Page is loading ...
FortiGate Administration Guide
Version 4.0
24 April 2009
01-400-89802-20090424
© Copyright 2009 Fortinet, Inc. All rights reserved. No part of this publication including text, examples,
diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of
Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,
FortiGate®, FortiGate Unified Threat Management System, FortiGuard®, FortiGuard-Antispam,
FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager,
Fortinet®, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and
FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual
companies and products mentioned herein may be the trademarks of their respective owners.
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 3
http://docs.fortinet.com/ • Feedback
Contents
Introduction............................................................................................ 21
Fortinet products .......................................................................................................... 21
About this document .................................................................................................... 21
Document conventions ................................................................................................ 24
IP addresses............................................................................................................. 24
CLI constraints.......................................................................................................... 24
Cautions, Notes and Tips ......................................................................................... 24
Typographical conventions....................................................................................... 25
Registering your Fortinet product............................................................................... 25
Customer service and technical support.................................................................... 25
Training.......................................................................................................................... 26
Fortinet documentation ............................................................................................... 26
Tools and Documentation CD................................................................................... 26
Fortinet Knowledge Center ...................................................................................... 26
Comments on Fortinet technical documentation ..................................................... 26
What’s new in FortiOS 4.0..................................................................... 27
FortiOS 4.0 FortiGate models and features supported ............................................. 28
UTM features grouped under new UTM menu............................................................ 29
Data Leak Prevention.................................................................................................... 29
Application Control....................................................................................................... 29
SSL content scanning and inspection........................................................................ 29
WAN Optimization......................................................................................................... 30
Endpoint control ........................................................................................................... 30
Network Access Control (NAC) quarantine................................................................ 30
IPS extensions............................................................................................................... 31
DoS policies for applying IPS sensors...................................................................... 31
NAC quarantine in DoS Sensors.............................................................................. 31
Adding IPS sensors to a DoS policy from the CLI.................................................... 32
One-arm IDS (sniffer mode) ..................................................................................... 32
IPS interface policies for IPv6 ............................................................................... 33
IPS Packet Logging.................................................................................................. 33
Enhanced Antispam Engine (ASE).............................................................................. 33
WCCP v2 support.......................................................................................................... 33
“Any” interface for firewall policies ............................................................................ 35
Global view of firewall policies.................................................................................... 35
Identity-based firewall policies.................................................................................... 35
Web filtering HTTP upload enhancements................................................................. 36
Contents
FortiGate Version 4.0 Administration Guide
401-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Traffic shaping enhancements .................................................................................... 36
Firewall load balancing virtual IP changes................................................................. 36
User session persistence.......................................................................................... 36
Health Check Monitor............................................................................................... 36
Load balancing server monitor ................................................................................. 36
Per-firewall policy session TTL ................................................................................... 37
Gratuitous ARP for virtual IPs ..................................................................................... 37
Changes to protection profiles.................................................................................... 37
Changes to content archiving...................................................................................... 37
Customizable web-based manager pages.................................................................. 37
Administration over modem ........................................................................................ 38
Auto-bypass and recovery for AMC bridge module .................................................. 38
Rogue Wireless Access Point detection..................................................................... 38
Configurable VDOM and global resource limits......................................................... 38
User authentication monitor ........................................................................................ 39
OCSP and SCEP certificate over HTTPS .................................................................... 39
Adding non-standard ports for firewall authentication............................................. 39
Dynamically assigning VPN client IP addresses from a RADIUS record ................ 40
DHCP over route-based IPSec VPNs........................................................................... 40
SNMP upgraded to v3.0................................................................................................ 40
File Quarantine.............................................................................................................. 41
Customizable SSL VPN web portals ........................................................................... 41
Logging improvements ................................................................................................ 41
Web filtering HTTP POST traffic (blocking or comforting
HTTP post traffic).......................................................................................................... 41
Web-based manager.............................................................................. 43
Common web-based manager tasks........................................................................... 44
Connecting to the web-based manager.................................................................... 44
Changing your FortiGate administrator password.................................................... 45
Changing the web-based manager language........................................................... 46
Changing administrative access to your FortiGate unit............................................ 46
Changing the web-based manager idle timeout....................................................... 47
Connecting to the FortiGate CLI from the web-based manager............................... 47
Button bar features....................................................................................................... 47
Contacting Customer Support..................................................................................... 48
Backing up your FortiGate configuration................................................................... 48
Using FortiGate Online Help ........................................................................................ 49
Searching the online help......................................................................................... 50
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 5
http://docs.fortinet.com/ • Feedback
Logging out ................................................................................................................... 52
Web-based manager pages.......................................................................................... 52
Using the web-based manager menu....................................................................... 52
Using web-based manager lists................................................................................ 53
Adding filters to web-based manager lists................................................................ 53
Using page controls on web-based manager lists.................................................... 57
Using column settings to control the columns displayed.......................................... 58
