ADMINISTRAT ION GUIDE

FortiGate Version 3.0 MR6

Visit http://support.fortinet.com to register your FortiGate product. By registering you can receive product updates, technical support, and FortiGuard services.

www.fortinet.com

FortiGate Administration Guide Version 3.0 MR6 13 March 2008 01-30006-0203-20080313 Copyright 2008 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet, Inc. Trademarks Fortinet, FortiGate and FortiGuard are registered trademarks and Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGate Unified Threat Management System, FortiGuard-Antispam, FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, and FortiVoIP, are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Contents

Contents
Introduction ...................................................................................... 17
Whats new in FortiOS 3.0 MR6 ...................................................................... 17 Introducing the FortiGate units ...................................................................... 21 FortiGate-5000 series chassis .................................................................... About the FortiGate-5000 series modules .................................................. FortiGate-AMC modules ............................................................................. FortiGate-3810A.......................................................................................... FortiGate-3600A.......................................................................................... FortiGate-3016B.......................................................................................... FortiGate-3600 ............................................................................................ FortiGate-3000 ............................................................................................ FortiGate-1000A/AFA2................................................................................ FortiGate-1000 ............................................................................................ FortiGate-800/800F..................................................................................... FortiGate-500A............................................................................................ FortiGate-500 .............................................................................................. FortiGate-400A............................................................................................ FortiGate-400 .............................................................................................. FortiGate-300A............................................................................................ FortiGate-300 .............................................................................................. FortiGate-224B............................................................................................ FortiGate-200A............................................................................................ FortiGate-200 .............................................................................................. FortiGate-100A............................................................................................ FortiGate-100 .............................................................................................. FortiGate-60B.............................................................................................. FortiWiFi-60B .............................................................................................. FortiGate-60/60M/ADSL.............................................................................. FortiWiFi-60/60A/60AM ............................................................................... FortiWiFi-50B .............................................................................................. FortiGate-50B.............................................................................................. FortiGate-50A.............................................................................................. FortiGuard Subscription Services ............................................................... FortiAnalyzer ............................................................................................... FortiClient.................................................................................................... FortiManager ............................................................................................... FortiBridge................................................................................................... FortiMail ...................................................................................................... 21 22 22 23 23 24 24 24 25 25 25 26 26 26 26 27 27 27 28 28 28 28 29 29 29 30 30 30 31 31 31 31 32 32 32

Fortinet family of products ............................................................................. 31

About this document....................................................................................... 33 Document conventions................................................................................ 35

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

FortiGate documentation ............................................................................... 36 Fortinet Tools and Documentation CD........................................................ 37 Fortinet Knowledge Center ........................................................................ 37 Comments on Fortinet technical documentation ........................................ 37 Customer service and technical support ...................................................... 37 Register your Fortinet product....................................................................... 37

Web-based manager........................................................................ 39
Button bar features ......................................................................................... 40 Contact Customer Support ......................................................................... Backup your FortiGate configuration .......................................................... Using FortiGate Online Help ....................................................................... Logout ......................................................................................................... Using the web-based manager menu ......................................................... Using web-based manager lists.................................................................. Adding filters to web-based manager lists .................................................. Using page controls on web-based manager lists ...................................... Using column settings to control the columns displayed in some web-based manager lists ............................................................................ Using web-based manager icons................................................................ 40 41 41 44 45 45 46 49 50 52

Web-based manager pages ............................................................................ 44

System Status .................................................................................. 55

Status page ...................................................................................................... 55 Viewing system status ................................................................................ 55 Changing system information........................................................................ 67 Configuring system time ............................................................................. 67 Changing the FortiGate unit host name ...................................................... 68 Changing the FortiGate firmware................................................................... 68 Upgrading to a new firmware version ......................................................... 69 Reverting to a previous firmware version.................................................... 69 Viewing operational history............................................................................ 70 Manually updating FortiGuard definitions .................................................... 71 Viewing Statistics ............................................................................................ 72 Viewing the session list............................................................................... 72 Viewing the Content Archive information .................................................... 73 Viewing the Attack Log ............................................................................... 74 Topology .......................................................................................................... 76 Adding a subnet object ............................................................................... 78 Customizing the topology diagram.............................................................. 79

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

Using virtual domains...................................................................... 81

Virtual domains................................................................................................ 81 VDOM configuration settings ...................................................................... 83 Global configuration settings ....................................................................... 84 Enabling VDOMs.............................................................................................. 84 Configuring VDOMs and global settings....................................................... 85 Creating a new VDOM ................................................................................ Working with VDOMs and global settings ................................................... Adding interfaces to a VDOM...................................................................... Assigning an administrator to a VDOM ....................................................... Changing the Management VDOM ............................................................. 86 86 87 90 90

System Network ............................................................................... 93

Interfaces.......................................................................................................... 93 Switch Mode................................................................................................ 96 Interface settings......................................................................................... 97 Configuring an ADSL interface.................................................................. 100 Creating an 802.3ad aggregate interface.................................................. 101 Creating a redundant interface.................................................................. 102 Configuring DHCP on an interface ............................................................ 104 Configuring an interface for PPPoE or PPPoA ......................................... 105 Configuring Dynamic DNS on an interface ............................................... 107 Configuring a virtual IPSec interface ......................................................... 107 Configuring interfaces with CLI commands............................................... 109 Additional configuration for interfaces ....................................................... 110 Configuring the modem interface .............................................................. 113 Zones .............................................................................................................. 119 Networking Options....................................................................................... 120 DNS Servers ............................................................................................. 121 Dead gateway detection............................................................................ 121 Routing table (Transparent Mode) ............................................................... 122 Transparent mode route settings .............................................................. 122 VLAN overview............................................................................................... 123 FortiGate units and VLANs ....................................................................... 124 VLANs in NAT/Route mode........................................................................... 124 Rules for VLAN IDs ................................................................................... 125 Rules for VLAN IP addresses ................................................................... 125 Adding VLAN subinterfaces ...................................................................... 126 VLANs in Transparent mode ........................................................................ 127 Rules for VLAN IDs ................................................................................... 129 Transparent mode virtual domains and VLANs ........................................ 129 Troubleshooting ARP Issues..................................................................... 130

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

System Wireless ............................................................................ 133

FortiWiFi wireless interfaces........................................................................ 133 Channel assignments ................................................................................... 134 IEEE 802.11a channel numbers ............................................................... 134 IEEE 802.11b channel numbers ............................................................... 135 IEEE 802.11g channel numbers ............................................................... 135 System wireless settings.............................................................................. 136 Adding a wireless interface ....................................................................... 137 FortiWiFi-60 system wireless settings ........................................................ 139 Wireless MAC Filter....................................................................................... 141 Managing the MAC Filter list ..................................................................... 142 FortiWiFi-60 Wireless MAC Filter.............................................................. 143 Wireless Monitor............................................................................................ 144

System DHCP ................................................................................. 145

FortiGate DHCP servers and relays............................................................. 145 Configuring DHCP services.......................................................................... 146 Configuring an interface as a DHCP relay agent ...................................... 147 Configuring a DHCP server ...................................................................... 147 Viewing address leases ................................................................................ 149 Reserving IP addresses for specific clients .............................................. 149

System Config................................................................................ 151

HA ................................................................................................................... 151 HA options ................................................................................................ Cluster members list ................................................................................. Viewing HA statistics................................................................................. Changing subordinate unit host name and device priority ........................ Disconnecting a cluster unit from a cluster ............................................... Configuring SNMP .................................................................................... Configuring an SNMP community............................................................. Fortinet MIBs............................................................................................. FortiGate traps .......................................................................................... Fortinet MIB fields ..................................................................................... Replacement messages list ...................................................................... Changing replacement messages ............................................................ Changing the authentication login page.................................................... Changing the FortiGuard web filtering block override page ...................... Changing the SSL-VPN login message .................................................... Changing the authentication disclaimer page ........................................... Changing the Host Check pages (FortiGate-224B unit only) .................... 151 155 157 158 159 160 160 163 163 166 172 173 175 176 176 176 176

SNMP .............................................................................................................. 159

Replacement messages................................................................................ 172

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

Operation mode and VDOM management access...................................... 177 Changing operation mode ......................................................................... 177 Management access ................................................................................. 179

System Administrators.................................................................. 181

Administrators ............................................................................................... 181 Configuring regular (password) authentication for administrators............. Configuring remote authentication for administrators ............................... Configuring RADIUS authentication for administrators ............................. Configuring LDAP authentication for administrators ................................. Configuring TACACS+ authentication for administrators .......................... Configuring PKI certificate authentication for administrators .................... Viewing the administrators list................................................................... Configuring an administrator account ....................................................... 183 183 184 185 187 189 190 191

Access profiles .............................................................................................. 194 Viewing the access profiles list ................................................................. 196 Configuring an access profile .................................................................... 197 Central Management ..................................................................................... 198 Settings........................................................................................................... 201 Monitoring administrators ............................................................................ 202 FortiGate IPv6 support .................................................................................. 203

System Certificates........................................................................ 205

Local Certificates .......................................................................................... 205 Generating a certificate request ................................................................ Downloading and submitting a certificate request..................................... Importing a signed server certificate ......................................................... Importing an exported server certificate and private key .......................... Importing separate server certificate and private key files ........................ 207 208 209 209 210

Remote Certificates ....................................................................................... 210 Importing Remote (OCSP) certificates ...................................................... 211 CA Certificates ............................................................................................... 212 Importing CA certificates ........................................................................... 212 CRL ................................................................................................................. 213 Importing a certificate revocation list ......................................................... 214

System Maintenance...................................................................... 215

Maintenance System Configuration............................................................. 215 Backup and Restore.................................................................................. Firmware ................................................................................................... Firmware Upgrade .................................................................................... FortiClient.................................................................................................. Advanced .................................................................................................. 217 221 222 223 223

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

Revision Control............................................................................................ 225 FortiGuard ...................................................................................................... 226 FortiGuard Distribution Network................................................................ 226 FortiGuard Services .................................................................................. 226 Configuring the FortiGate unit for FDN and FortiGuard subscription services................................................................................. 228 Troubleshooting FDN connectivity.............................................................. 233 Updating antivirus and attack definitions ................................................... 233 Enabling push updates ................................................................................. 235 Push updates when FortiGate IP addresses changes .............................. 235 Enabling push updates through a NAT device.......................................... 235 License ........................................................................................................... 238

System Chassis (FortiGate-5000 series) ..................................... 239

SMC (shelf manager card) ............................................................................ 239 Blades (FortiGate-5000 chassis slots)......................................................... 240 Example temperature displays.................................................................. 241 Example voltage displays ......................................................................... 242 Chassis monitoring event log messages.................................................... 243

Router Static .................................................................................. 245

Routing concepts ......................................................................................... 245 How the routing table is built .................................................................... How routing decisions are made .............................................................. Multipath routing and determining the best route...................................... Route priority ............................................................................................ Equal Cost Multipath (ECMP) Routes....................................................... Blackhole Routing ..................................................................................... 246 246 246 247 248 248

Static Route ................................................................................................... 248 Working with static routes ........................................................................ 248 Default route and default gateway ........................................................... 250 Adding a static route to the routing table ................................................. 252 Policy Route .................................................................................................. 253 Adding a policy route ................................................................................ 254 Moving a route policy ................................................................................ 255

Router Dynamic ............................................................................. 257

RIP................................................................................................................... 257 How RIP works ......................................................................................... Viewing and editing basic RIP settings ..................................................... Selecting advanced RIP options ............................................................... Overriding the RIP operating parameters on an interface ........................ 258 258 260 261

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

OSPF ............................................................................................................... 262 How OSPF autonomous systems work..................................................... Defining an OSPF AS ............................................................................... Viewing and editing basic OSPF settings ................................................. Selecting advanced OSPF options ........................................................... Defining OSPF areas ................................................................................ Specifying OSPF networks ....................................................................... Selecting operating parameters for an OSPF interface ............................ 262 263 264 266 267 268 269

BGP ................................................................................................................. 270 How BGP works ........................................................................................ 270 Viewing and editing BGP settings ............................................................. 271 Multicast ......................................................................................................... 272 Viewing and editing multicast settings ...................................................... 273 Overriding the multicast settings on an interface ...................................... 274 Multicast destination NAT ......................................................................... 274 Bi-directional Forwarding Detection (BFD) ................................................. 275 How BFD works ........................................................................................ 275 Configuring BFD........................................................................................ 275

Router Monitor ............................................................................... 277

Viewing routing information ......................................................................... 277 Searching the FortiGate routing table ......................................................... 279

Firewall Policy ................................................................................ 281

How list order affects policy matching........................................................ 281 Multicast policies........................................................................................... 283 Viewing the firewall policy list...................................................................... 283 Moving a policy to a different position in the policy list.............................. 284 Configuring firewall policies......................................................................... 285 Adding authentication to firewall policies .................................................. Adding traffic shaping to firewall policies .................................................. IPSec firewall policy options...................................................................... SSL-VPN firewall policy options ................................................................ Options to check FortiClient on hosts ....................................................... 290 292 295 296 296

Firewall policy examples............................................................................... 297 Scenario one: SOHO sized business ........................................................ 297 Scenario two: enterprise sized business ................................................... 300

Firewall Address ............................................................................ 303

About firewall addresses .............................................................................. 303 Viewing the firewall address list .................................................................. 304 Configuring addresses.................................................................................. 305 Viewing the address group list..................................................................... 306
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

Configuring address groups ........................................................................ 307

Firewall Service.............................................................................. 309

Viewing the predefined service list.............................................................. 309 Viewing the custom service list ................................................................... 314 Configuring custom services ....................................................................... 314 Viewing the service group list...................................................................... 316 Configuring service groups.......................................................................... 317

Firewall Schedule........................................................................... 319

Viewing the one-time schedule list.............................................................. 319 Configuring one-time schedules.................................................................. 320 Viewing the recurring schedule list ............................................................. 320 Configuring recurring schedules................................................................. 321

Firewall Virtual IP ........................................................................... 323

How virtual IPs map connections through FortiGate units ....................... 324 Inbound connections................................................................................. 324 Outbound connections .............................................................................. 326 VIP requirements ...................................................................................... 327 Viewing the virtual IP list .............................................................................. 327 Configuring virtual IPs .................................................................................. 328 Adding a static NAT virtual IP for a single IP address .............................. Adding a static NAT virtual IP for an IP address range............................. Adding static NAT port forwarding for a single IP address and a single port .............................................................................................. Adding static NAT port forwarding for an IP address range and a port range.................................................................................................. Adding a server load balance virtual IP .................................................... Adding a server load balance port forwarding virtual IP ........................... Adding dynamic virtual IPs........................................................................ Adding a virtual IP with port translation only ............................................. 331 333 334 336 338 340 342 343

Virtual IP Groups ........................................................................................... 343 Viewing the VIP group list ............................................................................ 344 Configuring VIP groups ................................................................................ 344 Health Check Monitor.................................................................................... 345 IP pools........................................................................................................... 346 IP pools and dynamic NAT ....................................................................... 346 IP Pools for firewall policies that use fixed ports ....................................... 347 Source IP address and IP pool address matching .................................... 347 Viewing the IP pool list ................................................................................. 348 Configuring IP Pools ..................................................................................... 349
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

10

Contents

Double NAT: combining IP pool with virtual IP .......................................... 349

Firewall Protection Profile............................................................. 353

What is a protection profile? ........................................................................ 353 Default protection profiles ............................................................................ 354 Viewing the protection profile list ................................................................ 354 Configuring a protection profile................................................................... 355 Anti-Virus options ...................................................................................... Web Filtering options ................................................................................ FortiGuard Web Filtering options .............................................................. Spam Filtering options .............................................................................. IPS options ................................................................................................ Content Archive options ............................................................................ IM/P2P options .......................................................................................... VoIP options.............................................................................................. Logging options......................................................................................... 356 358 359 361 363 363 365 366 366

Applying a protection profile to a policy ..................................................... 367

VPN IPSEC ...................................................................................... 369

Overview of IPSec VPN configuration ......................................................... 369 Policy-based versus route-based VPNs ...................................................... 370 Auto Key ......................................................................................................... 371 Creating a new phase 1 configuration....................................................... Defining phase 1 advanced settings ......................................................... Creating a new phase 2 configuration....................................................... Defining phase 2 advanced settings ......................................................... Internet browsing configuration ................................................................. 372 374 377 378 380

Manual Key..................................................................................................... 381 Creating a new manual key configuration ................................................ 382 Concentrator ................................................................................................. 384 Defining concentrator options ................................................................... 384 Monitor............................................................................................................ 385

VPN PPTP ....................................................................................... 387

PPTP Range ................................................................................................... 387

VPN SSL.......................................................................................... 389

ssl.root............................................................................................................ 390 Configuring SSL VPN .................................................................................... 390 Monitoring SSL VPN sessions ..................................................................... 391 SSL VPN bookmarks ..................................................................................... 392 Viewing the SSL VPN bookmark list ............................................................ 392

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

11

Contents

Configuring SSL VPN bookmarks................................................................ 393 Viewing the SSL VPN Bookmark Groups list.............................................. 394 Configuring SSL VPN bookmark groups .................................................... 394

User Authentication....................................................................... 395

Configuring user authentication .................................................................. 395 Local user accounts...................................................................................... 396 Configuring a Local user account ............................................................. 396 Remote authentication.................................................................................. 397 RADIUS servers ............................................................................................. 397 Configuring a RADIUS server ................................................................... 398 LDAP servers ................................................................................................. 400 Configuring an LDAP server ..................................................................... 401 TACACS+ servers.......................................................................................... 403 Configuring TACACS+ servers ................................................................. 404 PKI authentication ......................................................................................... 405 Configuring peer users and peer groups .................................................. 405 Windows AD servers..................................................................................... 406 Configuring a Windows AD server ............................................................ 408 User groups ................................................................................................... 409 Firewall user groups.................................................................................. Active Directory user groups ..................................................................... SSL VPN user groups............................................................................... User group list........................................................................................... Configuring a user group .......................................................................... Configuring FortiGuard override options for a user group ........................ Configuring SSL VPN user group options................................................. 410 411 412 413 414 415 416

Authentication settings................................................................................. 418

AntiVirus ......................................................................................... 421

Order of operations ....................................................................................... 421 Antivirus elements ........................................................................................ 421 FortiGuard antivirus .................................................................................. 422 Antivirus settings and controls.................................................................... 423 File Filter......................................................................................................... 424 Built-in patterns and supported file types .................................................. Viewing the file filter list catalog ................................................................ Creating a new file filter list ....................................................................... Viewing the file filter list............................................................................. Configuring the file filter list....................................................................... 424 425 426 426 427

12

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

Quarantine...................................................................................................... 427 Viewing the Quarantined Files list ............................................................. Viewing the AutoSubmit list....................................................................... Configuring the AutoSubmit list ................................................................. Configuring quarantine options ................................................................. 428 429 430 430

Config ............................................................................................................. 431 Viewing the virus list.................................................................................. 431 Viewing the grayware list .......................................................................... 432 Antivirus CLI configuration .......................................................................... 434 system global optimize .............................................................................. config antivirus heuristic ............................................................................ config antivirus quarantine ........................................................................ config antivirus service <service_name> .................................................. 434 434 434 434

Intrusion Protection ....................................................................... 435

About intrusion protection ........................................................................... 435 Intrusion Protection settings and controls ................................................. 436 When to use Intrusion Protection .............................................................. 436 Signatures ...................................................................................................... 437 Viewing the predefined signature list ........................................................ 437 Using display filters ................................................................................... 438 Fine tuning predefined signatures for enhanced system performance ..... 439 Custom signatures ........................................................................................ 439 Viewing the custom signature list .............................................................. 439 Creating custom signatures ...................................................................... 440 Protocol decoders ......................................................................................... 440 Viewing the protocol decoder list .............................................................. 440 Upgrading the IPS protocol decoder list.................................................... 441 IPS sensors .................................................................................................... 441 Viewing the IPS sensor list........................................................................ 442 Adding an IPS sensor ............................................................................... 442 Configuring IPS sensors............................................................................... 443 Configuring filters ...................................................................................... 444 Configuring pre-defined and custom overrides ......................................... 446 DoS sensors................................................................................................... 446 Viewing the DoS sensor list ...................................................................... 447 Configuring DoS sensors .......................................................................... 447 Understanding the anomalies ................................................................... 449 Intrusion protection CLI configuration ........................................................ 450 ips global fail-open .................................................................................... 450 ips global socket-size ................................................................................ 450

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

13

Contents

Web Filter........................................................................................ 451

Order of web filtering .................................................................................... 451 How web filtering works ............................................................................... 451 Web filter controls ......................................................................................... 452 Content block................................................................................................. 454 Viewing the web content block list catalog................................................ Creating a new web content block list....................................................... Viewing the web content block list ............................................................ Configuring the web content block list ...................................................... Viewing the web content exempt list catalog ............................................ Creating a new web content exempt list ................................................... Viewing the web content exempt list ......................................................... Configuring the web content exempt list ................................................... Viewing the URL filter list catalog ............................................................. Creating a new URL filter list .................................................................... Viewing the URL filter list .......................................................................... Configuring the URL filter list .................................................................... URL formats.............................................................................................. Moving URLs in the URL filter list ............................................................. Configuring FortiGuard Web Filtering ....................................................... Viewing the override list ............................................................................ Configuring override rules ......................................................................... Creating local categories .......................................................................... Viewing the local ratings list ...................................................................... Configuring local ratings ........................................................................... Category block CLI configuration .............................................................. FortiGuard Web Filtering reports .............................................................. 454 455 455 456 457 457 458 459 459 460 461 462 462 463 464 464 465 468 468 469 470 470

URL filter ........................................................................................................ 459

FortiGuard - Web Filter ................................................................................. 464

Antispam......................................................................................... 473
Antispam ........................................................................................................ 473 Order of Spam Filtering............................................................................. 473 Anti-spam filter controls ............................................................................ 474 Banned word.................................................................................................. 476 Viewing the antispam banned word list catalog ........................................ Creating a new antispam banned word list ............................................... Viewing the antispam banned word list..................................................... Configuring the antispam banned word list ............................................... 476 477 477 478

14

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Contents

Black/White List ............................................................................................. 479 Viewing the antispam IP address list catalogue ........................................ Creating a new antispam IP address list ................................................... Viewing the antispam IP address list ........................................................ Configuring the antispam IP address list................................................... Viewing the antispam email address list catalog....................................... Creating a new antispam email address list.............................................. Viewing the antispam email address list ................................................... Configuring the antispam email address list ............................................. 479 480 480 481 481 482 482 483

Advanced antispam configuration............................................................... 484 config spamfilter mheader ......................................................................... 484 config spamfilter dnsbl .............................................................................. 485 Using Perl regular expressions.................................................................... 485 Regular expression vs. wildcard match pattern ........................................ Word boundary.......................................................................................... Case sensitivity ......................................................................................... Perl regular expression formats ................................................................ Example regular expressions .................................................................... 485 486 486 486 487

IM, P2P & VoIP................................................................................ 489

Overview......................................................................................................... 489 Configuring IM/P2P/VoIP protocols ............................................................. 491 Configuring IM/P2P/VoIP IPS signatures .................................................. Configuring IPS signatures for unsupported IM/P2P protocols ................. Configuring IM/P2P/VoIP options within a protection profile ..................... Configuring older versions of IM/P2P applications.................................... 491 492 492 492

Statistics......................................................................................................... 493 Viewing overview statistics........................................................................ 493 Viewing statistics by protocol .................................................................... 494 User................................................................................................................. 495 Viewing the Current Users list ................................................................... Viewing the User List ................................................................................ Adding a new user to the User List ........................................................... Configuring a policy for unknown IM users ............................................... 495 496 496 497

Log&Report .................................................................................... 499

FortiGate Logging.......................................................................................... 499 FortiGuard Analysis and Management Service .......................................... 500 FortiGuard Analysis and Management Service portal website ................. 501 Log severity levels......................................................................................... 502 High Availability cluster logging .................................................................. 502

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

15

Contents

Storing Logs .................................................................................................. 503 Logging to a FortiAnalyzer unit ................................................................. Connecting to FortiAnalyzer using Automatic Discovery .......................... Testing the FortiAnalyzer configuration .................................................... Logging to a FortiGuard Analysis server................................................... Logging to memory ................................................................................... Logging to a Syslog server ....................................................................... Logging to WebTrends.............................................................................. Traffic log .................................................................................................. Event log ................................................................................................... Antivirus log .............................................................................................. Web filter log ............................................................................................. Attack log .................................................................................................. Spam filter log ........................................................................................... IM and P2P log ......................................................................................... VoIP log .................................................................................................... Accessing log messages stored in memory.............................................. Accessing log message stored on the hard disk....................................... Accessing logs stored on the FortiAnalyzer unit ....................................... Accessing logs stored on the FortiGuard Analysis server ........................ 503 504 505 506 506 507 508 509 510 511 511 512 512 512 513 514 514 515 515

Log types........................................................................................................ 509

Accessing Logs ............................................................................................. 513

Viewing log information................................................................................ 516 Customizing the display of log messages .................................................. 516 Column settings ........................................................................................ 517 Filtering log messages .............................................................................. 518 Content Archive............................................................................................. 519 Configuring content archiving ................................................................... 519 Viewing content archives .......................................................................... 520 Alert Email...................................................................................................... 521 Configuring Alert Email ............................................................................. 521 Reports ........................................................................................................... 523 Basic traffic reports ................................................................................... FortiAnalyzer reports................................................................................. Configuring a FortiAnalyzer report ........................................................... Viewing FortiAnalyzer reports from a FortiGate unit ................................. Viewing parts of a FortiAnalyzer report ..................................................... Editing FortiAnalyzer reports..................................................................... Printing your FortiAnalyzer report ............................................................. 523 524 524 532 532 532 533

Index................................................................................................ 535

16

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Whats new in FortiOS 3.0 MR6

Introduction
Welcome and thank you for selecting Fortinet products for your real-time network protection. FortiGate ASIC-accelerated multi-threat security systems improve network security, reduce network misuse and abuse, and help you use communications resources more efficiently without compromising the performance of your network. FortiGate Systems are ICSA-certified for Antivirus, Firewall, IPSec, SSL-TLS, IPS, Intrusion detection, and AntiSpyware services. FortiGate Systems are dedicated, easily managed security devices that deliver a full suite of capabilities including: Application-level services such as virus protection, intrusion protection, spam filtering, web content filtering, IM, P2P, and VoIP filtering Network-level services such as firewall, intrusion detection, IPSec and SSL VPN, and traffic shaping Management services such as user authentication, logging, reporting with FortiAnalyzer, administration profiles, secure web and CLI administrative access, and SNMP.

The FortiGate security system uses Fortinets Dynamic Threat Prevention System (DTPS) technology, which leverages breakthroughs in chip design, networking, security and content analysis. The unique ASIC-accelerated architecture analyzes content and behavior in real-time, enabling key applications to be deployed right at the network edge where they are most effective at protecting your networks. This chapter contains the following sections: Whats new in FortiOS 3.0 MR6 Introducing the FortiGate units Fortinet family of products About this document FortiGate documentation Customer service and technical support Register your Fortinet product

Whats new in FortiOS 3.0 MR6

This section lists and describes some of the new features and changes in FortiOS 3.0 MR6. For more information, see the FortiOS 3.0 MR6 Upgrade Guide. CLI command changes There are many CLI command changes, as well as new commands. See the Whats New chapter of the MR6 FortiOS CLI Reference for details.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

17

Whats new in FortiOS 3.0 MR6

Introduction

New widgets for the system dashboard Several new system dashboard widgets are available: Top Sessions (see Top Sessions on page 65), Top Viruses (see Top Viruses on page 65), Top Attacks (see Top Attacks on page 66), and Traffic History (see Traffic History on page 66). Also on FortiGate units that support it, the Unit Operation widget displays information about installed AMC hard disks (see Unit Operation on page 59). Virtual Domain (VDOM) enhancements Enhancements for VDOMs in FortiOS 3.0 MR6 include additional menus for each VDOM and a default interface. See Using virtual domains on page 81. Interface column settings You can now display several additional columns when viewing interface settings, including the MAC address and available access settings of an interface. See Interfaces on page 93. Soft switch interface The soft switch interface provides a virtual interface, creating a bridge between two or more physical or wireless interfaces. See Software switch interface on page 109. SNMP MIBs FortiOS 3.0 MR6 has added MIBs to help manage FortiOS and its applications when connected to a FortiManager. See Fortinet MIBs on page 163 and Fortinet MIB fields on page 166. Read-only super_admin The new administrative access profile provides read-only access to a read and write administrator. See System Administrators on page 181. IPv6 web-based manager support FortiOS 3.0 MR6 provides support for IPv6 in the web-based manager. See FortiGate IPv6 support on page 203. Managing certificates You can now manage all certificates from System > Certificates. See System Certificates on page 205. FortiGuard-FortiManager protocol FortiOS 3.0 MR6 has a new protocol for better communication between the FortiGuard center and FortiGate units, as well as between FortiGate units and FortiManager units. See System Maintenance on page 215. FortiGuard Management Services FortiGuard Management Services are available for all FortiGate units. This subscription-based service incorporates several features previously found only on a FortiManager unit. See FortiGuard Analysis and Management Service on page 227. FortiGuard Analysis Service The FortiGuard Analysis Service is now available on all FortiGate units. See FortiGuard Analysis and Management Service on page 227. Multiple authentication within a firewall policy You can now enable multiple authentication options for one firewall policy. See Adding authentication to firewall policies on page 290. Media Gateway Control Protocol pre-defined service You can configure firewall policies for this pre-defined service. See Table 36, Predefined services, on page 311. Authentication-based routing FortiOS 3.0 MR6 now provides a RADIUS server to send user authentication information to make a routing decision. The Knowledge Center article Authentication Based Routing describes how to configure this CLI-only feature, and the FortiOS CLI Reference describes the commands to use. HTTP multiplexing in port forwarding virtual IPs You can now add HTTP multiplexing to port forwarding virtual IPs to multiple client connections that are destined for a web server. See HTTP Multiplexing on page 330.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

18

Introduction

Whats new in FortiOS 3.0 MR6

Web support for SSL offloading You can now configure web SSL offloading in port forwarding virtual IPs. See SSL Offloading on page 330. Health check monitors for server load balancing You can now add health check monitors for server local balancing virtual IPs from the Health Check Monitor menu. See Health Check Monitor on page 345. Multiple anti-virus databases FortiOS 3.0 MR6 provides multiple anti-virus databases to make sure that the FortiGate unit catches more viruses. See Anti-Virus options on page 356. IPSec VPN default gateway You can add default gateways to IPSec VPN Interface tunnels using the default_gw keyword of the config vpn ipsec-interface CLI command. See the FortiOS CLI Reference. SSL VPN changes SSL VPN changes include support for Windows Vista and performance improvements as well as a new virtual SSL VPN interface called ssl.<vdom_name>. For the root VDOM, this interface is called ssl.root, and appears in the firewall policy interface lists and static route interface lists. See ssl.root on page 390. Terminal Access Controller Access-Control System (TACACS+) FortiOS 3.0 MR6 now supports TACACS+ in both the web-based manager and CLI. See TACACS+ servers on page 403. FSAE enhancements FSAE now includes support for the Active Directory native mode, which can retrieve user and group information and display it on the web-based manager using LDAP. See Windows AD servers on page 406. Anti-virus file filter The Antivirus file filter feature replaces the Antivirus File Pattern feature. This new feature can filter files based on their file name pattern and file type. See File Filter on page 424. Intrusion Protection enhancements FortiOS 3.0 MR6 Intrusion Protection configuration is now based on creating multiple IPS sensor profiles and Denial of Service (DoS) profiles. Profile-based intrusion protection makes it easier to configure IPS and to apply different IPS configurations to different network traffic streams. In previous versions of FortiOS you configured individual signatures and anomalies and enabled the same IPS configuration for all protection profiles. See IPS options on page 363 for information about adding IPS sensors to protection profiles. For information about configuring IPS and DoS sensors, see IPS sensors on page 441 and DoS sensors on page 446. Controlling MSN over HTTP proxy FortiOS 3.0 MR6 IM, P2P & VoIP can now transparently monitor and control MSN tunneling over HTTP. See IM, P2P & VoIP on page 489 for information about configuring FortiGate IM, P2P and VoIP settings. Remote logging changes You now configure remote logging to FortiAnalyzer units and to the FortiGuard Analysis server from the Remote Logging section of the Log Settings page. See Storing Logs on page 503. Log message changes A number of log message changes for FortiOS 3.0 MR6 have been made. These changes will appear in the FortiGate Log Message Reference and are listed in the FortiOS 3.0 MR6 Upgrade Guide. PPTP client feature You can use CLI commands to configure any FortiGate unit interface to be a PPTP client and connect to a PPTP server. See the config system interface command description in the FortiOS CLI Reference for more information.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

19

Whats new in FortiOS 3.0 MR6

Introduction

Standalone session synchronization Standalone session synchronization provides a way to synchronize two standalone FortiGate units with external load balancers to distribute TCP sessions between two peer FortiGate units to provide failover protection. See the config system session-sync command description in the FortiOS CLI Reference. Interval settings between gratuitous ARP packets You can now use the arps-interval keyword of the config system ha command in the CLI to configure the number of seconds to wait between sending gratuitous ARP packets in an HA cluster. See the config system ha command description in the FortiOS CLI Reference. Remote IP monitoring In an HA cluster, you can use the pingservermonitor-interface, pingserver-failover-threshold, and pingserver-flip-timeout keywords of the config system ha command to remotely monitor IP addresses; remote IP monitoring uses ping servers that are configured on FortiGate interfaces to test connectivity of network devices. See the config system ha command description in the FortiOS CLI Reference for more information.

20

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Introducing the FortiGate units

Introducing the FortiGate units

All FortiGate Unified Threat Management Systems deliver similar SOHO or enterprise-class network-based antivirus, content filtering, firewall, VPN, and network-based intrusion detection/prevention features. In addition to these features, FortiGate units running FortiOS Carrier also deliver MMS content processing and GTP protection.

FortiGate-5000 series chassis

The FortiGate-5000 series Security Systems are chassis-based systems that MSSPs and large enterprises can use to provide subscriber security services such as firewall, VPN, antivirus protection, spam filtering, web filtering and intrusion prevention (IPS). The wide variety of system configurations available with FortiGate-5000 series provide flexibility to meet the changing needs of growing high performance networks. The FortiGate-5000 series chassis support multiple hot-swappable FortiGate-5000 series modules and power supplies. This modular approach provides a scalable, high-performance and failure-proof solution.
5140
13 11 9 7 5 3 1 2
5140SAP
T SE RE L 2 1 3 R R CA ITI MAJO MINO USER USER USER CR

SERIAL 1

SERIAL 2

ALARM

10

12

14

5 4
USB CONSOLE

CONSOLE PWR ACC

USB

8 STA IPM

PWR ACC

PWR ACC

PWR ACC

PWR ACC

PWR ACC

PWR ACC

CONSOLE

SYSTEM

LED MODE

ZRE

Z R E 0

Z R E 0

14

12

10

CLK

E2

Z R E 1

Z R E 1

ETH0 ETH1

EXT FLT

2
5000SM 10/100 link/Act 10/100 link/Act
ETH0 Service RESET STATUS

MANAGEMENT

HOT SWAP

E T H O

R S 2 3 2

Z R E 0

Z R E 1

Z R E 2

15

13

INT FLT

OK

E1

RESET

11

Z R E 2 E2 14 12 E1 15 13 11 9 7 5 3 1 ZRE E2 14 12 10 8 6 4 2 0 ZRE E1 15

Z R E 2

14

12

10

CLK

E2

13 11 9 7

10 8 6 4 2 0

Hot Swap

ETH0 ETH1

ALARM

RESET

5 3 1

2
12
5000SM 10/100 link/Act 10/100 link/Act
ETH0 ETH1

SERIAL 1

SERIAL 2

RESET

Hot Swap

ETH0 ETH1

Hot Swap

ETH0 Service

STATUS

ETH0 Service

STATUS

SMC

5000SM 10/100 link/Act 10/100 link/Act

5050SAP

EXT FLT

MANAGEMENT

CONSOLE

SYSTEM

HOT SWAP

E T H O

R S 2 3 2

Z R E 0

Z R E 1

Z R E 2

E1

INT FLT

OK

5000SM 10/100 link/Act 10/100 link/Act

LED MODE

15

13

ZRE

RESET

11

FortiGate-5140 chassis
You can install up to 14 FortiGate-5000 series modules in the 14 slots of the FortiGate-5140 ATCA chassis. The FortiGate-5140 is a 12U chassis that contains two redundant hot swappable DC power entry modules that connect to -48 VDC Data Center DC power. The FortiGate-5140 chassis also includes three hot swappable cooling fan trays.

FortiGate-5050 chassis
You can install up to five FortiGate-5000 series modules in the five slots of the FortiGate-5050 ATCA chassis. The FortiGate-5050 is a 5U chassis that contains two redundant DC power connections that connect to -48 VDC Data Center DC power. The FortiGate-5050 chassis also includes a hot swappable cooling fan tray.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

PWR ACC CONSOLE USB 1 2 3 4 5 6 7 8 STA IPM

PWR ACC CONSOLE USB 1 2 3 4 5 6 7 8 STA IPM

PWR ACC CONSOLE USB 1 2 3 4 5 6 7 8 STA IPM

PWR ACC CONSOLE USB 1 2 3 4 5 6 7 8 STA IPM

FILTER
USB
RESET STATUS

PWR ACC CONSOLE USB 1 2 3 4 5 6 7 8 STA IPM

PWR ACC CONSOLE USB 1 2 3 4 5 6 7 8 STA IPM

MANAGEMENT E T H O

MANAGEMENT E T H O

CONSOLE PWR ACC

USB

8 STA IPM

CONSOLE USB

CONSOLE USB

CONSOLE USB

CONSOLE USB

CONSOLE USB

SYSTEM CONSOLE R S 2 3 2

SYSTEM CONSOLE R S 2 3 2

CONSOLE PWR ACC

USB

8 STA IPM

1 2 3 4 5 6

1 2 3 4 5 6

1 2 3 4 5 6

1 2 3 4 5 6

1 2 3 4 5 6

POWER

2 3 4 5 6

SMC

CLK EXT FLT

OK INT FLT HOT SWAP RESET

CLK EXT FLT

OK INT FLT

HOT SWAP RESET

8
ETH0 Service RESET STATUS

LED MODE

LED MODE

STA IPM

STA IPM

STA IPM

STA IPM

STA IPM

STA IPM

Hot Swap

PSU A PSU B

CONSOLE

6 2

5 3

6
ALT ON/OFF

PWR

IPM

USB
RESET

CONSOLE

6 2

5 3

6
ALT ON/OFF

STATUS

PWR

IPM

FA N T R AY

FA N T R AY

FA N T R AY

21

Introducing the FortiGate units

Introduction

FortiGate-5020 chassis
You can install one or two FortiGate-5000 series modules in the two slots of the FortiGate-5020 ATCA chassis. The FortiGate-5020 is a 4U chassis that contains two redundant AC to DC power supplies that connect to AC power. The FortiGate-5020 chassis also includes an internal cooling fan tray.

About the FortiGate-5000 series modules

Each FortiGate-5000 series module is a standalone security system that can also function as part of an HA cluster. All FortiGate-5000 series modules are also hot swappable. All FortiGate-5000 series units are high capacity security systems with multiple gigabit interfaces, multiple virtual domain capacity, and other high end FortiGate features. FortiOS Carrier runs on FortiGate-5000 series modules.

FortiGate-5005FA2 module
The FortiGate-5001SX module is an independent high-performance security system with eight Gigabit ethernet interfaces; two of which include Fortinet technology to accelerate small packet performance. The FortiGate-5005FA2 module also supports high-end features including 802.1Q VLANs, multiple virtual domains and specialized FortiGate-5000 series features such as base and fabric backplane switching and FortiOS Carrier MMS content processing and GTP protection.

FortiGate-5001SX module
The FortiGate-5001SX module is an independent high-performance security system with eight Gigabit ethernet interfaces. The FortiGate-5001SX module supports high-end features including 802.1Q VLANs and multiple virtual domains and specialized FortiGate-5000 series features such as base and fabric backplane switching and FortiOS Carrier MMS content processing and GTP protection.

FortiGate-5001FA2 module
The FortiGate-5001FA2 module is an independent high-performance security system with six Gigabit ethernet interfaces. The FortiGate-5001FA2 module is similar to the FortiGate-5001SX module except that two of the FortiGate-5001FA2 interfaces include Fortinet technology to accelerate small packet performance.

FortiGate-5002FB2 module
The FortiGate-5002FB2 module is an independent high-performance FortiGate security system with a total of 6 Gigabit ethernet interfaces. Two of the FortiGate-5002FB2 interfaces include Fortinet technology to accelerate small packet performance.

FortiGate-AMC modules
The FortiGate-AMC modules (including the FortiGate-ADM-XB2, FortiGate-ASM-FB4, and the FortiGate-ASM-SO8) add additional capabilities such as accelerated interfaces, hard disk space and so on to FortiGate units, such as the FortiGate-3600A unit and the FortiGate-3810 unit that contain AMC slots.
HS OOS PWR OT

1
LINK ACT LINK

2
ACT LINK

3
ACT LINK

4
ACT

ASM-FB4

22

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Introducing the FortiGate units

FortiGate-3810A
The FortiGate-3810A multi-threat security appliance is the first standalone security appliance offering optional 10-Gigabit Ethernet interfaces. Four AMC expansion slots allow the FortiGate-3810A to be customized for your exact performance needs. Up to 26 Gbps firewall performance can be achieved in a full configuration with just a single 2U rackmount appliance.
AMC-SW1 AMC-DW1

-E4

AMC-SW2

AMC-DW2

USB

Esc

Enter

CONSOLE

AUX

10

STATUS
POWER

The FortiGate-3810A includes: Base unit provides eight 10/100/1000 interfaces plus two SFP (fiber) interfaces Supports two dual-width and two single-width AMC expansion modules Dual-width AMC slots support up to four 10-Gigabit Ethernet XFP interfaces Single-width AMC slots support up to eight additional Gigabit Ethernet SFP interfaces

FortiGate-3600A
The FortiGate-3600A multi-threat security appliance establishes a new level of priceperformance and flexibility for multigigabit capacity network security systems. With ten gigabit Ethernet interfaces and up to six Gbps throughput, the FortiGate-3600A enables a new generation of high performance protection against blended threats.
CONSOLE

PWR

Esc

Enter

1 2

3 4

5 6

7 8

9 10

MODEM

USB

Hi-Temp

The FortiGate-3600A includes Multi-Gigabit performance for large enterprises and Managed Security Service Providers (MSSPs) ensures security and throughput Provides eight gigabit copper (10/100/1000) interfaces and two gigabit fiber (SFP) interfaces for greater flexibility and to meet the needs of large enterprise and service provider networks Advanced Mezzanine Card (AMC) slot provides future upgrade possibilities with either the four interface hardware accelerated SFP expansion module or the storage expansion module.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

23

Introducing the FortiGate units

Introduction

FortiGate-3016B
The FortiGate-3016B multi-threat security appliance is a carrierclass device with sixteen gigabit Ethernet interfaces and a full complement of network protection features. Each interface of the FortiGate-3016B provides wire-speed firewall performance using Fortinet's advanced FortiASIC network processor technology. Multiple FortiGate-3016Bs can be deployed in redundant clusters to ensure failsafe operation.
FG-AMC-SW
CONSOLE 1 3 5 7 9 11 13 15 17
Esc Enter

POWER STATUS

MODEM

10

12

14

16

18

The FortiGate-3016B is the ideal solution for large enterprises and Managed Security Service Providers (MSSPs) looking to add new security services. The highly available architecture and redundant hot-swappable power supplies ensure failsafe operation, and AMC expansion provide additional connectivity, performance and storage capacity.

FortiGate-3600
The FortiGate-3600 unit provides carrierclass levels of performance and reliability demanded by large enterprises and service providers. The unit uses multiple CPUs and FortiASIC chips to deliver throughput of 4Gbps, meeting the needs of the most demanding applications. The FortiGate-3600 unit includes redundant power supplies, which minimize singlepoint failures, and supports load-balanced operation. The high-capacity, reliability and easy management makes the FortiGate-3600 a natural choice for managed service offerings.
POWER 1 2 3
Esc Enter

Hi-Temp

5/HA

INT

EXT

5/HA

INTERNAL

EXTERNAL

FortiGate-3000
The FortiGate-3000 unit provides the carrier-class levels of performance and reliability demanded by large enterprises and service providers. The unit uses multiple CPUs and FortiASIC chips to deliver a throughput of 3Gbps, meeting the needs of the most demanding applications. The FortiGate-3000 unit includes redundant power supplies to minimize single-point failures, including load-balanced operation and redundant failover with no interruption in service. The high capacity, reliability, and easy management of the FortiGate-3000 makes it a natural choice for managed service offerings.
POWER 1 2 3
Esc Enter

Hi-Temp

4/HA

INT

EXT

4/HA

INTERNAL

EXTERNAL

24

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Introducing the FortiGate units

FortiGate-1000A/AFA2
The FortiGate-1000A/AFA2 Security System is a high performance solution that delivers gigabit throughput with exceptional reliability for the most demanding large enterprise. The FortiGate-1000AFA2 optionally provides 2 additional fiber interfaces featuring FortiAccel ASIC technology enhancing small packet performance. The FortiGate-1000A/AFA2 deploys easily in existing networks and can be used for antivirus and content filtering only or can be deployed as a complete network protection solution. High Availability (HA) operation and redundant hot-swappable power supplies ensure non-stop operation in missioncritical applications. The FortiGate-1000A offers 10 tri-speed 10/100/1000 Base-TX interfaces. The FortiGate1000AFA2 offers 10 tri-speed interfaces + two Small Form-factor Pluggable (SFP) FortiAccel ASIC accelerated interfaces for line rate performance of all packet sizes ideal for applications such as VOIP.
CONSOLE A1

USB

A2

FortiGate-1000
The FortiGate-1000 unit is designed for larger enterprises. The FortiGate1000 meets the needs of the most demanding applications, using multiple CPUs and FortiASIC chips to deliver a throughput of 2Gps. The FortiGate-1000 unit includes support for redundant power supplies to minimize single-interface failures, load-balanced operation, and redundant failover with no interruption in service.
Esc Enter
1 2 3 4 / HA INTERNAL EXTERNAL

FortiGate-800/800F
The FortiGate-800/800F Multi-Threat Security system provides the performance, flexibility, and security necessary to protect today's most demanding large enterprise networks. The FortiGate-800 can be deployed as a high performance antivirus and web content filtering gateway, or as a complete network protection solution leveraging firewall, VPN, IPS and antispam capabilities.
INTERNAL EXTERNAL DMZ HA 1 2 3 4 CONSOLE USB

Esc

Enter

PWR

The FortiGate-800 MultiThreat Security system features four 10/100/1000 tri-speed ethernet interfaces for networks running at gigabit speeds and four userdefinable 10/100 interfaces that provide granular security through multi-zone capabilities, allowing administrators to segment their network into zones and create policies between zones.
PWR INTERNAL EXTERNAL DMZ HA 1 2 3 4 CONSOLE USB

Esc

Enter

800F

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

25

Introducing the FortiGate units

Introduction

FortiGate-500A
The FortiGate-500A MultiThreat Security system provides higher performance, flexibility, and security necessary to protect today's growing enterprise networks. The FortiGate-500A platform features two 10/100/1000 trispeed ethernet interfaces providing flexibility for networks running at or upgrading to gigabit speeds, four user-definable 10/100 interfaces for redundant WAN links, high availability, and multi-zone capabilities that allow administrators a high degree of flexibility to segment their network into zones for granular control of network traffic, and an internal 4-port switch for direct connectivity with the FortiGate-500A.
Esc Enter
CONSOLE USB LAN 10/100 10/100/1000 L1 L2 L3 L4 1 2 3 4 5 6

The FortiGate-500A is ideally suited for enterprise networks, the FortiGate-500A is unmatched in capabilities, speed, and price/performance.

FortiGate-500
The FortiGate-500 unit is designed for larger enterprises. The flexibility, reliability, and easy management makes the FortiGate-500 a natural choice for managed service offerings. The FortiGate-500 supports high availability (HA).
INTERNAL EXTERNAL DMZ HA 1 2 3 4 5 6 7 8

Esc

Enter

FortiGate-400A
The FortiGate-400A MultiThreat Security system provides higher performance, flexibility, and security necessary to protect today's growing enterprise networks. The FortiGate-400A platform features two 10/100/1000 trispeed ethernet interfaces for networks running at or upgrading to gigabit speeds and 4 user-definable 10/100 interfaces provide redundant WAN links, high availability, and multi-zone capabilities, allowing administrators a high degree of flexibility to segment their network into zones and create policies to control network traffic between zones.
Esc Enter
CONSOLE USB 10/100 10/100/1000 1 2 3 4 5 6

You can deploy the FortiGate-400A as a high performance antivirus and web content filtering gateway, or as a complete network protection solution leveraging firewall, intrusion detection and prevention, spam filtering and VPN capabilities.

FortiGate-400
The FortiGate-400 unit is designed for larger enterprises. The FortiGate400 unit is capable of throughput up to 500Mbps and supports high availability (HA), which includes automatic failover with no session loss.
Esc Enter
CONSOLE 1 2 3 4 / HA

26

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Introducing the FortiGate units

FortiGate-300A
The FortiGate-300A MultiThreat Security system provides performance, flexibility, and security necessary to protect today's growing small and medium sized enterprise networks. The FortiGate-300A platform features two 10/100/1000 tri-speed ethernet interfaces for networks running at or upgrading to gigabit speeds and 4 user-definable 10/100 interfaces.
Esc Enter
CONSOLE USB 10/100 10/100/1000 1 2 3 4 5 6

FortiGate-300
The FortiGate-300 unit is designed for larger enterprises. The FortiGate300 unit features high availability (HA), which includes automatic failover with no session loss. This feature makes the FortiGate-300 an excellent choice for mission-critical applications.
Esc Enter

FortiGate-224B
The FortiGate-224B converges network and security products that uniquely integrate multiple layers of threat protection with granular network access controls. The FortiGate-224B delivers configurable interface-level access control that combines traditional FortiOS security technologies with layer 2 switching hardware. The result is a complete and effective Local Area Network (LAN) security solution.
1 3 5 7 9 11 13 15 17 19 21 23

25

26

WAN1

WAN2

USB

CONSOLE

10

12

14

16

18

20

22

24

The FortiGate-224B integrates enhanced network security through the enforcement of security policy at the interface level. The FortiGate-224B provides multi-layered protection against intrusion attempts, viruses, worms, denial of service attacks, spyware and blended threats. The FortiGate-224B can operate in a initially trusted or initially un-trusted mode to adapt to the defined security policy. The FortiGate-224B features: firewall view - the unit is the same as other FortiGate models, except that in firewall view the FortiGate-224B has 28 network interfaces. FortiOS 3.0 MR6 firmware supports this default mode only. switch view - port1 through port26 are switch interfaces on the swlan interface. The web-based manager Switch menu is available, providing access to the following enhanced security features: Access control to enforce software security requirements for client workstations. You can apply this at the interface level or at the inter-VLAN level. Non-compliant clients are restricted to a quarantine VLAN. Route and interface-based VLANs. Firewall protection between secure switch interfaces. Firewall-like security policies to control communication between switch interfaces.

HA is not supported in switch view. FortiOS 3.0 MR6 does not support switch view features, but alternate firmware based on FortiOS 3.0 MR5 is available to support switch view.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

27

Introducing the FortiGate units

Introduction

FortiGate-200A
The FortiGate-200A MultiThreat Security system is an ideal solution for small to medium sized businesses. The FortiGate-200A platform features dual WAN link support for redundant internet connections, and an integrated 4-port switch that eliminates the need for an external hub or switch, giving networked devices a direct connection to the FortiGate-200A unit.
CONSOLE USB INTERNAL DMZ1 DMZ2 WAN1 WAN2

Esc

Enter

The FortiGate-200A delivers high performance for small to mid-sized organizations that require real-time network security services and features four routed 10/100 interfaces with a 4-port Internal switch interface.

FortiGate-200
The FortiGate-200 unit is designed for small businesses, home offices or even branch office applications. The FortiGate200 unit is an easy-to-deploy and easy-to-administer solution. The FortiGate-200 also supports high availability (HA).
POWER STATUS INTERNAL EXTERNAL DMZ CONSOLE INTERNAL EXTERNAL DMZ

FortiGate-100A
The FortiGate-100A system is an ideal solution for small offices. The FortiGate-100A features dual WAN A link support for redundant internet connections, and an integrated 4-port switch that eliminates the need for an external hub or switch, giving networked devices a direct connection to the FortiGate-100A.
INTERNAL PWR STATUS WAN 1 WAN 2 DMZ 1 DMZ 2 1 2 3 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 4

LINK 100

The FortiGate-100A has dual DMZ interfaces provide additional network segmentation for web and mail servers and dual WAN interfaces support redundant, load-balanced links to multiple ISPs.

FortiGate-100
The FortiGate-100 unit is designed for SOHO, SMB and branch office applications. The FortiGate-100 supports advanced features such as 802.1Q VLAN, virtual domains, high availability (HA), and the RIP and OSPF routing protocols.
STATUS INTERNAL EXTERNAL DMZ POWER

28

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Introducing the FortiGate units

FortiGate-60B
The FortiGate-60B multi-threat security solution offers Small and Medium Business and SOHO/ROBO users enterpriseclass protection against blended threats targeting 3G broadband, wireless LAN and wired infrastructure. The FortiGate-60B supports a wide array of wireless broadband PC Cards. The FortiGate-60B offers enterprise-class security for the SOHO/ROBO users and the flexibility needed for quick Point of Sales deployment.
1
INTERNAL

POWER STATUS

HA

ALARM

WAN 1

WAN 2

DMZ

FortiGate-60B offers a PC Card slot, dual WAN link support for redundant internet connections, a DMZ interface and 6 built-in switch interfaces. The FortiGate-60B also offers an integrated analog modem for dial backup capability. The FortiGate-60B is ideal for small businesses and enterprise remote offices where complete security including Firewall, IPSec and SSL VPN, Intrusion prevention, Antivirus, Web filtering and Antispam are needed. The FortiGate-60B also supports wide range of 3G wireless PC Cards for instant Point of Sales deployment.

FortiWiFi-60B
The FortiWiFi-60B multi-threat security solution offers Small and Medium Business and SOHO/ROBO users enterprise-class protection against blended threats targeting 3G broadband, wireless LAN and wired infrastructure. The FortiWiFi-60B supports a wide array of wireless broadband PC Cards and optional built-in 802.11 a/b/g wireless support. The FortiWiFi-60B offers enterprise-class security for the SOHO/ROBO users and the flexibility needed for quick Point of Sales deployment.
1
INTERNAL

POWER STATUS

HA

ALARM

Wifi

WAN 1

WAN 2

DMZ

The FortiWiFi-60B is the only dual wireless enabled platform with supports for both WiFi and 3G wireless simultaneously. Integrated 802.11a/b/g wireless LAN access point with a DMZ, Dual WAN and 6 switch interfaces provide ample of connectivity options for the remote office or small size business. The FortiWiFi-60B supports a wide range of 3G wireless PC Cards to provide an ideal wireless broadband and wireless LAN gateway

FortiGate-60/60M/ADSL
The FortiGate-60ADSL offers an integrated ADSL modem for Internet connectivity. It supports multiple ADSL standards, including ANSI T1.413 issue 2, ITU G.dmt and ITU G.lite, as well as support for Annex A.
INTERNAL PWR STATUS 1 2 3 4 DMZ WAN1 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 WAN2 LINK 100

The FortiGate-60ADSL is a complete security system for remote offices and teleworker sites that connect to the main office using ADSL.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

29

Introducing the FortiGate units

Introduction

The FortiGate unit has an integrated 4-port switch that leverages scarce resources and management overhead by eliminating the need for an external hub or switch.

FortiWiFi-60/60A/60AM
The FortiWiFi-60 model provides a secure, wireless LAN solution for wireless connections. It combines mobility and flexibility with FortiWiFi Antivirus Firewall features, and can be upgraded to future radio technologies. The FortiWiFi-60 serves as the connection point between wireless and wired networks or the center-point of a standalone wireless network.

INTERNAL PWR WLAN 1 LINK 100 2 LINK 100 3 LINK 100 4 LINK 100 DMZ LINK 100 WAN1 LINK 100 WAN2 LINK 100

FortiWiFi-50B
The FortiWiFi-50B adds wireless connectivity by providing standard 802.11 b/g support. The FortiWiFi50B can be powered by standard based Power Over Ethernet (POE) devices to ease installation and deployment. The FortiWiFi-50B is ideal for remote offices, wireless service providers, retail stores, broadband telecommuter sites, and many other applications. The FortiWiFi-50B provides complete real-time network protection for wired and wireless users through a combination of antivirus, intrusion detection and prevention, web and email content filtering, firewall and VPN services.
WLAN
LINK / ACT 10/100

WAN1 (PoE)

INTERNAL WAN2

POWER

STATUS

FortiGate-50B
The FortiGate-50B offers dual WAN interfaces for load balancing or redundant internet connections. The FortiGate-50B provides three integrated switch interfaces for multi-user environments in a small remote office. It is ideally suited for remote offices, retail stores, broadband telecommuter sites and many other applications.
INTERNAL WAN1 WAN2
LINK / ACT 10/100

POWER

STATUS

The FortiGate-50B provides complete real-time network protection through a combination of network-based antivirus, web and email content filtering, firewall, VPN, network-based intrusion detection and prevention, and traffic shaping.

30

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Fortinet family of products

FortiGate-50A
The FortiGate-50A unit is designed for telecommuters and small remote A offices with 10 or fewer employees. The FortiGate-50 unit includes an external modem interface that can be used as a backup or stand alone connection to the Internet.
PWR STATUS INTERNAL LINK 100 EXTERNAL LINK 100

Fortinet family of products

Fortinet offers a family of products that includes both software and hardware appliances for a complete network security solution including mail, logging, reporting, network management, and security along with FortiGate Unified Threat Manager Systems. For more information on the Fortinet product family, go to www.fortinet.com/products.

FortiGuard Subscription Services

FortiGuard Subscription Services are security services created, updated and managed by a global team of Fortinet security professionals. They ensure the latest attacks are detected and blocked before harming your corporate resources or infecting your end-user computing devices. These services are created with the latest security technology and designed to operate with the lowest possible operational costs. For more information about FortiGuard services, go to the FortiGuard Center at www.fortiguard.com.

FortiAnalyzer
FortiAnalyzer provides network administrators with the information they need to enable the best protection and security for their networks against attacks and vulnerabilities. FortiAnalyzer features include: collects logs from FortiGate units and syslog devices and FortiClient creates hundreds of reports using collected log data scans and reports vulnerabilities stores files quarantined from a FortiGate unit

The FortiAnalyzer unit can also be configured as a network analyzer to capture real-time traffic on areas of your network where firewalls are not employed. You can also use the unit as a storage device where users can access and share files, including the reports and logs that are saved on the FortiAnalyzer hard disk.

FortiClient
FortiClient Host Security software provides a secure computing environment for both desktop and laptop users running the most popular Microsoft Windows operating systems. FortiClient offers many features including: creating VPN connections to remote networks configuring real-time protection against viruses guarding against modification of the Windows registry virus scanning.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

31

Fortinet family of products

Introduction

FortiClient also offers a silent installation feature, enabling an administrator to efficiently distribute FortiClient to several users computers with preconfigured settings.

FortiManager
FortiManager meets the needs of large enterprises (including managed security service providers) responsible for establishing and maintaining security policies across many dispersed FortiGate installations. With FortiManager you can configure multiple FortiGate units and monitor their status. You can also view realtime and historical logs for FortiGate units. FortiManager emphasizes ease of use, including easy integration with third party systems.

FortiBridge
FortiBridge products are designed to provide enterprise organizations operating FortiGate units in Transparent mode with continuous network traffic flow in the event of a power outage or a FortiGate system failure. The FortiBridge unit bypasses the FortiGate unit to make sure that the network can continue processing traffic. FortiBridge products are easy to use and deploy, including providing customizable actions a FortiBridge unit takes in the event of a power outage or FortiGate system failure.

FortiMail
FortiMail provides powerful, flexible heuristic scanning and reporting capabilities to incoming and outgoing email traffic. The FortiMail unit has reliable, high performance features for detecting and blocking malicious attachments and spam, such as FortiGuard Antispam/Antivirus support, heuristic scanning, greylisting, and Bayesian scanning. Built on Fortinets award winning FortiOS and FortiASIC technology, FortiMail antivirus technology extends full content inspection capabilities to detect the most advanced email threats.

32

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

About this document

About this document

This FortiGate Version 3.0 MR6 Administration Guide provides detailed information about FortiGate web-based manager options and how to use them. This guide also contains some information about the FortiGate CLI. This administration guide describes web-based manager functions in the same order as the web-based manager menu. The document begins with a general description of the FortiGate web-based manager and a description of FortiGate virtual domains. Following these chapters, each item in the System menu, Router menu, Firewall menu, and VPN menu gets a separate chapter. Then User, AntiVirus, Intrusion Protection, Web Filter, AntiSpam, IM/P2P, and Log & Report are all described in single chapters. The document concludes with a detailed index. The most recent version of this document is available from the FortiOS page of the Fortinet Technical Documentation web site. The information in this document is also available in a slightly different form as FortiGate web-based manager online help. You can find more information about FortiOS v3.0 from the FortiGate page of the Fortinet Technical Documentation web site as well as from the Fortinet Knowledge Center. This administration guide contains the following chapters: Web-based manager provides an introduction to the features of the FortiGate web-based manager, the button bar, and includes information about how to use the web-based manager online help. System Status describes the System Status page, the dashboard of your FortiGate unit. At a glance you can view the current system status of the FortiGate unit including serial number, uptime, FortiGuard license information, system resource usage, alert messages and network statistics. This section also describes status changes that you can make, including changing the unit firmware, host name, and system time. Finally this section also describes the topology viewer that is available on all FortiGate models except those with model numbers 50 and 60. Using virtual domains describes how to use virtual domains to operate your FortiGate unit as multiple virtual FortiGate units, providing separate firewall and routing services to multiple networks. System Network explains how to configure physical and virtual interfaces and DNS settings on the FortiGate unit. System Wireless describes how to configure the Wireless LAN interface on a FortiWiFi-60 unit. System DHCP provides information about how to configure a FortiGate interface as a DHCP server or DHCP relay agent. System Config contains procedures for configuring HA and virtual clustering, configuring SNMP and replacement messages, and changing the operation mode. System Certificates explains how to manage X.509 security certificates used by various FortiGate features such as IPSec VPN and administrator authentication.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

33

About this document

Introduction

System Administrators guides you through adding and editing administrator accounts, defining access profiles for administrators, configuring central management using the FortiGuard Management Service or FortiManager, defining general administrative settings such as language, timeouts, and web administration ports. System Maintenance details how to back up and restore the system configuration using a management computer or a USB disk, use revision control, enable FortiGuard services and FortiGuard Distribution Network (FDN) updates, and enter a license key to increase the maximum number of virtual domains. System Chassis (FortiGate-5000 series) describes information displayed on the system chassis web-based manager pages about all of the hardware components in your FortiGate-5140 or FortiGate-5050 chassis. Router Static explains how to define static routes and create route policies. A static route causes packets to be forwarded to a destination other than the factory configured default gateway. Router Dynamic contains information about how to configure dynamic protocols to route traffic through large or complex networks. Router Monitor explains how to interpret the Routing Monitor list. The list displays the entries in the FortiGate routing table. Firewall Policy describes how to add firewall policies to control connections and traffic between FortiGate interfaces, zones, and VLAN subinterfaces. Firewall Address describes how to configure addresses and address groups for firewall policies. Firewall Service describes available services and how to configure service groups for firewall policies. Firewall Schedule describes how to configure one-time and recurring schedules for firewall policies. Firewall Virtual IP describes how to configure and use virtual IP addresses and IP pools. Firewall Protection Profile describes how to configure protection profiles for firewall policies. VPN IPSEC provides information about the tunnel-mode and route-based (interface mode) Internet Protocol Security (IPSec) VPN options available through the web-based manager. VPN PPTP explains how to use the web-based manager to specify a range of IP addresses for PPTP clients. VPN SSL provides information about basic SSL VPN settings. User Authentication details how to control access to network resources through user authentication. AntiVirus explains how to enable antivirus options when you create a firewall protection profile. Intrusion Protection explains how to configure IPS options when a firewall protection profile is created. Web Filter explains how to configure web filter options when a firewall protection profile is created. Antispam explains how to configure spam filter options when a firewall protection profile is created.

34

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

About this document

IM, P2P & VoIP explains how to configure IM, P2P, and VoIP options when a firewall protection profile is created. You can view IM, P2P, and VoIP statistics to gain insight into how the protocols are being used within the network. Log&Report describes how to enable logging, view log files, and view the basic reports available through the web-based manager.

Document conventions
The following document conventions are used in this guide: To avoid publication of public IP addresses that belong to Fortinet or any other organization, the IP addresses used in Fortinet technical documentation are fictional and follow the documentation guidelines specific to Fortinet. The addresses used are from the private IP address ranges defined in RFC 1918: Address Allocation for Private Internets, available at http://ietf.org/rfc/rfc1918.txt?number-1918. Notes and Cautions are used to provide important information:

Note: Highlights useful additional information.

Caution: Warns you about commands or procedures that could have unexpected or undesirable results including loss of data or damage to equipment.

Typographic conventions
Fortinet documentation uses the following typographical conventions:
Convention Menu commands Keyboard input Code examples Example Go to VPN > IPSEC > Phase 1 and select Create New. In the Gateway Name field, type a name for the remote VPN peer or client (for example, Central_Office_1). config sys global set ips-open enable end config firewall policy edit id_integer set http_retry_count <retry_integer> set natip <address_ipv4mask> end FortiGate Administration Guide <HTML><HEAD><TITLE>Firewall Authentication</TITLE></HEAD> <BODY><H4>You must authenticate to use this service.</H4> Welcome!

CLI command syntax

Document names File content

Program output Variables

<address_ipv4>

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

35

FortiGate documentation

Introduction

FortiGate documentation
The most up-to-date publications and previous releases of Fortinet product documentation are available from the Fortinet Technical Documentation web site at http://docs.forticare.com. The following FortiGate product documentation is available: FortiGate QuickStart Guide Provides basic information about connecting and installing a FortiGate unit. FortiGate Installation Guide Describes how to install a FortiGate unit. Includes a hardware reference, default configuration information, installation procedures, connection procedures, and basic configuration procedures. Choose the guide for your product model number. FortiGate Administration Guide Provides basic information about how to configure a FortiGate unit, including how to define FortiGate protection profiles and firewall policies; how to apply intrusion prevention, antivirus protection, web content filtering, and spam filtering; and how to configure a VPN. FortiGate online help Provides a context-sensitive and searchable version of the Administration Guide in HTML format. You can access online help from the web-based manager as you work. FortiOS CLI Reference Describes how to use the FortiGate CLI and contains a reference to all FortiGate CLI commands. FortiGate Log Message Reference Available exclusively from the Fortinet Knowledge Center, the FortiGate Log Message Reference describes the structure of FortiGate log messages and provides information about the log messages that are generated by FortiGate units. FortiGate High Availability Overview and FortiGate High Availability User Guide These documents contain in-depth information about the FortiGate High Availability (HA) feature and the FortiGate clustering protocol. FortiGate IPS User Guide Describes how to configure the FortiGate Intrusion Prevention System settings and how the FortiGate IPS deals with some common attacks. FortiGate IPSec VPN User Guide Provides step-by-step instructions for configuring IPSec VPNs using the webbased manager. FortiGate SSL VPN User Guide Compares FortiGate IPSec VPN and FortiGate SSL VPN technology, and describes how to configure web-only mode and tunnel-mode SSL VPN access for remote users through the web-based manager. FortiGate PPTP VPN User Guide Explains how to configure a PPTP VPN using the web-based manager.

36

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Introduction

Customer service and technical support

FortiGate Certificate Management User Guide Contains procedures for managing digital certificates including generating certificate requests, installing signed certificates, importing CA root certificates and certificate revocation lists, and backing up and restoring installed certificates and private keys.

FortiGate VLANs and VDOMs User Guide Describes how to configure VLANs and VDOMS in both NAT/Route and Transparent mode. Includes detailed examples.

Fortinet Tools and Documentation CD

All Fortinet documentation is available from the Fortinet Tools and Documentation CD shipped with your Fortinet product. The documents on this CD are current for your product at shipping time. For the latest versions of all Fortinet documentation see the Fortinet Technical Documentation web site at http://docs.forticare.com.

Fortinet Knowledge Center

Additional Fortinet technical documentation is available from the Fortinet Knowledge Center. The knowledge center contains troubleshooting and how-to articles, FAQs, technical notes, and more. Visit the Fortinet Knowledge Center at http://kc.forticare.com.

Comments on Fortinet technical documentation

Please send information about any errors or omissions in this document, or any Fortinet technical documentation, to [email protected].

Customer service and technical support

Fortinet Technical Support provides services designed to make sure that your Fortinet systems install quickly, configure easily, and operate reliably in your network. Please visit the Fortinet Technical Support web site at http://support.fortinet.com to learn about the technical support services that Fortinet provides.

Register your Fortinet product

Register your Fortinet product to receive Fortinet customer services such as product updates and technical support. You must also register your product for FortiGuard services such as FortiGuard Antivirus and Intrusion Prevention updates and for FortiGuard Web Filtering and AntiSpam. Register your product by visiting http://support.fortinet.com and selecting Product Registration. To register, enter your contact information and the serial numbers of the Fortinet products that you or your organization have purchased. You can register multiple Fortinet products in a single session without re-entering your contact information.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

37

Register your Fortinet product

Introduction

38

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web-based manager

Web-based manager
This section describes the features of the user-friendly web-based manager administrative interface of your FortiGate unit. Using HTTP or a secure HTTPS connection from any management computer running a web browser, you can connect to the FortiGate web-based manager to configure and manage the FortiGate unit. The recommended minimum screen resolution for the management computer is 1280 by 1024. The web-based manager supports multiple languages (go to System > Admin > Settings). You can configure the FortiGate unit for HTTP and HTTPS administration from any FortiGate interface (go to System > Network > Interface).
Figure 1: Example FortiGate-5001SX Web-based manager dashboard (default configuration)

You can go to System > Status to view detailed information about the status of your FortiGate unit on the system dashboard. The dashboard displays information such as the current FortiOS firmware version, antivirus and IPS definition versions, operation mode, connected interfaces, whether the FortiGate unit is connected to a FortiAnalyzer unit and a FortiManager unit or other central management service, and system resources.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

39

Button bar features

Web-based manager

You can use the web-based manager menus, lists, and configuration pages to configure most FortiGate settings. Configuration changes made using the web-based manager are effective immediately without resetting the FortiGate unit or interrupting service. Once you are satisfied with a configuration, you can back it up (select the Backup Configuration button on the button bar in the upper right corner of the web-based manager or go to System > Maintenance > Backup & Restore). The saved configuration can be restored at any time. The web-based manager also includes detailed context-sensitive online help. Select the Online Help button on the button bar in the upper right corner of the web-based manager to display help for the current web-based manager page. For information about connecting to the web-based manager, see the Install Guide for your FortiGate unit. This section describes: Button bar features Web-based manager pages Using FortiGate Online Help

Button bar features

The button bar in the upper right corner of the web-based manager provides access to several important FortiGate features.
Figure 2: Web-based manager button bar

Contact Customer Support Online Help

Logout Backup Configuration

Contact Customer Support

The Contact Customer Support button opens the Fortinet Support web page in a new browser window. From this page you can: Visit the Fortinet Knowledge Center. Log into Customer Support (Support Login). Register your Fortinet product (Product Registration). View Fortinet Product End of Life information. Find out about Fortinet Training and Certification. Visit the FortiGuard Center.

To register a Fortinet product, go to Product Registration and follow the instructions. You must register your Fortinet product to receive product updates, technical support, and FortiGuard services.
40 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web-based manager

Button bar features

Backup your FortiGate configuration

Select the Backup Configuration button to backup your FortiGate configuration. You can backup your FortiGate configuration to: The local PC that you are using to manage the FortiGate unit. A management station. This can be a FortiManager unit or the FortiGuard Management Service; as configured from System > Admin > Central Management. See Central Management on page 198. This option changes depending on your central management configuration. A USB disk if your FortiGate has a USB port and you have connected a USB disk to it.

For more information about backing up and restoring your FortiGate configuration, see Backup and Restore on page 217.
Figure 3: Backup your FortiGate configuration

Using FortiGate Online Help

The Online Help button displays online help for the current web-based manager page. The online help page that is displayed contains information and procedures related to the controls on the current web-based manager page. Most help pages also contains hyperlinks to related topics. The online help system also includes a number of controls that you can use to find additional information.
Figure 4: Viewing system status online help page

Show Navigation Previous Next

Bookmark Print Email

Show Navigation

Open the online help navigation pane. From the navigation pane you can use the online help table of contents, index, and search to access all of the information in the online help. The online help is organized in the same way as the FortiGate web-based manager and the FortiGate Administration Guide. Display the previous page in the online help. Display the next page in the online help.

Previous Next FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

41

Button bar features

Web-based manager

Email

Send an email to Fortinet Technical Documentation at [email protected]. You can use this email address to let us know if you have a comment about or correction for the online help or any other Fortinet technical documentation product. Print the current online help page. Add an entry for this online help page to your browser bookmarks or favorites list. Use this button to make it easier to find helpful online help pages. You cannot use the Bookmark icon to add an entry to your favorites list if you are viewing online help from Internet Explorer running on a management PC with Windows XP and service pack 2 installed.

Print Bookmark

Figure 5: Online help page with navigation pane

Contents

Index Search

Show in Contents

Contents

Display the online help table of contents. You can navigate through the table of contents to find information in the online help. The online help is organized in the same way as the FortiGate web-based manager and the FortiGate Administration Guide. Display the online help index. You can use the index to find information in the online help. Display the online help search. See About searching the online help on page 42 for information about how to search for information in the online help. If you have used the index, search, or hyperlinks to find information in the online help, the table of contents may not be visible or the table of contents may be out of sync with the current help page. You can select Show in Contents to display the table of contents showing the location of the current help page.

Index Search

Show in Contents

About searching the online help

Using the online help search, you can search for one word or multiple words in the full text of the FortiGate online help system. Please note the following about the search: If you search for multiple words, the search finds help pages that contain all of the words that you entered. The search does not find help pages that only contain one of the words that you entered. The help pages found by the search are ranked in order of relevance. The higher the ranking, the more likely the help page includes useful or detailed information about the word or words that you are searching for. Help pages with the search words in the help page title are ranked highest. You can use the asterisk (*) as a search wildcard character that is replaced by any number of characters. For example, if you search for auth* the search finds help pages containing auth, authenticate, authentication, authenticates, and so on.

42

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web-based manager

Button bar features

In some cases the search only finds exact matches. For example if you search for windows the search may not find pages containing the word window. You can work around this using the * wildcard (for example by searching for window*).

To search in the online help system 1 2 3 4 From any web-based manager page, select the online help button. Select Show Navigation to display the online help navigation pane. Select Search. Type one or more words to search for in the search field and then press the Enter key on your keyboard or select the Go button on the help system button bar. The search pane lists the names of all the online help pages that contain the word or words that you entered. Select a name from the list to display that help page.
Figure 6: Searching the online help system Go Button Search Field

Search Results

Using the keyboard to navigate in the online help

You can use the keyboard shortcuts listed in Table 1 to display and find information in the online help.
Table 1: Online help navigation keys Key Alt+1 Alt+2 Alt+3 Alt+4 Alt+5 Alt+7 Function Display the table of contents. Display the index. Display the Search tab. Go to the previous page. Go to the next page. Send an email to Fortinet Technical Documentation at [email protected]. You can use this email address to let us know if you have a comment about or correction for the online help or any other Fortinet technical documentation product. Print the current online help page. Add an entry for this online help page to your browser bookmarks or favorites list. Use this button to make it easier to find helpful online help pages.

Alt+8 Alt+9

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

43

Web-based manager pages

Web-based manager

Logout
The Logout button immediately logs you out of the web-based manager. Log out before you close the browser window. If you simply close the browser or leave the web-based manager, you remain logged-in until the idle timeout (default 5 minutes) expires.

Web-based manager pages

The web-based manager interface consists of a menu and pages. Many of the pages have multiple tabs. When you select a menu item, such as System, the web-based manager expands to reveal a submenu. When you select one of the submenu items, the associated page opens at its first tab. To view a different tab, select the tab. The procedures in this manual direct you to a page by specifying the menu item, the submenu item and the tab, for example: 1 Go to System > Network > Interface.
Figure 7: Parts of the web-based manager (shown for the FortiGate-50B)

Tabs

Page

Button bar

Menu

This section describes: Using the web-based manager menu Using web-based manager lists Adding filters to web-based manager lists Using page controls on web-based manager lists Using column settings to control the columns displayed in some web-based manager lists Using web-based manager icons
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

44

Web-based manager

Web-based manager pages

Using the web-based manager menu

The menu provides access to configuration options for all major FortiGate features.
System Configure system settings, such as network interfaces, virtual domains, DHCP services, administrators. High Availability (HA), system time and set system options. Configure FortiGate static and dynamic routing. Configure firewall policies and protection profiles that apply network protection features. Also configure virtual IP addresses and IP pools. Configure IPSec, SSL, and PPTP virtual private networking. Configure user accounts for use with firewall policies that require user authentication. Also configure external authentication servers such as RADIUS, LDAP, TACACS+, and Windows AD. Configure antivirus protection. Configure the FortiGate Intrusion Protection System (IPS). Configure web filtering. Configure email spam filtering.

Router Firewall VPN User

AntiVirus Intrusion Protection Web Filter AntiSpam

IM, P2P & VoIP Configure monitoring and control of internet messaging, peer-to-peer messaging, and voice over IP (VoIP) traffic. Log & Report Configure logging and alert email. View log messages and reports.

Using web-based manager lists

Many of the web-based manager pages are lists. There are lists of network interfaces, firewall policies, administrators, users, and so on. If you login as an administrator with an access profile that allows Read-Write access to a list, depending on the list you will usually be able to: Select Create New to add a new item to the list. Select the Edit icon for a list item to view and optionally change the settings of the item. Select the Delete icon for a list item to delete the item. The delete icon will not be available of the item cannot be deleted. Usually items cannot be deleted if they have been added to another configuration. To delete an item that does not have a delete icon you must find the configuration settings that the item has been added to and remove the item from them. For example, to delete a user that has been added to a user group you must first remove the user from the user group (see Figure 8).

Figure 8: Example of a web-based manager list (read-write access)

Delete Edit

If you login as an administrator with an access profile that allows Read Only access to a list you will only be able to view the items on the list (see Figure 9).
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

45

Web-based manager pages

Web-based manager

Figure 9: Example of a web-based manager list

View

For information about access profiles, see Access profiles on page 194.

Adding filters to web-based manager lists

On the following web-based manager pages that contain complex lists, you can add filters to control the information that is displayed by the list. Session list (see Viewing the session list on page 72) Firewall policy and IPv6 policy list (see Viewing the firewall policy list on page 283) IPSec VPN Monitor (see Monitor on page 385) Intrusion protection predefined signatures list (see Viewing the predefined signature list on page 437) Log and report log access list (see Accessing Logs on page 513)

Filters are useful for reducing the number of entries that are displayed on a list so that you can focus on the information that is important to you. For example, you can go to System > Status and in the Statistics section, select Details on the Sessions line to view the communications sessions currently being processed by the FortiGate unit. A busy FortiGate unit may be processing hundreds or thousands of communications sessions. If you are looking for specific communications sessions, you can add filters to make it easier to find them. For example, you might be looking for all communications sessions being accepted by a specific firewall policy. You can add a Policy ID filter to display only the sessions for a particular Policy ID or range of Policy IDs. You add filters to a web-based manager list by selecting any filter icon to display the Edit Filters window. From the Edit Filters window you can select any column name to filter and configure the filter for that column. You can add filters for one column or for multiple columns. You can configure multiple columns and then select OK. The filter icon remains grey for unfiltered columns and changes to green for filtered columns.
Figure 10: Example intrusion protection predefined signatures list filtered to display all signatures containing the string apache with logging enabled, action set to drop, and severity set to high Filter added to Display Names that Include apache

No Filter Added

The filter configuration is retained after leaving the web-based manager page and even after logging out of the web-based manager or rebooting the FortiGate unit.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

46

Web-based manager

Web-based manager pages

Different filter styles are available depending on the type of information displayed in individual columns. In all cases, you configure filters by specifying what to filter on and whether to display information that matches the filter or you can select NOT to display information that does not match the filter.
Note: Filter settings are stored in the FortiGate configuration and will be maintained the next time that you access any list for which you have added filters.

On firewall policy, IPv6 policy, predefined signature and log and report log access lists, you can combine filters with column settings to provide even more control of the information displayed by the list. See Using filters with column settings on page 51 for more information.

Filters for columns that contain numbers

If the column includes numbers (for example, IP addresses, firewall policy IDs, or port numbers) you can filter by a single number or a range of numbers. For example you could configure a source address column to display only entries for a single IP address or for all addresses in a ranged of addresses range. To specify a range separate the top and bottom values of the range with a dash, for example 25-50. Figure 11 shows configuring a numeric filter to control the source addresses that are displayed on the session list. In this example a filter is enabled for the Source Address column. The filter is configured to display only source addresses in the range of 1.1.1.1-1.1.1.2. To view the session list, display details about sessions from the Statistics section of the web-based manager dashboard.
Figure 11: Example session list with a numeric filter set to display sessions with source IP address in the range of 1.1.1.1-1.1.1.2

Filters for columns containing text strings

If the column includes text strings (for example, names) you can filter by a text string. You can also filter information that is an exact match for the text string (equals), that contains the text string, or that does not equal or does not contain the text string. You can also specify whether to match the capitalization (case) of the text string.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

47

Web-based manager pages

Web-based manager

Figure 12: Example firewall policy list filter to display all policies that do not include a source address with a name that contains the string My_Address

Filters for columns that can only contain specific items

For columns that can only contain specific items (for example, a log message severity or a pre-defined signature action) you can select a single item from a list. In this case, you can only filter on a single selected item.
Figure 13: Example intrusion protection predefined signature list filter to display all signatures with Action set to block

Custom filters
Other custom filters are also available. You can filter log messages according to date range and time range. You can also set the level log message filter to display log message with multiple severity levels.

48

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web-based manager

Web-based manager pages

Figure 14: Example log access filter to display all log messages with level of alert, critical, error, or warning

Using page controls on web-based manager lists

Some web-based manager lists can include more items than you can display on a typical browser window. To make it easier to view the items in these lists, the web-based manager includes page controls for paging through the lists. Page controls are available for the following lists: Session list (see Viewing the session list on page 72) Router Monitor (see Router Monitor on page 277) IPSec VPN Monitor (see Monitor on page 385) Intrusion protection predefined signatures list (see Viewing the predefined signature list on page 437) Web filtering lists (see Web Filter on page 451) Antispam lists (see Antispam on page 473) Log and report log access lists (see Accessing Logs on page 513)

Figure 15: Example page controls

Previous Page First Page

Total Number of Pages

Last Page Next Page Current Page (enter a page number to display that page)
First Page Previous Page Current Page Display the first page of items in the list. Display the previous page of items in the list. The current page number of list items that are displayed. You can enter a page number and press Enter to display the items on that page. For example if there are 5 pages of items and you enter 3, page 3 of the sessions will be displayed.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

49

Web-based manager pages

Web-based manager

Total Number of The number of pages of list items that you can view. Pages Next Page Last Page Display the next page of items in the list. Display the last page of items in the list.

Using column settings to control the columns displayed in some web-based manager lists
On the following web-based manager pages that contain complex lists, you can change column settings to control the information columns that are displayed for the list and to control the order in which they are displayed. Network interface list (see Interfaces on page 93) Firewall policy and IPv6 policy (see Viewing the firewall policy list on page 283) Intrusion protection predefined signatures list (see Viewing the predefined signature list on page 437) Log and report log access lists (see Accessing Logs on page 513)

Using column settings, you can format web-based manager lists so that information that is important to you is easy to find and information that is less important to you is hidden or does not make it difficult to view important information.
Note: Column settings are stored in the FortiGate configuration and will be maintained the next time that you access any list for which you have changed the column settings.

