Inter-VDOM links .................................................................................................... 113

Assigning an interface to a VDOM.......................................................................... 114

Assigning an administrator to a VDOM................................................................... 115

Changing the management VDOM......................................................................... 116

Configuring global and VDOM resource limits ........................................................ 116

VDOM resource limits............................................................................................. 117

Global resource limits............................................................................................. 118

System Network................................................................................... 119

Interfaces ..................................................................................................................... 119

Switch Mode........................................................................................................... 122

Interface settings .................................................................................................... 123

Creating an 802.3ad aggregate interface............................................................... 127

Creating a redundant interface............................................................................... 128

Configuring DHCP on an interface ......................................................................... 130

Configuring an interface for PPPoE........................................................................ 131

Configuring Dynamic DNS on an interface............................................................. 132

Configuring a virtual IPSec interface ...................................................................... 133

Configuring interfaces with CLI commands............................................................ 134

Administrative access to an interface..................................................................... 135

Interface MTU packet size...................................................................................... 135

Secondary IP Addresses........................................................................................ 136

Configuring zones....................................................................................................... 138

Configuring the modem interface.............................................................................. 139

Configuring modem settings................................................................................... 140

Redundant mode configuration............................................................................... 142

Standalone mode configuration.............................................................................. 143

Adding firewall policies for modem connections..................................................... 144

Connecting and disconnecting the modem............................................................. 144

Checking modem status......................................................................................... 144

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 7

http://docs.fortinet.com/ • Feedback

Configuring Networking Options............................................................................... 145

DNS Servers........................................................................................................... 146

Dead gateway detection......................................................................................... 146

Web Proxy.................................................................................................................... 147

Routing table (Transparent Mode)............................................................................. 149

Transparent mode route settings............................................................................ 149

VLAN overview............................................................................................................ 150

FortiGate units and VLANs..................................................................................... 151

VLANs in NAT/Route mode........................................................................................ 151

Rules for VLAN IDs................................................................................................. 152

Rules for VLAN IP addresses................................................................................. 152

Adding VLAN subinterfaces.................................................................................... 153

VLANs in Transparent mode...................................................................................... 154

Rules for VLAN IDs................................................................................................. 156

Transparent mode virtual domains and VLANs...................................................... 156

Troubleshooting ARP Issues.................................................................................. 157

System Wireless................................................................................... 159

FortiWiFi wireless interfaces ..................................................................................... 159

Channel assignments................................................................................................. 160

IEEE 802.11a channel numbers............................................................................. 160

IEEE 802.11b channel numbers............................................................................. 160

IEEE 802.11g channel numbers............................................................................. 161

Wireless settings......................................................................................................... 162

Adding a wireless interface..................................................................................... 163

Wireless MAC Filter .................................................................................................... 165

Managing the MAC Filter list................................................................................... 166

Wireless Monitor ......................................................................................................... 167

Rogue AP detection.................................................................................................... 168

Viewing wireless access points .............................................................................. 168

System DHCP....................................................................................... 171

FortiGate DHCP servers and relays .......................................................................... 171

Configuring DHCP services ....................................................................................... 172

Configuring an interface as a DHCP relay agent.................................................... 173

Configuring a DHCP server.................................................................................... 173

Viewing address leases.............................................................................................. 175

Reserving IP addresses for specific clients............................................................ 175

Contents

FortiGate Version 4.0 Administration Guide

801-400-89802-20090424

http://docs.fortinet.com/ • Feedback

System Config...................................................................................... 177

HA................................................................................................................................. 177

HA options.............................................................................................................. 177

Cluster members list............................................................................................... 180

Viewing HA statistics .............................................................................................. 182

Changing subordinate unit host name and device priority...................................... 183

Disconnecting a cluster unit from a cluster............................................................. 184

SNMP............................................................................................................................ 185

Configuring SNMP.................................................................................................. 186

Configuring an SNMP community........................................................................... 186

Fortinet MIBs .......................................................................................................... 188

Fortinet and FortiGate traps.................................................................................... 189

Fortinet and FortiGate MIB fields............................................................................ 192

Replacement messages ............................................................................................. 194