Using filters with column settings.............................................................................. 59
Web-based manager icons........................................................................................... 60
System Status ........................................................................................ 63
Status page.................................................................................................................... 63
Viewing system status.............................................................................................. 63
Changing system information ..................................................................................... 78
Configuring system time........................................................................................... 78
Changing the FortiGate unit host name.................................................................... 78
Changing the FortiGate firmware ................................................................................ 79
Upgrading to a new firmware version....................................................................... 80
Reverting to a previous firmware version ................................................................. 80
Viewing operational history ......................................................................................... 81
Manually updating FortiGuard definitions.................................................................. 82
Viewing Statistics.......................................................................................................... 83
Viewing the session list............................................................................................. 83
Viewing Content Archive information on the Statistics widget.................................. 84
Viewing the Attack Log............................................................................................. 85
Topology........................................................................................................................ 87
Adding a subnet object............................................................................................. 89
Customizing the topology diagram ........................................................................... 90
Managing firmware versions................................................................. 91
Backing up your configuration.................................................................................... 92
Backing up your configuration through the web-based manager ............................. 92
Backing up your configuration through the CLI......................................................... 92
Backing up your configuration to a USB key ............................................................ 93
Testing firmware before upgrading............................................................................. 94
Upgrading your FortiGate unit..................................................................................... 95
Upgrading to FortiOS 4.0 through the web-based manager..................................... 95
Upgrading to FortiOS 4.0 through the CLI................................................................ 96
Verifying the upgrade................................................................................................ 97
Reverting to a previous firmware image..................................................................... 98
Downgrading to a previous firmware through the web-based manager................... 98
Verifying the downgrade........................................................................................... 99
Downgrading to a previous firmware through the CLI .............................................. 99
Contents
FortiGate Version 4.0 Administration Guide
601-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Restoring your configuration..................................................................................... 101
Restoring your configuration settings in the web-based manager.......................... 101
Restoring your configuration settings in the CLI..................................................... 101
Using virtual domains.......................................................................... 103
Virtual domains........................................................................................................... 103
Benefits of VDOMs................................................................................................. 103
VDOM configuration settings.................................................................................. 104
Global configuration settings .................................................................................. 107
Enabling VDOMs ......................................................................................................... 108
Configuring VDOMs and global settings .................................................................. 109
VDOM licenses....................................................................................................... 109
Creating a new VDOM............................................................................................ 110
Working with VDOMs and global settings............................................................... 111
Adding interfaces to a VDOM................................................................................. 113
Inter-VDOM links .................................................................................................... 113
Assigning an interface to a VDOM.......................................................................... 114
Assigning an administrator to a VDOM................................................................... 115
Changing the management VDOM......................................................................... 116
Configuring global and VDOM resource limits ........................................................ 116
VDOM resource limits............................................................................................. 117
Global resource limits............................................................................................. 118
System Network................................................................................... 119
Interfaces ..................................................................................................................... 119
Switch Mode........................................................................................................... 122
Interface settings .................................................................................................... 123
Creating an 802.3ad aggregate interface............................................................... 127
Creating a redundant interface............................................................................... 128
Configuring DHCP on an interface ......................................................................... 130
Configuring an interface for PPPoE........................................................................ 131
Configuring Dynamic DNS on an interface............................................................. 132
Configuring a virtual IPSec interface ...................................................................... 133
Configuring interfaces with CLI commands............................................................ 134
Administrative access to an interface..................................................................... 135
Interface MTU packet size...................................................................................... 135
Secondary IP Addresses........................................................................................ 136
Configuring zones....................................................................................................... 138
Configuring the modem interface.............................................................................. 139
Configuring modem settings................................................................................... 140
Redundant mode configuration............................................................................... 142
Standalone mode configuration.............................................................................. 143
Adding firewall policies for modem connections..................................................... 144
Connecting and disconnecting the modem............................................................. 144
Checking modem status......................................................................................... 144
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 7
http://docs.fortinet.com/ • Feedback
Configuring Networking Options............................................................................... 145
DNS Servers........................................................................................................... 146
Dead gateway detection......................................................................................... 146
Web Proxy.................................................................................................................... 147
Routing table (Transparent Mode)............................................................................. 149
Transparent mode route settings............................................................................ 149
VLAN overview............................................................................................................ 150
FortiGate units and VLANs..................................................................................... 151
VLANs in NAT/Route mode........................................................................................ 151
Rules for VLAN IDs................................................................................................. 152
Rules for VLAN IP addresses................................................................................. 152