To change column settings on a list that supports it, select Column Settings. Move the column headings to be displayed to the Show these fields in this order list. Use the move up and move down buttons to change the order in which the columns are displayed. Move the column headings to be hidden to the Available fields list. For example you can change interface list column headings to display only the IP/Netmask, MAC address, MTU, and interface Type for each interface.
Figure 16: Example interface list column settings

50

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web-based manager

Web-based manager pages

Figure 17: Example FortiGate-5001SX interface list with column settings changed

Using filters with column settings

On firewall policy, IPv6 policy, predefined signature and log and report log access lists you can combine filters with column settings to provide even more control of the information displayed by the list. For example, you can go to Intrusion Protection > Signature > Predefined and configure the Intrusion Protection predefined signatures list to show only the names of signatures that protect against vulnerabilities for a selected application. To do this, set Column Settings to only display Applications and Name. Then apply a filter to Applications so that only selected applications are listed. In the pre-defined signatures list you can also sort the list by different columns so you might want to sort the list by application so that all signatures for each application are grouped together.
Figure 18: Example pre-defined signatures list: displaying pre-defined signatures for the Veritas and Winamp applications

For information about adding filters, see Adding filters to web-based manager lists on page 46.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

51

Web-based manager pages

Web-based manager

Using web-based manager icons

The web-based manager has icons in addition to buttons to enable you to interact with your FortiGate unit. There are tooltips to assist you in understanding the function of most icons. Pause the mouse pointer over the icon to view the tooltip. Table 2 describes the icons that are available in the web-based manager.
Table 2: web-based manager icons Icon Name Description

Administrative The administrative status of a FortiGate interface is down status down and the interface will not accept traffic. Administrative The administrative status of a FortiGate interface is up and status up the interface accepts traffic. Change Password Clear Change the administrator password. This icon appears in the Administrators list if your access profile enables you to give write permission to administrators. Clear all or remove all entries from the current list. For example, on a URL filter list you can use this icon to remove all URLs from the current URL filter list. Collapse this section to hide some fields. This icon is used in some dialog boxes and some lists. Delete an item. This icon appears in lists where the item can be deleted and you have edit permission on the page. The tooltip for this icon displays the Description or Comments field for this table entry. Disconnect a FortiGate unit from a functioning HA cluster. Download information from a FortiGate unit. For example, you can download certificates and debug logs. Edit a configuration. This icon appears in lists where you have write permission on the page.

Collapse Delete Description Disconnect from cluster Download Edit

Enter a VDOM Enter a virtual domain and use the web-based manager to configure settings for the virtual domain. Expand Expand this section to reveal more fields. This icon is used in some dialog boxes and some lists. Sometimes called a twistie. Set a filter on one or more columns in this table. See Adding filters to web-based manager lists on page 46.

Filter

First page Insert before

View the first page of a list. Add a new item to a list so that it precedes the current item. Used in lists when the order of items in the list is significant, for example firewall policies, IPS Sensors, and DoS Sensors. View the last page of a list. Change the position of an item in a list. Used in lists when the order of items in the list is significant, for example firewall policies, IPS Sensors, and DoS Sensors.

Last page Move to

52

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web-based manager

Web-based manager pages

Table 2: web-based manager icons (Continued) Icon Name Next page Description View the next page of a list.

Previous page View the previous page of a list. Refresh View Update the information on this page. View a configuration. This icon appears in lists instead of the Edit icon when you have read-only access to a web-based manager list. View detailed information about an item. For example, you can use this icon to view details about certificates.

View details

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

53

Web-based manager pages

Web-based manager

54

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Status page

System Status
This section describes the System Status page, the dashboard of your FortiGate unit. At a glance you can view the current system status of the FortiGate unit including serial number, uptime, FortiGuard license information, system resource usage, alert messages and network statistics.
Note: Your browser must support Javascript to view the System Status page.

This section describes: Status page Changing system information Changing the FortiGate firmware Viewing operational history Manually updating FortiGuard definitions Viewing Statistics Topology

Status page
View the System Status page, also known as the system dashboard, for a snapshot of the current operating status of the FortiGate unit. FortiGate administrators whose access profiles permit read access to System Configuration can view system status information. When the FortiGate unit is part of an HA cluster, the System Status page includes basic high availability (HA) cluster status such as including the name of the cluster and the cluster members including their host names. To view more complete status information for the cluster, go to System > Config > HA. For more information, see HA on page 151. HA is not available on FortiGate-50A and 50AM models. FortiGate administrators whose access profiles permit write access to system configuration can change or update FortiGate unit information. For information on access profiles, see Access profiles on page 194.

Viewing system status

The System Status page displays by default when you log in to the web-based manager. Go to System > Status to view the System Status page. To view this page, your access profile must permit read access to system configuration. If you also have system configuration write access, you can modify system information and update FortiGuard - AV and FortiGuard - IPS definitions. For information on access profiles, see Access profiles on page 194.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

55

Status page

System Status

The System Status page is customizable. You can select which widgets to display, where they are located on the page, and if they are minimized or maximized. Each display has an icon associated with it for easy recognition when minimized.
Figure 19: System Status page

Select Add Content to add any of the widgets not currently shown on the System Status page. Any widgets currently on the System Status page will be greyed out in the Add Content menu, as you can only have one of each display on the System Status page. Optionally select Back to Default to restore the historic System Status page configuration. Position your mouse over a displays titlebar to see your available options for that display. The options vary slightly from display to display.
Figure 20: A minimized display

Widget title Disclosure arrow

Widget Title Disclosure arrow History Edit Refresh Close

History Edit Refresh Close

Shows the name of the display Select to maximize or minimize the display. Select to show an expanded set of data. Not available for all widgets. Select to change settings for the display. Select to update the displayed information. Select to close the display. You will be prompted to confirm the action.

The available dashboard widgets are: System Information License Information Unit Operation
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

56

System Status

Status page

System Resources Alert Message Console Statistics CLI Console Top Sessions Top Viruses Top Attacks Traffic History

System Information
Go to System > Status to find System Information.
Figure 21: System Information

Serial Number Uptime System Time

The serial number of the FortiGate unit. The serial number is specific to the FortiGate unit and does not change with firmware upgrades. The time in days, hours, and minutes since the FortiGate unit was started. The current date and time according to the FortiGate units internal clock. Select Change to change the time or configure the FortiGate unit to get the time from an NTP server. See Configuring system time on page 67. The host name of the current FortiGate unit. Select Change to change the host name. See Changing the FortiGate unit host name on page 68. If the FortiGate unit is in HA mode, this field is not displayed. The name of the HA cluster for this FortiGate unit. See HA on page 151. The FortiGate unit must be operating in HA mode to display this field. The FortiGate units in the HA cluster. Information displayed about each member includes host name, serial number, and whether the unit is a primary (master) or subordinate (slave) unit in the cluster. See HA on page 151. The FortiGate unit must be operating in HA mode with virtual domains disabled to display this field. The role of each FortiGate unit in virtual cluster 1 and virtual cluster 2. See HA on page 151. The FortiGate unit must be operating in HA mode with virtual domains enabled to display these fields. The version of the current firmware installed on the FortiGate unit. Select Update to change the firmware. See Upgrading to a new firmware version on page 69.

Host Name

Cluster Name

Cluster Members

Virtual Cluster 1 Virtual Cluster 2 Firmware Version

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

57

Status page

System Status

FortiClient Version The currently stored version of FortiClient. Select Update to upload a FortiClient software image to this FortiGate unit from your management computer. This option is available only on FortiGate models that provide a portal from which hosts can download FortiClient software, such as FortiGate-3600 and 5005 models. Operation Mode The operating mode of the current FortiGate unit. A FortiGate unit can operate in NAT mode or Transparent mode. Select Change to switch between NAT and Transparent mode. See Changing operation mode on page 177 If virtual domains are enabled, this field shows the operating mode of the current virtual domain. Each virtual domain can be operating in either NAT mode or Transparent mode. Status of virtual domains on your FortiGate unit. Select enable or disable to change the status of virtual domains feature. If you enable or disable virtual domains, your session will be terminated and you will need to log in again. For more information, see Using virtual domains on page 81. The number of administrators currently logged into the FortiGate unit. Select Details to view more information about each administrator that is currently logged in. The additional information includes user name, type of connection, IP address from which they are connecting, and when they logged in.

Virtual Domain

Current Administrators

License Information
License Information displays the status of your technical support contract and FortiGuard subscriptions. The FortiGate unit updates the license information status indicators automatically when attempting to connect to the FortiGuard Distribution Network (FDN). FortiGuard Subscriptions status indicators are green if the FDN was reachable and the license was valid during the last connection attempt, grey if the FortiGate unit cannot connect to the FDN, and orange if the FDN is reachable but the license has expired. Selecting any of the Configure options will take you to the Maintenance page. For more information, see System Maintenance on page 215.
Figure 22: License Information

Support Contract

The Fortinet technical support contract number and expiry date, or registration status. If Not Registered appears, select Register to register the unit. If Renew appears, renew your technical support contract. Contact your local reseller.

FortiGuard Subscriptions

58

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Status page

AntiVirus AV Definitions

The FortiGuard Antivirus version, license issue date and service status. If your license has expired, you can select Renew two renew the license. The currently installed version of the FortiGuard Antivirus definitions. To update the definitions manually, select Update. For more information, see To update FortiGuard AV Definitions manually on page 71. The FortiGuard Intrusion Prevention System (IPS) license version, license issue date and service status. If your license has expired, you can select Renew two renew the license. The currently installed version of the IPS attack definitions. To update the definitions manually, select Update. For more information, see To update FortiGuard IPS Definitions manually on page 71. The FortiGuard Web Filtering license, license expiry date and service status. If your license has expired, you can select Renew two renew the license. The FortiGuard Antispam license type, license expiry date and service status. If your license has expired, you can select Renew two renew the license.

Intrusion Protection IPS Definitions

Web Filtering Antispam

Management Service The FortiGuard Management Service license, license expiry date and reachability status. Analysis Service Services Account ID The FortiGuard Analysis Service license, license expiry date and reachability status. Select change to enter a different Service Account ID. This ID is used to validate your license for subscription services such as FortiGuard Management Service and FortiGuard Analysis Service. The maximum number of virtual domains the unit supports with the current license. For FortiGate 3000 models or higher, you can select the Purchase More link to purchase a license key through Fortinet technical support to increase the maximum number of VDOMs. See License on page 238.

Virtual Domain VDOMs Allowed

Unit Operation
In the Unit Operation area, an illustration of the FortiGate units front panel shows the status of the units Ethernet network interfaces. If a network interface is green, that interface is connected. Pause the mouse pointer over the interface to view the name, IP address, netmask and current up/down status of the interface. If you select Reboot or ShutDown, a pop-up window opens allowing you to enter the reason for the system event. You can only have one management and one logging/analyzing method displayed for your FortiGate unit. The graphic for each will change based on which method you choose. If none are selected, no graphic is shown.
Note: Your reason will be added to the Disk Event Log if disk logging, event logging, and admin events are enabled. For more information on Event Logging, see Event log on page 510.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

59

Status page

System Status

Figure 23: Unit Operation (FortiGate-800)

Figure 24: Unit Operation (FortiGate 60)

INT / EXT / DMZ / HA / The network interfaces on the FortiGate unit. The names and number of these interfaces vary by model. 1/2/3/4 The icon below the interface name indicates its up/down status by color. Green indicates the interface is connected. Grey indicates there is no connection. For more information about the configuration and status of an interface, pause the mouse over the icon for that interface. A tooltip displays the full name of the interface, its alias if one is configured, the IP address and netmask, the status of the link, the speed of the interface, and the number of sent and received packets. If your FortiGate unit supports Advanced Mezzanine Card (AMC) modules and if you have installed an AMC module containing network interfaces (for example, the FortiGate-ASM-FB4 contains 4 interfaces) these interfaces are added to the interface status display. The interfaces are named AMC-SW1/1, AMC-SW1/2, and so on. FortiAnalyzer The icon on the link between the FortiGate unit graphic and the FortiAnalyzer graphic indicates the status of their OFTP connection. An X on a red icon indicates there is no connection. A check mark on a green icon indicates there is OFTP communication. Select the FortiAnalyzer graphic to configure remote logging tot he FortiAnalyzer unit on your FortiGate unit. See Logging to a FortiAnalyzer unit on page 503. The icon on the link between the FortiGate unit graphic and the FortiGuard Analysis Service graphic indicates the status of their OFTP connection. An X on a red icon indicates there is no connection. A check mark on a green icon indicates there is OFTP communication. Select the FortiGuard Analysis Service graphic to configure remote logging to the FortiGuard Analysis Service. See FortiGuard Analysis and Management Service on page 500. The icon on the link between the FortiGate unit graphic and the FortiManager graphic indicates the status of the connection. An X on a red icon indicates there is no connection. A check mark on a green icon indicates there is communication between the two units. Select the FortiManager graphic to configure central management on your FortiGate unit. See Central Management on page 198.

FortiGuard Analysis Service

FortiManager

60

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Status page

FortiGuard The icon on the link between the FortiGate unit graphic and the Management Service FortiGuard Management Service graphic indicates the status of the connection. An X on a red icon indicates there is no connection. A check mark on a green icon indicates there is communication. Select the FortiGuard Management Service graphic to configure central management on your FortiGate unit. See Central Management on page 198. Reboot Select to shutdown and restart the FortiGate unit. You will be prompted to enter a reason for the reboot that will be entered into the logs. Select to shutdown the FortiGate unit. You will be prompted for confirmation, and also prompted to enter a reason for the shutdown that will be entered into the logs. Select to reset the FortiGate unit to factory default settings. You will be prompted for confirmation.

Shutdown

Reset

System Resources
The System Resources widget displays basic FortiGate unit resource usage, such as CPU and memory (RAM) usage. Any System Resources that are not displayed on the status page can be viewed as a graph by selecting the History icon.
Figure 25: System Resources

History

A graphical representation of the last minute of CPU, memory, sessions, and network usage. This page also shows the virus and intrusion detections over the last 20 hours. For more information, see Viewing operational history on page 70. The current CPU status displayed as a dial gauge and as a percentage. The web-based manager displays CPU usage for core processes only. CPU usage for management processes (for example, for HTTPS connections to the web-based manager) is excluded. The current memory (RAM) status displayed as a dial gauge and as a percentage. The web-based manager displays memory usage for core processes only. Memory usage for management processes (for example, for HTTPS connections to the web-based manager) is excluded.

CPU Usage

Memory Usage

FortiAnalyzer Usage The current status of the FortiAnalyzer disk space used by this FortiGate units quota, displayed as a pie chart and a percentage. This is available only if you have configured logging to a FortiAnalyzer unit.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

61

Status page

System Status

Alert Message Console

Alert messages help you track system events on your FortiGate unit such as firmware changes, network security events, or virus detection events. Each message shows the date and time that the event occurred.
Figure 26: Alert Message Console

The following types of messages can appear in the Alert Message Console:
System restart Firmware upgraded by <admin_name> Firmware downgraded by <admin_name> The system restarted. The restart could be due to operator action or power off/on cycling. The named administrator upgraded the firmware to a more recent version on either the active or non-active partition. The named administrator downgraded the firmware to an older version on either the active or non-active partition.

FortiGate has reached The antivirus engine was low on memory for the connection limit for <n> seconds duration of time shown. Depending on model and configuration, content can be blocked or pass unscanned under these conditions. Found a new FortiAnalyzer Lost the connection to FortiAnalyzer New firmware is available from FortiGuard Shows that the FortiGate unit has either found or lost the connection to a FortiAnalyzer unit. See Logging to a FortiAnalyzer unit on page 503. An updated firmware image is available to be downloaded to this FortiGate unit.

If there is insufficient space for all of the messages within the Alert Message Console widget, select History to view the entire list in a new window. To clear alert messages, select the History icon and then select Clear Alert Messages, which is located at the top of the pop-up window. This will acknowledge and hide all current alert messages from your FortiGate unit. Selecting Edit brings up Custom Alert Display options that offers the customizations for your alert message display: Do not display system shutdown and restart. Do not display firmware upgrade and downgrade. Do not display conserve mode messages

Statistics
The Statistics widget is designed to allow you to see at a glance what is happening on your FortiGate unit with regards to network traffic and attack attempts.

62

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Status page

You can quickly see the amount and type of traffic as well as any attack attempts on your system. To investigate an area that draws your attention, select Details for a detailed list of the most recent activity. The information displayed in the statistics widget is derived from log messages that can be saved to a FortiAnalyzer unit, saved locally, or backed up to an external source such as a syslog server. You can use this data to see trends in network activity or attacks over time.
Note: The Email statistics are based on email protocols. POP3 traffic is registered as incoming email, and SMTP is outgoing email. If incoming or outgoing email does not use these protocols, these statistics will not be accurate.

For detailed procedures involving the Statistics list, see Viewing Statistics on page 72.
Figure 27: Statistics

Reset

Since

The date and time when the counts were last reset. Counts are reset when the FortiGate unit reboots, or when you select Reset. Reset the Content Archive and Attack Log statistic counts to zero. The number of communications sessions being handled by the FortiGate unit. Select Details for detailed information. See Viewing the session list on page 72. A summary of the HTTP, HTTPS, e-mail, VoIP, and IM/P2P traffic that has passed through the FortiGate unit, and whose meta data and/or files or traffic have been content archived. The Details pages list the last 64 items of the selected type and provide links to the FortiAnalyzer unit where the archived traffic is stored. If logging to a FortiAnalyzer unit is not configured, the Details pages provide a link to the Log & Report > Log Config > Log Settings page. A summary of viruses, attacks, spam email messages and blocked URLs that the FortiGate unit has intercepted. The Details pages list the most recent 10 items, providing the time, source, destination and other information.

Reset Sessions Content Archive

Attack Log

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

63

Status page

System Status

CLI Console
The System Status page can include a CLI. To use the console, select it to automatically log in to the admin account you are currently using in the web-based manager. You can copy (CTRL-C) and paste (CTRL-V) text from or to the CLI Console.
Figure 28: CLI Console

Customize

The two controls located on the CLI Console widgets title bar are Customize, and Detach. Detach moves the CLI Console widget into a pop-up window that you can resize and reposition. The two controls on the detached CLI Console are Customize and Attach. Attach moves the CLI console widget back onto the System Status page. Customize allows you to change the appearance of the console by defining fonts and colors for the text and background.
Figure 29: Customize CLI Console window

Preview Text

A preview of your changes to the CLI Consoles appearance. Select the current color swatch next to this label, then select a color from the color palette to the right to change the color of the text in the CLI Console. Select the current color swatch next to this label, then select a color from the color palette to the right to change the color of the background in the CLI Console.

Background

64

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Status page

Use external command input box

Select to display a command input field below the normal console emulation area. When this option is enabled, you can enter commands by typing them into either the console emulation area or the external command input field.

Console buffer length Enter the number of lines the console buffer keeps in memory. Valid numbers range from 20 to 9999. Font Size Select a font from the list to change the display font of the CLI Console. Select the size of the font. The default size is 10 points.

Top Sessions
Top Sessions displays a bar graph representing the IP addresses that have the most sessions open of the FortiGate unit. The sessions are sorted by either their source or destination IP address. The sort criteria being used is displayed in the top right corner. The Top Sessions display polls the kernel for session information, and this slightly impacts the FortiGate unit performance. For this reason when this display is not shown on the dashboard, it is not collecting data, and not impacting system performance. When the display is shown, information is only stored in memory and a reboot will reset the statistics to zero. The Top Sessions display is not part of the default dashboard display. It can be displayed by selecting Add Content, and selecting Top Sessions from the drop down menu. Selecting edit for Top Sessions allows changes to the: refresh interval sort criteria between source and destination addresses of the sessions top sessions to show

Figure 30: Top sessions

Sort Criteria Number of active sessions

Destination IP address of sessions

Top Viruses
Top Viruses displays a bar graph representing the most numerous virus threats detected by the FortiGate unit. The Top Viruses display is not part of the default dashboard display. It can be displayed by selecting Add Content, and selecting Top Viruses from the drop down menu.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

65

Status page

System Status

Selecting the history icon opens a window that displays up to the 20 most recent viruses that have been detected with information including the virus name, when it was last detected, and how many times it was detected. The system stores up to 1024 entries, but only displays up to 20 in the GUI. Selecting the edit icon for Top Viruses allows changes to the: refresh interval top viruses to show

Top Attacks
Top Attacks displays a bar graph representing the most numerous attacks detected by the FortiGate unit. The Top Attacks display is not part of the default dashboard display. It can be displayed by selecting Add Content, and selecting Top Attacks from the drop down menu. Selecting the history icon opens a window that displays up to the 20 most recent attacks that have been detected with information including the attack name, when it was last detected, and how many times it was detected. The system stores up to 1024 entries, but only displays up to 20 in the GUI. Selecting the edit icon for Top Attacks allows changes to the: refresh interval top attacks to show

Traffic History
The traffic history display shows the traffic on one selected interface over the last hour, day, and month. This feature can help you locate peaks in traffic that you need to address as well as their frequency, duration, and other information. Only one interface at a time can be monitored. You can change the interface being monitored by selecting Edit, choosing the interface from the drop down menu, and selecting Apply. Doing this will clear all the traffic history data.
Figure 31: Traffic History

interface being monitored

66

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Changing system information

Interface kbit/s

The interface that is being monitored . The units of the traffic graph. The scale varies based on traffic levels to allow it to show traffic levels no matter how little or how much traffic there is. Three graphs showing the traffic monitored on this interface of the FortiGate unit over different periods of time. Certain trends may be easier to spot in one graph over the others. The traffic entering the FortiGate unit on this interface is indicated with a thin red line. The traffic leaving the FortiGate unit on this interface is indicated with a dark green line, filled in with light green.

Last 60 Minutes Last 24 Hours Last 30 Days Traffic In Traffic Out

Changing system information

FortiGate administrators whose access profiles permit write access to system configuration can change the system time, host name and the operation mode for the VDOM.

Configuring system time

1 2 3 Go to System > Status. In the System Information section, select Change on the System Time line. Select the time zone and then either set the date and time manually or configure synchronization with an NTP server.
Figure 32: Time Settings

System Time Refresh Time Zone

The current FortiGate system date and time. Update the display of the current FortiGate system date and time. Select the current FortiGate system time zone.

Automatically adjust Select to automatically adjust the FortiGate system clock when your time zone changes between daylight saving time and standard clock for daylight time. saving changes Set Time Synchronize with NTP Server Select to set the FortiGate system date and time to the values you set in the Hour, Minute, Second, Year, Month and Day fields. Select to use an NTP server to automatically set the system date and time. You must specify the server and synchronization interval.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

67

Changing the FortiGate firmware

System Status

Server Sync Interval

Enter the IP address or domain name of an NTP server. To find an NTP server that you can use, see http://www.ntp.org. Specify how often the FortiGate unit should synchronize its time with the NTP server. For example, a setting of 1440 minutes causes the FortiGate unit to synchronize its time once a day.

Changing the FortiGate unit host name

The FortiGate host name appears on the Status page and in the FortiGate CLI prompt. The host name is also used as the SNMP system name. For information about SNMP, see SNMP on page 159. The default host name is the FortiGate unit serial number. For example FGT8002805030003 would be a FortiGate-800 unit. Administrators whose access profiles permit system configuration write access can change the FortiGate unit host name.
Note: If the FortiGate unit is part of an HA cluster, you should use a unique host name to distinguish the unit from others in the cluster.

To change the FortiGate unit host name If the host name is longer than 16 characters, it will be displayed as being truncated and end with a ~. The full host name will be displayed under System > Status, but the truncated host name will be displayed on the CLI and other places it is used. 1 2 3 4 Go to System > Status. In the Host Name field of the System Information section, select Change. In the New Name field, type a new host name. Select OK. The new host name is displayed in the Host Name field, and in the CLI prompt, and is added to the SNMP System Name.

Changing the FortiGate firmware

FortiGate administrators whose access profiles permit maintenance read and write access can change the FortiGate firmware. Firmware changes either upgrade to a newer version or revert to an earlier version. Follow the appropriate procedure for the firmware change you want to perform: Upgrading to a new firmware version Reverting to a previous firmware version

68

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Changing the FortiGate firmware

Upgrading to a new firmware version

Use the following procedure to upgrade the FortiGate unit to a newer firmware version.
Note: Installing firmware replaces the current antivirus and attack definitions with the definitions included with the firmware release that you are installing. After you install new firmware, use the procedure To update antivirus and attack definitions on page 233 to make sure that antivirus and attack definitions are up to date.

To upgrade the firmware using the web-based manager 1 2 3 4 5 6 Copy the firmware image file to your management computer. Log into the web-based manager as the super admin, or an administrator account that has system configuration read and write privileges. Go to System > Status. In the System Information section, select Update on the Firmware Version line. Type the path and filename of the firmware image file, or select Browse and locate the file. Select OK. The FortiGate unit uploads the firmware image file, upgrades to the new firmware version, closes all sessions, restarts, and displays the FortiGate login. This process takes a few minutes. 7 8 9 Log into the web-based manager. Go to System > Status and check the Firmware Version to confirm that the firmware upgrade is successfully installed. Update antivirus and attack definitions. For information about updating antivirus and attack definitions, see FortiGuard on page 226.

Reverting to a previous firmware version

Use the following procedure to revert your FortiGate unit to a previous firmware version. This also reverts the FortiGate unit to its factory default configuration and deletes IPS custom signatures, web content lists, email filtering lists, and changes to replacement messages. Back up your FortiGate unit configuration to preserve this information. For information, see Maintenance System Configuration on page 215. If you are reverting to a previous FortiOS version (for example, reverting from FortiOS v3.0 to FortiOS v2.8), you might not be able to restore the previous configuration from the backup configuration file.
Note: Installing firmware replaces the current antivirus and attack definitions with the definitions included with the firmware release that you are installing. After you install new firmware, use the procedure To update antivirus and attack definitions on page 233 to make sure that antivirus and attack definitions are up to date.

To revert to a previous firmware version using the web-based manager 1 2 3 Copy the firmware image file to the management computer. Log into the web-based manager as the super admin, or an administrator account that has system configuration read and write privileges. Go to System > Status.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

69

Viewing operational history

System Status

4 5 6

In the System Information section, select Update on the Firmware Version line. Type the path and filename of the firmware image file, or select Browse and locate the file. Select OK. The FortiGate unit uploads the firmware image file, reverts to the old firmware version, resets the configuration, restarts, and displays the FortiGate login. This process takes a few minutes.

7 8 9

Log into the web-based manager. Go to System > Status and check the Firmware Version to confirm that the firmware is successfully installed. Restore your configuration. For information about restoring your configuration, see Maintenance System Configuration on page 215. Update antivirus and attack definitions. For information about antivirus and attack definitions, see To update antivirus and attack definitions on page 233.

10

Viewing operational history

The System Resource History page displays six graphs representing system resources and protection activity. 1 2 Go to System > Status. Select History in the upper right corner of the System Resources section.
Figure 33: Sample system resources history

Time Interval CPU Usage History Memory Usage History Session History Network Utilization History Virus History Intrusion History

Select the time interval that the graphs show. CPU usage for the preceding interval. Memory usage for the preceding interval. Number of sessions over the preceding interval. Network utilization for the preceding interval. Number of Viruses detected over the preceding interval. Number of intrusion attempts detected over the preceding interval. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

70

System Status

Manually updating FortiGuard definitions

Manually updating FortiGuard definitions

You can update your FortiGuard - AV and FortiGuard - Intrusion Protection definitions at any time from the License Information section of the System Status page.
Note: For information about configuring the FortiGate unit for automatic AV and automatic IPS (attack) definitions updates, see FortiGuard on page 226.

To update FortiGuard AV Definitions manually 1 2 3 Download the latest AV definitions update file from Fortinet and copy it to the computer that you use to connect to the web-based manager. Start the web-based manager and go to System > Status. In the License Information section, in the AV Definitions field of the FortiGuard Subscriptions, select Update. The Anti-Virus Definitions Update dialog box appears. 4 5 6 In the Update File field, type the path and filename for the AV definitions update file, or select Browse and locate the AV definitions update file. Select OK to copy the AV definitions update file to the FortiGate unit. The FortiGate unit updates the AV definitions. This takes about 1 minute. Go to System > Status to confirm that the FortiGuard - AV Definitions version information has updated. To update FortiGuard IPS Definitions manually 1 2 3 Download the latest attack definitions update file from Fortinet and copy it to the computer that you use to connect to the web-based manager. Start the web-based manager and go to System > Status. In the License Information section, in the IPS Definitions field of the FortiGuard Subscriptions, select Update. The Intrusion Prevention System Definitions Update dialog box appears. 4 5 6 In the Update File field, type the path and filename for the attack definitions update file, or select Browse and locate the attack definitions update file. Select OK to copy the attack definitions update file to the FortiGate unit. The FortiGate unit updates the attack definitions. This takes about 1 minute. Go to System > Status to confirm that the IPS Definitions version information has updated.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

71

Viewing Statistics

System Status

Viewing Statistics
The System Status Statistics provide information about sessions, content archiving and network protection activity.

Viewing the session list

From the Statistics section of the System Status page, you can view statistics about HTTP, HTTPS, email, FTP and IM traffic through the FortiGate unit. You can select the Details link beside each traffic type to view more information. To view the session list 1 2 Go to System > Status. In the Statistics section, select Details on the Sessions line.
Figure 34: Session list

Virtual Domain

Select a virtual domain to list the sessions being processed by that virtual domain. Select All to view sessions being processed by all virtual domains. This is only available if multiple virtual domains are enabled. Update the session list. Select to go to the first displayed page of current sessions. Select to go to the page of sessions immediately before the current page Enter the page number of the session to start the displayed session list. For example if there are 5 pages of sessions and you enter 3, page 3 of the sessions will be displayed. The number following the / is the number of pages of sessions currently on the FortiGate unit. Select to go to the next page of sessions. Select to go to the last displayed page of current sessions. Select to reset any display filters that may have been set. The icon at the top of all columns except #, and Expiry. When selected it brings up the Edit Filter dialog allowing you to set the display filters by column. See Adding filters to web-based manager lists on page 46. The service protocol of the connection, for example, udp, tcp, or icmp. The source port of the connection. The destination IP address of the connection.

Refresh Icon First Page Previous Page Page

Next Page Last Page Clear All Filters Filter Icon Protocol Source Port Destination Address Policy ID

Source Address The source IP address of the connection.

Destination Port The destination port of the connection. The number of the firewall policy allowing this session or blank if the session involves only one FortiGate interface (admin session, for example).

72

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Viewing Statistics

Expiry (sec) Delete icon

The time, in seconds, before the connection expires. Stop an active communication session. Your access profile must include read and write access to System Configuration.

Viewing the Content Archive information

From the Statistics section of the System Status page, you can view statistics about HTTP, email, FTP and IM traffic through the FortiGate unit. You can select the Details link beside each traffic type to view more information. You can select Reset on the header of the Statistics section to clear the content archive and attack log information and reset the counts to zero. Viewing archived HTTP content information 1 2 Go to System > Status. In the Content Archive section, select Details for HTTP.

Date and Time From URL

The time when the URL was accessed. The IP address from which the URL was accessed. The URL that was accessed.

Viewing archived Email content information 1 2 Go to System > Status. In the Content Archive section, select Details for Email.

Date and Time From To Subject

The time that the email passed through the FortiGate unit. The senders email address. The recipients email address. The subject line of the email.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

73

Viewing Statistics

System Status

Viewing archived FTP content information 1 2 Go to System > Status. In the Content Archive section, select Details for FTP.

Date and Time Destination User Downloads Uploads

The time of access. The IP address of the FTP server that was accessed. The User ID that logged into the FTP server. The names of files that were downloaded. The names of files that were uploaded.

Viewing archived IM content information 1 2 Go to System > Status. In the Content Archive section, select Details for IM.

Date / Time Protocol Kind Local Remote Direction

The time of access. The protocol used in this IM session. The kind of IM traffic this transaction is. The local address for this transaction. The remote address for this transaction If the file was sent or received.

Viewing the Attack Log

From the Statistics section of the System Status page, you can view statistics about the network attacks that the FortiGate unit has stopped. You can select the Details link beside each attack type to view more information. You can select Reset on the header of the Statistics section to clear the content archive and attack log information and reset the counts to zero. Viewing viruses caught 1 2 Go to System > Status. In the Attack Log section, select Details for AV.
Date and Time From The time when the virus was detected. The senders email address or IP address.

74

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Viewing Statistics

To Service Virus

The intended recipients email address or IP address. The service type, such as POP or HTTP. The name of the virus that was detected.

Viewing attacks blocked 1 2 Go to System > Status. In the Attack Log section, select Details for IPS.
Date and Time From To Service Attack The time that the attack was detected. The source of the attack. The target host of the attack. The service type. The type of attack that was detected and prevented.

Viewing spam email detected 1 2 Go to System > Status. In the Attack Log section, select Details for Spam.
Date and Time From->To IP From->To Email Accounts Service SPAM Type The time that the spam was detected. The sender and intended recipient IP addresses. The sender and intended recipient email addresses. The service type, such as SMTP, POP or IMAP. The type of spam that was detected.

Viewing URLs blocked 1 2 Go to System > Status. In the Attack Log section, select Details for Web.
Date and Time From URL Blocked The time that the attempt to access the URL was detected. The host that attempted to view the URL. The URL that was blocked.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

75

Topology

System Status

Topology
The Topology page provides a way to diagram and document the networks connected to your FortiGate unit. It is available on all FortiGate models except FortiGate-50 and FortiGate-60. The Topology viewer is not available if Virtual Domains (VDOMs) are enabled. Go to System > Status > Topology to view the system topology. The Topology page consists of a large canvas upon which you can draw a network topology diagram of your FortiGate installation.
Figure 35: Topology page Zoom/Edit controls Text object Subnet object

FortiGate unit object

Viewport

Viewport control

Viewport and viewport control

The viewport displays only a portion of the drawing area. The viewport control, at the bottom right of the topology page, represents the entire drawing area. The darker rectangle represents the viewport. Drag the viewport rectangle within the viewport control to determine which part of the drawing area the viewport displays. The + and - buttons in the viewport control have the same function as the Zoom in and Zoom out controls.

76

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Topology

Zoom and Edit controls

The toolbar at the top left of the Topology page shows controls for viewing and editing the topology diagram.
Table 3: Zoom and Edit controls for Topology Refresh the displayed diagram.

Zoom in. Select to display a smaller portion of the drawing area in the viewport, making objects appear larger. Zoom out. Select to display a larger portion of the drawing area in the viewport, making objects appear smaller. Select to begin editing the diagram. This button expands the toolbar to show the editing controls described below: Save changes made to the diagram. Note: If you switch to any other page in the web-based manager without saving your changes, your changes are lost. Add a subnet object to the diagram. The subnet object is based on the firewall address that you select, and is connected by a line to the interface associated with that address. See Adding a subnet object on page 78. Insert Text. Select this control and then click on the diagram where you want to place the text object. Type the text and then click outside the text box. Delete. Select the object(s) to delete and then select this control or press the Delete key. Customize. Select to change the colors and the thickness of lines used in the drawing. See Customizing the topology diagram on page 79. Drag. Select this control and then drag objects in the diagram to arrange them. Scroll. Select this control and then drag the drawing area background to move the viewport within the drawing area. This has the same effect as moving the viewport rectangle within the viewport control. Select. Select this control and then drag to create a selection rectangle. Objects within the rectangle are selected when you release the mouse button. Exit. Select to finish editing the diagram. Save changes first. The toolbar contracts to show only the Refresh and Zoom controls.

FortiGate unit object

The FortiGate unit is a permanent part of the topology diagram. You can move it, but not delete it.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

77

Topology

System Status

The FortiGate unit object shows the link status of the units interfaces. Green indicates the interface is up. Grey indicates the interface is down. Select the interface to view its IP address and netmask, if assigned.

Adding a subnet object

While editing the topology diagram, you can select the Add Subnet control to define a subnet object. The object is drawn and connected by a line to the interface associated with the address.
Figure 36: Adding an existing subnet to the topology diagram

Figure 37: Adding a new subnet to the topology diagram

Select from existing address/group

Create a subnet object based on an existing firewall address. The object has the name of the firewall address and is connected by a line to the interface associated with that address. For more information about firewall addresses, see Firewall Address on page 303. Enter a name to identify the firewall address. Addresses, address groups, and virtual IPs must have unique names to avoid confusion in firewall policies. Select the interface or zone to associate with this address. If the field already displays a name, changing the setting changes the interface or zone associated with this existing address. If the address is currently used in a firewall policy, you can choose only the interface selected in the policy. Create a new firewall address and add a subnet object based on that address to the topology diagram. The address is associated with the interface you choose. Enter a name to identify the firewall address. Addresses, address groups, and virtual IPs must have unique names to avoid confusion in firewall policies. Select the type of address: Subnet/IP Range or FQDN. If Type is Subnet/IP Range, enter the firewall IP address, followed by a forward slash and then the subnet mask. Alternatively, enter IP range start address, followed by a hyphen (-) and the IP range end address. If Type is FQDN, enter the fully qualified domain name. Select the interface or zone to associate with this address.

Address Name Connect to interface

New addresses Address Name Type Subnet / IP Range

FQDN Connect to interface

78

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Status

Topology

Customizing the topology diagram

In System > Status > Topology, select the Customize button to open the Topology Customization window. Modify the settings as needed and select OK when you are finished.
Figure 38: Topology Customization window

Preview Canvas Size Resize to Image Background

A simulated topology diagram showing the effect of the selected appearance options. The size of the drawing in pixels. If you selected an image as Background, resize the diagram to fit within the image. One of: Solid - a solid color selected in Background Color U.S. Map - a map of the United States. World Map - a map of the world. Upload My Image - upload the image from Image Path. Select the color of the diagram background. If you selected Upload My Image for Background, enter the path to your image, or use the Browse button to find it. Select the color of the border region outside your diagram. Select the color of connecting lines between subnet objects and interfaces. Select the thickness of connecting lines. Reset all topology diagram settings to default.

Background Color Image path Exterior Color Line Color Line Width Reset to Default

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

79

Topology

System Status

80

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Using virtual domains

Virtual domains

Using virtual domains

This section describes virtual domains along with some of their benefits, and how to use them to operate your FortiGate unit as multiple virtual units. To get started working with virtual domains, see Enabling VDOMs on page 84. This section describes: Virtual domains Enabling VDOMs Configuring VDOMs and global settings

Virtual domains
Virtual domains (VDOMs) are a method of dividing a FortiGate unit into two or more virtual units that function as multiple independent units. A single FortiGate unit is then flexible enough to serve multiple departments of an organization, separate organizations, or be the basis for a service providers managed security service. Some benefits of VDOMs are: Easier administration Maintain Security Easy to increase or decrease number of VDOMs

Easier administration
VDOMs provide separate security domains that allow separate zones, user authentication, firewall policies, routing, and VPN configurations. Using VDOMs can also simplify administration of complex configurations because you do not have to manage as many routes or firewall policies at one time. See VDOM configuration settings on page 83. By default, each FortiGate unit has a VDOM named root. This VDOM includes all of the FortiGate physical interfaces, VLAN subinterfaces, zones, firewall policies, routing settings, and VPN settings. Also you can optionally assign an administrator account restricted to that VDOM. If the VDOM is created to serve an organization, this feature enables the organization to manage its own configuration. Management systems such as SNMP, logging, alert email, FDN-based updates and NTP-based time setting use addresses and routing in the management VDOM to communicate with the network. They can connect only to network resources that communicate with the management virtual domain. The management VDOM is set to root by default, but can be changed. For more information see Changing the Management VDOM on page 90.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

81

Virtual domains

Using virtual domains

Maintain Security
When a packet enters a VDOM, it is confined to that VDOM. In a VDOM, you can create firewall policies for connections between VLAN subinterfaces or zones in the VDOM. Packets do not cross the virtual domain border internally. To travel between VDOMs a packet must pass through a firewall on a physical interface. The packet then arrives at another VDOM on a different interface where it must pass through another firewall before entering. Both VDOMs are on the same FortiGate unit. Inter-VDOMs change this in that they are internal interfaces, however their packets go through all the same security measures as on physical interfaces. Without VDOMs, administrators can easily access settings across the FortiGate. This can lead to security issues or far-reaching configuration errors. However, administrator permissions are specific to one VDOM. An admin on one VDOM can't change information on another VDOM. Any configuration changes, and potential errors, will apply only to that VDOM and limit any potential down time. The remainder of FortiGate functionality is global - it applies to all VDOMs. This means there is one intrusion prevention configuration, one antivirus configuration, one web filter configuration, one protection profile configuration, and so on. As well, VDOMs share firmware versions, antivirus and attack databases. The operating mode, NAT/Route or Transparent, is independently selectable for each VDOM. For a complete list of shared configuration settings, see Global configuration settings on page 84.

Easy to increase or decrease number of VDOMs

To increase the number of physical units, you need to deal with shipping issues, you need more space and cables to install them, and you will likely need to change your network to accommodate them. Increasing VDOMs involves no extra hardware, no shipping, and very few changes to existing networking. They take no extra physical space - you are only limited by the size of the license you buy for your VDOMs. By default, your FortiGate unit supports a maximum of 10 VDOMs in any combination of NAT/Route and Transparent modes. For FortiGate models numbered 3000 and higher, you can purchase a license key to increase the maximum number of VDOMs to 25, 50, 100 or 250. For more information see License on page 238.
Note: When configuring a FortiAnalyzer unit, VDOMs count toward the maximum number of FortiGate units allowed by the FortiAnalyzer units license. The total number of devices registered can be seen on the FortiAnalyzer units System Status page under License Information.

If virtual domain configuration is enabled and you log in as the default super admin, you can go to System > Status and look at Virtual Domain in the License Information section to see the maximum number of virtual domains supported on your FortiGate unit. For more information on VDOMs, see the FortiGate VLANs and VDOMs Guide.

82

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Using virtual domains

Virtual domains

VDOM configuration settings

To configure and use VDOMs, you must enable virtual domain configuration on the System > Status dashboard, or using config system global, set vdom-admin in the CLI. See Enabling VDOMs on page 84. You can configure a VDOM by adding VLAN subinterfaces, zones, firewall policies, routing settings, and VPN settings. You can also move physical interfaces from the root VDOM to other VDOMs and move VLAN subinterfaces from one VDOM to another. For more information on VLANs, see VLAN overview on page 123. The following configuration settings are exclusively part of a virtual domain and are not shared between virtual domains. A regular administrator for the VDOM sees only these settings. The default super admin can also access these settings, but must first select which VDOM to configure. System settings Zones DHCP services Operation mode (NAT/Route or Transparent) Management IP (Transparent mode)

Router configuration Firewall settings Policies Addresses Service groups and custom services Schedules Virtual IPs IP pools Protection Profiles IPSec PPTP SSL Users User groups RADIUS and LDAP servers Microsoft Windows Active Directory servers

VPN configuration

User settings

Web Filter P2P Statistics (view/reset) Logging configuration, log access and log reports

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

83

Enabling VDOMs

Using virtual domains

Global configuration settings

The following configuration settings affect all virtual domains. When virtual domains are enabled, only accounts with the default super admin profile can access global settings. System settings Physical interfaces and VLAN subinterfaces (Each physical interface or VLAN subinterface belongs to only one VDOM. Each VDOM can use or configure only its own interfaces.) DNS settings Host name, System time, Firmware version (on System Status page) Idle and authentication timeout Web-based manager language LCD panel PIN, where applicable Dead gateway detection HA configuration SNMP configuration Replacement messages Administrators (Each administrator belongs to only one VDOM. Each VDOM can configure only its own administrators.) Access profiles FortiManager configuration Configuration backup and restore FDN update configuration Bug reporting Certificates Authentication settings Quarantine Configuration

VPN User Antivirus

Antispam configuration IM, P2P, & VoIP configuration User lists and policies

Enabling VDOMs
Using the default admin administration account, you can enable multiple VDOM operation on the FortiGate unit. To enable virtual domains 1 2 3 Log in to the web-based manager on a super admin profile account. Go to System > Status. In System Information, next to Virtual Domain select Enable. The FortiGate unit logs you off. You can now log in again as admin.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

84

Using virtual domains

Configuring VDOMs and global settings

When virtual domains are enabled, the web-based manager and the CLI are changed as follows: Global and per-VDOM configurations are separated. A new VDOM entry appears under the System option. When you are in a VDOM, there are reduced menu options available, and a new Global entry appears. Only super admin profile accounts can view or configure global options. Super admin profile accounts can configure all VDOM configurations. One or more administrators can be setup for each VDOM, but can only edit that VDOMs settings.

When virtual domains are enabled, you can see what the current virtual domain is by looking at the bottom left of the screen. It will say Current VDOM: followed by the name of the virtual domain.

Configuring VDOMs and global settings

A VDOM is not useful unless it contains at least two physical interfaces or virtual subinterfaces for incoming and outgoing traffic. Only the super admin can assign interfaces or subinterfaces to VDOMs. However, a regular administrator account can create a VLAN subinterface on a physical interface within their own VDOM. Only super admin profile accounts can configure a VDOM unless you create and assign a regular administrator to that VDOM. Only super admin profile accounts can assign an administrator to a VDOM. An administrator account whose access profile provides read and write access to Admin Users can create additional administrators in its own VDOM.
Table 4: Admin VDOM permissions Tasks Configure global settings Create or delete VDOMs Configure multiple VDOMs Assign interfaces to a VDOM Create VLANs Assign an administrator to a VDOM Create additional admin accounts Create and edit protection profiles Regular admin with Super admin profile read/write permission account no no no no yes - for 1 VDOM no yes - for 1 VDOM yes - for 1 VDOM yes yes yes yes yes - for all VDOMs yes yes - for all VDOMs yes - for all VDOMs

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

85

Configuring VDOMs and global settings

Using virtual domains

Creating a new VDOM

By default, every FortiGate unit has a root VDOM that is visible when VDOMs are enabled. To use additional VDOMs, you must first create them.
Note: The VDOM names vsys_ha and vsys_fgfm are in use by the FortiGate unit. If you attempt to name a new VDOM vsys_ha or vsys_fgfm it will generate an error. Figure 39: New Virtual Domain

To create a new VDOM 1 2 3 4 5 Log in as a super admin profile admin. Ensure VDOMs are enabled. Go to System > VDOM. Select Create New VDOM. Enter a name for the new VDOM, up to a maximum of 11 characters. The name must not contain any spaces, or special characters. Hyphens (-) and underlines (_) are allowed. 6 7 Optionally enter a comment for the VDOM, up to a maximum of 64 characters. Select Apply.

Working with VDOMs and global settings

When you log in as admin and virtual domains are enabled you are automatically in global configuration, as demonstrated by the VDOM option under System. Select System > VDOM to work with virtual domains.
Figure 40: VDOM list Disabled VDOM

Management VDOM

86

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Using virtual domains

Configuring VDOMs and global settings

Create New

Select to add a new VDOM. Enter the new VDOM name and select OK. The VDOM must not have the same name as an existing VDOM, VLAN or zone. The VDOM name can be a maximum of 11 characters long without spaces. Change the management VDOM to the selected VDOM in the drop down list. The management VDOM is indicated in the list of VDOMs as being greyed out in the Enable column. The default management VDOM is root. For more information see Changing the Management VDOM on page 90. Select Apply to save your changes to the Management VDOM. There are three states this column can be in. A green check mark indicates this VDOM is enabled, and you can select the Enter icon to change to that VDOM. An empty check box indicates this VDOM is disabled. When disabled, the configuration of that VDOM is preserved. The Enter icon is not available. A greyed out checkbox indicates this VDOM is the management VDOM. It cannot be deleted or changed to disabled - it is always active. The name of the VDOM. The VDOM operation mode, either NAT or Transparent. The interfaces associated with this VDOM, including virtual interfaces. Every VDOM includes an SSL VPN virtual interface named for that VDOM. For the root VDOM this interface is ssl.root. When you are creating a VDOM you can add comments to provide custom information about this VDOM. Select to delete the VDOM. The delete icon appears only when there are no configuration objects associated with that VDOM. For example you must remove all referring interfaces, profiles, and so on before you can delete the VDOM. If the delete icon does not appear and you do not want to delete all the referring configuration, you can disable the VDOM instead. Select to change the description of the VDOM. The name of the VDOM can not be changed. Select to enter the selected VDOM. This allows an admin to make VDOM specific changes or checks.

Management Virtual Domain

Apply Enable

Name Operation Mode Interfaces

Comments Delete icon

Edit icon Enter icon

Adding interfaces to a VDOM

A VDOM must contain at least two interfaces to be useful. These can be physical or virtual interfaces such as VLAN subinterfaces. By default, all physical interfaces are in the root virtual domain. VLAN subinterfaces often need to be in a different VDOM than their physical interface. To do this, the super admin must first create the VDOM, create the VLAN subinterface, and then assign the VLAN to the correct VDOM. System > Network > Interfaces is only available in global settings, and not within VDOMs. For information on creating VLAN subinterfaces, see Adding VLAN subinterfaces on page 126.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

87

Configuring VDOMs and global settings

Using virtual domains

Inter-VDOM links
An inter-VDOM link is a pair of interfaces that enable you to communicate between 2 VDOMs internally without using a physical interface. Inter-VDOM links have the same security as physical interfaces, but allow more flexible configurations that are not limited by the number of physical interfaces on your FortiGate unit. As with all virtual interfaces, the speed of the link depends on the CPU load but generally it is faster than physical interfaces. There are no MTU settings for inter-VDOM links. On the interface screen, an inter-VDOM link has an entry for the link. This can be expanded to show the 2 virtual interfaces in that link. The type of interface for the link is VDOM link and each of the virtual interfaces is pair type. Each of the virtual interfaces is named using the inter-VDOM link name with an added 0 or 1. So if the inter-VDOM link is called vlink the interfaces would be vlink0 and vlink1.
Note: Inter-VDOM links can not refer to a domain that is in transparent mode. Figure 41: VDOM link interfaces

Creating an inter-VDOM link Inter-VDOM links differ from normal interfaces because they are 2 interfaces that are connected - one for each VDOM. They are like a pipe between 2 VDOMs. Attaching these interfaces to VDOMs is part of the process when they are created. 1 2 3 Log in as admin. Go to System > Network > Interface. Select Create New and choose VDOM link.
Figure 42: New VDOM link

88

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Using virtual domains

Configuring VDOMs and global settings

Enter the name for the new VDOM link, up to a maximum of 11 characters. The name must not contain any spaces, or special characters. Hyphens (-) and underlines (_) are allowed. Remember that the name will have a 0 or 1 attached to the end for the actual interfaces.

5 6 7 8 9 10 11

Configure VDOM link 0. Select the VDOM from the menu. This is the VDOM this interface will connect to, and is different from the VDOM for the other interface in the VDOM link. Enter the IP address and netmask for this interface. Select the administrative access method or methods. Keep in mind that PING, TELNET, and HTTP are less secure methods. Optionally enter a description for this interface. Repeat steps 6 through 9 for VDOM link 1. Select OK to save your confrontation and return to the System > Interface screen.

Assigning an interface to a VDOM

The following procedure describes how to reassign an existing interface from one virtual domain to another. It assumes VDOMs are enabled and more than one VDOM exists. You cannot delete a VDOM if it is used in any configurations, such as having an interface in that VDOM. You cannot remove an interface from a VDOM if the interface is included in of any of the following configurations: DHCP server zone routing firewall policy IP pool proxy arp (only accessible through the CLI)

Before removing these configurations, it is recommended that you backup your configuration, so you can restore it if you want to create this VDOM at a later date. Delete the items in this list or modify them to remove the interface before proceeding.
Note: An interface or subinterface is available for reassigning or removing once the delete icon is displayed. Until then, the interface is used in a configuration somewhere.

Instead of deleting a VDOM, you can disable a VDOM. This has the benefit of preserving your configuration and saving the time to remove and re-configure it later. To assign an interface to a VDOM 1 2 3 4 Log in as admin. Go to System > Network > Interface. Select Edit for the interface that you want to reassign. Select the new Virtual Domain for the interface.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

89

Configuring VDOMs and global settings

Using virtual domains

Configure other settings as required and select OK. For more information on the other interfaces settings see Interface settings on page 97. The interface is assigned to the VDOM. Existing firewall IP pools and virtual IP addresses for this interface are deleted. You should manually delete any routes that include this interface, and create new routes for this interface in the new VDOM. Otherwise your network traffic will not be properly routed.

Assigning an administrator to a VDOM

If you are creating a VDOM to serve an organization that will be administering its own resources, you need to create an administrator account for that VDOM. A VDOM admin can change configuration settings within that VDOM but cannot make changes that affect other VDOMs on the FortiGate unit. A regular administrator assigned to a VDOM can log in to the web-based manager or the CLI only on interfaces that belong to that VDOM. The super admin can connect to the web-based manager or CLI through any interface on the FortiGate unit that permits management access. Only the super admin or a regular administrator of the root domain can log in by connecting to the console interface.
Note: If an admin account is assigned to a VDOM, that VDOM cannot be deleted until that account is removed, or assigned to another VDOM.

To assign an administrator to a VDOM 1 2 3 Log in as the super admin. Virtual domains must be enabled. Go to System > Admin >Administrators. Create and/or configure the new administrator account as required. For detailed information about configuring an administrator account, see Configuring an administrator account on page 191. 4 5 While configuring this admin account, select the VDOM this administrator manages from the Virtual Domain list. Select Apply.

Changing the Management VDOM

The management VDOM on your FortiGate unit is where some default types of traffic originate. These types of traffic include:

SNMP logging alert email FDN-based updates NTP-based time setting

Before you change the management VDOM, ensure virtual domains are enabled on the system dashboard screen. Only one VDOM can be the management VDOM at any given time. Global events are logged with the VDOM set to the management VDOM.
Note: You cannot change the management VDOM if any administrators are using RADIUS authentication. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

90

Using virtual domains

Configuring VDOMs and global settings

To change the management VDOM 1 2 Go to System > VDOM. Select the VDOM to be the new management VDOM from the drop down list of VDOMs. This drop down list is located to the immediate left of the Apply button. 3 Select Apply to make the change. You will be prompted to confirm the change. Management traffic will now originate from the new management VDOM.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

91

Configuring VDOMs and global settings

Using virtual domains

92

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

System Network
This section describes how to configure your FortiGate unit to operate in your network. Basic network settings include configuring FortiGate interfaces and DNS settings. More advanced configuration includes adding VLAN subinterfaces and zones to the FortiGate network configuration. This section describes: Interfaces Zones Networking Options Routing table (Transparent Mode) VLAN overview VLANs in NAT/Route mode VLANs in Transparent mode

Note: Unless stated otherwise, the term interface can refer to either a physical FortiGate interface or to a virtual FortiGate VLAN subinterface. Note: If you can enter both an IP address and a netmask in the same field, you can use the short form of the netmask. For example, 192.168.1.100/255.255.255.0 can also be entered as 192.168.1.100/24.

Interfaces
In NAT/Route mode, go to System > Network > Interface to configure FortiGate interfaces. You can: modify the configuration of a physical interface add and configure VLAN subinterfaces configure an ADSL interface aggregate several physical interfaces into an IEEE 802.3ad interface (models 300A, 400A, 500A, and 800 or higher) combine physical interfaces into a redundant interface add wireless interfaces (FortiWiFi models 50B, 60A, 60AM, and 60B) and service set identifiers (SSIDs) (see Adding a wireless interface on page 137) add and configure VDOM links (see Inter-VDOM links on page 88) view loopback interfaces configure the modem (see Configuring the modem interface on page 113) change which information about the interfaces is displayed

For information about VLANs, see FortiGate units and VLANs on page 124.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

93

Interfaces

System Network

Figure 43: Interface list - regular admin view

Figure 44: Interface list - admin view with virtual domains enabled

Create New

Select Create New to create a VLAN subinterface. On models 800 and higher, you can also create an IEEE 802.3ad aggregated interface. When VDOMs are enabled, selecting the Create New arrow enables you to create new VDOM links. For more information see Inter-VDOM links on page 88. Select to change between switch mode and interface mode. Switch mode combines the internal interfaces into one switch with one address. Interface mode gives each internal interface its own address. Before switching modes, all configuration settings that point to internal interfaces must be removed. This option is visible only on models 100A and 200A for Rev2.0 and higher. Switch mode is also visible on the FortiGate-60B and FortiWiFi-60B. For more information see Switch Mode on page 96.

Switch Mode

show backplane Select to make the two backplane interfaces visible as port9 and port10. Once visible these interfaces can be treated as regular physical interfaces interfaces. This option is available only on 5000 models. Column Settings Select to change the which columns of information about the network interfaces is displayed. For more information, see Column Settings on page 96. Description icon The tooltip for this icon displays the Description field for this interface.

94

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Name

The names of the physical interfaces on your FortiGate unit. This includes any alias names that have been configured. The name, including number, of a physical interface depends on the model. Some names indicate the default function of the interface such as Internal, External and DMZ. Other names are generic such as port1. FortiGate models numbered 50 and 60 provide a modem interface. See Configuring the modem interface on page 113. The oob/ha interface is the FortiGate model 4000 out of band management interface. You can connect to this interface to manage the FortiGate unit. This interface is also available as an HA heartbeat interface. On FortiGate-60ADSL units, you can configure the ADSL interface. See Configuring an ADSL interface on page 100. On FortiGate models 300A, 400A, 500A, and 800 or higher, if you combine several interfaces into an aggregate interface, only the aggregate interface is listed, not the component interfaces. The same is true for redundant interfaces. See Creating an 802.3ad aggregate interface on page 101 or Creating a redundant interface on page 102. If you have added VLAN subinterfaces, they also appear in the name list, below the physical or aggregated interface to which they have been added. See VLAN overview on page 123. If you have loopback virtual interfaces configured you will be able to view them. You can only edit these interfaces in the CLI. For more information on these interfaces see Configuring interfaces with CLI commands on page 109 or the config system interface command in the FortiOS CLI Reference. If you have software switch interfaces configured, you will be able to view them. You can only edit these interfaces in the CLI. for more information on these interfaces see Configuring interfaces with CLI commands on page 109 or the config system switchinterface command in the FortiOS CLI Reference. If virtual domain configuration is enabled, you can view information only for the interfaces that are in your current virtual domain, unless you are using the super admin account. If VDOMs are enabled, you will be able to create, edit, and view interVDOM links. For more information see Inter-VDOM links on page 88. If you have interface mode enabled on a FortiGate model 100A or 200A Rev2.0 or higher or on the FortiGate-60B and FortiWiFi-60B models, you will see multiple internal interfaces. If switch mode is enabled, there will only be one internal interface. For more information see Switch Mode on page 96. If your FortiGate unit supports AMC modules and if you have installed an AMC module containing interfaces (for example, the FortiGate-ASM-FB4 contains 4 interfaces) these interfaces are added to the interface status display. The interfaces are named AMC/1, AMC/2, and so on. The current IP address/netmask of the interface. When IPv6 Support on GUI is enabled, IPv6 addresses may be displayed in this column. The administrative access configuration for the interface. See Additional configuration for interfaces on page 110. The administrative status for the interface. If the administrative status is a green arrow, the interface is up and can accept network traffic. If the administrative status is a red arrow, the interface is administratively down and cannot accept traffic. To change the administrative status, select Bring Down or Bring Up. The virtual domain to which the interface belongs. This column is visible only to the super admin and only when virtual domain configuration is enabled.

IP/Netmask

Access Administrative Status

Virtual Domain

Delete, edit, and Delete, edit, or view an entry. view icons

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

95

Interfaces

System Network

Column Settings
Go to System > Network > Column Settings to change which information about the interfaces is displayed. The VDOM field is only available for display when VDOMs are enabled.
Figure 45: Column Settings

Available fields Show these fields in this order Right arrow Left arrow Move up Move down

The list of fields (columns) not currently being displayed. The list of fields (columns) currently being displayed. They are displayed in order. Top to bottom of the list will be displayed left to right on screen respectively. Move selected fields to the Show these fields in this order list. Move selected fields to the Available fields list. Move selected item up in the Show these fields in this order list. The corresponding column is moved to the left on the network interface display. Move selected item down in the Show these fields in this order list. The corresponding column is moved to the right on the network interface display.

Switch Mode
The internal interface is a switch with either four or six physical interface connections, depending on the FortiGate unit model. Normally the internal interface is configured as a single interface shared by all physical interface connections - a switch. The switch mode feature has two states - switch mode and interface mode. Switch mode is the default mode with only one interface and one address for the entire internal switch. Interface mode allows you to configure each of the internal switch physical interface connections separately. This allows you to assign different subnets and netmasks to each of the internal physical interface connections. FortiGate unit models 100A and 200A Rev2.0 and higher have four internal interface connections. The FortiGate-60B and FortiWifi-60B have six internal interface connections. Consult your release notes for the most current list of supported models for this feature. Selecting Switch Mode on the System > Network > Interface screen takes you to the Switch Mode Management screen.

Caution: Before you are able to change between switch mode and interface mode all references to internal interfaces must be removed. This includes references such as firewall policies, routing, DNS forwarding, DHCP services, VDOM interface assignments, VLANS, and routing. If they are not removed, you will not be able to switch modes, and you will see an error message. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

96

System Network

Interfaces

Figure 46: Switch Mode Management

Switch Mode Interface Mode

Select Switch Mode. Only one internal interface is displayed. This is the default mode. Select Interface Mode. All internal interfaces on the switch are displayed as individually configurable interfaces.

Switch Mode can also be configured using CLI commands. For more information see the FortiOS CLI Reference.

Interface settings
Go to System > Network > Interface and select Create New. Selecting the Create New arrow enables you to create VDOM links. For more information on VDOM links, see Inter-VDOM links on page 88. Some types of interfaces such as loopback interfaces can only be configured using CLI commands. For more information see Configuring interfaces with CLI commands on page 109. You cannot create a virtual IPSec interface on this screen, but you can specify its endpoint addresses , enable administrative access and provide a description if you are editing an existing interface. For more information, see Configuring a virtual IPSec interface on page 107.
Figure 47: Create New Interface settings

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

97

Interfaces

System Network

Figure 48: Edit Interface settings

Name Alias

Enter a name for the interface. You cannot change the name of an existing interface. Enter another name for the interface that will easily distinguish this interface from another. This is available only for physical interfaces where where you cannot configure the name. The alias can be a maximum of 15 characters. The alias name is not part of the interface name, but it will appear in brackets beside the interface name. It will not appears in logs. The type of the interfaces. When creating a new interface, this is VLAN by default. On models 300A, 400A, 500A, 800 and higher, you can create VLAN, 802.3ad Aggregate, and Redundant interfaces. On FortiGate 100A and 200A models of Rev2.0 and higher and on all 60B models, software switch is a valid type. You cannot edit this type in the GUI. On FortiWiFi models 50B, 60A, 60AM, and 60B, you can support up to four SSIDs by adding up to three wireless interfaces (for a total of four wireless interfaces).

Type

On the 60ADSL model, you can configure an ADSL interface. Other models support creation of VLAN interfaces only and have no Type field. You cannot change the type of an existing interface. Interface Select the name of the physical interface on which to create the VLAN. Once created, the VLAN subinterface is listed below its physical interface in the Interface list. You cannot change the interface of an existing VLAN subinterface. This field is only displayed when Type is set to VLAN. Enter the VLAN ID that matches the VLAN ID of the packets to be received by this VLAN subinterface. You cannot change the VLAN ID of an existing VLAN subinterface. The VLAN ID can be any number between 1 and 4094 and must match the VLAN ID added by the IEEE 802.1Q-compliant router or switch connected to the VLAN subinterface. See VLAN overview on page 123. This field is only displayed when Type is set to VLAN.

VLAN ID

98

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Virtual Domain Select the virtual domain to which this VLAN subinterface belongs. Admin accounts with super-admin profile can change the VDOM for aVLAN when VDOM configuration is enabled. See Using virtual domains on page 81. Physical Interface Members This section has two different forms depending on the interface type: Software switch interface - this section is a display-only field showing the interfaces that belong to the software switch virtual interface 802.3ad aggregate or Redundant interface - this section includes available interface and selected interface lists to enable adding or removing interfaces from the interface.

Available Interfaces Selected interfaces

Select interfaces from this list to include in the grouped interface - either redundant or aggregate interface. Select the right arrow to add an interface to the grouped interface. These interfaces are included in the aggregate or redundant interface. Select the left arrow to remove an interface from the grouped interface. For redundant interfaces, the interfaces will be activated during failover from the top of the list to the bottom Select the type of addressing mode as static or one of the available dynamic modes. To configure a static IP address for the interface, select Manual. You can also configure the interface for dynamic IP address assignment. See Configuring DHCP on an interface on page 104 or Configuring an interface for PPPoE or PPPoA on page 105. Enter the IP address/subnet mask in the IP/Netmask field. The IP address must be on the same subnet as the network to which the interface connects. Two interfaces cannot have IP addresses on the same subnet. This field is only available when Manual addressing mode is selected. Select DDNS to configure a Dynamic DNS service for this interface. See Configuring Dynamic DNS on an interface on page 107. To enable dead gateway detection, enter the IP address of the next hop router on the network connected to the interface and select Enable. See Dead gateway detection on page 121.

Addressing mode

IP/Netmask

DDNS Ping Server

Administrative Select the types of administrative access permitted on this interface. Access HTTPS PING HTTP Allow secure HTTPS connections to the web-based manager through this interface. Interface responds to pings. Use this setting to verify your installation and for testing. Allow HTTP connections to the web-based manager through this interface. HTTP connections are not secure and can be intercepted by a third party. Allow SSH connections to the CLI through this interface. Allow a remote SNMP manager to request SNMP information by connecting to this interface. See Configuring SNMP on page 160. Allow Telnet connections to the CLI through this interface. Telnet connections are not secure and can be intercepted by a third party.

SSH SNMP TELNET

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

99

Interfaces

System Network

MTU

To change the MTU, select Override default MTU value (1 500) and enter the MTU size based on the addressing mode of the interface 68 to 1 500 bytes for static mode 576 to 1 500 bytes for DHCP mode 576 to 1 492 bytes for PPPoE mode

up to 16 110 bytes for jumbo frames (FortiGate models numbered 3000 and higher) This field is available only on physical interfaces. VLANs inherit the parent interface MTU size by default. For more information on MTU and jumbo frames, see Interface MTU packet size on page 111. Secondary IP Address Description Add additional IP addresses to this interface. Select the blue arrow to expand or hide the section. See Secondary IP Addresses on page 112. Enter a description up to 63 characters long.

Administrative Select either up (green arrow) or down (red arrow) as the status of this interface. Status Up indicates the interface is active and can accept network traffic. Down indicates the interface is not active and cannot accept traffic. Note: In Transparent mode, if you change the MTU of an interface, you must change the MTU of all interfaces to match the new MTU.

To configure a specific type of interface, refer to the appropriate section. To configure:

an ADSL interface, see Configuring an ADSL interface on page 100. an aggregate interface, see Creating an 802.3ad aggregate interface on page 101. a redundant interface, seeCreating a redundant interface on page 102. a VLAN subinterface, see FortiGate units and VLANs on page 124. a wireless interface, see Adding a wireless interface on page 137.

Configuring an ADSL interface

The information that you need to provide for the ADSL interface depends on the addressing mode your ISP requires you to use. To use dynamic addressing see Configuring DHCP on an interface on page 104 or Configuring an interface for PPPoE or PPPoA on page 105. To configure an ADSL interface, your FortiGate unit cannot be in Transparent mode. To configure an ADSL interface ADSL interface addressing mode can be one of IP over ATM (IPoA), Ethernet over ATM (EoA) (also known as Bridged mode), Dynamic Host Configuration Protocol (DHCP), Point-to-Point Protocol over Ethernet (PPPoE), or Point-to-Point Protocol over ATM (PPPoA). 1 2 3 Go to System > Network > Interface. Select Create New or select the Edit icon of an existing interface. In the Addressing mode section, select IPoA or EoA.

100

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Figure 49: Settings for an ADSL interface

Addressing mode IPoA EoA DHCP PPPoE PPPoA IP/Netmask Gateway Connect to Server

Select the addressing mode that your ISP specifies. Enter the IP address and netmask that your ISP provides. Enter the IP address and netmask that your ISP provides. See Configuring DHCP on an interface on page 104. See Configuring an interface for PPPoE or PPPoA

on page 105. on page 105.

See Configuring an interface for PPPoE or PPPoA The IP address and netmask of this interface. Enter the default gateway. Enable Connect to Server so the interface will attempt to connect automatically. Do not enable this option if you are configuring the interface offline. Select the MUX type: LLC Encap or VC Encap. Your ISP must provide this information.

Virtual Circuit Identification Enter the VPI and VCI values your ISP provides. MUX Type

Creating an 802.3ad aggregate interface

You can aggregate (combine) two or more physical interfaces to increase bandwidth and provide some link redundancy. An aggregate interface provides more bandwidth but also creates more points of failure than redundant interfaces. The interfaces must connect to the same next-hop routing destination. Support of the IEEE standard 802.3ad for link aggregation is part of FortiGate firmware on models 300A, 400A, 500A, and models 800 and higher. An interface is available to be an aggregate interface if: it is a physical interface, not a VLAN interface it is not already part of an aggregate or redundant interface it is in the same VDOM as the aggregated interface it does not have a IP address and is not configured for DHCP or PPPoE it does not have a DHCP server or relay configured on it it does not have any VLAN subinterfaces it is not referenced in any firewall policy, VIP, IP Pool or multicast policy it is not an HA heartbeat interface it is not one of the FortiGate 5000 series backplane interfaces

Note: You can add an accelerated interface (FA2 interfaces) to an aggregate link, but you will lose the acceleration. For example, if you aggregate two accelerated interfaces you will get slower throughput than if the two interfaces were separate.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

101

Interfaces

System Network

Note: FortiGate-5000 backplane interfaces have to be made visible before they can be added to an aggregate or a redundant interface.

When an interface is included in an aggregate interface, it is not listed on the System > Network > Interface screen. You cannot configure the interface individually and it is not available for inclusion in firewall policies, VIPs, IP pools, or routing.
Figure 50: Settings for an 802.3ad aggregate interface

To create an 802.3ad Aggregate interface 1 2 3 4 5 6 Go to System > Network > Interface. Select Create New. In the Name field, enter a name for the aggregated interface. The interface name must not be the same as any other interface, zone or VDOM. From the Type list, select 802.3ad Aggregate. In the Available Interfaces list, select each interface that you want to include in the aggregate interface and move it to the Selected Interfaces list. If this interface operates in NAT/Route mode, you need to configure addressing for it. For information about dynamic addressing, see: 7 8 Configuring DHCP on an interface on page 104 Configuring an interface for PPPoE or PPPoA on page 105

Configure other interface options as required. Select OK.

Creating a redundant interface

You can combine two or more physical interfaces to provide link redundancy. This feature allows you to connect to two or more switches to ensure connectivity in the event one physical interface or the equipment on that interface fails. In a redundant interface, traffic is only going over one interface at any time. This differs from an aggregated interface where traffic is going over all interfaces for increased bandwidth. This difference means redundant interfaces can have more robust configurations with fewer possible points of failure. This is important in a fully-meshed HA configuration. FortiGate firmware on models 800 and higher implements redundant interfaces.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

102

System Network

Interfaces

An interface is available to be in a redundant interface if: it is a physical interface, not a VLAN interface it is not already part of an aggregated or redundant interface it is in the same VDOM as the redundant interface it has no defined IP address and is not configured for DHCP or PPPoE it has no DHCP server or relay configured on it it does not have any VLAN subinterfaces it is not referenced in any firewall policy, VIP, IP Pool or multicast policy it is not monitored by HA it is not one of the FortiGate 5000 series backplane interfaces

Note: FortiGate-5000 backplane interfaces have to be made visible before they can be added to an aggregate or a redundant interface.

When an interface is included in a redundant interface, it is not listed on the System > Network > Interface page. You cannot configure the interface individually and it is not available for inclusion in firewall policies, VIPs, IP pools, or routing.
Figure 51: Settings for a redundant interface

To create a redundant interface 1 2 3 4 5 Go to System > Network > Interface. Select Create New. In the Name field, enter a name for the redundant interface. The interface name must not be the same as any other interface, zone or VDOM. From the Type list, select Redundant Interface In the Available Interfaces list, select each interface that you want to include in the redundant interface and move it to the Selected Interfaces list. In a failover situation, the interface activated will be the next interface down the Selected Interfaces list. 6 If this interface operates in NAT/Route mode, you need to configure addressing for it. For information about dynamic addressing, see: 7 8 Configuring DHCP on an interface on page 104 Configuring an interface for PPPoE or PPPoA on page 105

Configure other interface options as required. Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

103

Interfaces

System Network

Configuring DHCP on an interface

If you configure an interface to use DHCP, the FortiGate unit automatically broadcasts a DHCP request. The interface is configured with the IP address and any DNS server addresses and default gateway address that the DHCP server provides. To configure DHCP on an interface 1 2 3 Go to System > Network > Interface. Select Create New or select the Edit icon of an existing interface. In the Addressing mode section, select DHCP.
Figure 52: Interface DHCP settings

Figure 53: ADSL interface DHCP settings

Status

Displays DHCP status messages as the FortiGate unit connects to the DHCP server and gets addressing information. Select Status to refresh the addressing mode status message. Only displayed if you selected Edit. Status can be one of: initializing - No activity. Obtained IP/Netmask Renew Expiry Date connecting - interface attempts to connect to the DHCP server. connected - interface retrieves an IP address, netmask, and other settings from the DHCP server. failed - interface was unable to retrieve an IP address and other settings from the DHCP server.

The IP address and netmask leased from the DHCP server. Only displayed if Status is connected. Select to renew the DHCP license for this interface. Only displayed if Status is connected. The time and date when the leased IP address and netmask is no longer valid. Only displayed if Status is connected. The IP address of the gateway defined by the DHCP server. Only displayed if Status is connected, and if Receive default gateway from server is selected,.

Default Gateway

104

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Distance

Enter the administrative distance for the default gateway retrieved from the DHCP server. The administrative distance, an integer from 1-255, specifies the relative priority of a route when there are multiple routes to the same destination. A lower administrative distance indicates a more preferred route. The default distance for the default gateway is 1.

Retrieve default Enable Retrieve default gateway from server to retrieve a default gateway from server gateway IP address from the DHCP server. The default gateway is added to the static routing table. Override internal DNS Enable Override internal DNS to use the DNS addresses retrieved from the DHCP server instead of the DNS server IP addresses on the DNS page. On FortiGate models numbered 100 and lower, you should also enable Obtain DNS server address automatically in System > Network > Options. See DNS Servers on page 121. Connect to Server Enable Connect to Server so that the interface automatically attempts to connect to a DHCP server. Disable this option if you are configuring the interface offline.

Configuring an interface for PPPoE or PPPoA

If you configure the interface to use PPPoE or PPPoA, the FortiGate unit automatically broadcasts a PPPoE or PPPoA request. When configuring the FortiGate unit offline and you do not want the FortiGate unit to send the PPPoE or PPPoA request, do not enable Connect to Server. FortiGate units support many PPPoE RFC features (RFC 2516) including unnumbered IPs, initial discovery timeout and PPPoE Active Discovery Terminate (PADT). PPPoA is only available on FortiGate models that support ADSL. To configure an interface for PPPoE or PPPoA 1 2 3 Go to System > Network > Interface. Select Create New or select the Edit icon of an existing interface. In the Addressing mode section, select PPPoE or PPPoA.
Figure 54: Interface PPPoE settings

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

105

Interfaces

System Network

Figure 55: ADSL interface PPPoE or PPPoA settings

Status

Displays PPPoE or PPPoA status messages as the FortiGate unit connects to the PPPoE or PPPoA server and gets addressing information. Select Status to refresh the addressing mode status message. Only displayed if you selected Edit. Status can be one of the following 4 messages. No activity. The interface retrieves an IP address, netmask, and other settings from the PPPoE server. When the status is connected, PPPoE or PPPoA connection information is displayed. The interface was unable to retrieve an IP address and other information from the PPPoE or PPPoA server.

initializing connected

connecting The interface is attempting to connect to the PPPoE or PPPoA server.

failed

Reconnect Select to reconnect to the PPPoE or PPPoA server. Only displayed if Status is connected. User Name Password Unnumbered IP The PPPoE or PPPoA account user name. The PPPoE or PPPoA account password. Specify the IP address for the interface. If your ISP has assigned you a block of IP addresses, use one of them. Otherwise, this IP address can be the same as the IP address of another interface or can be any IP address. Enter Initial discovery timeout. Enter the time to wait before starting to retry a PPPoE or PPPoA discovery. Enter Initial PPPoE Active Discovery Terminate (PADT) timeout in seconds. Use this timeout to shut down the PPPoE or PPPoA session if it is idle for this number of seconds. PADT must be supported by your ISP. Set initial PADT timeout to 0 to disable. Enter the administrative distance for the default gateway retrieved from the PPPoE or PPPoA server. The administrative distance, an integer from 1-255, specifies the relative priority of a route when there are multiple routes to the same destination. A lower administrative distance indicates a more preferred route. The default distance for the default gateway is 1. Enable Retrieve default gateway from server to retrieve a default gateway IP address from a PPPoE server. The default gateway is added to the static routing table.

Initial Disc Timeout Initial PADT timeout Distance

Retrieve default gateway from server

106

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Override internal Enable Override internal DNS to replace the DNS server IP addresses on the System DNS page with the DNS addresses retrieved from the DNS PPPoE or PPPoA server. Connect to server Enable Connect to Server so that the interface automatically attempts to connect to a PPPoE or PPPoA server when you select OK or Apply. Disable this option if you are configuring the interface offline.

Configuring Dynamic DNS on an interface

When the FortiGate unit has a static domain name and a dynamic public IP address, you can use a DDNS service to update Internet DNS servers when the IP address for the domain changes. Dynamic DNS is available only in NAT/Route mode. To configure DDNS on an interface 1 2 3 4 5 Get the DDNS configuration information from your DDNS service. Go to System > Network > Interface. Select Create New. Enable DDNS. Enter DDNS configuration information. If at any time your Fortigate unit cannot contact the DDNS server, it will retry three times at one minute intervals and then change to retrying at three minute intervals. This is to prevent flooding the DDNS server.
Figure 56: DDNS service configuration

Server

Select a DDNS server to use. The client software for these services is built into the FortiGate firmware. The FortiGate unit can connect only to one of these services. Enter the fully qualified domain name of the DDNS service.

Domain

Username Enter the user name to use when connecting to the DDNS server. Password Enter the password to use when connecting to the DDNS server.

Configuring a virtual IPSec interface

You create a virtual IPSec interface by selecting IPSec Interface Mode in VPN > IPSec > Auto Key or VPN > IPSec > Manual Key when you create a VPN. You also select a physical or VLAN interface from the Local Interface list. The virtual IPSec interface is listed as a subinterface of that interface in System > Network > Interface. For more information, see: Policy-based versus route-based VPNs on page 370 Auto Key on page 371 or Manual Key on page 381

Go to System > Network > Interface and select Edit on an IPSec interface to:

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

107

Interfaces

System Network

configure IP addresses for the local and remote endpoints of the IPSec interface so that you can run dynamic routing over the interface or use ping to test the tunnel enable administrative access through the IPSec interface enable logging on the interface enter a description for the interface

Figure 57: Virtual IPSec interface settings

Name Virtual Domain IP Remote IP Administrative Access HTTPS PING HTTP

The name of the IPSec interface. Select the VDOM of the IPSec interface. If you want to use dynamic routing with the tunnel or be able to ping the tunnel interface, enter IP addresses for the local and remote ends of the tunnel. These two addresses must not be used anywhere else in the network. Select the types of administrative access permitted on this interface. Allow secure HTTPS connections to the web-based manager through this interface. Allow the interface to respond to pings. Use this setting to verify your installation and for testing. Allow HTTP connections to the web-based manager through this interface. HTTP connections are not secure and can be intercepted by a third party. Allow SSH connections to the CLI through this interface. Allow a remote SNMP manager to request SNMP information by connecting to this interface. See Configuring SNMP on page 160. Allow Telnet connections to the CLI through this interface. Telnet connections are not secure and can be intercepted by a third party. Enter a description of the interface. It can be up to 63 characters.

SSH SNMP TELNET Description

108

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Configuring interfaces with CLI commands

While nearly all types of interfaces can be configured from the GUI interface, a few, such as loopback and soft switch interface, can only be configured using CLI commands. Virtual interfaces are not connected to any physical devices or cables outside the FortiGate unit. They allow additional connections inside the FortiGate unit, which allow for more complex configurations. Virtual interfaces also have the added benefit of speed. Depending on the CPU load, virtual interfaces are consistently faster than physical interfaces. Loopback interface Software switch interface

Loopback interface
A loopback interface is a reliable virtual interface that is not connected to any other interfaces. Loopback interfaces were added to assist with blackhole routing which drops packets sent to a particular network address. For more information on blackhole routing, see Blackhole Routing on page 248. A loopback interface is not connected to hardware, so it is not affected by hardware problems. As long as the FortiGate unit is functioning, the loopback interface is active. This always up feature is useful in dynamic routing. The CLI command to configure a loopback interface called loop1 with an IP address of 10.0.0.10 is: config system interface edit loop1 set type loopback set ip 10.0.0.10 255.255.255.0 end For more information, see config system interface in the FortiOS CLI Reference.

Software switch interface

A software switch interface forms a simple bridge between two or more physical or wireless FortiGate interfaces. The interfaces added to a soft switch interface are called members. The members of a switch interface cannot be accessed as an individual interface after being added to a soft switch interface. They are removed from the system interface table. Similar to aggregate interfaces, a soft switch interface functions like a normal interface. A soft switch interface has one IP address. You create firewall policies to and from soft switch interfaces and soft switch interfaces can be added to zones. There are some limitations; soft switch interfaces cannot be monitored by HA or used as HA heartbeat interfaces. To add interfaces to a software switch group, no configuration settings can refer to those interfaces. This includes default routes, VLANs, inter-VDOM links, and policies. You can view available interfaces on the CLI when entering the set member command by using ? or <TAB> to scroll through the available list.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

109

Interfaces

System Network

The CLI command to configure a software switch interface called soft_switch with port1, external and dmz interfaces is: config system switch-interface edit soft_switch set members port1 external dmz end For more information, see config system switch-interface in the FortiOS CLI Reference.

Additional configuration for interfaces

Additional configuration for an interface consists of setting: Administrative access to an interface Interface MTU packet size Traffic logging for an interface Secondary IP Addresses

Administrative access to an interface

You can control administrative access to the interfaces in a VDOM. You can allow remote administration of the FortiGate unit running in NAT/Route mode, but allowing remote administration from the Internet could compromise the security of the FortiGate unit. You should avoid this unless it is required for your configuration. To improve the security of a FortiGate unit that allows remote administration from the Internet: Use secure administrative user passwords. Change these passwords regularly. Enable secure administrative access to this interface using only HTTPS or SSH. Do not change the system idle timeout from the default value of 5 minutes (see Settings on page 201).

For more information on configuring administrative access in Transparent mode, see Operation mode and VDOM management access on page 177. To control administrative access to an interface 1 2 3 4 Go to System > Network > Interface. Choose an interface and select Edit. Select the Administrative Access methods for the interface. Select OK.

110

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Interface MTU packet size

To improve network performance, you can change the maximum transmission unit (MTU) of the packets that the FortiGate unit transmits. Ideally, the MTU should be the same as the smallest MTU of all the networks between the FortiGate unit and the destination of the packets. If the packets that the FortiGate unit sends are larger than the smallest MTU, they are broken up or fragmented, which slows down transmission. Experiment by lowering the MTU to find an MTU size for optimum network performance. FortiGate models numbered 3 000 and higher support jumbo frames - frames larger than the traditional 1 500 bytes. Some models support a limit of 9 000 bytes while others support 16 110 bytes. Jumbo frames can be up to 9 000 bytes or 16 110, much larger than standard Ethernet frames. Standard Ethernet frames (packets) can be a maximum of 1 500 bytes including header information. As new Ethernet standards have been implemented (such as Gigabit Ethernet), 1 500 byte frames remain in the standard for backward compatibility. To be able to send jumbo frames over a route, all Ethernet devices on that route must support jumbo frames, otherwise your jumbo frames are not recognized and are dropped. If you have standard ethernet and jumbo frame traffic on the same interface, routing alone cannot route them to different routes based only on frame size. However you can use VLANs to make sure the jumbo frame traffic is routed over network devices that support jumbo frames. VLANs will inherit the MTU size from the parent interface. You will need to configure the VLAN to include both ends of the route as well as all switches and routers along the route. For more information on VLAN configurations, see the VLAN and VDOM guide. To change the MTU size of the packets leaving an interface 1 2 3 4 Go to System > Network > Interface. Choose a physical interface and select Edit. Below Administrative Access, select Override default MTU value (1 500). Set the MTU size. If you select an MTU size larger than your FortiGate unit supports, an error message will indicate this. In this situation, try a smaller MTU size until the value is supported. Supported maximums are 16 110, 9 000, and 1 500.
Note: If you change the MTU, you need to reboot the FortiGate unit to update the MTU value of VLAN subinterfaces on the modified interface.