Replacement messages list.................................................................................... 195

Changing replacement messages.......................................................................... 196

Mail replacement messages................................................................................... 197

HTTP replacement messages................................................................................ 197

FTP replacement messages................................................................................... 198

NNTP replacement messages................................................................................ 199

Alert Mail replacement messages........................................................................... 199

Spam replacement messages................................................................................ 200

Administration replacement message..................................................................... 200

Authentication replacement messages................................................................... 201

FortiGuard Web Filtering replacement messages.................................................. 202

IM and P2P replacement messages....................................................................... 203

Endpoint control replacement message ................................................................. 204

NAC quarantine replacement messages................................................................ 204

SSL VPN replacement message............................................................................ 205

Replacement message tags................................................................................... 205

Operation mode and VDOM management access ................................................... 206

Changing operation mode ...................................................................................... 206

Management access............................................................................................... 207

System Admin...................................................................................... 209

Administrators............................................................................................................. 209

Viewing the administrators list................................................................................ 211

Configuring an administrator account..................................................................... 212

Configuring regular (password) authentication for administrators.......................... 214

Configuring remote authentication for administrators............................................. 214

Configuring PKI certificate authentication for administrators.................................. 220

Admin profiles............................................................................................................. 222

Viewing the admin profiles list ................................................................................ 224

Configuring an admin profile................................................................................... 225

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 9

http://docs.fortinet.com/ • Feedback

Central Management................................................................................................... 226

Settings........................................................................................................................ 228

Monitoring administrators.......................................................................................... 229

FortiGate IPv6 support ............................................................................................... 230

Customizable web-based manager ........................................................................... 231

System Certificates.............................................................................. 243

Local Certificates ....................................................................................................... 244

Generating a certificate request.............................................................................. 245

Downloading and submitting a certificate request.................................................. 246

Importing a signed server certificate....................................................................... 247

Importing an exported server certificate and private key........................................ 247

Importing separate server certificate and private key files...................................... 248

Remote Certificates .................................................................................................... 248

Importing Remote (OCSP) certificates ................................................................... 249

CA Certificates ............................................................................................................ 249

Importing CA certificates......................................................................................... 250

CRL............................................................................................................................... 251

Importing a certificate revocation list ...................................................................... 251

System Maintenance............................................................................ 253

About the Maintenance menu.................................................................................... 253

Backing up and restoring........................................................................................... 254

Basic backup and restore options........................................................................... 255

Upgrading and downgrading firmware.................................................................... 259

Upgrading and downgrading firmware through FortiGuard .................................... 259

Configuring advanced options................................................................................ 260

Managing configuration revisions............................................................................. 261

Using script files ......................................................................................................... 262

Creating script files................................................................................................. 263

Uploading script files............................................................................................... 264

Configuring FortiGuard Services .............................................................................. 264

FortiGuard Distribution Network ............................................................................. 264

FortiGuard services ................................................................................................ 265

Configuring the FortiGate unit for FDN and FortiGuard

subscription services .............................................................................................. 266

Troubleshooting FDN connectivity ........................................................................... 271

Updating antivirus and attack definitions................................................................. 271

Enabling push updates............................................................................................... 273

Enabling push updates when a FortiGate unit IP address changes....................... 273

Enabling push updates through a NAT device ....................................................... 274

Adding VDOM Licenses.............................................................................................. 276

Contents

FortiGate Version 4.0 Administration Guide

10 01-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Router Static ........................................................................................ 277

Routing concepts ....................................................................................................... 277

How the routing table is built .................................................................................. 278

How routing decisions are made ........................................................................... 278

Multipath routing and determining the best route ................................................... 278

Route priority ......................................................................................................... 279

Blackhole Route...................................................................................................... 279

Static Route ................................................................................................................ 280

Working with static routes ...................................................................................... 280

Default route and default gateway ......................................................................... 281

Adding a static route to the routing table ............................................................... 284

Policy Route ............................................................................................................... 285

Adding a policy route.............................................................................................. 286

Moving a policy route.............................................................................................. 287

Router Dynamic.................................................................................... 289

RIP ................................................................................................................................ 289