Adding VLAN subinterfaces.................................................................................... 153
VLANs in Transparent mode...................................................................................... 154
Rules for VLAN IDs................................................................................................. 156
Transparent mode virtual domains and VLANs...................................................... 156
Troubleshooting ARP Issues.................................................................................. 157
System Wireless................................................................................... 159
FortiWiFi wireless interfaces ..................................................................................... 159
Channel assignments................................................................................................. 160
IEEE 802.11a channel numbers............................................................................. 160
IEEE 802.11b channel numbers............................................................................. 160
IEEE 802.11g channel numbers............................................................................. 161
Wireless settings......................................................................................................... 162
Adding a wireless interface..................................................................................... 163
Wireless MAC Filter .................................................................................................... 165
Managing the MAC Filter list................................................................................... 166
Wireless Monitor ......................................................................................................... 167
Rogue AP detection.................................................................................................... 168
Viewing wireless access points .............................................................................. 168
System DHCP....................................................................................... 171
FortiGate DHCP servers and relays .......................................................................... 171
Configuring DHCP services ....................................................................................... 172
Configuring an interface as a DHCP relay agent.................................................... 173
Configuring a DHCP server.................................................................................... 173
Viewing address leases.............................................................................................. 175
Reserving IP addresses for specific clients............................................................ 175
Contents
FortiGate Version 4.0 Administration Guide
801-400-89802-20090424
http://docs.fortinet.com/ • Feedback
System Config...................................................................................... 177
HA................................................................................................................................. 177
HA options.............................................................................................................. 177
Cluster members list............................................................................................... 180
Viewing HA statistics .............................................................................................. 182
Changing subordinate unit host name and device priority...................................... 183
Disconnecting a cluster unit from a cluster............................................................. 184
SNMP............................................................................................................................ 185
Configuring SNMP.................................................................................................. 186
Configuring an SNMP community........................................................................... 186
Fortinet MIBs .......................................................................................................... 188
Fortinet and FortiGate traps.................................................................................... 189
Fortinet and FortiGate MIB fields............................................................................ 192
Replacement messages ............................................................................................. 194
Replacement messages list.................................................................................... 195
Changing replacement messages.......................................................................... 196
Mail replacement messages................................................................................... 197
HTTP replacement messages................................................................................ 197
FTP replacement messages................................................................................... 198
NNTP replacement messages................................................................................ 199
Alert Mail replacement messages........................................................................... 199
Spam replacement messages................................................................................ 200
Administration replacement message..................................................................... 200
Authentication replacement messages................................................................... 201
FortiGuard Web Filtering replacement messages.................................................. 202
IM and P2P replacement messages....................................................................... 203
Endpoint control replacement message ................................................................. 204
NAC quarantine replacement messages................................................................ 204
SSL VPN replacement message............................................................................ 205
Replacement message tags................................................................................... 205
Operation mode and VDOM management access ................................................... 206
Changing operation mode ...................................................................................... 206
Management access............................................................................................... 207
System Admin...................................................................................... 209
Administrators............................................................................................................. 209
Viewing the administrators list................................................................................ 211
Configuring an administrator account..................................................................... 212
Configuring regular (password) authentication for administrators.......................... 214
Configuring remote authentication for administrators............................................. 214
Configuring PKI certificate authentication for administrators.................................. 220
Admin profiles............................................................................................................. 222
Viewing the admin profiles list ................................................................................ 224
Configuring an admin profile................................................................................... 225
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 9
http://docs.fortinet.com/ • Feedback
Central Management................................................................................................... 226
Settings........................................................................................................................ 228
Monitoring administrators.......................................................................................... 229
FortiGate IPv6 support ............................................................................................... 230
Customizable web-based manager ........................................................................... 231
System Certificates.............................................................................. 243
Local Certificates ....................................................................................................... 244
Generating a certificate request.............................................................................. 245
Downloading and submitting a certificate request.................................................. 246
Importing a signed server certificate....................................................................... 247
Importing an exported server certificate and private key........................................ 247
Importing separate server certificate and private key files...................................... 248
Remote Certificates .................................................................................................... 248
Importing Remote (OCSP) certificates ................................................................... 249
CA Certificates ............................................................................................................ 249
Importing CA certificates......................................................................................... 250
CRL............................................................................................................................... 251
Importing a certificate revocation list ...................................................................... 251
System Maintenance............................................................................ 253
About the Maintenance menu.................................................................................... 253