Note: In Transparent mode, if you change the MTU of an interface, you must change the MTU of all interfaces to match the new MTU.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

111

Interfaces

System Network

Traffic logging for an interface

You can enable traffic logging for any interface. See Traffic log on page 509 for more information.

Secondary IP Addresses
An interface can be assigned more than one IP address. You can create and apply separate firewall policies for each IP address on an interface. You can also forward traffic and use RIP or OSPF routing with secondary IP addresses. There can be up to 32 secondary IP addresses per interface including primary, secondary, and any other IP addresses assigned to the interface. Primary and secondary IP addresses can share the same ping generator. The following restrictions must be in place before you are able to assign a secondary IP address: A primary IP address must be assigned to the interface. The interface must use manual addressing mode. By default, IP addresses cannot be part of the same subnet. To allow interface subnet overlap use the CLI command:

config system global (global)# set allow-interface-subnet-overlap enable (global)#end You can use the CLI command config system interface to add a secondary IP address to an interface. For more information, see config secondaryip under system interface in the FortiOS CLI Reference.
Figure 58: Adding Secondary IP Addresses

IP/Netmask

Enter the IP address/subnet mask in the IP/Netmask field. The Secondary IP address must be on a different subnet than the Primary IP address. This field is only available in Manual addressing mode. To enable dead gateway detection, enter the IP address of the next hop router on the network connected to the interface and select Enable. See Dead gateway detection on page 121. Multiple addresses can share the same ping server. Select the types of administrative access permitted on the secondary IP. These can be different from the primary address. Allow secure HTTPS connections to the web-based manager through this secondary IP. Allow secondary IP to respond to pings. Use this setting to verify your installation and for testing.

Ping Server

Administrative Access HTTPS PING

112

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

HTTP SSH SNMP TELNET Add

Allow HTTP connections to the web-based manager through this secondary IP. HTTP connections are not secure and can be intercepted by a third party. Allow SSH connections to the CLI through this secondary IP. Allow a remote SNMP manager to request SNMP information by connecting to this secondary IP. See Configuring SNMP on page 160. Allow Telnet connections to the CLI through this secondary IP. Telnet connections are not secure and can be intercepted by a third party. Select Add to add the configured secondary IP address to the secondary IP table. Addresses in this table are not added to the interface until you select OK or Apply. A table that displays all the secondary IP addresses that have been added to this interface. These addresses are not permanently added to the interface until you select OK or Apply.. The identifying number of the secondary IP address.

Secondary IP table

IP/Netmask The IP address and netmask for the secondary IP. Ping Server The IP address of the ping server for the address. The ping server can be shared by multiple addresses. Enable Access Indicates if the ping server option is selected. The administrative access methods for this address. They can be different from the primary IP address.

Delete Icon Select to remove this secondary IP entry. Note: It is recommended that after adding a secondary IP, you refresh the secondary IP table and verify your new address is listed. If not, one of the restrictions (have a primary IP address, use manual addressing mode, more than one IP on the same subnet, more than 32 IP addresses assigned to the interface, etc.) prevented the address from being added.

Configuring the modem interface

All FortiGate-50 series and FortiGate-60 series modules include modem support. In NAT/Route mode the modem can be in one of two modes: In redundant (backup) mode, the modem interface automatically takes over from a selected ethernet interface when that ethernet interface is unavailable. In standalone mode, the modem interface is the connection from the FortiGate unit to the Internet.

In redundant or standalone mode when connecting to the ISP, you can configure the FortiGate unit to automatically have the modem dial up to three dialup accounts until the modem connects to an ISP. FortiGate models 50AM, 60M have a built-in modem. For these models, you can configure modem operation in the web-based manager. See Configuring modem settings. Other 50 and 60 models can connect to an external modem through a USB-toserial converter. For these models, you must configure modem operation using the CLI. See the system modem command in the FortiOS CLI Reference.
Note: The modem interface is not the AUX port. While the modem and AUX port may appear similar, the AUX port has no associated interface and is used for remote console connection. The AUX port is only available on FortiGate models 1000A, 1000AFA2, and 3000A. For more information, see the config system aux command in the FortiOS CLI Reference. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

113

Interfaces

System Network

Configuring modem settings

Configure modem settings so that the FortiGate unit uses the modem to connect to your ISP dialup accounts. You can configure up to three dialup accounts, select standalone or redundant operation, and configure how the modem dials and disconnects.
Note: You cannot configure and use the modem in Transparent mode.

Figure 59 shows the only the settings specific to standalone mode. The remaining settings are common to both standalone and redundant modes and are shown in Figure 60.
Figure 59: Modem settings (Standalone)

Figure 60: Modem settings (Redundant)

Enable Modem Modem status

Select to enable the FortiGate modem. Modem status can be: not active, connecting, connected, disconnecting, or hung up.

114

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Dial Now/Hang Up

(Standalone mode only) Select Dial Now to manually connect to a dialup account. If the modem is connected, you can select Hang Up to manually disconnect the modem. Select Standalone or Redundant mode. Select to dial the modem automatically if the connection is lost or the FortiGate unit is restarted. You cannot select Auto-dial if Dial on demand is selected. Select to dial the modem when packets are routed to the modem interface. The modem disconnects after the idle timeout period if there is no network activity. You cannot select Dial on demand if Auto-dial is selected. Enter the timeout duration in minutes. After this period of inactivity, the modem disconnects. Select the ethernet interface for which the modem provides backup service. (Redundant mode only) Enter the time (1-60 seconds) that the FortiGate unit waits before switching back to the primary interface from the modem interface, after the primary interface has been restored. The default is 1 second. Configure a higher value if you find the FortiGate unit switching repeatedly between the primary interface and the modem interface. The maximum number of times (1-10) that the FortiGate unit modem attempts to reconnect to the ISP if the connection fails. The default redial limit is 1. Select None to have no limit on redial attempts. Display a connected wireless modem if available. Display connections made on the modem interface. Information displayed about connections includes:

Mode Auto-dial (Standalone mode) Dial on demand (Standalone mode)

Idle timeout (Standalone mode) Redundant for (Redundant mode) Holddown Timer (Redundant mode)

Redial Limit

Wireless Modem Usage History

Supported Modems Select to view a list of supported modems.

Dialup Account

date and time duration of the connection in hours, minutes, and seconds IP address connected to traffic statistics including received, sent, and total current status of the connection

Configure up to three dialup accounts. The FortiGate unit tries connecting to each account in order until a connection can be established. The active dialup account is indicated with a green check mark. The phone number required to connect to the dialup account. Do not add spaces to the phone number. Make sure to include standard special characters for pauses, country codes, and other functions as required by your modem to connect to your dialup account. The user name (maximum 63 characters) sent to the ISP. The password sent to the ISP.

Phone Number

User Name Password

To configure the modem in Redundant mode, see Redundant mode configuration on page 116. To configure the modem in Standalone mode, see Standalone mode configuration on page 117.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

115

Interfaces

System Network

Redundant mode configuration

In redundant mode the modem interface backs up a selected ethernet interface. If that ethernet interface disconnects from its network, the modem automatically dials the configured dialup accounts. When the modem connects to a dialup account, the FortiGate unit routes IP packets normally destined for the selected ethernet interface to the modem interface. The FortiGate unit disconnects the modem interface and switches back to the ethernet interface when the ethernet interface is able to connect to its network. You can set a holddown timer that delays the switch back to the ethernet interface to ensure it is stable and fully active before switching the traffic. The modem will disconnect after a period of network inactivity set by the value in idle timeout. This saves money on dialup connection charges. For the FortiGate unit to be able to switch from an ethernet interface to the modem, you must select the name of the interface in the modem configuration and configure a ping server for that interface. You must also configure firewall policies for connections between the modem interface and other FortiGate interfaces.
Note: Do not add policies for connections between the modem interface and the ethernet interface that the modem is backing up.

To configure redundant mode 1 2 3 Go to System > Network > Modem. Select Redundant mode. Enter the following information:
Redundant for Holddown timer Redial Limit Dialup Account 1 Dialup Account 2 Dialup Account 3 From the list, select the interface to back up. Enter the number of seconds to continue using the modem after the network connectivity is restored. Enter the maximum number of times to retry if the ISP does not answer. Enter the ISP phone number, user name and password for up to three dialup accounts.

4 5 6

Select Apply. Configure a ping server for the ethernet interface the modem backs up. See To add a ping server to an interface on page 122. Configure firewall policies for network connectivity through the modem interface. See Adding firewall policies for modem connections on page 117.

116

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Interfaces

Standalone mode configuration

In standalone mode, the modem connects to a dialup account to provide a connection to the Internet. You can configure the modem to dial when the FortiGate unit restarts or when there are unrouted packets. You can also hang up or redial the modem manually. If the connection to the dialup account fails, the FortiGate unit will redial the modem. The modem redials the number of times specified by the redial limit, or until it connects to a dialup account. The modem will disconnect after a period of network inactivity set by the value in idle timeout. This saves money on dialup connection charges. You must configure firewall policies for connections between the modem interface and other FortiGate interfaces. You must also go to Router > Static to configure static routes to route traffic to the modem interface. For example, if the modem interface is acting as the FortiGate unit external interface you must set the device setting of the FortiGate unit default route to modem. To configure standalone mode 1 2 3 Go to System > Network > Modem. Select standalone mode. Enter the following information:
Auto-dial Dial on demand Idle timeout Redial Limit Dialup Account 1 Dialup Account 2 Dialup Account 3 Select if you want the modem to dial when the FortiGate unit restarts. Select if you want the modem to connect to its ISP whenever there are unrouted packets. Enter the timeout duration in minutes. After this period of inactivity, the modem disconnects. Enter the maximum number of times to retry if the ISP does not answer. Enter the ISP phone number, user name and password for up to three dialup accounts.

4 5 6

Select Apply. Configure firewall policies for network connectivity through the modem interface. See Adding firewall policies for modem connections on page 117. Go to Router > Static and set device to modem to configure static routes to route traffic to the modem interface. See Adding a static route to the routing table on page 252.

Adding firewall policies for modem connections

The modem interface requires firewall addresses and policies. You can add one or more addresses to the modem interface. For information about adding addresses, see Configuring addresses on page 305. You can configure firewall policies to control the flow of packets between the modem interface and the other interfaces on the FortiGate unit. For information on configuring firewall policies, see Configuring firewall policies on page 285.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

117

Interfaces

System Network

Connecting and disconnecting the modem

Note: The modem must be in Standalone mode before connecting or disconnecting from a dialup account.

To connect to a dialup account 1 2 3 4 5 Go to System > Network > Modem. Select Enable USB Modem. Verify the information in Dialup Accounts. Select Apply. Select Dial Now. The FortiGate unit dials into each dialup account in turn until the modem connects to an ISP. To disconnect from a dialup account 1 2 Go to System > Network > Modem. Select Hang Up to disconnect the modem.

Checking modem status

You can determine the connection status of your modem and which dialup account is active. If the modem is connected to the ISP, you can see the IP address and netmask. To check the modem status, go to System > Network > Modem. Modem status is one of the following:
not active connecting connected disconnecting hung up The modem is not connected to the ISP. The modem is attempting to connect to the ISP. The modem is connected to the ISP. The modem is disconnecting from the ISP. The modem has disconnected from the ISP. (Standalone mode only) The modem will not redial unless you select Dial Now.

A green check mark indicates the active dialup account. The IP address and netmask assigned to the modem interface appears on the System Network Interface screen of the web-based manager.

118

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Zones

Zones
Grouping interfaces and VLAN subinterfaces into zones simplifies policy creation. You can configure policies for connections to and from a zone, but not between interfaces in a zone. You can add zones, rename and edit zones, and delete zones from the zone list. When you add a zone, you select the names of the interfaces and VLAN subinterfaces to add to the zone. Zones are added to virtual domains. If you have added multiple virtual domains to your FortiGate configuration, make sure you are configuring the correct virtual domain before adding or editing zones.
Figure 61: Zone list

Create New Name Block intra-zone traffic

Select Create New to create a new zone. Names of the zones. Displays Yes if traffic between interfaces in the same zone is blocked and No if traffic between interfaces in the same zone is not blocked.

Interface Members Names of the interfaces added to the zone. Interface names depend on the FortiGate model. Edit/View icons Delete icon Edit or view a zone. Delete a zone.

To configure zone settings 1 2 3 4 Go to System > Network > Zone. Select Create New or select the Edit icon for a zone. Select name, and interfaces. Select OK.
Figure 62: Zone settings

Zone Name Block intra-zone traffic

Enter the name to identify the zone. Select Block intra-zone traffic to block traffic between interfaces or VLAN subinterfaces in the same zone.

Interface members Select the interfaces that are part of this zone. This list includes configured VLANs. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

119

Networking Options

System Network

Networking Options
Network options include DNS server and dead gateway detection settings. To configure network options 1 2 3 4 5 Go to System > Network > Options Enter primary and secondary DNS servers. Enter local domain name. Enter Dead Gateway Detection settings. Select OK.
Figure 63: Configuring Networking Options - FortiGate models 200 and higher

Figure 64: Configuring Networking Options - FortiGate models 100 and lower

120

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

Networking Options

Obtain DNS server address automatically

This option applies only to FortiGate models 100 and lower. Select to obtain the DNS server IP address when DHCP is used on an interface, also obtain the DNS server IP address. Available only in NAT/Route mode. You should also enable Override internal DNS in the DHCP settings of the interface. See Configuring DHCP on an interface on page 104.

Use the following DNS server This option applies only to FortiGate models 100 and lower. addresses Use the specified Primary and Secondary DNS server addresses. Primary DNS Server Secondary DNS Server Local Domain Name Enter the primary DNS server IP address. Enter the secondary DNS server IP address. Enter the domain name to append to addresses with no domain portion when performing DNS lookups.

Enable DNS forwarding from This option applies only to FortiGate models 100 and lower operating in NAT/Route mode. Select the interfaces that forward DNS requests they receive to the DNS servers that you configured. Dead Gateway Detection Dead gateway detection confirms connectivity using a ping server added to an interface configuration. For information about adding a ping server to an interface, see Dead gateway detection on page 121. Enter a number in seconds to specify how often the FortiGate unit pings the target. Enter the number of times that the ping test fails before the FortiGate unit assumes that the gateway is no longer functioning.

Detection Interval Fail-over Detection

DNS Servers
Several FortiGate functions use DNS, including alert email and URL blocking. You can specify the IP addresses of the DNS servers to which your FortiGate unit connects. DNS server IP addresses are usually supplied by your ISP. You can configure FortiGate models numbered 100 and lower to obtain DNS server addresses automatically. To obtain these addresses automatically, at least one FortiGate unit interface must use the DHCP or PPPoE addressing mode. See Configuring DHCP on an interface on page 104 or Configuring an interface for PPPoE or PPPoA on page 105. FortiGate models 100 and lower can provide DNS Forwarding on their interfaces. Hosts on the attached network use the interface IP address as their DNS server. DNS requests sent to the interface are forwarded to the DNS server addresses that you configured or that the FortiGate unit obtained automatically.

Dead gateway detection

Dead gateway detection periodically pings a ping server to confirm network connectivity. Typically, the ping server is the next-hop router that leads to an external network or the Internet. The ping period (Detection Interval) and the number of failed pings that is considered to indicate a loss of connectivity (Failover Detection) are set in System > Network > Options. To apply dead gateway detection to an interface, you must configure a ping server on it.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

121

Routing table (Transparent Mode)

System Network

To add a ping server to an interface 1 2 3 4 5 Go to System > Network > Interface. Choose an interface and select Edit. Set Ping Server to the IP address of the next hop router on the network. Select Enable. Select OK.

Routing table (Transparent Mode)

In NAT/Route mode the static routing table is located at System > Routing > Static, but in Transparent Mode that static routing table is located at System > Network > Routing Table. Adding a static route in Transparent Mode 1 2 3 Ensure your FortiGate unit is in Transparent mode. For more details see Changing operation mode on page 177. Go to System > Network > Routing Table. Select Create New to add a static route.
Figure 65: Static routing table - Transparent Mode

Create New # IP Mask Gateway Distance Delete icon View/edit icon Move To icon

Add a new static route. Position of the route in the routing table. The destination IP address for the route. The netmask for the route. The IP address of the next hop router to which the route directs traffic. The administration distance or relative preferability of the route. An administration distance of 1 is most preferred. Remove a route. Edit or view a route. Change the position of a route in the list.

Transparent mode route settings

Configuring a static route in Transparent mode 1 2 3 4 5 Go to System > Network > Routing Table Select Create New to add a route. You can also select the Edit icon of an existing route to modify it. Enter the destination IP and netmask. Enter the gateway. Enter the administrative distance.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

122

System Network

VLAN overview

Select OK.
Figure 66: Transparent mode route settings

Destination IP Enter the destination IP address and netmask for the route. /Mask To create a default route, set the Destination IP and Mask to 0.0.0.0. Gateway Enter the IP address of the next hop router to which the route directs traffic. For an Internet connection, the next hop routing gateway routes traffic to the Internet. The administration distance or relative preferability of the route. An administration distance of 1 is most preferred.

Distance

VLAN overview
A VLAN is group of PCs, servers, and other network devices that communicate as if they were on the same LAN segment, regardless of their location. For example, the workstations and servers for an accounting department could be scattered throughout an office or city and connected to numerous network segments, but still belong to the same VLAN. A VLAN segregates devices logically instead of physically. Each VLAN is treated as a broadcast domain. Devices in VLAN 1 can connect with other devices in VLAN 1, but cannot connect with devices in other VLANs. The communication among devices on a VLAN is independent of the physical network. A VLAN segregates devices by adding 802.1Q VLAN tags to all of the packets sent and received by the devices in the VLAN. VLAN tags are 4-byte frame extensions that contain a VLAN identifier as well as other information. For more information on VLANs, see the FortiGate VLANs and VDOMs Guide.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

123

VLANs in NAT/Route mode

System Network

Figure 67: Basic VLAN topology

Internet

Untagged packets Router VL AN 1 VL AN 2

VL AN 1 VLAN Switch

VL AN 2

VL AN 1 Network

VL AN 2 Network

FortiGate units and VLANs

In a typical VLAN configuration, 802.1Q-compliant VLAN layer-2 switches or layer-3 routers or firewalls add VLAN tags to packets. Packets passing between devices in the same VLAN are normally handled by layer-2 switches but can be handled by layer-3 devices. Packets passing between devices in different VLANs must be handled by a layer-3 device such as router, firewall, or layer-3 switch. Using VLANs, a single FortiGate unit can provide security services and control connections between multiple security domains. Traffic from each security domain is given a different VLAN ID. The FortiGate unit can recognize VLAN IDs and apply security policies to secure network and IPSec VPN traffic between security domains. The FortiGate unit can also apply policies, protection profiles, and other firewall features for network and VPN traffic that is allowed to pass between security domains.

VLANs in NAT/Route mode

Operating in NAT/Route mode, the FortiGate unit functions as a layer-3 device to control the flow of packets between VLANs. The FortiGate unit can also remove VLAN tags from incoming VLAN packets and forward untagged packets to other networks, such as the Internet. FortiGate units in NAT/Route mode can use VLANs for constructing VLAN trunks between an IEEE 802.1Q-compliant switch (or router) and the FortiGate units. Normally the FortiGate unit internal interface connects to a VLAN trunk on an internal switch, and the external interface connects to an upstream Internet router . The FortiGate unit can then apply different policies for traffic on each VLAN that connects to the internal interface.

124

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

VLANs in NAT/Route mode

When constructing VLAN trunks, you add VLAN subinterfaces that have VLAN IDs that match the VLAN IDs of packets in the VLAN trunk to the FortiGate internal interface. If the IDs dont match, traffic will not be delivered. The FortiGate unit directs packets with VLAN IDs to subinterfaces with matching VLAN IDs. For example packets from the sending system VLAN ID#101 are delivered to the recipient systems VLAN ID#101. You can also define VLAN subinterfaces on all FortiGate interfaces. The FortiGate unit can add VLAN tags to packets leaving a VLAN subinterface or remove VLAN tags from incoming packets and add different VLAN tags to outgoing packets.

Rules for VLAN IDs

In NAT/Route mode, two VLAN subinterfaces added to the same physical interface cannot have the same VLAN ID. However, you can add two or more VLAN subinterfaces with the same VLAN IDs to different physical interfaces. There is no internal connection or link between two VLAN subinterfaces with same VLAN ID. Their relationship is the same as the relationship between any two FortiGate network interfaces.

Rules for VLAN IP addresses

IP addresses of all FortiGate interfaces cannot overlap. That is, the IP addresses of all interfaces must be on different subnets. This rule applies to both physical interfaces and to VLAN subinterfaces.
Note: If you are unable to change your existing configurations to prevent IP overlap, enter the CLI command config system global and set allow-interface-subnetoverlap enable to allow IP address overlap. If you enter this command, multiple VLAN interfaces can have an IP address that is part of a subnet used by another interface. This command is recommended for advanced users only.

Figure 57 shows a simplified NAT/Route mode VLAN configuration. In this configuration, the FortiGate internal interface connects to a VLAN switch using an 802.1Q trunk and is configured with two VLAN subinterfaces (VLAN 100 and VLAN 200). The external interface connects to the Internet. The external interface is not configured with VLAN subinterfaces. When the VLAN switch receives packets from VLAN 100 and VLAN 200, it applies VLAN tags and forwards the packets to local ports and across the trunk to the FortiGate unit. The FortiGate unit is configured with policies that allow traffic to flow between VLANs and from the VLANs to the external network.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

125

VLANs in NAT/Route mode

System Network

Figure 68: FortiGate unit in NAT/Route mode

Internet

Untagged packets External 172.16.21.2

FortiGate unit
Internal 192.168.110.126 802.1Q trunk Fa 0/24 Fa 0/9 Fa 0/3 VLAN Switch

VLAN 100

VLAN 200

VLAN 100 Network 10.1.1.0

VLAN 200 Network 10.1.2.0

Adding VLAN subinterfaces

The VLAN ID of each VLAN subinterface must match the VLAN ID added by the IEEE 802.1Q-compliant router. The VLAN ID can be any number between 1 and 4096. Each VLAN subinterface must also be configured with its own IP address and netmask. VLAN subinterfaces to the physical interface that receives VLAN-tagged packets.
Note: A VLAN must not have the same name as a virtual domain or zone.

To add a VLAN subinterface in NAT/Route mode 1 2 3 4 5 6 Go to System > Network > Interface. Select Create New to add a VLAN subinterface. Enter a Name to identify the VLAN subinterface. Select the physical interface that receives the VLAN packets intended for this VLAN subinterface. Enter the VLAN ID that matches the VLAN ID of the packets to be received by this VLAN subinterface. If you are an administrator with a super-admin profile, you can create VLAN subinterfaces for any virtual domain. If not, you can only create VLAN subinterfaces in your own VDOM. See Using virtual domains on page 81 for information about virtual domains.

126

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

VLANs in Transparent mode

7 8

Configure the VLAN subinterface settings. See Interface settings on page 97. Select OK. The FortiGate unit adds the new VLAN subinterface to the interface that you selected in step 4. To add firewall policies for a VLAN subinterface After you add a VLAN subinterface you can add firewall policies for connections between a VLAN subinterface or from a VLAN subinterface to a physical interface.

1 2

Go to Firewall > Address. Select Create New to add firewall addresses that match the source and destination IP addresses of VLAN packets. See About firewall addresses on page 303. Go to Firewall > Policy. Configure firewall policies as required.

3 4

VLANs in Transparent mode

In Transparent mode, the FortiGate unit can apply firewall policies and services, such as authentication, protection profiles, and other firewall features, to traffic on an IEEE 802.1 VLAN trunk. You can insert the FortiGate unit into the trunk without making changes to the network. In a typical configuration, the FortiGate internal interface accepts VLAN packets on a VLAN trunk from a VLAN switch or router connected to internal VLANs. The FortiGate external interface forwards tagged packets through the trunk to an external VLAN switch or router that can be connected to the Internet. The FortiGate unit can be configured to apply different policies for traffic on each VLAN in the trunk. For VLAN traffic to be able to pass between the FortiGate internal and external interface you add a VLAN subinterface to the internal interface and another VLAN subinterface to the external interface. If these VLAN subinterfaces have the same VLAN IDs, the FortiGate unit applies firewall policies to the traffic on this VLAN. If these VLAN subinterfaces have different VLAN IDs, or if you add more than two VLAN subinterfaces, you can also use firewall policies to control connections between VLANs. If the network uses IEEE 802.1 VLAN tags to segment your network traffic, you can configure a FortiGate unit to provide security for network traffic passing between different VLANs. To support VLAN traffic in Transparent mode, you add virtual domains to the FortiGate unit configuration. A virtual domain consists of two or more VLAN subinterfaces or zones. In a virtual domain, a zone can contain one or more VLAN subinterfaces.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

127

VLANs in Transparent mode

System Network

When the FortiGate unit receives a VLAN tagged packet at an interface, the packet is directed to the VLAN subinterface with the matching VLAN ID. The VLAN subinterface removes the VLAN tag and assigns a destination interface to the packet based on its destination MAC address. The firewall policies for the source and destination VLAN subinterface pair are applied to the packet. If the packet is accepted by the firewall, the FortiGate unit forwards the packet to the destination VLAN subinterface. The destination VLAN ID is added to the packet by the FortiGate unit and the packet is sent to the VLAN trunk.
Note: There is a maximum of 255 interfaces total allowed per VDOM in Transparent mode. This includes VLANs. If no other interfaces are configured for a VDOM, you can configure up to 255 VLANs in that VDOM.

Figure 69 shows a FortiGate unit operating in Transparent mode with 2 virtual domains and configured with three VLAN subinterfaces.
Figure 69: FortiGate unit with two virtual domains in Transparent mode
FortiGate unit VLAN1 Internal VLAN1 VLAN2 VLAN3 VLAN trunk VLAN Switch or router VLAN3 root virtual domain VLAN1 VLAN1 External VLAN1 VLAN2 VLAN3 VLAN trunk VLAN Switch or router
Internet

VLAN2

New virtual domain VLAN2 VLAN2 VLAN3 VLAN3

Figure 70 shows a FortiGate unit operating in Transparent mode and configured with three VLAN subinterfaces. In this configuration, the FortiGate unit would provide virus scanning, web content filtering, and other services to each VLAN.

128

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

VLANs in Transparent mode

Figure 70: FortiGate unit in Transparent mode

Internet

Router Untagged packets VLAN Switch VL AN 1 VL AN 2 VL AN 3 FortiGate unit in Transparent mode VLAN Trunk VL AN 1 VL AN 2 VL AN 3

VLAN Trunk

VLAN Switch

VL AN 1

VL AN 2

VL AN 3

VL AN 1 Network

VL AN 2 Network

VL AN 3 Network

Rules for VLAN IDs

In Transparent mode, two VLAN subinterfaces added to the same physical interface cannot have the same VLAN ID. However, you can add two or more VLAN subinterfaces with the same VLAN IDs to different physical interfaces. There is no internal connection or link between two VLAN subinterfaces with the same VLAN ID. Their relationship is the same as the relationship between any two FortiGate network interfaces.
Note: There is a maximum of 255 VLANs allowed per interface in Transparent mode.

Transparent mode virtual domains and VLANs

VLAN subinterfaces are added to and associated with virtual domains. By default the FortiGate configuration includes one virtual domain, named root, and you can add as many VLAN subinterfaces as you require to this virtual domain. You can add more virtual domains if you want to separate groups of VLAN subinterfaces into virtual domains. For information on adding and configuring virtual domains, see Using virtual domains on page 81

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

129

VLANs in Transparent mode

System Network

Adding a VLAN subinterface in Transparent mode

Note: A VLAN must not have the same name as a virtual domain or zone.

1 2 3 4 5 6 7 8

Go to System > Network > Interface. Select Create New to add a VLAN subinterface. Enter a Name to identify the VLAN subinterface. Select the physical interface that receives the VLAN packets intended for this VLAN subinterface. Enter the VLAN ID that matches the VLAN ID of the packets to be received by this VLAN subinterface. Select which virtual domain to add this VLAN subinterface to. See Using virtual domains on page 81 for information about virtual domains. Configure the administrative access, and log settings. See Interface settings on page 97 for more descriptions of these settings. Select OK. The FortiGate unit adds the new subinterface to the interface that you selected in step 4.

Select Bring up to activate the VLAN subinterface. To add firewall policies for a VLAN subinterface After you add a VLAN subinterface, you can add firewall policies for connections between VLAN subinterfaces or from a VLAN subinterface to a physical interface.

1 2

Go to Firewall > Address. Select Create New to add firewall addresses that match the source and destination IP addresses of VLAN packets. See About firewall addresses on page 303. Go to Firewall > Policy. Add firewall policies as required.

3 4

Troubleshooting ARP Issues

Address Resolution Protocol (ARP) traffic is vital to communication on a network and is enabled on FortiGate interfaces by default. Normally ARP packets to pass through the FortiGate unit, especially if it is sitting between a client and a server or between a client and a router.

Duplicate ARP packets

ARP traffic can cause problems such as duplicate ARP packets making the recipient device think the packets originated from two different device, which is generally an attempt to hack into the network.

130

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Network

VLANs in Transparent mode

This is true especially in Transparent mode where ARP packets arriving on one interface are sent to all other interfaces, including VLAN subinterfaces. Some Layer 2 switches become unstable when they detect the same MAC address originating on more than one switch interface or from more than one VLAN. This instability can occur if the Layer 2 switch does not maintain separate MAC address tables for each VLAN. Unstable switches may reset causing network traffic to slow down.

ARP Forwarding
One solution to the duplicate ARP packet problem is to enable ARP forwarding. When ARP forwarding is enabled, the Fortigate unit allows duplicate ARP packets that resolve the delivery problems caused by duplicate ARP packets. However, this also opens up your network to potential hacking attempts that spoof packets. For more secure solutions, see the FortiGate VLANs and VDOMs Guide.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

131

VLANs in Transparent mode

System Network

132

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Wireless

FortiWiFi wireless interfaces

System Wireless
This section describes how to configure the Wireless LAN interfaces on FortiWiFi units. The majority of this section is applicable to all FortiWiFi units. Where indicated, some features may not be available on the FortiWiFi-60. This section describes: FortiWiFi wireless interfaces Channel assignments System wireless settings FortiWiFi-60 system wireless settings Wireless MAC Filter Wireless Monitor

FortiWiFi wireless interfaces

FortiWiFi units (except the FortiWiFi-60) support up to four wireless interfaces and four different SSIDs. Each wireless interface should have a different SSID and each wireless interface can have different security settings. For details on adding wireless interfaces, see Adding a wireless interface on page 137. You can configure the FortiWiFi unit to: Provide an access point that clients with wireless network cards can connect to. This is called Access Point mode, which is the default mode. All FortiWiFi units except the FortiWiFi-60 can have up to 4 wireless interfaces. Connect the FortiWiFi unit to another wireless network. This is called Client mode. A FortiWiFi unit operating in client mode can also can only have one wireless interface. IEEE 802.11a (5-GHz Band) (FortiWiFi-60A and FortiWiFi-60B) IEEE 802.11b (2.4-GHz Band) IEEE 802.11g (2.4-GHz Band) WEP64 and WEP128 Wired Equivalent Privacy (WEP) Wi-Fi Protected Access (WPA), WPA2 and WPA2 Auto using pre-shared keys or RADIUS servers

or

FortiWiFi units support the following wireless network standards:

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

133

Channel assignments

System Wireless

Channel assignments
Depending on the wireless protocol selected, you have specific channels available to you, depending on what region of the world you are in. Set the channel for the wireless network by going to System > Wireless > Settings. For more information see System wireless settings on page 136. The following tables list the channel assignments for wireless networks for each supported wireless protocol. IEEE 802.11a channel numbers IEEE 802.11b channel numbers IEEE 802.11g channel numbers

IEEE 802.11a channel numbers

Table 5 lists IEEE 802.11a channels supported for FortiWiFi products that support the IEEE 802.11a wireless standard. 802.11a is only available on the FortiWiFi-60A and FortiWiFi-60B units. All channels are restricted to indoor usage except the Americas, which allows for indoor and outdoor use on channels 52 through 64 in the United States.
Table 5: IEEE 802.11a (5-GHz Band) channel numbers Channel number 34 36 38 40 42 44 46 48 52 56 60 64 149 153 157 161 Frequency (MHz) 5170 5180 5190 5200 5210 5220 5230 5240 5260 5280 5300 5320 5745 5765 5785 5805 Regulatory Areas Americas Europe Taiwan Singapore Japan

134

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Wireless

Channel assignments

IEEE 802.11b channel numbers

Table 6 lists IEEE 802.11b channels. All FortiWiFi units support 802.11b. Mexico is included in the Americas regulatory domain. Channels 1 through 8 are for indoor use only. Channels 9 through 11 can be used indoors and outdoors. You must make sure that the channel number complies with the regulatory standards of Mexico.
Table 6: IEEE 802.11b (2.4-Ghz Band) channel numbers Channel number 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Frequency (MHz) 2412 2417 2422 2427 2432 2437 2442 2447 2452 2457 2462 2467 2472 2484 Americas Regulatory Areas EMEA Israel Japan

IEEE 802.11g channel numbers

Table 7 lists IEEE 802.11b channels. All FortiWiFi products support 802.11g.
Table 7: IEEE 802.11g (2.4-GHz Band) channel numbers Regulatory Areas Americas EMEA Israel Channel Frequency number (MHz) CCK ODFM CCK ODFM CCK ODFM 1 2412 2 2417 3 2422 4 2427 5 2432 6 2437 7 2442 8 2447 9 2452 10 2457 11 2462 12 2467 13 2472 14 2484 Japan CCK ODFM

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

135

System wireless settings

System Wireless

System wireless settings

To configure the wireless settings, go to System > Wireless > Settings.
Note: For a FortiWiFi-60 unit, see FortiWiFi-60 system wireless settings on page 139.

By default the FortiWiFi unit includes one wireless interface, called wlan. If you are operating your FortiWiFi unit in access point mode, you can add up to three more wireless interfaces. All wireless interfaces use the same wireless parameters. That is, you configure the wireless settings once, and all wireless interfaces use those settings. For details on adding more wireless interfaces, see Adding a wireless interface on page 137. When operating the FortiWiFi in Client mode, wireless settings are not configurable.
Figure 71: FortiWiFi wireless parameters

Operation Mode Select Change to switch operation modes. Access Point - The FortiWiFi unit acts as an access point for wireless users to connect to send and receive information over a wireless network. It enables multiple wireless network users access to the network without the need to connect to it physically. The FortiWiFi unit can connect to the internal network and act as a firewall to the Internet. Client - The FortiWiFi unit is set to receive transmissions from another access point. This enables you to connect remote users to an existing network using wireless protocols from a location that does not have a wired infrastructure. In Client mode, the wireless port is not available to wireless devices as it is dedicated to connecting to the Access Point. Band Select the wireless frequency band. Be aware what wireless cards or devices your users have as it may limit their use of the wireless network. For example, if you configure the FortiWiFi unit for 802.11g and users have 802.11b devices, they may not be able to use the wireless network. Select your country or region. This determines which channels are available. See Channel assignments on page 134 for channel information. Select a channel for your wireless network or select Auto. The channels that you can select depend on the Geography setting. See Channel assignments on page 134 for channel information. Set the transmitter power level. The higher the number, the larger the area the FortiWiFi will broadcast. If you want to keep the wireless signal to a small area, enter a smaller number.

Geography

Channel

Tx Power

136

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Wireless

System wireless settings

Beacon Interval Set the interval between beacon packets. Access Points broadcast Beacons or Traffic Indication Messages (TIM) to synchronize wireless networks. A higher value decreases the number of beacons sent, however it may delay some wireless clients from connecting if it misses a beacon packet. Decreasing the value will increase the number of beacons sent, while this will make it quicker to find and connect to the wireless network, it requires more overhead, slowing throughput. Wireless interface list Interface MAC Address SSID The name of the wireless interface. To add more wireless interfaces, see Adding a wireless interface on page 137. The MAC address of the Wireless interface. The wireless service set identifier (SSID) or network name for the wireless interface. Clients who want to use the wireless interface must configure their computers to connect to the network that broadcasts this network name.

SSID Broadcast Green checkmark icon indicates that the wireless interface broadcasts its SSID. Broadcasting the SSID makes it possible for clients to connect to your wireless network without first knowing the SSID. Security Mode Displays information about the security mode for the wireless interface.

Adding a wireless interface

You can add up to three additional wireless interfaces. The additional interfaces share the same wireless parameters configured for the WLAN interface for Band, Geography, Channel, Tx Power, and Beacon Interval. Ensure each wireless interface has a unique SSID.
Note: You cannot add additional wireless interfaces on the FortiGate-60, or when the FortiWiFi is in Client mode.

To add a wireless interface 1 2 3 Go to System > Network > Interface. Select Create New. Complete the following:
Name Enter a name for the wireless interface. The name cannot be the same as an existing interface, zone or VDOM. Type Select Wireless. Address Mode The wireless interface can only be set as a manual address. Enter a valid IP address and netmask. If the FortiWiFi is running in Transparent mode, this field does not appear. The interface will be on the same subnet as the other interfaces. Administrative Set the administrative access for the interface. Access

In the Wireless Settings section, complete the following and select OK:
Figure 72: Wireless interface settings (WEP64)

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

137

System wireless settings

System Wireless

Figure 73: Wireless interface settings (WAP2)

SSID

Enter the wireless service set identifier (SSID) or network name for this wireless interface. Users who want to use the wireless network must configure their computers to connect to the network that broadcasts this network name. Select to broadcast the SSID. Broadcasting the SSID enables clients to connect to your wireless network without first knowing the SSID. For better security, do not broadcast the SSID. If the interface is not broadcast, there is less chance of an unwanted user connecting to your wireless network. If you choose not to broadcast the SSID, you need to inform users of the SSID so they can configure their wireless devices.

SSID Broadcast

Security mode Select the security mode for the wireless interface. Wireless users must use the same security mode to be able to connect to this wireless interface. None has no security. Any wireless user can connect to the wireless network. WEP64 - 64-bit web equivalent privacy (WEP). To use WEP64 you must enter a Key containing 10 hexadecimal digits (0-9 a-f) and inform wireless users of the key. WEP128 - 128-bit WEP. To use WEP128 you must enter a Key containing 26 hexadecimal digits (0-9 a-f) and inform wireless users of the key. Wi-Fi protected access (WPA) security. To use WPA you must select a data encryption method. You must also enter a pre-shared key containing at least eight characters or select a RADIUS server. If you select a RADIUS server the wireless clients must have accounts on the RADIUS server. WPA2 provides more security features and is more secure than WPA. To use WPA2 you must select a data encryption method and enter a pre-shared key containing at least eight characters or select a RADIUS server. If you select a RADIUS server the wireless clients must have accounts on the RADIUS server. WPA2 Auto provides the same security features as WPA2. However, WPA2 Auto also accepts wireless clients using WPA security. To use WPA2 Auto you must select a data encryption method You must also enter a pre-shared key containing at least 8 characters or select a RADIUS server. If you select a RADIUS server the wireless clients must have accounts on the RADIUS server.

Key Data Encryption

Enter the security key. This field appears when selecting WEP64 or WEP128 security. Select a data encryption method to be used by WPA, WPA2, or WPA Auto. Select TKIP to use the Temporal Key Integrity Protocol (TKIP). Select AES to use advanced encryption standard (AES) encryption. AES is considered more secure that TKIP. Some implementations of WPA may not support AES.

138

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Wireless

FortiWiFi-60 system wireless settings

Pre-shared Key Enter the pre-shared key. This field appears when selecting WPA, WPA2, or WPA2 Auto security. RADIUS Server Select to use a RADIUS server when selecting WPA or WPA2 security. You can use WPA or WPA2 Radius security to integrate your wireless network configuration with a RADIUS or Windows AD server. Select a RADIUS server name from the list. You must configure the Radius server by going to User > RADIUS. For more information, see RADIUS servers on page 397. RTS Threshold Set the Request to Send (RTS) threshold. The RTS threshold is the maximum size, in bytes, of a packet that the FortiWiFi will accept without sending RTS/CTS packets to the sending wireless device. In some cases, larger packets being sent may cause collisions, slowing data transmissions. By changing this value from the default of 2346, you can configure the FortiWiFi unit to, in effect, have the sending wireless device ask for clearance before sending larger transmissions. There can still be risk of smaller packet collisions, however this is less likely. A setting of 2346 bytes effectively disables this option. Fragmentation Set the maximum size of a data packet before it is broken into smaller packets, reducing the chance of packet collisions. If the packet is smaller Threshold than the threshold, the FortiWiFi unit will fragment the transmission. If the packet size less than the threshold, the FortiWiFi unit will not fragment the transmission. A setting of 2346 bytes effectively disables this option.

FortiWiFi-60 system wireless settings

Go to System > Wireless > Settings to configure wireless settings.
Figure 74: Configuring wireless parameters

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

139

FortiWiFi-60 system wireless settings

System Wireless

MAC Address

The MAC address of the Wireless interface.

Operation Mode Select Change to switch operation modes. Access Point - The FortiWiFi unit acts as an access point for wireless users to connect to send and receive information over a wireless network. It enables multiple wireless network users access to the network without the need to connect to it physically. The FortiWiFi unit can connect to the internal network and act as a firewall to the Internet. Client - The FortiWiFi unit is set to receive transmissions from another access point. This enables you to connect remote users to an existing network using wireless protocols from a location that does not have a wired infrastructure. In Client mode, the wireless port is not available to wireless devices as it is dedicated to connecting to the Access Point. Geography Channel Select your country or region. This determines which channels are available. Select a channel for your wireless network or select Auto. The channels that you can select depend on the Geography setting. See Channel assignments on page 134 for channel information. Enter the wireless service set identifier (SSID) or network name for this wireless interface. Users who want to use the wireless network must configure their computers to connect to the network that broadcasts this network name.

SSID

SSID Broadcast Select to broadcast the SSID. Broadcasting the SSID enables clients to connect to your wireless network without first knowing the SSID. For better security, do not broadcast the SSID. If the interface is not broadcast, there is less chance of an unwanted user connecting to your wireless network. If you choose not to broadcast the SSID, you need to inform users of the SSID so they can configure their wireless devices. Security mode Select the security mode for the wireless interface. Wireless users must use the same security mode to be able to connect to this wireless interface. None has no security. Any wireless user can connect to the wireless network. WEP64 -64-bit web equivalent privacy (WEP), select. To use WEP64 you must enter a Key containing 10 hexadecimal digits (0-9 a-f) and inform wireless users of the key. WEP128 - 128-bit WEP. To use WEP128 you must enter a Key containing 26 hexadecimal digits (0-9 a-f) and inform wireless users of the key. Wi-Fi protected access (WPA) security. To use WPA you must select a data encryption method. You must also enter a pre-shared key containing at least eight characters or select a RADIUS server. If you select a RADIUS server the wireless clients must have accounts on the RADIUS server.

Key

Enter the security key. This field appears when selecting WEP64 or WEP128 security.

Pre-shared Key Enter the pre-shared key. This field appears when selecting WPA security. Radius Server Name Select to use a RADIUS server when selecting WPA security. You can use WPA Radius security to integrate your wireless network configuration with a RADIUS or Windows AD server. Select a RADIUS server name from the list. You must configure the Radius server by going to User > RADIUS. For more information, see RADIUS servers on page 397. Open or close the Advanced settings section of the Wireless Parameters. Change settings if needed to address performance issues. Default values should work well for most situations. Advanced settings are available in Access Point mode only.

Advanced

140

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Wireless

Wireless MAC Filter

Tx Power

Set the transmitter power level. The higher the number, the larger the area the FortiWiFi will broadcast. If you want to keep the wireless signal to a small area, enter a smaller number.

Beacon Interval Set the interval between beacon packets. Access Points broadcast Beacons or Traffic Indication Messages (TIM) to synchronize wireless networks. A higher value decreases the number of beacons sent, however it may delay some wireless clients from connecting if it misses a beacon packet. Decreasing the value will increase the number of beacons sent, while this will make it quicker to find and connect to the wireless network, it requires more overhead, slowing throughput. RTS Threshold Set the Request to Send (RTS) threshold. The RTS threshold is the maximum size, in bytes, of a packet that the FortiWiFi will accept without sending RTS/CTS packets to the sending wireless device. In some cases, larger packets being sent may cause collisions, slowing data transmissions. By changing this value from the default of 2347, you can configure the FortiWiFi unit to in effect, have the sending wireless device ask for clearance before sending larger transmissions. There can still be risk of smaller packet collisions, however this is less likely. A setting of 2347 bytes effectively disables this option. Fragmentation Threshold Set the maximum size of a data packet before it is broken into smaller packets, reducing the chance of packet collisions. If the packet size is larger than the threshold, the FortiWiFi unit will fragment the transmission. If the packet is smaller than the threshold, the FortiWiFi unit will not fragment the transmission. A setting of 2346 bytes effectively disables this option.

Wireless MAC Filter

To improve the security of your wireless network, you can enable MAC address filtering on the FortiWiFi unit. By enabling MAC address filtering, you define the wireless devices that can access the network based on their system MAC address. When a user attempts to access the wireless network, the FortiWiFi unit checks the MAC address of the user to the list you created. If the MAC address is on the approved list, the user gains access to the network. If the user is not in the list, the user is rejected. Alternatively, you can create a deny list. Similar to the allow list, you can configure the wireless interface to allow all connections except those in the MAC address list. Using MAC address filtering makes it more difficult for a hacker using random MAC addresses or spoofing a MAC address to gain access to your network. Note you can configure one list per WLAN interface. To allow or deny wireless access to wireless clients based on the MAC address of the client wireless cards, go to System > Wireless > MAC Filter. Managing the MAC Filter list FortiWiFi-60 Wireless MAC Filter

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

141

Wireless MAC Filter

System Wireless

Managing the MAC Filter list

The MAC Filter list enables you to view the MAC addresses you have added to a wireless interface and their status; either allow or deny. It also enables you to edit and manage MAC Filter lists.
Note: The FortiWiFi-60 only has one wireless interface. Figure 75: Wireless MAC filter list

Wireless MAC filter interface list Interface MAC address List Access Enable Edit icon The name of the wireless interface. The list of MAC addresses in the MAC filter list for the wireless interface. Allow or deny access to the listed MAC addresses for the wireless interface. Select to enable the MAC filtering for the wireless interface. When not selected MAC filtering options are not applied to the interface. Edit the MAC address list for an interface.

To edit a MAC filter list 1 2 Go to System > Wireless > MAC Filter. Select Edit for the wireless interface.
Note: For the FortiWiFi-60, see FortiWiFi-60 Wireless MAC Filter on page 143. Figure 76: Wireless interface MAC filter

Complete the following and select OK:

142

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Wireless

Wireless MAC Filter

Edit the MAC filter list for a wireless interface List Access MAC Address Add Remove Select to allow or deny the addresses in the MAC Address list from accessing the wireless network. Enter the MAC address to add to the list. Add the entered MAC address to the list. Select one or more MAC addresses in the list and select Remove to deleted the MAC addresses from the list.

FortiWiFi-60 Wireless MAC Filter

To edit a MAC filter list 1 2 Go to System > Wireless > MAC Filter. Select Edit for the wireless interface.
Figure 77: FortiWiFi-60 wireless MAC filter

Complete the following and select Apply:

MAC Filter Enable Select to enable the MAC filtering for the wireless interface. When not selected MAC filtering options are not applied to the interface.

Access for PCs not Select whether to allow or deny access to unlisted MAC addresses. listed below MAC Address Allow or Deny Add Allow List Deny List Arrow buttons Remove (below Allow list) Remove (below Deny list) Enter the MAC address to filter. Select whether to allow or deny the MAC Address. Add the MAC address to the Allow or Deny list, as selected. List of MAC addresses allowed access to the wireless network. List of MAC addresses denied access to the wireless network. Move MAC addresses between lists. Remove selected MAC addresses from Allow list. Remove selected MAC addresses from Deny list.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

143

Wireless Monitor

System Wireless

Wireless Monitor
Go to System > Wireless > Monitor to see who is connected to your wireless LAN.
Figure 78: FortiWiFi-50B, 60A, 60AM, and 60B wireless monitor

Figure 79: FortiWiFi-60 wireless monitor

Statistics

Statistical information about wireless performance for each wireless interface. Statistics are not available for the FortiWiFi-60. The name of the wireless interface. The frequency that the wireless interface is operating with. Should be around 5-GHz for 802.11a interfaces and around 2.4-GHz for 802.11b and 802.11g networks. The strength of the signal from the client. The received noise level. The signal-to-noise ratio in deciBels calculated from signal strength and noise level. The amount of data in kilobytes received this session. The amount of data in kilobytes sent this session. Real-time details about what devices are connected to the FortiWiFi unit. This is a useful way to view the number of users connected should you need to troubleshoot or perform maintenance on the unit. The MAC address of the connected wireless client. The IP address assigned to the connected wireless client. The name of the wireless interface that the client is connected to. Not available on the FortiWiFi-60. The user ID of the connected client using WPA RADIUS security mode. This field is blank if the client uses WPA Pre-Shared Key or WEP security modes. Available on FortiWiFi-60 units only.

AP Name Frequency

Signal Strength (dBm) Noise (dBm) S/N (dB) Rx (KBytes) Tx (KBytes) Clients

MAC Address IP Address AP Name ID

144

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System DHCP

FortiGate DHCP servers and relays

System DHCP
This section describes how to use DHCP to provide convenient automatic network configuration for your clients. DHCP is not available in Transparent mode. DHCP requests are passed through the FortiGate unit when it is in Transparent mode. This section describes: FortiGate DHCP servers and relays Configuring DHCP services Viewing address leases

FortiGate DHCP servers and relays

The DHCP protocol enables hosts to automatically obtain an IP address from a DHCP server. Optionally, they can also obtain default gateway and DNS server settings. A FortiGate interface or VLAN subinterface can provide the following DHCP services: Basic DHCP servers for non-IPSec IP networks IPSec DHCP servers for IPSec (VPN) connections DHCP relay for regular Ethernet or IPSec (VPN) connections

An interface cannot provide both a server and a relay for connections of the same type (regular or IPSec).
Note: You can configure a Regular DHCP server on an interface only if the interface has a static IP address. You can configure an IPSec DHCP server on an interface that has either a static or a dynamic IP address.

You can configure one or more DHCP servers on any FortiGate interface. A DHCP server dynamically assigns IP addresses to hosts on the network connected to the interface. The host computers must be configured to obtain their IP addresses using DHCP. If an interface is connected to multiple networks via routers, you can add a DHCP server for each network. The IP range of each DHCP server must match the network address range. The routers must be configured for DHCP relay. To configure a DHCP server, see Configuring a DHCP server on page 147. You can configure a FortiGate interface as a DHCP relay. The interface forwards DHCP requests from DHCP clients to an external DHCP server and returns the responses to the DHCP clients. The DHCP server must have appropriate routing so that its response packets to the DHCP clients arrive at the FortiGate unit. To configure a DHCP relay see Configuring an interface as a DHCP relay agent on page 147. DHCP services can also be configured through the Command Line Interface (CLI). See the FortiOS CLI Reference for more information.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

145

Configuring DHCP services

System DHCP

Configuring DHCP services

Go to System > DHCP > Service to configure DHCP services. On each FortiGate interface, you can configure a DHCP relay or add DHCP servers as needed. On FortiGate 50 and 60 series units, a DHCP server is configured, by default, on the Internal interface, as follows: IP Range Netmask Default gateway Lease time DNS Server 1 192.168.1.110 to 192.168.1.210 255.255.255.0 192.168.1.99 7 days 192.168.1.99

You can disable or change this default DHCP Server configuration.

Note: You can not configure DHCP in Transparent mode. In Transparent mode DHCP requests pass through the FortiGate unit.

These settings are appropriate for the default Internal interface IP address of 192.168.1.99. If you change this address to a different network, you need to change the DHCP server settings to match.
Figure 80: DHCP service list - FortiGate-200A shown

Edit Delete Add DHCP Server Interface Server Name/ Relay IP Type Enable List of FortiGate interfaces. Expand each listed interface to view the Relay and Servers. Name of FortiGate DHCP server or IP address of DHCP server accessed by relay. Type of DHCP relay or server: Regular or IPSec. Green check mark icon indicates that server or relay is enabled.

Add DHCP Server Select to configure and add a DHCP server for this interface. icon Edit icon Delete icon Select to edit the DHCP relay or server configuration. Select to delete the DHCP server.

146

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System DHCP

Configuring DHCP services

Configuring an interface as a DHCP relay agent

Go to System > DHCP > Service and select an edit icon to view or modify the DHCP relay configuration for an interface.
Figure 81: Edit DHCP relay settings for an interface

Interface Name Type DHCP Server IP

The name of the interface. Select the type of DHCP service required as either Regular or IPSEC. Enter the IP address of the DHCP server that will answer DHCP requests from computers on the network connected to the interface.

DHCP Relay Agent Select to enable the DHCP relay agent on this interface.

Configuring a DHCP server

The System > DHCP > Service screen gives you access to existing DHCP servers. It is also where you configure new DHCP servers. To Configure a DHCP server 1 2 3 4 5 Go to System > DHCP > Service. Select blue arrow for the interface. Select the select the Add DHCP Server icon to create a new DHCP server, or select the Edit icon beside an existing DHCP server to change its settings. Configure the DHCP server. Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

147

Configuring DHCP services

System DHCP

Figure 82: DHCP Server options

Name Enable Type

Enter a name for the DHCP server. Enable the DHCP server. Select Regular or IPSEC DHCP server. You cannot configure a Regular DHCP server on an interface that has a dynamic IP address. Enter the start and end for the range of IP addresses that this DHCP server assigns to DHCP clients. Enter the netmask of the addresses that the DHCP server assigns. Enter the IP address of the default gateway that the DHCP server assigns to DHCP clients. Enter the domain that the DHCP server assigns to DHCP clients. Select Unlimited for an unlimited lease time or enter the interval in days, hours, and minutes after which a DHCP client must ask the DHCP server for new settings. The lease time can range from 5 minutes to 100 days. Select to configure advanced options. The remaining options in this table are advanced options. Enter the IP addresses of up to 3 DNS servers that the DHCP server assigns to DHCP clients. Add the IP addresses of one or two WINS servers that the DHCP server assigns to DHCP clients. Enter up to three custom DHCP options that can be sent by the DHCP server. Code is the DHCP option code in the range 1 to 255. Option is an even number of hexadecimal characters and is not required for some option codes. For detailed information about DHCP options, see RFC 2132, DHCP Options and BOOTP Vendor Extensions.

IP Range Network Mask Default Gateway Domain Lease Time

Advanced DNS Server 1 DNS Server 2 DNS Server 3 WINS Server 1 WINS Server 2 Option 1 Option 2 Option 3

148

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System DHCP

Viewing address leases

Exclude Ranges Add Add an IP exclude range. You can add up to 16 exclude ranges of IP addresses that the DHCP server cannot assign to DHCP clients. No range can exceed 65536 IP addresses. Enter the first IP address of the exclude range. Enter the last IP address of the exclude range. Delete the exclude range.

Starting IP End IP Delete icon

Viewing address leases

Go to System > DHCP > Address Leases to view the IP addresses that the DHCP servers have assigned and the corresponding client MAC addresses.
Figure 83: Address leases list

Interface Refresh IP MAC Expire

Select interface for which to list leases. Select Refresh to update Address leases list. The assigned IP address. The MAC address of the device to which the IP address is assigned. Expiry date and time of the DHCP lease.

Reserving IP addresses for specific clients

You can reserve an IP address for a specific client identified by the client device MAC address and the connection type, regular Ethernet or IPSec. The DHCP server always assigns the reserved address to that client. You can define up to 50 reserved addresses. Use the CLI config system dhcp reserved-address command. For more information, see the FortiOS CLI Reference.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

149

Viewing address leases

System DHCP

150

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

HA

System Config
This section describes the configuration of several non-network features, such as HA, SNMP, custom replacement messages, and VDOM operation. This section describes: HA SNMP Replacement messages Operation mode and VDOM management access

HA, SNMP and Replacement messages are part of the global configuration of the FortiGate unit. Changing operation mode applies to each individual VDOM.

HA
FortiGate high availability (HA) provides a solution for two key requirements of critical enterprise networking components: enhanced reliability and increased performance. This section contains a brief description of HA web-based manager configuration options, the HA cluster members list, HA statistics, and disconnecting cluster members. For complete information about how to configure and operate FortiGate HA clusters see the FortiGate HA Overview, the FortiGate HA Guide, and the Fortinet Knowledge Center. HA is not available on FortiGate models 50A and 50AM. HA is available on all other FortiGate models, including the FortiGate-50B. The following topics are included in this section: HA options Cluster members list Viewing HA statistics Changing subordinate unit host name and device priority Disconnecting a cluster unit from a cluster

HA options
Configure HA options so that a FortiGate unit can join a cluster or to change the configuration of an operating cluster or cluster member. To configure HA options so that a FortiGate unit can join an HA cluster, go to System > Config > HA. If HA is already enabled, go to System > Config > HA to display the cluster members list. Select edit for the FortiGate unit with Role of master (also called the primary unit). When you edit the HA configuration of the primary unit, all changes are synchronized to the other cluster units.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

151

HA

System Config

Figure 84: FortiGate-1000AFA2 unit HA configuration

You can configure HA options for a FortiGate unit with virtual domains (VDOMs) enabled by logging into the web-based manager as the global admin administrator and then going to System > Config > HA.
Note: If your FortiGate cluster uses virtual domains, you are configuring HA virtual clustering. Most virtual cluster HA options are the same as normal HA options. However, virtual clusters include VDOM partitioning options. Other differences between configuration options for regular HA and for virtual clustering HA are described below and in the FortiGate HA Overview and the FortiGate HA Guide.

152

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

HA

Figure 85: FortiGate-5001SX HA virtual cluster configuration

Mode

Select an HA mode for the cluster or return the FortiGate units in the cluster to standalone mode. When configuring a cluster, you must set all members of the HA cluster to the same HA mode. You can select Standalone (to disable HA), Active-Passive, or Active-Active. If virtual domains are enabled you can select Active-Passive or Standalone. Optionally set the device priority of the cluster unit. Each cluster unit can have a different device priority. During HA negotiation, the unit with the highest device priority usually becomes the primary unit. In a virtual cluster configuration, each cluster unit can have two device priorities, one for each virtual cluster. During HA negotiation, the unit with the highest device priority in a virtual cluster becomes the primary unit for that virtual cluster. Changes to the device priority are not synchronized. You can accept the default device priority when first configuring a cluster. When the cluster is operating you can change the device priority for different cluster units as required.

Device Priority

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

153

HA

System Config

Group Name

Enter a name to identify the cluster. The maximum group name length is 7 characters. The group name must be the same for all cluster units before the cluster units can form a cluster. After a cluster is operating, you can change the group name. The group name change is synchronized to all cluster units. The default group name is FGT-HA. You can accept the default group name when first configuring a cluster. When the cluster is operating you can change the group name, if required. Two clusters on the same network cannot have the same group name. Enter a password to identify the cluster. The maximum password length is 15 characters. The password must be the same for all cluster units before the cluster units can form a cluster. The default is no password. You can accept the default password when first configuring a cluster. When the cluster is operating, you can add a password, if required. Two clusters on the same network must have different passwords.

Password

Enable Session Select to enable session pickup so that if the primary unit fails, all sessions are picked up by the cluster unit that becomes the new primary pickup unit. Session pickup is disabled by default. You can accept the default setting for session pickup and then chose to enable session pickup after the cluster is operating. Port Monitor Select to enable or disable monitoring FortiGate interfaces to verify that the monitored interfaces are functioning properly and connected to their networks. If a monitored interface fails or is disconnected from its network, the interface leaves the cluster and a link failover occurs. The link failover causes the cluster to reroute the traffic being processed by that interface to the same interface of another cluster unit that still has a connection to the network. This other cluster unit becomes the new primary unit. Port monitoring (also called interface monitoring) is disabled by default. Leave port monitoring disabled until the cluster is operating and then only enable port monitoring for connected interfaces. You can monitor up to 16 interfaces. This limit only applies to FortiGate units with more than 16 physical interfaces. Select to enable or disable HA heartbeat communication for each interface in the cluster and set the heartbeat interface priority. The heartbeat interface with the highest priority processes all heartbeat traffic. If two or more heartbeat interfaces have the same priority, the heartbeat interface that is highest in the interface list processes all heartbeat traffic. The default heartbeat interface configuration is different for each FortiGate unit. This default configuration usually sets the priority of two heartbeat interfaces to 50. You can accept the default heartbeat interface configuration if one or both of the default heartbeat interfaces are connected. The heartbeat interface priority range is 0 to 512. The default priority when you select a new heartbeat interface is 0. You must select at least one heartbeat interface. If heartbeat communication is interrupted, the cluster stops processing traffic. For more information about configuring heartbeat interfaces, see the FortiGate HA Guide. You can select up to 8 heartbeat interfaces. This limit only applies to FortiGate units with more than 8 physical interfaces. If you are configuring virtual clustering, you can set the virtual domains to be in virtual cluster 1 and the virtual domains to be in virtual cluster 2. The root virtual domain must always be in virtual cluster 1. For more information about configuring VDOM partitioning, see the FortiGate HA Guide.

Heartbeat Interface

VDOM partitioning

154

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

HA

Cluster members list

You can display the cluster members list to view the status of an operating cluster and the status of the FortiGate units in the cluster. The cluster members list shows the FortiGate units in the cluster and for each FortiGate unit shows interface connections, the cluster unit host name, and the device priority of the cluster unit. From the cluster members list you can disconnect a unit from the cluster, edit the HA configuration of primary unit, change the device priority and host name of subordinate units, and download a debug log for any cluster unit. You can also view HA statistics for the cluster. To display the cluster members list, log into an operating cluster and go to System > Config > HA.
Figure 86: Example FortiGate-5001SX cluster members list Download Debug Log Edit Disconnect from Cluster

Up and Down Arrows

If virtual domains are enabled, you can display the cluster members list to view the status of the operating virtual clusters. The virtual cluster members list shows the status of both virtual clusters including the virtual domains added to each virtual cluster. To display the virtual cluster members list for an operating cluster log in as the global admin administrator and go to System > Config > HA.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

155

HA

System Config

Figure 87: Example FortiGate-5001SX virtual cluster members list Download Debug Log Edit Disconnect from Cluster

Up and Down Arrows

View HA Statistics

Displays the serial number, status, and monitor information for each cluster unit. See Viewing HA statistics on page 157.

Up and down arrows Changes the order of cluster members in the list. The operation of the cluster or of the units in the cluster are not affected. All that changes is the order of the units on the cluster members list. Cluster member Illustrations of the front panels of the cluster units. If the network jack for an interface is shaded green, the interface is connected. Pause the mouse pointer over each illustration to view the cluster unit host name, serial number, how long the unit has been operating (up time), and the interfaces that are configured for port monitoring. The host name of the FortiGate unit. The default host name of the FortiGate unit is the FortiGate unit serial number. To change the primary unit host name, go to System > Status and select Change beside the current host name. Role To change a subordinate unit host name, from the cluster members list select the edit icon for a subordinate unit.

Hostname

The status or role of the cluster unit in the cluster. Role is MASTER for the primary (or master) unit Role is SLAVE for all subordinate (or backup) cluster units The device priority of the cluster unit. Each cluster unit can have a different device priority. During HA negotiation, the unit with the highest device priority becomes the primary unit. The device priority range is 0 to 255. Select to disconnect a selected cluster unit from the cluster. See Disconnecting a cluster unit from a cluster on page 159.

Priority

Disconnect from cluster

156

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

HA

Edit

Select to change a cluster unit HA configuration. For a primary unit, select Edit to change the cluster HA configuration (including the device priority) of the primary unit. For a primary unit in a virtual cluster, select Edit to change the virtual cluster HA configuration; including the virtual cluster 1 and virtual cluster 2 device priority of this cluster unit. For a subordinate unit, select Edit to change the subordinate unit host name and device priority. See Changing subordinate unit host name and device priority on page 158. For a subordinate unit in a virtual cluster, select Edit to change the subordinate unit host name and the device priority of the subordinate unit for the selected virtual cluster. See Changing subordinate unit host name and device priority on page 158.

Download debug log Select to download an encrypted debug log to a file. You can send this debug log file to Fortinet Technical Support (http://support.fortinet.com) to help diagnose problems with the cluster or with individual cluster units.

Viewing HA statistics
From the cluster members list, you can select View HA statistics to display the serial number, status, and monitor information for each cluster unit. To view HA statistics, go to System > Config > HA and select View HA Statistics.
Figure 88: Example HA statistics (active-passive cluster)

Refresh every

Select to control how often the web-based manager updates the HA statistics display.

Back to HA monitor Select to close the HA statistics list and return to the cluster members list. Unit Status The host name and serial number of the cluster unit. Indicates the status of each cluster unit. A green check mark indicates that the cluster unit is operating normally. A red X indicates that the cluster unit cannot communicate with the primary unit. The time in days, hours, minutes, and seconds since the cluster unit was last started. Displays system status information for each cluster unit.

Up Time Monitor

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

157

HA

System Config

CPU Usage

The current CPU status of each cluster unit. The web-based manager displays CPU usage for core processes only. CPU usage for management processes (for example, for HTTPS connections to the web-based manager) is excluded. The current memory status of each cluster unit. The web-based manager displays memory usage for core processes only. Memory usage for management processes (for example, for HTTPS connections to the web-based manager) is excluded. The number of communications sessions being processed by the cluster unit. The number of packets that have been processed by the cluster unit since it last started up. The number of viruses detected by the cluster unit.

Memory Usage

Active Sessions Total Packets Virus Detected

Network Utilization The total network bandwidth being used by all of the cluster unit interfaces. Total Bytes The number of bytes that have been processed by the cluster unit since it last started up.

Intrusion Detected The number of intrusions or attacks detected by Intrusion Protection running on the cluster unit.

Changing subordinate unit host name and device priority

To change the host name and device priority of a subordinate unit in an operating cluster, go to System > Config > HA to display the cluster members list. Select Edit for any slave (subordinate) unit in the cluster members list. To change the host name and device priority of a subordinate unit in an operating cluster with virtual domains enabled, log in as the global admin administrator and go to System > Config > HA to display the cluster members list. Select Edit for any slave (subordinate) unit in the cluster members list. You can change the host name (Peer) and device priority (Priority) of this subordinate unit. These changes only affect the configuration of the subordinate unit.
Figure 89: Changing the subordinate unit host name and device priority

Peer Priority

View and optionally change the subordinate unit host name. View and optionally change the subordinate unit device priority. The device priority is not synchronized among cluster members. In a functioning cluster you can change device priority to change the priority of any unit in the cluster. The next time the cluster negotiates, the cluster unit with the highest device priority becomes the primary unit. The device priority range is 0 to 255. The default device priority is 128.

158

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

SNMP

Disconnecting a cluster unit from a cluster

You can disconnect a cluster unit if you need to use the disconnected FortiGate unit for another purpose, such as to act as a standalone firewall. You can go to System > Config > HA and select a Disconnect from cluster icon to disconnect a cluster unit from a functioning cluster without disrupting the operation of the cluster.
Figure 90: Disconnect a cluster member

Serial Number Interface

Displays the serial number of the cluster unit to be disconnected from the cluster. Select the interface that you want to configure. You also specify the IP address and netmask for this interface. When the FortiGate unit is disconnected, all management access options are enabled for this interface. Specify an IP address and netmask for the interface. You can use this IP address to connect to this interface to configure the disconnected FortiGate unit.

IP/Netmask

SNMP
Simple Network Management Protocol (SNMP) allows you to monitor hardware on your network. You can configure the hardware, or FortiGate SNMP agent, to report system information and send traps (alarms or event messages) to SNMP managers. An SNMP manager is a computer running an application that can read the incoming traps from the agent and track the information. Using an SNMP manager, you can access SNMP traps and data from any FortiGate interface or VLAN subinterface configured for SNMP management access.
Note: Part of configuring an SNMP manager is to list it as a host in a community on the FortiGate unit it will be monitoring. Otherwise the SNMP monitor will not receive any traps from that FortiGate unit, or be able to query it.

The FortiGate SNMP implementation is read-only. SNMP v1 and v2c compliant SNMP managers have read-only access to FortiGate system information and can receive FortiGate traps. To monitor FortiGate system information and receive FortiGate traps you must compile Fortinet proprietary MIBs as well as Fortinetsupported standard MIBs into your SNMP manager. RFC support includes support for most of RFC 2665 (Ethernet-like MIB) and most of RFC 1213 (MIB II) (for more information, see Fortinet MIBs on page 163.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

159

SNMP

System Config

Configuring SNMP
Go to System > Config > SNMP v1/v2c to configure the SNMP agent.
Figure 91: Configuring SNMP

SNMP Agent Description Location Contact Apply Create New Communities Name Queries Traps Enable Delete icon Edit/View icon

Enable the FortiGate SNMP agent. Enter descriptive information about the FortiGate unit. The description can be up to 35 characters long. Enter the physical location of the FortiGate unit. The system location description can be up to 35 characters long. Enter the contact information for the person responsible for this FortiGate unit. The contact information can be up to 35 characters. Save changes made to the description, location, and contact information. Select Create New to add a new SNMP community. See Configuring an SNMP community on page 160. The list of SNMP communities added to the FortiGate configuration. You can add up to 3 communities. The name of the SNMP community. The status of SNMP queries for each SNMP community. The query status can be enabled or disabled. The status of SNMP traps for each SNMP community. The trap status can be enabled or disabled. Select Enable to activate an SNMP community. Select Delete to remove an SNMP community. Select to view or modify an SNMP community.

Configuring an SNMP community

An SNMP community is a grouping of equipment for network administration purposes. Add SNMP communities to your FortiGate unit so that SNMP managers can connect to view system information and receive SNMP traps. You can add up to three SNMP communities. Each community can have a different configuration for SNMP queries and traps. Each community can be configured to monitor the FortiGate unit for a different set of events. You can also add the IP addresses of up to 8 SNMP managers to each community.
Note: When the FortiGate unit is in virtual domain mode, SNMP traps can only be sent on interfaces in the management virtual domain. Traps cannot be sent over other interfaces.

160

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

SNMP

Figure 92: SNMP community options (part 1)

Figure 93: SNMP community options (part 2)

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

161

SNMP

System Config

Community Name Hosts IP Address

Enter a name to identify the SNMP community. Enter the IP address and Identify the SNMP managers that can use the settings in this SNMP community to monitor the FortiGate unit. The IP address of an SNMP manager than can use the settings in this SNMP community to monitor the FortiGate unit. You can also set the IP address to 0.0.0.0 to so that any SNMP manager can use this SNMP community. Optionally select the name of the interface that this SNMP manager uses to connect to the FortiGate unit. You only have to select the interface if the SNMP manager is not on the same subnet as the FortiGate unit. This can occur if the SNMP manager is on the Internet or behind a router. In virtual domain mode, the interface must belong to the management VDOM to be able to pass SNMP traps. Select a Delete icon to remove an SNMP manager. Add a blank line to the Hosts list. You can add up to 8 SNMP managers to a single community. Enter the Port number (161 by default) that the SNMP managers in this community use for SNMP v1 and SNMP v2c queries to receive configuration information from the FortiGate unit. Select the Enable check box to activate queries for each SNMP version. Enter the Local and Remote port numbers (port 162 for each by default) that the FortiGate unit uses to send SNMP v1 and SNMP v2c traps to the SNMP managers in this community. Select the Enable check box to activate traps for each SNMP version. Enable each SNMP event for which the FortiGate unit should send traps to the SNMP managers in this community. Temperature too high and Voltage out of range event traps are available only on FortiGate 5001 units.

Interface

Delete Add Queries

Traps

SNMP Event

To configure SNMP access (NAT/Route mode) Before a remote SNMP manager can connect to the FortiGate agent, you must configure one or more FortiGate interfaces to accept SNMP connections. 1 2 3 4 Go to System > Network > Interface. Choose an interface that an SNMP manager connects to and select Edit. In Administrative Access, select SNMP. Select OK. To configure SNMP access (Transparent mode) 1 2 3 Go to System > Config > Operation Mode. Enter the IP address that you want to use for management access and the netmask in the Management IP/Netmask field. Select Apply.

162

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

SNMP

Fortinet MIBs
The FortiGate SNMP agent supports Fortinet proprietary MIBs as well as standard RFC 1213 and RFC 2665 MIBs. RFC support includes support for the parts of RFC 2665 (Ethernet-like MIB) and the parts of RFC 1213 (MIB II) that apply to FortiGate unit configuration. The FortiGate MIB is listed in Table 8 along with the two RFC MIBs. You can obtain these MIB files from Fortinet technical support. To be able to communicate with the SNMP agent, you must compile all of these MIBs into your SNMP manager. Your SNMP manager may already include standard and private MIBs in a compiled database that is ready to use. You must add the Fortinet proprietary MIB to this database. If the standard MIBs used by the Fortinet SNMP agent are already compiled into your SNMP manager you do not have to compile them again.
Table 8: Fortinet MIBs MIB file name or RFC fortinet.3.00.mib Description The proprietary Fortinet MIB includes detailed FortiGate system configuration information and trap information. Your SNMP manager requires this information to monitor FortiGate configuration settings and receive traps from the FortiGate SNMP agent. See FortiGate traps on page 163 and Fortinet MIB fields on page 166. The FortiGate SNMP agent supports MIB II groups with the following exceptions. No support for the EGP group from MIB II (RFC 1213, section 3.11 and 6.10). Protocol statistics returned for MIB II groups (IP/ICMP/TCP/UDP/etc.) do not accurately capture all FortiGate traffic activity. More accurate information can be obtained from the information reported by the Fortinet MIB.

RFC-1213 (MIB II)

RFC-2665 (Ethernetlike MIB)

The FortiGate SNMP agent supports Ethernet-like MIB information with the following exception. No support for the dot3Tests and dot3Errors groups.

FortiGate traps
The FortiGate agent can send traps to SNMP managers that you have added to SNMP communities. To receive traps, you must load and compile the Fortinet 3.0 MIB into the SNMP manager. FortiManager related traps are only sent if a FortiManager unit is configured to manage this FortiGate unit. All traps sent include the trap message as well as the FortiGate unit serial number and hostname.
Table 9: Generic FortiGate traps Trap message ColdStart WarmStart LinkUp LinkDown FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313 Description Standard traps as described in RFC 1215.

163

SNMP

System Config

Table 10: FortiGate system traps Trap message CPU usage high (fnTrapCpuHigh) Memory low (fnTrapMemLow) Interface IP change (fnTrapIpChange) Description CPU usage exceeds 80%. This threshold can be set in the CLI using config system global. Memory usage exceeds 90%. This threshold can be set in the CLI using config system global. Change of IP address on a FortiGate interface. The trap message includes the name of the interface, the new IP address and the serial number of the FortiGate unit. You can use this trap to track interface IP address changes for interfaces with dynamic IP addresses set using DHCP or PPPoE. Hardware sensor detects high temperature. This is available only for FortiGate 5001 units. Hardware sensor detects abnormal power levels. This is available only for FortiGate 5001 units. Trap being sent by FortiBridge when detecting a FortiGate failure.

Temperature too high (fnTrapTempHigh) Voltage out of range (fnTrapVoltageOutOfRa nge) (fnTrapBridge)

Table 11: FortiGate VPN traps Trap message VPN tunnel is up (fnTrapVpnTunUp) VPN tunnel down (fnTrapVpnTunDown) (fnVpnTrapLocalGateway) Description An IPSec VPN tunnel started. An IPSec VPN tunnel shuts down. Local gateway address of VPN tunnel.

(fnVpnTrapRemoteGateway) Remote gateway address of VPN tunnel.

Table 12: FortiGate IDS / IPS traps Trap message IDS Port Scan (fnTrapIdsPortScan) IDS Syn Flood (fnTrapIdsSynFlood) IPS Anomaly (fnTrapIpsAnomaly) IPS Signature (fnTrapIpsSignature) IPS Package Update (fnTrapIpsPkgUpdate) (fnIpsTrapSigId) (fnIpsTrapSrcIp) (fnIpsTrapSigMsg) Description Port scan attack is detected. This is not used in FortiOS MR3.0. Syn flood attack is detected. This is not used in FortiOS MR3.0. IPS anomaly detected. IPS signature detected. The IPS signature database has been updated. ID of IPS signature identified in trap IP Address of the IPS signature trigger Message associated with IPS event

164

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

SNMP

Table 13: FortiGate antivirus traps Trap message Virus detected (fnTrapAvVirus) Description The FortiGate unit detects a virus and removes the infected file from an HTTP or FTP download or from an email message.

Oversize file/email detected The FortiGate unit antivirus scanner detects an oversized file. (fnTrapAvOversize) Filename block detected (fnTrapAvPattern) The FortiGate unit antivirus scanner blocks a file matching a pattern.

Fragmented email detected The FortiGate unit antivirus scanner detects a fragmented file or attachment. (fnTrapAvFragmented) (fnTrapAvEnterConserve) (fnTrapAvBypass) (fnTrapAvOversizePass) (fnTrapAvOversizeBlock) (fnAvTrapVirName) AV engine enters conservation mode due to reduced memory conditions. AV scanning has been bypassed due to conservation mode. An oversized file has been detected, but has been passed due to configuration. An oversized file has been detected and has been blocked. Virus name that triggered the event.

Table 14: FortiGate logging traps Trap message Log full (fnTrapLogFull) Description On a FortiGate unit with a hard drive, hard drive usage exceeds 90%. On a FortiGate unit without a hard drive, log to memory usage exceeds 90%. This threshold can be set in the CLI using config system global.

Table 15: FortiGate HA traps Trap message HA switch (fnTrapHaSwitch) HA Heartbeat Failure (fnTrapHaHBFail) (fnTrapHaMemberDown) (fnTrapHaMemberUp) (fnTrapHaStateChange) (fnHaTrapMemberSerial) Description The primary unit in an HA cluster fails and is replaced with a new primary unit. HA monitored interface fails heartbeat. An HA member becomes unavailable to the cluster. An HA member becomes available to the cluster. An HA member changes state. Serial number of an HA cluster member. Used to identify the origin of a trap when a cluster is configured.

Table 16: FortiBridge traps Trap message FortiBridge detects fail (fnTrapBridge) Description A FortiBridge unit detects a FortiGate unit failure.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

165

SNMP

System Config

Table 17: FortiManager related traps Trap message (fnFMTrapDeployComplete) Description Deployment of a new configuration from a FortiManager unit has been completed. Used for verification by FortiManager. Deployment of a new configuration from a FortiManager unit is pending. Used for verification by FortiManager. Any configuration changes made to FortiGate unit, excluding any changes made by a connected FortiManager unit. No message. Interface changes IP. Only sent to monitoring FortiManager.

(fnFMTrapDeployInProgress)

(fnFMTrapConfChange)

(fnFMTrapIfChange)

Fortinet MIB fields

The Fortinet MIB contains fields reporting current FortiGate unit status information. The tables below list the names of the MIB fields and describe the status information available for each one. You can view more details about the information available from all Fortinet MIB fields by compiling the fortinet.3.00.mib file into your SNMP manager and browsing the Fortinet MIB fields.
Table 18: System MIB fields MIB field fnSysModel fnSysSerial fnSysVersion fnSysVersionAv fnSysVersionNids fnSysHaMode fnSysOpMode fnSysCpuUsage fnSysMemUsage fnSysSesCount fnSysDiskUsage Description FortiGate model number, for example, 400 for the FortiGate-400. FortiGate unit serial number. The firmware version currently running on the FortiGate unit. The antivirus definition version installed on the FortiGate unit. The attack definition version installed on the FortiGate unit. The current High-Availability (HA) mode (standalone, A-A, A-P) The FortiGate unit operation mode (NAT or Transparent). The current CPU usage (%). The current memory utilization (%). The current IP session count. The current hard disk usage (MB)

fnSysDiskCapacity The hard disk capacity (MB) fnSysMemCapacity The physical memory installed (KB).

166

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

SNMP

Table 19: HA MIB fields MIB field fnHaGroupId fnHaPriority fnHaOverride fnHaAutoSync Description HA cluster group ID. HA clustering priority (default - 127). Status of a master override flag. Status of an automatic configuration synchronization.

fnHaGroupName HA cluster group name. fnHaTrapMember Serial number of an HA cluster member. Serial fnHaSchedule fnHaStatsTable Load balancing schedule for A-A mode. Statistics for the individual FortiGate unit in the HA cluster. fnHaStatsIndex fnHaStatsSerial fnHaStatsCpuUsage fnHaStatsMemUsage fnHaStatsNetUsage fnHaStatsSesCount fnHaStatsPktCount fnHaStatsByteCount fnHaStatsIdsCount fnHaStatsAvCount fnHaStatsHostname The index number of the unit in the cluster. The FortiGate unit serial number. The current FortiGate unit CPU usage (%). The current unit memory usage (%). The current unit network utilization (Kbps). The number of active sessions. The number of packets processed. The number of bytes processed by the FortiGate unit The number of attacks that the IPS detected in the last 20 hours. The number of viruses that the antivirus system detected in the last 20 hours. Hostname of HA Cluster's unit.

Table 20: Administrator accounts MIB field fnAdminNumber fnAdminTable Description The number of administrators on the FortiGate unit. Table of administrators. fnAdminIndex fnAdminName fnAdminAddr fnAdminMask Administrator account index number. The user name of the administrator account. An address of a trusted host or subnet from which this administrator account can be used. A mask of a subnet where fnAdminAddr can be used.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

167

SNMP

System Config

Table 21: Local users MIB field fnUserNumber fnUserTable Description The number of local user accounts on the FortiGate unit. Table of local users. fnUserIndex fnUserName fnUserAuth Local user account index number. The user name of the local user account. The authentication type for the local user: local - a password stored on the FortiGate unit radius-single - a password stored on a RADIUS server radius-multiple - any user who can authenticate on the RADIUS server can log on ldap - a password stored on an LDAP server Whether the local user is enabled or disabled.

fnUserState

Table 22: Options MIB field fnOptIdleTimeout fnOptAuthTimeout fnOptLanguage fnOptLcdProtection Description The idle period in minutes after which the administrator must reauthenticate. The idle period in minutes after which a user must re-authenticate with the firewall. The web-based manager language. Whether an LCD PIN has been set.

Table 23: Logging MIB field fnLogOption Description Logging preferences.

Table 24: Custom messages MIB field Description

fnMesgNumber The number of custom messages on the FortiGate unit.

168

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

SNMP

Table 25: Hardware sensor MIB field fnHwSensorTable Description A list of local and proxied (Radius server) user accounts. fnHwSensorEnt Hardware Sensor user account number. Index fnHwSensorEnt A name of user account. Name fnHwSensorEnt Authentication type of the account. Value Types can be one of: local radiusSingle radiusMultiple ldap fnHwSensorEnt Status of the user account. AlarmStatus

fnHwSensorCount The number of user accounts in fnHwSensorTable.

Table 26: Virtual domains MIB field fnVdNumber fnVdMaxVdoms fnVdEnabled fnVdTable Description The number of virtual domains on the FortiGate unit. The maximum number of virtual domains allowed on the FortiGate unit. Whether virtual domains are enabled on this FortiGate unit. Table of virtual domains. fnVdIndex fnVdName fnVdSesCount fnVdOpMode Internal virtual domain index number on the FortiGate unit. The name of the virtual domain. Number of session in this virtual domain. Operation mode of this virtual domain - either NAT or Transparent.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

169

SNMP

System Config

Table 27: Active IP sessions MIB field fnIpSessIndex fnIpSessProto fnIpSessFromPort fnIpSessToPort fnIpSessToAddr fnIpSessExp fnIpSessVdom Description The index number of the active IP session. The IP protocol (TCP, UDP, ICMP, etc.) of the session. The source port of the active IP session. The destination IP address of the active IP session. The destination port of the active IP session. The expiry time or time-to-live in seconds for the session. The virtual domain this session is in. fnIpSessStatsVdom Index that identifies the virtual domain. Index fnIpSessNumber Total sessions on this virtual domain.

fnIpSessFromAddr The source IP address of the active IP session.

fnIpSessStatsTable IP Session statistics table for virtual domains.