Viewing and editing basic RIP settings................................................................... 290

Selecting advanced RIP options............................................................................. 292

Configuring a RIP-enabled interface....................................................................... 293

OSPF ............................................................................................................................ 294

Defining an OSPF AS—Overview .......................................................................... 295

Configuring basic OSPF settings............................................................................ 296

Selecting advanced OSPF options......................................................................... 298

Defining OSPF areas.............................................................................................. 299

Specifying OSPF networks..................................................................................... 300

Selecting operating parameters for an OSPF interface.......................................... 301

BGP .............................................................................................................................. 302

Viewing and editing BGP settings........................................................................... 303

Multicast....................................................................................................................... 304

Viewing and editing multicast settings.................................................................... 305

Overriding the multicast settings on an interface.................................................... 306

Multicast destination NAT....................................................................................... 306

Bi-directional Forwarding Detection (BFD) .............................................................. 307

Configuring BFD..................................................................................................... 307

Customizable routing widgets................................................................................... 309

Access List.............................................................................................................. 309

Distribute List.......................................................................................................... 310

Key Chain............................................................................................................... 310

Offset List................................................................................................................ 311

Prefix List................................................................................................................ 312

Route Map.............................................................................................................. 312

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 11

http://docs.fortinet.com/ • Feedback

Router Monitor ..................................................................................... 315

Viewing routing information ...................................................................................... 315

Searching the FortiGate routing table....................................................................... 317

Firewall Policy...................................................................................... 319

How list order affects policy matching ..................................................................... 319

Moving a policy to a different position in the policy list........................................... 320

Multicast policies ........................................................................................................ 321

Viewing the firewall policy list ................................................................................... 321

Configuring firewall policies...................................................................................... 323

Adding authentication to firewall policies................................................................ 327

Identity-based firewall policy options (non-SSL-VPN)............................................ 328

IPSec firewall policy options................................................................................... 330

Configuring SSL VPN identity-based firewall policies............................................. 331

Endpoint Compliance Check options...................................................................... 336

DoS policies................................................................................................................. 337

Viewing the DoS policy list...................................................................................... 337

Configuring DoS policies ........................................................................................ 338

Firewall policy examples............................................................................................ 339

Scenario one: SOHO-sized business..................................................................... 339

Scenario two: enterprise-sized business................................................................ 342

Firewall Address .................................................................................. 345

About firewall addresses............................................................................................ 345

Viewing the firewall address list................................................................................ 346

Configuring addresses............................................................................................... 347

Viewing the address group list.................................................................................. 348

Configuring address groups...................................................................................... 348

Firewall Service.................................................................................... 351

Viewing the predefined service list........................................................................... 351

Viewing the custom service list................................................................................. 356

Configuring custom services..................................................................................... 357

Viewing the service group list ................................................................................... 359

Configuring service groups ....................................................................................... 359

Firewall Schedule................................................................................. 361

Viewing the recurring schedule list........................................................................... 361

Configuring recurring schedules .............................................................................. 362

Viewing the one-time schedule list ........................................................................... 362

Configuring one-time schedules ............................................................................... 363

Contents

FortiGate Version 4.0 Administration Guide

12 01-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Firewall Virtual IP................................................................................. 365

How virtual IPs map connections through FortiGate units..................................... 365

Inbound connections............................................................................................... 365

Outbound connections............................................................................................ 368

VIP requirements.................................................................................................... 369

Viewing the virtual IP list............................................................................................ 369

Configuring virtual IPs................................................................................................ 370

Adding a static NAT virtual IP for a single IP address............................................ 372

Adding a static NAT virtual IP for an IP address range .......................................... 373

Adding static NAT port forwarding for a single IP address

and a single port..................................................................................................... 375

Adding static NAT port forwarding for an IP address range

and a port range ..................................................................................................... 377

Adding dynamic virtual IPs ..................................................................................... 378

Adding a virtual IP with port translation only........................................................... 379

Virtual IP Groups......................................................................................................... 380

Viewing the VIP group list.......................................................................................... 380

Configuring VIP groups.............................................................................................. 380

IP pools........................................................................................................................ 381

IP pools and dynamic NAT..................................................................................... 382