Backing up and restoring........................................................................................... 254
Basic backup and restore options........................................................................... 255
Upgrading and downgrading firmware.................................................................... 259
Upgrading and downgrading firmware through FortiGuard .................................... 259
Configuring advanced options................................................................................ 260
Managing configuration revisions............................................................................. 261
Using script files ......................................................................................................... 262
Creating script files................................................................................................. 263
Uploading script files............................................................................................... 264
Configuring FortiGuard Services .............................................................................. 264
FortiGuard Distribution Network ............................................................................. 264
FortiGuard services ................................................................................................ 265
Configuring the FortiGate unit for FDN and FortiGuard
subscription services .............................................................................................. 266
Troubleshooting FDN connectivity ........................................................................... 271
Updating antivirus and attack definitions................................................................. 271
Enabling push updates............................................................................................... 273
Enabling push updates when a FortiGate unit IP address changes....................... 273
Enabling push updates through a NAT device ....................................................... 274
Adding VDOM Licenses.............................................................................................. 276
Contents
FortiGate Version 4.0 Administration Guide
10 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Router Static ........................................................................................ 277
Routing concepts ....................................................................................................... 277
How the routing table is built .................................................................................. 278
How routing decisions are made ........................................................................... 278
Multipath routing and determining the best route ................................................... 278
Route priority ......................................................................................................... 279
Blackhole Route...................................................................................................... 279
Static Route ................................................................................................................ 280
Working with static routes ...................................................................................... 280
Default route and default gateway ......................................................................... 281
Adding a static route to the routing table ............................................................... 284
Policy Route ............................................................................................................... 285
Adding a policy route.............................................................................................. 286
Moving a policy route.............................................................................................. 287
Router Dynamic.................................................................................... 289
RIP ................................................................................................................................ 289
Viewing and editing basic RIP settings................................................................... 290
Selecting advanced RIP options............................................................................. 292
Configuring a RIP-enabled interface....................................................................... 293
OSPF ............................................................................................................................ 294
Defining an OSPF AS—Overview .......................................................................... 295
Configuring basic OSPF settings............................................................................ 296
Selecting advanced OSPF options......................................................................... 298
Defining OSPF areas.............................................................................................. 299
Specifying OSPF networks..................................................................................... 300
Selecting operating parameters for an OSPF interface.......................................... 301
BGP .............................................................................................................................. 302
Viewing and editing BGP settings........................................................................... 303
Multicast....................................................................................................................... 304
Viewing and editing multicast settings.................................................................... 305
Overriding the multicast settings on an interface.................................................... 306
Multicast destination NAT....................................................................................... 306
Bi-directional Forwarding Detection (BFD) .............................................................. 307
Configuring BFD..................................................................................................... 307
Customizable routing widgets................................................................................... 309
Access List.............................................................................................................. 309
Distribute List.......................................................................................................... 310
Key Chain............................................................................................................... 310
Offset List................................................................................................................ 311
Prefix List................................................................................................................ 312
Route Map.............................................................................................................. 312
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 11
http://docs.fortinet.com/ • Feedback
Router Monitor ..................................................................................... 315
Viewing routing information ...................................................................................... 315
Searching the FortiGate routing table....................................................................... 317
Firewall Policy...................................................................................... 319
How list order affects policy matching ..................................................................... 319
Moving a policy to a different position in the policy list........................................... 320
Multicast policies ........................................................................................................ 321
Viewing the firewall policy list ................................................................................... 321
Configuring firewall policies...................................................................................... 323
Adding authentication to firewall policies................................................................ 327
Identity-based firewall policy options (non-SSL-VPN)............................................ 328
IPSec firewall policy options................................................................................... 330
Configuring SSL VPN identity-based firewall policies............................................. 331
Endpoint Compliance Check options...................................................................... 336
DoS policies................................................................................................................. 337
Viewing the DoS policy list...................................................................................... 337
Configuring DoS policies ........................................................................................ 338
Firewall policy examples............................................................................................ 339
Scenario one: SOHO-sized business..................................................................... 339
Scenario two: enterprise-sized business................................................................ 342
Firewall Address .................................................................................. 345
About firewall addresses............................................................................................ 345
Viewing the firewall address list................................................................................ 346
Configuring addresses............................................................................................... 347
Viewing the address group list.................................................................................. 348
Configuring address groups...................................................................................... 348