Table 28: Firewall policy statistics MIB field Description

fnFwPolicyStats Firewall policy statistics table. Table fnFwPolicyStats Index that identifies the virtual domain. VdomIndex fnFwPolicyID Firewall policy ID. Only enabled policies are available for querying.

fnFwPolicyPktC Packet counter per policy. ount fnFwPolicyByte Count Byte counter per policy.

Table 29: Dialup VPNs MIB field fnVpnDialupIndex fnVpnDialupGateway fnVpnDialupLifetime fnVpnDialupTimeout fnVpnDialupSrcBegin fnVpnDialupSrcEnd fnVpnDialupDstAddr fnVpnDialupVdom Description The index of the dialup VPN peer. The remote gateway IP address. VPN tunnel lifetime in seconds. Time remaining until the next key exchange (seconds). Remote subnet address. Remote subnet mask. Local subnet address. Virtual domain this tunnel belongs to.

170

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

SNMP

Table 30: VPN Tunnels MIB field fnVpnTunEntIndex fnVpnTunEntPhase1Name fnVpnTunEntPhase2Name fnVpnTunEntRemGwyIp fnVpnTunEntRemGwyPort fnVpnTunEntLocGwyIp fnVpnTunEntLocGwyPort fnVpnTunEntSelectorSrcBeginIp fnVpnTunEntSelectorSrcEndIp fnVpnTunEntSelectorSrcPort fnVpnTunEntSelectorDstBeginIp fnVpnTunEntSelectorDstEndIp fnVpnTunEntSelectorDstPort fnVpnTunEntSelectorProto fnVpnTunEntLifeSecs fnVpnTunEntLifeBytes fnVpnTunEntTimeout fnVpnTunEntInOctets fnVpnTunEntOutOctets fnVpnTunEntStatus fnVpnTunEntVdom Description The unique index of the VPN tunnel. The descriptive name of the Phase1 configuration. The descriptive name of the Phase2 configuration. The IP of the remote gateway. The port of the remote gateway. The IP of the local gateway. The port of the local gateway. Beginning of the address range of a source selector. Ending of the address range of a source selector. Source selector port Beginning of the address range of a destination selector Ending of the address range of a destination selector. Destination selector port. Protocol number for the selector. Lifetime of the tunnel in seconds. Lifetime of the tunnel in bytes. Timeout of the tunnel in seconds. Number of bytes received on the tunnel. Number of bytes sent out on the tunnel. Current status of the tunnel - either up or down. Virtual domain the tunnel belongs to.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

171

Replacement messages

System Config

Replacement messages
Go to System > Config > Replacement Messages to change replacement messages and customize alert email and information that the FortiGate unit adds to content streams such as email messages, web pages, and FTP sessions. The FortiGate unit adds replacement messages to a variety of content streams. For example, if a virus is found in an email message, the file is removed from the email and replaced with a replacement message. The same applies to pages blocked by web filtering and email blocked by spam filtering.
Note: Disclaimer replacement messages provided by Fortinet are examples only.

Replacement messages list

Figure 94: Replacement messages list

172

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

Replacement messages

Name

The type of replacement message. Select the blue triangle to expand or collapse the category. You can change messages added to email with virus-infected attachments web pages (http) ftp sessions alert mail messages smtp email blocked as spam web pages blocked by web filter category blocking

instant messaging and peer-to-peer sessions Also, you can modify the login page and rejected login page for user authentication Description Edit or view icon disclaimer messages for user and administrator authentication (some models) keep alive page for authentication the FortiGuard web filtering block override page the login page for the SSL-VPN host check related pages (FortiGate-224B unit only)

Description of the replacement message type. The web-based manager describes where each replacement message is used by the FortiGate unit. Select to edit or view a replacement message.

Note: FortiOS uses HTTP to send the Authentication Disclaimer page for the user to accept before the firewall policy is in effect. Therefore, the user must initiate an HTTP traffic first in order to trigger the Authentication Disclaimer page. Once the Disclaimer is accepted, the user can send whatever traffic is allowed by the firewall policy.

Changing replacement messages

Figure 95: Sample HTTP virus replacement message

Replacement messages can be text or HTML messages. You can add HTML code to HTML messages. Allowed Formats shows you which format to use in the replacement message. There is a limitation of 8192 characters for each replacement message.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

173

Replacement messages

System Config

In addition, replacement messages can include replacement message tags. When users receive the replacement message, the replacement message tag is replaced with content relevant to the message. Table 31 lists the replacement message tags that you can add.
Table 31: Replacement message tags Tag %%AUTH_LOGOUT%% Description The URL that will immediately delete the current policy and close the session. Used on the auth-keepalive page.

%%AUTH_REDIR_URL%% The auth-keepalive page can prompt the user to open a new window which links to this tag. %%CATEGORY%% %%DEST_IP%% The name of the content category of the web site. The IP address of the request destination from which a virus was received. For email this is the IP address of the email server that sent the email containing the virus. For HTTP this is the IP address of web page that sent the virus. The email address of the sender of the message from which the file was removed. The email address of the intended receiver of the message from which the file was removed.

%%EMAIL_FROM%% %%EMAIL_TO%%

%%FAILED_MESSAGE%% The failed to login message displayed on the auth-login-failed page. %%FILE%% The name of a file that has been removed from a content stream. This could be a file that contained a virus or was blocked by antivirus file blocking. %%FILE%% can be used in virus and file block messages. The FortiGuard - Web Filtering logo. The Fortinet logo. This ActiveX control is for the FortiGate-224B Host Check feature. The link to the downloadable FortiClient Host Security image on a FortiGate-224B unit. Link(s) for third-party security software on a FortiGate-224B unit. These links are defined in Switch > Port Quarantine > Dynamic Policy. The HTTP error code. 404 for example. The HTTP error description. auth-keepalive-page automatically connects to this URL every %%TIMEOUT%% seconds to renew the connection policy. The IPS attack message. %%NIDSEVENT%% is added to alert email intrusion messages. The link to the FortiGuard Web Filtering override form. This is visible only if the user belongs to a group that is permitted to create FortiGuard web filtering overrides. The FortiGuard web filter block override form. This tag must be present in the FortiGuard Web Filtering override form and should not be used in other replacement messages. The protocol (http, ftp, pop3, imap, or smtp) in which a virus was detected. %%PROTOCOL%% is added to alert email virus messages.

%%FORTIGUARD_WF%% %%FORTINET%% %%HC_ACTIVEX%% %%HC_FC_LINK%%

%%HC_REMEDY_LINK%% Link to rerun Host Check on a FortiGate-224B unit. %%HC_URL_LINK%%

%%HTTP_ERR_CODE%% %%HTTP_ERR_DESC%% %%KEEPALIVEURL%% %%NIDSEVENT%% %%OVERRIDE%%

%%OVRD_FORM%%

%%PROTOCOL%%

174

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

Replacement messages

Table 31: Replacement message tags (Continued) Tag %%QUARFILENAME%% Description The name of a file that has been removed from a content stream and added to the quarantine. This could be a file that contained a virus or was blocked by antivirus file blocking. %%QUARFILENAME%% can be used in virus and file block messages. Quarantining is only available on FortiGate units with a local disk. Authentication challenge question on auth-challenge page. Prompt to enter username and password on auth-login page. The name of the web filtering service. The IP address of the request originator who would have received the blocked file. For email this is the IP address of the users computer that attempted to download the message from which the file was removed. Configured number of seconds between authentication keepalive connections. Used on the auth-keepalive page. The URL of a web page. This can be a web page that is blocked by web filter content or URL blocking. %%URL%% can also be used in http virus and file block messages to be the URL of the web page from which a user attempted to download a file that is blocked. The name of a virus that was found in a file by the antivirus system. %%VIRUS%% can be used in virus messages

%%QUESTION%% %%SERVICE%% %%SOURCE_IP%%

%%TIMEOUT%% %%URL%%

%%VIRUS%%

Changing the authentication login page

Users see the authentication login page when they use a VPN or a firewall policy that requires authentication. You can customize this page in the same way as you modify other replacement messages, but there are some unique requirements: The login page must be an HTML page containing a form with ACTION="/" and METHOD="POST" The form must contain the following hidden controls: <INPUT TYPE="hidden" NAME="%%MAGICID%%" VALUE="%%MAGICVAL%%"> <INPUT TYPE="hidden" NAME="%%STATEID%%" VALUE="%%STATEVAL%%"> <INPUT TYPE="hidden" NAME="%%REDIRID%%" VALUE="%%PROTURI%%"> The form must contain the following visible controls: <INPUT TYPE="text" NAME="%%USERNAMEID%%" size=25> <INPUT TYPE="password" NAME="%%PASSWORDID%%" size=25> Example The following is an example of a simple authentication page that meets the requirements listed above. <HTML><HEAD><TITLE>Firewall Authentication</TITLE></HEAD> <BODY><H4>You must authenticate to use this service.</H4> <FORM ACTION="/" method="post"> <INPUT NAME="%%MAGICID%%" VALUE="%%MAGICVAL%%" TYPE="hidden">

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

175

Replacement messages

System Config

<TABLE ALIGN="center" BGCOLOR="#00cccc" BORDER="0" CELLPADDING="15" CELLSPACING="0" WIDTH="320"><TBODY> <TR><TH>Username:</TH> <TD><INPUT NAME="%%USERNAMEID%%" SIZE="25" TYPE="text"> </TD></TR> <TR><TH>Password:</TH> <TD><INPUT NAME="%%PASSWORDID%%" SIZE="25" TYPE="password"> </TD></TR> <TR><TD COLSPAN="2" ALIGN="center" BGCOLOR="#00cccc"> <INPUT NAME="%%STATEID%%" VALUE="%%STATEVAL%%" TYPE="hidden"> <INPUT NAME="%%REDIRID%%" VALUE="%%PROTURI%%" TYPE="hidden"> <INPUT VALUE="Continue" TYPE="submit"> </TD></TR> </TBODY></TABLE></FORM></BODY></HTML>

Changing the FortiGuard web filtering block override page

The %%OVRD_FORM%% tag provides the form used to initiate an override if FortiGuard - Web Filtering blocks access to a web page. Do not remove this tag from the replacement message.

Changing the SSL-VPN login message

The SSL VPN login message presents a web page through which users log in to the SSL-VPN web portal. The page is linked to FortiGate functionality and you must construct it according to the following guidelines to ensure that it will work. The login page must be an HTML page containing a form with ACTION="%%SSL_ACT%%" and METHOD="%%SSL_METHOD%%" The form must contain the %%SSL_LOGIN%% tag to provide the login form. The form must contain the %%SSL_HIDDEN%% tag.

Changing the authentication disclaimer page

The Authentication Disclaimer page, available on some models, makes a statement about usage policy to which the user must agree before the FortiGate unit permits access. You enable the disclaimer in the firewall policy. See User Authentication Disclaimer in Configuring firewall policies on page 285. You should change only the disclaimer text itself, not the HTML form code.

Changing the Host Check pages (FortiGate-224B unit only)

The Scan Access, Remedy Failed, Quarantined, Allow Access and Deny Access pages are text messages in HTML format. You can modify the messages as needed. There are no special requirements. The Portal page and the Submit Result page contain special elements that you must not remove.

Portal page
The Portal page is displayed to provide FortiClient or third-party antivirus software downloads as a remedy for a failed host check. There are two tags that provide links to downloadable software: the %%HC_FC_LINK%% tag is for FortiClient

176

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

Operation mode and VDOM management access

the %%HC_URL_LINK%% tag is for third-party software

You could omit one of these tags if it is not needed in your network. For example, if you only provide FortiClient software, you could omit the tag for third-party software. The %%HC_REMEDY_LINK%% tag is required so that the user can choose to re-run the host check after installing the antivirus software.

Submit Result page

The Submit Results page runs the host check and provides a button to submit the results to the FortiGate-224B unit. Most elements of this page are compulsory. They are as follows: The Body tag for the page must contain onload="host_checker() so that the host check is performed. The tag %%HC_ACTIVEX%% must appear in the head part of the HTML page to load the required host check ActiveX control. The following form must appear in the body of the HTML page: <form method=post name=recover action="%%HC_PORTAL_PAGE%%"> <input type=hidden name="%%HC_PORT_NAME%%" value="%%HC_FROM_PORT%%"> <input type=hidden name="%%HC_TYPE_NAME%%"> <input type=hidden name="%%HC_RESULT_NAME%%"> <input class=button type=submit name="%%HC_SUBMIT_NAME%%" value="Submit"> </form>

Operation mode and VDOM management access

You can change the operation mode of each VDOM independently of other VDOMs. This allows any combination of NAT/Route and Transparent operating modes on the FortiGate unit VDOMs. Management access to a VDOM can be restricted based on which interfaces and protocols can be used to connect to the FortiGate unit.

Changing operation mode

You can set the operating mode for your VDOM and perform sufficient network configuration to ensure that you can connect to the web-based manager in the new mode. To switch from NAT/Route to Transparent mode 1 Go to System > Config > Operation Mode or select Change beside Operation Mode on the System Status page for the virtual domain.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

177

Operation mode and VDOM management access

System Config

From the Operation Mode list, select Transparent.

Enter the following information and select Apply.

Management IP/Netmask Enter the management IP address and netmask. This

must be a valid IP address for the network from which you want to manage the FortiGate unit.

Default Gateway

Enter the default gateway required to reach other networks from the FortiGate unit.

To switch from Transparent to NAT/Route mode 1 2 Go to System > Config > Operation Mode or select Change beside Operation Mode on the System Status page for the virtual domain. From the Operation Mode list, select NAT.

178

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Config

Operation mode and VDOM management access

Enter the following information and select Apply.

Interface IP/Netmask Device Default Gateway Gateway Device Enter a valid IP address and netmask for the network from which you want to manage the FortiGate unit. Select the interface to which the Interface IP/Netmask settings apply. Enter the default gateway required to reach other networks from the FortiGate unit. Select the interface to which the default gateway is connected.

Management access
You can configure management access on any interface in your VDOM. See You can control administrative access to the interfaces in a VDOM. on page 110. In NAT/Route mode, the interface IP address is used for management access. In Transparent mode, you configure a single management IP address that applies to all interfaces in your VDOM that permit management access. The FortiGate also uses this IP address to connect to the FDN for virus and attack updates (see FortiGuard on page 226). The system administrator (admin) can access all VDOMs, and create regular administrator accounts. A regular administrator account can access only the VDOM to which it belongs. The management computer must connect to an interface in that VDOM. It does not matter to which VDOM the interface belongs. In both cases, the management computer must connect to an interface that permits management access and its IP address must be on the same network. Management access can be via HTTP, HTTPS, telnet, or SSH sessions if those services are enabled on the interface. HTTPS and SSH are preferred as they are more secure. You can allow remote administration of the FortiGate unit. However, allowing remote administration from the Internet could compromise the security of the FortiGate unit. You should avoid this unless it is required for your configuration. To improve the security of a FortiGate unit that allows remote administration from the Internet: Use secure administrative user passwords. Change these passwords regularly. Enable secure administrative access to this interface using only HTTPS or SSH. Use Trusted Hosts to limit where the remote access can originate from. Do not change the system idle timeout from the default value of 5 minutes (see Settings on page 201).

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

179

Operation mode and VDOM management access

System Config

180

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Administrators

System Administrators
This section describes how to configure administrator accounts on your FortiGate unit. Administrators access the FortiGate unit to configure its operation. In its factory default configuration, the unit has one administrator, admin. After connecting to the web-based manager or the CLI, you can configure additional administrators with various levels of access to different parts of the FortiGate unit configuration.
Note: Always end your FortiGate session by logging out, in the CLI or the web-based manager. If you do not, the session remains open.

This section describes: Administrators Access profiles Central Management Settings Monitoring administrators FortiGate IPv6 support

Administrators
There are two levels of administrator accounts: regular administrator - an administrator with any access profile other than super_admin system administrator - includes the factory default system administrator admin, any other administrators assigned to the super_admin profile, and any administrator that is assigned to the super_admin_readonly profile

Regular administrators
A regular administrator account has access to configuration options as determined by its access profile. If virtual domains are enabled, the regular administrator is assigned to one VDOM and cannot access global configuration options or the configuration for any other VDOM. For information about which options are global and which are per-VDOM, see VDOM configuration settings on page 83 and Global configuration settings on page 84.

System administrators
Any administrator assigned to the super_admin access profile, including the default administrator account admin, has full access to the FortiGate unit configuration and general system settings that includes the ability to: enable VDOM configuration create VDOMs

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

181

Administrators

System Administrators

configure VDOMs assign regular administrators to VDOMs configure global options

The super_admin access profile cannot be changed - it does not appear in the list of profiles in System > Admin > Access Profile, but it is one of the selections in the Access Profile drop-down list in System > Admin New/Edit Administrator dialog box.
Figure 96: New Administrator dialog box

Users assigned to the super_admin profile: Cannot delete logged-in users who are also assigned the super_admin profile Can delete other users assigned the super_admin profile and/or change the configured authentication method, password, or access profile, only if the other users are not logged in Can delete the default admin account only if the default admin user is not logged in

By default, admin has no password. The password should be 32 characters or less.

Note: The password of users with the super_admin access profile can be reset in the CLI. If the password of a user who is logged in is changed, they will be logged out and made to re-authenticate with the new password. For a user ITAdmin with the access profile super_admin, to set the password to 123456: config sys admin edit ITAdmin set password 123456 end For a user ITAdmin with the access profile super_admin, to reset the password from 123456 to the default empty: config sys admin edit ITAdmin unset password 123456 end

182

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Administrators

There is also an access profile that allows read-only super admin privileges, super_admin_readonly. The super_admin_readonly profile cannot be deleted or changed, similar to the super_admin profile. This read-only super-admin profile is suitable in a situation where it is necessary for a system administrator to troubleshoot a customer configuration without being able to make changes. Other than being read-only, the super_admin_readonly profile has full access to the FortiGate unit configuration. You can authenticate an administrator using a password stored on the FortiGate unit, a RADIUS, LDAP, or TACACS+ server, or use PKI certificate-based authentication. The RADIUS server authenticates users and authorizes access to internal network resources based on the access profile of the user. To authenticate an administrator with an LDAP or TACACS+ server, you must create the server, include the server in a user group, and associate the administrator with the user group. Users authenticated with the PKI-based certificate are permitted access to internal network resources based on the user group they belong to and the associated access profile.

Configuring regular (password) authentication for administrators

You can use a password stored on the local FortiGate unit to authenticate an administrator. To configure an administrator to authenticate with a password stored on the FortiGate unit 1 2 3 Go to System > Admin. Select Create New. Enter or select the following:
Name Type Password Confirm Password Access Profile A name for the administrator. Regular. Enter a password for the administrator to use to authenticate. Re-enter the password entered in Password. Select the access profile to apply to the administrator.

When you select Type > Regular, you will see Local as the entry in the Type column when you view the list of administrators. For more details, see Viewing the administrators list on page 190. You may also configure additional features. For more information, see Configuring an administrator account on page 191.

Configuring remote authentication for administrators

You can authenticate administrators using RADIUS, LDAP, or TACACS+ servers. In order to do this, you must configure the server, include the server as a user in a user group, and create the administrator account to include in the user group.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

183

Administrators

System Administrators

Configuring RADIUS authentication for administrators

If you want to use a RADIUS server to authenticate administrators in your VDOM, you must configure the authentication before you create the administrator accounts. To do this you need to: configure the FortiGate unit to access the RADIUS server create a user group with the RADIUS server as its only member

Note: Access to the FortiGate is according to the VDOM associated with the administrator account.

The following procedures assume that there is a RADIUS server on your network populated with the names and passwords of your administrators. For information on how to set up a RADIUS server, see the documentation for your RADIUS server.
Figure 97: Example RADIUS server list

Create New Name Delete icon

Add a new RADIUS server. The name that identifies the RADIUS server on the FortiGate unit. Delete a RADIUS server configuration. You cannot delete a RADIUS server that has been added to a user group. Edit a RADIUS server configuration.

Server Name/IP The domain name or IP address of the RADIUS server.

Edit icon

To configure the FortiGate unit to access the RADIUS server 1 2 3 Go to User > Remote > RADIUS. Select Create New. Enter the following information:
Name A name that identifies the RADIUS server. Use this name when you create the user group.

Primary Server The domain name or IP address of the RADIUS server. Name/IP Primary Server The RADIUS server secret. The RADIUS server administrator can provide this information. Secret

Select OK. You may also provide information regarding a secondary RADIUS server, custom authentication scheme, and a NAS IP/Called Station ID. In addition, you can configure the RADIUS server to be included in every user group in the associated VDOM. For more information, see Configuring a RADIUS server on page 398.

184

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Administrators

To create the user group (RADIUS) 1 2 3 4 5 6 Go to User > User Group. Select Create New. In the Group Name field, type a name for the administrator group. In the Available Users list, select the RADIUS server name and move it to the Members list. Select a protection profile. Select OK. To configure an administrator to authenticate with a RADIUS server 7 8 9 Go to System > Admin. Select Create New. Enter or select the following:
Name Type User Group Password Confirm Password Access Profile A name that identifies the administrator. Remote. The user group that includes the RADIUS server as a member. The password the administrator uses to authenticate. The re-entered password that confirms the original entry in Password. The access profile to apply to the administrator.

You may also configure additional features. For more information, see Configuring an administrator account on page 191.

Configuring LDAP authentication for administrators

Lightweight Directory Access Protocol (LDAP) is an Internet protocol used to maintain authentication data that may include departments, people, groups of people, passwords, email addresses, and printers etc. If you have configured LDAP support and an administrator is required to authenticate using an LDAP server, the FortiGate unit contacts the LDAP server for authentication. If the LDAP server cannot authenticate the administrator, the connection is refused by the FortiGate unit. If you want to use an LDAP server to authenticate administrators in your VDOM, you must configure the authentication before you create the administrator accounts. To do this you need to: configure the LDAP server configure the FortiGate unit to access the LDAP server create a user group with the LDAP server as a member

Go to User > Remote > LDAP to configure an LDAP server.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

185

Administrators

System Administrators

Figure 98: Example LDAP server list

Create New Name Port Common Name Identifier Distinguished Name Delete icon Edit icon

Add a new LDAP server. The name that identifies the LDAP server on the FortiGate unit. The TCP port used to communicate with the LDAP server. The common name identifier for the LDAP server. The distinguished name used to look up entries on the LDAP server. Delete the LDAP server configuration. Edit the LDAP server configuration.

Server Name/IP The domain name or IP address of the LDAP server.

To configure the FortiGate unit to access the LDAP server 1 2 3 Go to User > Remote > LDAP. Select Create New. Enter the following information:
Name Server Name/IP Server Port Common Name Identifier The name that identifies the LDAP server on the FortiGate unit. The domain name or IP address of the LDAP server. The TCP port used to communicate with the LDAP server. The common name identifier for the LDAP server.

Distinguished Name The base distinguished name for the server in the correct X.500 or LDAP format. Query icon View the LDAP server Distinguished Name Query tree for the LDAP server that you are configuring so that you can cross-reference to the Distinguished Name. For more information, see Using the Query icon on page 402. The type of binding for LDAP authentication. Filter used for group searching. Distinguished name of user to be authenticated. Password of user to be authenticated. A secure LDAP protocol to use for authentication. A certificate to use for authentication.

Bind Type Filter User DN Password Protocol Certificate

Secure Connection Use a secure LDAP server connection for authentication.

Select OK. For further information about LDAP authentication, see Configuring an LDAP server on page 401.

186

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Administrators

To create the user group (LDAP) 1 2 3 4 5 6 Go to User > User Group. Select Create New. In the Group Name field, type a name for the administrator group. In the Available Users list, select the LDAP server name and move it to the Members list. Select a protection profile. Select OK. To configure an administrator to authenticate with an LDAP server 1 2 3 Go to System > Admin. Select Create New. Enter or select the following:
Name Type User Group Password Confirm Password Access Profile A name that identifies the administrator. Remote. The user group that includes the LDAP server as a member. The password the administrator uses to authenticate. The re-entered password that confirms the original entry in Password. The access profile to apply to the administrator.

You may also configure additional features. For more information, see Configuring an administrator account on page 191.

Configuring TACACS+ authentication for administrators

Terminal Access Controller Access-Control System (TACACS+) is a remote authentication protocol that provides access control for routers, network access servers, and other networked computing devices via one or more centralized servers. If you have configured TACACS+ support and an administrator is required to authenticate using a TACACS+ server, the FortiGate unit contacts the TACACS+ server for authentication. If the TACACS+ server cannot authenticate the administrator, the connection is refused by the FortiGate unit. If you want to use an TACACS+ server to authenticate administrators in your VDOM, you must configure the authentication before you create the administrator accounts. To do this you need to: configure the TACACS+ server configure the FortiGate unit to access the TACACS+ server create a user group with the TACACS+ server as a member

Go to User > Remote > TACACS+ to configure a TACACS+ server.

Figure 99: Example TACACS+ server list

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

187

Administrators

System Administrators

Create New Server Authentication Type Delete icon Edit icon

Add a new TACACS+ server. The server domain name or IP address of the TACACS+ server. The supported authentication method. TACACS+ authentication methods include: Auto, ASCII, PAP, CHAP, and MSCHAP. Delete this TACACS+ server. Edit this TACACS+ server.

To configure the FortiGate unit to access the TACACS+ server 1 2 3 Go to User > Remote > TACACS+. Select Create New. Enter the following information:
Name Server Name/IP Server Key Authentication Type The name that identifies the TACACS+ server. The server domain name or IP address of the TACACS+ server. The key to access the TACACS+ server. The authentication type to use for the TACACS+ server. Selection includes: Auto, ASCII, PAP, CHAP, and MSCHAP. Auto authenticates using PAP, MSCHAP, and CHAP (in that order).

For further information about TACACS+ authentication, see Configuring TACACS+ servers on page 404. To create the user group (TACACS+) 1 2 3 4 5 6 Go to User > User Group. Select Create New. In the Group Name field, type a name for the administrator group. In the Available Users list, select the TACACS+ server name and move it to the Members list. Select a protection profile. Select OK. To configure an administrator to authenticate with a TACACS+ server 1 2 3 Go to System > Admin. Select Create New. Enter or select the following:
Name Type User Group Password Confirm Password Access Profile A name that identifies the administrator. Remote. The user group that includes the TACACS+ server as a member. The password the administrator uses to authenticate. The re-entered password that confirms the original entry in Password. The access profile to apply to the administrator.

You may also configure additional features. For more information, see Configuring an administrator account on page 191.

188

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Administrators

Configuring PKI certificate authentication for administrators

Public Key Infrastructure (PKI) authentication utilizes a certificate authentication library that takes a list of peers, peer groups, and/or user groups and returns authentication successful or denied notifications. Users only need a valid certificate for successful authentication - no username or password are necessary. If you want to use PKI authentication for an administrator, you must configure the authentication before you create the administrator accounts. To do this you need to: configure a PKI administrator to be included in the user group create a user group

Go to User > PKI to configure PKI users.

Figure 100:User > PKI user list

Create New User Name Subject Issuer Delete icon Edit icon

Add a new PKI user. The name of the PKI user. The text string that appears in the subject field of the certificate of the authenticating user. The CA certificate that is used to authenticate this user. Delete this PKI user. Edit this PKI user.

Note: The following fields in the PKI User List correspond to the noted fields in the PKI User dialog: User Name: Name Subject: Subject CA: Issuer (CA certificate)

To create the user group (PKI) 1 2 3 4 5 6 Go to User > User Group. Select Create New. In the Group Name field, type a name for the administrator group. In the Available Users list, select the PKI user name and move it to the Members list. Select a protection profile. Select OK. To configure an administrator to authenticate with a PKI certificate 1 2 Go to System > Admin. Select Create New.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

189

Administrators

System Administrators

Enter or select the following:

Name Type User Group Access Profile A name that identifies the administrator. PKI. The user group that includes the PKI user as a member. The access profile to apply to the administrator.

You may also configure additional features. For more information, see Configuring an administrator account on page 191

Viewing the administrators list

Use the default admin account, an account with the super_admin access profile, or an administrator with Access Control Read Write to add new administrator accounts and control their permission levels. Go to System > Admin > Administrators. If you log in with an administrator account that does not have the super_admin access profile, the Administrators list will show only the administrators for the current virtual domain.
Figure 101:Administrators list

Create New Name Trusted hosts

Add an administrator account. The login name for an administrator account. The IP address and netmask of trusted hosts from which the administrator can log in. For more information, see Using trusted hosts on page 193. The access profile for the administrator. The type of authentication for this administrator, one of: Local - authentication of an account with a local password stored on the FortiGate unit Remote - authentication of a specific account on a RADIUS, LDAP, or TACACS+ server Remote+Wildcard - authentication of any account on a RADIUS, LDAP, or TACACS+ server. PKI - PKI-based certificate authentication of an account. Delete the administrator account. You cannot delete the original admin account until you create another user with the super_admin profile, log out of the admin account, and log in with the alternate user that has the super_admin profile. Edit or view the administrator account.

Profile Type

Delete icon

Edit or View icon

Change Password Change the password for the administrator account. icon

190

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Administrators

To change an administrator password 1 2 3 4 Go to System > Admin > Administrators. Select the Change Password icon next to the administrator account you want to change the password for. Enter and confirm the new password. Select OK.

Configuring an administrator account

Use the default admin account, an account with the super_admin access profile, or an administrator with Access Control Read Write to create a new administrator. Go to System > Admin > Administrators and select Create New.
Figure 102:Administrator account configuration - Regular (local) authentication

Figure 103:Administrator account configuration - Remote authentication

Figure 104:Administrator account configuration - PKI authentication

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

191

Administrators

System Administrators

Administrator

Enter the login name for the administrator account. The name of the administrator should not contain the characters <>()#"'. Using these characters in the administrator account name can result in a cross site scripting (XSS) vulnerability. Select the type of administrator account: Regular: Select to create a Local administrator account. Remote: Select to authenticate the administrator using a RADIUS, LDAP, or TACACS+ server. Server authentication for administrators must be configured first. See Configuring remote authentication for administrators on page 183. PKI: Select to enable certificate-based authentication for the administrator. Only one administrator can be logged in with PKI authentication enabled.

Type

User Group

If you are using Remote or PKI certificate-based authentication, select the administrator user group that includes the Remote server/PKI (peer) users as members of the User Group. The administrator user group cannot be deleted once the group is selected for authentication. Select to allow all accounts on the RADIUS, LDAP, or TACACS+ server to be administrators. This is available only if Remote is selected. Only one wildcard user permitted per VDOM. Enter a password for the administrator account. For improved security, the password should be at least 6 characters long. This is not available if Wildcard is selected. Not available when PKI authentication is selected. Type the password for the administrator account a second time to confirm that you have typed it correctly. This is not available if Wildcard is selected. Not available when PKI authentication is selected.

Wildcard

Password

Confirm Password

Trusted Host #1 Optionally, type the trusted host IP address and netmask that Trusted Host #2 administrator login is restricted to on the FortiGate unit. You can specify Trusted Host #3 up to three trusted hosts. These addresses all default to 0.0.0.0/0. Setting trusted hosts for all of your administrators can enhance the security of your system. For more information, see Using trusted hosts on page 193. Access Profile Select the access profile for the administrator. The pre-configured super_admin profile provides full access to the FortiGate unit. You can also select Create New to create a new access profile. For more information on access profiles, see Configuring an access profile on page 197.

To configure an administrator account 1 2 3 Go to System > Admin > Administrators. Select Create New to add an administrator account. In the Administrator field, type a login name for the administrator account. If you are using RADIUS authentication for this administrator but not using the wildcard option, the administrator name must match an account on the RADIUS server.

192

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Administrators

Select the type of authentication: If you are using local authentication for this administrator: Select Regular. Type and confirm the password for the administrator account.

If you are using remote authentication for this administrator (RADIUS, LDAP, or TACACS+): Select Remote. Select Wildcard if you want all accounts on the RADIUS, LDAP, or TACACS+ server to be administrators of this FortiGate unit. Type and confirm the password for the administrator account. This step does not apply if you are using Remote Wildcard or PKI certificate-based authentication. Select the administrators user group from the User Group list. Select PKI. Select the administrators user group from the User Group list.

5 6 7

If you are using PKI certificate-based authentication for this administrator:

If required, type Trusted Host IP address(es) and netmask(s) from which the administrator can log into the web-based manager. Select the access profile for the administrator. Select OK.

Using trusted hosts

Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative access. In addition to knowing the password, an administrator must connect only through the subnet or subnets you specify. You can even restrict an administrator to a single IP address if you define only one trusted host IP address with a netmask of 255.255.255.255. When you set trusted hosts for all administrators, the FortiGate unit does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access. The trusted hosts you define apply both to the web-based manager and to the CLI when accessed through telnet or SSH. CLI access through the console connector is not affected. The trusted host addresses all default to 0.0.0.0/0. If you set one of the 0.0.0.0/0 addresses to a non-zero address, the other 0.0.0.0/0 will be ignored. The only way to use a wildcard entry is to leave the trusted hosts at 0.0.0.0/0. However, this configuration is less secure.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

193

Access profiles

System Administrators

Access profiles
Each administrator account belongs to an access profile. The access profile separates FortiGate features into access control categories for which you can enable none (deny), read only, or read/write access. The following table lists the web-based manager pages to which each category provides access:
Table 32: Access profile control of access to Web-based manager pages Access control Admin Users Affected web-based manager pages System > Admin System > Admin > FortiManager System > Admin > Settings AntiVirus User Firewall System > Maintenance > FortiGuard Center

Antivirus Configuration Auth Users Firewall Configuration FortiGuard Update

IM, P2P & VoIP Configuration IM, P2P & VoIP > Statistics IM, P2P & VoIP > User > Current Users IM, P2P & VoIP > User > User List IM, P2P & VoIP > User > Config IPS Configuration Log & Report Maintenance Network Configuration Intrusion Protection Log & Report System > Maintenance System > Network > Interface System > Network > Zone System > DHCP Router AntiSpam System > Status, including Session info System > Config System > Hostname System > Network > Options System > Admin > FortiManager System > Admin > Settings System > Status > System Time VPN Web Filter

Router Configuration Spamfilter Configuration System Configuration

VPN Configuration Webfilter Configuration

Read-only access enables the administrator to view the web-based manager page. The administrator needs write access to change the settings on the page. You can now expand the firewall configuration access control to enable more granular control of access to the firewall functionality. You can control administrator access to policy, address, service, schedule, profile, and other (VIP) configurations.

194

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Access profiles

Note: When Virtual Domain Configuration is enabled (see Settings on page 201), only the administrators with the access profile super_admin have access to global settings. When Virtual Domain Configuration is enabled, other administrator accounts are assigned to one VDOM and cannot access global configuration options or the configuration for any other VDOM. For information about which settings are global, see VDOM configuration settings on page 83.

The access profile has a similar effect on administrator access to CLI commands. The following table shows which command types are available in each access control category. You can access get and show commands with read access. Access to config commands requires write access.
Table 33: Access profile control of access to CLI commands Access control Admin Users (admingrp) Antivirus Configuration (avgrp) Auth Users (authgrp) Firewall Configuration (fwgrp) Available CLI commands system admin system accprofile antivirus user firewall Use the set fwgrp custom and config fwgrp-permission commands to set some firewall permissions individually. Selections can be made for policy, address, service, schedule, profile, and other (VIP) configurations. For more information, see FortiOS CLI Reference. system autoupdate execute update-av execute update-ips execute update-now imp2p ips alertemail log system fortianalyzer execute log execute execute execute execute execute formatlogdisk restore backup batch usb-disk

FortiProtect Update (updategrp)

IM, P2P & VoIP Configuration IPS Configuration (ipsgrp) Log & Report (loggrp)

Maintenance (mntgrp)

Network Configuration (netgrp)

system arp-table system dhcp system interface system zone execute dhcp lease-clear execute dhcp lease-list execute clear system arp table execute interface router execute router execute mrouter

Router Configuration (routegrp)

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

195

Access profiles

System Administrators

Table 33: Access profile control of access to CLI commands (Continued) Access control Spamfilter Configuration (spamgrp) System Configuration (sysgrp) Available CLI commands spamfilter system except accprofile, admin, arp-table, autoupdate, fortianalyzer, interface, and zone. execute date execute ha execute ping execute ping-options execute ping6 execute time execute traceroute execute cfg execute factoryreset execute reboot execute shutdown execute deploy execute set-next-reboot execute ssh execute telnet execute disconnect-admin-session execute usb vpn execute vpn webfilter

VPN Configuration (vpngrp) Webfilter Configuration (webgrp)

Go to System > Admin > Access Profile to add access profiles for FortiGate administrators. Each administrator account belongs to an access profile. You can create access profiles that deny access to, allow read-only, or allow both readand write-access to FortiGate features. When an administrator has read-only access to a feature, the administrator can access the web-based manager page for that feature but cannot make changes to the configuration. There are no Create or Apply buttons and lists display only the View ( ) icon instead of icons for Edit, Delete or other modification commands.

Viewing the access profiles list

Use the admin account or an account with Admin Users read and write access to create or edit access profiles. Go to System > Admin > Access Profile.
Figure 105:Access profile list

Create New Profile Name Delete icon Edit icon

Add a new access profile. The name of the access profile. Select to delete the access profile. You cannot delete an access profile that has administrators assigned to it. Select to modify the access profile.

196

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Access profiles

Configuring an access profile

Use the admin account or an account with Admin Users read and write access to edit an access profile. Go to System > Admin > Access Profile and select Create New.
Figure 106:Access profile option

Profile Name Access Control None Read Only Read-Write Access Control categories

Enter the name of the access profile. Access Control lists the items that can customized access control settings configured. Select to deny access to all Access Control categories. Select to enable Read access in all Access Control categories. Select to allow read/write access in all Access Control categories. Make specific control selections as required. For detailed information about the access control categories, see Access profiles on page 194.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

197

Central Management

System Administrators

Central Management
Central Management provides the option of remotely managing your FortiGate unit by either a FortiManager unit or the FortiGuard Analysis and Management Service. From System > Admin > Central Management, you can configure your FortiGate unit to back up or restore configuration settings automatically to the specified central management server. The central management server is the type of service you enabled, either a FortiManager unit or the FortiGuard Analysis and Management Service. If you have a subscription for FortiGuard Analysis and Management Service, you can also remotely upgrade the firmware on the FortiGate unit.
Figure 107:Central Management configurations - FortiManager and FortiGuard Analysis and Management Service

Enable Central Management Type

Enables the Central Management feature on the FortiGate unit. FortiManager: Select to use FortiManager as the central management service for the FortiGate unit. Enter the IP address in the IP field. FortiGuard Management Service: Select to use the FortiGuard Analysis and Management Service as the central management service for the FortiGate unit. Enter the Account ID in the Account ID field. If you do not have an account ID, register for the FortiGuard Analysis and Management Service on the Fortinet support website. Select Change to open the FortiGuard page and change the account ID name.

Allow automatic backup of configuration on logout/timeout

Enable to automatically have the current configuration backed up to the management server, when either the administrator logs out or the admin timeout is reached.

198

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Central Management

Allow configuration updates initiated by the management server Allow firmware upgrades initiated by the management server (FortiGuard Analysis and Management Service only)

Enable to allow the management server to automatically update the configuration. Enable to upgrade the firmware on the FortiGate unit by the management server. This option is available only to the FortiGuard Analysis and Management Service.

Figure 108:Management and Analysis Service Options on the FortiGuard page

The Revision Control tab, which is part of Central Management, displays a list of the backed up configuration files. This tab displays a list only when your FortiGate unit is managed by a central management server. From the Revision Control tab, you can download a backed up configuration file, revert to a selected revision, or compare two revisions.
Figure 109:Configuration back ups on the Revision page
Page Navigation

Diff Revert Download

Page Navigation

Select from the various arrows to go to the next page, previous page, last, or first page. You can also enter a number to view that page of log messages. For example, entering the number 5 displays the fifth page. An incremental number indicating the order the configurations were saved. These may not be consecutive numbers if one or more configurations are deleted. The most recent, which is also the largest number, is first in the list. Displays the date and time when this configuration was saved on the FortiGate unit. Displays the administrator account that was used to back up this revision. Any relevant description or notes that were saved with the revision. This is a good place to include information about why the revision was saved, who saved it, and if there is a date when it can be deleted to free up space.

Revision

Date/Time Administrator Comments

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

199

Central Management

System Administrators

Diff icon

Select the diff icon to compare two revisions. This will display a window that lets you compare the selected revision to one of: the current configuration a selected revision from the displayed list including revision history and templates a specified revision number

Download icon Revert icon

Select the download icon to download this revision to your local PC. Select to go back to the selected revision. You will be prompted to confirm this action.

For further information about system maintenance, FortiGuard, and configuration backup and restore, see Maintenance System Configuration on page 215.
Note: The FortiGuard-FortiManager protocol is a new protocol designed to provide better communication when a FortiGate unit is connected to a FortiManager unit or when a FortiGate unit is connected to the FortiGuard Analysis and Management Service. This new protocol resolves the FortiGate-behind-NAT issue and supports passive mode on the FortiGate Analysis and Management Service. This protocol runs over SSL using IPv4/TCP port 541 and includes the following functions: detects FortiGate unit dead or alive status detects management service dead/alive status notifies the FortiGate units about configuration changes, AV/IPS database update and firewall changes.

200

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

Settings

Settings
Go to System > Admin > Settings to set the following options: Ports for HTTP/HTTPS administrative access and SSL VPN login The idle timeout setting Display settings that include the language of the web-based manager and the number of lines displayed in generated reports PIN protection for LCD and control buttons (LCD-equipped models only) Enable SCP capability for users logged in via SSH Configure Gi Gatekeeper settings for GTP traffic inspection Enable IPv6 support on GUI (default configuration only available in CLI)

Figure 110:Administrators Settings

Web Administration Ports HTTP HTTPS SSLVPN Login Port Enter the TCP port to be used for administrative HTTP access. The default is 80. Enter the TCP port to be used for administrative HTTPS access. The default is 443. Enter a different HTTPS port number for remote client web browsers to connect to the FortiGate unit. The default port number is 10443. Enter the TCP port to be used for administrative telnet access. The default is 23.

Telnet Port

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

201

Monitoring administrators

System Administrators

SSH Port Enable v1 compatibility Timeout Settings Idle Timeout

Enter the TCP port to be used for administrative SSH access. The default is 22. Select to enable compatibility with SSH v1 in addition to v2. (Optional) Enter the number of minutes that an administrative connection can be idle before the administrator must log in again. The maximum is 480 minutes (8 hours). To improve security, keep the idle timeout at the default value of 5 minutes. Select a language for the web-based manager to use. Choose from English, Simplified Chinese, Japanese, Korean, Spanish, Traditional Chinese or French. You should select the language that the management computer operating system uses. Set the number of lines per page to display in table lists. The default is 50. Range is from 20 - 1000.

Display Settings Language

Lines per Page

IPv6 Support on GUI Enable if you want to configure IPv6 options from the GUI (Firewall policy, route, address and address group). Default allows configuration from CLI only. LCD Panel (LCD-equipped models only) PIN Protection Select the PIN Protection check box and type a 6-digit PIN. Administrators must enter the PIN to use the control buttons and LCD. Enable if you want users logged in through the SSH to be able to use the SCP to copy the configuration file.

Enable SCP

Note: If you make a change to the default port number for HTTP, HTTPS, telnet, or SSH, ensure that the port number is unique.

Monitoring administrators
To see the number of logged-in administrators, go to System > Status. Under System Information, you will see Current Administrators. Click on Details to view information about the administrators currently logged in to the FortiGate unit.
Figure 111:System Information > Current Administrators

202

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Administrators

FortiGate IPv6 support

Figure 112:Administrators logged in monitor window

Disconnect Refresh Close check box

Select to disconnect the selected administrators. This is available only if your access profile gives you System Configuration write permission. Select to update the list. Select to close the window. Select and then select Disconnect to log off this administrator. This is available only if your access profile gives you System Configuration write access. You cannot log off the default admin user. The administrator account name. The type of access: http, https, jsconsole, sshv2. If Type is jsconsole, the value in From is N/A. Otherwise, Type contains the administrators IP address. The date and time that the administrator logged on.

User Name Type From Time

FortiGate IPv6 support

IPv6 is version 6 of the Internet Protocol. It can provide billions more unique IP addresses than the previous standard, IPv4. The internet is currently in transition from IPv4 to IPv6 addressing. IPv6 hosts and routers maintain interoperability with the existing IPv4 infrastructure in two ways: implementing dual IP layers to support both IPv6 and IPv4 using IPv6 over IPv4 tunneling to encapsulate IPv6 packets within IPv4 headers to carry them over IPv4 infrastructure.

FortiGate units are dual IP layer IPv6/IPv4 nodes. They support IPv6 overIPv4 tunneling, routing, firewall policies and IPSec VPN. You can assign both an IPv4 and an IPv6 address to any interface on a FortiGate unit - the interface functions as two interfaces, one for IPv4-addressed packets and another for IPv6addressed packets. For more information, see the FortiGate IPv6 Support Technical Note available from the Fortinet Knowledge Center. Before you can work with IPv6 on the web-based manager, you must enable IPv6 support. To enable IPv6 support, go to System > Admin > Settings, then under Display Settings, enable IPv6 Support on GUI. After you enable the web-based manager IPv6 support you can: create IPv6 static routes (see Router Static) monitor IPv6 routes (see Router Monitor) create IPv6 firewall policies (see Firewall Policy) create IPv6 firewall addresses (see Firewall Address) create IPv6 firewall address groups (see Firewall Address) create VPNs that use IPv6 addressing (see VPN IPSEC) Once IPv6 support is enabled, you can configure the IPv6 options using the webbased manager or the CLI. See the FortiOS CLI Reference for information on configuring IPv6 support using the CLI.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

203

FortiGate IPv6 support

System Administrators

204

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Certificates

Local Certificates

System Certificates
This section explains how to manage X.509 security certificates using the FortiGate web-based manager. Certificate authentication allows administrators to generate certificate requests, install signed certificates, import CA root certificates and certificate revocation lists, and back up and restore installed certificates and private keys. Authentication is the process of determining if a remote host can be trusted, which ultimately controls remote access to network resources. To establish its trustworthiness, the remote host must provide an acceptable authentication certificate by obtaining a certificate from a certification authority (CA). The application can accept or reject any certificate. The FortiGate unit can use certificate authentication to allow administrative access via HTTPS, and to authenticate IPSec VPN peers or clients and SSL VPN user groups or clients. For additional background information, see the FortiGate Certificate Management User Guide. This section describes: Local Certificates Remote Certificates CA Certificates CRL

Local Certificates
Certificate requests and installed server certificates are displayed in the Local Certificates list. After you submit the request to a CA, the CA will verify the information and register the contact information on a digital certificate that contains a serial number, an expiration date, and the public key of the CA. The CA will then sign and send the signed certificate to you to install on the FortiGate unit. To view certificate requests and/or import signed server certificates, go to System > Certificates > Local Certificates. To view certificate details, select the View Certificate Detail icon in the row that corresponds to the certificate.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

205

Local Certificates

System Certificates

Figure 113:Local Certificates list Download View Certificate Detail

Delete Generate Import Name Subject Comments Status View Certificate Detail icon Delete icon Generate a local certificate request. See Generating a certificate request on page 207. Import a signed local certificate. See Importing a signed server certificate on page 209. The names of existing local certificates and pending certificate requests. The Distinguished Names (DNs) of local signed certificates. Enter a description of the certificate. The status of the local certificate. PENDING designates a certificate request that needs to be downloaded and signed. Display certificate details such as the certificate name, issuer, subject, and valid certificate dates. See Figure 114. Delete the selected certificate request or installed server certificate from the FortiGate configuration. This is available only if the certificate can be deleted (has PENDING status). Save a copy of the certificate request to a local computer. Send the request to your CA to obtain a signed server certificate for the FortiGate unit.

Download icon

Figure 114:Certificate Detail Information

For detailed information and step-by-step procedures related to obtaining and installing digital certificates, see the FortiGate Certificate Management User Guide.

206

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Certificates

Local Certificates

Generating a certificate request

The FortiGate unit generates a certificate request based on the information you enter to identify the FortiGate unit. Generated requests are displayed in the Local Certificates list with a status of PENDING. After you generate a certificate request, you can download the request to a computer that has management access to the FortiGate unit and then forward the request to a CA. To fill out a certificate request, go to System > Certificates > Local Certificates and select Generate. To download and send the certificate request to a CA, see Downloading and submitting a certificate request on page 208.
Figure 115:Generate Certificate Signing Request

Certification Name

Type a certificate name. Typically, this would be the name of the FortiGate unit. To enable the export of a signed certificate as a PKCS12 file later on if required, do not include spaces in the name. Enter the information needed to identify the FortiGate unit: If the FortiGate unit has a static IP address, select Host IP and enter the public IP address of the FortiGate unit. If the FortiGate unit does not have a public IP address, use an email address (or domain name if available) instead.

Subject Information Host IP

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

207

Local Certificates

System Certificates

Domain Name

If the FortiGate unit has a static IP address and subscribes to a dynamic DNS service, use a domain name if available to identify the FortiGate unit. If you select Domain Name, enter the fully qualified domain name of the FortiGate unit. Do not include the protocol specification (http://) or any port number or path names. If a domain name is not available and the FortiGate unit subscribes to a dynamic DNS service, an unable to verify certificate type message may be displayed in the users browser whenever the public IP address of the FortiGate unit changes. If you select E-mail, enter the email address of the owner of the FortiGate unit. All fields under Optional Information are not required. Type the name of your department (s). You can enter a maximum of 5 Organization Units. To add or remove a unit, use the plus (+) or minus (-) icon. Type the legal name of your company or organization. Type the name of the city or town where the FortiGate unit is installed. Type the name of the state or province where the FortiGate unit is installed. Select the country where the FortiGate unit is installed. Type the contact email address. Only RSA is supported. Select 1024 Bit, 1536 Bit or 2048 Bit. Larger keys are slower to generate but they provide better security. Select File Based to generate the certificate request. Select Online SCEP to obtain a signed SCEP-based certificate automatically over the network. CA Server URL: Enter the URL of the SCEP server from which to retrieve the CA certificate. Challenge Password: Enter the CA server challenge password.

E-Mail Optional Information Organization Unit

Organization Locality (City) State/Province Country e-mail Key Type Key Size Enrollment Method File Based Online SCEP

Downloading and submitting a certificate request

You have to fill out a certificate request and generate the request before you can submit the results to a CA. For more information, see Generating a certificate request on page 207. To download and submit a certificate request 1 2 3 4 Go to System > Certificates > Local Certificates. In the Local Certificates list, select the Download icon in the row that corresponds to the generated certificate request. In the File Download dialog box, select Save to Disk. Name the file and save it to the local file system.

208

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Certificates

Local Certificates

Submit the request to your CA as follows: Using the web browser on the management computer, browse to the CA web site. Follow the CA instructions to place a base-64 encoded PKCS#12 certificate request and upload your certificate request. Follow the CA instructions to download their root certificate and Certificate Revocation List (CRL), and then install the root certificate and CRL on each remote client (refer to the browser documentation).

When you receive the signed certificate from the CA, install the certificate on the FortiGate unit. See Importing a signed server certificate on page 209.

Importing a signed server certificate

Your CA will provide you with a signed server certificate to install on the FortiGate unit. When you receive the signed certificate from the CA, save the certificate on a computer that has management access to the FortiGate unit. To install the signed server certificate, go to System > Certificates > Local Certificates and select Import. Install the signed certificate through the Upload Local Certificate dialog box at the top of the page. The certificate file can be in either PEM or DER format. The other dialog boxes are for importing previously exported certificates and private keys.
Figure 116:Upload Local Certificate

Certificate File Browse

Enter the full path to and file name of the signed server certificate. Alternatively, browse to the location on the management computer where the certificate has been saved, select the certificate, and then select OK.

Importing an exported server certificate and private key

The server certificate and private key to import must have been exported previously as a single PKCS12 file through the execute vpn certificate key export CLI command. The file is associated with a password, which you will need to know in order to import the file. Before you begin, save a copy of the file on a computer that has management access to the FortiGate unit. For more information, see the FortiGate Certificate Management User Guide. To import the PKCS12 file, go to System > Certificates > Local Certificates and select Import.
Figure 117:Upload PKCS12 Certificate

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

209

Remote Certificates

System Certificates

Certificate with key file Browse

Enter the full path to and file name of the previously exported PKCS12 file. Alternatively, browse to the location on the management computer where the PKCS12 file has been saved, select the file, and then select OK. Type the password needed to upload the PKCS12 file.

Password

Importing separate server certificate and private key files

Use the Upload Certificate dialog box to import a server certificate and the associated private key file when the server certificate request and private key were not generated by the FortiGate unit. The two files to import must be available on the management computer.
Figure 118:Upload Certificate

Certificate file Key file Browse Password

Enter the full path to and file name of the previously exported certificate file. Enter the full path to and file name of the previously exported key file. Browse to the location of the previously exported certificate file/key file, select the file, and then select OK. If a password is required to upload and open the files, type the password.

Remote Certificates
Note: The certificate file must not use 40-bit RC2-CBC encryption.

For dynamic certificate revocation, an OCSP (Online Certificate Status Protocol) server is used. Remote certificates are public certificates without a private key. The OCSP is configured in the CLI only. For more information, see the FortiOS CLI Reference.
Note: There is one OCSP per vdom.

210

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Certificates

Remote Certificates

Figure 119:Remote certificate list

Installed Remote (OCSP) certificates are displayed in the Remote Certificates list. To view installed Remote (OCSP) certificates or import a Remote (OCSP) certificate, go to System > Certificates > Remote. To view certificate details, select the View Certificate Detail icon in the row that corresponds to the certificate.
Import Name Import a public OCSP certificate. See Importing CA certificates on page 212. The names of existing Remote (OCSP) certificates. The FortiGate unit assigns unique names (REMOTE_Cert_1, REMOTE_Cert_2, REMOTE_Cert_3, and so on) to the Remote (OCSP) certificates when they are imported. Information about the Remote (OCSP) certificate. Delete a Remote (OCSP) certificate from the FortiGate configuration. Display certificate details. Save a copy of the Remote (OCSP) certificate to a local computer.

Subject Delete icon View Certificate Detail icon Download icon

Importing Remote (OCSP) certificates

To import a Remote (OCSP) certificate, go to System > Certificates > Remote and select Import.
Figure 120:Upload Remote Certificate

Local PC

Use a management PC to upload a public certificate. Enter the location, or select Browse to navigate to the location of the certificate. Browse to the location on the management computer where the certificate has been saved, select the certificate, and then select OK.

Browse

The system assigns a unique name to each Remote (OCSP) certificate. The names are numbered consecutively (REMOTE_Cert_1, REMOTE_Cert_2, REMOTE_Cert_3, and so on).

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

211

CA Certificates

System Certificates

CA Certificates
When you apply for a signed personal or group certificate to install on remote clients, you must obtain the corresponding root certificate and CRL from the issuing CA. When you receive the signed personal or group certificate, install the signed certificate on the remote client(s) according to the browser documentation. Install the corresponding root certificate and CRL from the issuing CA on the FortiGate unit. Installed CA certificates are displayed in the CA Certificates list. You cannot delete the Fortinet_CA certificate. To view installed CA root certificates or import a CA root certificate, go to System > Certificates > CA Certificates. To view root certificate details, select the View Certificate Detail icon in the row that corresponds to the certificate.
Figure 121:CA Certificates list

View Certificate Detail Download Import Name Import a CA root certificate. See Importing CA certificates on page 212. The names of existing CA root certificates. The FortiGate unit assigns unique names (CA_Cert_1, CA_Cert_2, CA_Cert_3, and so on) to the CA certificates when they are imported. Information about the issuing CA. Delete a CA root certificate from the FortiGate configuration. Display certificate details. Save a copy of the CA root certificate to a local computer.

Subject Delete icon View Certificate Detail icon Download icon

For detailed information and step-by-step procedures related to obtaining and installing digital certificates, see the FortiGate Certificate Management User Guide.

Importing CA certificates
After you download the root certificate of the CA, save the certificate on a PC that has management access to the FortiGate unit. To import a CA root certificate, go to System > Certificates > CA Certificates and select Import.

212

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Certificates

CRL

Figure 122:Import CA Certificate

SCEP

Select to use an SCEP server to access CA certificate for user authentication. Enter the URL of the SCEP server from which to retrieve the CA certificate. Optionally, enter identifying information of the CA, such as the file name. Select OK. Select to use a local administrators PC to upload a public certificate. Enter the location, or browse to the location on the management computer where the certificate has been saved, select the certificate, and then select OK.

Local PC

When you select OK and you have elected to import a certificate via the SCEP server, the system starts the retrieval process immediately. The system assigns a unique name to each CA certificate. The names are numbered consecutively (CA_Cert_1, CA_Cert_2, CA_Cert_3, and so on).

CRL
A Certificate Revocation List (CRL) is a list of CA certificate subscribers paired with certificate status information. Installed CRLs are displayed in the CRL list. The FortiGate unit uses CRLs to ensure that the certificates belonging to CAs and remote clients are valid. To view installed CRLs, go to System > Certificates > CRL.
Figure 123:Certificate revocation list

View Certificate Detail Download

Import Name Import a CRL. See Importing a certificate revocation list on page 214. The names of existing certificate revocation lists. The FortiGate unit assigns unique names (CRL_1, CRL_2, CRL_3, and so on) to certificate revocation lists when they are imported. Information about the certificate revocation lists. Delete the selected CRL from the FortiGate configuration. Display CRL details such as the issuer name and CRL update dates. See example Figure 124. Save a copy of the CRL to a local computer.

Subject Delete icon View Certificate Detail icon Download icon

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

213

CRL

System Certificates

Figure 124:CRL Certificate Detail

Importing a certificate revocation list

Certificate revocation lists from CA web sites must be kept updated on a regular basis to ensure that clients having revoked certificates cannot establish a connection with the FortiGate unit. After you download a CRL from the CA web site, save the CRL on a computer that has management access to the FortiGate unit.
Note: When the CRL is configured with an LDAP, HTTP, and/or SCEP server, the latest version of the CRL is retrieved automatically from the server when the FortiGate unit does not have a copy of it or when the current copy expires.

To import a certificate revocation list, go to System > Certificates > CRL and select Import.
Figure 125:Import CRL

HTTP LDAP SCEP

Select to use an HTTP server to retrieve the CRL. Enter the URL of the HTTP server. Select to use an LDAP server to retrieve the CRL. Select the LDAP server from the drop-down list. Select to use an SCEP server to retrieve the CRL. Select the Local Certificate from the drop-down list. Enter the URL of the SCEP server from which the CRL can be retrieved. Select to use a local administrators PC to upload a public certificate. Enter the location, or browse to the location on the management computer where the certificate has been saved, select the certificate, and then select OK.

Local PC

The system assigns a unique name to each CRL. The names are numbered consecutively (CRL_1, CRL_2, CRL_3, and so on).

214

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Maintenance System Configuration

System Maintenance
This section describes how to maintain your system configuration as well as information about enabling and updating FDN services. This section also explains the types of FDN services that are available for your FortiGate unit. This section includes the following topics: Maintenance System Configuration Revision Control FortiGuard Troubleshooting FDN connectivity Updating antivirus and attack definitions Enabling push updates License

Maintenance System Configuration

In System > Maintenance > Backup & Restore, you can easily manage your system configuration by performing backups, remotely upgrade firmware, and store FortiClient software for users to download and install. The Maintenance menu is comprised of the following tabs: Backup and Restore provides the ability to back up and restore your system configuration file, remotely upgrade firmware, and import CLI commands. Revision Control displays all system configuration backups with the date and time of when they were backed up. This tab only displays if the FortiGuard Analysis and Management Service is enabled. FortiGuard displays all FDN subscription services, such as antivirus and IPS definitions as well as the FortiGuard Analysis and Management Service. The FortiGuard tab also provides configuration for antivirus, IPS, web filtering, and antispam services. License only displays on FortiGate-3000 units and higher; enables you to increase the maximum number of VDOMs.

When backing up the system configuration, web content files and spam filtering files are also included. You can save the configuration to the management computer or to a USB disk if your FortiGate unit supports a USB disk. You can also restore the system configuration from previously downloaded backup files in the Backup and Restore menu.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

215

Maintenance System Configuration

System Maintenance

When virtual domain configuration is enabled, the content of the backup file depends on the administrator account that created it. A backup of the system configuration from the super admin account contains global settings and the settings included in each VDOM. Only the super admin can restore the configuration from this file. When you back up the system configuration from a regular administrator account, the backup file contains the global settings and the settings for the VDOM that the regular administrator belongs to. A regular administrator is the only user account that can restore the configuration from this file. Some FortiGate models support FortiClient by storing a FortiClient image that users can download. The FortiClient section of Backup and Restore is available if your FortiGate model supports FortiClient. This feature is currently available on FortiGate-1000A, 3600A, and 5005FA2 models.
Figure 126:Backup and Restore page on a FortiGate-3000 unit

The Backup and Restore menu is divided into sections, making it easier to find specific information about maintaining your system configuration. For example, the Backup and Restore section contains only information about backing up and restoring a configuration file from the various storage places, such as your management computer or a FortiManager unit. These sections are: Backup and Restore Firmware FortiClient Advanced

Note: The Firmware Section is available only on FortiGate-100A units and higher. If you have a FortiGate-100 unit or lower, you can upgrade or downgrade the firmware by going to System > Status and selecting Update for Firmware Version.

216

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Maintenance System Configuration

Backup and Restore

The Backup and Restore section is where you backup and restore system configuration. This section allows you to back up and restore your FortiGate configuration to your management PC, a central management server, or a USB key (if available). The central management server is referred to remote management service the FortiGate unit is connected to. For example, if the current configuration on a FortiGate-60 is backed up to a FortiManager unit, the central management server would be the FortiManager unit. You must configure central management in System > Admin > Central Management before these options are available in the Backup and Restore section. See Central Management on page 198 for more information.
Figure 127:Backup and Restore local options with FortiGuard Analysis and Management Service enabled

System Configuration (Last Backup:) Backup

Displays the date and time of the last local or remote backup. If you backed up the configuration file using a USB disk, only the date displays. Time is not saved when backing up using a USB disk. Displays the options available for backing up your current configuration. Backup Select one of the displayed options: configuration to: Local PC always displays regardless of whether a USB disk is available, FortiGuard Analysis and Management Service is enabled, or the FortiGate unit is connected to a FortiManager unit. This option backs up the configuration to the management computer the FortiGate unit is connected to. USB Disk displays if the FortiGate unit supports USB disks. This option is grayed out if no USB disks are connected. FortiGuard displays if FortiGuard Analysis and Management Service is enabled. If FortiGuard Management Services is not enabled, this option does not display.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

217

Maintenance System Configuration

System Maintenance

FortiManager displays if the FortiGate unit is connected to a FortiManager unit. If the FortiGate unit is not connected to a FortiManager unit, this option does not display.

Encrypt Select to encrypt the backup file. configuration file Encryption must be enabled to save VPN certificates with the configuration. This option is not available for FortiManager backup option. Password Enter a password to encrypt the configuration file. You will need this password to restore the configuration file. Enter the password again to confirm the password. Enter the name of the backup file or select Browse to locate the file. The Filename field is only available when the USB drive is connected. Select to back up the configuration. If you are backing up to a FortiManager device, a confirmation message displays after successfully completing the backup.

Confirm Filename

Backup

Restore

Restore the configuration from a file. Restore configuration from: Select one of the displayed options:

Local PC always displays regardless of whether a USB disk is available, FortiGuard Analysis and Management Service is enabled, or the FortiGate unit is connected to a FortiManager unit. This option backs up the configuration to the management computer the FortiGate unit is connected to. USB Disk displays if the FortiGate unit supports USB disks. This option is grayed out if no USB disks are connected. FortiGuard displays if FortiGuard Analysis and Management Service is enabled. If FortiGuard Analysis and Management Service is not enabled, this option does not display. FortiManager displays if the FortiGate unit is connected to a FortiManager unit. If the FortiGate unit is not connected to a FortiManager unit, this option does not display.

218

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Maintenance System Configuration

Filename

Select the configuration file name from the Browse list if you are restoring the configuration from a USB disk. Enter the configuration file name or use the Browse button if you are restoring the configuration from a file on the management computer. Enter the password you entered when backing up the configuration file. Select to restore the configuration.

Password Restore

Note: The radio button, Management Station, appears when the FortiGuard Analysis and Management Service is disabled. The FortiGuard radio button appears when FortiGuard Analysis and Management Service is enabled.

Remote FortiManager Options

Your FortiGate unit has the option of being remotely managed by a FortiManager unit. The FortiGate unit connects through a VPN IPSec tunnel to the FortiManager unit where a FortiManager administrator adds the FortiGate unit to the FortiManager database. After successfully connecting to the FortiManager, you can then back up your configuration to the FortiManager unit. You can also restore your configuration. The automatic backup of the configuration is available only in local mode on the FortiManager unit. A list of revisions is displayed when restoring the configuration from a remote location. The list enables you to choose the specific configuration to restore.
Figure 128:Backup and Restore local options with FortiManager enabled
\

Backup

Displays the options available for backing up your current configuration to a FortiManager unit. Backup configuration to: Comments: Backup Select the FortiManager option to upload the configuration to the FortiManager unit. The Local PC option is always available. Enter a description or information about the file in the Comments field. This is optional. Select to back up the configuration file to the FortiManager unit. A confirmation message displays after successfully completing the backup. Select the FortiManager option to download the configuration file from the FortiManager unit.

Restore

Displays the options for restoring a configuration file. Restore configuration from:

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

219

Maintenance System Configuration

System Maintenance

Please Select:

Select the configuration file you want to restore from the drop-down list. The list includes the comments you included in the Comment field before uploading to the FortiManager unit. The drop-down list is in numerical order, with the recent uploaded configuration first. Select to restore the configuration from the FortiManager unit.

Restore

Note: The FortiGuard-FortiManager protocol is a new protocol designed to provide better communication when a FortiGate unit is connected to a FortiManager unit or when a FortiGate unit is connected to the FortiGuard Analysis and Management Service. This new protocol resolves the FortiGate-behind-NAT issue and supports passive mode on the FortiGate Analysis and Management Service. This protocol runs over SSL using IPv4/TCP port 541 and includes the following functions: detects FortiGate unit dead or alive status detects management service dead/alive status notifies the FortiGate units about configuration changes, AV/IPS database update and firewall changes.

Remote Management Options

Your FortiGate unit can be remotely managed by a central management server, which is available when you register for the FortiGuard Analysis and Management Service. The FortiGuard Analysis and Management Service is a subscriptionbased service and is purchased by contacting support. Additional information and how to register for the FortiGuard Analysis and Management Service is available in the FortiGuard Analysis and Management Service Administration Guide, located at http://kc.forticare.com. After registering, you can back up your configuration or restore your configuration. The FortiGuard Analysis and Management Service is useful when administering multiple FortiGate units without having a FortiManager unit. You can also upgrade the firmware on your FortiGate unit using the FortiGuard Analysis and Management Service. Upgrading the firmware is available in the Firmware Upgrade section of the Backup and Restore menu. See Firmware Upgrade on page 222 for more information about upgrading firmware from the Backup and Restore menu. When restoring the configuration from a remote location, a list of revisions is displayed so you can choose the configuration file to restore.
Figure 129:Backup and Restore Central Management options

220

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Maintenance System Configuration

Backup

Displays the options available for backing up your current configuration to the FortiGuard Analysis and Management Service server. Backup configuration Select the FortiGuard option to upload the to: configuration to the FortiGuard Analysis and Management Service server. The Local PC option is always available. Comments: Backup Enter a description or note in the Comments field. Select to back up the configuration file to the FortiGuard Analysis and Management Service. A confirmation message displays after successfully completing the backup. Select the FortiManager option to download the configuration file from the FortiManager unit. Select the configuration file you want to restore from the drop-down list. The list includes the comments you included in the Comment field before uploading to the FortiGuard Analysis Management Service server. The drop-down list is in numerical order, with the recent uploaded configuration first. Select to restore the configuration from the FortiGuard Management Services server.

Restore

Displays the options for restoring a configuration file. Restore configuration from: Please Select:

Restore

Note: The FortiGuard-FortiManager protocol is a new protocol designed to provide better communication when a FortiGate unit is connected to a FortiManager unit or when a FortiGate unit is connected to the FortiGuard Analysis and Management Service. This new protocol resolves the FortiGate-behind-NAT issue and supports passive mode on the FortiGuard Analysis and Management Service. This protocol runs over SSL using IPv4/TCP port 541 and includes the following functions: detects FortiGate unit dead or alive status detects management service dead/alive status notifies the FortiGate units about configuration changes, AV/IPS database update and firewall changes.

Firmware
The Firmware section displays the current version of firmware installed on your FortiGate unit, and also displays the firmware version currently in use if there is more than one firmware image saved on the FortiGate unit.
Figure 130:Two firmware images displaying on a FortiGate-1000A unit in the Firmware section on the Backup and Restore page

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

221

Maintenance System Configuration

System Maintenance

Partition

A partition can contain one version of the firmware and the system configuration. FortiGate-100A units and higher have two partitions. One partition is active and the other is used as a backup. A green check mark indicates the partition currently in use. The date and time of the last update to this partition. The version and build number of the FortiGate firmware. If your FortiGate model has a backup partition, you can: Select Upload to replace with firmware from the management computer or a USB disk. Select Upload and Reboot to replace the firmware and make this the active partition.

Active Last Upgrade Firmware Version

Boot alternate firmware

Restart the FortiGate unit using the backup firmware. This is only available for FortiGate-100 units or higher.

Firmware Upgrade
The Firmware section of the Backup and Restore page displays options for upgrading to a new version using the FortiGuard Analysis and Management Service if that option is available to you. Using the FortiGuard Analysis and Management Service to upgrade the firmware on your FortiGate unit is only available on certain FortiGate units. You must register for the service by contacting customer support. Detailed firmware version information is provided if you have subscribed for the FortiGuard Analysis and Management Service.
Figure 131:Firmware Upgrade section of the Backup and Restore page

Upgrade method

Select to upgrade from the FortiGuard Analysis and Management Service. You can also choose to upgrade by file if a current firmware version is stored on your management computer. Select one of the available firmware versions. The list contains the following information for each available firmware release: continent (for example, North America) maintenance release number patch release number

[Please Select]

build number For example, if you are upgrading to FortiOS 3.0 MR6 and the FortiGate unit is located in North America, the firmware version available is v3.0 MR6-NA (build 0700). Allow firmware downgrade Select to be able to install older versions than the one currently installed. This is useful if the current version changed functionality you need and you have to revert to the previous image. Select Browse to select a file on your local PC to upload to the FortiGate unit. Select OK to enable your selection.

Upgrade by File OK

222

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Maintenance System Configuration

FortiClient
If your FortiGate unit supports the host check function, you can view version information for the FortiClient application stored on the unit, including uploading a current firmware version of the FortiClient application. Some FortiGate units provide a host check function that can determine whether users computers have FortiClient Host Security software installed. Users who fail the host check are redirected to a web portal where they can download the FortiClient application. See Options to check FortiClient on hosts on page 296 for more information.
Figure 132:FortiClient section of the Backup & Restore page

Software Image

The current FortiClient image on this FortiGate unit. Select Upload to upload a new FortiClient image from your management computer. The name of the uploaded file must begin with FortiClientSetup_ followed by the version number, for example, 3.0.526. Fortinet provides reduced-size installer files, with _FG in the name, specifically for upload to FortiGate units. The current version of the FortiGuard antivirus database on this FortiGate unit. See Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228 for more information. The current version of the FortiGuard antivirus engine on this FortiGate unit. See Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228 for more information. Select the port for the web portal where users are redirected if they fail the FortiClient host check. Select Save after changing the port number to commit the change. The default port number is 8009. Change the port number only if it causes a conflict on your network.

Antivirus Database Antivirus Engine

Web Portal Port

Advanced
The Advanced section on the Backup and Restore page includes the USB Auto Install feature, importing CLI commands, and the debug log.
Figure 133:Options available in the Advanced section

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

223

Maintenance System Configuration

System Maintenance

Advanced (USB Auto-Install, This section is only available if a USB disk is connected to the FortiGate unit. Select the options as required and Import CLI Commands, restart the FortiGate unit. Download Debug Log) If you select both configuration and firmware update, both occur on the same reboot. The FortiGate unit will not reload a firmware or configuration file that is already loaded. On system restart, automatically update FortiGate configuration Automatically update the configuration on restart. Ensure that the Default configuration file name matches the configuration file name on the USB disk. If the configuration file name on the disk matches the specified file name, the FortiGate unit skips the update FortiGate configuration process.

On system restart, Automatically update the firmware automatically update on restart. Ensure that the Default FortiGate firmware image name matches the firmware file name on the USB disk. If the firmware image name on the disk matches the specified firmware image name, the FortiGate unit skips the update FortiGate firmware process. Apply Select to have the selected image and configuration file automatically install

Import Bulk CLI Commands

Imports CLI commands from a text file on the management computer to the FortiGate unit. These commands need to be formatted in the text file as they appear in the CLI for the import to properly work. Upload File Enter the name of the file that contains the CLI commands or select Browse to locate the file. Select to import the file.

Import Now Download Debug Log

Download an encrypted debug log to a file. You can send this debug log to Fortinet Technical Support to help diagnose problems with your FortiGate unit.

USB Disks
FortiGate units with USB port(s) support USB disks for backing up and restoring configurations. FortiUSB and generic USB disks are supported, but the generic USB disk must be formatted as a FAT16 disk. No other partition type is supported. There are two ways that you can format the USB disk, either by using the CLI or a Windows system. You can format the USB disk in the CLI using the command syntax, exe usb-disk format. When using a Windows system to format the disk, at the DOS command prompt or similar prompt type, format <drive_letter>: /FS:FAT /V:<drive_label> where <drive_letter> is the letter of the connected USB drive you want to format, and <drive_label> is the name you want to give the USB drive for identification.
Note: Formatting the USB disk deletes all information on the disk. Back up the information on the USB disk before formatting to ensure all information on the disk can be recovered.

224

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Revision Control

Revision Control
The Revision Control tab enables you to manage multiple versions of configuration files and appears only after registering and configuring FortiGuard Analysis and Management Service. Revision Control requires a configured central management server. This server can either be a FortiManager unit or the FortiGuard Analysis and Management Service. If central management is not configured on your FortiGate unit, a message displays telling you do one of the following: Enable Central Management, see Central Management on page 198 Obtain a valid license

When revision control is enabled on your FortiGate unit, you can view a list of saved revisions of the configuration.
Figure 134:Revision Control page displaying system configuration back ups
Page Navigation

Diff Download Revert

Page Navigation Revision

Select from the various arrows to go to the next page, previous page, last, or first page. You can also enter a number to view that page of log messages. For example, entering the number 5 displays the fifth page. An incremental number indicating the order the configurations were saved. These may not be consecutive numbers if one or more configurations are deleted. The most recent, also the largest number, is first in the list. Displays the date and time when this configuration was saved on the FortiGate unit. Displays the administrator account that was used to back up this revision. Any relevant information saved with the revision. A description provides information about why the revision was saved, who saved it, and if there is a date when it can be deleted to free up space. Select to compare two revisions. A window appears after selecting the diff icon, enabling you to view and compare the selected revision to one of: the current configuration a selected revision from the displayed list including revision history and templates a specified revision number

Date/Time Administrator Comments

Diff

Download Revert

Select to download this revision to your local PC. Select to go to the previous selected revision. You will be prompted to confirm this action.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

225

FortiGuard

System Maintenance

FortiGuard
The FortiGuard tab enables you to configure your FortiGate unit to use the FortiGuard Distribution Network (FDN) and FortiGuard Services. The FDN provides updates to antivirus and IPS attack definitions. FortiGuard Services provides online IP address black list, URL black list, and other spam filtering tools.

FortiGuard Distribution Network

The FortiGuard Distribution Network (FDN) is a world-wide network of FortiGuard Distribution Servers (FDS). The FDN provides updates to antivirus (including grayware) and IPS attack definitions. When the FortiGate unit connects to the FDN, it connects to the nearest FDS based on the current time zone setting. The FortiGate unit supports the following update options: User-initiated updates from the FDN, Hourly, daily, or weekly scheduled antivirus and attack definition updates from the FDN, Push updates from the FDN, Update status including version numbers, expiry dates, and update dates and times, Push updates through a NAT device.

Registering your FortiGate unit on the Fortinet Support web page provides a valid license contract and connection to the FDN. On the Fortinet Support web page, go to Product Registration and follow the instructions. The FortiGate unit must be able to connect to the FDN using HTTPS on port 443 to receive scheduled updates. See To enable scheduled updates on page 234 for information about configuring scheduled updates. You can also configure the FortiGate unit to receive push updates. When the FortiGate unit is receiving push updates, the FDN must be able to route packets to the FortiGate unit using UDP port 9443. See Enabling push updates on page 235 for information about configuring push updates. If the FortiGate unit is behind a NAT device, see Enabling push updates through a NAT device on page 235.

FortiGuard Services
Worldwide coverage of FortiGuard services are provided by FortiGuard Service Points. When the FortiGate unit is connecting to the FDN, it is connecting to the closest FortiGuard Service Point. Fortinet adds new Service Points as required. By default, the FortiGate unit communicates with the closest Service Point. If the Service Point becomes unreachable for any reason, the FortiGate unit contacts another Service Point and information is available within seconds. By default, the FortiGate unit communicates with the Service Point via UDP on port 53. Alternately, the UDP port used for Service Point communication can be switched to port 8888 by going to System > Maintenance > FortiGuard. If you need to change the default FortiGuard Service Point host name, use the hostname keyword in the system fortiguard CLI command. You cannot change the FortiGuard Service Point name using the web-based manager. See the FortiGuard Center web page for detailed information about FortiGuard services.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

226

System Maintenance

FortiGuard

FortiGuard Antispam Service

FortiGuard Antispam is an antispam system from Fortinet that includes an IP address black list, a URL black list, and spam filtering tools. The IP address black list contains IP addresses of email servers known to generate spam. The URL black list contains URLs found in spam email. FortiGuard Antispam processes are completely automated and configured by Fortinet. With constant monitoring and dynamic updates, FortiGuard Antispam is always current. You can either enable or disable FortiGuard Antispam in the Firewall menu in a protection profile. See Spam Filtering options on page 361 for more information. Every FortiGate unit comes with a free 30-day FortiGuard Antispam trial license. FortiGuard Antispam license management is performed by Fortinet servers; there is no need to enter a license number. The FortiGate unit automatically contacts a FortiGuard Antispam Service Point when enabling FortiGuard Antispam. Contact Fortinet Technical support to renew the FortiGuard Antispam license after the free trial is over. You can globally enable FortiGuard Antispam in System > Maintenance > FortiGuard and then configure Spam Filtering options in each firewall protection profile in Firewall > Protection Profile. See Spam Filtering options on page 361 for more information.

FortiGuard Web Filtering Service

FortiGuard Web Filtering is a managed web filtering solution provided by Fortinet. FortiGuard Web Filtering sorts hundreds of millions of web pages into a wide range of categories users can allow, block, or monitor. The FortiGate unit accesses the nearest FortiGuard Web Filtering Service Point to determine the category of a requested web page, then follows the firewall policy configured for that user or interface. Every FortiGate unit comes with a free 30-day FortiGuard Web Filtering trial license. FortiGuard license management is performed by Fortinet servers. There is no need to enter a license number. The FortiGate unit automatically contacts a FortiGuard Service Point when enabling FortiGuard category blocking. Contact Fortinet Technical Support to renew a FortiGuard license after the free trial. You can globally enable FortiGuard Web Filtering in System > Maintenance > FortiGuard Center and then configure FortiGuard Web Filtering options for each profile in Firewall > Protection Profiles. See FortiGuard Web Filtering options on page 359 for more information.

FortiGuard Analysis and Management Service

FortiGuard Analysis and Management Service is a subscription-based service that provides remote management services, including logging and reporting capabilities for all FortiGate units. These services were previously only available on FortiAnalyzer and FortiManager units. The subscription-based service is available from the FortiGuard Analysis and Management Service portal web site, which provides a central location for configuring logging and reporting and remote management, including viewing subscription contract information, such as daily quota and the expiry date of the service.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

227

FortiGuard

System Maintenance

Configuring the FortiGate unit for FDN and FortiGuard subscription services
FDN updates, as well as FortiGuard services, are configured in System > Maintenance > FortiGuard. The FortiGuard Distribution Network page contains four sections of FortiGuard services. The four sections are: Support Contract and FortiGuard Subscription Services AntiVirus and IPS Downloads Web Filtering and AntiSpam Options Management and Analysis Service Options

Support Contract and FortiGuard Subscription Services

The Support Contract and FortiGuard Subscription Services sections are displayed in abbreviated form on the System Status page. See Viewing system status on page 55.
Figure 135:Support Contract and FortiGuard Subscription Services section

Support Contract The availability or status of your FortiGate unit support contract. The status displays can be one of the following: Unreachable, Not Registered or Valid Contract. If Valid Contract is shown, the FortiOS firmware version and contract expiry date displays. A green checkmark also displays. [Register] Select to register your FortiGate unit support contract. This displays only when the support contract is not registered.

FortiGuard Subscription Services

Availability and status information for each of the FortiGuard subscription services including: AntiVirus AV Definitions Intrusion Protection IPS Definitions Web Filtering AntiSpam Management Service Analysis Service

228

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

FortiGuard

[Availability] The availability of this service on this FortiGate unit, dependent on your service subscription. The status can be one of the following: Unreachable Not Registered Valid License

Valid Contract The option Subscribe displays if Availability is Not Registered. The option Renew displays if Availability has expired. [Update] Select to manually update this service on your FortiGate unit. This will prompt you to download the update file from your local computer. Select Update Now to immediately download current updates from FDN directly. Select to register the service. This displays in Management Service and Analysis Service. Select to renew the service. This displays in Management Service and Analysis Service. Icon shown indicates the status of the subscription service. The icon corresponds to the availability description. Grey (Unreachable) FortiGate unit is not able to connect to service Orange (Not Registered) FortiGate unit can connect, but has no subscription registered for this service Yellow (Expired) FortiGate unit had a valid license that expired

[Register] [Renew] Status Icon

Green (Valid license) FortiGate unit can connect to FDN and has a registered support contract If the Status Icon is green, the expiry date displays. [Version] The version number of the definition file currently installed on the FortiGate unit for this service.

[Last update The date of the last update and method used for last date and attempt to download definition updates for this method] service. [Date] Local system date when the FortiGate unit last checked for updates for this service.

AntiVirus and IPS Downloads

The Antivirus and IPS Options section enables you to schedule antivirus and IPS updates, configure an override server, or allow push updates. You can access these options by selecting the blue arrow. The SETUP message that the FortiGate unit sends when you enable push updates includes the IP address of the FortiGate interface that the FDN connects to. The Use override push IP option is used when your FortiGate unit is behind a NAT device. The FortiGate unit sends the FDS the IP and port numbers of the NAT device to the FDS. The NAT device must also be configured to forward the FDS traffic to the FortiGate unit on port 9443. See Enabling push updates through a NAT device on page 235 for more information.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

229

FortiGuard

System Maintenance

Figure 136:AntiVirus and IPS Options section

Use override server address

Select to configure an override server if you cannot connect to the FDN or if your organization provides updates using their own FortiGuard server. When selected, enter the IP address or domain name of a FortiGuard server and select Apply. If the FDN Status still indicates no connection to the FDN, see Troubleshooting FDN connectivity on page 233. Select to allow push updates. Updates are sent to your FortiGate unit when they are available, without having to check if they are available. Push Update Status Icon shows the status of the push update service. Allow Push The status of the FortiGate unit for receiving push Update status updates: icon Grey (Unreachable) - FortiGate unit is not able to connect to push update service Yellow (Not Available) - push update service is not available with current support license

Allow Push Update

Green (Available) - push update service is allowed. See on page 235. If the icon is either grey or yellow, see Troubleshooting FDN connectivity on page 233. Use override push IP Available only if Use override server address and Allow Push Update is enabled. Select to allow you to create a forwarding policy that redirects incoming FDS push updates to your FortiGate unit. Enter the IP address of the NAT device in front of your FortiGate unit. FDS will connect to this device when attempting to reach the FortiGate unit. The NAT device must be configured to forward the FDS traffic to the FortiGate unit on UDP port 9443. See Enabling push updates through a NAT device on page 235. Select the port on the NAT device that will receive the FDS push updates. This port must be forwarded to UDP port 9443 on the FortiGate unit. Available only if Use override push is enabled. Attempt to update once every 1 to 23 hours. Select the number of hours between each update request. Attempt to update once a day. You can specify the hour of the day to check for updates. The update attempt occurs at a randomly determined time within the selected hour.