IP Pools for firewall policies that use fixed ports..................................................... 382

Source IP address and IP pool address matching.................................................. 382

Viewing the IP pool list............................................................................................... 383

Configuring IP Pools................................................................................................... 383

Double NAT: combining IP pool with virtual IP........................................................ 384

Adding NAT firewall policies in transparent mode.................................................. 386

Firewall Load Balance ......................................................................... 389

How load balancer works........................................................................................... 389

Configuring virtual servers ........................................................................................ 390

Configuring real servers............................................................................................. 392

Configuring health check monitors........................................................................... 393

Monitoring the servers ............................................................................................... 395

Firewall Protection Profile................................................................... 397

What is a protection profile?...................................................................................... 397

Adding a protection profile to a firewall policy........................................................ 398

Default protection profiles ......................................................................................... 398

Viewing the protection profile list ............................................................................. 399

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 13

http://docs.fortinet.com/ • Feedback

SSL content scanning and inspection...................................................................... 399

Supported FortiGate models................................................................................... 400

Setting up certificates to avoid client warnings....................................................... 400

Configuring SSL content scanning and inspection................................................. 402

Configuring a protection profile ................................................................................ 404

Protocol recognition options ................................................................................... 405

Anti-Virus options.................................................................................................... 407

IPS options ............................................................................................................. 411

Web Filtering options.............................................................................................. 411

FortiGuard Web Filtering options............................................................................ 413

Spam Filtering options............................................................................................ 416

Data Leak Prevention Sensor options.................................................................... 419

Application Control options..................................................................................... 420

Logging options ...................................................................................................... 421

Traffic Shaping..................................................................................... 423

Guaranteed bandwidth and maximum bandwidth................................................... 423

Traffic priority.............................................................................................................. 424

Traffic shaping considerations.................................................................................. 424

Configuring traffic shaping........................................................................................ 425

SIP support........................................................................................... 427

VoIP and SIP................................................................................................................ 427

The FortiGate unit and VoIP security........................................................................ 429

SIP NAT.................................................................................................................. 429

How SIP support works.............................................................................................. 431

Configuring SIP........................................................................................................... 432

Enabling SIP support and setting rate limiting from the web-based manager........ 432

Enabling SIP support from the CLI......................................................................... 433

Enabling SIP logging .............................................................................................. 434

Enabling advanced SIP features in an application list............................................ 434

AntiVirus............................................................................................... 439

Order of operations..................................................................................................... 439

Antivirus tasks ............................................................................................................ 440

FortiGuard antivirus................................................................................................ 441

Antivirus settings and controls ................................................................................. 441

File Filter ...................................................................................................................... 443

Built-in patterns and supported file types................................................................ 443

Viewing the file filter list catalog.............................................................................. 444

Creating a new file filter list..................................................................................... 444

Viewing the file filter list .......................................................................................... 445

Configuring the file filter list..................................................................................... 445

Contents

FortiGate Version 4.0 Administration Guide

14 01-400-89802-20090424

http://docs.fortinet.com/ • Feedback

File Quarantine............................................................................................................ 446

Viewing the File Quarantine list.............................................................................. 447

Viewing the AutoSubmit list.................................................................................... 448

Configuring the AutoSubmit list .............................................................................. 449

Configuring quarantine options............................................................................... 449

Viewing the virus database information ................................................................... 451

Viewing and configuring the grayware list............................................................... 452

Antivirus CLI configuration........................................................................................ 453

Intrusion Protection............................................................................. 455

About intrusion protection......................................................................................... 455

Intrusion Protection settings and controls............................................................... 456

When to use Intrusion Protection............................................................................ 456

Signatures.................................................................................................................... 456

Viewing the predefined signature list...................................................................... 457

Using display filters................................................................................................. 458

Custom signatures...................................................................................................... 459

Viewing the custom signature list ........................................................................... 459

Creating custom signatures.................................................................................... 459

Protocol decoders....................................................................................................... 460

Viewing the protocol decoder list............................................................................ 460

Upgrading the IPS protocol decoder list................................................................. 461

IPS sensors.................................................................................................................. 461