Firewall Service.................................................................................... 351
Viewing the predefined service list........................................................................... 351
Viewing the custom service list................................................................................. 356
Configuring custom services..................................................................................... 357
Viewing the service group list ................................................................................... 359
Configuring service groups ....................................................................................... 359
Firewall Schedule................................................................................. 361
Viewing the recurring schedule list........................................................................... 361
Configuring recurring schedules .............................................................................. 362
Viewing the one-time schedule list ........................................................................... 362
Configuring one-time schedules ............................................................................... 363
Contents
FortiGate Version 4.0 Administration Guide
12 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Firewall Virtual IP................................................................................. 365
How virtual IPs map connections through FortiGate units..................................... 365
Inbound connections............................................................................................... 365
Outbound connections............................................................................................ 368
VIP requirements.................................................................................................... 369
Viewing the virtual IP list............................................................................................ 369
Configuring virtual IPs................................................................................................ 370
Adding a static NAT virtual IP for a single IP address............................................ 372
Adding a static NAT virtual IP for an IP address range .......................................... 373
Adding static NAT port forwarding for a single IP address
and a single port..................................................................................................... 375
Adding static NAT port forwarding for an IP address range
and a port range ..................................................................................................... 377
Adding dynamic virtual IPs ..................................................................................... 378
Adding a virtual IP with port translation only........................................................... 379
Virtual IP Groups......................................................................................................... 380
Viewing the VIP group list.......................................................................................... 380
Configuring VIP groups.............................................................................................. 380
IP pools........................................................................................................................ 381
IP pools and dynamic NAT..................................................................................... 382
IP Pools for firewall policies that use fixed ports..................................................... 382
Source IP address and IP pool address matching.................................................. 382
Viewing the IP pool list............................................................................................... 383
Configuring IP Pools................................................................................................... 383
Double NAT: combining IP pool with virtual IP........................................................ 384
Adding NAT firewall policies in transparent mode.................................................. 386
Firewall Load Balance ......................................................................... 389
How load balancer works........................................................................................... 389
Configuring virtual servers ........................................................................................ 390
Configuring real servers............................................................................................. 392
Configuring health check monitors........................................................................... 393
Monitoring the servers ............................................................................................... 395
Firewall Protection Profile................................................................... 397
What is a protection profile?...................................................................................... 397
Adding a protection profile to a firewall policy........................................................ 398
Default protection profiles ......................................................................................... 398
Viewing the protection profile list ............................................................................. 399
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 13
http://docs.fortinet.com/ • Feedback
SSL content scanning and inspection...................................................................... 399
Supported FortiGate models................................................................................... 400
Setting up certificates to avoid client warnings....................................................... 400
Configuring SSL content scanning and inspection................................................. 402
Configuring a protection profile ................................................................................ 404
Protocol recognition options ................................................................................... 405
Anti-Virus options.................................................................................................... 407
IPS options ............................................................................................................. 411
Web Filtering options.............................................................................................. 411
FortiGuard Web Filtering options............................................................................ 413
Spam Filtering options............................................................................................ 416
Data Leak Prevention Sensor options.................................................................... 419
Application Control options..................................................................................... 420
Logging options ...................................................................................................... 421
Traffic Shaping..................................................................................... 423
Guaranteed bandwidth and maximum bandwidth................................................... 423
Traffic priority.............................................................................................................. 424
Traffic shaping considerations.................................................................................. 424
Configuring traffic shaping........................................................................................ 425
SIP support........................................................................................... 427
VoIP and SIP................................................................................................................ 427
The FortiGate unit and VoIP security........................................................................ 429
SIP NAT.................................................................................................................. 429
How SIP support works.............................................................................................. 431
Configuring SIP........................................................................................................... 432
Enabling SIP support and setting rate limiting from the web-based manager........ 432
Enabling SIP support from the CLI......................................................................... 433
Enabling SIP logging .............................................................................................. 434
Enabling advanced SIP features in an application list............................................ 434
AntiVirus............................................................................................... 439
Order of operations..................................................................................................... 439
Antivirus tasks ............................................................................................................ 440
FortiGuard antivirus................................................................................................ 441
Antivirus settings and controls ................................................................................. 441
File Filter ...................................................................................................................... 443
Built-in patterns and supported file types................................................................ 443
Viewing the file filter list catalog.............................................................................. 444
Creating a new file filter list..................................................................................... 444
Viewing the file filter list .......................................................................................... 445
Configuring the file filter list..................................................................................... 445