Port

Schedule Updates

Select this check box to enable scheduled updates. Every

Daily

230

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

FortiGuard

Weekly

Attempt to update once a week. You can specify the day of the week and the hour of the day to check for updates. The update attempt occurs at a randomly determined time within the selected hour.

Update Now Submit attack characteristics

Select Update Now to manually initiate an FDN update. Fortinet recommends that you select this checkbox. It helps to improve the quality of IPS signature.

Web Filtering and AntiSpam Options

You can access this section by selecting the blue arrow to expand the Web Filtering and AntiSpam Options options.
Figure 137:Web Filtering and AntiSpam Options section

Enable Web Filter

Select to enable FortiGuard Web Filter service. Enable Cache Select to enable caching of web filter queries. This improves performance by reducing FortiGate unit requests to the FortiGuard server. The cache uses 6 percent of the FortiGate memory. When the cache is full, the least recently used IP address or URL is deleted. The Enable Cache is only available if Enable Web Filter is selected. TTL Time to live. The number of seconds to store blocked IP addresses and URLs in the cache before contacting the server again. Available only if both Enable Web Filter and Enable Cache are selected.

Enable AntiSpam

Select to enable FortiGuard AnitSpam service. Enable Cache Select to enable caching of antispam queries. This improves performance by reducing FortiGate unit requests to the FortiGuard server. The cache uses 6 percent of the FortiGate memory. When the cache is full, the least recently used IP address or URL is deleted. Available only if Enable Anti Spam is selected. TTL Time to live. The number of seconds to store blocked IP addresses and URLs in the cache before contacting the server again.

Port Section

Select one of the following ports for your web filtering and antispam requirements: Use Default Port (53) Select to use port 53 for transmitting with FortiGuard Antispam servers.

Use Alternate Select to use port 8888 for transmitting with Port (8888) FortiGuard Antispam servers.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

231

FortiGuard

System Maintenance

Test Availability please click here

Select to test the connection to the servers. Results are shown below the button and on the Status indicators. Select to re-evaluate a URLs category rating on the FortiGuard Web Filter service.

Management and Analysis Service Options

The Management and Analysis Service Options section contains the Account ID and other options regarding the FortiGuard Analysis and Management Service. You can access this section by selecting the blue arrow to expand the Management and Analysis Service Options.
Figure 138:FortiGuard Management and Analysis Service options

Account ID

Enter the name for the Management and Analysis Services that identifies the account. The account ID that you entered in the Account ID field when registering is used in this field.

To launch the service Select to go directly to the FortiGuard Analysis and Management services portal website to either view logs or configuration. You portal, please click can also select this to register your FortiGate unit with the here FortiGuard Analysis and Management Services. To configure...please Select the link, please click here, to configure and enable logging to the FortiGuard Analysis server. The link redirects you to click here. Log&Report > Log Config > Log Setting. This displays only after registering for the service. To purge...please click here. Select the number of months from the drop-down list that will remove those logs from the FortiGuard Analysis server and select the link, please click here. For example, if you select 2 months, the logs from the past two months will be removed from the server. You can also use this option to remove logs that may appear on a current report. This displays only after logging is enabled and log messages are sent to the FortiGuard Analysis server.

232

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Troubleshooting FDN connectivity

Troubleshooting FDN connectivity

If your FortiGate unit is unable to connect to the FDN, check your configuration. For example, you may need to add routes to the FortiGate routing table or configure your network to allow the FortiGate unit to use HTTPS on port 443 to connect to the Internet. You might have to connect to an override FortiGuard server to receive updates. See To add an override server on page 234 for more information. If this is not successful, check your configuration to make sure you can connect to the override FortiGuard server from the FortiGate unit. Push updates might be unavailable if: you have not registered the FortiGate unit (To register your FortiGate unit, go to Product Registration and follow the instructions.) there is a NAT device installed between the FortiGate unit and the FDN (see Enabling push updates through a NAT device on page 235) your FortiGate unit connects to the Internet using a proxy server (see To enable scheduled updates through a proxy server on page 234).

Updating antivirus and attack definitions

Use the following procedures to configure the FortiGate unit to connect to the FDN to update the antivirus (including grayware) definitions and IPS attack definitions. Updating antivirus and IPS attack definitions can cause a very short disruption in traffic scanning while the FortiGate unit applies the new signature definitions. It is recommended to schedule updates for times when traffic is light to minimize disruption. To make sure the FortiGate unit can connect to the FDN 1 Go to System > Status and select Change on the System Time line in the System Information section. Verify that the time zone is correctly set for the region where your FortiGate unit is located. 2 3 4 Go to System > Maintenance > FortiGuard. Select the blue arrow to expand the Web Filtering and AntiSpam Options. Select Test Availability. The FortiGate unit tests its connection to the FDN. The test results displays at the top of the FortiGuard page. To update antivirus and attack definitions 1 2 3 Go to System > Maintenance > FortiGuard. Select the blue arrow to expand the Antivirus and IPS Options. Select Update Now to update the antivirus and attack definitions. If the connection to the FDN or override server is successful, the web-based manager displays a message similar to the following:

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

233

Updating antivirus and attack definitions

System Maintenance

Your update request has been sent. Your database will be updated in a few minutes. Please check your update page for the status of the update. After a few minutes, if an update is available, the FortiGuard page lists new version information for antivirus definitions and IPS attack definitions. The page also displays new dates and version numbers for the updated definitions and engines. Messages are recorded to the event log, indicating whether the update was successful or not. To enable scheduled updates 1 2 3 4 Go to System > Maintenance > FortiGuard. Select the blue arrow to expand the AntiVirus and IPS Options. Select the Scheduled Update check box. Select one of the following:
Every Daily Weekly Once every 1 to 23 hours. Select the number of hours and minutes between each update request. Once a day. You can specify the time of day to check for updates. Once a week. You can specify the day of the week and the time of day to check for updates.

Select Apply. The FortiGate unit starts the next scheduled update according to the new update schedule. Whenever the FortiGate unit runs a scheduled update, the event is recorded in the FortiGate event log. To add an override server If you cannot connect to the FDN, or if your organization provides antivirus and IPS attack updates using their own FortiGuard server, you can use the following procedure to add the IP address of an override FortiGuard server.

1 2 3 4

Go to System > Maintenance > FortiGuard. Select the Use override server address check box. Type the fully qualified domain name or IP address of the FortiGuard server. Select Apply. The FortiGate unit tests the connection to the override server. If the FortiGuard Distribution Network availability icon changes from gray to green, the FortiGate unit has successfully connected to the override server. If the FortiGuard Distribution Network availability icon stays gray, the FortiGate unit cannot connect to the override server. Check the FortiGate configuration and network configuration for settings that would prevent the FortiGate unit from connecting to the override FortiGuard server. To enable scheduled updates through a proxy server If your FortiGate unit must connect to the Internet through a proxy server, you can use the config system autoupdate tunneling command syntax to allow the FortiGate unit to connect (or tunnel) to the FDN using the proxy server. See the FortiOS CLI Reference for more information.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

234

System Maintenance

Enabling push updates

Enabling push updates

The FDN can push updates to FortiGate units to provide the fastest possible response to critical situations. You must register the FortiGate unit before it can receive push updates. Register your FortiGate unit by going to the Fortinet Support web site, Product Registration, and follow the instructions. When you configure a FortiGate unit to allow push updates, the FortiGate unit sends a SETUP message to the FDN. The next time new antivirus or IPS attack definitions are released, the FDN notifies all FortiGate units that are configured for push updates, that a new update is available. Within 60 seconds of receiving a push notification, the FortiGate unit requests the update from the FDN. When the network configuration permits, configuring push updates is recommended in addition to configuring scheduled updates. On average the FortiGate unit receives new updates sooner through push updates than if the FortiGate unit receives only scheduled updates. Scheduled updates ensures that the FortiGate unit receives current updates. Enabling push updates is not recommended as the only method for obtaining updates. The FortiGate unit might not receive the push notification. When the FortiGate unit receives a push notification, it makes only one attempt to connect to the FDN and download updates.

Push updates when FortiGate IP addresses changes

The SETUP message that the FortiGate unit sends when you enable push updates includes the IP address of the FortiGate interface that the FDN connects to. The interface used for push updates is the interface configured in the default route of the static routing table. The FortiGate unit sends the SETUP message if you change the IP address of this interface manually or if you have set the interface addressing mode to DHCP or PPPoE and your DHCP or PPPoE server changes the IP address. The FDN must be able to connect to this IP address for your FortiGate unit to be able to receive push update messages. If your FortiGate unit is behind a NAT device, see Enabling push updates through a NAT device on page 235. If you have redundant connections to the Internet, the FortiGate unit also sends the SETUP message when one Internet connection goes down and the FortiGate unit fails over to another Internet connection. In Transparent mode, if you change the management IP address, the FortiGate unit also sends the SETUP message to notify the FDN of the address change.

Enabling push updates through a NAT device

If the FDN connects only to the FortiGate unit through a NAT device, you must configure port forwarding on the NAT device and add the port forwarding information to the push update configuration. Port forwarding enables the FDN to connect to the FortiGate unit using UDP on either port 9443 or an override push port that you specify. If the external IP address of the NAT device is dynamic (PPPoE or DHCP), the FortiGate unit is unable to receive push updates through a NAT device.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

235

Enabling push updates

System Maintenance

The following procedures configure the FortiGate unit to push updates through a NAT Device. These procedures also include adding port forwarding virtual IP and a firewall policy to the NAT device.
Figure 139:Example network: Push updates through a NAT device
172.16.35.144 (external interface) Virtual IP 10.20.6.135 (external interface) Internet Internal Network FDN Server

FortiGate unit

NAT Device

This procedure configures both the FortiGate unit and NAT device so that they FortiGate unit can receive push updates. General procedure 1 2 Register the FortiGate unit on the internal network so that it has a current support license and can receive push updates. Configure the following FortiGuard options on the FortiGate unit on the internal network. 3 Allow push updates Add an override push update IP. Usually this would be the IP address of the external interface of the NAT device If required, change the override push update port Set the external IP address of the virtual IP to match the override push update IP. Usually this would be the IP address of the external interface of the NAT device.

Add a port forwarding virtual IP to the NAT device.

Add a firewall policy to the FortiGate NAT device that includes the port forwarding virtual IP.
Note: Push updates are not supported if the FortiGate unit must use a proxy server to connect to the FDN. See To enable scheduled updates through a proxy server on page 234 for more information.

To configure FortiGuard options on the FortiGate unit on the internal network 1 2 3 4 Go to System > Maintenance > FortiGuard. Select the blue arrow to expand AntiVirus and IPS Options. Select Allow Push Update. Select Use override push IP.

236

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Maintenance

Enabling push updates

5 6

Enter the IP address of the external interface of the NAT device. UDP port 9943 is only changed if it is blocked or in use. Select Apply. You can add changes to the Use override push configuration if the external IP address of the external service port changes; select Apply to update the push information on the FDN. The FortiGate unit sends the override push IP address and port to the FDN. The FDN now uses this IP address and port for push updates to the FortiGate unit on the internal network. Push updates will not actually work until a virtual IP is added to the NAT device so that the NAT device accepts push update packets and forwards them to the FortiGate unit on the internal network. The following procedure enables you to configure the NAT device to use port forwarding to push update connections from the FDN to the FortiGate unit on the internal network. To add a port forwarding virtual IP to the FortiGate NAT device

1 2 3

Go to Firewall > Virtual IP. Select Create New. Enter the appropriate information for the following:
Name External Interface Type Enter a name for the Virtual IP. Select an external interface from the drop-down list. This is the interface on the NAT device that connects to the Internet. Select Static NAT. If you select Server Load Balance, additional options display. See Firewall Virtual IP on page 323 for more information. Enter the IP address and/or range. This is the IP address that the FDN connects to send push updates to the FortiGate unit on the Internal network. This would usually be the IP address of the external interface of the NAT device. This IP address must be the same as the User override push update IP for the FortiGate unit on the internal network. Enter the IP address and/or range of the FortiGate unit on the Internal network.

External IP Address/Range

Mapped IP Address/Range

Port Forwarding Select Port Forwarding. When you select Port Forwarding, the options Protocol, External Services Port and Map to Port appear. Protocol Select UDP. External Service Enter the external service port. The external service port is the port that the FDN connects to. The external service port for push updates Port is usually 9443. If you changed the push update port in the FortiGuard configuration of the FortiGate unit on the internal network, you must set the external service port to the changed push update port. Map to Port Select HTTP Multiplexing to enable the FortiGate unit to use its HTTP proxy to multiplex multiple client connections destined for the web server into fewer connections, improving performance. Preserve Client IP is available only when HTTP Multiplexing is selected. This preserves the IP address of the client in the XForwarded-For HTTP header.

Select OK. To add a firewall policy to the FortiGate NAT device

1 2

Go to Firewall > Policy. Select Create New.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

237

License

System Maintenance

3 4

Configure the external to internal firewall policy. Select OK. Verify that push updates to the FortiGate unit on the internal network are working by going to System > Maintenance > FortiGuard and select Test Availability. The Push Update indicator should change to green.

License
If you have a FortiGate-3000 unit or higher, you can purchase a license key from Fortinet to increase the maximum number of VDOMs to 25, 50, 100 or 250. By default, FortiGate units support a maximum of 10 VDOMs. The license key is a 32-character string supplied by Fortinet. Fortinet requires the serial number of the FortiGate unit to generate the license key. The license key is entered in System > Maintenance > License in the Input License Key field. This appears only on the FortiGate-3000 unit and higher. The following does not appear on any other FortiGate unit.
Figure 140:License key for additional VDOMs

Current License Input License Key

The current maximum number of Virtual Domains. Enter the license key supplied by Fortinet and select Apply.

Note: VDOMs created on a registered FortiGate unit are considered real devices by the FortiAnalyzer unit and the FortiAnalyzer unit includes VDOMs in the total number of registered devices. For example, three FortiGate units are registered on the FortiAnalyzer unit and contain four VDOMs: the total number of registered FortiGate units on the FortiAnalyzer unit is seven. See the FortiAnalyzer Administration Guide for more information.

238

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Chassis (FortiGate-5000 series)

SMC (shelf manager card)

System Chassis (FortiGate-5000 series)

For FortiGate-5000 series boards installed in a FortiGate-5050 or FortiGate-5140 chassis, you can go to System > Chassis to view real-time operating status information about the hardware components installed in the chassis. You can also use the get chassis status command to display similar chassis information from the FortiGate CLI. Information displayed by the system chassis pages and by the get chassis status command depends on the chassis and on the boards and modules installed in the chassis and not on the FortiGate-5000 board that you are connecting to.
Figure 141:FortiGate-5050 chassis showing the shelf manager and other components

CONSOLE

USB

8 STA IPM

FortiGate-5001SX boards slots 3, 4, and 5 FortiSwitch-5003 boards slots 1 and 2

5 4 3 2 1
ShMC

PWR ACC

CONSOLE PWR ACC

USB

8 STA IPM

CONSOLE PWR ACC

USB

8 STA IPM

14

12

10

CLK

E2

EXT FLT

POWER

MANAGEMENT

CONSOLE

SYSTEM

HOT SWAP

Hot-swappable cooling fan tray Power LED

MANAGEMENT

CONSOLE

SYSTEM

HOT SWAP

E T H O

R S 2 3 2

Z R E 0

Z R E 1

Z R E 2

INT FLT

OK

E1

E T H O

R S 2 3 2

Z R E 0

Z R E 1

Z R E 2

INT FLT

OK

E1

14

12

10

CLK

E2

EXT FLT

LED MODE

15

13

ZRE

RESET

11

LED MODE

15

13

ZRE

RESET

11

ShMC
Critical Major Hot Swap Status Console Ethernet Minor

Alarm

Alarm Reset

FortiGate-5050 Shelf Manager

ESD socket

The system chassis pages display information received from the chassis shelf manager, also called the Shelf Manager Card (SMC). To display information, at least one shelf manager must be functioning and the FortiGate-5000 board that you have connected to must be able to communicate with the functioning shelf manager. This section describes: SMC (shelf manager card) Blades (FortiGate-5000 chassis slots) Chassis monitoring event log messages

SMC (shelf manager card)

Go to System > Chassis > SMC to view the status of the shelf manager cards (SMCs) installed in the FortiGate-5000 series chassis. The SMC list is the same for the FortiGate-5140 chassis and the FortiGate-5050 chassis. The SMC list shows basic status information about the shelf manager cards in the chassis.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

239

Blades (FortiGate-5000 chassis slots)

System Chassis (FortiGate-5000 series)

Figure 142:Shelf manager card (SMC) list

Refresh interval Set how often the web-based manager refreshes the information displayed on the SMC list. Refresh SMC # Status Manually refresh the information displayed on the SMC list. Shelf manager card slot number: SMC 1 or SCM 2. Current status of the shelf manager card in each chassis slot. The status can be: Present if a shelf manager card is installed in the slot. Empty if a shelf manager card is not installed.

Active/Standby The mode of the shelf manager card in each chassis slot. Shelf managers can operate in active or standby mode. In active mode the shelf manager is operating the chassis. In standby mode the shelf manager is waiting to switch to active mode if it detects that the active shelf manager is not operating. If Status is Empty, active/standby is blank.

Blades (FortiGate-5000 chassis slots)

Go to System > Chassis > Blades to display a list of the slots in the FortiGate-5000 chassis that the FortiGate-5000 series board is installed in. The list of slots shows whether the slot is empty or contains a FortiGate-5000 board. If a slot contains a board, the display shows the type of board in the slot. Slots can contain node cards such as the FortiGate-5001SX board and switch cards such as the FortiSwitch-5003 board. The slot containing the FortiGate-5000 board that you are connecting to is highlighted in yellow. If the FortiGate-5000 series board that you are connecting to is installed in a FortiGate-5050 chassis, the blades list contains 5 rows. For a FortiGate-5140 chassis the blades list contains 14 rows. For each slot that contains a board, the blades list indicates if the monitored temperatures and voltages for the board in that slot are within acceptable ranges. If temperature and voltage indicate Good, the board is operating with acceptable ranges. If temperature or voltage indicate Alarm, the shelf manager has registered an alarm because a temperature or voltage is outside of the acceptable range. If you have SNMP enabled and have selected the Temperature too high and Voltage out of range SNMP events, when the shelf manager registers a temperature or voltage alarm, the FortiGate-5000 board SNMP agent sends an SNMP trap. For information about configuring SNMP, see SNMP on page 159.

240

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Chassis (FortiGate-5000 series)

Blades (FortiGate-5000 chassis slots)

Figure 143:Example FortiGate-5050 blades list

Refresh interval Refresh Slot #

Set how often the web-based manager refreshes the information displayed on the blades list. Manually refresh the information displayed on the blades list. The slot number in the chassis. The FortiGate-5050 contains 5 slots numbered 1 to 5. The FortiGate-5140 contains 14 slots numbered 1 to 14. Indicates whether the slot contains a node card (for example, a FortiGate-5001SX board) or a switch card (for example, a FortiSwitch-5003 board) or is empty. Indicates if the temperature sensors for the board in each slot are detecting a temperature within an acceptable range. Good indicates that all monitored temperatures are within acceptable ranges. Alarm indicates that a monitored temperature is too high (usually about 75C or higher) or too low (below 10C). You can mouse over the temperature indicator to view the temperatures being read by each sensor on the board. The mouse over display includes the name of the temperature sensor and the temperature reading. Each FortiGate or FortiSwitch board has its own hardware specific temperature senors. So the temperatures that are displayed are different for each FortiGate or FortiSwitch boards. For examples, see Example temperature displays on page 241. Indicates if the voltage sensors for the board in each slot are detecting a voltage within an acceptable range. Good indicates that all monitored voltages are within acceptable ranges. Alarm indicates that a monitored voltage is too high or too low. You can mouse over the voltage indicator for each slot to view the voltages being read by each sensor. The information displayed for each sensor includes the design voltage (for example 3.3V) and the actual measured voltage (for example, 3.288V). The acceptable voltage range depends on the sensor. Each FortiGate or FortiSwitch board has its own hardware specific voltage senors. So the voltages that are displayed are different for different FortiGate-5000 or FortiSwitch boards. For examples, see Example voltage displays on page 242.

Blade Type

Temperature

Voltage

Example temperature displays

Each FortiGate or FortiSwitch board has its own hardware specific temperature senors. So the temperatures that are displayed when you go to System > Chassis > Blades are different for each FortiGate or FortiSwitch boards. For example: For FortiGate-5005FA2 boards: Incoming Air-Flow: 37C CPU Board Temp: 49C CPU1 Temp: 65C CPU2 Temp: 66C

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

241

Blades (FortiGate-5000 chassis slots)

System Chassis (FortiGate-5000 series)

For FortiGate-5001SX and FortiGate-5001FA2 boards: TEMP1: 37C TEMP2: 30C For FortiSwitch-5003 boards: Baseboard Temp: 35C Board (BRD) Top Temp: 33C BRD Bottom Temp: 33C BRD Center Temp: 38C

Example voltage displays

Each FortiGate or FortiSwitch board has its own hardware specific voltage senors. So the voltages that are displayed are different for different FortiGate or FortiSwitch boards. For examples: For FortiGate-5005FA2 boards: CPU1 Voltage: 1.1956V CPU1 Voltage: 1.1858V +5.0V: 4.851V +3.3V: 3.321V +2.5V CPU 1: 2.5376V +2.5V CPU 2: 2.5498V +1.2V 1: 1.1956V +1.2V 2: 1.2054V For FortiGate-5001SX and FortiGate-5001FA2 boards: 5V: 5.0764V 3.3V: 3.4884V 2.5V: 2.534V 1.8V: 1.8236V 1.5V: 1.5326V For FortiSwitch-5003 boards: +1.5V: 1.521V +2V: 1.989V +2.5V: 2.4921V +3.3V: 3.3024V +3.3VSB: 3.3712V +5VSB: 5.096V +12V: 12.096V

242

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

System Chassis (FortiGate-5000 series)

Chassis monitoring event log messages

Chassis monitoring event log messages

FortiGate-5000 series boards can send the log messages shown in Table 34 when chassis monitoring detects temperatures, voltages, or fan speeds that are outside of normal operating parameters. The messages in Table 34 all have the chassis log type and a severity of warning or critical. Warning messages are recorded when non-critical thresholds are reached. Critical messages are recorded when critical thresholds are reached.
Table 34: Chassis monitoring warning and critical event log messages ID Message Meaning A chassis fan is operating at an RPM value outside of the normal operating range. <fan_integer> is the number of the fan tray. For the FortiGate-5140 <fan_integer> can be 0, 1, or 2. Fan tray 0 is on the left, 1 in the center, and 2 on the right. The FortiGate-5050 only has one fan tray. <rpm_integer> is the RPM at which the fan is operating. A temperature sensor has reported a temperature outside of the normal operating range for this sensor. A typical operating range is between 10 and 75 degrees Celsius. <temp_integer> identifies the temperature sensor. <temp_integer> is the temperature being reported by the sensor. A chassis voltage sensor has detected a voltage level outside of the operating range for the sensor. <design_voltage> is the voltage the circuit should have at the sensor location during normal operation. For example, <design_voltage> could be 3.3, 5, and so on. <monitored_voltage> is the actual voltage measure by the sensor. A blade fan is operating at an RPM value outside of the normal operating range. <fan_integer> identifies the fan. <rpm_integer> is the RPM at which the fan is operating. A temperature sensor on a FortiGate-5000 or FortiSwitch-5000 series board has reported a temperature outside of the normal operating range for this sensor. A typical operating range is between 10 and 75 degrees Celsius. <temp_integer> identifies the board temperature sensor. <temp_integer> is the temperature being reported by the sensor. A voltage sensor on a FortiGate-5000 or FortiSwitch-5000 series board has detected a voltage level outside of the operating range for the sensor. <design_voltage> is the voltage the circuit should have at the sensor location during normal operation. For example, <design_voltage> could be 3.3, 5, and so on. <monitored_voltage> is the actual voltage measure by the sensor.

99503 Chassis fan anomaly: Fan <fan_integer>, <rpm_integer> RPM Chassis fan anomaly

99504 Chassis temperature anomaly: T <sensor_integer>, <temp_integer> Celsius

99505 Chassis voltage anomaly: V<design_voltage>, <monitored_voltage> V

99506 Blade fan anomaly: Fan <fan_integer>, <rpm_integer> RPM 99507 Blade temperature anomaly: Blade <temp_integer>, <temp_integer> Celsius

99508 Blade voltage anomaly: Blade <design_voltage>, <monitored_voltage> V

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

243

Chassis monitoring event log messages

System Chassis (FortiGate-5000 series)

244

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Static

Routing concepts

Router Static
This section explains some general routing concepts, how to define static routes and route policies. A route provides the FortiGate unit with the information it needs to forward a packet to a particular destination on the network. A static route causes packets to be forwarded to a destination other than the factory configured default gateway. The factory configured static default route provides you with a starting point to configure the default gateway. You must either edit the factory configured static default route to specify a different default gateway for the FortiGate unit, or delete the factory configured route and specify your own static default route that points to the default gateway for the FortiGate unit. See Default route and default gateway on page 250. You define static routes manually. Static routes control traffic exiting the FortiGate unityou can specify through which interface the packet will leave and to which device the packet should be routed. As an option, you can define route policies. Route policies specify additional criteria for examining the properties of incoming packets. Using route policies, you can configure the FortiGate unit to route packets based on the IP source and/or destination addresses in packet headers and other criteria such as on which interface the packet was received and which protocol (service) and/or port is being used to transport the packet. This section describes: Routing concepts Static Route Policy Route

Routing concepts
The FortiGate unit works as a security device on a network and packets must pass through it. You need to understand a number of basic routing concepts in order to configure the FortiGate unit appropriately. Whether you administer a small or large network, this module will help you understand how the FortiGate unit performs routing functions. The following topics are covered in this section: How the routing table is built How routing decisions are made Multipath routing and determining the best routeRoute priority Route priority Equal Cost Multipath (ECMP) Routes Blackhole Routing

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

245

Routing concepts

Router Static

How the routing table is built

In the factory default configuration, the FortiGate routing table contains a single static default route. You can add routing information to the routing table by defining additional static routes. The table may include several different routes to the same destinationthe IP addresses of the next-hop router specified in those routes or the FortiGate interfaces associated with those routes may vary. The FortiGate unit selects the best route for a packet by evaluating the information in the routing table. The best route to a destination is typically associated with the shortest distance between the FortiGate unit and the closest next-hop router. In some cases, the next best route may be selected if the best route is unavailable for some reason. The best routes are installed in the FortiGate forwarding table, which is a subset of the FortiGate routing table. Packets are forwarded according to the information in the forwarding table.

How routing decisions are made

Whenever a packet arrives at one of the FortiGate units interfaces, the FortiGate unit determines whether the packet was received on a legitimate interface by doing a reverse lookup using the source IP address in the packet header. If the FortiGate unit cannot communicate with the computer at the source IP address through the interface on which the packet was received, the FortiGate unit drops the packet as it is likely a hacking attempt. If the destination address can be matched to a local address (and the local configuration permits delivery), the FortiGate unit delivers the packet to the local network. If the packet is destined for another network, the FortiGate unit forwards the packet to a next-hop router according to a route policy and/or the information stored in the FortiGate forwarding table. See Policy Route on page 253.

Multipath routing and determining the best route

Multipath routing occurs when more than one entry to the same destination is present in the routing table. When multipath routing happens, the FortiGate unit may have several possible destinations for an incoming packet, forcing the FortiGate unit to decide which next-hop is the best one. Two methods to manually resolve multiple routes to the same destination are to lower the administrative distance of one route or to set the priority of both routes. For the FortiGate unit to select a primary (preferred) route, manually lower the administrative distance associated with one of the possible routes. Administrative distance determines the priority of the available routes.

246

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Static

Routing concepts

Administrative distance can be from 1 to 255, with lower numbers being preferred. This weighting is based on how reliable a route is, and may be set by hand or by other routing protocols. For example if there are two possible routes traffic can take between 2 destinations with administration distances of 5 (always up) and 31 (sometimes not available), the traffic will use the route with 5 if it is available. Different routing protocols have different default administrative distances. These defaults are configurable.
Table 35: Default administrative distances for routing protocols Routing protocol Direct physical connection Static EBGP RIP OSPF IBGP Default administrative distance 1 10 20 110 120 200

Another method is to manually change the priority of both of the routes. If the next-hop administrative distances of two routes on the FortiGate unit are equal it may not be clear which route the packet will take. Configuring the priority for each of those routes will make it clear which next-hop will be used in the case of a tie. The priority for a route can only be set from the CLI. Lower priorities are preferred. For more information see the FortiOS CLI Reference. All entries in the routing table are associated with an administrative distance. If the routing table contains several entries that point to the same destination (the entries may have different gateways or interface associations), the FortiGate unit compares the administrative distances of those entries, selects the entries having the lowest distances, and installs them as routes in the FortiGate forwarding table. As a result, the FortiGate forwarding table only contains routes having the lowest distances to every possible destination. For information about how to change the administrative distance associated with a static route, see Adding a static route to the routing table on page 252.

Route priority
After the FortiGate unit selects static routes for the forwarding table based on their administrative distances, the priority field of those routes determines routing preference. The priority field is configured using the CLI. The route with the lowest value in the priority field is considered the best route. The best route is also the primary route. The command to set the priority field is: set priority <integer> under the config route static command. For more information see the FortiOS CLI Reference. In summary, because you can use the CLI to specify which sequence numbers or priority field settings to use when defining static routes, routes to the same destination can be prioritized according to their priority field settings. For a static route to be the preferred route, you must create the route using the config router static CLI command and specify a low priority for the route. If two routes are the same distance, and the same priority then they are equal cost multipath (ECMP) routes.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

247

Static Route

Router Static

Equal Cost Multipath (ECMP) Routes

When there is more than one route to the same destination, it can be confusing which route or routes will be installed and used. This is based on distance and priority, as explained in Multipath routing and determining the best route on page 246. If the distance of both routes is the same and both priorities are the same, then they are an Equal Cost Multipath (ECMP) route. If you have load balancing enabled with ECMP routes, then different sessions will use different routes to the same address to load balance traffic.

Blackhole Routing
Blackhole routing is a route that drops all traffic sent to it. It is very much like /dev/null in Linux programming. Blackhole routing is used to dispose of packets instead of responding to suspicious inquiries. This provides added security since the originator will not discover any information from the target system. Blackhole routing can also be used to limit traffic on a subnet. If some addresses are not in use, traffic to those addresses (traffic which may be valid or malicious) can be directed to a blackhole for added security and lowering traffic on the subnet. The loopback interface was added to enable easier configuration of blackhole routing. It is a virtual interface that does not forward traffic. It can only be configured from the CLI, the same way as a normal interface, but it has fewer parameters to configure and all traffic sent to it stops there. It does not suffer from hardware connection or link status problems, so it is always available. This can be useful for other dynamic routing roles. Once configured, a loopback interface can be used in firewall policies, routing, and other places that refer to interfaces. For more information see the system chapter of the FortiOS CLI Reference.

Static Route
You configure static routes by defining the destination IP address and netmask of packets that the FortiGate unit is intended to intercept, and specifying a (gateway) IP address for those packets. The gateway address specifies the next-hop router to which traffic will be routed.
Note: You can use the config router static6 CLI command to add, edit, or delete static routes for IPv6 traffic. For more information, see the router chapter of the FortiOS CLI Reference.

Working with static routes

The Static Route list displays information that the FortiGate unit compares to packet headers in order to route packets. Initially, the list contains the factory configured static default route. See Default route and default gateway on page 250. Additional entries can be added manually. When you add a static route to the Static Route list, the FortiGate unit evaluates the information to determine if it represents a different route compared to any other route already present in the FortiGate routing table. If no route having the same destination exists in the routing table, the FortiGate unit adds the route to the routing table.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

248

Router Static

Static Route

To edit an existing static route entry 1 2 3 4 Go to Router > Static > Static Route. Select the Edit icon beside the entry that you want to edit. Make the changes to the routing entry. Select OK to confirm and save your changes. When IPv6 is enabled in the GUI, IPv6 routes will be visible on the Static Route list. Otherwise, IPv6 routes will not be displayed. For more information on IPv6 see the System Admin chapter FortiGate IPv6 support on page 203.
Note: Unless otherwise specified, static route examples and procedures are for IPv4 static routes.

Figure 144 shows the static route list belonging to a FortiGate unit that has interfaces named port1 and port2. The names of the interfaces on your FortiGate unit may be different.
Figure 144:Static Route list when IPv6 is enabled in the GUI

Delete Edit Create New Select Create New to add a static route to the Static Route list. See Adding a static route to the routing table on page 252. Select the down arrow to select create a static IPv6 Route. Select the twistie to display or hide the IPv4 static routes. By default this is displayed. This is only displayed when IPv6 is enabled in the GUI. Select the twistie to display or hide the IPv6 static routes. By default this is hidden. This is only displayed when IPv6 is enabled in the GUI. The destination IP addresses of packets that the FortiGate unit intercepts. The network masks associated with the IP addresses. The IP addresses of the next-hop routers to which intercepted packets are forwarded. The names of the FortiGate interfaces through which intercepted packets are received and sent. The administrative distances associated with each route. The values represent distances to next-hop routers. Delete or edit an entry in the list.

Route

IPv6 Route

IP Mask Gateway Device Distance Delete and Edit icons

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

249

Static Route

Router Static

Default route and default gateway

In the factory default configuration, entry number 1 in the Static Route list is associated with a destination address of 0.0.0.0/0.0.0.0, which means any/all destinations. This route is called the static default route. If no other routes are present in the routing table and a packet needs to be forwarded beyond the FortiGate unit, the factory configured static default route causes the FortiGate unit to forward the packet to the default gateway. To prevent this you must either edit the factory configured static default route to specify a different default gateway for the FortiGate unit, or delete the factory configured route and specify your own static default route that points to the default gateway for the FortiGate unit.
Note: For network traffic to pass, even with the correct routes configured, you must have the appropriate firewall policies. For details see Configuring firewall policies on page 285.

For example, Figure 145, shows a FortiGate unit connected to a router. To ensure that all outbound packets destined to any network beyond the router are routed to the correct destination, you must edit the factory default configuration and make the router the default gateway for the FortiGate unit.
Figure 145:Making a router the default gateway

Internet

Gateway Router 192.168.10.1

external

FortiGate_1
internal

Internal network 192.168.20.0/24

To route outbound packets from the internal network to destinations that are not on network 192.168.20.0/24, you would edit the default route and include the following settings: Destination IP/mask: 0.0.0.0/0.0.0.0 Gateway: 192.168.10.1 Device: Name of the interface connected to network 192.168.10.0/24 (for example, external). Distance: 10
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

250

Router Static

Static Route

The Gateway setting specifies the IP address of the next hop router interface to the FortiGate external interface. The interface behind the router (192.168.10.1) is the default gateway for FortiGate_1. In some cases, there may be routers behind the FortiGate unit. If the destination IP address of a packet is not on the local network but is on a network behind one of those routers, the FortiGate routing table must include a static route to that network. For example, in Figure 146, the FortiGate unit must be configured with static routes to interfaces 192.168.10.1 and 192.168.11.1 in order to forward packets to Network_1 and Network_2 respectively.
Figure 146:Destinations on networks behind internal routers

Internet

FortiGate_1
internal Gateway / Router_1 192.168.10.1 192.168.11.1 dmz Gateway / Router_2

Network_1 192.168.20.0/24

Network_2 192.168.30.0/24

To route packets from Network_1 to Network_2, Router_1 must be configured to use the FortiGate internal interface as its default gateway. On the FortiGate unit, you would create a new static route with these settings: Destination IP/mask: 192.168.30.0/24 Gateway: 192.168.11.1 Device: dmz Distance: 10 To route packets from Network_2 to Network_1, Router_2 must be configured to use the FortiGate dmz interface as its default gateway. On the FortiGate unit, you would create a new static route with these settings: Destination IP/mask: 192.168.20.0/24 Gateway: 192.168.10.1 Device: internal Distance: 10

Changing the gateway for the default route

The default gateway determines where packets matching the default route will be forwarded.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

251

Static Route

Router Static

To change the gateway for the default route 1 2 3 Go to Router > Static > Static Route. Select the Edit icon in row 1. If the FortiGate unit reaches the next-hop router through a different interface (compared to the interface that is currently selected in the Device field), select the name of the interface from the Device field. In the Gateway field, type the IP address of the next-hop router to which outbound traffic may be directed. In the Distance field, optionally adjust the administrative distance value. Select OK.

4 5 6

Adding a static route to the routing table

A route provides the FortiGate unit with the information it needs to forward a packet to a particular destination. A static route causes packets to be forwarded to a destination other than the default gateway. You define static routes manually. Static routes control traffic exiting the FortiGate unityou can specify through which interface the packet will leave and to which device the packet should be routed. To add a static route entry 1 2 3 4 5 6 Go to Router > Static > Static Route. Select Create New. Enter the IP address and netmask. For example 172.1.2.0/255.255.255.0 would be a route for all addresses on the subnet 172.1.2.x . Enter the FortiGate unit interface closest or connected to this subnet. Enter the gateway IP address. Continuing with the example 172.1.2.3 would be a valid address. Enter the administrative distance of this route. The administrative distance allows you to weight one route to be preferred over another. This is useful when one route is unreliable. 7 Select OK to confirm and save your new static route. When you add a static route through the web-based manager, the FortiGate unit assigns the next unassigned sequence number to the route automatically and adds the entry to the Static Route list. Figure 147 shows the Edit Static Route dialog box belonging to a FortiGate unit that has an interface named internal. The names of the interfaces on your FortiGate unit may be different.
Figure 147:Edit Static Route

252

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Static

Policy Route

Destination IP/Mask Gateway Device Distance

Type the destination IP address and network mask of packets that the FortiGate unit has to intercept. The value 0.0.0.0/0.0.0.0 is reserved for the default route. Type the IP address of the next-hop router to which the FortiGate unit will forward intercepted packets. Select the name of the FortiGate interface through which the intercepted packets may be routed to the next-hop router. Type an administrative distance for the route. The distance value is arbitrary and should reflect the distance to the next-hop router. A lower value indicates a more preferred route. The value can be an integer from 1 to 255.

Policy Route
A routing policy allows you to bend traffic away from a static route. This can be useful if you want certain types of network traffic to be routed differently. You can use incoming traffics protocol, source address or interface, destination address, or port number to determine where to send the traffic. For example generally network traffic would go to the router of a subnet, but you might want to direct SMTP or POP3 traffic addressed to that subnet directly to the mail server. When routing policies exist and a packet arrives at the FortiGate unit, the FortiGate unit starts at the top of the Policy Route list and attempts to match the packet with a policy. If a match is found and the policy contains enough information to route the packet (the IP address of the next-hop router must be specified as well as the FortiGate interface for forwarding packets to the next-hop router), the FortiGate unit routes the packet using the information in the policy. If no route policy matches the packet, the FortiGate unit routes the packet using the routing table.
Note: Because most policy settings are optional, a matching policy alone might not provide enough information for the FortiGate unit to forward the packet. The FortiGate unit may refer to the routing table in an attempt to match the information in the packet header with a route in the routing table. For example, if the outgoing interface is the only item given in the policy, the FortiGate unit looks up the IP address of the next-hop router in the routing table. This situation could happen when the FortiGate interfaces are dynamic (the interface receives an IP address through DHCP or PPPoE) and you do not want or are unable to specify the IP address of the next-hop router because the IP address changes dynamically.

Policy route options define which attributes of a incoming packet cause policy routing to occur. If the attributes of a packet match all the specified conditions, the FortiGate unit routes the packet through the specified interface to the specified gateway. Figure 148 shows the policy route list belonging to a FortiGate unit that has interfaces named external and internal. The names of the interfaces on your FortiGate unit may be different.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

253

Policy Route

Router Static

Figure 148:Policy Route list

Delete Edit Move To

Create New Add a route policy. See Adding a policy route on page 254. # Incoming Outgoing Source The ID numbers of configured route policies. These numbers are sequential unless policies have been moved within the table. The interfaces on which packets subjected to route policies are received. The interfaces through which policy routed packets are routed. The IP source addresses and network masks that cause policy routing to occur.

Destination The IP destination addresses and network masks that cause policy routing to occur. Delete icon Select to delete a policy route. Edit icon Move To icon Select to edit a policy route. Select to move policy route up or down in the policy route table. Selecting this icon will bring up the Move Policy Route screen where you can specify the new location in the Policy Route table. See Moving a route policy.

To edit an existing route policy 1 2 3 Go to Router > Static > Policy Route. Select the Edit icon beside the policy that you want to edit. Enter the incoming details. Enter the protocol number. For example HTTP

Adding a policy route

To add a route policy, go to Router > Static > Policy Route and select Create New. Figure 149 shows the New Routing Policy dialog box belonging to a FortiGate unit that has interfaces named external and internal. The names of the interfaces on your FortiGate unit may be different.
Figure 149:New Routing Policy

254

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Static

Policy Route

Protocol

To perform policy routing based on the value in the protocol field of the packet, type the protocol number to match. The range is from 0 to 255. A value of 0 disables the feature.

Incoming Interface Select the name of the interface through which incoming packets subjected to the policy are received. Source Address / Mask Destination Address / Mask Destination Ports To perform policy routing based on the IP source address of the packet, type the source address and network mask to match. A value of 0.0.0.0/0.0.0.0 disables the feature. To perform policy routing based on the IP destination address of the packet, type the destination address and network mask to match. A value of 0.0.0.0/0.0.0.0 disables the feature. To perform policy routing based on the port on which the packet is received, type the same port number in the From and To fields. If you want policy routing to apply to a range of ports, type the starting port number in the From field and the ending port number in the To field. A value of zero disables this feature.

Outgoing Interface Select the name of the interface through which packets affected by the policy will be routed. Gateway Address Type the IP address of the next-hop router that the FortiGate unit can access through the specified interface. A value of 0.0.0.0 is not valid.

Moving a route policy

A routing policy is added to the bottom of the routing table when it is created. If you want one policy to be used in preference to another, you may want to move it to a different location in the routing policy table. The option to use one of two routes happens when both routes are a match, say 172.20.0.0/255.255.0.0 and 172.20.120.0/255.255.255.0. If both of these routes are in the policy table, both can match a route to 172.20.120.112 but the second one is a better match. In that case the best match route should be positioned before the other route in the policy table. Using the CLI, you can assign priorities to routes. In the case of two matches in the routing table, the priority will determine which route is used. This feature is only available through the CLI. For details, see FortiOS CLI Reference.
Figure 150:Move Policy Route

Before / After

Select before to place the selected Policy Route before the indicated route. Select After to place it following the indicated route. Enter the Policy route ID of the route in the Policy route table to move the selected route before or after.

Policy route ID

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

255

Policy Route

Router Static

256

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

RIP

Router Dynamic
This section explains how to configure dynamic protocols to route traffic through large or complex networks. Dynamic routing protocols enable the FortiGate unit to automatically share information about routes with neighboring routers and learn about routes and networks advertised by neighboring routers. The FortiGate unit supports these dynamic routing protocols: Routing Information Protocol (RIP) Open Shortest Path First (OSPF) Border Gateway Protocol (BGP)

Note: Basic RIP, OSPF, and BGP routing options can be configured through the web-based manager. Many additional options may be configured through CLI commands only. For complete descriptions and examples of how to use CLI commands to configure RIP, OSPF, and BGP settings, see the router chapter of FortiOS CLI Reference.

The FortiGate unit selects routes and updates its routing table dynamically based on the rules you specify. Given a set of rules, the FortiGate unit can determine the best route or path for sending packets to a destination. You can also define rules to suppress the advertising of routes to neighboring routers and/or change FortiGate routing information before it is advertised.
Note: A FortiGate unit can operate as a Protocol Independent Multicast (PIM) version 2 router in the root virtual domain. FortiGate units support PIM sparse mode and dense mode and can service multicast servers or receivers on the network segment to which a FortiGate interface is connected. PIM can use static routes, RIP, OSPF, or BGP to forward multicast packets to their destinations.

Bi-Directional Forwarding (BFD) is a protocol that works with BGP and OSPF to quickly discover routers on the network that can not be contacted, and re-route traffic accordingly until those routers can be contacted. Multi Protocol Label Switching (MPLS) is a protocol that attaches labels to the header of packets for improved routing. This section describes: RIP OSPF BGP Multicast Bi-directional Forwarding Detection (BFD)

RIP
RIP is a distance-vector routing protocol intended for small, relatively homogeneous networks. The FortiGate implementation of RIP supports RIP version 1 (see RFC 1058) and RIP version 2 (see RFC 2453).

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

257

RIP

Router Dynamic

How RIP works

When RIP is enabled, the FortiGate unit broadcasts requests for RIP updates from each of its RIP-enabled interfaces. Neighboring routers respond with information from their routing tables. The FortiGate unit adds routes from neighbors to its own routing table only if those routes are not already recorded in the routing table. When a route already exists in the routing table, the FortiGate unit compares the advertised route to the recorded route and chooses the shortest route for the routing table. RIP uses hop count as the metric for choosing the best route. A hop count of 1 represents a network that is connected directly to the FortiGate unit, while a hop count of 16 represents a network that the FortiGate unit cannot reach. Each network that a packet travels through to reach its destination usually counts as one hop. When the FortiGate unit compares two routes to the same destination, the route having the lowest hop count is added to the routing table. Similarly, when RIP is enabled on an interface, the FortiGate unit sends RIP responses to neighboring routers on a regular basis. The updates provide information about the routes in the FortiGate routing table, subject to the rules that you specify for advertising those routes. You can specify how often the FortiGate unit sends updates, how long a route can be kept in the FortiGate routing table without being updated, and for routes that are not updated regularly, how long the FortiGate unit advertises the route as unreachable before it is removed from the FortiGate routing table.

Viewing and editing basic RIP settings

When you configure RIP settings, you have to specify the networks that are running RIP and specify any additional settings needed to adjust RIP operation on the FortiGate interfaces that are connected to the RIP-enabled network. Figure 151 shows the basic RIP settings on a FortiGate unit that has interfaces named dmz and external. The names of the interfaces on your FortiGate unit may be different.
Figure 151:Basic RIP settings

Delete

Delete Edit

258

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

RIP

RIP Version

Select the level of RIP compatibility needed at the FortiGate unit. You can enable global RIP settings on all FortiGate interfaces connected to RIPenabled networks: Select 1 to send and receive RIP version 1 packets. Select 2 to send and receive RIP version 2 packets. You can override the global settings for a specific FortiGate interface if required (see Overriding the RIP operating parameters on an interface on page 261). Select advanced RIP options. See Selecting advanced RIP options on page 260. The IP addresses and network masks of the major networks (connected to the FortiGate unit) that run RIP. When you add a network to the Networks list, the FortiGate interfaces that are part of the network are advertised in RIP updates. You can enable RIP on all FortiGate interfaces whose IP addresses match the RIP network address space. IP/Netmask Add Enter the IP address and netmask that defines the RIPenabled network. Select to add the network information to the Networks list.

Advanced Options Networks

Interfaces

Any additional settings needed to adjust RIP operation on a FortiGate interface. Create New Select to configure RIP operating parameters for an interface. These parameters will override the global RIP settings for that interface. See Overriding the RIP operating parameters on an interface on page 261. Select the interface to configure RIP operating parameters for. Select the version of RIP used to send updates through each interface: 1, 2, or both.

Interface Send Version

Receive Version Select the versions of RIP used to listen for updates on each interface: 1, 2, or both. Authentication Passive Delete and Edit icons Select the type of authentication used on this interface: None, Text or MD5. Select to block RIP broadcasts on this interface

Delete or edit a RIP network entry or a RIP interface definition.

To edit the operating parameters of a RIP-enabled interface 1 2 3 4 5 6 7 Go to Router > Dynamic > RIP. Select the Edit icon in the row that corresponds to the RIP-enabled interface. Select the interface. Select the send and receive RIP versions. Select the level of authentication. Optionally select passive. Select OK to save your choices and return to Router > Dynamic > RIP.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

259

RIP

Router Dynamic

Selecting advanced RIP options

Advanced RIP options let you specify settings for RIP timers and define metrics for redistributing routes that the FortiGate unit learns through some means other than RIP updates. For example, if the FortiGate unit is connected to an OSPF or BGP network or you add a static route to the FortiGate routing table manually, you can configure the FortiGate unit to advertise those routes on RIP-enabled interfaces. To select advanced RIP options, go to Router > Dynamic > RIP and expand Advanced Options. After you select the options, select Apply.
Note: Additional advanced options can be configured through the CLI. For example, you can filter incoming or outgoing updates using a route map, an access list, or a prefix list. The FortiGate unit also supports offset lists, which add the specified offset to the metric of a route. For more information, see the router chapter of the FortiOS CLI Reference. Figure 152:Advanced Options (RIP)

Default Metric

Enter the default hop count that the FortiGate unit should assign to routes that are added to the Fortinet routing table. The range is from 1 to 16. This metric is the hop count, with 1 being best or shortest. This value also applies to Redistribute unless otherwise specified.

Enable DefaultSelect to generate and unconditionally advertise a default route information-originate into the FortiGate units RIP-enabled networks. The generated route may be based on routes learned through a dynamic routing protocol, routes in the routing table or both. RIP Timers Override the default RIP timer settings. The default settings are effective in most configurations if you change these settings, take care to ensure that the new settings are compatible with local routers and access servers. Update Enter the amount of time (in seconds) that the FortiGate unit will wait between sending RIP updates. Enter the maximum amount of time (in seconds) that a route is considered reachable while no updates are received for the route. This is the maximum time the FortiGate unit will keep a reachable route in the routing table while no updates for that route are received. If the FortiGate unit receives an update for the route before the timeout period expires, the timer is restarted. The Timeout period should be at least three times longer than the Update period.

Timeout

260

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

RIP

Garbage

Enter the amount of time (in seconds) that the FortiGate unit will advertise a route as being unreachable before deleting the route from the routing table. The value determines how long an unreachable route is kept in the routing table.

Redistribute

Enable or disable RIP updates about routes that were not learned through RIP. The FortiGate unit can use RIP to redistribute routes learned from directly connected networks, static routes, OSPF, and/or BGP. Connected Select to redistribute routes learned from directly connected networks. If you want to specify a hop count for those routes, select Metric, and in the Metric field, enter the hop count. The range is from 1 to 16. Static Select to redistribute routes learned from static routes. If you want to specify a hop count for those routes, select Metric, and in the Metric field, enter the hop count. The range is from 1 to 16. Select to redistribute routes learned through OSPF. If you want to specify a hop count for those routes, select Metric, and in the Metric field, enter the hop count. The range is from 1 to 16. Select to redistribute routes learned through BGP. If you want to specify a hop count for those routes, select Metric, and in the Metric field, enter the hop count. The range is from 1 to 16.

OSPF

BGP

Overriding the RIP operating parameters on an interface

RIP interface options enable you to override the global RIP settings that apply to all Fortinet interfaces connected to RIP-enabled networks. For example, if you want to suppress RIP advertising on an interface that is connected to a subnet of a RIP-enabled network, you can enable the interface to operate passively. Passive interfaces listen for RIP updates but do not respond to RIP requests. If RIP version 2 is enabled on the interface, you can optionally choose password authentication to ensure that the FortiGate unit authenticates a neighboring router before accepting updates from that router. The FortiGate unit and the neighboring router must both be configured with the same password. Authentication guarantees the authenticity of the update packet, not the confidentiality of the routing information in the packet. To set specific RIP operating parameters for a RIP-enabled interface, go to Router > Dynamic > RIP and select Create New.
Note: Additional options such as split-horizon and key-chain settings can be configured per interface through the CLI. For more information, see the router chapter of the FortiOS CLI Reference.

Figure 153 shows the New/Edit RIP Interface dialog box belonging to a FortiGate unit that has an interface named internal. The names of the interfaces on your FortiGate unit may be different.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

261

OSPF

Router Dynamic

Figure 153:New/Edit RIP Interface

Interface

Select the name of the FortiGate interface to which these settings apply. The interface must be connected to a RIP-enabled network. The interface can be a virtual IPSec or GRE interface. Select to override the default RIP-compatibility setting for sending and receiving updates through the interface: RIP version 1, version 2 or Both. Select an authentication method for RIP exchanges on the specified interface: Select None to disable authentication. If the interface is connected to a network that runs RIP version 2, optionally select Text and type a password (up to 35 characters) in the Password field. The FortiGate unit and the RIP updates router must both be configured with the same password. The password is sent in clear text over the network. Select MD5 to authenticate the exchange using MD5. Select to suppress the advertising of FortiGate routing information through the specified interface. For the interface to respond to RIP requests, clear Passive Interface.

Send Version, Receive Version Authentication

Passive Interface

OSPF
Open shortest path first (OSPF) is a link-state routing protocol that is most often used in large heterogeneous networks to share routing information among routers in the same Autonomous System (AS). FortiGate units support OSPF version 2 (see RFC 2328).

How OSPF autonomous systems work

An OSPF autonomous system (AS) is typically divided into logical areas linked by area border routers. A group of contiguous networks form an area. An area border router (ABR) links one or more areas to the OSPF network backbone (area ID 0). To specify the characteristics of an OSPF AS, see Defining an OSPF AS on page 263. When the FortiGate unit has an interface connected to an OSPF area, it can participate in OSPF communications. The FortiGate unit uses the OSPF Hello protocol to acquire neighbors in an area. A neighbor is any router that has an interface to the same area as the FortiGate unit. After initial contact, the FortiGate unit exchanges Hello packets with its OSPF neighbors regularly to confirm that the neighbors can be reached.

262

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

OSPF

OSPF-enabled routers generate Link-State Advertisements (LSA) and send them to their neighbors whenever the status of a neighbor changes or a new neighbor comes online. As long as the OSPF network is stable, LSAs between OSPF neighbors do not occur. An LSA identifies the interfaces of all OSPF-enabled routers in an area, and provides information that enables OSPF-enabled routers to select the shortest path to a destination. All LSA exchanges between OSPFenabled routers are authenticated. The FortiGate unit maintains a database of link-state information based on the advertisements that it receives from OSPF-enabled routers. To calculate the best route (shortest path) to a destination, the FortiGate unit applies the Shortest Path First (SPF) algorithm to the accumulated link-state information. OSPF uses relative cost as a basic metric for choosing the best route. Cost imposes a penalty on the outgoing direction of a FortiGate interface. The cost of a route is calculated by adding together all of the costs associated with the outgoing interfaces along the path to a destination. The lowest overall cost indicates the best route.
Note: The inter-area routes may not be calculated when a Cisco type ABR has no fully adjacent neighbor in the backbone area. In this situation, the router considers summaryLSAs from all Actively summary-LSAs from all Actively Attached areas (RFC 3509).

The FortiGate unit dynamically updates its routing table based on the results of the SPF calculation to ensure that an OSPF packet will be routed using the shortest path to its destination. Depending on the network topology, the entries in the FortiGate routing table may include: the addresses of networks in the local OSPF area (to which packets are sent directly) routes to OSPF area border routers (to which packets destined for another area are sent) if the network contains OSPF areas and non-OSPF domains, routes to AS boundary routers, which reside on the OSPF network backbone and are configured to forward packets to destinations outside the OSPF AS

The number of routes that a FortiGate unit can learn through OSPF depends on the network topology. A single FortiGate unit can support tens of thousands of routes if the OSPF network is configured properly.

Defining an OSPF AS
Defining an OSPF autonomous system (AS), involves: Defining the characteristics of one or more OSPF areas. Creating associations between the OSPF areas that you defined and the local networks to include in the OSPF AS. If required, adjusting the settings of OSPF-enabled interfaces.

For more information about how to perform these tasks using the web-based manager, follow the procedure given below. To define an OSPF AS 1 2 3 Go to Router > Dynamic > OSPF. Under Areas, select Create New. Define the characteristics of one or more OSPF areas. See Defining OSPF areas on page 267.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

263

OSPF

Router Dynamic

4 5

Under Networks, select Create New. Create associations between the OSPF areas that you defined and the local networks to include in the OSPF AS. See Specifying OSPF networks on page 268. If you need to adjust the default settings of an OSPF-enabled interface, select Create New under Interfaces. Select the OSPF operating parameters for the interface. See Selecting operating parameters for an OSPF interface on page 269. Repeat Steps 6 and 7 if required for additional OSPF-enabled interfaces. Optionally select advanced OSPF options for the OSPF AS. See Selecting advanced OSPF options on page 266. Select Apply.

6 7 8 9 10

Viewing and editing basic OSPF settings

When you configure OSPF settings, you have to define the AS in which OSPF is enabled and specify which of the FortiGate interfaces participate in the AS. As part of the AS definition, you specify the AS areas and specify which networks to include those areas. You may optionally adjust the settings associated with OSPF operation on the FortiGate interfaces. To view and edit OSPF settings, go to Router > Dynamic > OSPF. Figure 154 shows the basic OSPF settings on a FortiGate unit that has an interface named port1. The names of the interfaces on your FortiGate unit may be different.
Figure 154:Basic OSPF settings

Router ID

Enter a unique router ID to identify the FortiGate unit to other OSPF routers. By convention, the router ID is the numerically highest IP address assigned to any of the FortiGate interfaces in the OSPF AS. Do not change the router ID while OSPF is running. Select advanced OSPF settings. See Selecting advanced OSPF options on page 266.

Advanced Options

264

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

OSPF

Areas

Information about the areas making up an OSPF AS. The header of an OSPF packet contains an area ID, which helps to identify the origination of a packet inside the AS. Create New Area Select to define an OSPF area and add the new area to the Areas list. See Defining OSPF areas on page 267. The unique 32-bit identifiers of areas in the AS, in dotted decimal notation. Area ID 0.0.0.0 references the backbone of the AS and cannot be changed or deleted. The types of areas in the AS: If an area is a normal OSPF area, Regular is displayed. If an area is not so stubby, NSSA is displayed. If an area is a stub, Stub is displayed. For more information, see Defining OSPF areas on page 267. Authentication The methods for authenticating OSPF packets sent and received through all FortiGate interfaces linked to each area: When authentication is disabled, None is displayed. When text-based password authentication is enabled, Text is displayed.

Type

When MD5 authentication is enabled, MD5 is displayed. A different authentication setting may apply to some of the interfaces in an area, as displayed under Interfaces. For example, if an area employs simple passwords for authentication, you can configure a different password for one or more of the networks in that area.

Networks

The networks in the OSPF AS and their area IDs. When you add a network to the Networks list, all FortiGate interfaces that are part of the network are advertised in OSPF link-state advertisements. You can enable OSPF on all FortiGate interfaces whose IP addresses match the OSPF network address space. Create New Select to add a network to the AS, specify its area ID, and add the definition to the Networks list. See Specifying OSPF networks on page 268. The IP addresses and network masks of networks in the AS on which OSPF runs. The FortiGate unit may have physical or VLAN interfaces connected to the network. The area IDs that have been assigned to the OSPF network address space.

Network

Area Interfaces

Any additional settings needed to adjust OSPF operation on a FortiGate interface. Create New Select to add additional/different OSPF operating parameters for a FortiGate interface and add the configuration to the Interfaces list. See Selecting operating parameters for an OSPF interface on page 269. The names of OSPF interface definitions. The names of FortiGate physical or VLAN interfaces having OSPF settings that differ from the default values assigned to all other interfaces in the same area. The IP addresses of the OSPF-enabled interfaces having additional/different settings.

Name Interface

IP

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

265

OSPF

Router Dynamic

Authentication The methods for authenticating LSA exchanges sent and received on specific OSPF-enabled interfaces. These settings override the area Authentication settings. Delete and Select to delete or edit an OSPF area entry, network entry, or interface Edit icons definition.

Selecting advanced OSPF options

Advanced OSPF options let you specify metrics for redistributing routes that the FortiGate unit learns through some means other than OSPF link-state advertisements. For example, if the FortiGate unit is connected to a RIP or BGP network or you add a static route to the FortiGate routing table manually, you can configure the FortiGate unit to advertise those routes on OSPF-enabled interfaces. To select advanced RIP options, go to Router > Dynamic > RIP and expand Advanced Options. After you select the options, select Apply.
Figure 155:Advanced Options (OSPF)

Default Information

Generate and advertise a default (external) route to the OSPF AS. The generated route may be based on routes learned through a dynamic routing protocol, or routes in the routing table, or both. None Regular Disable the generation of a default route. Generate a default route into the OSPF AS and advertise the route to neighboring autonomous systems only if the route is stored in the FortiGate routing table. Generate a default route into the OSPF AS and advertise the route to neighboring autonomous systems unconditionally, even if the route is not stored in the FortiGate routing table.

Always

Redistribute

Enable or disable OSPF link-state advertisements about routes that were not learned through OSPF. The FortiGate unit can use OSPF to redistribute routes learned from directly connected networks, static routes, RIP, and/or BGP. Connected Select to redistribute routes learned from directly connected networks. If you want to specify a cost for those routes, enter the cost in the Metric field. The range is from 1 to 16 777 214. Static Select to redistribute routes learned from static routes. If you want to specify a cost for those routes, enter the cost in the Metric field. The range is from 1 to 16 777 214.

266

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

OSPF

RIP

Select to redistribute routes learned through RIP. If you want to specify a cost for those routes, enter the cost in the Metric field. The range is from 1 to 16 777 214. Select to redistribute routes learned through BGP. If you want to specify a cost for those routes, enter the cost in the Metric field. The range is from 1 to 16 777 214.

BGP

Note: Many additional advanced OSPF options can be configured through the CLI. For details, see the router chapter of the FortiOS CLI Reference.

Defining OSPF areas

An area logically defines part of the OSPF AS. Each area is identified by a 32-bit area ID expressed in decimal dot notation. Area ID 0.0.0.0 is reserved for the OSPF network backbone. You can classify the remaining areas of an AS in one of three ways: Regular Stub NSSA

A regular area contains more than one router, each having at least one OSPFenabled interface to the area. To reach the OSPF backbone, the routers in a stub area must send packets to an area border router. Routes leading to non-OSPF domains are not advertised to the routers in stub areas. The area border router advertises to the OSPF AS a single default route (destination 0.0.0.0) into the stub area, which ensures that any OSPF packet that cannot be matched to a specific route will match the default route. Any router connected to a stub area is considered part of the stub area. In a Not-So-Stubby Area (NSSA), routes that lead out of the area into a nonOSPF domain are made known to OSPF AS. However, the area itself continues to be treated like a stub area by the rest of the AS. Regular areas and stub areas (including not-so-stubby areas) are connected to the OSPF backbone through area border routers. To define an OSPF area, go to Router > Dynamic > OSPF, and then under Areas, select Create New. To edit the attributes of an OSPF area, go to Router > Dynamic > OSPF and select the Edit icon in the row that corresponds to the area.
Note: If required, you can define a virtual link to an area that has lost its physical connection to the OSPF backbone. Virtual links can only be set up between two FortiGate units that act as area border routers. For more information, see config virtual-link under the OSPF config area subcommand in the FortiOS CLI Reference. Figure 156:New/Edit OSPF Area

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

267

OSPF

Router Dynamic

Area

Type a 32-bit identifier for the area. The value must resemble an IP address in decimal-dot notation. Once the OSPF area has been created, the area IP value cannot be changed. Select an area type to classify the characteristics of the network that will be assigned to the area: Select Regular if the area contains more than one router, each having at least one OSPF-enabled interface to the area. Select NSSA if you want routes to external non-OSPF domains made known to OSPF AS and you want the area to be treated like a stub area by the rest of the AS. Select STUB if the routers in the area must send packets to an area border router in order to reach the backbone and you do not want routes to non-OSPF domains to be advertised to the routers in the area.

Type

Authentication Select the method for authenticating OSPF packets sent and received through all interfaces in the area: Select None to disable authentication. Select Text to enable text-based password authentication. to authenticate LSA exchanges using a plain-text password. The password is sent in clear text over the network.

Select MD5 to enable MD5 authentication using an MD5 hash. If required, you can override this setting for one or more of the interfaces in the area (see Selecting operating parameters for an OSPF interface on page 269).

Note: To assign a network to the area, see Specifying OSPF networks on page 268.

Specifying OSPF networks

OSPF areas group a number of contiguous networks together. When you assign an area ID to a network address space, the attributes of the area are associated with the network. To assign an OSPF area ID to a network, go to Router > Dynamic > OSPF, and then under Networks, select Create New. To change the OSPF area ID assigned to a network, go to Router > Dynamic > OSPF and select the Edit icon in the row that corresponds to the network.
Figure 157:New/Edit OSPF Network

IP/Netmask Area

Enter the IP address and network mask of the local network that you want to assign to an OSPF area. Select an area ID for the network. The attributes of the area must match the characteristics and topology of the specified network. You must define the area before you can select the area ID. See Defining OSPF areas on page 267.

268

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

OSPF

Selecting operating parameters for an OSPF interface

An OSPF interface definition contains specific operating parameters for a FortiGate OSPF-enabled interface. The definition includes the name of the interface (for example, external or VLAN_1), the IP address assigned to the interface, the method for authenticating LSA exchanges through the interface, and timer settings for sending and receiving OSPF Hello and dead-interval packets. You can enable OSPF on all FortiGate interfaces whose IP addresses match the OSPF-enabled network space. For example, define an area of 0.0.0.0 and the OSPF network is defined as 10.0.0.0/16. Then define vlan1 as 10.0.1.1/24, vlan2 as 10.0.2.1/24 and vlan3 as 10.0.3.1/24. All three VLANs can run OSPF in area 0.0.0.0. To enable all interfaces, you would create an OSPF network 0.0.0.0/0 . You can configure different OSPF parameters for the same FortiGate interface when more than one IP address has been assigned to the interface. For example, the same FortiGate interface could be connected to two neighbors through different subnets. You could configure an OSPF interface definition containing one set of Hello and dead-interval parameters for compatibility with one neighbors settings, and a second OSPF interface definition for the same interface to ensure compatibility with the second neighbors settings. To select OSPF operating parameters for a FortiGate interface, go to Router > Dynamic > OSPF, and then under Interfaces, select Create New. To edit the operating parameters of an OSPF-enabled interface, go to Router > Dynamic > OSPF and select the Edit icon in the row that corresponds to the OSPF-enabled interface. Figure 158 shows the New/Edit OSPF Interface dialog box belonging to a FortiGate unit that has an interface named port1. The interface names on your FortiGate unit may differ.
Figure 158:New/Edit OSPF Interface

Add

Name Interface

Enter a name to identify the OSPF interface definition. For example, the name could indicate to which OSPF area the interface will be linked. Select the name of the FortiGate interface to associate with this OSPF interface definition (for example, port1, external, or VLAN_1). The FortiGate unit can have physical, VLAN, virtual IPSec or GRE interfaces connected to the OSPF-enabled network.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

269

BGP

Router Dynamic

IP

Enter the IP address that has been assigned to the OSPF-enabled interface. The interface becomes OSPF-enabled because its IP address matches the OSPF network address space. For example, if you defined an OSPF network of 172.20.120.0/24 and port1 has been assigned the IP address 172.20.120.140, type 172.20.120.140.

Authentication Select an authentication method for LSA exchanges on the specified interface: Select None to disable authentication. Select Text to authenticate LSA exchanges using a plain-text password. The password can be up to 35 characters, and is sent in clear text over the network. Select MD5 to use one or more keys to generate an MD5 hash. This setting overrides the area Authentication setting. Password Enter the plain-text password. Enter an alphanumeric value of up to 15 characters. The OSPF neighbors that send link-state advertisements to this FortiGate interface must be configured with an identical password. This field is available only if you selected plain-text authentication. Enter the key identifier for the (first) password in the ID field (the range is from 1 to 255) and then type the associated password in the Key field. The password is an alphanumeric string of up to 16 characters. The OSPF neighbors that send link-state advertisements to this FortiGate interface must be configured with an identical MD5 key. If the OSPF neighbor uses more than one password to generate MD5 hash, select the Add icon to add additional MD5 keys to the list. This field is available only if you selected MD5 authentication. Optionally, set the Hello Interval to be compatible with Hello Interval settings on all OSPF neighbors. This setting defines the period of time (in seconds) that the FortiGate unit waits between sending Hello packets through the interface. Optionally, set the Dead interval to be compatible with Dead Interval settings on all OSPF neighbors. This setting defines the period of time (in seconds) that the FortiGate unit waits to receive a Hello packet from an OSPF neighbor through the interface. If the FortiGate unit does not receive a Hello packet within the specified amount of time, the FortiGate unit declares the neighbor inaccessible. By convention, the Dead Interval value is usually four times greater than the Hello Interval value.

MD5 Keys

Hello Interval

Dead Interval

BGP
Border Gateway Protocol (BGP) is an Internet routing protocol typically used by ISPs to exchange routing information between different ISP networks. For example, BGP enables the sharing of network paths between the ISP network and an autonomous system (AS) that uses RIP and/or OSPF to route packets within the AS. The FortiGate implementation of BGP supports BGP-4 and complies with RFC 1771.

How BGP works

When BGP is enabled, the FortiGate unit sends routing table updates to neighboring autonomous systems whenever any part of the FortiGate routing table changes. Each AS, including the local AS of which the FortiGate unit is a member, is associated with an AS number. The AS number references a particular destination network.

270

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

BGP

BGP updates advertise the best path to a destination network. When the FortiGate unit receives a BGP update, the FortiGate unit examines the Multi-Exit Discriminator (MED) attributes of potential routes to determine the best path to a destination network before recording the path in the FortiGate routing table. BGP has the capability to gracefully restart. This capability limits the effects of software problems by allowing forwarding to continue when the control plane of the router fails. It also reduces routing flaps by stabilizing the network.
Note: Graceful restarting and other advanced settings cannot be configured through the web-based manager, only through CLI commands. For complete descriptions and examples of how to use CLI commands to configure BGP settings, see the router chapter of the FortiOS CLI Reference.

Viewing and editing BGP settings

When you configure BGP settings, specify the AS that includes the FortiGate unit as a member and enter a router ID to identify the FortiGate unit to other BGP routers. You must also identify the FortiGate units BGP neighbors and specify which of the networks local to the FortiGate unit should be advertised to BGP neighbors. To view and edit BGP settings, go to Router > Dynamic > BGP. The web-based manager offers a simplified user interface to configure basic BGP options. A large number of advanced BGP options can be configured through the CLI. For more information, see the router chapter of the FortiOS CLI Reference.
Figure 159:Basic BGP options

Local AS Router ID

Enter the number of the local AS that the FortiGate unit is a member of. Enter a unique router ID to identify the FortiGate unit to other BGP routers. The router ID is an IP address written in dotted-decimal format. If you change the router ID while BGP is running, all connections to BGP peers will be broken temporarily until they are re-established. The IP addresses and AS numbers of BGP peers in neighboring autonomous systems. IP Enter the IP address of the neighbor interface to the BGPenabled network. Select to add the neighbor information to the Neighbors list, or edit an entry in the list. The IP addresses of BGP peers.

Neighbors

Remote AS Enter the number of the AS that the neighbor belongs to. Add/Edit Neighbor

Remote AS The numbers of the autonomous systems associated with the BGP peers. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

271

Multicast

Router Dynamic

Networks

The IP addresses and network masks of networks to advertise to BGP peers. The FortiGate unit may have a physical or VLAN interface connected to those networks. IP/Netmask Enter the IP address and netmask of the network to be advertised. Add Network Select to add the network information to the Networks list. The IP addresses and network masks of major networks that are advertised to BGP peers.

Delete icon

Select to delete a BGP neighbor entry or a BGP network definition.

Multicast
A FortiGate unit can operate as a Protocol Independent Multicast (PIM) version 2 router in the root virtual domain. FortiGate units support PIM sparse mode (RFC 2362) and PIM dense mode (RFC 3973) and can service multicast servers or receivers on the network segment to which a FortiGate interface is connected. Multicast server applications use a (Class D) multicast address to send one copy of a packet to a group of receivers. The PIM routers throughout the network ensure that only one copy of the packet is forwarded through the network until it reaches an end-point destination. At the end-point destination, copies of the packet are made only when required to deliver the information to multicast client applications that request traffic destined for the multicast address.
Note: To support PIM communications, the sending/receiving applications and all connecting PIM routers in between must be enabled with PIM version 2. PIM can use static routes, RIP, OSPF, or BGP to forward multicast packets to their destinations. To enable source-to-destination packet delivery, either sparse mode or dense mode must be enabled on all the PIM-router interfaces. Sparse mode routers cannot send multicast messages to dense mode routers. In addition, if a FortiGate unit is located between a source and a PIM router, two PIM routers, or is connected directly to a receiver, you must create a firewall policy manually to pass encapsulated (multicast) packets or decapsulated data (IP traffic) between the source and destination.

A PIM domain is a logical area comprising a number of contiguous networks. The domain contains at least one Boot Strap Router (BSR). If sparse mode is enabled, the domain also contains a number of Rendezvous Points (RPs) and Designated Routers (DRs). When PIM is enabled on a FortiGate unit, the FortiGate unit can perform any of these functions at any time as configured. If required for sparse mode operation, you can define static RPs.
Note: Basic options can be configured through the web-based manager. Many additional options may be configured through CLI commands only. For complete descriptions and examples of how to use CLI commands to configure PIM settings, see multicast in the router chapter of the FortiOS CLI Reference. Note: You can also see the FortiGate Multicast Technical Note for more information about FortiGate multicast support..

272

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

Multicast

Viewing and editing multicast settings

When multicast (PIM) routing is enabled, you can configure sparse mode or dense mode operation on any FortiGate interface. To view and edit PIM settings, go to Router > Dynamic > Multicast. The webbased manager offers a simplified user interface to configure basic PIM options. Advanced PIM options can be configured through the CLI. For more information, see the router chapter of the FortiOS CLI Reference.
Figure 160:Basic Multicast options Add Static RP

Delete Edit
Enable Multicast Routing Add Static RP Select to enable PIM version 2 routing. A firewall policy must be created on PIM-enabled interfaces to pass encapsulated packets and decapsulated data between the source and destination, If required for sparse mode operation, enter the IP address of a Rendezvous Point (RP) that may be used as the root of a packet distribution tree for a multicast group. Join messages from the multicast group are sent to the RP, and data from the source is sent to the RP. If an RP for the specified IPs multicast group is already known to the Boot Strap Router (BSR), the RP known to the BSR is used and the static RP address that you specify is ignored. Select to save the specified static RP addresses. Select to create a new multicast entry for an interface. This will allow you to fine-tune PIM operation on a specific FortiGate interface or override the global PIM settings on a particular interface. See Overriding the multicast settings on an interface on page 274. The names of FortiGate interfaces having specific PIM settings. The mode of PIM operation (Sparse or Dense) on that interface. The status of parse-mode RP candidacy on the interface. To enable or disable RP candidacy on an interface, select the Edit icon in the row that corresponds to the interface. The priority number assigned to RP candidacy on that interface. Only available when RP candidacy is enabled. The priority number assigned to Designated Router (DR) candidacy on the interface. Only available when sparse mode is enabled.

Apply Create New

Interface Mode Status

Priority DR Priority

Delete and Edit icons Select to delete or edit the PIM settings on the interface.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

273

Multicast

Router Dynamic

Overriding the multicast settings on an interface

Use multicast (PIM) interface options to set operating parameters for FortiGate interfaces connected to PIM domains. For example, you can enable dense mode on an interface that is connected to a PIM-enabled network segment. When sparse mode is enabled, you can adjust the priority number that is used to advertise Rendezvous Point (RP) and/or Designated Router (DR) candidacy on the interface.
Figure 161:Multicast interface settings

Interface

Select the name of the root VDOM FortiGate interface to which these settings apply. The interface must be connected to a PIM version 2 enabled network segment. Select the mode of operation: Sparse Mode or Dense Mode. All PIM routers connected to the same network segment must be running the same mode of operation. If you select Sparse Mode, adjust the remaining options as described below. Enter the priority number for advertising DR candidacy on the FortiGate interface. The range is from 1 to 4 294 967 295. This value is compared to the DR interfaces of all other PIM routers on the same network segment, and the router having the highest DR priority is selected to be the DR. Select to enable or disable RP candidacy on the interface.

PIM Mode

DR Priority

RP Candidate

RP Candidate Priority Enter the priority number for advertising RP candidacy on the FortiGate interface. The range is from 1 to 255.

Multicast destination NAT

Multicast destination NAT (DNAT) allows you translate externally received multicast destination addresses to addresses that conform to an organization's internal addressing policy. Using this feature, users do not need to redistribute routes at the translation boundary into their network infrastructure for Reverse Path Forwarding (RPF) to work properly, and users can receive identical feeds from two ingress points in the network and route them independently. Multicast DNAT is configured in the CLI using the following command: config firewall multicast-policy edit p1 set dnat <dnatted-multicast-group> set ... next end For more information, see the firewall chapter of the FortiOS CLI Reference.

274

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Dynamic

Bi-directional Forwarding Detection (BFD)

Bi-directional Forwarding Detection (BFD)

Bi-directional Forwarding Detection (BFD) protocol is designed to deal with dynamic routing protocols' problem of not having a fine granularity for detecting device failures on the network and re-routing around those failures. BFD can detect these failures on a millisecond timer, where the routing protocols can only detect them on a second timer taking much longer to react to failures. Your FortiGate unit supports BFD as part of OSPF and BGP dynamic networking.
Note: BFD is only configurable from the CLI.

How BFD works

When you enable BFD on your FortiGate unit, BFD starts trying to connect to other routers on the network. You can limit where BFD looks for routers by only enabling one interface, and enabling BFD for specific neighboring routers on the network. Once the connection has been made, BFD will continue to send periodic packets to the router to make sure it is still operational. These small packets are sent frequently. If BFD never connects to the router on the network, it can't report on that router being up or down. In this situation, BFD will continue to try and connect to the router. Until that connection is made, the device may go down and up without notice. If there is no response from the neighboring router within the set period of time, BFD on your FortiGate unit declares that router down and changes routing accordingly. BFD continues to try and reestablish a connection. Once that connection is reestablished, routes are reset to include the router once again.

Configuring BFD
BFD is intended for networks that use BGP or OSPF routing protocols. This generally excludes smaller networks. BFD configuration on your FortiGate unit is very flexible. You can enable BFD for the whole unit, and turn it off for one or two interfaces. Alternatively you can specifically enable BFD for each neighbor router, or interface. Which method you choose will be determined by the amount of configuring required for your network The timeout period determines how long the FortiGate unit waits before labeling a connection as down. The size of the timeout period is important - if its too small connections will be labeled down prematurely, and if its too long time will be wasted waiting for a reply from a connection that is down. There is no easy number, as it varies for each network and FortiGate unit. High end FortiGate models will respond very quickly unless loaded down with traffic. Also the size of the network will slow down the response time - packets need to make more hops than on a smaller network. Those two factors (CPU load and network traversal

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

275

Bi-directional Forwarding Detection (BFD)

Router Dynamic

time) affect how long the timeout you select should be. With too short a timeout period, BFD will not connect to the network device but it will keep trying. This state generates unnecessary network traffic, and leaves the device unmonitored. If this happens to you, try setting a longer timeout period to allow BFD more time to discover the device on the network. Configuring BFD on your FortiGate unit For this example BFD is enabled on the FortiGate unit using the default values. This means that once a connection is established, your FortiGate unit will wait for up to 150 milliseconds (50 x 3) for a reply from a BFD router before declaring that router down and rerouting traffic. The port that BFD traffic originates from will be checked for security purposed. config system settings set bfd enable set bfd-desired-min-tx 50 set bfd-required-min-rx 50 set bfd-detect-mult 3 set bfd-dont-enforce-src-port disable end
Note: The minimum receive interval (bfd-required-min-rx) and the detection multiplier (bfd-detect-mult) combine to determine how long a period your FortiGate unit will wait for a reply before declaring the neighbor down. The correct value for your situation will vary based on the size of your network and the speed of your FortiGate units CPU. The number used in this example may not work for your network.

Configuring BFD off on a specific interface The above example configures BFD to be on for your FortiGate unit. If an interface is not connected to any BFD enabled routers, you can reduce network traffic by turning BFD off just for that interface. For this example, BFD is turned off for the internal interface using CLI commands. config system interface edit internal set bfd disable end

Configuring BFD on BGP

Configuring BFD on a BGP network is very straight forward - turn it on. In BGP, you enable BFD for each neighbor that is running the protocol. This allows a two-way communication to be established.

Configuring BFD on OSPF

Configuring BFD on an OSPF network is very much like enabling BFD on your FortiGate unit - you can enable it globally, and you can override the global settings at the interface level.

276

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Monitor

Viewing routing information

Router Monitor
This section explains how to interpret the Routing Monitor list. The list displays the entries in the FortiGate routing table. This section describes: Viewing routing information Searching the FortiGate routing table

Viewing routing information

By default, all routes are displayed in the Routing Monitor list. The default static route is defined as 0.0.0.0/0, which matches the destination IP address of any/all packets. To display the routes in the routing table, go to Router > Monitor. Figure 162 shows the Routing Monitor list belonging to a FortiGate unit that has interfaces named port1, port4, and lan. The names of the interfaces on your FortiGate unit may be different.
Figure 162:Routing Monitor list

IP version

Select IPv4 or IPv6 routes to display.

Page Use these buttons to move through pages of routes. Navigation For more information see Using page controls on web-based manager lists on page 49. Buttons

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

277

Viewing routing information

Router Monitor

Type

Select one of these route types to search the routing table and display routes of the selected type only: All displays all routes recorded in the routing table. Connected displays all routes associated with direct connections to FortiGate interfaces. Static displays the static routes that have been added to the routing table manually. RIP displays all routes learned through RIP. OSPF displays all routes learned through OSPF. BGP displays all routes learned through BGP. HA displays RIP, OSPF, and BGP routes synchronized between the primary unit and the subordinate units of a high availability (HA) cluster. HA routes are maintained on subordinate units and are only visible if you are viewing the router monitor from a virtual domain that is configured as a subordinate virtual domain in a virtual cluster. For details about HA routing synchronization, see the FortiGate High Availability User Guide.

Network Gateway

Enter an IP address and netmask (for example, 172.16.14.0/24) to search the routing table and display routes that match the specified network. Enter an IP address and netmask (for example, 192.168.12.1/32) to search the routing table and display routes that match the specified gateway.

Apply Filter Select to search the entries in the routing table based on the specified search criteria and display any matching routes. Type Subtype The type values assigned to FortiGate routes (Static, Connected, RIP, OSPF, or BGP). If applicable, the subtype classification assigned to OSPF routes. An empty string implies an intra-area route. The destination is in an area to which the FortiGate unit is connected. OSPF inter area means the destination is in the OSPF AS, but the FortiGate unit is not connected to that area. External 1 means the destination is outside the OSPF AS. The metric of a redistributed route is calculated by adding the external cost and the OSPF cost together. External 2 means the destination is outside the OSPF AS. In this case, the metric of the redistributed route is equivalent to the external cost only, expressed as an OSPF cost. OSPF NSSA 1 has the same meaning as External 1, but the route was received through a not-so-stubby area. OSPF NSSA 2 has the same meaning as External 2, but the route was received through a not-so-stubby area.

Network Distance

The IP addresses and network masks of destination networks that the FortiGate unit can reach. The administrative distance associated with the route. A value of 0 means the route is preferable compared to routes to the same destination. To modify the administrative distance assigned to static routes, see Adding a static route to the routing table on page 252. Refer to the FortiOS CLI Reference for dynamic routes.

278

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Router Monitor

Searching the FortiGate routing table

Metric

The metric associated with the route type. The metric of a route influences how the FortiGate unit dynamically adds it to the routing table: Hop count is used for routes learned through RIP. Relative cost is used for routes learned through OSPF. Multi-Exit Discriminator (MED) is used for this metric for routes learned through BGP. However, several attributes besides MED determine the best path to a destination network.

Gateway Interface Up Time

The IP addresses of gateways to the destination networks. The interface through which packets are forwarded to the gateway of the destination network. The total accumulated amount of time that a route learned through RIP, OSPF, or BGP has been reachable.