Viewing the IPS sensor list..................................................................................... 461

Adding an IPS sensor............................................................................................. 462

Configuring IPS sensors......................................................................................... 462

Configuring filters.................................................................................................... 464

Configuring pre-defined and custom overrides....................................................... 465

Packet logging........................................................................................................ 467

DoS sensors................................................................................................................ 469

Viewing the DoS sensor list.................................................................................... 470

Configuring DoS sensors........................................................................................ 470

Understanding the anomalies................................................................................. 472

Intrusion protection CLI configuration ..................................................................... 472

Web Filter.............................................................................................. 475

Order of web filtering.................................................................................................. 475

How web filtering works............................................................................................. 475

Web filter controls....................................................................................................... 476

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 15

http://docs.fortinet.com/ • Feedback

Web content block ...................................................................................................... 478

Viewing the web content block list catalog ............................................................. 479

Creating a new web content block list .................................................................... 479

Viewing the web content block list.......................................................................... 479

Configuring the web content block list.................................................................... 480

Viewing the web content exempt list catalog.......................................................... 481

Creating a new web content exempt list................................................................. 482

Viewing the web content exempt list....................................................................... 482

Configuring the web content exempt list................................................................. 483

URL filter...................................................................................................................... 483

Viewing the URL filter list catalog........................................................................... 484

Creating a new URL filter list.................................................................................. 484

Viewing the URL filter list........................................................................................ 485

Configuring the URL filter list.................................................................................. 485

URL formats............................................................................................................ 486

Moving URLs in the URL filter list........................................................................... 487

FortiGuard - Web Filter............................................................................................... 487

Configuring FortiGuard Web Filtering..................................................................... 488

Viewing the override list.......................................................................................... 488

Configuring administrative override rules ............................................................... 489

Creating local categories........................................................................................ 491

Viewing the local ratings list.................................................................................... 491

Configuring local ratings......................................................................................... 492

Category block CLI configuration............................................................................ 493

Antispam............................................................................................... 495

Antispam...................................................................................................................... 495

Order of spam filtering............................................................................................ 495

Anti-spam filter controls.......................................................................................... 496

Banned word ............................................................................................................... 498

Viewing the banned word list catalog ..................................................................... 498

Creating a new banned word list ............................................................................ 499

Viewing the antispam banned word list .................................................................. 499

Adding words to the banned word list..................................................................... 500

IP address and email address black/white lists....................................................... 501

Viewing the antispam IP address list catalog ......................................................... 501

Creating a new antispam IP address list ................................................................ 501

Viewing the antispam IP address list...................................................................... 502

Adding an antispam IP address.............................................................................. 503

Viewing the antispam email address list catalog.................................................... 503

Creating a new antispam email address list........................................................... 504

Viewing the antispam email address list................................................................. 504

Configuring the antispam email address list........................................................... 505

Contents

FortiGate Version 4.0 Administration Guide

16 01-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Advanced antispam configuration ............................................................................ 505

config spamfilter mheader ...................................................................................... 505

config spamfilter dnsbl............................................................................................ 506

Using wildcards and Perl regular expressions ........................................................ 506

Perl regular expression formats.............................................................................. 507

Example regular expressions ................................................................................. 508

Data Leak Prevention........................................................................... 511

DLP Sensors................................................................................................................ 511

Viewing the DLP sensor list.................................................................................... 511

Adding and configuring a DLP sensor.................................................................... 512

Adding or editing a rule in a DLP sensor................................................................ 513

DLP Rules .................................................................................................................... 515

Viewing the DLP rule list......................................................................................... 515

Adding or configuring DLP rules............................................................................. 516

DLP Compound Rules ................................................................................................ 519

Viewing the DLP compound rule list....................................................................... 520

Adding and configuring DLP compound rules ........................................................ 520

Application Control.............................................................................. 523

What is application control?...................................................................................... 523

FortiGuard application control database.................................................................. 523

Viewing the application control lists......................................................................... 524

Creating a new application control list ..................................................................... 524

Configuring an application control list ..................................................................... 525

Adding or configuring an application control list entry.......................................... 526

Application control statistics..................................................................................... 527