Contents
FortiGate Version 4.0 Administration Guide
14 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
File Quarantine............................................................................................................ 446
Viewing the File Quarantine list.............................................................................. 447
Viewing the AutoSubmit list.................................................................................... 448
Configuring the AutoSubmit list .............................................................................. 449
Configuring quarantine options............................................................................... 449
Viewing the virus database information ................................................................... 451
Viewing and configuring the grayware list............................................................... 452
Antivirus CLI configuration........................................................................................ 453
Intrusion Protection............................................................................. 455
About intrusion protection......................................................................................... 455
Intrusion Protection settings and controls............................................................... 456
When to use Intrusion Protection............................................................................ 456
Signatures.................................................................................................................... 456
Viewing the predefined signature list...................................................................... 457
Using display filters................................................................................................. 458
Custom signatures...................................................................................................... 459
Viewing the custom signature list ........................................................................... 459
Creating custom signatures.................................................................................... 459
Protocol decoders....................................................................................................... 460
Viewing the protocol decoder list............................................................................ 460
Upgrading the IPS protocol decoder list................................................................. 461
IPS sensors.................................................................................................................. 461
Viewing the IPS sensor list..................................................................................... 461
Adding an IPS sensor............................................................................................. 462
Configuring IPS sensors......................................................................................... 462
Configuring filters.................................................................................................... 464
Configuring pre-defined and custom overrides....................................................... 465
Packet logging........................................................................................................ 467
DoS sensors................................................................................................................ 469
Viewing the DoS sensor list.................................................................................... 470
Configuring DoS sensors........................................................................................ 470
Understanding the anomalies................................................................................. 472
Intrusion protection CLI configuration ..................................................................... 472
Web Filter.............................................................................................. 475
Order of web filtering.................................................................................................. 475
How web filtering works............................................................................................. 475
Web filter controls....................................................................................................... 476
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 15
http://docs.fortinet.com/ • Feedback
Web content block ...................................................................................................... 478
Viewing the web content block list catalog ............................................................. 479
Creating a new web content block list .................................................................... 479
Viewing the web content block list.......................................................................... 479
Configuring the web content block list.................................................................... 480
Viewing the web content exempt list catalog.......................................................... 481
Creating a new web content exempt list................................................................. 482
Viewing the web content exempt list....................................................................... 482
Configuring the web content exempt list................................................................. 483
URL filter...................................................................................................................... 483
Viewing the URL filter list catalog........................................................................... 484
Creating a new URL filter list.................................................................................. 484
Viewing the URL filter list........................................................................................ 485
Configuring the URL filter list.................................................................................. 485
URL formats............................................................................................................ 486
Moving URLs in the URL filter list........................................................................... 487
FortiGuard - Web Filter............................................................................................... 487
Configuring FortiGuard Web Filtering..................................................................... 488
Viewing the override list.......................................................................................... 488
Configuring administrative override rules ............................................................... 489
Creating local categories........................................................................................ 491
Viewing the local ratings list.................................................................................... 491
Configuring local ratings......................................................................................... 492
Category block CLI configuration............................................................................ 493
Antispam............................................................................................... 495
Antispam...................................................................................................................... 495
Order of spam filtering............................................................................................ 495
Anti-spam filter controls.......................................................................................... 496
Banned word ............................................................................................................... 498
Viewing the banned word list catalog ..................................................................... 498
Creating a new banned word list ............................................................................ 499
Viewing the antispam banned word list .................................................................. 499
Adding words to the banned word list..................................................................... 500
IP address and email address black/white lists....................................................... 501
Viewing the antispam IP address list catalog ......................................................... 501
Creating a new antispam IP address list ................................................................ 501
Viewing the antispam IP address list...................................................................... 502
Adding an antispam IP address.............................................................................. 503
Viewing the antispam email address list catalog.................................................... 503
Creating a new antispam email address list........................................................... 504
Viewing the antispam email address list................................................................. 504
Configuring the antispam email address list........................................................... 505
Contents
FortiGate Version 4.0 Administration Guide
16 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Advanced antispam configuration ............................................................................ 505
config spamfilter mheader ...................................................................................... 505
config spamfilter dnsbl............................................................................................ 506
Using wildcards and Perl regular expressions ........................................................ 506
Perl regular expression formats.............................................................................. 507
Example regular expressions ................................................................................. 508
Data Leak Prevention........................................................................... 511