Searching the FortiGate routing table

You can apply a filter to search the routing table and display certain routes only. For example, you can display static routes, connected routes, routes learned through RIP, OSPF, or BGP, and/or routes associated with the network or gateway that you specify. If you want to search the routing table by route type and further limit the display according to network or gateway, all of the values that you specify as search criteria must match corresponding values in the same routing table entry in order for that entry to be displayed (an implicit AND condition is applied to all of the search parameters you specify). For example, if the FortiGate unit is connected to network 172.16.14.0/24 and you want to display all directly connected routes to network 172.16.14.0/24, you must select Connected from the Type list, type 172.16.14.0/24 in the Network field, and then select Apply Filter to display the associated routing table entry or entries. Any entry that contains the word Connected in its Type field and the specified value in the Gateway field will be displayed. To search the FortiGate routing table 1 2 Go to Router > Monitor > Routing Monitor. From the Type list, select the type of route to display. For example, select Connected to display all connected routes, or select RIP to display all routes learned through RIP. If you want to display routes to a specific network, type the IP address and netmask of the network in the Networks field. If you want to display routes to a specific gateway, type the IP address of the gateway in the Gateway field. Select Apply Filter.
Note: All of the values that you specify as search criteria must match corresponding values in the same routing table entry in order for that entry to be displayed.

3 4 5

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

279

Searching the FortiGate routing table

Router Monitor

280

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

How list order affects policy matching

Firewall Policy
Firewall policies control all traffic attempting to pass through the FortiGate unit. To control traffic between FortiGate interfaces, zones, and VLAN subinterfaces, add firewall policies. Firewall policies are instructions the FortiGate unit uses to decide connection acceptance and packet processing for traffic attempting to pass through. When the firewall receives a connection packet, it analyzes the packets source address, destination address, and service (by port number), and attempts to locate a firewall policy matching the packet. Firewall policies can contain many instructions on what the FortiGate unit must do when it receives matching packets. Some instructions are required, such as whether to accept, drop, or accept and process the packets, while other instructions, such as logging and authentication, are optional. Policy instructions may include network address translation (NAT), or port address translation (PAT), by using virtual IPs or IP pools to translate source and destination IP addresses and port numbers. For details on using virtual IPs and IP pools, see Firewall Virtual IP on page 323. Policy instructions may also include protection profiles, which can specify application-layer inspection and other protocol-specific protection and logging. For details on using protection profiles, see Firewall Protection Profile on page 353. If you enable virtual domains (VDOMs) on the FortiGate unit, firewall policies are configured separately for each virtual domain, and you must first enter the virtual domain to configure its firewall policies. For details, see Using virtual domains on page 81. This section describes: How list order affects policy matching Multicast policies Viewing the firewall policy list Configuring firewall policies Firewall policy examples

How list order affects policy matching

Each time a FortiGate unit receives a connection attempting to pass through one of its interfaces, the FortiGate unit searches its firewall policy list for a matching firewall policy. The search begins at the top of the policy list and progresses in order towards the bottom of the list. The FortiGate unit evaluates each policy in the firewall policy list for a match until a match is found. When the FortiGate unit finds the first matching policy, it applies the matching policys specified actions to the packet, and disregards subsequent firewall policies. Matching firewall policies are determined by comparing the firewall policy and the packets:

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

281

How list order affects policy matching

Firewall Policy

source and destination interfaces source and destination firewall addresses services time/schedule

If no policy matches, the connection is dropped. As a general rule, you should order the firewall policy list from most specific to most general because of the order in which policies are evaluated for a match, and because only the first matching firewall policy is applied to a connection. Subsequent possible matches are not considered or applied. Ordering policies from most specific to most general prevents policies that match a wide range of traffic from superseding and effectively masking policies that match exceptions. For example, you might have a general policy that allows all connections from the internal network to the Internet, but want to make an exception that blocks FTP. In this case, you would add a policy that denies FTP connections above the general policy.
Figure 163:Example: Blocking FTP Correct policy order

}Exception

}General FTP connections would immediately match the deny policy, blocking the connection. Other kinds of services do not match the FTP policy, and so policy evaluation would continue until reaching the matching general policy. This policy order has the intended effect. But if you reversed the order of the two policies, positioning the general policy before the policy to block FTP, all connections, including FTP, would immediately match the general policy, and the policy to block FTP would never come into effect. This policy order would not have the intended effect.
Figure 164:Example: Blocking FTP Incorrect policy order

}General

}Exception

Similarly, if specific traffic requires authentication, IPSec VPN, or SSL VPN, you would position those policies above other potential matches in the policy list. Otherwise, the other matching policies could always take precedence, and the required authentication, IPSec VPN, or SSL VPN might never occur.
Note: A default firewall policy may exist which accepts all connections. You can move, disable and/or delete it. If you move the default policy to the bottom of the firewall policy list and no other policy matches the packet, the connection will be accepted. If you disable or delete the default policy and no other policy matches the packet, the connection will be dropped.

282

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Multicast policies

Multicast policies
FortiGate units support multicast policies. You can configure and create multicast policies using the following CLI command: config firewall multicast-policy For details, see the FortiOS CLI Reference and the FortiGate Multicast Technical Note.

Viewing the firewall policy list

The firewall policy list displays firewall policies in their order of matching precedence for each source and destination interface pair. If virtual domains are enabled on the FortiGate unit, firewall policies are configured separately for each virtual domain; you must access the VDOM before you can configure its policies. To access a VDOM, go to System > VDOM, and in the row corresponding to the VDOM whose policies you want to configure, select Enter. You can add, delete, edit, and re-order policies in the policy list. Policy order affects policy matching. For details, see How list order affects policy matching on page 281. To view the policy list, go to Firewall > Policy.
Figure 165:Firewall policy list

Filter

Delete Edit Insert Policy before Move To

Create New Select to add a firewall policy. See Configuring firewall policies on page 285. Select the down arrow beside Create New to choose to either add a firewall policy or firewall policy section. A firewall policy section is a way of visually grouping firewall policies. Select to customize the table view. You can select the columns to hide or display and specify the column displaying order in the table. By default, the From, To, VPN Tunnel, Authentication, Comments, Label, Count, Log and Index columns are not displayed. Select to edit the column filters, which allow you to filter or sort the policy list according to the criteria you specify. For details, see Adding filters to web-based manager lists on page 46.

Column Settings

Filter icon

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

283

Viewing the firewall policy list

Firewall Policy

ID Source

The policy identifier. Policies are numbered in the order they are added to the policy list. The source address or address group to which the policy applies. All source entries are highlighted with a small orange icon so that they are easy to find and compare in the firewall policy list. See Firewall Address on page 303. Address information can also be edited from the policy list. Clicking on the address opens the Edit Address dialog box. The destination address or address group to which the policy applies. All destination entries are highlighted with a small orange icon so that they are easy to find and compare in the firewall policy list. See Firewall Address on page 303. Address information can also be edited from the policy list. Clicking on the address opens the Edit Address dialog box. The schedule that controls when the policy should be active. See Firewall Schedule on page 319. The service to which the policy applies. All service entries are highlighted with a small orange icon so that they are easy to find and compare in the firewall policy list. See Firewall Service on page 309. The protection profile that is associated with the policy. The response to make when the policy matches a connection attempt. Either enabled or disabled. The source interface. The destination interface. The VPN tunnel the VPN policy uses. The user authentication method the policy uses. Comments entered when creating or editing the policy. A green check mark indicates traffic logging is enable for the policy; a grey cross mark indicates traffic logging is disabled for the policy. The FortiGate unit counts the number of packets and bytes a firewall policy is hit. For example, 5/50B means that a total of five packets and 50 bytes has hit the policy. The counter is reset when the FortiGate unit is restarted or the policy is deleted and re-configured. Select to delete the policy from the list. Select to open the policy for editing. Select to add a new policy above the corresponding policy (the New Policy screen appears). Select to move the corresponding policy before or after another policy in the list. See Moving a policy to a different position in the policy list on page 284.

Destination

Schedule Service

Profile Action Status From To VPN Tunnel Authentication Comments Log

Count

Delete icon Edit icon Insert Policy Before icon Move To icon

Moving a policy to a different position in the policy list

Firewall policy order affects policy matching. You can arrange the firewall policy list to influence the order in which policies are evaluated for matches with incoming traffic. When more than one policy has been defined for the same interface pair, the first matching firewall policy will be applied to the traffic session. For details, see How list order affects policy matching on page 281. Moving a policy in the firewall policy list does not change its ID, which is indicative of the order in which the policy was created.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

284

Firewall Policy

Configuring firewall policies

Figure 166:Move Policy

To move a firewall policy in the firewall policy list 1 2 3 4 Go to Firewall > Policy. In the firewall policy list, note the ID of a firewall policy that is before or after your intended destination. In the row corresponding to the firewall policy that you want to move, select the Move To icon. Select either Before or After, and enter the ID of the firewall policy that is before or after your intended destination. This specifies the policys new position in the firewall policy list. Select OK.

Configuring firewall policies

You can configure firewall policies to define which sessions will match the policy and actions the FortiGate unit will perform with packets from matching sessions. Sessions are matched to a firewall policy by considering the packets and policys: Source Interface/Zone Source Address Destination Interface/Zone Destination Address Schedule and time of the sessions initiation Service and the packets port numbers

If the initial packet matches the firewall policy, the FortiGate unit performs the configured Action and any other configured options on all packets in the session. Packet handling actions can be ACCEPT, DENY, IPSEC or SSL-VPN. ACCEPT policy actions permit communication sessions, and may optionally include other packet processing instructions, such as requiring authentication to use the policy, or specifying a protection profile to apply features such as virus scanning to packets in the session. An ACCEPT policy can also apply interface-mode IPSec VPN traffic if either the selected source or destination interface is an IPSec virtual interface. For more information, see Policy-based versus route-based VPNs on page 370. DENY policy actions block communication sessions, and may optionally log the denied traffic.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

285

Configuring firewall policies

Firewall Policy

IPSEC and SSL-VPN policy actions apply a tunnel mode IPSec VPN or SSL VPN tunnel, respectively, and may optionally apply NAT and allow traffic for one or both directions. If permitted by the firewall encryption policy, a tunnel may be initiated automatically whenever a packet matching the policy arrives on the specified network interface, destined for the local private network. For more information, see IPSec firewall policy options on page 295 and/or SSLVPN firewall policy options on page 296.

To add or edit a firewall policy, go to Firewall > Policy.

Note: You can configure differentiated services (DSCP) firewall policy options through the CLI. For details, see the firewall chapter of the FortiOS CLI Reference. Figure 167:Policy options

Source Interface/Zone

Select the name of the FortiGate network interface, virtual domain (VDOM) link, or zone on which IP packets are received. Interfaces and zones are configured on the System Network page. See Interfaces on page 93 for information about interfaces. See Zones on page 119 for information about zones. If Action is set to IPSEC, the interface is associated with the local private network. If Action is SSL-VPN, the interface is associated with connections from remote SSL VPN clients.

286

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Configuring firewall policies

Source Address Select the name of a firewall address to associate with the Source Interface/Zone. Only packets whose header contains an IP address matching the selected firewall address will be subject to this policy. You can create firewall addresses while configuring the firewall policy, or you can create firewall addresses in advance. For details on configuring firewall addresses in advance, see Configuring addresses on page 305. If you want to associate multiple firewall addresses or address groups with the Source Interface/Zone, from Source Address, select Multiple. In the pop-up window, move the firewall addresses or address groups from the Available Addresses box to the Members box, then select OK. If Action is set to IPSEC, the address is the private IP address of the host, server, or network behind the FortiGate unit. If Action is set to SSL-VPN and the policy is for web-only mode clients, select all. If Action is set to SSL-VPN and the policy is for tunnel mode clients, select the name of the address that you reserved for tunnel mode clients. Destination Interface/Zone Select the name of the FortiGate network interface, virtual domain (VDOM) link, or zone to which IP packets are forwarded. Interfaces and zones are configured on the System Network page. See Interfaces on page 93 for information about interfaces. See Zones on page 119 for information about zones. If Action is set to IPSEC, the interface is associated with the entrance to the VPN tunnel. If Action is set to SSL-VPN, the interface is associated with the local private network. Select the name of a firewall address to associate with the Destination Interface/Zone. Only packets whose header contains an IP address matching the selected firewall address will be subject to this policy. You can create firewall addresses while configuring the firewall policy, or you can create firewall addresses in advance. For details on configuring firewall addresses in advance, see Configuring addresses on page 305. If you want to associate multiple firewall addresses or address groups with the Destination Interface/Zone, from Destination Address, select Multiple. In the pop-up window, move the firewall addresses or address groups from the Available Addresses box to the Members box, then select OK. If Action is set to IPSEC, the address is the private IP address to which packets may be delivered at the remote end of the VPN tunnel. If Action is set to SSL-VPN, select the name of the IP address that corresponds to the host, server, or network that remote clients need to access behind the FortiGate unit. Select a one-time or recurring schedule that controls when the policy is in effect. You can create schedules while configuring the firewall policy, or you can create schedules in advance. For details on creating firewall schedules in advance, see Firewall Schedule on page 319. Select the name of a firewall service or service group that packets must match to trigger this policy. You can select from a wide range of predefined firewall services, or you can create a custom service. For instructions on creating firewall services in advance, see Configuring custom services on page 314 and Configuring service groups on page 317. You can select Create New to create a custom service or a service group during policy configuration. Add the information required for the custom service or service group and select OK. The new custom service or service group is added to the Service list. By selecting the Multiple button beside Service, you can select multiple services or service groups.

Destination Address

Schedule

Service

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

287

Configuring firewall policies

Firewall Policy

Action

Select how you want the firewall to respond when a packet matches the conditions of the policy. ACCEPT Accept traffic matched by the policy. You can configure NAT, protection profiles, log traffic, shape traffic, set authentication options, or add a comment to the policy. Reject traffic matched by the policy. The only other configurable policy options are to log traffic (to log the connections denied by this policy) or add a comment. Configure an IPSec firewall encryption policy, which causes the FortiGate unit to process IPSec VPN packets. See IPSec firewall policy options on page 295. Configure an SSL-VPN firewall encryption policy, which causes the FortiGate unit to accept SSL VPN traffic. This option is available only after you have added a SSL-VPN user group. See SSL-VPN firewall policy options on page 296.

DENY

IPSEC

SSL-VPN

NAT

Enable or disable Network Address Translation (NAT) of the source address and port of packets accepted by the policy. When NAT is enabled, you can also configure Dynamic IP Pool and Fixed Port. If this option is not selected, but a virtual IP is selected as the Destination Address, the FortiGate unit performs destination NAT (DNAT) rather than full NAT. Source NAT (SNAT) is not performed. Dynamic IP Pool Enable then select an IP pool to translate the source address to an IP address randomly selected from addresses in the IP Pool. IP Pool cannot be selected if the destination interface, VLAN subinterface, or one of the interfaces or VLAN subinterfaces in the destination zone is configured using DHCP or PPPoE, or if you have selected a Destination Interface to which no IP Pools are bound. You cannot use IP pools when using zones. An IP pool can only be associated with an interface. For details, see IP pools on page 346. Select Fixed Port to prevent NAT from translating the source port. Some applications do not function correctly if the source port is translated. In most cases, if Fixed Port is selected, Dynamic IP pool is also selected. If Dynamic IP pool is not selected, a policy with Fixed Port selected can only allow one connection to that service at a time.

Fixed Port

Protection Profile

Select a protection profile to configure how antivirus, web filtering, web category filtering, spam filtering, IPS, content archiving, and logging are applied to a firewall policy. Protection profiles can be created in advance or during profile configuration. Profiles created at this point appear in the protection profile list. For information about adding and configuring Protection profiles, see Firewall Protection Profile on page 353. For authentication in the advanced settings, the protection profile option is disabled because the user group chosen for authentication is already tied to a protection profile. For more information about adding authentication to firewall policies, see Adding authentication to firewall policies on page 290. Select Log Allowed Traffic, for Accept, IPSEC or SSL-VPN policies to record messages to the traffic log whenever the policy processes a connection. Enable traffic log for a logging location (syslog, WebTrends, local disk if available, memory, or FortiAnalyzer) and set the logging severity level to Notification or lower. For information about logging, see Log&Report on page 499.

Log Allowed Traffic

288

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Configuring firewall policies

Log Violation Traffic

Select Log Violation Traffic, for Deny policies, to record messages to the traffic log whenever the policy processes a connection. Enable traffic log for a logging location (syslog, WebTrends, local disk if available, memory, or FortiAnalyzer) and set the logging severity level to Notification or lower. For information about logging, see Log&Report on page 499. This option appears only if the Action is Deny. Select to require authentication to use this firewall policy, then specify the valid authentication methods, group names, and certificate. If FSAE authentication is selected, also specify a protection profile for Guest accounts. This option requires that Action is set to ACCEPT or SSL-VPN, and you first add users and a firewall protection profile to a user group. For information about adding and configuring user groups, see User groups on page 409. For more information about adding authentication to firewall policies, see Adding authentication to firewall policies on page 290.

Authentication

Check FortiClient Firewall policies can deny access for hosts that do not have FortiClient is Installed and Host Security software installed and operating. See Options to check FortiClient on hosts on page 296. Running This option appears only on FortiGate-1000A, FortiGate-3600A, and FortiGate-5005FA2 models. Traffic Shaping Traffic Shaping controls the bandwidth available to, and sets the priority of the traffic processed by, the policy. Be sure to enable traffic shaping on all firewall policies. If you do not apply any traffic shaping rule to a policy, the policy is set to high priority by default. Distribute firewall policies over all three priority queues (low, medium and high). For example, latency sensitive traffic might receive higher priority.

Be sure that the sum of all Guaranteed Bandwidth in all firewall policies is significantly less than the bandwidth capacity of the interface. For information about how to configure traffic shaping, see Adding traffic shaping to firewall policies on page 292 User Authentication Disclaimer Redirect URL Display the Authentication Disclaimer page (a replacement message). The user must accept the disclaimer to connect to the destination. You can use the disclaimer in conjunction with authentication or a protection profile. This option is available on some models. It is not available for SSL-VPN policies. If you enter a URL, the user is redirected to the URL after authenticating and/or accepting the user authentication disclaimer. This option is available on some models. It is not available for SSL-VPN policies. Add a description or other information about the policy. The comment can be up to 63 characters long, including spaces.

Comments

To add a firewall policy 1 Go to Firewall > Policy. Alternatively, if IPv6 GUI support is enabled and you want to configure a firewall policy using IPv6 firewall addresses, go to Firewall > Policy > IPv6 Policy. 2 Select Create New, or, to insert a new firewall policy before an existing firewall policy, in the row corresponding to a subsequent policy in the list, select Insert Policy before. From Source Interface/Zone, select the source interface, zone, or virtual domain (VDOM) link.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

289

Configuring firewall policies

Firewall Policy

From Source Address, select the source firewall address. Firewall addresses can represent one or more IP addresses. For more information on firewall addresses, see Firewall Address on page 303.

From Destination Interface/Zone, select the destination interface, zone, or virtual domain (VDOM) link. If the selected destination interface is one to which an IP pool is bound, and you want to apply dynamic NAT, you can select the NAT option in the firewall policy, then enable and select from Dynamic IP Pool the IP pool that will be used for dynamic NAT. For more information on IP pools, see IP pools on page 346.

From Destination Address, select the destination firewall address, which can be a virtual IP. If you select a virtual IP, the FortiGate unit applies NAT or PAT. The applied translation varies by the settings specified in the virtual IP, and whether you select the NAT option in the firewall policy. For more information on using virtual IPs, see Firewall Virtual IP on page 323. Firewall addresses can represent one or more IP addresses. For more information on firewall addresses, see Firewall Address on page 303.

7 8 9 10

From Action, select to ACCEPT, DENY, or apply IPSEC or SSL VPN. Configure the remaining firewall policy options if required. Select OK. Move the policy to its intended location in the firewall policy list. Firewall policy order affects policy matching. For details about arranging policies in a policy list, see How list order affects policy matching on page 281 and Moving a policy to a different position in the policy list.

Adding authentication to firewall policies

If you enable Authentication in a firewall policy, network users must send traffic involving a supported firewall authentication protocol to trigger the firewall authentication challenge, and successfully authenticate, before the FortiGate unit will allow any other traffic matching the firewall policy. User authentication can occur via any of the following supported protocols: HTTP HTTPS FTP Telnet

Depending on which of these supported protocols you have included in the selected firewall services group and which of those enabled protocols the network user uses to trigger the authentication challenge, the authentication style will be either certificate-based or user name and password-based. You can restrict which of these supported authentication protocols may be used to authenticate by including only one of them in the firewall service selected in the firewall policy.

290

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Configuring firewall policies

For example, if you want to require HTTPS certificate-based authentication before allowing SMTP and POP3 traffic, in the firewall policy, you must select a firewall service that includes SMTP, POP3 and HTTPS services. Prior to using either POP3 or SMTP, the network user would send traffic using the HTTPS service, which the FortiGate unit would use to verify the network users certificate; upon successful certificate-based authentication, the network user would then be able to access his or her email. In most cases, you should ensure that users can use DNS through the FortiGate unit without authentication. If DNS is not available, users will not be able to use a domain name when using a supported authentication protocol to trigger the FortiGate units authentication challenge. The style of the authentication method varies by the authentication protocol. If you have selected HTTP, FTP or Telnet, user name and password-based authentication occurs: the FortiGate unit prompts network users to input their firewall user name and password. If you have selected HTTPS, certificate-based authentication (HTTPS or HTTP redirected to HTTPS only) occurs: you must install customized certificates on the FortiGate unit and on the browsers of network users, which the FortiGate unit matches.
Note: If you do not install certificates on the network users web browser, the network users may see an SSL certificate warning message and have to manually accept the default FortiGate certificate, which the network users web browsers may then deem as invalid. For information on installing certificates, see System Certificates on page 205. Note: When you use certificate authentication, if you do not specify any certificate when you create a firewall policy, the FortiGate unit will use the default certificate from the global settings will be used. If you specify a certificate, the per-policy setting will override the global setting. For information on global authentication settings, see Authentication

settings on page 418. Authentication requires that Action is ACCEPT or SSL-VPN, and that you first create users, assign them to a firewall user group, and assign a protection profile to that user group. For details on configuring user groups, see User groups on page 409.
Figure 168:Selecting user groups for authentication

To require authentication for network users to use a firewall policy 1 2 Go to Firewall > Policy. Select Create New to add a firewall policy, or, in the row corresponding to an existing firewall policy, select Edit.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

291

Configuring firewall policies

Firewall Policy

3 4

Select Authentication. Authentication configuration options appear. Select one or more authentication server types. When a network user attempts to authenticate, these options indicate which local or remote authentication servers the FortiGate unit will consult to verify the users credentials. Firewall includes firewall user groups defined locally on the FortiGate unit, as well as on any connected LDAP and RADIUS servers. Active Directory(FSAE) includes Active Directory groups defined in User > User Group, and authenticatable through an Active Directory domain controller using Fortinet Server Authentication Extensions (FSAE). If you select this option, you must install the FSAE on the Active Directory Domain Controller. The FSAE is available on the tools and documentation CD provided with each FortiGate unit. NTLM Authentication includes Active Directory groups defined in User > User Group. If you select this option, you must use Active Directory groups as the members of the authentication group for NTLM.

5 6 7

From Available Groups, select one or more user groups that must authenticate to be allowed to use this policy. Select the right arrow to move the selected user groups to Allowed. To prioritize the allowed user group definitions, select an Allowed group, then select Move Up or Move Down. User groups located at the top of the Allowed list have higher priority. If a user is a member of more than one group, group priority determines which user group, and therefore which protection profile, will be applied to the authenticating users traffic.

8 9

If Active Directory (FSAE) group types are selected, from Guest Profile, select the protection profile that guest accounts will use. If you will permit or require that users will use certificate-based authentication, from Certificate, select the certificate that the FortiGate unit will use. Certificate-based authentication also requires that you select from Service a firewall service group that includes one of the supported authentication protocols that uses certificate-based style of authentication. You should also install the certificate on the network users web browser.

10

Select OK.

Adding traffic shaping to firewall policies

Traffic Shaping controls the bandwidth available to, and sets the priority of the traffic processed by, the policy. Traffic Shaping makes it possible to control which policies have the highest priority when large amounts of data are moving through the FortiGate unit. For example, the policy for the corporate web server might be given higher priority than the policies for most employees computers. An employee who needs unusually high-speed Internet access could have a special outgoing policy set up with higher bandwidth. Traffic shaping is available for firewall policies whose Action is ACCEPT, IPSEC, or SSL-VPN. It is also available for all supported services, including H.323, TCP, UDP, ICMP, and ESP.

292

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Configuring firewall policies

Guaranteed and maximum bandwidth in combination with queuing ensures minimum and maximum bandwidth is available for traffic. Traffic shaping cannot increase the total amount of bandwidth available, but it can be used to improve the quality of bandwidth-intensive and sensitive traffic.
Note: For more information would traffic shaping you can also see the FortiGate Traffic Shaping Technical Note.

Guaranteed bandwidth and maximum bandwidth

When you enter a value in the Guaranteed Bandwidth field of a firewall policy you guarantee the amount of bandwidth available for selected network traffic (in Kbytes/sec). For example, you may want to give a higher guaranteed bandwidth to your e-commerce traffic. When you enter a value in the Maximum Bandwidth field of a firewall policy you limit the amount of bandwidth available for selected network traffic (in Kbytes/sec). For example, you may want to limit the bandwidth of IM traffic usage, so as to save some bandwidth for the more important e-commerce traffic. The bandwidth available for traffic controlled by a policy is used for both the control and data sessions and is used for traffic in both directions. For example, if guaranteed bandwidth is applied to an internal to external FTP policy, and a user on an internal network uses FTP to put and get files, both the put and get sessions share the bandwidth available to the traffic controlled by the policy. The guaranteed and maximum bandwidth available for a policy is the total bandwidth available to all traffic controlled by the policy. If multiple users start multiple communications session using the same policy, all of these communications sessions must share from the bandwidth available for the policy. However, bandwidth availability is not shared between multiple instances of using the same service if these multiple instances are controlled by different policies. For example, you can create one FTP policy to limit the amount of bandwidth available for FTP for one network address and create another FTP policy with a different bandwidth availability for another network address.

Traffic Priority
Set traffic priority to manage the relative priorities of different types of traffic. Important and latency-sensitive traffic should be assigned a high priority. Less important and less sensitive traffic should be assigned a low priority. The FortiGate unit provides bandwidth to low-priority connections only when bandwidth is not needed for high-priority connections. For example, you can add policies to guarantee bandwidth for voice and e-commerce traffic. Then you can assign a high priority to the policy that controls voice traffic and a medium priority to the policy that controls e-commerce traffic. During a busy time, if both voice and e-commerce traffic are competing for bandwidth, the higher priority voice traffic will be transmitted before the e-commerce traffic.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

293

Configuring firewall policies

Firewall Policy

Traffic shaping considerations

Traffic shaping will by definition attempt to normalize traffic peaks/bursts and can be configured to prioritize certain flows over others. But there is a physical limitation to the amount of data which can be buffered and for how long. Once these thresholds have been surpassed, frames and packets will be dropped, and sessions will be affected. Incorrect traffic shaping configurations may actually further degrade certain network flows, since the excessive discarding of packets can create additional overhead at the upper layers, which may be attempting to recover from these errors. A basic traffic shaping example would be to prioritize certain traffic flows at the detriment of other traffic which can be discarded. This would mean that you accept to sacrifice certain performance and stability on traffic X, in order to increase or guarantee performance and stability to traffic Y. If for example you are applying bandwidth limitations to certain flows, you must accept the fact that these sessions can be limited and therefore negatively impacted. Traffic shaping which is applied to a firewall policy, is enforced for traffic which may flow in either direction. Therefore a session which may be setup by an internal host to an external one, via a Internal -> External policy, will have Traffic shaping applied even if the data stream is then coming from external to internal. For example, an FTP get or a SMTP server connecting to an external one, in order to retrieve email. Also note that traffic shaping is effective for normal IP traffic at normal traffic rates. Traffic shaping is not effective during extremely high-traffic situations where the traffic is exceeding the capacity of the FortiGate unit. Packets must be received by the FortiGate unit before they are subject to traffic shaping. If the FortiGate unit cannot process all of the traffic it receives, then dropped packets, delays, and latency are likely to occur. To ensure that traffic shaping is working at its best, ensure that the interface ethernet statistics are clean of errors, collisions or buffer overruns. If these are not clean, then FortiGate and switch settings may require adjusting. To make traffic shaping work efficiently, be sure to observe the following rules: Enable traffic shaping on all firewall policies. If you do not apply any traffic shaping rule to a policy, the policy is set to high priority by default. Distribute firewall policies over all three priority queues (low, medium and high).

Be sure that the sum of all Guaranteed Bandwidth in all firewall policies is significantly less than the bandwidth capacity of the interface.

Configuring traffic shaping

You enable and specify traffic shaping settings when you configure firewall policies. To configure traffic shaping 1 2 3 Go to Firewall > Policy. When you create a new policy or edit a policy, select Traffic Shaping. Configure the following three options:

294

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Configuring firewall policies

Guaranteed Bandwidth

Use traffic shaping to guarantee the amount of bandwidth available through the firewall for a policy. Guarantee bandwidth (in Kbytes) to ensure there is enough bandwidth available for a high-priority service. Be sure that the sum of all Guaranteed Bandwidth in all firewall policies is significantly less than the bandwidth capacity of the interface. Use traffic shaping to limit the amount of bandwidth available through the firewall for a policy. Limit bandwidth to keep less important services from using bandwidth needed for more important services. Select High, Medium, or Low. Select Traffic Priority so the FortiGate unit manages the relative priorities of different types of traffic. For example, a policy for connecting to a secure web server needed to support e-commerce traffic should be assigned a high traffic priority. Less important services should be assigned a low priority. The firewall provides bandwidth to low-priority connections only when bandwidth is not needed for high-priority connections. Be sure to enable traffic shaping on all firewall policies. If you do not apply any traffic shaping rule to a policy, the policy is set to high priority by default. Distribute firewall policies over all three priority queues.

Maximum Bandwidth Traffic Priority

Note: If you set both guaranteed bandwidth and maximum bandwidth to 0 (zero), the policy does not allow any traffic.

IPSec firewall policy options

In a firewall policy (see To add a firewall policy on page 289), when Action is set to IPSEC, the following options are available:
Figure 169:IPSEC encryption policy

VPN Tunnel Allow Inbound Allow outbound Inbound NAT

Select the VPN tunnel name defined in the phase 1 configuration. The specified tunnel will be subject to this firewall encryption policy. Select to enable traffic from a dialup client or computers on the remote private network to initiate the tunnel. Select to enable traffic from computers on the local private network to initiate the tunnel. Select to translate the source IP addresses of inbound decrypted packets into the IP address of the FortiGate interface to the local private network. Select in combination with a natip CLI value to translate the source addresses of outbound cleartext packets into the IP address that you specify. Do not select Outbound NAT unless you specify a natip value through the CLI. When a natip value is specified, the source addresses of outbound IP packets are replaced before the packets are sent through the tunnel. For more information, see the firewall chapter of the FortiOS CLI Reference.

Outbound NAT

Note: For a route-based (interface mode) VPN, you do not configure an IPSEC firewall policy. Instead, you configure two regular ACCEPT firewall policies, one for each direction of communication, with the IPSec virtual interface as the source or destination interface as appropriate.

For more information, see the Defining firewall policies chapter of the FortiGate IPSec VPN User Guide.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

295

Configuring firewall policies

Firewall Policy

SSL-VPN firewall policy options

In a firewall policy (see To add a firewall policy on page 289), when Action is set to SSL-VPN, the following options are available:
Note: The SSL-VPN option is available from the Action list after one or more SSL VPN user groups have been created. To create user accounts and SSL VPN user groups, see Configuring SSL VPN user group options on page 416. Figure 170:SSL-VPN encryption policy

SSL Client Certificate Restrictive

Allow traffic generated by holders of a (shared) group certificate. The holders of the group certificate must be members of an SSL VPN user group, and the name of that user group must be present in the Allowed field.

Cipher Strength Select the level of SSL encryption. The web browser on the remote client must be capable of matching the level that you select: To use any cipher suite, select Any. To use a 164-bit or greater cipher suite, select High >= 164. To use a 128-bit or greater cipher suite, select Medium >= 128. User Authentication Method Select one of the following options: Select Local if the user group that will be bound to this firewall policy is a local user group. Select RADIUS if the remote clients will be authenticated by an external RADIUS server. Select LDAP if the remote clients will be authenticated by an external LDAP server. Select Any to enable all of the above authentication methods. Local is attempted first, then Radius, then LDAP.

Available Groups Select the name of the user group requiring SSL VPN access, and then select the right-pointing arrow. Do not select more than one user group unless all members of the selected user groups have identical access requirements.

For information about how to create a firewall encryption policy for SSL VPN users, see the SSL VPN administration tasks chapter of the FortiGate SSL VPN User Guide. NAT does work in an SSL VPN firewall policy. With NAT enabled, the IP address of the outgoing interface of the FortiGate unit is used as the source address for new sessions started by SSL VPN. The traffic shaping option can be used to traffic shape tunnel-mode SSL VPN traffic, but has no effect on web-mode SSL VPN traffic.

Options to check FortiClient on hosts

Some FortiGate models, including models 1000A, 3600A, and 5005FA2, provide FortiClient checking as a firewall policy option. A firewall policy can deny access to hosts that do not have FortiClient Host Security software installed and operating. This feature can detect FortiClient software version 3.0 MR2 or later.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

296

Firewall Policy

Firewall policy examples

Figure 171:FortiClient Host Security check options

Check FortiClient Installed and Running

Select to check that the source host is running FortiClient Host Security software. Enable the following reasons to deny access as needed: FortiClient is Not Installed FortiClient is Not Licensed AV/IPS Database Out-of-Date AV Disabled Firewall Disabled Web Filter Disabled

Redirect Restricted Users to Select to redirect denied users to the internal web portal which provides the reason for denial. From the web portal, FortiGate Download Portal the user can download FortiClient Host Security software. To upload FortiClient software to your FortiGate unit, go to the System Status page (System Information section) or go to the System > Maintenance > Backup & Restore page. For more information, see FortiClient on page 223.

Firewall policy examples

FortiGate units are capable of meeting various network requirements from home use to SOHO, large enterprises and ISPs. The following two scenarios will demonstrate the practical applications of firewall policies in the SOHO and large enterprise environments. For more detail on these two examples, please see the Example Library Network and SOHO and SMB Network Protection example guides in the FortiOS v3.0 MR2 documentation.

Scenario one: SOHO sized business

Company A is a small software company performing development and providing customer support. In addition to their internal network of 15 computers, they also have several employees that work from home all or some of the time. With their current network topography, all 15 of the internal computers are behind a router and must go to an external source to access the IPS Mail and Web servers. All home based employees access the router through open/non secured connections.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

297

Firewall policy examples

Firewall Policy

Figure 172:Example SOHO network before FortiGate installation

Company A requires secure connections for home-based workers. Like many companies, they rely heavily on email and Internet access to conduct business. They want a comprehensive security solution to detect and prevent network attacks, block viruses, and decrease spam. They want to apply different protection settings for different departments. They also want to integrate web and email servers into the security solution. To deal with their first requirement, company A configures specific policies for each home-based worker to ensure secure communication between the homebased worker and the internal network. 1 2 Go to Firewall > Policy. Select Create New and enter or select the following settings for Home_User_1:
Interface / Zone Address Schedule Service Action VPN Tunnel Allow Inbound Allow outbound Inbound NAT Outbound NAT Protection Profile Source: internal Source: CompanyA_Network Always ANY IPSEC Home1 yes yes yes no Enable and select standard_profile Destination: wan1 Destination: Home_User_1

298

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Firewall policy examples

3 4

Select OK. Select Create New and enter or select the following settings for Home_User_2:
Interface / Zone Address Schedule Service Action VPN Tunnel Allow Inbound Allow outbound Inbound NAT Outbound NAT Protection Profile Source: internal Source: CompanyA_network Always ANY IPSEC Home2_Tunnel yes yes yes no Enable and select standard_profile Destination: wan1 Destination: All

Select OK.
Figure 173:SOHO network topology with FortiGate-100

The proposed network is based around a ForitGate 100A unit. The 15 internal computers are behind the FortiGate unit. They now access the email and web servers in a DMZ, which is also behind the FortiGate unit. All home based employees now access the office network through the FortiGate unit via VPN tunnels.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

299

Firewall policy examples

Firewall Policy

Scenario two: enterprise sized business

Located in a large city, the library system is anchored by a main downtown location serving most of the population, with more than a dozen branches spread throughout the city. Each branch is wired to the Internet but none are linked with each other by dedicated connections. The current network topography at the main location consists of three user groups. The main branch staff and public terminals access the servers in the DMZ behind the firewall. The catalog access terminals directly access the catalog server without first going through the firewall. The topography at the branch office has all three users accessing the servers at the main branch via non secured internet connections.
Figure 174:The library systems current network topology

The library must be able to set different access levels for patrons and staff members. The first firewall policy for main office staff members allows full access to the Internet at all times. A second policy will allow direct access to the DMZ for staff members. A second pair of policies are required to allow branch staff members the same access. The staff firewall policies will all use a protection profile configured specifically for staff access. Enabled features include virus scanning, spam filtering, IPS, and blocking of all P2P traffic. FortiGuard web filtering is also used to block advertising, malware, and spyware sites.

300

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Policy

Firewall policy examples

A few users may need special web and catalog server access to update information on those servers, depending on how theyre configured. Special access can be allowed based on IP address or user. The proposed topography has the main branch staff and the catalog access terminals going through a Fortigate HA cluster to the servers in a DMZ. The public access terminals first go through a ForitWiFi unit, where additional policies can be applied, to the HA Cluster and finally to the servers. The branch office has all three users routed through a ForitWiFi unit to the main branch via VPN tunnels.
Figure 175:Proposed library system network topology

Policies are configured in Firewall > Policy. Protection Profiles are configured in Firewall > Protection Profile. Main office staff to Internet policy:
Source Interface Source Address Destination Interface Destination Address Schedule Action Internal All External All Always Accept

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

301

Firewall policy examples

Firewall Policy

Main office staff to DMZ policy:

Source Interface Source Address Destination Interface Destination Address Schedule Action Internal All DMZ Servers Always Accept

Branches staff to Internet policy:

Source Interface Source Address Destination Interface Destination Address Schedule Action Branches Branch Staff External All Always Accept

Branches staff to DMZ policy:

Source Interface Source Address Destination Interface Destination Address Schedule Action Branches Branch Staff DMZ Servers Always Accept

For more information regarding these examples, see: SOHO and SMB Configuration Example Guide FortiGate Enterprise Configuration Example

302

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Address

About firewall addresses

Firewall Address
Firewall addresses and address groups define network addresses that you can use when configuring firewall policies source and destination address fields. The FortiGate unit compares the IP addresses contained in packet headers with firewall policy source and destination addresses to determine if the firewall policy matches the traffic. You can organize related addresses into address groups to simplify your firewall policy list. If you enable virtual domains (VDOMs) on the FortiGate unit, firewall addresses are configured separately for each virtual domain, and you must first enter the virtual domain to configure its firewall addresses. For details, see Using virtual domains on page 81. This section describes: About firewall addresses Viewing the firewall address list Configuring addresses Viewing the address group list Configuring address groups

About firewall addresses

A firewall address can contain one or more network addresses. Network addresses can be represented by an IP address with a netmask, an IP address range, or a fully qualified domain name (FQDN). When representing hosts by an IP address with a netmask, the IP address can represent one or more hosts. For example, a firewall address can be: a single computer, such as 192.45.46.45 a subnetwork, such as 192.168.1.0 for a class C subnet 0.0.0.0, which matches any IP address

The netmask corresponds to the subnet class of the address being added, and can be represented in either dotted decimal or CIDR format. The FortiGate unit automatically converts CIDR formatted netmasks to dotted decimal format. For example, the netmask can be a: netmask for a single computer: 255.255.255.255, or /32 netmask for a class A subnet: 255.0.0.0, or /8 netmask for a class B subnet: 255.255.0.0, or /16 netmask for a class C subnet: 255.255.255.0, or /24 netmask including all IP addresses: 0.0.0.0 Valid IP address and netmask formats include: x.x.x.x/x.x.x.x, such as 192.168.1.0/255.255.255.0 x.x.x.x/x, such as 192.168.1.0/24

Note: IP address 0.0.0.0 with netmask 255.255.255.255 is not a valid firewall address. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

303

Viewing the firewall address list

Firewall Address

When representing hosts by an IP Range, the range indicates hosts with continuous IP addresses in a subnet, such as 192.168.1.[2-10], or 192.168.1.* to indicate the complete range of hosts on that subnet. Valid IP Range formats include: x.x.x.x-x.x.x.x, such as 192.168.110.100-192.168.110.120 x.x.x.[x-x], such as 192.168.110.[100-120] x.x.x.*, such as 192.168.110.*

When representing hosts by a FQDN, the domain name can be a subdomain, such as mail.example.com. A single FQDN firewall address may be used to apply a firewall policy to multiple hosts, such as in load balancing and high availability (HA) configurations. FortiGate units automatically resolves and maintains a record of all addresses to which the FQDN resolves. Valid FQDN formats include: <host_name>.<second_level_domain_name>.<top_level_domain_name>, such as mail.example.com <host_name>.<top_level_domain_name>

Caution: Be cautious if employing FQDN firewall addresses. Using a fully qualified domain name in a firewall policy, while convenient, does present some security risks, because policy matching then relies on a trusted DNS server. Should the DNS server be compromised, firewall policies requiring domain name resolution may no longer function properly. Note: By default, IPv6 firewall addresses are configurable only in the CLI. For information on enabling configuration of IPv6 firewall addresses in the web-based manager, see Settings on page 201.

Viewing the firewall address list

Firewall addresses in the list are grouped by type: IP/Mask, IP Range, or FQDN. FortiGate unit default configurations include the all address, which represents any IP address on any network. To view the address list, go to Firewall > Address.
Figure 176:Firewall address list

Delete Edit

304

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Address

Configuring addresses

Create New

Select to add a firewall address. If IPv6 Support on GUI is enabled, you can alternatively select the down arrow located in the Create New button, then select IPv6 Address, to configure an IPv6 firewall address. For details, see Settings on page 201. The name of the firewall address. The IP address and mask, IP address range, or fully qualified domain name. Select to remove the address. The Delete icon only appears if the address is not currently being used by a firewall policy or address group. Select to edit the address.

Name Address/FQDN Delete icon

Edit icon

Configuring addresses
You can use one of three methods to represent hosts in firewall addresses: IP/Mask, IP Range, or FQDN.
Caution: Be cautious if employing FQDN firewall addresses. Using a fully qualified domain name in a firewall policy, while convenient, does present some security risks, because policy matching then relies on a trusted DNS server. Should the DNS server be compromised, firewall policies requiring domain name resolution may no longer function properly. Note: By default, IPv6 firewall addresses are configurable only in the CLI. For information on enabling configuration of IPv6 firewall addresses in the web-based manager, see Settings on page 201.

To add a firewall address 1 2 Go to Firewall > Address. Select Create New. If IPv6 GUI support is enabled, you can alternatively select the down arrow located in the Create New button, then select IPv6 Address, to configure an IPv6 firewall address. For information on enabling configuration of IPv6 firewall addresses in the web-based manager, see Settings on page 201. You can also create firewall addresses during firewall policy configuration by selecting Create New from the Address drop-down menu. 3 Complete the following:
Figure 177:New address or IP range options

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

305

Viewing the address group list

Firewall Address

Address Name Type

Enter a name to identify the firewall address. Addresses, address groups, and virtual IPs must have unique names. Select the type of address: Subnet/IP Range or FQDN. The Subnet/IP Range type allows you to enter either an IP Range or an IP address with subnet mask.

Subnet/IP Range Enter the firewall IP address, followed by a forward slash (/), then subnet mask, or enter an IP address range separated by a hyphen. Interface Select the interface, zone, or virtual domain (VDOM) link to which you want to bind the IP address. Select Any if you want to bind the IP address with the interface/zone when you create a firewall policy.

Select OK.

Viewing the address group list

You can organize multiple firewall addresses into an address group to simplify your firewall policy list. For example, instead of having five identical policies for five different but related firewall addresses, you might combine the five addresses into a single address group, which is used by a single firewall policy. To view the address group list, go to Firewall > Address > Group.
Figure 178:Firewall address group list

Delete Edit
Create New Group Name Members Delete icon Edit icon Select to add an address group. The name of the address group. The addresses in the address group. Select to remove the address group. The Delete icon only appears if the address group is not currently being used by a firewall policy. Select to edit the address group.

306

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Address

Configuring address groups

Configuring address groups

You can organize multiple firewall addresses into an address group to simplify your firewall policy list. For example, instead of having five identical policies for five different but related firewall addresses, you might combine the five addresses into a single address group, which is used by a single firewall policy. Because firewall policies require addresses with homogenous network interfaces, address groups should contain only addresses bound to the same network interface, or to Any addresses whose selected Interface is Any are bound to a network interface during creation of a firewall policy, rather than during creation of the firewall address. For example, if address A1 is associated with port1, and address A2 is associated with port2, they cannot be grouped. However, if A1 and A2 have an Interface of Any, they can be grouped, even if the addresses involve different networks. To organize addresses into an address group 1 2 Go to Firewall > Address > Group. Select Create New. You can also create firewall address groups during firewall policy configuration by selecting Create New from the Address drop-down menu. 3 Complete the following:
Figure 179:Address group options

Group Name Available Addresses Members

Enter a name to identify the address group. Addresses, address groups, and virtual IPs must have unique names. The list of all configured and default firewall addresses. Use the arrows to move selected addresses between the lists of available and member addresses. The list of addresses included in the address group. Use the arrows to move selected addresses between the lists of available and member addresses.

Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

307

Configuring address groups

Firewall Address

308

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Service

Viewing the predefined service list

Firewall Service
Firewall services define one or more protocols and port numbers associated with each service. Service definitions are used by firewall policies to match session types. You can organize related services into service groups to simplify your firewall policy list. If you enable virtual domains (VDOMs) on the FortiGate unit, firewall services are configured separately for each virtual domain, and you must first enter the virtual domain to configure its firewall services. For details, see Using virtual domains on page 81. This section describes: Viewing the predefined service list Viewing the custom service list Configuring custom services Viewing the service group list Configuring service groups

Viewing the predefined service list

Many well-known traffic types have been predefined in firewall services. These predefined services are defaults, and cannot be edited or removed. If you require service definitions that are different from the predefined services, you can add them using custom services. For details, see Configuring custom services on page 314. To view the predefined service list, go to Firewall > Service.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

309

Viewing the predefined service list

Firewall Service

Figure 180:Predefined service list

Name Detail

The name of the predefined service. The protocol and port number of the predefined service.

310

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Service

Viewing the predefined service list

Table 36: Predefined services Service name AH Description Authentication Header. AH provides source host authentication and data integrity, but not secrecy. This protocol is used for authentication by IPSec remote gateways set to aggressive mode. Matches connections using any protocol over IP. AOL Instant Message protocol. Border Gateway Protocol. BGP is an interior/exterior routing protocol. all TCP TCP IP Protocol Port 51

ANY AOL BGP DCE-RPC

all 5190-5194 179 135 135

Distributed Computing Environment / TCP Remote Procedure Calls. Applications using DCE-RPC can call procedures from UDP another application without having to know on which host the other application is running. Dynamic Host Configuration Protocol. DHCP allocates network addresses and delivers configuration parameters from DHCP servers to hosts. Domain Name Service. DNS resolves domain names into IP addresses. Encapsulating Security Payload. ESP is used by manual key and AutoIKE IPSec VPN tunnels for communicating encrypted data. AutoIKE VPN tunnels use ESP after establishing the tunnel by IKE. A network service providing information about users. File Transfer Protocol. File Transfer Protocol. This service is for FTP connections which upload files. File Transfer Protocol. This service is for FTP connections which download files. Gopher organizes and displays Internet server contents as a hierarchically structured list of files. Generic Routing Encapsulation.GRE allows an arbitrary network protocol to be transmitted over any other arbitrary network protocol, by encapsulating the packets of the protocol within GRE packets. H.323 multimedia protocol. H.323 is a TCP standard approved by the International Telecommunication Union (ITU) defining how audiovisual conferencing data can be transmitted across networks. For more information, see the FortiGate Support for H.323 Technical Note. Hypertext Transfer Protocol. HTTP is used TCP to browse web pages on the World Wide Web. HTTP with secure socket layer (SSL) for secure communication with web servers. TCP TCP TCP TCP TCP TCP UDP

DHCP

53

DNS ESP

TCP UDP

53 53 50

FINGER FTP FTP_GET FTP_PUT GOPHER

79 21 21 21 70

GRE

47

H323

1720, 1503

HTTP

80

HTTPS

443

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

311

Viewing the predefined service list

Firewall Service

Table 36: Predefined services (Continued) Service name ICMP_ANY Description Internet Control Message Protocol. ICMP allows control messages and error reporting between a host and gateway (Internet). Internet Key Exchange. IKE obtains authenticated keying material for use with ISAKMP for IPSEC. Internet Message Access Protocol. IMAP retrieves email messages. IP Protocol Port ICMP N/A

IKE

UDP

500

IMAP

TCP ICMP ICMP TCP TCP

143 17 15 6660-6669 389

INFO_ADDRESS ICMP information request messages. INFO_REQUEST ICMP address mask request messages. IRC Internet Relay Chat. IRC allows users to join chat channels.

InternetInternet Locator Service. ILS includes Locator-Service LDAP, User Locator Service, and LDAP over TLS/SSL. L2TP Layer 2 Tunneling Protocol. L2TP is a PPP-based tunnel protocol for remote access. Lightweight Directory Access Protocol. LDAP is used to access information directories.

TCP

1701

LDAP

TCP

389

MGCP

Media Gateway Control Protocol. MGCP is UDP used by call agents and media gateways in distributed Voice over IP (VoIP) systems. Network File System. NFS allows network TCP users to mount shared files. Network News Transport Protocol. NNTP is used to post, distribute, and retrieve Usenet messages. TCP

2427, 2727

NFS NNTP

111, 2049 119

NTP NetMeeting

Network Time Protocol. NTP synchronizes TCP a hosts time with a time server. NetMeeting allows users to teleconference TCP using the Internet as the transmission medium. Open Shortest Path First. OSPF is a common link state routing protocol. PC-Anywhere is a remote control and file transfer protocol. Ping sends ICMP echo request/reply to test connectivity to other hosts. Ping6 sends ICMPv6 echo request/replies to network hosts to test IPv6 connectivity to other hosts. Post Office Protocol v3. POP retrieves email messages. TCP UDP ICMP

123 1720

OSPF PC-Anywhere PING PING6

89 5632 8 58

POP3 PPTP

110 1723

Point-to-Point Tunneling Protocol. PPTP is TCP used to tunnel connections between private network hosts over the Internet. Note: Also requires IP protocol 47.

312

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Service

Viewing the predefined service list

Table 36: Predefined services (Continued) Service name QUAKE Description IP Protocol Port 26000, 27000, 27910, 27960 7070 512

Quake multi-player computer game traffic. UDP

RAUDIO REXEC

RealAudio multimedia traffic. Rexec traffic allows specified commands to be executed on a remote host running the rexecd service (daemon). Routing Information Protocol. RIP is a common distance vector routing protocol. This service matches RIP v1. Remote login traffic. Remote Shell traffic allows specified commands to be executed on a remote host running the rshd service (daemon).

UDP TCP

RIP

UDP

520

RLOGIN RSH

TCP TCP

513 514

SAMBA

Server Message Block. SMB allows clients TCP to use file and print shares from enabled hosts. This is primarily used for Microsoft Windows hosts, but may be used with operating systems running the Samba daemon. Skinny Client Control Protocol. SCCP is a Cisco proprietary standard for terminal control for use with voice over IP (VoIP). TCP

139

SCCP

2000

SIP

Session Initiation Protocol. SIP allows UDP audiovisual conferencing data to be transmitted across networks. For more information, see the FortiGate SIP Support Technical Note. Session Initiation Protocol used by Microsoft Messenger to initiate an interactive, possibly multimedia session. Simple Mail Transfer Protocol. SMTP is sends email messages. Simple Network Management Protocol. SNMP can be used to monitor and manage complex networks. Secure Shell. SSH allows secure remote management and tunneling. Syslog service for remote logging. Talk allows conversations between two or more users. Matches connections using any TCP port. Telnet allows plain text remote management. Trivial File Transfer Protocol. TFTP is similar to FTP, but without security features such as authentication. ICMP timestamp request messages. Unix to Unix Copy Protocol. UUCP provides simple file copying. VDO Live streaming multimedia traffic. TCP

5060

SIPMSNmessenger SMTP SNMP

1863

TCP TCP UDP TCP UDP UDP UDP TCP TCP UDP

25 161-162 161-162 22 22 514 517-518 0-65535 23 69

SSH SYSLOG TALK TCP TELNET TFTP

TIMESTAMP UDP UUCP VDOLIVE FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

ICMP UDP TCP

13 0-65535 540 7000-7010

Matches connections using any UDP port. UDP

313

Viewing the custom service list

Firewall Service

Table 36: Predefined services (Continued) Service name WAIS Description IP Protocol Port 210

Wide Area Information Server. WAIS is an TCP Internet search protocol which may be used in conjunction with Gopher. WinFrame provides communications between computers running Windows NT, or Citrix WinFrame/MetaFrame. X Window System (also known as X11) can forward the graphical shell from an X Window server to X Window client. TCP

WINFRAME

1494

X-WINDOWS

TCP

6000-6063

Viewing the custom service list

If you need to create a firewall policy for a service that is not in the predefined service list, you can add a custom service. To view the custom service list, go to Firewall > Service > Custom.
Figure 181:Custom service list

Delete Edit
Create New Service Name Detail Delete icon Edit icon Select Create New to add a custom service. The name of the custom service. The protocol and port numbers for each custom service. Select to remove the custom service. The Delete icon only appears if the service is not currently being used by a firewall policy. Select to edit the custom service.

Configuring custom services

If you need to create a firewall policy for a service that is not in the predefined service list, you can add a custom service. You can also create custom services during firewall policy configuration by selecting Create New from the Service dropdown menu. To add a custom TCP or UDP service 1 2 3 4 Go to Firewall > Service > Custom. Select Create New. Set Protocol Type to TCP/UDP. Configure the following.

314

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Service

Configuring custom services

Figure 182:New Custom Service - TCP/UDP

Delete

Name Protocol Type Protocol Source Port

Enter a name for the custom service. Select TCP/UDP. Select TCP or UDP as the protocol of the port range being added. Specify the Source Port number range for the service by entering the low and high port numbers. If the service uses one port number, enter this number in both the Low and High fields. The default values allow the use of any source port.

Destination Port Specify the Destination Port number range for the service by entering the low and high port numbers. If the service uses one port number, enter this number in both the Low and High fields. Add Delete Icon If the custom service being created requires more than one port range, select Add to allow more source and destination ranges. Select to remove the entry from the list.

To add a custom ICMP service 1 2 3 4 Go to Firewall > Service > Custom. Select Create New. Set Protocol Type to ICMP. Configure the following.
Figure 183:New Custom Service - ICMP

Name Protocol Type Type Code

Enter the name of the ICMP custom service. Select ICMP. Enter the ICMP type number for the service. If required, enter the ICMP code number for the service.

To add a custom IP service 1 2 3 Go to Firewall > Service > Custom. Select Create New. Set Protocol Type to IP.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

315

Viewing the service group list

Firewall Service

Configure the following.

Figure 184:New Custom Service - IP

Name Protocol Type

Enter the name of the IP custom service. Select IP.

Protocol Number The IP protocol number for the service.

Viewing the service group list

You can organize multiple firewall services into a service group to simplify your firewall policy list. For example, instead of having five identical policies for five different but related firewall services, you might combine the five services into a single address group, which is used by a single firewall policy. Service groups can contain both predefined and custom services. Service groups cannot contain other service groups. To view the service group list, go to Firewall > Service > Group.
Figure 185:Sample service group list

Delete Edit
Create New Group Name Members Delete icon Edit icon Select to add a service group. The name to identify the service group. The services added to the service group. Select to remove the entry from the list. The Delete icon only appears if the service group is not selected in a firewall policy. Select to edit the following information: Group Name and Members.

316

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Service

Configuring service groups

Configuring service groups

You can organize multiple firewall services into a service group to simplify your firewall policy list. For example, instead of having five identical policies for five different but related firewall services, you might combine the five services into a single address group, which is used by a single firewall policy. Service groups can contain both predefined and custom services. Service groups cannot contain other service groups. To organize services into a service group, go to Firewall > Service > Group. Service groups can also be created during firewall policy configuration by selecting Create New from the Service drop-down menu.
Figure 186:Service Group

Group Name Available Services Members

Enter a name to identify the service group. The list of configured and predefined services. Use the arrows to move selected services between the lists of available and member services. The list of services in the group. Use the arrows to move selected services between the lists of available and member services.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

317

Configuring service groups

Firewall Service

318

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Schedule

Viewing the one-time schedule list

Firewall Schedule
Firewall schedules control when policies are in effect. You can create one-time schedules or recurring schedules. One-time schedules are in effect only once for the period of time specified in the schedule. Recurring schedules are in effect repeatedly at specified times of the day on specified days of the week. If you enable virtual domains (VDOMs) on the FortiGate unit, firewall schedules are configured separately for each virtual domain, and you must first enter the virtual domain to configure its firewall schedules. For details, see Using virtual domains on page 81. This section describes: Viewing the one-time schedule list Configuring one-time schedules Viewing the recurring schedule list Configuring recurring schedules

Viewing the one-time schedule list

You can create a one-time schedule that activates a policy during a specified period of time. For example, a firewall might be configured with a default policy that allows access to all services on the Internet at all times, but you could add a one-time schedule to block access to the Internet during a holiday. To view the one-time schedule list, go to Firewall > Schedule > One-time.
Figure 187:One-time schedule list

Delete Edit
Create New Name Start Stop Delete icon Edit icon Select to add a one-time schedule. The name of the one-time schedule. The start date and time for the schedule. The stop date and time for the schedule. Select to remove the schedule from the list. The Delete icon only appears if the schedule is not being used in a firewall policy. Select to edit the schedule.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

319

Configuring one-time schedules

Firewall Schedule

Configuring one-time schedules

To add a one-time schedule, go to Firewall > Schedule > One-time. You can also create one-time during firewall policy configuration by selecting Create New from the Schedule drop-down list. To put a policy into effect for an entire day, set schedule start and stop time to 00.
Figure 188:New One-time Schedule

Name Start Stop

Enter the name to identify the one-time schedule. Select the start date and time for the schedule. Select the stop date and time for the schedule.

Viewing the recurring schedule list

You can create a recurring schedule that activates a policy during a specified period of time. For example, you might prevent game play during office hours by creating a recurring schedule.
Note: A recurring schedule with a stop time that occurs before the start time starts at the start time and finishes at the stop time on the next day. You can use this technique to create recurring schedules that run from one day to the next. To create a recurring schedule that runs for 24 hours, set the start and stop times to the same time.

To view the recurring schedule list, go to Firewall > Schedule > Recurring.
Figure 189:Recurring schedule list

Delete Edit
Create New Name Day Start Stop Delete icon Edit icon Select to add a recurring schedule. The name of the recurring schedule. The initials of the days of the week on which the schedule is active. The start time of the recurring schedule. The stop time of the recurring schedule. Select to remove the schedule from the list. The Delete icon only appears if the schedule is not being used in a firewall policy. Select to edit the schedule.

320

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Schedule

Configuring recurring schedules

Configuring recurring schedules

To add a recurring schedule, go to Firewall > Schedule > Recurring. You can also create recurring schedules during firewall policy configuration by selecting Create New from the Schedule drop-down list. To put a policy into effect for an entire day, set schedule start and stop time to 00.
Figure 190:New Recurring Schedule

Name Select Start Stop

Enter the name to identify the recurring schedule. Select the days of the week for the schedule to be active. Select the start time for the recurring schedule. Select the stop time for the recurring schedule.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

321

Configuring recurring schedules

Firewall Schedule

322

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Firewall Virtual IP
Virtual IP addresses (VIPs) can be used when configuring firewall policies to translate IP addresses and ports of packets received by a network interface, including a modem interface. When the FortiGate unit receives inbound packets matching a firewall policy whose Destination Address field is a virtual IP, the FortiGate unit applies NAT, replacing packets IP addresses with the virtual IPs mapped IP address. IP pools, similarly to virtual IPs, can be used to configure aspects of NAT; however, IP pools configure dynamic translation of packets IP addresses based on the Destination Interface/Zone, whereas virtual IPs configure dynamic or static translation of a packets IP addresses based upon the Source Interface/Zone. To implement the translation configured in the virtual IP or IP pool, you must add it to a NAT firewall policy. For details, see Configuring virtual IPs on page 328.
Note: Virtual IP and IP pools are available when the FortiGate unit is in network address translation (NAT) operation mode. They are not available or required in Transparent mode.

If you enable virtual domains (VDOMs) on the FortiGate unit, firewall virtual IPs are configured separately for each virtual domain, and you must first enter the virtual domain to configure its firewall virtual IPs. For details, see Using virtual domains on page 81. This section describes: How virtual IPs map connections through FortiGate units Viewing the virtual IP list Configuring virtual IPs Virtual IP Groups Viewing the VIP group list Configuring VIP groups Health Check Monitor IP pools Viewing the IP pool list Configuring IP Pools Double NAT: combining IP pool with virtual IP

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

323

How virtual IPs map connections through FortiGate units

Firewall Virtual IP

How virtual IPs map connections through FortiGate units

Virtual IPs can specify translations of packets port numbers and/or IP addresses for both inbound and outbound connections.
Note: Virtual IPs are not available in Transparent mode.

Inbound connections
Virtual IPs can be used in conjunction with firewall policies whose Action is not DENY to apply bidirectional NAT, also known as inbound NAT. When comparing packets with the firewall policy list to locate a matching policy, if a firewall policys Destination Address is a virtual IP, FortiGate units compares packets destination address to the virtual IPs external IP address. If they match, the FortiGate unit applies the virtual IPs inbound NAT mapping, which specifies how the FortiGate unit translates network addresses and/or port numbers of packets from the receiving (external) network interface to the network interface connected to the destination (mapped) IP address or IP address range. In addition to specifying IP address and port mappings between interfaces, virtual IP configurations can optionally bind an additional IP address or IP address range to the receiving network interface. By binding an additional IP address, you can configure a separate set of mappings that the FortiGate unit can apply to packets whose destination matches that bound IP address, rather than the IP address already configured for the network interface. Depending on your configuration of the virtual IP, its mapping may involve port address translation (PAT), also known as port forwarding or network address port translation (NAPT), and/or network address translation (NAT) of IP addresses. If you configure NAT in the virtual IP and firewall policy, the NAT behavior varies by your selection of: static vs. dynamic NAT mapping the dynamic NATs load balancing style, if using dynamic NAT mapping full NAT vs. destination NAT (DNAT)

The following table describes combinations of PAT and/or NAT that are possible when configuring a firewall policy with a virtual IP.
Static NAT Static, one-to-one NAT mapping: an external IP address is always translated to the same mapped IP address. If using IP address ranges, the external IP address range corresponds to a mapped IP address range containing an equal number of IP addresses, and each IP address in the external range is always translated to the same IP address in the mapped range.

Static NAT with Static, one-to-one NAT mapping with port forwarding: an external IP Port Forwarding address is always translated to the same mapped IP address, and an external port number is always translated to the same mapped port number. If using IP address ranges, the external IP address range corresponds to a mapped IP address range containing an equal number of IP addresses, and each IP address in the external range is always translated to the same IP address in the mapped range. If using port number ranges, the external port number range corresponds to a mapped port number range containing an equal number of port numbers, and each port number in the external range is always translated to the same port number in the mapped range. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

324

Firewall Virtual IP

How virtual IPs map connections through FortiGate units

Server Load Balancing

Dynamic, one-to-many NAT mapping: an external IP address is translated to one of the mapped IP addresses, as determined by the selected load balancing algorithm for more even traffic distribution. The external IP address is not always translated to the same mapped IP address. Server load balancing requires that you configure at least one real server, but can use up to eight. Real servers can be configured with health check monitors. Health check monitors can be used to gauge server responsiveness before forwarding packets.

Server Load Dynamic, one-to-many NAT mapping with port forwarding: an external Balancing with IP address is translated to one of the mapped IP addresses, as Port Forwarding determined by the selected load balancing algorithm for more even traffic distribution. The external IP address is not always translated to the same mapped IP address. Server load balancing requires that you configure at least one real server, but can use up to eight. Real servers can be configured with health check monitors. Health check monitors can be used to gauge server responsiveness before forwarding packets. Note: If the NAT check box is not selected when building the firewall policy, the resulting policy does not perform full (source and destination) NAT; instead, it performs destination network address translation (DNAT). For inbound traffic, DNAT translates packets destination address to the mapped private IP address, but does not translate the source address. The private network is aware of the sources public IP address. For reply traffic, the FortiGate unit translates packets private network source IP address to match the destination address of the originating packets, which is maintained in the session table.

A typical example of static NAT is to allow client access from a public network to a web server on a private network that is protected by a FortiGate unit. Reduced to its essence, this example involves only three hosts, as shown in Figure 191: the web server on a private network, the client computer on another network, such as the Internet, and the FortiGate unit connecting the two networks. When a client computer attempts to contact the web server, it uses the virtual IP on the FortiGate units external interface. The FortiGate unit receives the packets. The addresses in the packets are translated to private network IP addresses, and the packet is forwarded to the web server on the private network.
Figure 191:A simple static NAT virtual IP example

The packets sent from the client computer have a source IP of 192.168.37.55 and a destination IP of 192.168.37.4. The FortiGate unit receives these packets at its external interface, and matches them to a firewall policy for the virtual IP. The virtual IP settings map 192.168.37.4 to 10.10.10.42, so the FortiGate unit changes the packets addresses. The source address is changed to 10.10.10.2 and the destination is changed to 10.10.10.42. The FortiGate unit makes a note of this translation in the firewall session table it maintains internally. The packets are then sent on to the web server.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

325

How virtual IPs map connections through FortiGate units

Firewall Virtual IP

Figure 192:Example of packet address remapping during NAT from client to server

Note that the client computers address does not appear in the packets the server receives. After the FortiGate unit translates the network addresses, there is no reference to the client computers IP address, except in its session table. The web server has no indication that another network exists. As far as the server can tell, all packets are sent by the FortiGate unit. When the web server replies to the client computer, address translation works similarly, but in the opposite direction. The web server sends its response packets having a source IP address of 10.10.10.42 and a destination IP address of 10.10.10.2. The FortiGate unit receives these packets on its internal interface. This time, however, the session table is used to recall the client computers IP address as the destination address for the address translation. In the reply packets, the source address is changed to 192.168.37.4 and the destination is changed to 192.168.37.55. The packets are then sent on to the client computer. The web servers private IP address does not appear in the packets the client receives. After the FortiGate unit translates the network addresses, there is no reference to the web servers network. The client has no indication that the web servers IP address is not the virtual IP. As far as the client is concerned, the FortiGate units virtual IP is the web server.
Figure 193:Example of packet address remapping during NAT from server to client

In the previous example, the NAT check box is checked when configuring the firewall policy. If the NAT check box is not selected when building the firewall policy, the resulting policy does not perform full NAT; instead, it performs destination network address translation (DNAT). For inbound traffic, DNAT translates packets destination address to the mapped private IP address, but does not translate the source address. The web server would be aware of the clients IP address. For reply traffic, the FortiGate unit translates packets private network source IP address to match the destination address of the originating packets, which is maintained in the session table.

Outbound connections
Virtual IPs can also affect outbound NAT, even though they are not selected in an outbound firewall policy. If no virtual IPs are configured, FortiGate units apply traditional outbound NAT to connections outbound from private network IP addresses to public network IP addresses. However, if virtual IP configurations exist, FortiGate units use virtual IPs inbound NAT mappings in reverse to apply outbound NAT, causing IP address mappings for both inbound and outbound traffic to be symmetric.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

326

Firewall Virtual IP

Viewing the virtual IP list

For example, if a network interfaces IP address is 10.10.10.1, and its bound virtual IPs external IP is 10.10.10.2, mapping inbound traffic to the private network IP address 192.168.2.1, traffic outbound from 192.168.2.1 will be translated to 10.10.10.2, not 10.10.10.1

VIP requirements
Virtual IPs have the following requirements. The Mapped IP Address/Range cannot be 0.0.0.0 or 255.255.255.255. The Mapped IP Address/Range must not include any interface IP addresses. If the virtual IP is mapped to a range of IP addresses and its type is Static NAT, the External IP Address/Range cannot be 0.0.0.0. When port forwarding, the External IP Address/Range cannot include any interface IP addresses. When port forwarding, the count of mapped port numbers and external port numbers must be the same, and the last port number in the range must not exceed 65535. Virtual IP names must be different from address or address group names. Duplicate entries or overlapping ranges are not permitted.

Viewing the virtual IP list

To view the virtual IP list, go to Firewall > Virtual IP > Virtual IP.
Figure 194:Virtual IP list

Delete Edit
Create New Name IP Service Port Map to IP/IP Range Map to Port Delete icon Edit icon Select to add a virtual IP. The name of the virtual IP. The bound network interface and external IP address or IP address, separated by a slash (/). The external port number or port number range. This field is empty if the virtual IP does not specify port forwarding. The mapped to IP address or address range on the destination network. The mapped to port number or port number range. This field is empty if the virtual IP does not specify port forwarding. Remove the virtual IP from the list. The Delete icon only appears if the virtual IP is not selected in a firewall policy. Edit the virtual IP to change any virtual IP option including the virtual IP name.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

327

Configuring virtual IPs

Firewall Virtual IP

Configuring virtual IPs

A virtual IPs external IP address can be a single IP address or an IP address range, and is bound to a FortiGate unit interface. When you bind the virtual IPs external IP address to a FortiGate unit interface, by default, the network interface responds to ARP requests for the bound IP address or IP address range. Virtual IPs use proxy ARP, as defined in RFC 1027, so that the FortiGate unit can respond to ARP requests on a network for a server that is actually installed on another network. To disable ARP replies, see the FortiGate CLI Reference. A virtual IPs mapped IP address can be a single IP address, IP address range, or set of defined servers for load balancing. When the FortiGate unit receives packets matching a firewall policy whose Destination Address field is a virtual IP, the FortiGate unit applies NAT, replacing the packets destination IP address with the virtual IPs mapped IP address. To implement the translation configured in the virtual IP or IP pool, you must add it to a NAT firewall policy. For example, to add a firewall policy that maps public network addresses to a private network, add an external to internal firewall policy whose Destination Address field is a virtual IP.
Figure 195:Creating a Virtual IP

Name

Enter or change the name to identify the virtual IP. To avoid confusion, addresses, address groups, and virtual IPs cannot have the same names.

External Interface Select the virtual IP external interface from the list. The external interface is connected to the source network and receives the packets to be forwarded to the destination network. You can select any FortiGate interface, VLAN subinterface, VPN interface, or modem interface. Type Select Static NAT or Server Load Balance. For details about VIP types, see How virtual IPs map connections through FortiGate units on page 324. Enter the external IP address that you want to map to an address on the destination network. To configure a dynamic virtual IP that accepts connections for any IP address, set the external IP address to 0.0.0.0. For a static NAT dynamic virtual IP you can only add one mapped IP address. For a load balance dynamic virtual IP you can specify a single mapped address or a mapped address range.

External IP Address/Range

328

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring virtual IPs

Mapped IP Address/Range

Enter the real IP address on the destination network to which the external IP address is mapped. You can also enter an address range to forward packets to multiple IP addresses on the destination network. For a static NAT virtual IP, if you add a mapped IP address range the FortiGate unit calculates the external IP address range and adds the IP address range to the External IP Address/Range field. This option appears only if Type is Static NAT. If you select Server Load Balance, you can select one of the following load balancing methods. Static: The traffic load is spread evenly across all servers, no additional server is required. Round Robin: Directs request to the next server, and treats all servers as equals regardless of response time or number of connections. Dead servers or non responsive servers are avoided. A separate server is required.

Method

Weighted: Servers with a higher weight value will receive a larger percentage of connections. Set the server weight when adding a server. This option appears only if Type is Server Load Balance. Select to perform port address translation (PAT). Select the protocol of the forwarded packets. This option appears only if Port Forwarding is enabled. Enter the external interface port number for which you want to configure port forwarding. This option appears only if Port Forwarding is enabled. Enter the port number on the destination network to which the external port number is mapped. You can also enter a port number range to forward packets to multiple ports on the destination network. For a virtual IP with static NAT, if you add a map to port range the FortiGate unit calculates the external port number range and adds the port number range to the External Service port field. This option appears only if Port Forwarding is enabled. If you select Server Load Balancing for the Type, enter the real server IP addresses. At least one IP address is required, but you can enter up to eight (8) real server IP addresses per virtual IP (VIP). To enter a server IP address, select Add under Real Servers and enter the following information: IP: Enter the IP address of the server. Port: If you enable port forwarding, enter the port number on the destination network to which the external port number is mapped. Weight: Determines the weight value of a specific server. The higher the weight value, the higher the percentage of connections the server will handle. A range of 1-255 can be used. This option is available only if Method is Weighted. Health Check: Enable this option to use ping detection to check the status of the server before forwarding the session.

Port Forwarding Protocol External Service Port Map to Port

Real Servers

Monitors: If Health Check is selected, select which health check monitor method will be used to perform the health check. For details on configuring a health check monitor, see Health Check Monitor on page 345. This option appears only if Type is Server Load Balance.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

329

Configuring virtual IPs

Firewall Virtual IP

HTTP Multiplexing Select to use the FortiGate units HTTP proxy to multiplex multiple client connections destined for the web server into a few connections between the FortiGate unit and the web server. This can improve performance by reducing server overhead associated with establishing multiple connections. The server must be HTTP/1.1 compliant. This option appears only if Port Forwarding is selected. Note: Additional HTTP Multiplexing options are available in the CLI. For details, see the FortiGate CLI Reference. Preserve Client IP Select to preserve the IP address of the client in the X-ForwardedFor HTTP header. This can be useful if you require logging on the server of the clients original IP address. If this option is not selected, the header will contain the IP address of the FortiGate unit. This option appears only if Port Forwarding is selected, and is available only if HTTP Multiplexing is selected. SSL Offloading Select to accelerate clients SSL connections to the server by using the FortiGate unit to perform SSL operations, then select which segments of the connection will receive SSL offloading. Client <-> FortiGate Select to apply hardware accelerated SSL only to the part of the connection between the client and the FortiGate unit. The segment between the FortiGate unit and the server will use clear text communications. This results in best performance, but cannot be used in failover configurations where the failover path does not have an SSL accelerator. Client <-> FortiGate <-> Server Select to apply hardware accelerated SSL to both parts of the connection: the segment between client and the FortiGate unit, and the segment between the FortiGate unit and the server. The segment between the FortiGate unit and the server will use encrypted communications, but the handshakes will be abbreviated. This results in performance which is less than the other option, but still improved over communications without SSL acceleration, and can be used in failover configurations where the failover path does not have an SSL accelerator. If the server is already configured to use SSL, this also enables SSL acceleration without requiring changes to the servers configuration. SSL 3.0, TLS 1.0, and TLS 1.1 are supported. This option appears only if Port Forwarding is selected, and only on FortiGate models whose hardware support SSL acceleration, such as FortiGate-3600A. Note: Additional SSL Offloading options are available in the CLI. For details, see the FortiGate CLI Reference. Select which SSL certificate to use with SSL Offloading. This option appears only if Port Forwarding is selected, and is available only if SSL Offloading is selected.

Certificate

To configure a virtual IP 1 2 Go to Firewall > Virtual IP > Virtual IP. Select Create New.

330

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring virtual IPs

Configure the virtual IP by entering the virtual IP address, if any, that will be bound to the network interface, and selecting the mapping type and mapped IP address(es) and/or port(s). For configuration examples of each type, see: Adding a static NAT virtual IP for a single IP address on page 331 Adding a static NAT virtual IP for an IP address range on page 333 Adding static NAT port forwarding for a single IP address and a single port on page 334 Adding static NAT port forwarding for an IP address range and a port range on page 336 Adding a server load balance virtual IP on page 338 Adding a server load balance port forwarding virtual IP on page 340 Adding dynamic virtual IPs on page 342 Adding a virtual IP with port translation only on page 343

4 5

Select OK. The virtual IP appears in the virtual IP list. To implement the virtual IP, select the virtual IP in a firewall policy. For example, to add a firewall policy that maps public network addresses to a private network, you might add an external to internal firewall policy and select the Source Interface/Zone to which a virtual IP is bound, then select the virtual IP in the Destination Address field of the policy. For details, see Configuring firewall policies on page 285.

Adding a static NAT virtual IP for a single IP address

The IP address 192.168.37.4 on the Internet is mapped to 10.10.10.42 on a private network. Attempts to communicate with 192.168.37.4 from the Internet are translated and sent to 10.10.10.42 by the FortiGate unit. The computers on the Internet are unaware of this translation and see a single computer at 192.168.37.4 rather than a FortiGate unit with a private network behind it.
Figure 196:Static NAT virtual IP for a single IP address example

To add a static NAT virtual IP for a single IP address 1 2 Go to Firewall > Virtual IP > Virtual IP. Select Create New.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

331

Configuring virtual IPs

Firewall Virtual IP

Use the following procedure to add a virtual IP that allows users on the Internet to connect to a web server on the DMZ network. In our example, the wan1 interface of the FortiGate unit is connected to the Internet and the dmz1 interface is connected to the DMZ network.
Figure 197:Virtual IP options: static NAT virtual IP for a single IP address

Name Type External IP Address/Range

static_NAT Static NAT The Internet IP address of the web server. The external IP address is usually a static IP address obtained from your ISP for your web server. This address must be a unique IP address that is not used by another host and cannot be the same as the IP address of the external interface the virtual IP will be using. However, the external IP address must be routed to the selected interface. The virtual IP address and the external IP address can be on different subnets. When you add the virtual IP, the external interface responds to ARP requests for the external IP address.

External Interface wan1

Map to IP/IP Range The IP address of the server on the internal network. Since there is only one IP address, leave the second field blank.

Select OK. To add a static NAT virtual IP for a single IP address to a firewall policy Add a external to dmz1 firewall policy that uses the virtual IP so that when users on the Internet attempt to connect to the web server IP address packets pass through the FortiGate unit from the external interface to the dmz1 interface. The virtual IP translates the destination address of these packets from the external IP to the DMZ network IP address of the web server.

1 2

Go to Firewall > Policy and select Create New. Configure the firewall policy:
Source Interface/Zone Source Address Destination Address Schedule Service Action external All (or a more specific address) simple_static_nat always HTTP ACCEPT

Destination Interface/Zone dmz1

3 4

Select NAT. Select OK.

332

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring virtual IPs

Adding a static NAT virtual IP for an IP address range

The IP address range 192.168.37.4-192.168.37.6 on the Internet is mapped to 10.10.10.42-10.10.123.44 on a private network. Packets from Internet computers communicating with 192.168.37.4 are translated and sent to 10.10.10.42 by the FortiGate unit. Similarly, packets destined for 192.168.37.5 are translated and sent to 10.10.10.43, and packets destined for 192.168.37.6 are translated and sent to 10.10.10.44. The computers on the Internet are unaware of this translation and see three computers with individual IP addresses rather than a FortiGate unit with a private network behind it.
Figure 198:Static NAT virtual IP for an IP address range example

To add a static NAT virtual IP for an IP address range 1 2 3 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Use the following procedure to add a virtual IP that allows users on the Internet to connect to three individual web servers on the DMZ network. In this example, the wan1 interface of the FortiGate unit is connected to the Internet and the dmz1 interface is connected to the DMZ network.
Figure 199:Virtual IP options: static NAT virtual IP with an IP address range

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

333

Configuring virtual IPs

Firewall Virtual IP

Name External Interface Type

static_NAT_range wan1 Static NAT

External IP Address/Range The Internet IP address range of the web servers. The external IP addresses are usually static IP addresses obtained from your ISP for your web server. These addresses must be unique IP addresses that are not used by another host and cannot be the same as the IP addresses of the external interface the virtual IP will be using. However, the external IP addresses must be routed to the selected interface. The virtual IP addresses and the external IP address can be on different subnets. When you add the virtual IP, the external interface responds to ARP requests for the external IP addresses. Map to IP/IP Range The IP address range of the servers on the internal network. Define the range by entering the first address of the range in the first field and the last address of the range in the second field.

Select OK. To add a static NAT virtual IP with an IP address range to a firewall policy Add a wan1 to dmz1 firewall policy that uses the virtual IP so that when users on the Internet attempt to connect to the server IP addresses, packets pass through the FortiGate unit from the wan1 interface to the dmz1 interface. The virtual IP translates the destination addresses of these packets from the wan1 IP to the DMZ network IP addresses of the servers.

1 2

Go to Firewall > Policy and select Create New. Configure the firewall policy:
Source Interface/Zone Source Address Destination Address Schedule Service Action wan1 All (or a more specific address) static_NAT_range always HTTP ACCEPT

Destination Interface/Zone dmz1

3 4

Select NAT. Select OK.

Adding static NAT port forwarding for a single IP address and a single port
The IP address 192.168.37.4, port 80 on the Internet is mapped to 10.10.10.42, port 8000 on a private network. Attempts to communicate with 192.168.37.4, port 80 from the Internet are translated and sent to 10.10.10.42, port 8000 by the FortiGate unit. The computers on the Internet are unaware of this translation and see a single computer at 192.168.37.4, port 80 rather than a FortiGate unit with a private network behind it.

334

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring virtual IPs

Figure 200:Static NAT virtual IP port forwarding for a single IP address and a single port example

To add static NAT virtual IP port forwarding for a single IP address and a single port 1 2 3 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Use the following procedure to add a virtual IP that allows users on the Internet to connect to a web server on the DMZ network. In our example, the wan1 interface of the FortiGate unit is connected to the Internet and the dmz1 interface is connected to the DMZ network.
Figure 201:Virtual IP options: Static NAT port forwarding virtual IP for a single IP address and a single port

Name External Interface Type

Port_fwd_NAT_VIP wan1 Static NAT

External IP Address/Range The Internet IP address of the web server. The external IP address is usually a static IP address obtained from your ISP for your web server. This address must be a unique IP address that is not used by another host and cannot be the same as the IP address of the external interface the virtual IP will be using. However, the external IP address must be routed to the selected interface. The virtual IP address and the external IP address can be on different subnets. When you add the virtual IP, the external interface responds to ARP requests for the external IP address.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

335

Configuring virtual IPs

Firewall Virtual IP

Map to IP/IP Range Port Forwarding Protocol External Service Port Map Port

The IP address of the server on the internal network. Since there is only one IP address, leave the second field blank. Selected TCP The port traffic from the Internet will use. For a web server, this will typically be port 80. The port on which the server expects traffic. Since there is only one port, leave the second field blank.

Select OK. To add static NAT virtual IP port forwarding for a single IP address and a single port to a firewall policy Add a wan1 to dmz1 firewall policy that uses the virtual IP so that when users on the Internet attempt to connect to the web server IP addresses, packets pass through the FortiGate unit from the wan1 interface to the dmz1 interface. The virtual IP translates the destination addresses and ports of these packets from the external IP to the dmz network IP addresses of the web servers.

1 2

Go to Firewall > Policy and select Create New. Configure the firewall policy:
Source Interface/Zone Source Address Destination Address Schedule Service Action wan1 All (or a more specific address) Port_fwd_NAT_VIP always HTTP ACCEPT

Destination Interface/Zone dmz1

3 4

Select NAT. Select OK.

Adding static NAT port forwarding for an IP address range and a port range
Ports 80 to 83 of addresses 192.168.37.4 to 192.168.37.7 on the Internet are mapped to ports 8000 to 8003 of addresses 10.10.10.42 to 10.10.10.44 on a private network. Attempts to communicate with 192.168.37.5, port 82 from the Internet, for example, are translated and sent to 10.10.10.43, port 8002 by the FortiGate unit. The computers on the Internet are unaware of this translation and see a single computer at 192.168.37.5 rather than a FortiGate unit with a private network behind it.