IPSec VPN............................................................................................. 531

Overview of IPSec VPN configuration....................................................................... 531

Policy-based versus route-based VPNs ................................................................... 532

Auto Key ...................................................................................................................... 533

Creating a new phase 1 configuration.................................................................... 534

Defining phase 1 advanced settings....................................................................... 536

Creating a new phase 2 configuration.................................................................... 538

Defining phase 2 advanced settings....................................................................... 539

Manual Key .................................................................................................................. 541

Creating a new manual key configuration .............................................................. 542

Internet browsing configuration................................................................................ 544

Concentrator ............................................................................................................... 544

Defining concentrator options................................................................................. 545

Monitoring VPNs ......................................................................................................... 545

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 17

http://docs.fortinet.com/ • Feedback

PPTP VPN ............................................................................................. 547

PPTP configuration using FortiGate web-based manager...................................... 547

PPTP configuration using CLI commands ............................................................... 549

SSL VPN................................................................................................ 551

ssl.root ......................................................................................................................... 551

Configuring SSL VPN ................................................................................................. 552

Monitoring SSL VPN sessions................................................................................... 553

SSL VPN web portal.................................................................................................... 554

Default web portal configurations............................................................................. 554

General tab............................................................................................................. 556

Advanced tab.......................................................................................................... 556

Adding and editing widgets..................................................................................... 558

Session Information widget..................................................................................... 559

Bookmarks widget .................................................................................................. 559

Connection Tool widget.......................................................................................... 563

Tunnel Mode widget ............................................................................................... 564

User....................................................................................................... 567

Getting started - User authentication........................................................................ 567

Local user accounts ................................................................................................... 568

Configuring Local user accounts ............................................................................ 568

Remote......................................................................................................................... 571

RADIUS ........................................................................................................................ 571

Configuring a RADIUS server................................................................................. 572

Dynamically assigning VPN client IP addresses

from a RADIUS record.......................................................................................... 573

LDAP ............................................................................................................................ 575

Configuring an LDAP server................................................................................... 575

TACACS+..................................................................................................................... 578

Configuring TACACS+ servers............................................................................... 578

Directory Service......................................................................................................... 579

Configuring a Directory Service server................................................................... 581

PKI ............................................................................................................................... 581

Configuring peer users and peer groups................................................................ 582

User Group .................................................................................................................. 583

Firewall user groups ............................................................................................... 584

Directory Service user groups ................................................................................ 585

SSL VPN user groups............................................................................................. 585

Viewing the User group list..................................................................................... 586

Configuring a user group........................................................................................ 586

Configuring FortiGuard Web filtering override options............................................ 589

Contents

FortiGate Version 4.0 Administration Guide

18 01-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Options......................................................................................................................... 590

Monitor......................................................................................................................... 591

Firewall user monitor list......................................................................................... 591

IPSEC monitor list................................................................................................... 592

SSL VPN monitor list.............................................................................................. 593

IM user monitor list ................................................................................................. 594

NAC quarantine and the Banned User list................................................................ 595

NAC quarantine and DLP....................................................................................... 595

NAC quarantine and DLP replacement messages................................................. 595

Configuring NAC quarantine................................................................................... 596

The Banned User list.............................................................................................. 596

WAN optimization and web caching .................................................. 599

Frequently asked questions about FortiGate WAN optimization........................... 599

Overview of FortiGate WAN optimization................................................................. 601

WAN optimization tunnels....................................................................................... 602

WAN optimization peer authentication.................................................................... 602

Authentication Groups............................................................................................ 603

WAN optimization rules and firewall policies.......................................................... 603

WAN optimization Transparent mode..................................................................... 604

FortiGate models that support WAN optimization................................................... 604

Configuring WAN optimization.................................................................................. 605

How list order affects rule matching........................................................................ 606

Moving a rule to a different position in the rule list.................................................. 607

Configuring a WAN optimization rule ....................................................................... 608

Web caching................................................................................................................ 610

Web cache only topology........................................................................................ 611

Configuring web cache only WAN optimization...................................................... 611

Configuring client/server (active-passive) web caching.......................................... 612

Configuring peer to peer web caching.................................................................... 614