DLP Sensors................................................................................................................ 511
Viewing the DLP sensor list.................................................................................... 511
Adding and configuring a DLP sensor.................................................................... 512
Adding or editing a rule in a DLP sensor................................................................ 513
DLP Rules .................................................................................................................... 515
Viewing the DLP rule list......................................................................................... 515
Adding or configuring DLP rules............................................................................. 516
DLP Compound Rules ................................................................................................ 519
Viewing the DLP compound rule list....................................................................... 520
Adding and configuring DLP compound rules ........................................................ 520
Application Control.............................................................................. 523
What is application control?...................................................................................... 523
FortiGuard application control database.................................................................. 523
Viewing the application control lists......................................................................... 524
Creating a new application control list ..................................................................... 524
Configuring an application control list ..................................................................... 525
Adding or configuring an application control list entry.......................................... 526
Application control statistics..................................................................................... 527
IPSec VPN............................................................................................. 531
Overview of IPSec VPN configuration....................................................................... 531
Policy-based versus route-based VPNs ................................................................... 532
Auto Key ...................................................................................................................... 533
Creating a new phase 1 configuration.................................................................... 534
Defining phase 1 advanced settings....................................................................... 536
Creating a new phase 2 configuration.................................................................... 538
Defining phase 2 advanced settings....................................................................... 539
Manual Key .................................................................................................................. 541
Creating a new manual key configuration .............................................................. 542
Internet browsing configuration................................................................................ 544
Concentrator ............................................................................................................... 544
Defining concentrator options................................................................................. 545
Monitoring VPNs ......................................................................................................... 545
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 17
http://docs.fortinet.com/ • Feedback
PPTP VPN ............................................................................................. 547
PPTP configuration using FortiGate web-based manager...................................... 547
PPTP configuration using CLI commands ............................................................... 549
SSL VPN................................................................................................ 551
ssl.root ......................................................................................................................... 551
Configuring SSL VPN ................................................................................................. 552
Monitoring SSL VPN sessions................................................................................... 553
SSL VPN web portal.................................................................................................... 554
Default web portal configurations............................................................................. 554
General tab............................................................................................................. 556
Advanced tab.......................................................................................................... 556
Adding and editing widgets..................................................................................... 558
Session Information widget..................................................................................... 559
Bookmarks widget .................................................................................................. 559
Connection Tool widget.......................................................................................... 563
Tunnel Mode widget ............................................................................................... 564
User....................................................................................................... 567
Getting started - User authentication........................................................................ 567
Local user accounts ................................................................................................... 568
Configuring Local user accounts ............................................................................ 568
Remote......................................................................................................................... 571
RADIUS ........................................................................................................................ 571
Configuring a RADIUS server................................................................................. 572
Dynamically assigning VPN client IP addresses
from a RADIUS record.......................................................................................... 573
LDAP ............................................................................................................................ 575
Configuring an LDAP server................................................................................... 575
TACACS+..................................................................................................................... 578
Configuring TACACS+ servers............................................................................... 578
Directory Service......................................................................................................... 579
Configuring a Directory Service server................................................................... 581
PKI ............................................................................................................................... 581
Configuring peer users and peer groups................................................................ 582
User Group .................................................................................................................. 583
Firewall user groups ............................................................................................... 584
Directory Service user groups ................................................................................ 585
SSL VPN user groups............................................................................................. 585
Viewing the User group list..................................................................................... 586
Configuring a user group........................................................................................ 586
Configuring FortiGuard Web filtering override options............................................ 589
Contents
FortiGate Version 4.0 Administration Guide
18 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Options......................................................................................................................... 590
Monitor......................................................................................................................... 591
Firewall user monitor list......................................................................................... 591
IPSEC monitor list................................................................................................... 592
SSL VPN monitor list.............................................................................................. 593
IM user monitor list ................................................................................................. 594
NAC quarantine and the Banned User list................................................................ 595
NAC quarantine and DLP....................................................................................... 595
NAC quarantine and DLP replacement messages................................................. 595
Configuring NAC quarantine................................................................................... 596
The Banned User list.............................................................................................. 596
WAN optimization and web caching .................................................. 599
Frequently asked questions about FortiGate WAN optimization........................... 599
Overview of FortiGate WAN optimization................................................................. 601
WAN optimization tunnels....................................................................................... 602