336

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring virtual IPs

Figure 202:Static NAT virtual IP port forwarding for an IP address range and a port range example

To add static NAT virtual IP port forwarding for an IP address range and a port range 1 2 3 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Use the following procedure to add a virtual IP that allows users on the Internet to connect to a web server on the DMZ network. In this example, the external interface of the FortiGate unit is connected to the Internet and the dmz1 interface is connected to the DMZ network.
Name External Interface Type Port_fwd_NAT_VIP_port_range external Static NAT

External IP Address/Range The external IP addresses are usually static IP addresses obtained from your ISP. This addresses must be unique, not used by another host, and cannot be the same as the IP address of the external interface the virtual IP will be using. However, the external IP addresses must be routed to the selected interface. The virtual IP addresses and the external IP address can be on different subnets. When you add the virtual IP, the external interface responds to ARP requests for the external IP addresses. Map to IP/IP Range The IP addresses of the server on the internal network. Define the range by entering the first address of the range in the first field and the last address of the range in the second field. Selected TCP The ports that traffic from the Internet will use. For a web server, this will typically be port 80. The ports on which the server expects traffic. Define the range by entering the first port of the range in the first field and the last port of the range in the second field. If there is only one port, leave the second field blank.

Port Forwarding Protocol External Service Port Map Port

Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

337

Configuring virtual IPs

Firewall Virtual IP

To add static NAT virtual IP port forwarding for an IP address range and a port range to a firewall policy Add a external to dmz1 firewall policy that uses the virtual IP so that when users on the Internet attempt to connect to the web server IP addresses, packets pass through the FortiGate unit from the external interface to the dmz1 interface. The virtual IP translates the destination addresses and ports of these packets from the external IP to the dmz network IP addresses of the web servers. 1 2 Go to Firewall > Policy and select Create New. Configure the firewall policy:
Source Interface/Zone Source Address Destination Address Schedule Service Action external All (or a more specific address) Port_fwd_NAT_VIP_port_range always HTTP ACCEPT

Destination Interface/Zone dmz1

3 4

Select NAT. Select OK.

Adding a server load balance virtual IP

In this example the IP address 192.168.37.4 on the Internet, is mapped to the following servers behind the fortiGate unit, 10.10.123.42, 10.10.123.43, and 10.10.123.44. The IP address mapping is determined by the FortiGate units load balancing algorithm. Attempts to communicate with 192.168.37.4 from the Internet are translated and sent to 10.10.10.42, 10.10.10.43, or 10.10.10.44 by the FortiGate unit. The computers on the Internet are unaware of this translation and see a single computer at 192.168.37.4 rather than a FortiGate unit with a private network behind it.
Note: Server load balancing maps a single IP on one network to up to eight real server IPs on another network. At least one real address must be added to use this feature Figure 203:Server Load balance virtual IP

338

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring virtual IPs

To add a server load balance virtual IP 1 2 3 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Use the following procedure to add a virtual IP that allows users on the Internet to connect to a web server on the DMZ network. In this example, the wan1 interface of the FortiGate unit is connected to the Internet and the dmz1 interface is connected to the DMZ network.
Figure 204:Virtual IP options: server load balancing virtual IP

Name External Interface Type

Load_Bal_VIP wan1 Server Load Balance

External IP address/Range The public IP addresses of the web servers. The external IP address is usually a static IP address obtained from your ISP for your web server. This address must be a unique IP address that is not used by another host and cannot be the same as the IP address of the external interface the virtual IP will be using. However, the external IP address must be routed to the selected interface. The virtual IP address and the external IP address can be on different subnets. When you add the virtual IP, the external interface responds to ARP requests for the external IP address. Method Real Servers Select one of the load balance methods. For details, see Configuring virtual IPs on page 328. If you select Server Load Balancing for the VIP type, enter the real server IP addresses. For details about real server settings, see Configuring virtual IPs on page 328.

Select OK. To add a server load balance virtual IP to a firewall policy Add a wan1 to dmz1 firewall policy that uses the virtual IP so that when users on the Internet attempt to connect to the web servers IP address, packets pass through the FortiGate unit from the wan1 interface to the dmz1 interface. The virtual IP translates the destination address of these packets from the external IP to the dmz network IP addresses of the web servers.

1 2

Go to Firewall > Policy and select Create New. Configure the firewall policy:

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

339

Configuring virtual IPs

Firewall Virtual IP

Source Interface/Zone Source Address Destination Address Schedule Service Action

wan1 All (or a more specific address) Server_Load_Bal_VIP always HTTP ACCEPT

Destination Interface/Zone dmz1

3 4

Select NAT. Select OK.

Adding a server load balance port forwarding virtual IP

In this example, connections to 192.168.37.4 on the Internet are mapped to 10.10.10.42, 10.10.10.43, and 10.10.10.44 on a private network. The IP address mapping is determined by the FortiGate unit load balancing algorithm. The external service port on 192.168.37.4 is mapped to specified ports in conjunction with the specified IP addresses. The computers on the Internet are unaware of this translation and see a single computer at 192.168.37.4 rather than a FortiGate unit with a private network behind it.
Figure 205:Server load balance virtual IP port forwarding

To add a server load balance port forwarding virtual IP 1 2 3 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Use the following procedure to add a virtual IP that allows users on the Internet to connect to a web server on the DMZ network. In this example, the wan1 interface of the FortiGate unit is connected to the Internet and the dmz1 interface is connected to the DMZ network.

340

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring virtual IPs

Figure 206:Server load balanced port forwarding

Name External Interface Type

Load_Bal_VIP_port_forward wan1 Server Load Balance

External IP Address/Range The public IP addresses of the web servers. The external IP address is usually a static IP address obtained from your ISP for your web server. This address must be a unique IP address that is not used by another host and cannot be the same as the IP address of the wan1 interface the virtual IP will be using. However, the external IP address must be routed to the selected interface. The virtual IP address and the external IP address can be on different subnets. When you add the virtual IP, the external interface responds to ARP requests for the external IP address. Method Real Servers Select one of the load balance methods. For details, see Configuring virtual IPs on page 328. If you select Server Load Balancing for the VIP type, enter the real server IP addresses. For details about real server settings, see Configuring virtual IPs on page 328. Selected TCP The ports that traffic from the Internet will use. For a web server, this will typically be port 80.

Port Forwarding Protocol External Service Port

Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

341

Configuring virtual IPs

Firewall Virtual IP

To add a server load balance virtual IP to a firewall policy Add a wan1 to dmz1 firewall policy that uses the virtual IP so that when users on the Internet attempt to connect to the web server IP address packets pass through the FortiGate unit from the wan1 interface to the dmz1 interface. The virtual IP translates the destination address of these packets from the wan1 IP to the dmz network IP addresses of the web servers. 1 2 Go to Firewall > Policy and select Create New. Configure the firewall policy:
Source Interface/Zone Source Address Destination Address Schedule Service Action wan1 All (or a more specific address) Load_Bal_VIP_port_forward always HTTP ACCEPT

Destination Interface/Zone dmz1

3 4

Select NAT. Select OK.

Adding dynamic virtual IPs

Adding a dynamic virtual IP is similar to adding a virtual IP. The difference is that the External IP address must be set to 0.0.0.0 so the External IP address matches any IP address. To add a dynamic virtual IP 1 2 3 4 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Enter a name for the dynamic virtual IP. Select the virtual IP External Interface from the list. The external interface is connected to the source network and receives the packets to be forwarded to the destination network. Select any firewall interface or a VLAN subinterface. 5 6 7 8 9 Set the External IP Address to 0.0.0.0. The 0.0.0.0 External IP Address matches any IP address. Enter the Map to IP address to which to map the external IP address. For example, the IP address of a PPTP server on an internal network. Select Port Forwarding. For Protocol, select TCP. Enter the External Service Port number for which to configure dynamic port forwarding. The external service port number must match the destination port of the packets to be forwarded. For example, if the virtual IP provides PPTP passthrough access from the Internet to a PPTP server, the external service port number should be 1723 (the PPTP port).

342

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Virtual IP Groups

10

Enter the Map to Port number to be added to packets when they are forwarded. Enter the same number as the External Service Port if the port is not to be translated.

11

Select OK.

Adding a virtual IP with port translation only

When adding a virtual IP, if you enter a virtual IP address that is the same as the mapped IP address and apply port forwarding, the destination IP address will be unchanged, but the port number will be translated.
Note: To apply port forwarding to the external interface without binding a virtual IP address to it, enter the IP address of the network interface instead of a virtual IP address, then configure port forwarding as usual.

To add a virtual IP with port translation only 1 2 3 4 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Enter a name for the dynamic virtual IP. Select the virtual IP External Interface from the list. The external interface is connected to the source network and receives the packets to be forwarded to the destination network. Select any firewall interface or a VLAN subinterface. 5 6 7 8 9 Set the External IP Address as the mapped IP address. Enter the Map to IP address to which to map the external IP address. For example, the IP address of a PPTP server on an internal network. Select Port Forwarding. For Protocol, select TCP. Enter the External Service Port number for which to configure dynamic port forwarding. The external service port number must match the destination port of the packets to be forwarded. For example, if the virtual IP provides PPTP passthrough access from the Internet to a PPTP server, the external service port number should be 1723 (the PPTP port). 10 11 Enter the Map to Port number to be added to packets when they are forwarded. Select OK.

Virtual IP Groups
You can organize multiple virtual IPs into a virtual IP group to simplify your firewall policy list. For example, instead of having five identical policies for five different but related virtual IPs located on the same network interface, you might combine the five virtual IPs into a single virtual IP group, which is used by a single firewall policy. Firewall policies using VIP Groups are matched by comparing both the member VIP IP address(es) and port number(s).
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

343

Viewing the VIP group list

Firewall Virtual IP

Viewing the VIP group list

To view the virtual IP group list, go to Firewall > Virtual IP > VIP Group.
Figure 207:VIP Group list

Delete Edit
Create New Group Name Members Interface Delete icon Edit icon Select to add a new VIP group. See Configuring VIP groups on page 344. The name of the virtual IP group. Lists the group members. Displays the interface that the VIP group belongs to. Remove the VIP group from the list. The Delete icon only appears if the VIP group is not being used in a firewall policy. Edit the VIP group information, including the group name and membership.

Configuring VIP groups

To add a VIP group, go to Firewall > Virtual IP > VIP Group and select Create new. To edit a VIP group, go to Firewall > Virtual IP > VIP Group and select the Edit icon for the VIP group to edit.
Figure 208:Editing a VIP group

Configure the following settings and select OK:

344

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Health Check Monitor

Group Name Interface

Enter or modify the group name. Select the interface for which you want to create the VIP group. If you are editing the group, the Interface box is grayed out. Select the up or down arrow to move virtual IPs between Available VIPs and Members. Members contains virtual IPs that are a part of this virtual IP group.

Available VIPs and Members

Health Check Monitor

When Health Check is enabled for virtual IPs of the server load balancing type, you can specify which health check monitor configuration to use when polling to determine a servers connectivity status. Health check monitor configurations can specify TCP, HTTP or ICMP PING. A health check occurs every number of seconds indicated by the interval. If a reply is not received within the timeout period, and you have configured the health check to retry, it will attempt a health check again; otherwise, the server is deemed unresponsive, and load balancing will compensate by disabling traffic to that server until it becomes responsive again. Health check monitor configurations are not active until used by a VIP. For information on enabling health checks for a VIP and specifying which health check monitor configuration a VIP will use, see Configuring virtual IPs on page 328.
Figure 209:Health Check Monitor

Delete Edit Create New Name Details Select to add a health check monitor configuration. The name of the health check monitor configuration. The details of the health check monitor configuration, which vary by the type of the health check monitor, and do not include the interval, timeout, or retry, which are settings common to all types. This field is empty if the type of the health check monitor is PING. Select Delete to remove the health check monitor configuration. This option appears only if the health check monitor configuration is not currently being used by a VIP configuration. Select Edit to change the health check monitor configuration.

To create a health check monitor configuration 1 2 3 Go to Firewall > Virtual IP > Health Check Monitor. Select Create New. Complete the following:

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

345

IP pools

Firewall Virtual IP

Name Type

Enter the name of the health check monitor configuration. Select the protocol used to perform the health check. TCP HTTP PING

Port URL Matched Content

Enter the port number used to perform the health check. This option does not appear if the Type is PING. Enter the URL that will receive the HTTP request. This option appears only if Type is HTTP. Enter the HTTP reply content that must be present to indicate proper server connectivity. This option appears only if Type is HTTP. Enter the number of seconds between each server health check. Enter the number of seconds which must pass after the server health check to indicate a failed health check. Enter the number of times, if any, a failed health check will be retried before the server is determined to be inaccessible.

Interval Timeout Retry

Select OK.

IP pools
Use IP pools to add NAT policies that translate source addresses to addresses randomly selected from the IP pool, rather than the IP address assigned to that FortiGate unit interface. An IP pool defines an address or a range of IP addresses, all of which respond to ARP requests on the interface to which the IP pool is added. Select Enable Dynamic IP Pool in a firewall policy to translate the source address of outgoing packets to an address randomly selected from the IP pool. An IP pool list appears when the policy destination interface is the same as the IP pool interface. With an IP pool added to the internal interface, you can select Dynamic IP pool for policies with the internal interface as the destination. Add multiple IP pools to any interface and select the IP pool to use when configuring a firewall policy. A single IP address is entered normally. For example, 192.168.110.100 is a valid IP pool address. If an IP address range is required, use either of the following formats. x.x.x.x-x.x.x.x, for example 192.168.110.100-192.168.110.120 x.x.x.[x-x], for example 192.168.110.[100-120]

IP pools and dynamic NAT

Use IP pools for dynamic NAT. For example, an organization might have purchased a range of Internet addresses but has only one Internet connection on the external interface of the FortiGate unit.

346

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

IP pools

Assign one of the organizations Internet IP addresses to the external interface of the FortiGate unit. If the FortiGate unit is operating in NAT/Route mode, all connections from the network to the Internet appear to come from this IP address. For connections to originate from all the Internet IP addresses, add this address range to an IP pool for the external interface. Then select Dynamic IP Pool for all policies with the external interface as the destination. For each connection, the firewall dynamically selects an IP address from the IP pool to be the source address for the connection. As a result, connections to the Internet appear to be originating from any of the IP addresses in the IP pool.

IP Pools for firewall policies that use fixed ports

Some network configurations do not operate correctly if a NAT policy translates the source port of packets used by the connection. NAT translates source ports to keep track of connections for a particular service. Select fixed port for NAT policies to prevent source port translation. However, selecting fixed port means that only one connection can be supported through the firewall for this service. To be able to support multiple connections, add an IP pool to the destination interface, and then select dynamic IP pool in the policy. The firewall randomly selects an IP address from the IP pool and assigns it to each connection. In this case the number of connections that the firewall can support is limited by the number of IP addresses in the IP pool.

Source IP address and IP pool address matching

When the source addresses are translated to the IP pool addresses, one of the following three cases may occur: Scenario 1: The number of source addresses equals that of IP pool addresses In this case, the FortiGate unit will always match the IP addressed one to one. If you use fixed port in such a case, the FortiGate unit will preserve the original source port. However, this may cause conflicts if more than one firewall policy uses the same IP pool, or the same IP addresses are used in more than one IP pool.
Original address 192.168.1.1 192.168.1.2 ...... 192.168.1.254 Change to 172.16.30.1 172.16.30.2 ...... 172.16.30.254

Scenario 2: The number of source addresses is more than that of IP pool addresses In this case, the FortiGate unit translates IP addresses using a wrap-around mechanism. If you use fixed port in such a case, the FortiGate unit preserves the original source port. But conflicts may occur since users may have different sessions using the same TCP 5 tuples.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

347

Viewing the IP pool list

Firewall Virtual IP

Original address 192.168.1.1 192.168.1.2 ...... 192.168.1.10 192.168.1.11 192.168.1.12 192.168.1.13 ......

Change to 172.16.30.10 172.16.30.11 ...... 172.16.30.19 172.16.30.10 172.16.30.11 172.16.30.12 ......

Scenario 3: The number of source addresses is fewer than that of IP pool addresses In this case, some of the IP pool addresses will used and the rest of them will not be used.
Original address 192.168.1.1 192.168.1.2 192.168.1.3 No more source addresses Change to 172.16.30.10 172.16.30.11 172.16.30.12 172.16.30.13 and other addresses will not be used

Viewing the IP pool list

If virtual domains are enabled on the FortiGate unit, IP pools are created separately for each virtual domain. To access IP pools, select a virtual domain from the list on the main menu. IP pools are not available in Transparent mode. To view the IP pool list go to Firewall > Virtual IP > IP Pool.
Figure 210:IP pool list

Delete Edit
Create New Name Start IP End IP Select to add an IP pool. Enter the name of the IP pool. Enter the start IP defines the start of an address range. Enter the end IP defines the end of an address range.

348

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Configuring IP Pools

Delete icon Edit icon

Select to remove the entry from the list. The Delete icon only appears if the IP pool is not being used in a firewall policy. Select to edit the following information: Name, Interface, IP Range/Subnet.

Configuring IP Pools
To add an IP pool, go to Firewall > Virtual IP > IP Pool.
Figure 211:New Dynamic IP Pool

Name Interface

Enter the name of the IP pool. Select the interface to which to add an IP pool.

IP Range/Subnet Enter the IP address range for the IP pool. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range. The IP range does not have to be on the same subnet as the IP address of the interface to which the IP pool is being added.

Double NAT: combining IP pool with virtual IP

When creating a firewall policy, you can use both IP pool and virtual IP for double IP and/or port translation. For example, in the following network topology: Users in the 10.1.1.0/24 subnet use port 8080 to access server 172.16.1.1. The servers listening port is 80. Fixed ports must be used.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

349

Double NAT: combining IP pool with virtual IP

Firewall Virtual IP

Figure 212:Double NAT

To allow the local users to access the server, you can use fixed port and IP pool to allow more than one user connection while using virtual IP to translate the destination port from 8080 to 80. To create an IP pool 1 2 3 Go to Firewall > Virtual IP > IP Pool. Select Create New. Enter the following information and select OK.
Name Interface pool-1 DMZ

IP Range/Subnet 10.1.3.1-10.1.3.254

To create a Virtual IP with port translation only 1 2 3 Go to Firewall > Virtual IP > Virtual IP. Select Create New. Enter the following information and select OK.
Name External Interface Type server-1 Internal Static NAT

External IP 172.16.1.1 Address/Range Note this address is the same as the server address. Mapped IP 172.16.1.1. Address/Range Port Forwarding Enable Protocol TCP

350

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Virtual IP

Double NAT: combining IP pool with virtual IP

External Service 8080 Port Map to Port 80

To create a firewall policy Add an internal to dmz firewall policy that uses the virtual IP to translate the destination port number and the IP pool to translate the source addresses. 1 2 3 Go to Firewall > Policy. Select Create New. Configure the firewall policy:
Source Interface/Zone Source Address Destination Address Schedule Service Action internal 10.1.1.0/24 server-1 always HTTP ACCEPT

Destination Interface/Zone dmz

4 5

Select NAT. Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

351

Double NAT: combining IP pool with virtual IP

Firewall Virtual IP

352

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

What is a protection profile?

Firewall Protection Profile

Protection profiles contain settings for many application layer and other types of protection, such as antivirus, web filtering, and logging, that you can apply to a firewall policy. Protection profiles can also contain settings for protocol-specific firewall actions, such as rate limiting for voice over IP (VoIP). If you enable virtual domains (VDOMs) on the FortiGate unit, firewall protection profiles are configured separately for each virtual domain, and you must first enter the virtual domain to configure its firewall protection profiles. For details, see Using virtual domains on page 81. This section describes: What is a protection profile? Default protection profiles Viewing the protection profile list Configuring a protection profile Applying a protection profile to a policy

What is a protection profile?

A protection profile is a group of settings that you can apply to one or more firewall policies. Because protection profiles can be used by more than one firewall policy, you can configure once a protection profile for the traffic types handled by a set of firewall policies requiring identical protection levels and types, rather than repeatedly configuring those same protection profile settings for each individual firewall policy.
Note: If the firewall policy requires authentication, do not select the protection profile in the firewall policy. Instead, the protection profile is specific to the authenticating user group. For details on configuring the protection profile associated with the user group, see Configuring a user group on page 414.

For example, while traffic between trusted and untrusted networks might need strict protection, traffic between trusted internal addresses might need moderate protection. To provide the different levels of protection, you might configure two separate protection profiles: one for traffic between trusted networks, and one for traffic between trusted and untrusted networks. You can use protection profiles to configure: antivirus protection web filtering FortiGuard Web Filtering spam filtering IPS content archiving

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

353

Default protection profiles

Firewall Protection Profile

IM filtering and access control P2P access and bandwidth control logging for traffic which violates the protection profile rate limiting for VoIP protocols (SIP and SCCP)

Default protection profiles

FortiGate units have four default protection profiles. You can use these default protection profiles as bases for creating your own protection profiles.
Strict Apply maximum protection to HTTP, FTP, IMAP, POP3, and SMTP traffic. The strict protection profile may not be useful under normal circumstances, but it is available when maximum protection is required. Apply virus scanning to HTTP, FTP, IMAP, POP3, and SMTP traffic. Quarantine is also selected for all content services. On FortiGate models with a hard drive, if antivirus scanning finds a virus in a file, the file is quarantined on the FortiGate hard disk. If a FortiAnalyzer unit is configured, files are quarantined remotely. Quarantine permits system administrators to inspect, recover, or submit quarantined files to Fortinet for analysis. Apply virus scanning and web content blocking to HTTP traffic. Add this protection profile to firewall policies that control HTTP traffic. Apply no scanning, blocking or IPS. Use the unfiltered content profile if no content protection for content traffic is required. Add this protection profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected.

Scan

Web Unfiltered

Viewing the protection profile list

Both default and customized protection profiles appear in the protection profile list. To view the protection profile list, go to Firewall > Protection Profile.
Figure 213:Default protection profiles

Delete Edit
Create New Name Delete Select to add a protection profile. The name of the protection profile Select to remove a protection profile from the list. The Delete icon appears only if the protection profile is not currently selected in a firewall policy or user group. Select to modify a protection profile.

Edit

354

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

Configuring a protection profile

Configuring a protection profile

If the default protection profiles do not provide the settings required, you can create custom protection profiles. To add a protection profile, go to Firewall > Protection Profile and select Create New.
Note: If both Virus Scan and File Block are enabled, the FortiGate unit blocks files matching enabled file patterns before scanning files for viruses. Figure 214:New Protection Profile

Enter a name for the protection profile. Enter a description of the profile. Descriptions longer than 63 characters will be truncated. AntiVirus See Anti-Virus options on page 356. Web Filtering See Web Filtering options on page 358. FortiGuard Web Filtering See FortiGuard Web Filtering options on page 359. Spam Filtering See Spam Filtering options on page 361. IPS See IPS options on page 363. Content Archive See Content Archive options on page 363. IM & P2P See IM/P2P options on page 365. VoIP See VoIP options on page 366. Logging See Logging options on page 366.

Profile Name Comments

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

355

Configuring a protection profile

Firewall Protection Profile

Anti-Virus options
Antivirus scanning options can be applied through a protection profile. For more antivirus configuration options, see AntiVirus on page 421.
Figure 215:Protection Profile Anti-Virus options

Virus Scan

Select virus scanning for each protocol (HTTP, FTP, IMAP, POP3, SMTP, IM). Grayware, if enabled in AntiVirus > Config > Grayware, is included with the Virus Scan. Unless it is disabled in the config antivirus heuristic CLI command, the virus scan includes heuristic scanning. Note: When you enable virus scanning, scanning by splice, also called streaming mode, is enabled automatically. When scanning by splice, the FortiGate unit simultaneously scans and streams traffic to the destination, terminating the stream to the destination if a virus is detected. For details on configuring splicing, see the splice option for each protocol in the config firewall profile command in the FortiGate CLI Reference. For details on splicing behavior for each protocol, see the Knowledge Center article FortiGate Proxy Splice and Client Comforting Technical Note. Select to scan for viruses that have not been recently observed in the wild. In addition to the FortiGuard Antivirus wild list database, which contains viruses currently being detected in the wild, some FortiGate models are also equipped with an extended antivirus database, which contains viruses that have not been recently observed in the wild. This option appears only on models with more than one partition, such as the FortiGate-3810A. Select to filter files, then specify a file filter, which can consist of file name patterns and file types. For details, see File Filter on page 424. Select for each protocol to quarantine suspect files for later inspection or submission to Fortinet for analysis. This option appears only if the FortiGate unit has a hard drive or a configured FortiAnalyzer unit, and will take effect only if you have first enabled and configured the quarantine. For details on enabling and configuring the quarantine, see Quarantine on page 427.

Extended AV Database

File Filter Quarantine

Pass fragmented Select to allow fragmented email for mail protocols (IMAP, POP3, and SMTP). Fragmented email cannot be scanned for viruses. emails

356

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

Configuring a protection profile

Comfort Clients

Select client comforting for each protocol. Client comforting periodically forwards to the client a portion of the file being buffered for scanning, providing feedback that the download is occurring and preventing connection timeouts. Users can observe web pages loading or file downloads progressing. Without client comforting, users have no indication that the download has started until the FortiGate unit has completely buffered and scanned the download, and they may cancel or repeatedly retry the transfer, thinking it has failed. Interval The time in seconds before client comforting starts after the download has begun, and the time between subsequent intervals. The number of bytes sent at each interval.

Amount Oversized File/Email

Select block or pass for files and email messages exceeding configured thresholds for each protocol. Threshold If the file is larger than the threshold value in megabytes, the file is passed or blocked. The maximum threshold for scanning in memory is 10% of the FortiGate units RAM. Note: For email scanning, the oversize threshold refers to the final size of the email after encoding by the email client, including attachments. Email clients can use a variety of encoding types, and some encoding types result in larger file sizes than the original attachment. The most common encoding, base64, translates 3 bytes of binary data into 4 bytes of base64 data. As a result, a file may be blocked or logged as oversized even if the attachment is several megabytes smaller than the configured oversize threshold.

Add signature to Create and enable a signature to append to outgoing email (SMTP outgoing emails only).

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

357

Configuring a protection profile

Firewall Protection Profile

Web Filtering options

Web filtering options can be applied through a protection profile. See Web Filter on page 451 for more web filter configuration options.
Figure 216:Protection Profile Web Filtering options

Web Content Block

Select to block HTTP traffic based on the words or patterns in the content block filter. Web content block drop-down list: Select which content block filter will be used with this protection profile. Threshold: Enter a score threshold. If the combined scores of the content block patterns appearing on a web page exceed the threshold value, the page will be blocked. For details, see Viewing the web content block list on page 455. Enable or disable the override of web content block based on the content exempt patterns in the content exempt list. Web content exempt drop-down list: Select which content exemptions will be used with this protection profile. Select to block HTTP and HTTPS traffic based on the URL list. For details on how web URL filter lists are used with HTTP and HTTPS URLs, see URL formats on page 462. Web URL filter drop-down list: Select which web URL filter list will be used with this protection profile. Enable blocking of ActiveX controls. Enable blocking of cookies. Enable blocking of Java applets. Enable to block downloading parts of a file that have already been partially downloaded. Enabling this option will prevent the unintentional download of virus files hidden in fragmented files. Note that some types of files, such as PDFs, are fragmented to increase download speed. Enabling this option can cause download interruptions with these types of file.

Web Content Exempt

Web URL Filter

ActiveX Filter Cookie Filter Java Applet Filter Web resume download block

358

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

Configuring a protection profile

Block Invalid URLs

Enable to block web sites whose SSL certificates CN field does not contain a valid domain name. FortiGate units always validate the CN field, regardless of whether this option is enabled. However, if this option is disabled, although validation failure does not cause the FortiGate unit to block the request, it changes the behavior of FortiGuard Web Filtering. If the request is made directly to the web server, rather than a web server proxy, the FortiGate unit queries for FortiGuard Web Filtering category or class ratings using the IP address only, not the domain name. If the request is to a web server proxy, the real IP address of the web server is not known, and so rating queries by either or both the IP address and the domain name is not reliable. In this case, the FortiGate unit does not perform FortiGuard Web Filtering.

FortiGuard Web Filtering options

FortiGuard Web Filtering options can be applied through a protection profile. For more category blocking configuration options, see FortiGuard - Web Filter on page 464.
Figure 217:Protection Profile FortiGuard Web Filtering options

Enable FortiGuard Web Filtering

Enable FortiGuard Web Filtering.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

359

Configuring a protection profile

Firewall Protection Profile

Enable FortiGuard Web Filtering Overrides Provide details for blocked HTTP 4xx and 5xx errors

Enable category overrides. For details, see Viewing the override list on page 464 and Configuring override rules on page 465. Display a replacement message for 400 and 500-series HTTP errors. If the error is allowed through, malicious or objectionable sites can use these common error pages to circumvent web filtering. This option applies to HTTP traffic only.

Rate images by URL (blocked Block images that have been rated by FortiGuard. images will be replaced with Blocked images are replaced on the originating web pages with blanks. Rated image file types include GIF, blanks) JPEG, PNG, BMP, and TIFF. This option applies to HTTP traffic only. Allow websites when a rating Allow web pages that return a rating error from the web filtering service. error occurs Strict Blocking Strict blocking only has an effect when either a URL fits into a category and classification or IP rating is enabled. With IP rating enabled, all URLs have two categories and up to two classifications (one set for the domain and one set for the IP address). All URLs belong to at least one category (Unrated is a category) and may belong to one classification too. If strict blocking is enabled, a site is blocked if it is in at least one blocked category or classification and only allowed if all categories or classifications it falls under are allowed. With strict blocking disabled, a site is allowed if it belongs to at least one allowed category or classification and only blocked if all categories or classifications it falls under are allowed. For example, if a protection profile blocks Search Engines but allows Image Search and the URL images.google.ca falls into the Search Engines category and the Image Search classification. With strict blocking enabled, this URL is blocked because it belongs to the Search Engines category, which is blocked. With strict blocking disabled, the URL is allowed because it is classified as Image Search, which is allowed. It would only be blocked if both the Search Engines category and Image Search classification were blocked. This option is enabled by default.

Rate URLs by domain and IP When enabled, this option sends both the URL and the IP address of the requested site for checking, providing address additional security against attempts to bypass the FortiGuard system. However, because IP rating is not updated as quickly as URL rating, some false ratings may occur. This option is disabled by default. Block HTTP redirects by rating Enable to block HTTP redirects. Many web sites use HTTP redirects legitimately; however, in some cases, redirects may be designed specifically to circumvent web filtering, as the initial web page could have a different rating than the destination web page of the redirect. FortiGuard Web Filtering provides many content categories by which to filter web traffic. Categories reflect the subject matter of the content. For each category, select to Allow or Block, and, if the category is blocked, whether or not to Allow Override to permit users to override the filter if they successfully authenticate. You can also select to log each traffic occurrence of the category.

Category

360

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

Configuring a protection profile

Classification

In addition to content categories, FortiGuard Web Filtering provides functional classifications. Classifications block whole classes of web sites based upon their functionality, media type, or source, rather than by the web sites subject matter. Using classifications, you can block web sites that host cached content, that facilitate image, audio, or video searches, or web sites from spam URLs. Classification is in addition to, and can be configured separately from, the category. For each class, select to Allow or Block, and, if the class is blocked, whether or not to Allow Override to permit users to override the filter if they successfully authenticate. You can also select to log each traffic occurrence of the class.

Spam Filtering options

Spam filtering options can be applied through a protection profile. For more spam filter configuration options, see Antispam on page 473. To configure the FortiGuard Anti-spam service, see Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228.
Note: Some popular email clients cannot filter messages based on the MIME header. In this case, you can select to tag email messages subject line. Figure 218:Protection Profile Spam Filtering options

FortiGuard Antispam

IP address Enable or disable the FortiGuard Antispam filtering IP address blacklist. FortiGuard Antispam extracts the SMTP check mail server source address and sends the IP address to a FortiGuard Antispam server to see if this IP address matches the list of known spammers. If the IP address is found, FortiGuard Antispam terminates the session. If FortiGuard Antispam does not find a match, the mail server sends the email to the recipient. For more information about this service, see FortiGuard Antispam Service on page 227.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

361

Configuring a protection profile

Firewall Protection Profile

URL check Enable or disable the FortiGuard Antispam spam filtering URL blacklist. FortiGuard Antispam checks the body of email messages to extract any URL links. These URL links are sent to a FortiGuard Antispam server to see if any are listed. Spam messages often contain URL links to advertisements (also called spamvertizing). If a URL match is found, FortiGuard Antispam terminates the session. If FortiGuard Antispam does not find a match, the mail server sends the email to the recipient. For more information about this service, see FortiGuard Antispam Service on page 227. E-mail checksum check Enable or disable the FortiGuard Antispam email message checksum blacklist. If enabled, this filter calculates the checksum of an email message and sends this checksum to the FortiGuard servers to determine if the checksum is in the blacklist. The FortiGate unit then passes or marks/blocks the email message according to the server response.

Spam When enabled, all e-mail messages marked as spam have a submission link added to the message body. If an email message is not spam, simply click the link in the message to inform FortiGuard of the false positive. IP address BWL check Black/white list check. Enable or disable the checking incoming IP addresses against the configured spam filter IP address list. This option applies to SMTP traffic only. IP address BWL check drop-down list: Select which IP address black/white list will be used with this protection profile. Enable or disable looking up the source domain name (from the SMTP HELO command) in the Domain Name Server.

HELO DNS lookup

E-mail Enable or disable checking incoming email addresses against the address BWL configured spam filter email address list. E-mail address BWL check drop-down list: Select which email address check black/white list will be used with this protection profile. Return e-mail Enable or disable checking that the domain specified in the reply-to or from address has an A or MX record. DNS check Banned word Enable or disable checking source email against the configured spam filter banned word list. check Banned word check drop-down list: Select which banned word list will be used with this protection profile. Threshold: If the combined scores of the banned word patterns appearing in an email message exceed the threshold value, the message will be processed according to the Spam Action setting. For details, see Viewing the antispam banned word list on page 477. Spam Action Select to either tag or discard email that the FortiGate unit determines to be spam. Tagging affixes custom text to the subject line or header of email identified as spam. For SMTP, if you enable virus scanning (which is automatically implemented as a spliced stream), you will only be able to discard spam email if a virus is detected. Discarding immediately drops the connection. If virus scanning is not enabled, you can choose to either tag or discard SMTP spam. For IMAP, if you select to tag spam, spam email may be tagged only after the user downloads the entire message by opening the email. Some IMAP email clients download the envelope portion of the email message initially, and will only later complete the download if the user opens the message. However, the envelope may be insufficient to determine whether an email message is spam, because it is not the full content of the message. For example, with only the envelope, the FortiGate unit cannot complete assessment of the email message body for banned words. In this case, the FortiGate unit may not be able to tag spam until the user downloads the remainder of the message by opening the email.

362

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

Configuring a protection profile

Tag Location

Select to affix the tag to the subject or MIME header of the email identified as spam. If you select to affix the tag to the subject line, the FortiGate unit will convert the entire subject line, including tag, to UTF-8 by default. This improves display for some email clients that cannot properly display subject lines that use more than one encoding. For details on disabling conversion of subject line to UTF-8, see the system settings chapter of the FortiGate CLI Reference. Enter a word or phrase (tag) to affix to email identified as spam. When typing a tag, use the same language as the FortiGate units current administrator language setting. Tag text using other encodings may not be accepted. For example, when entering a spam tag that uses Japanese characters, first verify that the administrator language setting is Japanese; the FortiGate unit will not accept a spam tag written in Japanese characters while the administrator language setting is English. For details on changing the language setting, see Settings on page 201. Tags must not exceed 64 bytes. The number of characters constituting 64 bytes of data varies by text encoding, which may vary by the FortiGate administrator language setting.

Tag Format

IPS options
IPS sensor options can be applied through a protection profile. For details on IPS, see Intrusion Protection on page 435.
Figure 219:Protection profile IPS options

IPS drop-down list

Select to enable and use the specified IPS sensor. This option does not select denial of service (DoS) sensors. For details on configuring DoS sensors, see DoS sensors on page 446.

Content Archive options

Content archive options can be applied through a protection profile. Content archives consist of either logged meta data (summary), or logged meta data with a copy of the associated file or message (full). Content archive summaries may be displayed in multiple locations, such as Log&Report, FortiAnalyzer unit, and in the Statistics section of the dashboard. Locations vary by the options you select in the protection profile, and your configuration of a FortiAnalyzer unit. Full content archiving may also be available. Whether or not content archiving is available and will occur, and whether content archives will be full or summary, varies by your selected options. For details, see Content archiving requirements and behavior on page 364. Content archives can be stored locally, if your FortiGate unit has a hard drive, or remotely, on a FortiAnalyzer unit. Remote content archive options require that you first configure a FortiAnalyzer unit. For instructions on configuring and viewing remotely stored content archives, see Logging to a FortiAnalyzer unit on page 503 and Content Archive on page 519.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

363

Configuring a protection profile

Firewall Protection Profile

Figure 220:Protection Profile Content Archive options

Display content metainformation on the system dashboard

For each protocol, select whether or not to display the content archive summary in the Statistics section of the dashboard. For details on the dashboard display, see Statistics on page 62. Note: NNTP cannot be selected, and is reserved for future use. For each protocol, select to send a full or partial content archive to the FortiAnalyzer unit, or to not send content archives. None: Do not send content archives. Summary: Content archive metadata only. Content metadata includes information such as date and time, source and destination, request and response size, and scan result.

Archive to FortiAnalyzer/FortiGuard

Full: Content archive both metadata and copies of files or messages. In some cases, the FortiGate unit may not archive content, or may not make a full content archive, regardless of your selected option. This behavior varies by prerequisites for each protocol. For details, see Content archiving requirements and behavior on page 364. This option is selectable only if a FortiAnalyzer unit is configured. For details, see Logging to a FortiAnalyzer unit on page 503. Archive SPAMed emails to FortiAnalyzer/FortiGuard For each email protocol, select to include spam email messages in content archives sent to the FortiAnalyzer unit. By default, the FortiGate unit sends content archives of non-spam email messages only, omitting spam.

Content archiving requirements and behavior

Steps required to implement content archiving, whether summary (summary log only) or full (summary log plus a copy of the file or message) content archiving, vary by protocol. In all cases, with the exception of spam email if you have enabled Archive SPAMed emails to FortiAnalyzer/FortiGuard, FortiGate units only form content archives of allowed traffic for which you have enabled content archiving. Content archiving will not occur when disabled, nor for files or messages that are blocked. Traffic can be blocked for reasons configured outside of the firewall policy or protection profile itself. If you have selected content archiving but neither summary nor full content archives are being formed, verify that the traffic is not being blocked due configurations in other areas, such as web filtering and antispam banned words or blocked IM/P2P user names. For details on configuring protocolspecific blocking, see the chapters specific to those areas of the configuration, such as Configuring a policy for unknown IM users on page 497.

364

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

Configuring a protection profile

Most protocols only require that you allow the traffic and select either Summary or Full content archiving. Exceptions include: AIM, ICQ, MSN, and Yahoo! instant message content archiving is grayed out and cannot be selected until you enable inspection of the protocol by selecting it in IM/P2P options. HTTPS full content archives cannot be formed. Because HTTPS content is encrypted, archived copies of files transferred by HTTPS would not be viewable except by the requesting client. For protocols with an Oversize File/Message action and Threshold in the AntiVirus options section of the protection profile, if you select Pass for oversized files and the size of the file or message is greater than the value you have configured in Threshold, the FortiGate proxy will not scan the content of oversized files, and therefore will not form a copy of the file or message. In that case, even if you have selected Full content archiving, the FortiGate unit can only form a summary content archive.

IM/P2P options
IM and P2P options can be applied through a protection profile. Changes to IM protection profile options, while IM users are logged in, will take effect only upon their next login. Enabling Block Login, for example, cannot be used to disconnect currently logged in users. For more IM configuration options, see IM, P2P & VoIP on page 489.
Figure 221:Protection Profile IM/P2P options

Block Login Block File Transfers Block Audio Inspect Non-standard Port Action

Enable to prevent instant message users from logging in to AIM, ICQ, MSN, Yahoo, and SIMPLE services. Enable to block file transfers for AIM, ICQ, MSN, and Yahoo protocols. Enable to block audio for AIM, ICQ, MSN, and Yahoo protocols. Enable inspection of non-standard ports for IM traffic. Pass, block, or rate limit P2P transfers for BitTorrent, eDonkey, Gnutella, Kazaa, and WinNY protocols. Skype transfers can be passed or blocked, but not rate limited. If Action is set to Rate Limit, specify the bandwidth limit for BitTorrent, eDonkey, Gnutella, Kazaa, and WinNY protocols. The bandwidth limit can be applied separately for each firewall policy that uses the protection profile, or shared by all firewall policies that use the protection profile. By default, the limit is applied separately to each firewall policy. For information on configuring per policy or per protection profile P2P bandwidth limiting, see P2P rate limiting option in the FortiGate CLI Reference. For details on P2P bandwidth usage statistics, see Statistics on page 493.

Limit (KBytes/s)

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

365

Configuring a protection profile

Firewall Protection Profile

VoIP options
VoIP options can be applied through a protection profile. FortiGate units support rate limiting for SIP (including SIMPLE) and SCCP protocols.
Figure 222:Protection Profile VoIP options

SIP SCCP Limit RIGISTER Request

Select to rate limit SIP and SIMPLE traffic. Select to rate limit SCCP traffic. Enter a rate limit for SIP RIGISTER requests (per second, per policy). If this option is set to zero (0), requests are not limited. Enter a rate limit for SIP INVITE requests (per second, per policy). If this option is set to zero (0), requests are not limited. Enter a rate limit to SCCP call setup (calls per minute, per client) between call clients and the call manager. If this option is set to zero (0), setups are not limited.

Limit INVITE Request

Limit Call Setup

Logging options
Logging options can be specified in a protection profile. For more information about enabling and configuring logging, see Log&Report on page 499.
Figure 223:Protection Profile Logging options

366

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Firewall Protection Profile

Applying a protection profile to a policy

Antivirus

Viruses Blocked Files Oversized Files/Emails

Select to log detected viruses. Select to log blocked files. Select to log oversize files and email messages. Select to log content blocking events. Select to log blocked and exempted URLs. Select to log blocked Active X plugins. Select to log blocked cookies. Select to log blocked Java applets. Select to log rating errors. Select to log detected spam. Select to log IPS signature and anomaly events. Select to log IM events. Select to log P2P events. Select to log VoIP events.

Web Filtering

Content Block URL Filter ActiveX Filter Cookie Filter Java Applet Filter

FortiGuard Web Rating errors Filtering (HTTP only) Spam Filtering IPS IM and P2P VoIP Log Spam Log Intrusions Log IM Activity Log P2P Activity Log VoIP Activity

Applying a protection profile to a policy

Protection profiles are used when specified in one or more firewall policies whose Action is not DENY. For example, if you create a protection profile containing SMTP antivirus settings that you want to apply to all incoming SMTP connections, you might select that protection profile in all external to internal firewall policies whose service group contain the SMTP service. Protection profiles can contain settings relevant to many different services. Each firewall policy uses the subset of the protection profile settings which apply to its specified Service. In this way, you might define once a protection profile that can be used by many firewall policies, each policy using a different or overlapping subset of the protection profile. To apply a protection profile to a firewall policy 1 Go to Firewall > Policy. If virtual domains are enabled on the FortiGate unit, protection profiles are applied separately in firewall policies for each virtual domain (VDOM). To access firewall policies, first select a virtual domain from the main menu. 2 Select Create New to add a policy, or select Edit for the policy to which you want to apply the protection profile. For example, if you want to apply a protection profile containing HTTP antivirus scanning, select policies whose Service is a service or service group containing HTTP. 3 Select the Protection Profile that you want to apply. The firewall policy will use settings from the protection profile that are applicable to its Service. 4 5 If you are creating a new firewall policy, configure other required policy options. Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

367

Applying a protection profile to a policy

Firewall Protection Profile

368

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Overview of IPSec VPN configuration

VPN IPSEC
This section provides information about Internet Protocol Security (IPSec) VPN configuration options available through the web-based manager. FortiGate units support both policy-based (tunnel-mode) and route-based (interface mode) VPNs.
Note: For information about how to configure an IPSec VPN, see the FortiGate IPSec VPN User Guide.

This section describes: Overview of IPSec VPN configuration Policy-based versus route-based VPNs Auto Key Manual Key Concentrator Monitor

Overview of IPSec VPN configuration

FortiGate units implement the Encapsulated Security Payload (ESP) protocol. The encrypted packets look like ordinary packets that can be routed through any IP network. Internet Key Exchange (IKE) is performed automatically based on preshared keys or X.509 digital certificates. As an option, you can specify manual keys. Interface mode is supported in NAT/Route mode only. It creates a virtual interface for the local end of a VPN tunnel. The following configuration procedures are common to all IPSec VPNs: 1 Define the phase 1 parameters that the FortiGate unit needs to authenticate remote peers or clients and establish a secure a connection. See Creating a new phase 1 configuration on page 372. Define the phase 2 parameters that the FortiGate unit needs to create a VPN tunnel with a remote peer or dialup client. See Creating a new phase 2 configuration on page 377.
Note: Steps 1 and 2 are required if you want the FortiGate unit generate unique IPSec encryption and authentication keys automatically. If a remote VPN peer or client requires a specific IPSec encryption and/or authentication key, you must configure the FortiGate unit to use manual keys instead. For more information, see Manual Key on page 381.

Create a firewall policy to permit communication between your private network and the VPN. For a policy-based VPN, the firewall policy action is IPSEC. For an interface-based VPN, the firewall policy action is ACCEPT. See Configuring firewall policies on page 285. For detailed information about configuring IPSec VPNs, see the FortiGate IPSec VPN User Guide.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

369

Policy-based versus route-based VPNs

VPN IPSEC

Policy-based versus route-based VPNs

FortiGate units support both policy-based and route-based VPNs. Generally, route-based VPNs are easier to configure than policy-based VPNs. However, the two types have different requirements that limit where they can be used.
Table 37: Comparison of policy-based and route-based VPNs Policy-based Available in NAT/Route or Transparent mode Route-based Available only in NAT/Route mode

Requires a firewall policy with IPSEC Requires only a simple firewall policy with action that specifies the VPN tunnel. One ACCEPT action. A separate policy is required policy controls connections in both for connections in each direction. directions. Supports DHCP over IPSec Does not support DHCP over IPSec

You create a policy-based VPN by defining an IPSEC firewall policy between two network interfaces and associating it with the VPN tunnel (phase 1 or manual key) configuration. Only one firewall policy is required, even if either end of the VPN can initiate a connection. You create a route-based VPN by enabling IPSec interface mode when you create the VPN phase 1 or manual key configuration. This creates a virtual IPSec interface bound to the local interface that you selected. You then define an ACCEPT firewall policy to permit traffic to flow between the virtual IPSec interface and another network interface. If either end of the VPN can initiate the connection, you need two firewall policies, one for each direction. Virtual IPSec interface bindings are shown on the System > Network > Interface page. The names of all tunnels bound to physical, aggregate, VLAN, inter-VDOM link or wireless interfaces are displayed under their associated interface names in the Name column. For more information about the Interface page, see Interfaces on page 93. As with other interfaces, you can include a virtual IPSec interface in a zone.

Hub-and-spoke configurations
To function as the hub of a hub-and-spoke VPN, the FortiGate unit provides a Concentrator function. This is available only for policy-based VPNs, but you can create the equivalent function for a route-based VPN in any of the following ways: Define a firewall policy between each pair of IPSec interfaces that you want to concentrate. For dialup, the same interface can be both source and destination. This can be tedious if you have many site-to-site connections. Put all the IPSec interfaces into a zone and then define a single zone-to-zone policy. Put all the IPSec interfaces in a zone and enable intra-zone traffic. There must be more than one IPSec interface.

For more information and an example, see the FortiGate IPSec VPN User Guide.

370

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Auto Key

Redundant configurations
Route-based VPNs help to simplify the implementation of VPN tunnel redundancy. You can configure several routes for the same IP traffic using different route metrics. You can also configure the exchange of dynamic (RIP, OSPF, or BGP) routing information through VPN tunnels. If the primary VPN connection fails or the priority of a route changes through dynamic routing, an alternative route will be selected to forward traffic using the redundant connection. A simple way to provide failover redundancy is to create a backup IPSec interface. You can do this in the CLI. Refer to the FortiOS CLI Reference. See the monitor-phase1 keyword of the ipsec vpn phase1-interface command. An example configuration is provided.

Routing
Optionally, using the CLI, you can define a specific default route for a virtual IPSec interface. For more information, see the default-gw keyword for the vpn ipsec phase-interface command in the FortiOS CLI Reference.

Auto Key
Two VPN peers (or a FortiGate dialup server and a VPN client) can be configured to generate unique Internet Key Exchange (IKE) keys automatically during the IPSec phase 1 and phase 2 exchanges. To configure the FortiGate unit to generate unique keys automatically in phase 1 and phase 2, go to VPN > IPSEC > Auto Key (IKE). When you define phase 2 parameters, you can choose any set of phase 1 parameters to set up a secure connection for the tunnel and authenticate the remote peer. Auto Key configuration applies to both tunnel-mode and interface-mode VPNs.
Figure 224:Auto Key list

Delete
Create Phase 1 Create Phase 2 Phase 1 Phase 2 Interface Binding

Edit

Create a new phase 1 tunnel configuration. See Creating a new phase 1 configuration on page 372. Create a new phase 2 configuration. See Creating a new phase 2 configuration on page 377. The names of existing phase 1 tunnel configurations. The names of existing phase 2 configurations. The names of the local interfaces to which IPSec tunnels are bound. These can be physical, aggregate, VLAN, inter-VDOM link or wireless interfaces.

Delete and Edit icons Delete or edit a phase 1 configuration.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

371

Auto Key

VPN IPSEC

Creating a new phase 1 configuration

In phase 1, two VPN peers (or a FortiGate dialup server and a VPN client) authenticate each other and exchange keys to establish a secure communication channel between them. The basic phase 1 settings associate IPSec phase 1 parameters with a remote gateway and determine: whether the various phase 1 parameters will be exchanged in multiple rounds with encrypted authentication information (main mode) or in a single message with authentication information that is not encrypted (aggressive mode) whether a pre-shared key or digital certificates will be used to authenticate the identities of the two VPN peers (or a VPN server and its client) whether a special identifier, certificate distinguished name, or group name will be used to identify the remote VPN peer or client when a connection attempt is made

To define basic IPSec phase 1 parameters, go to VPN > IPSEC > Auto Key (IKE) and select Create Phase 1. For information about how to choose the correct phase 1 settings for your particular situation, see the FortiGate IPSec VPN User Guide.
Figure 225:New Phase 1

Name

Type a name to represent the phase 1 definition. The maximum name length is 15 characters for an interface mode VPN, 35 characters for a policy-based VPN. If Remote Gateway is Dialup User, the maximum name length is further reduced depending on the number of dialup tunnels that can be established: by 2 for up to 9 tunnels, by 3 for up to 99 tunnels, 4 for up to 999 tunnels, and so on. For a tunnel mode VPN, the name should reflect the origination of the remote connection. For a route-based tunnel, the FortiGate unit also uses the name for the virtual IPSec interface that it creates automatically. Select the nature of the remote connection: If the remote peer has a static IP address, select Static IP Address. If one or more FortiClient or FortiGate dialup clients with dynamic IP addresses will connect to the FortiGate unit, select Dialup User. If a remote peer that has a domain name and subscribes to a dynamic DNS service will be connecting to the FortiGate unit, select Dynamic DNS.

Remote Gateway

372

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Auto Key

IP Address Dynamic DNS Local Interface

If Static IP Address is selected, type the IP address of the remote peer. If Dynamic DNS is selected, type the domain name of the remote peer. This option is available in NAT/Route mode only. Select the name of the interface through which remote peers or dialup clients connect to the FortiGate unit. The FortiGate unit obtains the IP address of the interface from System > Network > Interface settings (see Interfaces on page 93) unless you are configuring an IPSec interface, in which case you can specify a different IP address in the Local Gateway IP field under Advanced settings (see Local Gateway IP on page 375). Select Main or Aggressive: In Main mode, the phase 1 parameters are exchanged in multiple rounds with encrypted authentication information. In Aggressive mode, the phase 1 parameters are exchanged in single message with authentication information that is not encrypted. When the remote VPN peer has a dynamic IP address and is authenticated by a pre-shared key, you must select aggressive mode if there is more than one dialup phase1 configuration for the interface IP address. When the remote VPN peer has a dynamic IP address and is authenticated by a certificate, you must select aggressive mode if there is more than one phase 1 configuration for the interface IP address and these phase 1 configurations use different proposals. Peer Options settings may require a particular mode. See Peer Options, below.

Mode

Authentication Method Pre-shared Key

Select Preshared Key or RSA Signature. If Pre-shared Key is selected, type the pre-shared key that the FortiGate unit will use to authenticate itself to the remote peer or dialup client during phase 1 negotiations. You must define the same value at the remote peer or client. The key must contain at least 6 printable characters and should only be known by network administrators. For optimum protection against currently known attacks, the key should consist of a minimum of 16 randomly chosen alphanumeric characters. If RSA Signature is selected, select the name of the server certificate that the FortiGate unit will use to authenticate itself to the remote peer or dialup client during phase 1 negotiations. To obtain and load the required server certificate, see the FortiGate Certificate Management User Guide. One or more of the following options are available to authenticate VPN peers or clients, depending on the Remote Gateway and Authentication Method settings. Accept the local ID of any remote VPN peer or client. The FortiGate unit does not check identifiers (local IDs). Mode can be set to Aggressive or Main. You can use this option with RSA Signature authentication. But, for highest security, you should configure a PKI user/group for the peer and set Peer Options to Accept this peer certificate only. Authenticate remote peers based on a particular identifier. Enter the identifier in the field. The remote peer must be configured with the same identifier. This option is available only if the remote peer has a dynamic IP address. If the remote peer is a FortiGate unit, the identifier must be specified in the Local ID field of the phase 1 configuration. For FortiClient dialup clients, select Config in the Policy section of the Advanced Settings for the connection and specify the identifier in the Local ID field.

Certificate Name

Peer Options

Accept any peer ID

Accept this peer ID

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

373

Auto Key

VPN IPSEC

Accept peer ID Authenticate multiple FortiGate or FortiClient dialup clients that use in dialup group unique identifiers and unique pre-shared keys (or unique pre-shared keys only) through the same VPN tunnel. You must create a dialup user group for authentication purposes. See User groups on page 409. Select the group from the list adjacent to the Accept peer ID in dialup group option. To configure FortiGate dialup clients, refer to the FortiGate IPSec VPN User Guide. To configure FortiClient dialup clients, refer to the Authenticating FortiClient Dialup Clients Technical Note. Mode must be set to Aggressive when the dialup clients use unique identifiers and unique pre-shared keys. If the dialup clients use unique pre-shared keys only, you can set Mode to Main if there is only one dialup phase 1 configuration for this interface IP address. Accept this Authenticate remote peers or dialup clients using a security peer certificate certificate. Select the certificate from the list adjacent to the option. You must add peer certificates to the FortiGate configuration through only the User > PKI page before you can select them here. For more information, see PKI authentication on page 405. This option is available when Authentication Method is set to RSA Signature. Accept this Use a certificate group to authenticate dialup clients that have peer certificate dynamic IP addresses and use unique certificates. Select the name of the peer group from the list. You must first create group only the group through the config user peergrp CLI command before you can select it. For more information, see the user chapter of the FortiOS CLI Reference. Members of the peer group must be certificates added through the User > PKI page or the config user peer CLI command. This option is available when Authentication Method is set to RSA Signature and Remote Gateway is set to Dialup User. Advanced Define advanced phase 1 parameters. See Defining phase 1 advanced settings on page 374.

Defining phase 1 advanced settings

The advanced P1 Proposal parameters select the encryption and authentication algorithms that the FortiGate unit uses to generate keys for the IKE exchange. Additional advanced phase 1 settings can be selected to ensure the smooth operation of phase 1 negotiations. To modify IPSec phase 1 advanced parameters, go to VPN > IPSEC > Auto Key (IKE), select Create Phase 1, and then select Advanced. For information about how to choose the correct advanced phase 1 settings for your particular situation, see the FortiGate IPSec VPN User Guide.

374

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Auto Key

Figure 226:Phase 1 advanced settings

Add

Enable IPSec Interface Mode

Create a virtual interface for the local end of the VPN tunnel. Select this option to create a route-based VPN, clear it to create a policybased VPN. This is not available in Transparent mode. Select if you want to use IPv6 addresses for the remote gateway and interface IP addresses. This is available only when Enable IPSec Interface Mode is enabled. If you selected Enable IPSec Interface Mode, you need to specify an IP address for the local end of the VPN tunnel. Select one of the following: Main Interface IP - the FortiGate unit obtains the IP address of the interface from System > Network > Interface settings (see Interfaces on page 93) Specify - you can specify a secondary address of the interface selected in the phase 1 Local Interface field (see Local Interface on page 373). You cannot configure Interface mode in a Transparent mode VDOM.

IPv6 Version

Local Gateway IP

P1 Proposal

Select the encryption and authentication algorithms used to generate keys for protecting negotiations. Add or delete encryption and authentication algorithms as required. Select a minimum of one and a maximum of three combinations. The remote peer or client must be configured to use at least one of the proposals that you define. You can select any of the following symmetric-key algorithms: DES - Digital Encryption Standard, a 64-bit block algorithm that uses a 56-bit key. 3DES - Triple-DES, in which plain text is encrypted three times by three keys. AES128 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 128-bit key. AES192 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 192-bit key. AES256 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 256-bit key.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

375

Auto Key

VPN IPSEC

You can select either of the following message digests to check the authenticity of messages during phase 1 negotiations: MD5-Message Digest 5, the hash algorithm developed by RSA Data Security. SHA1-Secure Hash Algorithm 1, which produces a 160-bit message digest. To specify a third combination, use the Add button beside the fields for the second combination. DH Group Select one or more Diffie-Hellman groups from DH group 1, 2, and 5. When using aggressive mode, DH groups cannot be negotiated. If both VPN peers (or a VPN server and its client) have static IP addresses and use aggressive mode, select a single DH group. The setting on the FortiGate unit must be identical to the setting on the remote peer or dialup client. When the remote VPN peer or client has a dynamic IP address and uses aggressive mode, select up to three DH groups on the FortiGate unit and one DH group on the remote peer or dialup client. The setting on the remote peer or client must be identical to one of the selections on the FortiGate unit. If the VPN peer or client employs main mode, you can select multiple DH groups. At least one of the settings on the remote peer or client must be identical to the selections on the FortiGate unit.

Keylife

Type the length of time (in seconds) until the IKE encryption key expires. When the key expires, a new key is generated without interrupting service. The keylife can be from 120 to 172800 seconds. If the FortiGate unit will act as a VPN client and you are using peer IDs for authentication purposes, enter the identifier that the FortiGate unit will supply to the VPN server during the phase 1 exchange. If the FortiGate unit will act as a VPN client and you are using security certificates for authentication, select the distinguished name (DN) of the local server certificate that the FortiGate unit will use for authentication purposes. If the FortiGate unit is a dialup client and will not be sharing a tunnel with other dialup clients (that is, the tunnel will be dedicated to this FortiGate dialup client), set Mode to Aggressive. This option is provided to support the authentication of dialup clients. If the FortiGate unit is a dialup client and you select Enable as Client, type the user name and password that the FortiGate unit will need to authenticate itself to the remote XAuth server. If Remote Gateway is set to Dialup User and dialup clients will authenticate as members of a dialup group, the FortiGate unit can act as an XAuth server. To select Enable as Server, you must first create user groups to identify the dialup clients that need access to the network behind the FortiGate unit. See Configuring a user group on page 414. You must also configure the FortiGate unit to forward authentication requests to an external RADIUS or LDAP authentication server. For information about these topics, see Configuring a RADIUS server on page 398 or Configuring an LDAP server on page 401. Select a Server Type setting to determine the type of encryption method to use between the FortiGate unit, the XAuth client and the external authentication server, and then select the user group from the User Group list. Enable this option if a NAT device exists between the local FortiGate unit and the VPN peer or client. The local FortiGate unit and the VPN peer or client must have the same NAT traversal setting (both selected or both cleared) to connect reliably.

Local ID

XAuth

Nat-traversal

376

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Auto Key

Keepalive Frequency Dead Peer Detection

If you enabled NAT-traversal, enter a keepalive frequency setting. The value represents an interval from 10 to 900 seconds. Enable this option to reestablish VPN tunnels on idle connections and clean up dead IKE peers if required. You can use this option to be notified whenever a tunnel goes up or down, or enable the option to keep the tunnel connection open when no traffic is being generated inside the tunnel (for example, in scenarios where a dialup client or dynamic DNS peer connects from an IP address that changes periodicallytraffic may be suspended while the IP address changes). When the Dead Peer Detection option is selected, you can use the config vpn ipsec phase1 (tunnel mode) or config vpn ipsec phase1-interface (interface mode) CLI command to optionally specify a retry count and a retry interval. For more information, see the FortiOS CLI Reference.

Creating a new phase 2 configuration

After IPSec phase 1 negotiations complete successfully, phase 2 begins. The phase 2 parameters define the algorithms that the FortiGate unit may use to encrypt and transfer data for the remainder of the session. During phase 2, the specific IPSec security associations needed to implement security services are selected and a tunnel is established. The basic phase 2 settings associate IPSec phase 2 parameters with the phase 1 configuration that specifies the remote end point of the VPN tunnel. In most cases, you need to configure only basic phase 2 settings. To configure phase 2 settings, go to VPN > IPSEC > Auto Key (IKE) and select Create Phase 2. For information about how to choose the correct phase 2 settings for your particular situation, see the FortiGate IPSec VPN User Guide.
Figure 227:New Phase 2

Name Phase 1

Type a name to identify the phase 2 configuration. Select the phase 1 tunnel configuration. See Creating a new phase 1 configuration on page 372. The phase 1 configuration describes how remote VPN peers or clients will be authenticated on this tunnel, and how the connection to the remote peer or client will be secured. Define advanced phase 2 parameters. See Defining phase 2 advanced settings on page 378.

Advanced

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

377

Auto Key

VPN IPSEC

Defining phase 2 advanced settings

In phase 2, the FortiGate unit and the VPN peer or client exchange keys again to establish a secure communication channel between them. The P2 Proposal parameters select the encryption and authentication algorithms needed to generate keys for protecting the implementation details of Security Associations (SAs). The keys are generated automatically using a Diffie-Hellman algorithm. A number of additional advanced phase 2 settings are available to enhance the operation of the tunnel. To modify IPSec phase 2 advanced parameters, go to VPN > IPSEC Auto Key (IKE), select Create Phase 2, and then select Advanced. For information about how to choose the correct advanced phase 2 settings for your particular situation, see the FortiGate IPSec VPN User Guide.
Figure 228:Phase 2 advanced settings

Add

P2 Proposal

Select the encryption and authentication algorithms that will be proposed to the remote VPN peer. You can specify up to three proposals. To establish a VPN connection, the remote peer must be configured to use at least one of the proposals that you specify. Initially there are two proposals. To specify only one proposal, use the minus button to remove the second proposal. To specify a third proposal, use the plus button beside the second proposal. It is invalid to set both Encryption and Authentication to NULL. You can select any of the following symmetric-key algorithms: NULL - do not use an encryption algorithm. DES - Digital Encryption Standard, a 64-bit block algorithm that uses a 56-bit key. 3DES - Triple-DES, in which plain text is encrypted three times by three keys. AES128 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 128-bit key. AES192 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 192-bit key. AES256 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 256-bit key.

Encryption

378

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Auto Key

Authentication

You can select either of the following message digests to check the authenticity of messages during an encrypted session: NULL-Do not use a message digest. MD5-Message Digest 5, the hash algorithm developed by RSA Data Security. SHA1-Secure Hash Algorithm 1, which produces a 160-bit message digest.

Enable replay detection Enable perfect forward secrecy (PFS) DH Group Keylife

Optionally enable or disable replay detection. Replay attacks occur when an unauthorized party intercepts a series of IPSec packets and replays them back into the tunnel. Enable or disable PFS. Perfect forward secrecy (PFS) improves security by forcing a new Diffie-Hellman exchange whenever keylife expires. Select one Diffie-Hellman group (1, 2, or 5). The remote peer or dialup client must be configured to use the same group. Select the method for determining when the phase 2 key expires: Seconds, KBytes, or Both. If you select both, the key expires when either the time has passed or the number of KB have been processed. The range is from 120 to 172800 seconds, or from 5120 to 2147483648 KB.

Autokey Keep Alive Enable the option if you want the tunnel to remain active when no data is being processed. DHCP-IPSec Select Enable if the FortiGate unit acts as a dialup server and FortiGate DHCP relay will be used to assign VIP addresses to FortiClient dialup clients. The DHCP relay parameters must be configured separately. For more information, see System DHCP on page 145. If the FortiGate unit acts as a dialup server and you manually assigned FortiClient dialup clients VIP addresses that match the network behind the dialup server, select Enable to cause the FortiGate unit to act as a proxy for the dialup clients. This is available only for tunnel mode phase 2 configurations associated with a dialup phase 1 configuration.

Note: You can enable VPN users to browse the Internet through the FortiGate unit. See Internet browsing configuration on page 380.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

379

Auto Key

VPN IPSEC

Quick Mode Selector

Optionally specify the source and destination IP addresses to be used as selectors for IKE negotiations. If the FortiGate unit is a dialup server, the default value 0.0.0.0/0 should be kept unless you need to circumvent problems caused by ambiguous IP addresses between one or more of the private networks making up the VPN. You can specify a single host IP address, an IP address range, or a network address. You may optionally specify source and destination port numbers and/or a protocol number. If you are editing an existing phase 2 configuration, the Source address and Destination address fields are unavailable if the tunnel has been configured to use firewall addresses as selectors. This option exists only in the CLI. See the dst-addr-type, dst-name, src-addr-type and src-name keywords for the vpn ipsec phase2 command in the FortiOS CLI Reference Source address If the FortiGate unit is a dialup server, type the source IP address that corresponds to the local sender(s) or network behind the local VPN peer (for example, 172.16.5.0/24 or 172.16.5.0/255.255.255.0 for a subnet, or 172.16.5.1/32 or 172.16.5.1/255.255.255.255 for a server or host, or 192.168.10.[80-100] or 192.168.10.80-192.168.10.100 for an address range). A value of 0.0.0.0/0 means all IP addresses behind the local VPN peer. If the FortiGate unit is a dialup client, source address must refer to the private network behind the FortiGate dialup client. Type the port number that the local VPN peer uses to transport traffic related to the specified service (protocol number). The range is 0 to 65535. To specify all ports, type 0. Type the destination IP address that corresponds to the recipient(s) or network behind the remote VPN peer (for example, 192.168.20.0/24 for a subnet, or 172.16.5.1/32 for a server or host, or 192.168.10.[80-100] for an address range). A value of 0.0.0.0/0 means all IP addresses behind the remote VPN peer. Type the port number that the remote VPN peer uses to transport traffic related to the specified service (protocol number). The range is 0 to 65535. To specify all ports, type 0. Type the IP protocol number of the service. The range is 0 to 255. To specify all services, type 0.

Source port

Destination address

Destination port

Protocol

Internet browsing configuration

You can enable VPN users to browse the Internet through the FortiGate unit. You do this with firewall policies. The required policies are different for policy-based and route-based VPNs. For more information about firewall policies, see Configuring firewall policies on page 285.

Policy-based VPN Internet browsing configuration

Configure an additional firewall policy as follows:
Source Interface/Zone Source Address Name Destination Interface/Zone Destination Address Name Action Select the FortiGate unit public interface. Select All Select the FortiGate unit public interface. Select the remote network address name. Select IPSEC.

380

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Manual Key

VPN Tunnel

Select the tunnel that provides access to the private network behind the FortiGate unit. Inbound NAT Enable Configure other settings as required.

Route-based VPN Internet browsing configuration

Configure an additional firewall policy as follows:
Source Interface/Zone Select the IPSec interface. Source Address Name Select All Destination Interface/Zone Select the FortiGate unit public interface. Destination Address Name Select All Action Select ACCEPT. NAT Enable Configure other settings as required.

Manual Key
If required, you can manually define cryptographic keys for establishing an IPSec VPN tunnel. You would define manual keys in situations where: Prior knowledge of the encryption and/or authentication key is required (that is, one of the VPN peers requires a specific IPSec encryption and/or authentication key). Encryption and authentication needs to be disabled.

In both cases, you do not specify IPSec phase 1 and phase 2 parameters; you define manual keys on the VPN > IPSEC > Manual Key page instead.
Note: It may not be safe or practical to define manual keys because network administrators must be trusted to keep the keys confidential, and propagating changes to remote VPN peers in a secure manner may be difficult.

For general information about how to configure an IPSec VPN, see the FortiGate IPSec VPN User Guide.
Figure 229:Manual Key list

Edit Delete
Create New Tunnel Name Remote Gateway Encryption Algorithm Authentication Algorithm Delete and Edit icons FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313 Create a new manual key configuration. See Creating a new manual key configuration on page 382. The names of existing manual key configurations. The IP addresses of remote peers or dialup clients. The names of the encryption algorithms specified in the manual key configurations. The names of the authentication algorithms specified in the manual key configurations. Delete or edit a manual key configuration.

381

Manual Key

VPN IPSEC

Creating a new manual key configuration

If one of the VPN devices uses specific authentication and/or encryption keys to establish a tunnel, both VPN devices must be configured to use identical authentication and/or encryption keys. In addition, it is essential that both VPN devices be configured with complementary Security Parameter Index (SPI) settings. Each SPI identifies a Security Association (SA). The value is placed in ESP datagrams to link the datagrams to the SA. When an ESP datagram is received, the recipient refers to the SPI to determine which SA applies to the datagram. An SPI must be specified manually for each SA. Because an SA applies to communication in one direction only, you must specify two SPIs per configuration (a local SPI and a remote SPI) to cover bidirectional communications between two VPN devices.
Caution: If you are not familiar with the security policies, SAs, selectors, and SA databases for your particular installation, do not attempt the following procedure without qualified assistance.

To specify manual keys for creating a tunnel, go to VPN > IPSEC > Manual Key and select Create New.
Figure 230:New Manual Key

Name

Type a name for the VPN tunnel. The maximum name length is 15 characters for an interface mode VPN, 35 characters for a policybased VPN. Type a hexadecimal number (up to 8 characters, 0-9, a-f) that represents the SA that handles outbound traffic on the local FortiGate unit. The valid range is from 0x100 to 0xffffffff. This value must match the Remote SPI value in the manual key configuration at the remote peer. Type a hexadecimal number (up to 8 characters, 0-9, a-f) that represents the SA that handles inbound traffic on the local FortiGate unit. The valid range is from 0x100 to 0xffffffff. This value must match the Local SPI value in the manual key configuration at the remote peer. Type the IP address of the public interface to the remote peer. The address identifies the recipient of ESP datagrams.

Local SPI

Remote SPI

Remote Gateway

382

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Manual Key

Local Interface

This option is available in NAT/Route mode only. Select the name of the interface to which the IPSec tunnel will be bound. The FortiGate unit obtains the IP address of the interface from System > Network > Interface settings (see Interfaces on page 93). Select one of the following symmetric-key encryption algorithms: DES - Digital Encryption Standard, a 64-bit block algorithm that uses a 56-bit key. 3DES - Triple-DES, in which plain text is encrypted three times by three keys. AES128 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 128-bit key. AES192 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 192-bit key.

Encryption Algorithm

AES256 - a 128-bit block Cipher Block Chaining (CBC) algorithm that uses a 256-bit key. Note: The algorithms for encryption and authentication cannot both be NULL. Encryption Key If you selected: DES, type a 16-character hexadecimal number (0-9, a-f). Authentication Algorithm 3DES, type a 48-character hexadecimal number (0-9, a-f) separated into three segments of 16 characters. AES128, type a 32-character hexadecimal number (0-9, a-f) separated into two segments of 16 characters. AES192, type a 48-character hexadecimal number (0-9, a-f) separated into three segments of 16 characters. AES256, type a 64-character hexadecimal number (0-9, a-f) separated into four segments of 16 characters.

Select one of the following message digests: MD5-Message Digest 5 algorithm, which produces a 128-bit message digest. SHA1-Secure Hash Algorithm 1, which produces a 160-bit message digest. Note: The Algorithms for encryption and authentication cannot both be NULL.

Authentication Key If you selected: MD5, type a 32-character hexadecimal number (0-9, a-f) separated into two segments of 16 characters. SHA1, type 40-character hexadecimal number (0-9, a-f) separated into one segment of 16 characters and a second segment of 24 characters.

IPSec Interface Mode

Create a virtual interface for the local end of the VPN tunnel. Select this option to create a route-based VPN, clear it to create a policybased VPN. This is available only in NAT/Route mode.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

383

Concentrator

VPN IPSEC

Concentrator
In a hub-and-spoke configuration, policy-based VPN connections to a number of remote peers radiate from a single, central FortiGate unit. Site-to-site connections between the remote peers do not exist; however, VPN tunnels between any two of the remote peers can be established through the FortiGate unit hub. In a hub-and-spoke network, all VPN tunnels terminate at the hub. The peers that connect to the hub are known as spokes. The hub functions as a concentrator on the network, managing all VPN connections between the spokes. VPN traffic passes from one tunnel to the other through the hub. You define a concentrator to include spokes in the hub-and-spoke configuration. To define a concentrator, go to VPN > IPSEC > Concentrator. For detailed information and step-by-step procedures about how to set up a hub-and-spoke configuration, see the FortiGate IPSec VPN User Guide.
Figure 231:Concentrator list

Edit Delete
Create New Define a new concentrator for an IPSec hub-and-spoke configuration. See Defining concentrator options on page 384. The tunnels that are associated with the concentrators. Delete or edit a concentrator.

Concentrator Name The names of existing IPSec VPN concentrators. Members Delete and Edit icons

Defining concentrator options

A concentrator configuration specifies which spokes to include in an IPSec huband-spoke configuration. To specify the spokes of an IPSec hub-and-spoke configuration, go to VPN > IPSEC > Concentrator and select Create New.
Figure 232:New VPN Concentrator

Concentrator Name Type a name for the concentrator.

384

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN IPSEC

Monitor

Available Tunnels

A list of defined IPSec VPN tunnels. Select a tunnel from the list and then select the right-pointing arrow. Repeat these steps until all of the tunnels associated with the spokes are included in the concentrator. A list of tunnels that are members of the concentrator. To remove a tunnel from the concentrator, select the tunnel and select the leftpointing arrow.

Members

Monitor
You can use the monitor to view activity on IPSec VPN tunnels and start or stop those tunnels. The display provides a list of addresses, proxy IDs, and timeout information for all active tunnels, including tunnel mode and route-based (interface mode) tunnels. You can use filters control the information displayed in the list. See Adding filters to web-based manager lists on page 46. To view active tunnels, go to VPN > IPSEC > Monitor.
Figure 233:Monitor list

Type Clear All Filters Page controls Name Remote Gateway Remote Port Proxy ID Source

Proxy ID Destination

Select the types of VPN to display: All, Dialup, or Static IP and Dynamic DNS. Select to clear any column display filters you might have applied. Display the first, previous, next or last page of monitored VPNs. The name of the phase 1 configuration for the VPN. The public IP address of the remote host device, or if a NAT device exists in front of the remote host, the public IP address of the NAT device. The UDP port of the remote host device, or if a NAT device exists in front of the remote host, the UDP port of the NAT device. Zero (0) indicates that any port can be used. The IP addresses of the hosts, servers, or private networks behind the FortiGate unit. A network range may be displayed if the source address in the firewall encryption policy was expressed as a range of IP addresses. When a FortiClient dialup client establishes a tunnel: If VIP addresses are not used, the Proxy ID Destination field displays the public IP address of the remote host Network Interface Card (NIC).

If VIP addresses were configured (manually or through FortiGate DHCP relay), the Proxy ID Destination field displays either the VIP address belonging to the FortiClient dialup client, or the subnet address from which VIP addresses were assigned. When a FortiGate dialup client establishes a tunnel, the Proxy ID Destination field displays the IP address of the remote private network. Tunnel up or tunnel A green arrow pointing up means the tunnel is currently processing traffic. Select to bring down tunnel. down icon A red arrow pointing down means the tunnel is not processing traffic. Select to bring up tunnel.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

385

Monitor

VPN IPSEC

For Dialup VPNs, the list provides status information about the VPN tunnels established by dialup clients, including the IP addresses of the dialup clients. The number of tunnels shown in the list can change as dialup clients connect and disconnect. For Static IP and dynamic DNS VPNs, the list provides status and IP addressing information about VPN tunnels, active or not, to remote peers that have static IP addresses or domain names. You can also start and stop individual tunnels from the list.

386

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN PPTP

PPTP Range

VPN PPTP
FortiGate units support PPTP to tunnel PPP traffic between two VPN peers. Windows or Linux PPTP clients can establish a PPTP tunnel with a FortiGate unit that has been configured to act as a PPTP server. As an alternative, you can configure the FortiGate unit to forward PPTP packets to a PPTP server on the network behind the FortiGate unit. PPTP VPN is available only in NAT/Route mode. The current maximum number of PPTP sessions is 254. The start and end IPs must be in the same 24-bit subnet, e.g. x.x.x.1. - x.x.x.254. This section explains how to use the web-based manager to specify a range of IP addresses for PPTP clients. For information about how to perform other related PPTP VPN setup tasks, see the FortiGate PPTP VPN User Guide. This section describes: PPTP Range

PPTP Range
The PPTP address range is the range of addresses reserved for remote PPTP clients. When the remote PPTP client connects, the FortiGate unit assigns an IP address from a reserved range of IP addresses to the client PPTP interface. The PPTP client uses the assigned IP address as its source address for the duration of the connection. To enable PPTP and specify the PPTP address range, go to VPN > PPTP > PPTP Range, select the required options, and then select Apply.
Figure 234:Edit PPTP range

Enable PPTP Starting IP Ending IP User Group Disable PPTP

Select to enable PPTP. You must add a user group before you can select the option. See User groups on page 409. Type the starting address in the range of reserved IP addresses. Type the ending address in the range of reserved IP addresses. Select the name of the PPTP user group that you defined. Select the option to disable PPTP support.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

387

PPTP Range

VPN PPTP

388

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN SSL

VPN SSL
An SSL VPN (Secure Sockets Layer virtual private network) is a form of VPN that can be used with a standard Web browser. SSL VPN does not require the installation of specialized client software on end users computers, and is ideal for applications including Web-based email, business and government directories, file sharing, remote backup, remote system management, and consumer-level e-commerce. The two modes of SSL VPN operation (supported in NAT/Route mode only) are: web-only mode, for thin remote clients equipped with a web-browser only. tunnel mode, for remote computers that run a variety of client and server applications

When the FortiGate unit provides services in web-only mode, a secure connection between the remote client and the FortiGate device is established using the SSL VPN security in the FortiGate unit and the SSL security in the FortiGate device and the SSL security in the web browser. After the connection has been established, the FortiGate device provides access to selected services and network resources through a web portal. When users have complete administrative rights over their computers and use a variety of applications, tunnel mode allows remote clients to access the local internal network as if they were connected to the network directly. This section provides information about the features of SSL VPN available for configuration in the web-based manager. The SSL VPN feature is supported on FortiGate units that run in NAT/Route mode only.
Note: For detailed instructions about how to configure web-only mode or tunnel mode operation, see the FortiGate SSL VPN User Guide.

This section describes: Configuring SSL VPN Monitoring SSL VPN sessions SSL VPN bookmarks Viewing the SSL VPN bookmark list Configuring SSL VPN bookmarks Viewing the SSL VPN Bookmark Groups list Configuring SSL VPN bookmark groups

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

389

ssl.root

VPN SSL

ssl.root
A virtual SSL VPN interface called ssl.<vdom_name> has been added. For the root VDOM, this interface is called ssl.root. The ssl.root interface appears in the firewall policy interface lists and static route interface lists. The ssl-root interface was added to the SSL VPN configuration to allow access to additional networks, including to facilitate connected users ability to browse the Internet using the FortiGate. The SSL VPN tunnel-mode access requires the following firewall policies: External > Internal, with the action set to SSL, with an SSL user group ssl.root > Internal, with the action set to Accept Internal > ssl.root, with the action set to Accept Destination network - <ssl tunnel mode assigned range> interface ssl.root

This also requires a new static route and should appear as follows: If you are configuring Internet access through an SSl VPN tunnel, the following configuration must be added: ssl.root > External, with the action set to Accept, with NAT enabled

Configuring SSL VPN

The Config page contains basic SSL VPN settings including timeout values and SSL encryption preferences. If required, you can also enable the use of digital certificates for authenticating remote clients.
Note: If required, you can enable SSL version 2 encryption (for compatibility with older browsers) through a FortiGate CLI command. For more information, see ssl settings in the vpn chapter of the FortiOS CLI Reference.

Go to VPN > SSL > Config to enable and configure SSL VPN.
Figure 235:SSL-VPN Settings

390

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN SSL

Monitoring SSL VPN sessions

Enable SSL VPN Tunnel IP Range

Select to enable SSL VPN connections. Specify the range of IP addresses reserved for tunnelmode SSL VPN clients. Type the starting and ending address that defines the range of reserved IP addresses. Select the signed server certificate to use for authentication purposes. If you leave the default setting (Self-Signed), the FortiGate unit offers its factory installed (self-signed) certificate from Fortinet to remote clients when they connect. If you want to enable the use of group certificates for authenticating remote clients, select the option. Afterward, when the remote client initiates a connection, the FortiGate unit prompts the client for its client-side certificate as part of the authentication process. Select the algorithm for creating a secure SSL connection between the remote client web browser and the FortiGate unit. If the web browser on the remote client is capable of matching a 128-bit or greater cipher suite, select this option. If the web browser on the remote client is capable of matching a high level of SSL encryption, select this option to enable cipher suites that use more than 128 bits to encrypt data. If you are not sure which level of SSL encryption the remote client web browser supports, select this option to enable a 64-bit or greater cipher suite. Type the period of time (in seconds) to control how long the connection can remain idle before the system forces the user to log in again. The range is from 10 to 28800 seconds. You can also set the value to 0 to have no idle connection timeout. This setting applies to the SSL VPN session. The interface does not time out when web application sessions or tunnels are up. If you want to display a custom caption at the top of the web portal home page, type the message. Enter up to two DNS Servers to be provided for the use of clients. Enter up to two WINS Servers to be provided for the use of clients.

Server Certificate

Require Client Certificate

Encryption Key Algorithm

Default - RC4(128 bits) and higher High - AES(128/256 bits) and 3DES Low - RC4(64 bits), DES and higher Idle Timeout

Portal Message

Advanced (DNS and WINS Servers) DNS Server #1 DNS Server #2 WINS Server #1 WINS Server #2

Monitoring SSL VPN sessions

You can view a list of all active SSL VPN sessions. The list displays the user name of the remote user, the IP address of the remote client, and the time that the connection was made. The list also identifies which services are being provided, and allows you to delete an active web session from the FortiGate unit. Go to VPN > SSL > Monitor to view the list of active SSL VPN sessions.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

391

SSL VPN bookmarks

VPN SSL

Figure 236:Monitor list

Delete
No. User Source IP Begin Time Description The identifier of the connection. The user names of all connected remote users. The IP addresses of the host devices connected to the FortiGate unit. The starting time of each connection. Information about the services provided by an SSL VPN tunnel session. Subsession Tunnel IP: IP address that the FortiGate unit assigned to the remote client. Delete icon: Delete current subsession. Delete a web session.

Action

SSL VPN bookmarks

If you create a user account that permits web-only mode access, you can create hyperlinks to frequently accessed server applications that the user can use to start any session from the home page through the hyperlinks. The FortiGate unit forwards client requests to servers on the Internet or internal network. To use the web-portal applications, you add the URL, IP address, or name of the server application to the Bookmarks list. The bookmarks are available when the user starts an active SSL VPN session.

Viewing the SSL VPN bookmark list

You can view a list of all existing SSL VPN bookmarks created using the FortiGate unit. The list details the name of the bookmark, type of bookmark, and the link details. To view the list of predefined SSL VPN bookmarks, go to VPN > SSL > Bookmark.
Figure 237:Bookmark list

Delete Edit
Bookmark Name The type/names of links to remote server applications and network services.

392

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

VPN SSL

Configuring SSL VPN bookmarks

Link Delete and Edit icons

The URL, host, or folder of the bookmark link. Delete or edit an entry in the list.