Client/server or active passive WAN optimization................................................... 617

Configuring client/server (active-passive) WAN optimization................................. 617

Peer to peer WAN optimization.................................................................................. 620

Configuring peer to peer WAN optimization ........................................................... 620

About WAN optimization addresses....................................................................... 622

Protocol optimization ................................................................................................. 623

Byte caching................................................................................................................ 624

SSL offloading for WAN optimization and web caching ......................................... 624

Example configuration: SSL offloading for a WAN optimization tunnel.................. 625

SSL offloading and reverse proxy web caching for an internet web server............ 627

Secure tunnelling........................................................................................................ 630

WAN optimization over IPSec VPN........................................................................ 630

Contents

FortiGate Version 4.0 Administration Guide

01-400-89802-20090424 19

http://docs.fortinet.com/ • Feedback

WAN optimization with FortiClient ............................................................................ 630

Configuring WAN optimization storage.................................................................... 631

Example WAN optimization iSCSI configuration .................................................... 632

About partition labels.............................................................................................. 633

WAN optimization and HA.......................................................................................... 634

Configuring peers ....................................................................................................... 634

Configuring authentication groups........................................................................... 635

Details about WAN optimization peer authentication.............................................. 636

Monitoring WAN optimization.................................................................................... 637

Changing web cache settings.................................................................................... 638

Endpoint control .................................................................................. 641

Configuring endpoint control .................................................................................... 641

Viewing FortiClient required version information.................................................... 642

Configuring FortiClient required version and installer download ............................ 642

Viewing and configuring the software detection list................................................ 643

Monitoring endpoints ................................................................................................. 644

Log&Report .......................................................................................... 647

FortiGate logging ........................................................................................................ 647

FortiGuard Analysis and Management Service........................................................ 648

FortiGuard Analysis and Management Service portal web site.............................. 649

Log severity levels...................................................................................................... 649

High Availability cluster logging ............................................................................... 650

Storing logs ................................................................................................................. 650

Logging to a FortiAnalyzer unit............................................................................... 650

Connecting to FortiAnalyzer using Automatic Discovery........................................ 651

Testing the FortiAnalyzer configuration.................................................................. 652

Logging to a FortiGuard Analysis server ................................................................ 653

Logging to memory................................................................................................. 654

Logging to a Syslog server..................................................................................... 654

Logging to WebTrends ........................................................................................... 655

Log types..................................................................................................................... 657

Traffic log................................................................................................................ 657

Example configuration: logging all FortiGate traffic................................................ 658

Event log................................................................................................................. 659

Data Leak Prevention log ....................................................................................... 660

Application Control log............................................................................................ 660

Antivirus log............................................................................................................ 660

Web filter log........................................................................................................... 661

Spam filter log......................................................................................................... 661

Attack log (IPS)....................................................................................................... 661

Contents

FortiGate Version 4.0 Administration Guide

20 01-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Accessing Logs........................................................................................................... 662

Accessing logs stored in memory........................................................................... 662

Accessing logs stored on the hard disk.................................................................. 662

Accessing logs stored on the FortiAnalyzer unit..................................................... 663

Accessing logs stored on the FortiGuard Analysis server...................................... 664

Viewing log information ............................................................................................. 664

Customizing the display of log messages................................................................ 665

Column settings...................................................................................................... 666

Filtering log messages............................................................................................ 667

Content Archive .......................................................................................................... 667

Content archiving and data leak prevention ........................................................... 668

Configuring spam email message content archiving.............................................. 668

Configuring VoIP content archiving ........................................................................ 669

Viewing content archives........................................................................................ 670

Alert Email ................................................................................................................... 670

Configuring Alert Email........................................................................................... 672

Reports......................................................................................................................... 673

Viewing basic traffic reports.................................................................................... 673

FortiAnalyzer report schedules............................................................................... 674

Viewing FortiAnalyzer reports................................................................................. 677

Printing your FortiAnalyzer report........................................................................... 677

Index...................................................................................................... 679

Page is loading ...

Fortinet Gate 60D Administration Manual

Fortinet Gate 60D Administration Manual

Related papers

Other documents