WAN optimization peer authentication.................................................................... 602
Authentication Groups............................................................................................ 603
WAN optimization rules and firewall policies.......................................................... 603
WAN optimization Transparent mode..................................................................... 604
FortiGate models that support WAN optimization................................................... 604
Configuring WAN optimization.................................................................................. 605
How list order affects rule matching........................................................................ 606
Moving a rule to a different position in the rule list.................................................. 607
Configuring a WAN optimization rule ....................................................................... 608
Web caching................................................................................................................ 610
Web cache only topology........................................................................................ 611
Configuring web cache only WAN optimization...................................................... 611
Configuring client/server (active-passive) web caching.......................................... 612
Configuring peer to peer web caching.................................................................... 614
Client/server or active passive WAN optimization................................................... 617
Configuring client/server (active-passive) WAN optimization................................. 617
Peer to peer WAN optimization.................................................................................. 620
Configuring peer to peer WAN optimization ........................................................... 620
About WAN optimization addresses....................................................................... 622
Protocol optimization ................................................................................................. 623
Byte caching................................................................................................................ 624
SSL offloading for WAN optimization and web caching ......................................... 624
Example configuration: SSL offloading for a WAN optimization tunnel.................. 625
SSL offloading and reverse proxy web caching for an internet web server............ 627
Secure tunnelling........................................................................................................ 630
WAN optimization over IPSec VPN........................................................................ 630
Contents
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424 19
http://docs.fortinet.com/ • Feedback
WAN optimization with FortiClient ............................................................................ 630
Configuring WAN optimization storage.................................................................... 631
Example WAN optimization iSCSI configuration .................................................... 632
About partition labels.............................................................................................. 633
WAN optimization and HA.......................................................................................... 634
Configuring peers ....................................................................................................... 634
Configuring authentication groups........................................................................... 635
Details about WAN optimization peer authentication.............................................. 636
Monitoring WAN optimization.................................................................................... 637
Changing web cache settings.................................................................................... 638
Endpoint control .................................................................................. 641
Configuring endpoint control .................................................................................... 641
Viewing FortiClient required version information.................................................... 642
Configuring FortiClient required version and installer download ............................ 642
Viewing and configuring the software detection list................................................ 643
Monitoring endpoints ................................................................................................. 644
Log&Report .......................................................................................... 647
FortiGate logging ........................................................................................................ 647
FortiGuard Analysis and Management Service........................................................ 648
FortiGuard Analysis and Management Service portal web site.............................. 649
Log severity levels...................................................................................................... 649
High Availability cluster logging ............................................................................... 650
Storing logs ................................................................................................................. 650
Logging to a FortiAnalyzer unit............................................................................... 650
Connecting to FortiAnalyzer using Automatic Discovery........................................ 651
Testing the FortiAnalyzer configuration.................................................................. 652
Logging to a FortiGuard Analysis server ................................................................ 653
Logging to memory................................................................................................. 654
Logging to a Syslog server..................................................................................... 654
Logging to WebTrends ........................................................................................... 655
Log types..................................................................................................................... 657
Traffic log................................................................................................................ 657
Example configuration: logging all FortiGate traffic................................................ 658
Event log................................................................................................................. 659
Data Leak Prevention log ....................................................................................... 660
Application Control log............................................................................................ 660
Antivirus log............................................................................................................ 660
Web filter log........................................................................................................... 661
Spam filter log......................................................................................................... 661
Attack log (IPS)....................................................................................................... 661
Contents
FortiGate Version 4.0 Administration Guide
20 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Accessing Logs........................................................................................................... 662
Accessing logs stored in memory........................................................................... 662
Accessing logs stored on the hard disk.................................................................. 662
Accessing logs stored on the FortiAnalyzer unit..................................................... 663
Accessing logs stored on the FortiGuard Analysis server...................................... 664
Viewing log information ............................................................................................. 664
Customizing the display of log messages................................................................ 665
Column settings...................................................................................................... 666
Filtering log messages............................................................................................ 667
Content Archive .......................................................................................................... 667
Content archiving and data leak prevention ........................................................... 668
Configuring spam email message content archiving.............................................. 668
Configuring VoIP content archiving ........................................................................ 669
Viewing content archives........................................................................................ 670
Alert Email ................................................................................................................... 670
Configuring Alert Email........................................................................................... 672
Reports......................................................................................................................... 673
Viewing basic traffic reports.................................................................................... 673
FortiAnalyzer report schedules............................................................................... 674
Viewing FortiAnalyzer reports................................................................................. 677
Printing your FortiAnalyzer report........................................................................... 677
Index...................................................................................................... 679
/