Configuring SSL VPN bookmarks

Go to VPN > SSL > Bookmark and select Create New to create hyperlinks to frequently accessed server applications.
Figure 238:Create New Bookmark

Bookmark Name Type the text to display in the hyperlink. The name is displayed in the Bookmarks list. Application Type Select the abbreviated name of the server application or network service from the drop-down list: Web Telnet FTP SMB/CIFS VNC RDP

URL/Host/Folder Type the information that the FortiGate unit needs to forward client requests to the correct server application or network service: If the application type is Web, type the URL of the web server (for example, www.fortinet.com). If the application type is Telnet, type the IP address of the telnet host (for example, 10.10.10.10). If the application type is FTP, type the IP address of the FTP host as a root directory/folder (for example, //server/folder/). If the application type is SMB/CIFS, type the IP address of the SMB host and the root directory/folder associated with your account (for example, //server/folder/). If the application type is VNC, type the IP address of the VNC host (for example, 10.10.10.10). If the application type is RDP, type the IP address of the RDP host (for example, 10.10.10.10).

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

393

Viewing the SSL VPN Bookmark Groups list

VPN SSL

Viewing the SSL VPN Bookmark Groups list

You can create a group of specific bookmarks that can be included in the configuration of an SSL VPN user group. For details about SSL VPN user groups, see Configuring SSL VPN user group options on page 416. To view a list of bookmark groups, go to VPN > SSL > Bookmark Group.
Figure 239:Bookmark Group list

Name of bookmark group List of bookmarks that are available to the group of users defined in Group Name. Delete and Edit Delete or edit an entry in the list. icons

Group Name Bookmarks

Configuring SSL VPN bookmark groups

Go to VPN > SSL > Bookmark Group and select Create New to create a group of selected bookmarks.
Figure 240:Create New Bookmark Group

Name

Type the name of the bookmark group. The name is displayed in the Bookmark Group list. Available The list of bookmarks available for inclusion in the bookmark group. Lists bookmarks under appropriate category (FTP, RDP, SMB, Telnet, Bookmarks VNC, or Web). Used Bookmarks The list of bookmarks that belong to the bookmark group. Right arrow Add a bookmark to the Used Bookmarks list. button Select a user or server name in the Available Bookmarks list and select the right arrow button to move it to the Used Bookmarks list. Left arrow button Remove a bookmark from the Used Bookmarks list. Select a bookmark in the Used Bookmarks list and select the left arrow button to move it to the Available Bookmarks list. Create New... Select to create a new bookmark for inclusion in the Available Bookmarks list.

394

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

Configuring user authentication

User Authentication
This section explains how to set up user accounts, user groups, and external authentication servers. These are components of user authentication that you can use to control access to network resources. This section describes: Configuring user authentication Local user accounts Remote authentication RADIUS servers LDAP servers TACACS+ servers PKI authentication Windows AD servers User groups Authentication settings

Configuring user authentication

FortiGate authentication controls access by user group, but creating user groups is not the first step in configuring authentication. Configure local user accounts in User > Local. For each user, you can choose whether the password is verified by the FortiGate unit, by a RADIUS server, by an LDAP server, or by a TACACS+ server. See Local user accounts on page 396. To configure your FortiGate unit to authenticate users using your RADIUS, LDAP, or TACACS+ servers see RADIUS servers on page 397, LDAP servers on page 400, and TACACS+ servers on page 403. If you use a Microsoft Windows Active Directory server for authentication, configure access to the FortiGate unit. See Configuring a Windows AD server on page 408. To use certificate-based authentication for administrative access (HTTPS webbased manager), IPSec, SSL-VPN, and web-based firewall authentication, configure using User > PKI. See PKI authentication on page 405. Create user groups in User > User Group and add members. For each network resource that requires authentication, you specify which user groups are permitted access to the network. There are three types of user groups: Firewall, Active Directory and SSL VPN. See Configuring a user group on page 414. To change the authentication timeout value or select the protocol supported for Firewall authentication, go to User > Authentication. See Authentication settings on page 418. You can authenticate system administrators with your FortiGate unit, using RADIUS, LDAP and TACACS+ servers and with certificate-based authentication using PKI (PKI). See System Administrators on page 181.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

395

Local user accounts

User Authentication

Local user accounts

A local user is a user configured on a FortiGate unit. The user can be authenticated with a password stored on the FortiGate unit (the user name and password must match a user account stored on the FortiGate unit) or with a password stored on an authentication server (the user name must match a user account stored on the FortiGate unit and the user name and password must match a user account stored on the authentication server associated with the user). Go to User > Local to view the local user list.
Figure 241:Example Local user list

Create New User Name Type

Add a new local user account. The local user name. The authentication type to use for this user. The authentication types are Local (user and password stored on FortiGate unit), LDAP, RADIUS, and TACACS+ (user and password matches a user account stored on the authentication server). Delete the user. The delete icon is not available if the user belongs to a user group. Edit the user account.

Delete icon Edit icon

Note: Deleting the user name deletes the authentication configured for the user.

Configuring a Local user account

Go to User > Local and select Create New to add a local user. To authenticate a user with the user name and password stored on the FortiGate unit, select Password. To authenticate a user with the user account stored on a server (LDAP, RADIUS, or TACACS+), select type and server from the drop-down list.
Figure 242:Local user

396

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

Remote authentication

User Name Disable Password

Enter a name that identifies the user. Select Disable to prevent this user from authenticating. Select Password to authenticate this user using a password stored on the FortiGate unit. Type or edit the password. The password should be at least six characters. Select LDAP to authenticate this user using a password stored on an LDAP server. Select the LDAP server from the drop-down list. You can only select an LDAP server that has been added to the FortiGate LDAP configuration. See LDAP servers on page 400. Select RADIUS to authenticate this user using a password stored on a RADIUS server. Select the RADIUS server from the drop-down list. You can only select a RADIUS server that has been added to the FortiGate RADIUS configuration. See RADIUS servers on page 397. Select TACACS+ to authenticate this user using a password stored on a TACACS server. Select the TACACS+ server from the drop-down list. You can only select a TACACS server that has been added to the FortiGate TACACS configuration. See TACACS+ servers on page 403.

LDAP

RADIUS

TACACS+

Remote authentication
Computer networks have, for the most part, improved worker efficiency and helped a companys bottom line. Along with these benefits, the need has arisen for workers to be able to remotely access their corporate network, with appropriate security measures in place. In general terms, authentication is the process of attempting to verify the (digital) identity of the sender of a communication such as a log in request. The sender may be someone using a computer, the computer itself, or a computer program. A computer system should only be used by those who are authorized to do so, therefore there must be a measure in place to detect and exclude any unauthorized access. On a FortiGate unit, you can control access to network resources by defining lists of authorized users, called user groups. To use a particular resource, such as a network or VPN tunnel, the user must: belong to one of the user groups that is allowed access correctly enter a user name and password to prove his/her identity, if asked to do so

RADIUS servers
Remote Authentication and Dial-in User Service (RADIUS) servers provide authentication, authorization, and accounting functions. FortiGate units use the authentication function of the RADIUS server. If you are going to use the RADIUS server for authentication purposes, you must configure the server before you configure the FortiGate users or user groups that will use it.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

397

RADIUS servers

User Authentication

If you have configured RADIUS support and a user is required to authenticate using a RADIUS server, the FortiGate unit sends the users credentials to the RADIUS server for authentication. If the RADIUS server can authenticate the user, the user is successfully authenticated with the FortiGate unit. If the RADIUS server cannot authenticate the user, the connection is refused by the FortiGate unit. You can override the default authentication scheme by selecting a specific authentication protocol or changing the default port for RADIUS traffic.
Note: The default port for RADIUS traffic is 1812. If your RADIUS server is using port 1645, use the CLI to change the default RADIUS port. For more information see the config system global command in the FortiOS CLI Reference.

Go to User > Remote > RADIUS to configure a RADIUS server.

Figure 243:Example RADIUS server list

Create New Name Delete icon

Add a new RADIUS server. The name that identifies the RADIUS server on the FortiGate unit. Delete a RADIUS server configuration. You cannot delete a RADIUS server that has been added to a user group. Edit a RADIUS server configuration.

Server Name/IP The domain name or IP address of the RADIUS server.

Edit icon

Configuring a RADIUS server

The RADIUS server uses a shared secret key to encrypt information passed between it and clients such as the FortiGate unit. When you configure a RADIUS server, there is an option to configure a secondary RADIUS server. Authentication is attempted with the primary server first, and if there is no response, the secondary server is used. The RADIUS server can be included in every user group without including it specifically in user group configurations. There are several different authentication protocols that the RADIUS server can use during the authentication process: MS-CHAP-V2 (Microsoft challenge-handshake authentication protocol v2) MS-CHAP (Microsoft challenge-handshake authentication protocol v1) CHAP (challenge-handshake authentication protocol) provides the same functionality as PAP, but does not send the password and other user information over the network to a security server PAP (password authentication protocol) is used to authenticate PPP connections. PAP passes passwords and other user information in clear text (unencrypted).

Unless a protocol is selected, the default protocol configuration uses PAP, MSCHAPv2, and CHAP, in that order. Go to User > Remote > RADIUS and select Create New to add a new RADIUS server.

398

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

RADIUS servers

Figure 244:RADIUS server configuration

Name Primary Server Name/IP Primary Server Secret

Enter the name that is used to identify the RADIUS server on the FortiGate unit. Enter the domain name or IP address of the primary RADIUS server. Enter the RADIUS server secret key for the primary RADIUS server.

Secondary Server Name/IP Enter the domain name or IP address of the secondary RADIUS server, if you have one. Secondary Server Secret Authentication Scheme Enter the RADIUS server secret key for the secondary RADIUS server. Select Use Default Authentication Scheme to authenticate with the default method. The default authentication scheme uses PAP, MS-CHAP-V2, and CHAP, in that order. Select Specify Authentication Protocol to override the default authentication method, and choose the protocol from the drop-down box: MS-CHAP-V2, MS-CHAP, CHAP, or PAP, depending on what your RADIUS server needs. Enter the NAS IP address and Called-Station-ID (fore more information about RADIUS Attribute 31, see RFC 2548 Microsoft Vendor-specific RADIUS Attributes). If you do not enter an IP address, the IP address of the FortiGate interface used to communicate with the RADIUS server is used.

NAS IP/Called Station ID

Include in every User Group Enable to have the RADIUS server automatically included in all user groups.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

399

LDAP servers

User Authentication

LDAP servers
Lightweight Directory Access Protocol (LDAP) is an Internet protocol used to maintain authentication data that may include departments, people, groups of people, passwords, email addresses, and printers etc. An LDAP consists of a data-representation scheme, a set of defined operations, and a request/response network. If you have configured LDAP support and a user is required to authenticate using an LDAP server, the FortiGate unit contacts the LDAP server for authentication. To authenticate with the FortiGate unit, the user enters a user name and password. The FortiGate unit sends this user name and password to the LDAP server. If the LDAP server can authenticate the user, the user is successfully authenticated with the FortiGate unit. If the LDAP server cannot authenticate the user, the connection is refused by the FortiGate unit. The FortiGate unit supports LDAP protocol functionality defined in RFC 2251: Lightweight Directory Access Protocol v3, for looking up and validating user names and passwords. FortiGate LDAP supports all LDAP servers compliant with LDAP v3. In addition, FortiGate LDAP supports LDAP over SSL/TLS. To configure SSL/TLS authentication, refer to the FortiOS CLI Reference. FortiGate LDAP support does not extend to proprietary functionality, such as notification of password expiration, that is available from some LDAP servers. FortiGate LDAP support does not supply information to the user about why authentication failed. Go to User > Remote > LDAP to configure an LDAP server.
Figure 245:Example LDAP server list

Create New Name Port Common Name Identifier Distinguished Name Delete icon Edit icon

Add a new LDAP server. The name that identifies the LDAP server on the FortiGate unit. The TCP port used to communicate with the LDAP server. The common name identifier for the LDAP server. The common name identifier for most LDAP servers is cn. However, some servers use other common name identifiers such as uid. The distinguished name used to look up entries on the LDAP server. The distinguished name reflects the hierarchy of LDAP database object classes above the common name identifier. Delete the LDAP server configuration. Edit the LDAP server configuration.

Server Name/IP The domain name or IP address of the LDAP server.

400

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

LDAP servers

Configuring an LDAP server

A directory is a set of objects with similar attributes organized in a logical and hierarchical way. Generally, an LDAP directory tree reflects geographic and/or organizational boundaries, with the Domain name system (DNS) names to structure the top level of the hierarchy. The common name identifier for most LDAP servers is cn, however some servers use other common name identifiers such as uid. For example, you could use the following base distinguished name: ou=marketing,dc=fortinet,dc=com where ou is organization unit and dc is a domain component. You can also specify multiple instances of the same field in the distinguished name, for example, to specify multiple organization units: ou=accounts,ou=marketing,dc=fortinet,dc=com Binding is the step where the LDAP server authenticates the user, and if the user is successfully authenticated, allows the user access to the LDAP server based on that users permissions. The FortiGate unit can be configured to use one of three types of binding: anonymous - bind using anonymous user search regular - bind using username/password and then search simple - bind using a simple password authentication without a search

You can use simple authentication if the user records all fall under one dn. If the users are under more than one dn, use the anonymous or regular type, which can search the entire LDAP database for the required user name. If your LDAP server requires authentication to perform searches, use the regular type and provide values for username and password. Go to User > Remote > LDAP and select Create New to add an LDAP server.
Figure 246:LDAP server configuration

Query icon

Name Server Name/IP

Enter the name that identifies the LDAP server on the FortiGate unit. Enter the domain name or IP address of the LDAP server.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

401

LDAP servers

User Authentication

Server Port

Enter the TCP port used to communicate with the LDAP server. By default, LDAP uses port 389. If you use a secure LDAP server, the default port changes when you select Secure Connection. Enter the common name identifier for the LDAP server. 20 characters maximum.

Common Name Identifier

Distinguished Name Enter the base distinguished name for the server using the correct X.500 or LDAP format. The FortiGate unit passes this distinguished name unchanged to the server. Query icon View the LDAP server Distinguished Name Query tree for the LDAP server that you are configuring so that you can cross-reference to the Distinguished Name. For more information, see Using the Query icon. Select the type of binding for LDAP authentication. Connect to the LDAP server directly with user name/password, then receive accept or reject based on search of given values. Connect as an anonymous user on the LDAP server, then retrieve the user name/password and compare them to given values. Connect directly to the LDAP server with user name/password authentication. Filter used for group searching. Available if Bind Type is Regular or Anonymous. Distinguished name of user to be authenticated. Available if Bind Type is Regular. Password of user to be authenticated. Available if Bind Type is Regular. Select a secure LDAP protocol to use for authentication. Depending on your selection, the value in Server Port will change to the default port for the selected protocol. Only available if Secure Connection is enabled. LDAPS: port 636 STARTTLS: port 389 Select a certificate to use for authentication from the drop-down list. The certificate list comes from CA certificates at System > Certificates > CA Certificates.

Bind Type Regular Anonymous Simple Filter User DN Password

Secure Connection Select to use a secure LDAP server connection for authentication. Protocol

Certificate

Using the Query icon

The LDAP Distinguished Name Query list displays the LDAP Server IP address, and all the distinguished names associated with the Common Name Identifier for the LDAP server. The tree helps you to determine the appropriate entry for the DN field. To see the distinguished name associated with the Common Name identifier, expand the CN identifier (click on the blue triangle). Select the DN from the list. The DN you select is displayed in the Distinguished Name field. Select OK and the Distinguished Name you selected will be saved in the Distinguished Name field of the LDAP Server configuration. To see the users within the LDAP Server user group for the selected Distinguished Name, expand the Distinguished Name in the LDAP Distinguished Name Query tree.

402

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

TACACS+ servers

Figure 247:Example LDAP server Distinguished Name Query tree

Common Name Identifier (CN)

Distinguished Name (DN)

TACACS+ servers
In recent years, remote network access has shifted from terminal access to LAN access. Users are now connecting to their corporate network (using notebooks or home PCs) with computers that utilize complete network connections. Remote node technology allows users the same level of access to the corporate network resources as they would have if they were physically in the office. When users connect to their corporate network remotely, they do so through a remote access server. As remote access technology has evolved, the need for network access security has become increasingly important. Terminal Access Controller Access-Control System (TACACS+) is a remote authentication protocol that provides access control for routers, network access servers, and other networked computing devices via one or more centralized servers. TACACS+ allows a client to accept a username and password and send a query to a TACACS+ authentication server. The server host determines whether to accept or deny the request and sends a response back that allows or denies network access to the user. The default TCP port for a TACACS+ server is 49. Go to User > Remote > TACACS+ to configure a TACACS+ server.
Figure 248:Example TACACS+ server list

Create New Server Authentication Type Delete icon Edit icon

Add a new TACACS+ server. The server domain name or IP address of the TACACS+ server. The supported authentication method. TACACS+ authentication methods include: Auto, ASCII, PAP, CHAP, and MSCHAP. Delete this TACACS+ server. Edit this TACACS+ server.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

403

TACACS+ servers

User Authentication

Configuring TACACS+ servers

There are several different authentication protocols that TACACS+ can use during the authentication process: ASCII Machine-independent technique that uses representations of English characters. Requires user to type a user name and password that are sent in clear text (unencrypted) and matched with an entry in the user database stored in ASCII format. PAP (password authentication protocol) Used to authenticate PPP connections. Transmits passwords and other user information in clear text. CHAP (challenge-handshake authentication protocol) Provides the same functionality as PAP, but more secure as it does not send the password and other user information over the network to the security server. MS-CHAP (Microsoft challenge-handshake authentication protocol v1) Microsoft-specific version of CHAP. The default protocol configuration, Auto, uses PAP, MS-CHAP, and CHAP, in that order. Go to User > Remote > TACACS+ and select Create New to add a new TACACS+ server.
Figure 249:TACACS+ server configuration

Name Server Name/IP Server Key Authentication Type

Enter the name of the TACACS+ server. Enter the server domain name or IP address of the TACACS+ server. Enter the key to access the TACACS+ server. Select the authentication type to use for the TACACS+ server. Selection includes: Auto, ASCII, PAP, CHAP, and MSCHAP. Auto authenticates using PAP, MSCHAP, and CHAP (in that order).

404

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

PKI authentication

PKI authentication
Public Key Infrastructure (PKI) authentication utilizes a certificate authentication library that takes a list of peers, peer groups, and/or user groups and returns authentication successful or denied notifications. Users only need a valid certificate for successful authentication - no username or password are necessary. For PKI authentication, only Firewall and SSL VPN user groups are applicable. For more information about certificate authentication, see the FortiGate Certificate Management User Guide. For information about the detailed PKI configuration settings only available through the CLI, see the FortiOS CLI Reference.

Configuring peer users and peer groups

You can define peer users and peer groups used for authentication in some VPN configurations and for PKI certificate authentication in firewall policies. A peer user is a digital certificate holder that can use PKI authentication. To use PKI authentication, you must define peer users to include in the user group that is incorporated into the firewall authentication policy. To define a peer user, you need: a peer user name the text from the subject field of the certificate of the authenticating peer user, or the CA certificate used to authenticate the peer user.

There are other configuration settings that can be added/modified for PKI authentication. For information about the detailed PKI configuration settings only available through the CLI, see the FortiOS CLI Reference. To create a peer user for PKI authentication 1 2 Go to User > PKI. Select Create New, enter the following information, and select OK.
Name Subject CA Enter the name of the PKI user. Enter the text string that appears in the subject field of the certificate of the authenticating user. This field is optional. Enter the CA certificate that must be used to authenticate this user. This field is optional.

Caution: In the CLI, you can create a peer user without values in subject and ca. If you create a PKI user in the CLI with no values in subject or ca and subsequently open the user record in the web-based manager, you will be prompted to add a value in Subject (subject) or CA (ca). If you create a peer user in the web-based manager, you will be required to enter a value in either Subject or CA.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

405

Windows AD servers

User Authentication

Figure 250:PKI user

User Name Subject Issuer Delete icon

Enter the name of the PKI user. Enter the text string that appears in the subject field of the certificate of the authenticating user. Select the CA certificate that is used to authenticate this user. Delete this PKI user. The delete icon is not available if the peer user belongs to a user group. Remove it from the user group first. Edit this PKI user.

Edit icon

Figure 251:Example PKI User list

Peer user groups can only be configured using CLI. For information about creating peer user groups, see the FortiOS CLI Reference.

Windows AD servers
Windows Active Directory (AD) provides central authentication services for Windows-based computers by storing information about network resources across a domain (a logical group of computers running versions of the Microsoft Windows operating system) in a central directory database. Each person who uses computers within a domain receives his/her own unique account/user name. This account can be assigned access to resources within the domain. In a domain, the directory resides on computers that are configured as domain controllers. A domain controller is a server that manages all security-related features that affect the user/domain interactions, security centralization, and administrative functions.

406

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

Windows AD servers

FortiGate units use firewall policies to control access to resources based on user groups configured in the policies. Each FortiGate user group is associated with one or more Windows AD user groups. When a user logs on to the Windows domain, a Fortinet Server Authentication Extension (FSAE) sends the FortiGate unit the users IP address and the names of the Active Directory user groups to which the user belongs. The FSAE has two components that you must install on your network: The domain controller (DC) agent must be installed on every domain controller to monitor user logons and send information about them to the collector agent. The collector agent is installed on at least one domain controller to send the information received from the DC agents to the FortiGate unit.

The FortiGate unit uses this information to maintain a copy of the domain controller user group database. Because the domain controller authenticates users, the FortiGate unit does not perform authentication. It recognizes group members by their IP address. You must install the Fortinet Server Authentication Extensions (FSAE) on the network and configure the FortiGate unit to retrieve information from the Windows AD server. For more information about FSAE, see the FSAE Technical Note. Go to User > Windows AD to configure Windows AD servers.
Figure 252:Example Windows AD server list

Create New Name

Add a new Windows AD server. The name of the Windows AD server with FSAE. You can expand the server name to display Windows AD domain group information. The IP addresses and TCP ports of up to five FSAE collector agents that send Windows AD server logon information to the FortiGate unit. Delete this Windows AD server. Edit this Windows AD server. Get current domain and group information from the Windows AD server.

FSAE Collector IP

Delete icon Edit icon Refresh icon

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

407

Windows AD servers

User Authentication

Configuring a Windows AD server

You need to configure the FortiGate unit to access at least one FSAE collector agent. You can specify up to five Windows AD servers on which you have installed a collector agent. If it is necessary for your FSAE collector agent to require
authenticated access, you enter a password for the server. The server name appears in the list of Windows AD servers when you create user groups. You can also retrieve AD

information directly through an LDAP server instead of through the FSAE agent.
Note: You can create a redundant configuration on your FortiGate unit if you install a collector agent on two or more domain controllers. If the current (or first) collector agent fails, the FortiGate unit switches to the next one in its list of up to five collector agents.

Go to User > Windows AD and select Create New to add a new Windows AD server. Enter the following information for up to five collector agents.
Figure 253:Windows AD server configuration

Name

Enter the name of the Windows AD server.

FSAE Collector Enter the IP address or name of the Windows AD server where this collector agent is installed. Maximum length is 63 characters. IP/Name Port Enter the TCP port used for Windows AD. This must be the same as the FortiGate listening port specified in the FSAE collector agent configuration. Enter the password for the collector agent. Enable and select an LDAP server to access the Windows AD.

Password LDAP Server

408

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

User groups

User groups
A user group is a list of user identities. An identity can be: a local user account (user name and password) stored on the FortiGate unit a local user account with a password stored on a RADIUS, LDAP, or TACACS+ server a RADIUS, LDAP, or TACACS+ server (all identities on the server can authenticate) a user/user group defined on a Microsoft Active Directory server

In most cases, the FortiGate unit authenticates users by requesting their user name and password. The FortiGate unit checks local user accounts first. If a match is not found, the FortiGate unit checks the RADIUS, LDAP, or TACACS+ servers that belong to the user group. Authentication succeeds when a matching user name and password are found. For an Active Directory user group, the Active Directory server authenticates users when they log on to the network. The FortiGate unit receives the users name and IP address from the FSAE collector agent. For more information about FSAE, see the FSAE Technical Note. You can configure user groups to provide authenticated access to: Firewall policies that require authentication See Adding authentication to firewall policies on page 290. SSL VPNs on the FortiGate unit See SSL-VPN firewall policy options on page 296. IPSec VPN Phase 1 configurations for dialup users See Creating a new phase 1 configuration on page 372. XAuth for IPSec VPN Phase 1 configurations See XAUTH in Defining phase 1 advanced settings on page 374. FortiGate PPTP configuration See PPTP Range on page 387. FortiGate L2TP configuration This is configurable only using the config vpn l2tp CLI command. See the FortiOS CLI Reference. Administrator login with RADIUS authentication See Configuring RADIUS authentication for administrators on page 184. FortiGuard Web Filtering override groups See FortiGuard - Web Filter on page 464. For each resource that requires authentication, you specify which user groups are permitted access. You need to determine the number and membership of user groups appropriate to your authentication needs.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

409

User groups

User Authentication

Firewall user groups

A firewall user group provides access to a firewall policy that requires authentication and lists the user group as one of the allowed groups. The FortiGate unit requests the group members user name and password when the user attempts to access the resource that the policy protects. A user may also be authenticated by certificate if this method is selected in the firewall policy. For more information, see Adding authentication to firewall policies on page 290. A firewall user group can also provide access to an IPSec VPN for dialup users. In this case, the IPSec VPN phase 1 configuration uses the Accept peer ID in dialup group peer option. The users VPN client is configured with the user name as peer ID and the password as pre-shared key. The user can connect successfully to the IPSec VPN only if the user name is a member of the allowed user group and the password matches the one stored on the FortiGate unit.
Note: A user group cannot be a dialup group if any member is authenticated using a RADIUS or LDAP server.

For more information, see Creating a new phase 1 configuration on page 372. A firewall user group can be used to provide override privileges for FortiGuard web filtering. See Configuring FortiGuard override options for a user group on page 415. For detailed information about FortiGuard Web Filter, including the override feature, see FortiGuard - Web Filter on page 464.
Figure 254:Firewall user group

Name Type

Name of the user group. User group type: Firewall Active Directory SSL VPN A user group that requires Firewall authentication A user group that requires Active Directory authentication. A user group that requires the ability to set up SSL VPN network access.

Protection Profile

The protection profile for this user group. Select an available protection profile from the dropdown list or create a new protection profile by selecting Create New.

410

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

User groups

Available Users

The list of users, RADIUS servers, LDAP servers, TACACS+ servers, Windows AD users/user groups, or PKI users that can be added to the user group. The list of users, RADIUS servers, LDAP servers, TACACS+ servers, Windows AD users/user groups, or PKI users that belong to the user group. Add a user or server to the Members list. Select a user or server name in the Available Users list and select the right arrow button to move it to the Members list. Remove a user or server from the Members list. Select a user name or server name in the Members list and select the left arrow button to move it to the Available Users list. Configure Web Filtering override capabilities for this group. See Configuring FortiGuard override options for a user group on page 415.

Members

Right arrow button

Left arrow button

FortiGuard Web Filtering Override

Active Directory user groups

On a Microsoft Windows network, the FortiGate unit can allow access to members of Active Directory server user groups who have been authenticated on the Windows network. The Fortinet Server Authentication Extensions (FSAE) must be installed on the network domain controllers. An Active Directory user group provides access to a firewall policy that requires Active Directory type authentication and lists the user group as one of the allowed groups. The members of the user group are Active Directory users or groups that you select from a list that the FortiGate unit receives from the Windows AD servers that you have configured. See Windows AD servers on page 406.
Note: An Active Directory user group cannot have FortiGuard Web Filter override privileges or SSL VPN access. Figure 255:Active Directory user group

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

411

User groups

User Authentication

SSL VPN user groups

An SSL VPN user group provides access to a firewall policy that requires SSL VPN type authentication and lists the user group as one of the allowed groups. Local user accounts, LDAP, and RADIUS servers can be members of an SSL VPN user group. The FortiGate unit requests the users user name and password when the user accesses the SSL VPN web portal. The user group settings include options for SSL VPN features. See Configuring SSL VPN user group options on page 416. An SSL VPN user group can also provide access to an IPSec VPN for dialup users. In this case, the IPSec VPN phase 1 configuration uses the Accept peer ID in dialup group peer option. The users VPN client is configured with the user name as peer ID and the password as pre-shared key. The user can connect successfully to the IPSec VPN only if the user name is a member of the allowed user group and the password matches the one stored on the FortiGate unit.
Note: A user group cannot be an IPSec dialup group if any member is authenticated using a RADIUS or LDAP server.

For more information, see Creating a new phase 1 configuration on page 372.
Figure 256:SSL VPN user group

412

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

User groups

User group list

Go to User > User Group to view the user group list.
Figure 257:Example User group list

Create New Group Name Members

Add a new user group. The name of the user group. User group names are listed by type of user group: Firewall, Active Directory and SSL VPN. The Local users, RADIUS servers, LDAP servers, TACACS+ servers, Windows AD users/user groups or PKI users found in the user group. Delete the user group. You cannot delete a user group that is included in a firewall policy, a dialup user phase 1 configuration, or a PPTP or L2TP configuration. Edit the membership and options of the group.

Protection Profile The protection profile associated with this user group. Delete icon

Edit icon

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

413

User groups

User Authentication

Configuring a user group

Go to User >Group and select Create New to add a new user group.
Note: If you try to add LDAP servers or local users to a group configured for administrator authentication, an Entry not found error occurs. Figure 258:User group configuration

Name Type

Type or enter the name of the user group. Select the user group type: Firewall Select this group in any firewall policy that requires Firewall authentication. See Adding authentication to firewall policies on page 290. Select this group in any firewall policy that requires Active Directory authentication. See Adding authentication to firewall policies on page 290. Select this group in any firewall policy with Action set to SSL VPN. Not available in Transparent mode. See SSL-VPN firewall policy options on page 296.

Active Directory

SSL VPN

Protection Profile

Available only if Type is Firewall or Active Directory. Select a protection profile for this user group from the drop-down list. To create a new protection profile, select Create New. The list of Local users, RADIUS servers, LDAP servers, TACACS+ servers, Windows AD users/user groups, or PKI users that can be added to the user group. The list of Local users, RADIUS servers, LDAP servers, TACACS+ servers, Windows AD users/user groups, or PKI users that belong to the user group. Add a user or server to the Members list. Remove a user or server from the Members list. Configure Web Filtering override capabilities for this group. See Configuring FortiGuard override options for a user group on page 415. Available only if Type is SSL VPN. See Configuring SSL VPN user group options on page 416.

Available Users/Groups Members

Right arrow button Left arrow button FortiGuard Web Filtering Override SSL-VPN User Group Options

414

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

User groups

Configuring FortiGuard override options for a user group

Directory.

Go to User > Group and select the Edit icon for a firewall user group. Expand the FortiGuard Web Filtering Override section. Available only if Type is Firewall or Active For detailed instructions about how to configure web-only mode or tunnel mode operation, see the FortiGate SSL VPN User Guide.
Figure 259:FortiGuard Web Filtering Override configuration

Allowed to perform Select to allow members of this group to request an override on the FortiGuard Web Filtering Block page. The firewall protection profile FortiGuard Web Filtering overrides governing the connection must have FortiGuard overrides enabled. The protection profile may have more than one user group as an override group. Members of an override group can authenticate on the FortiGuard Web Filter Block Override page to access the blocked site. For detailed information see FortiGuard - Web Filter on page 464. Override Scope The override can apply to just the user who requested the override, or include others. Make a selection from the drop-down list to include: User User Group IP Profile Ask Override Type Only the user. The user group to which the user belongs. Any user at the users IP address. Any user with the specified protection profile of the user group. Authenticating user, who chooses the override scope. Only the lowest level directory in the URL. The entire website domain. The FortiGuard category. Authenticating user, who chooses the override type.

Select from the drop-down list to allow access to: Directory Domain Categories Ask

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

415

User groups

User Authentication

Off-site URLs

Select from the drop-down list whether the user can follow links to sites off of the blocked site: Allow Deny Ask User can follow links to other sites. User can follow links only to destinations as defined by Override Type. Authenticating user chooses whether to allow use of off-site links. Select to set the duration of override in days, hours, minutes. Select to allow the authenticating user to determine the duration of override. The duration set is the maximum.

Override Time

Select to set the duration of the override: Constant Ask

Protection Profiles Available

Available only if Type is Firewall or Active Directory. One protection profile can have several user groups with override permissions. Verification of the user group occurs once the username and password are entered. The overrides can still be enabled/disabled on a profile-wide basis regardless of the user groups that have permissions to override the profile.

Permission Granted The list of defined protection profiles applied to user groups that have override privileges. For

Configuring SSL VPN user group options

Go to User > Group and select the Edit icon for an SSL VPN user group. Expand the SSL-VPN User Group Options section. For detailed instructions about how to configure SSL VPN web-only mode or tunnel mode operation, see the FortiGate SSL VPN User Guide.
Figure 260:SSL-VPN user group options

416

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

User groups

Enable SSL-VPN Tunnel Service

Select to allow users in this group to connect to the network behind the FortiGate unit using the SSL VPN tunnel.

Allow Split Tunneling Select to allow split tunneling for this group. Split tunneling ensures that only the traffic for the private network is sent to the SSL VPN gateway. Internet traffic is sent through the usual unencrypted route. Not selected as default. Restrict tunnel IP range for this group Enable Web Application HTTP/HTTPS Proxy FTP Telnet (applet) SMB/CIFS VNC RDP Type the starting and ending IP address range for this group if you want to override the Tunnel IP range defined in VPN > SSL > Config. Select to enable the web portal to provide access to web applications. If you enabled Web Application, select to enable each of the applications that users in this group are permitted to access.

Check FortiClient AV Select to allow the client to connect only if it is running Installed and Running FortiClient with virus scanning enabled. For information about this software, see the Fortinet Technical Documentation web site. Check FortiClient FW Select to allow the client to connect only if it is running Installed and Running FortiClient Host Security FW software. For information about this software, see the Fortinet Technical Documentation web site. Check for Third Party Select to allow the client to connect only if it running FortiClient with firewall enabled. See Table 38 on page 418 AV Software for supported products for Windows XP SP2. For all other Microsoft Windows versions, Norton (Symantec) AntiVirus or McAfee VirusScan software is supported. Check for Third Party Select to allow the client to connect only if it has supported firewall software installed. The software must be installed Firewall Software and enabled (running). See Table 38 on page 418 for supported products for Windows XP SP2. For all other Microsoft Windows versions, Norton (Symantec) AntiVirus or McAfee VirusScan software is supported. Enable Cache Clean Select to remove all temporary Internet files created on the client computer between user login and logout. This is executed with a downloaded ActiveX control for IE, and a plugin for Firefox. Works on Internet Explorer and Firefox with Windows 2000/ Windows XP. If the clients browser cannot install and run the cache cleaner, the user is not allowed to access the SSL VPN portal. Enable to allow the SSL VPN user group to use the preconfigured bookmark group that you select from the dropdown menu. Select to open a second browser window at this URL when the SSL VPN web portal page opens. The web server for this URL must reside on the private network behind the FortiGate unit. You can modify the SSL VPN web portal login page. For more information, see Changing the SSL-VPN login message on page 176.

Bookmarks

Redirect URL

Customize portal message Type or edit a custom web portal home page caption for this group. for this group

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

417

Authentication settings

User Authentication

Table 38: AV/Firewall supported product detection Product Norton Internet Security 2006 Trend Micro PC-cillin McAfee Sophos Anti-Virus Panda Platinum 2006 Internet Security F-Secure Secure Resolutions Cat Computer Services AhnLab Kaspersky ZoneAlarm AV Y Y Y Y Y Y Y Y Y Y Y Firewall Y Y Y N Y Y Y Y Y Y Y

Authentication settings
You can define settings for user authentication, including authentication timeout, supported protocols, and authentication certificates. Authentication timeout controls how long an authenticated firewall connection can be idle before the user must authenticate again. When user authentication is enabled on a firewall policy, the authentication challenge is normally issued for any of the four protocols (depending on the connection protocol): HTTP (can also be set to redirect to HTTPS) HTTPS FTP Telnet

The selections made in the Protocol Support list of the Authentication Settings screen control which protocols support the authentication challenge. The user must connect with a supported protocol first so they can subsequently connect with other protocols. If HTTPS is selected as a method of protocol support, it allows the user to authenticate with a customized Local certificate. When you enable user authentication on a firewall policy, the firewall policy user will be challenged to authenticate. In the case of user ID and password authentication, users must provide their user name and password. In case of certificate authentication (HTTPS or HTTP redirected to HTTPS only), you can install customized certificates on the FortiGate unit and the users can also have customized certificates installed on their browsers, otherwise, users will see a warning message and have to accept a default FortiGate certificate.
Note: When you use certificate authentication, if you do not specify any certificate when you create the firewall policy, the global settings will be used. If you specify a certificate, the per-policy setting will overwrite the global setting. For information about how to use certificate authentication, see FortiGate Certificate Management User Guide.

418

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

User Authentication

Authentication settings

Go to User > Authentication to configure user authentication settings.

Figure 261:Authentication Settings

Authentication Timeout

Enter a length of time in minutes, from 1 to 480. Authentication Timeout controls how long an authenticated firewall connection can be idle before the user must authenticate again. The default value is 30. Select the protocol(s) to challenge during firewall user authentication. If using HTTPS protocol support, select the Local certificate to use for authentication. Only available if HTTPS protocol support is selected. Apply selections for user Authentication Settings.

Protocol Support Certificate

Apply

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

419

Authentication settings

User Authentication

420

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

AntiVirus

Order of operations

AntiVirus
This section describes how to configure the antivirus options associated with firewall protection profiles. This section describes: Order of operations Antivirus elements Antivirus settings and controls File Filter Quarantine Config Antivirus CLI configuration

Order of operations
Antivirus scanning function includes various modules and engines that perform separate tasks. The FortiGate unit performs antivirus processing in the order the elements appear in the web-based manager menu: File filter Virus scan Grayware Heuristics

If a file fails any of the elements of the antivirus scan, no further scans are performed. For example, if the file fakefile.EXE is recognized as a blocked pattern, the FortiGate unit will send the end user a replacement message and the file will be deleted or quarantined. The virus scan, grayware and heuristic scans will not be performed as the file is already found to be a threat and has been dealt with.

Antivirus elements
The antivirus elements work in sequence to efficiently scan incoming files and offer your network unparalleled antivirus protection. The first three elements have specific functions, the fourth, the heuristics, is to cover any new, previously unknown, virus threats. To ensure that your system is providing the most protection available, all virus definitions and signatures are updated regularly through the FortiGuard antivirus services. The elements will be discussed in the order that they are applied followed by FortiGuard antivirus.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

421

Antivirus elements

AntiVirus

File filter
Once a file is accepted, the FortiGate unit applies the file pattern and file type recognition filter. The FortiGate unit will check the file against the file pattern and file type setting you have configured. If the file is a blocked pattern or type, .EXE for example, then it is stopped and a replacement message is sent to the end user. No other levels of protected are applied. If the file is not a blocked pattern the next level of protection is applied.

Virus scan
If the file is passed by the file filter, it will have a virus scan applied to it. The virus definitions are keep up to date through the FortiNet Distribution Network. The list is updated on a regular basis so you do not have to wait for a firmware upgrade. For more information on updating virus definitions, see FortiGuard antivirus on page 422.

Grayware
Once past the file filter and the virus scan, the incoming file will be checked for grayware. Grayware configurations can be turned on and off as required and are kept up to date in the same manner as the antivirus definitions. For more information on configuring grayware please see Viewing the grayware list on page 432.

Heuristics
After an incoming file has passed the first three antivirus elements, it is subjected to the heuristics element. The FortiGate heuristic antivirus engine performs tests on the file to detect virus-like behavior or known virus indicators. In this way, heuristic scanning may detect new viruses, but may also produce some false positive results.
Note: Heuristics is configurable only through the CLI. See the FortiOS CLI Reference.

FortiGuard antivirus
FortiGuard antivirus services are an excellent resource and include automatic updates of virus and IPS (attack) engines and definitions, as well as the local spam DNSBL, through the FortiGuard Distribution Network (FDN). The FortiGuard Center also provides the FortiGuard antivirus virus and attack encyclopedia and the FortiGuard Bulletin. Visit the Fortinet Knowledge Center for details and a link to the FortiGuard Center. The connection between the FortiGate unit and FortiGuard Center is configured in System > Maintenance > FortiGuard Center. See Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228 for more information.

422

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

AntiVirus

Antivirus settings and controls

Antivirus settings and controls

While antivirus settings are configured for system-wide use, specific settings can be implemented on a per profile basis. Table 39 compares antivirus options in protection profiles and the antivirus menu.
Note: If virtual domains are enabled, you configure antivirus file filtering and antivirus settings in protection profiles separately for each virtual domain. Antivirus quarantine and grayware settings are part of the global configuration.

Table 39: Antivirus and Protection Profile antivirus configuration Protection Profile antivirus options Virus Scan Enable or disable virus scanning for each protocol (HTTP, FTP, IMAP, POP3, SMTP, IM). File Filter Enable or disable file pattern and file type handling for each protocol. Quarantine Enable or disable quarantining for each protocol. Quarantine is only available on units with a local disk, or with a configured FortiAnalyzer unit. Pass fragmented email messages. Enable or disable passing fragmented email messages. Fragmented email messages cannot be scanned for viruses. Comfort Clients Enable or disable for HTTP and FTP traffic. Set the interval and byte amount to trigger client comforting. Oversized file/email Configure the FortiGate unit to block or pass oversized files and email messages for each protocol. Set the size thresholds for files and email messages for each protocol in AntiVirus. AntiVirus > Config > Grayware Enable or disable blocking of Grayware by category. Add signature to outgoing email messages Create and enable a signature to append to outgoing email messages (SMTP only). Antivirus setting AntiVirus > Config > Virus List View a read-only list of current viruses.

AntiVirus > File Filter Configure file patterns and types to block or allow files. Patterns and types can also be individually enabled or disabled. AntiVirus > Quarantine View and sort the list of quarantined files, configure file patterns to upload automatically to Fortinet for analysis, and configure quarantining options in AntiVirus.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

423

File Filter

AntiVirus

File Filter
Configure the FortiGate file filter to block files by: File pattern: Files can be blocked by name, extension, or any other pattern. File pattern blocking provides the flexibility to block potentially harmful content. File pattern entries are not case sensitive. For example, adding *.exe to the file pattern list also blocks any files ending in .EXE. In addition to the built-in patterns, you can specify more file patterns to block. For details, see Configuring the file filter list on page 427. File type: In addition to file pattern (file name) checking, you can also configure the FortiGate unit to analyze the file and determine the file type of the files, regardless of the file name. For details about supported file types, see Built-in patterns and supported file types on page 424.

For standard operation, you can choose to disable File Filter in the Protection Profile, and enable it temporarily to block specific threats as they occur. The FortiGate unit can take any of the following three actions towards the files that match a configured file pattern or type: Allow: the file will be allowed to pass. Block: the file will be blocked and a replacement messages will be sent to the user. If both File Filter and Virus Scan are enabled, the FortiGate unit blocks files that match enabled file filter and does not scan these files for viruses.

The FortiGate unit also writes a message to the virus log and sends an alert email message if configured to do so. Files are compared to the enabled file patterns and then the file types from top to bottom. If a file does not match any specified patterns or types, it is passed along to antivirus scanning (if enabled). In effect, files are passed if not explicitly blocked. Using the allow action, this behavior can be reversed with all files being blocked unless explicitly passed. Simply enter all the file patterns or types to be passed with the allow attribute. At the end of the list, add an all-inclusive wildcard (*.*) with a block action. Allowed files continue to antivirus scanning (if enabled) while files not matching any allowed patterns are blocked by the wildcard at the end.

Built-in patterns and supported file types

The FortiGate unit is preconfigured with a default list of file patterns: executable files (*.bat, *.com, and *.exe) compressed or archive files (*.gz, *.rar, *.tar, *.tgz, and *.zip) dynamic link libraries (*.dll) HTML application (*.hta) Microsoft Office files (*.doc, *.ppt, *.xl?) Microsoft Works files (*.wps) Visual Basic files (*.vb?) screen saver files (*.scr) program information files (*.pif)

424

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

AntiVirus

File Filter

The FortiGate unit can take actions against the following file types:
Table 40: Supported file types exe gzip bzip aspack ignored Note: The unknown type is any file type that is not listed in the table. The ignored type is the traffic the FortiGate unit typically does not scan. This includes primarily streaming audio and video. com rar genscript bat tar vbs lzh arj javascript upx base64 msc html zip binhex petite hta cab uue sis msoffice bzip2 fsg unknown

activemime hlp

shellscript perlscript

Viewing the file filter list catalog

You can add multiple file filter lists and then select the best file filter list for each protection profile. To view the file filter list catalog, go to AntiVirus > File Filter. To view any individual file filter list, select the edit icon for the list you want to see.
Figure 262:Sample file pattern list catalog

Note: The default file pattern list catalog is called builtin-patterns.

Create New Name # Entries Profiles Comments Delete icon

Select Create New to add a new file filter list to the catalog. The available file filter lists. The number of file patterns or file types in each file filter list. The protection profiles each file filter list has been applied to. Optional description of each file filter list. Select to remove the file filter list from the catalog. The delete icon is only available if the file filter list is not selected in any protection profiles. Select to edit the file filter, its name and comment.

Edit icon

The file filter list will be used in protection profiles. For more information, see AntiVirus options on page 356.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

425

File Filter

AntiVirus

Creating a new file filter list

To add a file pattern list to the file pattern list catalog, go to AntiVirus > File Filter and select Create New.
Figure 263:New File Filter List dialog box

Name Comment

Enter the name of the new list. Enter a comment to describe the list, if required.

Viewing the file filter list

To view the file filter list, go to AntiVirus > File Filter and select the edit icon of the file filter list you want to view.
Figure 264:Sample file filter list

The file filter list has the following icons and features:
Name Comment OK Create New Filter Action Enable Delete icon Edit icon Move To icon File filter list name. To change the name, edit text in the name field and select OK. Optional comment. To add or edit comment, enter text in comment field and select OK. If you make changes to the list name or comments, select OK to save the changes. Select Create New to add a new file pattern or type to the file filter list. The current list of file patterns and types. Files matching the file patterns and types can be set to block, allow, or intercept. For information about actions, see File Filter on page 424. Clear the checkbox to disable the file pattern or type. Select to remove the file pattern or type from the list. Select to edit the file pattern/type and action. Select to move the file pattern or type to any position in the list.

426

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

AntiVirus

Quarantine

Configuring the file filter list

For file patterns, you can add a maximum of 5000 patterns to a list. For file types, you can only select from the supported types.
Figure 265:New file filter

To add a file pattern or type 1 2 3 4 Go to AntiVirus > File Filter. Select the Edit icon for a file filter catalog. Select Create New. Enter the following information and select OK.
Filter Type Select File Name Pattern if you want to add a file pattern; select File Type and then select a file type from the supported file type list. Enter the file pattern. The file pattern can be an exact file name or can include wildcards. The file pattern can be 80 characters long. Select a file type from the list. For information about supported file types, see Built-in patterns and supported file types on page 424. Select an action from the drop down list: Block, Allow, or Intercept. For more information about actions, see File Filter on page 424. Select to enable the pattern.

Pattern File Type

Action Enable

Quarantine
FortiGate units with a local disk can quarantine blocked and infected files. View the file name and status information about the file in the quarantined file list. Submit specific files and add file patterns to the AutoSubmit list so they will automatically be uploaded to Fortinet for analysis. FortiGate units without a local disk can quarantine blocked and infected files to a FortiAnalyzer unit. Files stored on the FortiAnalyzer can be retrieved for viewing. To configure the FortiAnalyzer unit, go to Log & Report > Log Config > Log Setting. File quarantine configuration involves several steps. To configure and enable file quarantine 1 2 Go to AntiVirus > Quarantine > Config to configure the quarantine service and destination. For details, see Configuring quarantine options on page 430. Go to Firewall > Protection Profile to enable quarantine for required protocols in the protection profiles. For details, see Configuring a protection profile on page 355. Go to Firewall > Policy and use the protection profile in a policy.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

427

Quarantine

AntiVirus

Viewing the Quarantined Files list

The Quarantined Files list displays information about each file quarantined because of virus infection or file blocking. Sort the files by file name, date, service, status, duplicate count (DC), or time to live (TTL). Filter the list to view only quarantined files with a specific status or from a specific service. To view the Quarantined Files list, go to AntiVirus > Quarantine > Quarantined Files.
Figure 266:Quarantined files list

The quarantined files list has the following features and displays the following information about each quarantined file:
Source Sort by Filter Either FortiAnalyzer or Local disk, depending where you configure to store the quarantined files. Sort the list. Choose from: status, service, file name, date, TTL, or duplicate count. Select Apply to complete the sort. Filter the list. Choose from status (infected, blocked, or heuristics) or service (IMAP, POP3, SMTP, FTP, HTTP, IM, or NNTP). Select Apply to complete the filtering. Heuristics mode is configurable through the CLI only. See Antivirus CLI configuration on page 434. Select to apply the sorting and filtering selections to the quarantined files list. Select to delete the selected files. Use the controls to page through the list. For details, see Using page controls on web-based manager lists on page 49. The processed file name of the quarantined file. When a file is quarantined, all spaces are removed from the file name, and a 32-bit checksum is performed on the file. The checksum appears in the replacement message but not in the quarantined file. The file is stored on the FortiGate hard disk with the following naming convention: <32bit_CRC>.<processed_filename> For example, a file named Over Size.exe is stored as 3fc155d2.oversize.exe. The date and time the file was quarantined, in the format dd/mm/yyyy hh:mm. This value indicates the time that the first file was quarantined if the duplicate count increases. The service from which the file was quarantined (HTTP, FTP, IMAP, POP3, SMTP, IM, or NNTP). The reason the file was quarantined: infected, heuristics, or blocked. Specific information related to the status, for example, File is infected with W32/Klez.h or File was stopped by file block pattern.

Apply Delete Page Controls File Name

Date

Service Status Status Description

428

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

AntiVirus

Quarantine

DC TTL

Duplicate count. A count of how many duplicates of the same file were quarantined. A rapidly increasing number can indicate a virus outbreak. Time to live in the format hh:mm. When the TTL elapses, the FortiGate unit labels the file as EXP under the TTL heading. In the case of duplicate files, each duplicate found refreshes the TTL. The TTL information is not available if the files are quarantined on a FortiAnalyzer unit. Y indicates the file has been uploaded to Fortinet for analysis, N indicates the file has not been uploaded. This option is available only if the FortiGate unit has a local hard disk. Select to download the corresponding file in its original format. This option is available only if the FortiGate unit has a local hard disk. Select to upload a suspicious file to Fortinet for analysis. This option is available only if the FortiGate unit has a local hard disk.

Upload status

Download icon Submit icon

Note: Duplicates of files (based on the checksum) are not stored, only counted. The TTL value and the duplicate count are updated each time a duplicate of a file is found.

Viewing the AutoSubmit list

If the FortiGate unit has a local hard disk, you can configure the FortiGate unit to upload suspicious files automatically to Fortinet for analysis. You can add file patterns to the AutoSubmit list using wildcard characters (* or ?). File patterns are applied for AutoSubmit regardless of file blocking settings. Upload files to Fortinet based on status (blocked or heuristics), or submit individual files directly from the quarantined files list. The FortiGate unit uses encrypted email to autosubmit files to an SMTP server through port 25. To view the AutoSubmit list, go to AntiVirus > Quarantine > AutoSubmit. The autosubmit feature is not available on the FortiGate models without a local hard disk.
Figure 267:Sample AutoSubmit list

AutoSubmit list has the following icons and features:

Create New File Pattern Select to add a new file pattern to the AutoSubmit list. The current list of file patterns that will be automatically uploaded. Create a pattern by using ? or * wildcard characters. Enable the check box to enable all file patterns in the list. Select to remove the entry from the list. Select to edit the following information: File Patter and Enable.

Delete icon Edit icon

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

429

Quarantine

AntiVirus

Configuring the AutoSubmit list

To add a file pattern to the AutoSubmit list, go to AntiVirus > Quarantine > AutoSubmit. Note that the autosubmit feature is available only if your FortiGate unit has a local hard disk.
Figure 268:New File Pattern dialog box

File Pattern Enable

Enter the file pattern or file name to be upload automatically to Fortinet. Select to enable the file pattern

Note: To enable automatic uploading of the configured file patterns, go to AntiVirus > Quarantine > Config, select Enable AutoSubmit, and select Use File Pattern.

Configuring quarantine options

Go to AntiVirus > Quarantine > Config to set quarantine configuration options, such as whether to quarantine blocked or infected files and from which service.
Figure 269:Quarantine Configuration (FortiGate unit with local disk)

Quarantine configuration has the following options:

Options Quarantine Infected Files: Select the protocols from which to quarantine infected files identified by antivirus scanning. Quarantine Suspicious Files: Select the protocols from which to quarantine suspicious files identified by heuristics. Quarantine Blocked Files. Select the protocols from which to quarantine blocked files identified by antivirus file filtering. The Quarantine Blocked Files option is not available for IM because a file name is blocked before downloading and cannot be quarantined.

430

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

AntiVirus

Config

Age limit

The time limit in hours for which to keep files in quarantine. The age limit is used to formulate the value in the TTL column of the quarantined files list. When the limit is reached, the TTL column displays EXP. and the file is deleted (although a record is maintained in the quarantined files list). Entering an age limit of 0 (zero) means files are stored on disk indefinitely, depending on low disk space action. The maximum size of quarantined files in MB. Setting the maximum file size too large may affect performance.

Max filesize to quarantine

Low disk space Select the action to take when the local disk is full: overwrite the oldest file or drop the newest file. FortiAnalyzer Select to enable storage of blocked and quarantined files on a FortiAnalyzer unit. See Log&Report on page 499 for more information about configuring a FortiAnalyzer unit. Enable AutoSubmit: enables the AutoSubmit feature. Select one or both of the options below. Use file pattern: Enables the automatic upload of files matching the file patterns in the AutoSubmit list. Use file status: Enables the automatic upload of quarantined files based on their status. Select either Heuristics or Block Pattern. Heuristics is configurable through the CLI only. See Antivirus CLI configuration on page 434. Select to save the configuration.

Enable AutoSubmit

Apply

Config
You can config displays a list of the current viruses blocked by the FortiGate unit. You can also configure file and email size limits and grayware blocking.

Viewing the virus list

The virus list displays an alphabetical list of the current FortiGuard virus definitions (also called AV definitions) installed on the FortiGate unit. The FortiGate unit uses the virus definitions to detect and remove viruses, worms, trojans, and other threats from content as it passes through the FortiGate unit. View the entire list or parts of the list by selecting the number or alphabet ranges. To view the virus list, go to AntiVirus > Config > Virus List. The FortiGuard virus definitions list is updated every time the FortiGate unit receives a new version of the FortiGuard AV definitions. The FortiGuard Center Virus Encyclopedia contains detailed descriptions of the viruses, worms, trojans, and other threats that can be detected and removed by your FortiGate unit using the information in the FortiGuard virus definitions.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

431

Config

AntiVirus

Figure 270:Virus list (partial)

Usually the FortiGuard AV definitions are updated automatically from the FortiGuard Distribution Network (FDN). Go to System > Maintenance > FortiGuard Center to configure automatic AV definition updates from the FDN. You can also update the AV definitions manually from the system dashboard (go to System > Status). In addition to the wildlist AV database, which contains actively spreading viruses, some newer FortiGate models are also equipped with an extended AV database, which contains viruses that are not considered to be actively spreading. If required, you can enable this feature to allow the FortiGate unit to scan for nonactive viruses. For details, see Anti-Virus options on page 356.

Viewing the grayware list

Grayware programs are unsolicited commercial software programs that get installed on computers, often without the users consent or knowledge. Grayware programs are generally considered an annoyance, but these programs can cause system performance problems or be used for malicious ends. The FortiGate unit scans for known grayware executable programs in each enabled category. The category list and contents are added or updated whenever the FortiGate unit receives a virus update package. New categories may be added at any time and will be loaded with the virus updates. By default, all new categories are disabled. Grayware is enabled in a protection profile when Virus Scan is enabled. Grayware categories are populated with known executable files. Each time the FortiGate unit receives a virus and attack definitions update, the grayware categories and contents are updated. To view the grayware list, go to AntiVirus > Config > Grayware.

432

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

AntiVirus

Config

Figure 271:Sample grayware options

Enabling a grayware category blocks all files listed in the category. The categories may change or expand when the FortiGate unit receives updates. You can choose to enable the following grayware categories:
Adware Block adware programs. Adware is usually embedded in freeware programs and causes ads to pop up whenever the program is opened or used. Block browser helper objects. BHOs are DLL files that are often installed as part of a software package so the software can control the behavior of Internet Explorer 4.x and later. Not all BHOs are malicious, but the potential exists to track surfing habits and gather other information. Block dialer programs. Dialers allow others to use the PC modem to call premium numbers or make long distance calls. Block download programs. Download components are usually run at Windows startup and are designed to install or download other software, especially advertising and dial software. Block games. Games are usually joke or nuisance games that you may want to block from network users. Block hacker tools. Block browser hijacking programs. Browser hijacking occurs when a spyware type program changes web browser settings, including favorites or bookmarks, start pages, and menu options. Block joke programs. Joke programs can include custom cursors and programs that appear to affect the system. Block keylogger programs. Keylogger programs can record every keystroke made on a keyboard including passwords, chat, and instant messages. Block any programs included in the miscellaneous grayware category. Block network management tools. Network management tools can be installed and used maliciously to change settings and disrupt network security. Block peer to peer communications programs. P2P, while a legitimate protocol, is synonymous with file sharing programs that are used to swap music, movies, and other files, often illegally.

BHO

Dial Download

Game HackerTool Hijacker

Joke Keylog

Misc NMT

P2P

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

433

Antivirus CLI configuration

AntiVirus

Plugin

Block browser plugins. Browser plugins can often be harmless Internet browsing tools that are installed and operate directly from the browser window. Some toolbars and plugins can attempt to control or record and send browsing preferences. Block remote administration tools. Remote administration tools allow outside users to remotely change and monitor a computer on a network. Block spyware programs. Spyware, like adware, is often included with freeware. Spyware is a tracking and analysis program that can report your activities, such as web browsing habits, to the advertisers web site where it may be recorded and analyzed. Block custom toolbars. While some toolbars are harmless, spyware developers can use these toolbars to monitor web habits and send information back to the developer.

RAT

Spy

Toolbar

Antivirus CLI configuration

This section describes the CLI commands that extend features available through the web-based manager. For complete descriptions and examples of how to enable additional features through CLI commands, see the FortiOS CLI Reference.

system global optimize

The optimize feature configures CPU settings to ensure efficient operation of the FortiGate unit for either antivirus scanning or straight throughput traffic. When optimize is set to antivirus, the FortiGate unit uses symmetric multiprocessing to spread the antivirus tasks to several CPUs, making scanning faster. This feature is available on models numbered 1000 and higher. For more information, see the Antivirus failopen and optimization Fortinet Knowledge Center article.

config antivirus heuristic

The FortiGate heuristic antivirus engine performs tests on files to detect virus-like behavior or known virus indicators. Heuristic scanning is performed last, after file blocking and virus scanning have found no matches. In this way, heuristic scanning may detect new viruses, but may also produce some false positive results. The heuristic engine is enabled by default to pass suspected files to the recipient and send a copy to quarantine. Once configured in the CLI, heuristic scanning is enabled in a protection profile when Virus Scan is enabled. Use the heuristic command to change the heuristic scanning mode.

config antivirus quarantine

The quarantine command also allows configuration of heuristic related settings. This feature is available on models numbered 200 and higher.

config antivirus service <service_name>

Use this command to configure how the FortiGate unit handles antivirus scanning of large files in HTTP, FTP, IM, POP3, IMAP, or SMTP traffic, and what ports the FortiGate unit scans for the service.

434

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Intrusion Protection

About intrusion protection

Intrusion Protection
The FortiGate Intrusion Protection system combines signature and anomaly detection and prevention with low latency and excellent reliability. Intrusion Protection provides the ability to create multiple IPS sensors, each containing a complete configuration based on signatures. Then, any IPS sensor can be applied to each protection profile. DoS sensors can also be created to examine traffic for anomaly-based attacks. This section describes how to configure the FortiGate Intrusion Protection settings. For detailed information about Intrusion Protection, see the FortiGate Intrusion Protection System (IPS) Guide. This section describes: About intrusion protection Signatures Custom signatures Protocol decoders DoS sensors Intrusion protection CLI configuration

About intrusion protection

The FortiGate unit can log suspicious traffic, send alert email messages to system administrators, and log, pass, or block suspicious packets or sessions. Adjust the DoS sensor anomaly thresholds to work best with the normal traffic on the protected networks. Create custom signatures to tailor the FortiGate Intrusion Protection system for your network environment. The FortiGate Intrusion Protection system matches network traffic against patterns contained in attack signatures. Attack signatures reliably protect your network from known attacks. Fortinets FortiGuard infrastructure ensures the rapid identification of new threats and the development of new attack signatures. FortiGuard services are a valuable customer resource and include automatic updates of virus and intrusion protection (attack) engines and definitions through the FortiGuard Distribution Network (FDN). The FortiGuard Center also provides the FortiGuard virus and attack encyclopedia and the FortiGuard Bulletin. Visit the Fortinet Knowledge Center for details and a link to the FortiGuard Center. The connection between the FortiGate unit and FortiGuard is configured in System > Maintenance > FortiGuard Center. See Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228 for more information. Configure the FortiGate unit to check for and automatically download updated attack definition files containing the latest signatures, or download the updated attack definition file manually. Alternately, configure the FortiGate unit to allow push updates of updated attack definition files as soon as they are available from the FortiGuard Distribution Network.
FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

435

About intrusion protection

Intrusion Protection

Create custom attack signatures for the FortiGate unit to use in addition to an extensive list of predefined attack signatures. Whenever the Intrusion Protection system detects or prevents an attack, it generates an attack log message. Configure the FortiGate unit to add the message to the attack log and send an alert email to administrators. Configure how often the FortiGate unit sends alert email. Reduce the number of log messages and alerts by disabling signatures for attacks to which the system is not vulnerable. For example, signatures to detect web attacks do not need to be enabled when there is no web server to protect. Packet logging provides administrators with the ability to analyze packets for forensics and false positive detection. For more information about FortiGate logging and alert email, see Log&Report on page 499.

Intrusion Protection settings and controls

Configure the Intrusion Protection system using either the web-based manager or the CLI, then select IPS sensors in individual firewall protection profiles.
Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings are configured separately in each VDOM. All sensors and custom signatures will appear only in the VDOM in which they were created.

To create IPS sensors, go to Intrusion Protection > IPS Sensor. See Configuring IPS sensors on page 443 for details. To access the protection profile IPS sensor selection, go to Firewall > Protection Profile, select Edit or Create New, and select IPS. See IPS options on page 363 for details. To create a DoS Sensor, go to Intrusion Protection > DoS Sensor. See DoS sensors on page 446 for details.

When to use Intrusion Protection

Intrusion Protection is best for large networks or for networks protecting highly sensitive information. Using IPS effectively requires monitoring and analysis of the attack logs to determine the nature and threat level of an attack. An administrator can adjust the threshold levels to ensure a balance between performance and intrusion prevention. Small businesses and home offices without network administrators may be overrun with attack log messages and not have the networking background required to configure the thresholds and other IPS settings. In addition, the other protection features in the FortiGate unit, such as antivirus (including grayware), spam filters, and web filters offer excellent protection for all networks.

436

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Intrusion Protection

Signatures

Signatures
Signatures are used by grouping the required signatures in an IPS sensor. The IPS sensor is then selected in the protection profile. If required, you can override the default settings of the signatures specified in an IPS sensor. A number of pre-built IPS sensors are provided, but check their settings to ensure they meet the requirements of your network before using them. Using only the signatures you require can improve system performance and reduce the number of log messages and alert email messages the IPS sensor generates. For example, if the FortiGate unit is not protecting a web server, do not include any web server signatures.
Note: Some default protection profiles include IPS Sensors that use all the available signatures. By using these default settings, you may be slowing down the overall performance of the FortiGate unit. By fine-tuning the predefined signature and logging setting, you can ensure maximum performance as well as maximum protection. See Fine tuning predefined signatures for enhanced system performance on page 439

Viewing the predefined signature list

The predefined signature list displays the characteristics of each signature. Use these characteristics to define which signatures are included in your IPS sensors. The default action, the default logging status, and whether the signature is enabled by default is also displayed in the signature list.
Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings are configured separately in each VDOM. All sensors and custom signatures will appear only in the VDOM in which they were created.

To view the predefined signature list, go to Intrusion Protection > Signature > Predefined. You can also use filters to display the signatures you want to view. For details, see Using display filters on page 438.
Figure 272:Predefined signature list

By default, the signatures are sorted by name. To sort the table by another column, select the required column header name.
Column Settings Select to customize the signature information displayed in the table. You can also readjust the column order.

Clear All Filters If you have applied filtering to the predefined signature list display, select this option to clear all filters and display all the signatures. Name The name of the signature, linked to the FortiGuard Center web page about the signature.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

437

Signatures

Intrusion Protection

Severity Target Protocols OS Applications Enable Action

The severity rating of the signature. The severity levels, from lowest to highest, are Information, Low, Medium, High, and Critical. The target lists whether the signature is targeted at servers or clients. Some signature targets are both servers and clients. The protocol the signature applies to. The operating system the signature applies to. The applications the signature applies to. The default status of the signature. A green circle indicates the signature is enabled. A gray circle indicates the signature is not enabled. The default action for the signature. The available actions are pass and drop. Pass allows the traffic to continue without any modification. If you want to determine what effect IPS protection would have on your network traffic, you can enable the required signatures, set the action to pass, and enable logging. Traffic will not be interrupted, but you will be able to examine in detail which signatures were detected. Drop prevents the traffic with detected signatures from reaching its destination. If logging is enabled, the action appears in the status field of the log message generated by the signature. A unique numeric identifier for the signature. The default logging behavior of the signature. A green circle indicates logging is enabled. A gray circle indicates logging is disabled. Each signature is assigned a functional group. This group is only for reference and cannot be used to define filters. The default packet log status of the signature. A green circle indicates packet log is enabled. A gray circle indicates packet log is disabled. The revision level of the signature. If the signature is updated, the revision number will be incremented.

ID Logging Group Packet Log Revision

Using display filters

By default, all the predefined signatures are displayed. You can apply filters to display only the signatures you want to view. For example, if you want to view only the Windows signatures, you can use the OS status filter. See Adding filters to web-based manager lists on page 46. To apply filters to the predefined signature list 1 2 3 Go to Intrusion Protection > Signature > Predefined. Select the filter icon beside any column name in the signature table. In the Edit Filters dialog box, specify the filtering criteria and enable the filter. The filtering options for every column are displayed in the Edit Filters window. You can specify the filtering criteria for multiple columns with a single visit to the Edit Filters window. 4 Select OK.

438

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Intrusion Protection

Custom signatures

Fine tuning predefined signatures for enhanced system performance

By default, the Intrusion Protection system is not used. The default policies have no protection profiles enabled, and no default DoS sensors are provided. To meet your specific network requirements, you need to either select a sample IPS sensor or create your own and apply them to protection profiles used by the policies controlling your network traffic. By fine tuning the IPS sensors, you can provide the best protection available but also free up valuable FortiGate resources. Fine tuning allows you to only include the signatures you need to check for. By using only the signatures you need, you allow the FortiGate unit to perform fewer checks, thus improving overall system performance. For example, if you have a FortiGate unit that is controlling computers that only have access to an internal database and do not have access to the internet or email, there is no point having the Fortigate unit scanning for certain types of signatures such as email, IM, and P2P. By telling the FortiGate unit not to look for these signatures in this situation, you will maintain a high level of security and increase overall performance. You should also review exactly how you use the information provided by the logging feature. If you find that you do not often review the logs, consider limiting logging to only the signatures you are most interested in.

Custom signatures
Custom signatures provide the power and flexibility to customize the FortiGate Intrusion Protection system for diverse network environments. The FortiGate predefined signatures represent common attacks. If an unusual or specialized application or an uncommon platform is being used, custom signatures based on the security alerts released by the application and platform vendors can be added. You can also create custom signatures to help you block P2P protocols. After creation, custom signatures are specified in IPS sensors created to scan traffic. For more details about custom signatures, see the FortiGate Intrusion Protection System (IPS) Guide.
Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings are configured separately in each VDOM. All sensors and custom signatures will appear only in the VDOM in which they were created.

Viewing the custom signature list

To view the custom signature list, go to Intrusion Protection > Signature > Custom.
Figure 273:The custom signature list

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

439

Protocol decoders

Intrusion Protection

Create New Name Signature Delete icon Edit icon

Select to create a new custom signature. The custom signature name. The signature syntax. Select to delete the custom signature. Select to edit the custom signature.

Creating custom signatures

Use custom signatures to block or allow specific traffic. For example, to block traffic containing pornography, add custom signatures similar to the following: set signature 'F-SBID (--protocol tcp; --flow bi_direction; --pattern "nude cheerleader"; --no_case)' For more information on custom signature syntax, see the FortiGate Intrusion Protection System (IPS) Guide.
Note: Custom signatures are an advanced feature. This document assumes the user has previous experience creating intrusion detection signatures.

To create a custom signature, go to Intrusion Protection > Signature > Custom.

Figure 274:Edit Custom Signature

Name Signature

Enter a name for the custom signature. Enter the custom signature. For more information about custom signature syntax, see Custom signature syntax in the FortiGate Intrusion Protection System (IPS) Guide.

Protocol decoders
The FortiGate Intrusion Protection system uses protocol decoders to identify the abnormal traffic patterns that do not meet the protocol requirements and standards. For example, the HTTP decoder monitors traffic to identify any HTTP packets that do not meet the HTTP protocol standards. On the Intrusion Protection > Signature > Protocol Decoder page, you can view the decoders and the port numbers that the protocol decoders monitor.

Viewing the protocol decoder list

To view the decoder list, go to Intrusion Protection > Signature > Protocol Decoder. The decoder list is provided for your reference and can be configured using the CLI. See the FortiOS CLI Reference for details.

440

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Intrusion Protection

IPS sensors

Figure 275:The protocol decoder list

Protocols Ports

The protocol decoder name. The port number or numbers the decoder monitors.

Upgrading the IPS protocol decoder list

The Intrusion Protection system protocol decoders are upgraded automatically through the FortiGuard Distribution Network (FDN) if existing decoders are modified or new decoders added. The FDN will keep the protocol decoder list up to date with new threats such as the latest versions of existing IM/P2P as well as new applications.

IPS sensors
Group signatures into IPS sensors for easy selection in protection profiles. Signatures for specific types of traffic can be defined in separate IPS sensors, and those sensors can then be selected in profiles designed to handle that type of traffic. For example, all of the web-server related signatures can be specified in an IPS sensor, and the sensor can be used by a protection profile in a policy that controls all of the traffic to and from a web server protected by the FortiGate unit. The pre-defined signatures are periodically updated by the FortiGuard Service, with signatures added to counter new threats. Because the signatures included in filters are defined by specifying signature attributes, new signatures matching existing filter specifications will automatically be included in those filters. For example, if you have a filter that includes all signatures for the Windows operating system, your filter will automatically incorporate new Windows signatures as they are added.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

441

IPS sensors

Intrusion Protection

Viewing the IPS sensor list

Go to Intrusion Protection > IPS Sensor to view the IPS sensors.
Figure 276:IPS Sensor list showing the default sensors

The IPS sensor list displays the following information.

Create New Name Comments Delete icon Edit icon Select to add a new IPS sensor. See Adding an IPS sensor on page 442. Each IPS sensor is listed by name. An optional description of the IPS sensor is displayed. Select to delete the IPS sensor. Select to open the IPS sensor for editing.

Five default IPS sensors are provided with the default configuration.
all_default all_default_pass All signatures are included. The sensor is set to use the default enable status and action of each signature. All signatures are included. The sensor is set to use the default enable status of each signature, but the action is set to pass. This sensor includes only signatures designed to detect attacks against clients. The sensor is set to use the default enable status and action of each signature. This sensor includes only signatures designed to detect attacks against servers and the SMTP, POP3, or IMAP protocols. The sensor is set to use the default enable status and action of each signature. This sensor includes only signatures designed to detect attacks against servers and the HTTP protocol. The sensor is set to use the default enable status and action of each signature.

protect_client

protect_email_server

protect_http_server

Adding an IPS sensor

An IPS sensor must be created before it can be configured by adding filters and overrides. Use the following steps to create a new IPS sensor.
Figure 277:New IPS sensor

1 2

Go to Intrusion Protection > IPS Sensor. Select Create New.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

442

Intrusion Protection

Configuring IPS sensors

3 4

Enter a name for the new IPS sensor. Enter a descriptive comment about the new IPS sensor. Although the comment is optional, a brief description will make it easier to distinguish between the IPS sensors when viewing the sensor list.

Select OK to proceed to the IPS sensor configuration page.

Configuring IPS sensors

Each IPS sensor is made up of two parts: filters and overrides. Overrides are always checked before filters. Each filter is made up of a number of signatures attributes. All of the signatures with those attributes, and only those attributes, are checked against traffic when the filter is run. If multiple filters are defined in an IPS Sensor, they are checked against the traffic one at a time, from top to bottom. If a match is found, the appropriate action is taken and further checking is cancelled. A signature override can modify the behavior of a signature specified in a filter. A signature override can also add a signature not specified in the sensors filters. Custom signatures are included in an IPS sensor using overrides. The signatures in the overrides are first compared to network traffic. If no matches are discovered, the signatures in each filter are then compared to network traffic, one filter at a time, from top to bottom. If no signature matches are found, the IPS sensor does not affect the network traffic.
Figure 278:Edit IPS sensor

Go to Intrusion Protection > IPS Sensor and select the Edit icon of any IPS sensor. The Edit IPS Sensor window is divided into three parts: the sensor attributes, the filters, and the overrides. IPS sensor attributes:
Name Comments The name of the IPS sensor is displayed. It can be changed at any time. An optional comment describing the IPS sensor is displayed.

IPS sensor filters:

Add Filter # Name Select to add a new filter to the end of the filter list. Current position of each filter in the list. The name of the filter.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

443

Configuring IPS sensors

Intrusion Protection

Signature attributes

Severity Target Protocol OS Application

The severity of the included signatures. The type of system targeted by the attack. The targets are client and server. The protocols to which the signatures applies. Examples include HTTP, POP3, H323, and DNS. The operating systems to which the signatures apply. The applications to which the signatures apply.

Enable

The status of the signatures included in the filter is displayed. The signatures can be set to enabled, disabled, or default. The default setting uses the default status of each individual signature as displayed in the signature list. The logging status of the signatures included in the filter is displayed. Logging can be set to enabled or disabled. The action of the signatures included in the filter is displayed. The action can be set to pass all, block all, reset all, or default. The default setting uses the action of each individual signature as displayed in the signature list. To delete the filter, select the Delete icon. To edit the filter, select the Edit icon. To create a new filter and insert it above the current filter, select the Insert icon. To move the current filter, select the Move to icon. In the window that appears, enter the destination list position and select OK.

Logging Action

Delete icon Edit icon Insert icon Move to icon

IPS sensor overrides:

Add Pre-defined Select to create an override based on a pre-defined signature. Override Add Custom Override # Name Enable Logging Action Delete icon Edit icon Select to create an override based on a custom signature. Current position of each override in the list. The name of the signature. The status of the override is displayed. A green circle indicates the override is enabled. A gray circle indicates the override is not enabled. The logging status of the override is displayed. A green circle indicates logging is enabled. A gray circle indicates logging is not enabled. The action set for the override is displayed. The action can be set to pass, block, or reset. To delete the filter, select the Delete icon. To edit the filter, select the Edit icon.

Configuring filters
To edit a filter, go to Intrusion Protection > IPS Sensor and select the Edit icon of the IPS sensor containing the filter you want to edit. When the sensor window opens, select the Edit icon of the filter you want to change. You define which signatures are included in a filter by choosing five signature attributes: Severity is a rating applied to each signature defining its relative importance. Signatures rated critical detect the most dangerous attacks while those rated as info pose a much smaller threat. The five severity ratings, from highest to lowest, are: critical, high, medium, low, info.

444

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Intrusion Protection

Configuring IPS sensors

Target indicates the type of system targeted by the attack. The choices are server or client. Protocol specifies what network protocol is used by the attack. OS lists the operating system vulnerable to the attack. Application lists the application or application suite vulnerable to the attack.

The signatures included in the filter are only those matching every attribute specified. When created, a new filter has every attribute set to all. This setting results in every signature being included in the filter. If the severity is changed to high, and the target is changed to server, the filter includes only signatures checking for high priority attacks targeted at servers.
Note: If you are unsure which signatures are being included in the filters you construct, you can filter the signature list with the same attributes. The filtered list will display all of the signatures that match all the attributes you specify. See Using display filters on page 438 for signature list filtering details. Figure 279:Edit IPS Filter

For each of the five signature attributes, you can select either All or Specify. Selecting Specify will allow you to select any available options within that attribute. Signatures with an OS attribute of All are not operating system specific and affect all operating systems. These signatures will be automatically included in any filter where a single, multiple, or all operating systems are specified. Each pre-defined signature also has a default enable attribute. This default is displayed in the signature list. When configuring a filter, you can choose to accept this default attribute or override the default and either enable or disable the attribute for all of the included signatures. The signature actions work in the same way except the options are default, pass all, block all, and reset all.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

445

DoS sensors

Intrusion Protection

Configuring pre-defined and custom overrides

To edit a pre-defined or custom override, go to Intrusion Protection > IPS Sensor and select the Edit icon of the IPS sensor containing the override you want to edit. When the sensor window opens, select the Edit icon of the override you want to change. Pre-defined and custom overrides are configured and work in the same way. Unlike filters, each override defines the behavior of one signature. Overrides can be used to achieve three results: A signature override can change the behavior of a signature already included in a filter. For example, if you want to protect a web server, you could create a filter that includes and enables all signatures related to servers. If you wanted to disable one of those signatures, the simplest way would be to create an override and mark the signature as disabled. An override can add an individual signature not included in any filters, to an IPS sensor. This is the only way custom signatures can be added to IPS sensors. A signature override can be used to define the way a signature works depending on the traffics source and destination. The override configuration allows you to specify source and destination IP addresses or subnets. If an address field is left blank, all addresses are assumed to be included.

Figure 280:Configure IPS override

When a pre-defined signature is specified in an override, the default status and action attributes have no effect. These settings must be explicitly set when creating the override.

DoS sensors
The FortiGate IPS uses anomaly detection to identify network traffic that does not fit known or common traffic patterns and behavior. For example, one type of flooding is the denial of service (DoS) attack that occurs when an attacking system starts an abnormally high number of sessions with a target system. The high number of sessions slows down or disables the target system so the target system is no longer available to legitimate users. This attack gives the DoS sensor its name though it is capable of detecting and protecting against a number of anomaly attacks. Enable or disable logging for each traffic anomaly, and configure the detection threshold and action to take when the detection threshold is exceeded.

446

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Intrusion Protection

DoS sensors

Multiple DoS sensors can be created. Each sensor examines the network traffic in sequence, from top to bottom. When a sensor detects an anomaly, it applies the configured action. Multiple sensors allow great granularity in detecting anomalies because each sensor can be configured to examine traffic from a specific address, to a specific address, on a specific port, in any combination. When arranging the DoS sensors, place the most specific sensors at the top and the most general at the bottom. For example, a sensor with no specified protected addresses and no specified port will match all traffic. If this sensor is at the top of the list, no subsequent sensors will ever execute. The traffic anomaly detection list can be updated only when the FortiGate firmware image is upgraded.
Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings are configured separately in each VDOM. All sensors and custom signatures will appear only in the VDOM in which they were created.

Viewing the DoS sensor list

To view the anomaly list, go to Intrusion Protection > DoS Sensor.
Figure 281:The DoS sensor list

Create New ID Status Name Comments Delete Edit icon Insert DoS Sensor before icon Move To icon

Select to create a new DoS sensor at the bottom of the list. The ID is a unique identifier for each DoS sensor. The ID does not indicate the sequence in which the sensors examine network traffic. Select to enable the DoS sensor or clear to disable the DoS sensor. The DoS sensor name. An optional description of the DoS sensor. Select to delete the DoS sensor. Select to edit the following information: Action, Severity, and Threshold. Select to create a new DoS sensor before the current sensor.

Select to move the current DoS sensor to another position in the list.

Configuring DoS sensors

Because an improperly configured DoS sensor can interfere with network traffic, no DoS sensors are present on a factory default FortiGate unit. Also, newly created sensors are is disabled, and the thresholds are preset with recommended values. Use the recommended threshold, or adjust it to meet the needs of your network.
Note: It is important to know normal and expected network traffic before changing the default anomaly thresholds. Setting the thresholds too low could cause false positives, and setting the thresholds too high could allow otherwise avoidable attacks.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

447

DoS sensors

Intrusion Protection

To configure DoS sensors, go to Intrusion Protection > DoS Sensor. Select the Edit icon of an existing DoS sensor, or select Create New to create a new DoS sensor.
Figure 282:Edit DoS Sensor

DoS sensor attributes:

Name Comments The DoS sensor name. An optional description of the DoS sensor. This description will appear in the DoS sensor list and make each item easily identifiable.

Anomaly configuration:
Name Enable The name of the anomaly. When selected, the DoS sensor will detect when the specified anomaly occurs. The selection in the header row will enable or disable all anomalies. When selected, the DoS sensor will log when the anomaly occurs. The selection in the header row will enable or disable logging for all anomalies. No logging will occur if an anomaly is disabled. When an anomaly is detected, the FortiGate unit will execute the set action. Anomalous traffic will be allowed if the action is set to pass. When set to block, the anomalous traffic will be blocked. The threshold setting determines how many sessions/packets displaying the anomalous behavior are required to trigger the anomaly action. For further description, see Table 41 on page 449.

Logging

Action

Threshold

Protected addresses:
Destination The IP address of the traffic destination. 0.0.0.0/0 matches all addresses. If the FortiGate unit is running in transparent mode, 0.0.0.0/0 also includes the management IP address. The destination port of the traffic. 0 matches any port.

Destination Port

448

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Intrusion Protection

DoS sensors

Source Add

The IP address of the traffic source. 0.0.0.0/0 matches all addresses. After entering the required destination address, destination port, and source address, select Add to add protected address to the list. The DoS sensor will only be invoked on traffic matching all three of the entered values. If no addresses appear in the list, the sensor will be applied to all traffic.

Understanding the anomalies

For each of the TCP, UDP, and ICMP protocols, DoS sensors offer four statistical anomaly types. The result is twelve configurable anomalies.
Table 41: The twelve individually configurable anomalies Anomaly tcp_syn_flood Description If the SYN packet rate, including retransmission, to one destination IP address exceeds the configured threshold value, the action is executed. The threshold is expressed in packets per second. If the SYN packets rate, including retransmission, from one source IP address exceeds the configured threshold value, the action is executed. The threshold is expressed in packets per second. If the number of concurrent TCP connections from one source IP address exceeds the configured threshold value, the action is executed. If the number of concurrent TCP connections to one destination IP address exceeds the configured threshold value, the action is executed. If the UDP traffic to one destination IP address exceeds the configured threshold value, the action is executed. The threshold is expressed in packets per second. If the number of UDP sessions originating from one source IP address exceeds the configured threshold value, the action is executed. The threshold is expressed in packets per second. If the number of concurrent UDP connections from one source IP address exceeds the configured threshold value, the action is executed. If the number of concurrent UDP connections to one destination IP address exceeds the configured threshold value, the action is executed. If the number of ICMP packets sent to one destination IP address exceeds the configured threshold value, the action is executed. The threshold is expressed in packets per second. If the number of ICMP packets originating from one source IP address exceeds the configured threshold value, the action is executed. The threshold is expressed in packets per second. If the number of concurrent ICMP connections from one source IP address exceeds the configured threshold value, the action is executed. If the number of concurrent ICMP connections to one destination IP address exceeds the configured threshold value, the action is executed.

tcp_port_scan

tcp_src_session

tcp_dst_session

udp_flood

udp_scan

udp_src_session

udp_dst_session

icmp_flood

icmp_sweep

icmp_src_session

icmp_dst_session

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

449

Intrusion protection CLI configuration

Intrusion Protection

Intrusion protection CLI configuration

This section describes the CLI commands that extend features available through the web-based manager. For complete descriptions and examples of how to enable additional features through CLI commands, see the FortiOS CLI Reference.

ips global fail-open

If for any reason the IPS should cease to function, it will fail open by default. This means crucial network traffic will not be blocked, and the FortiGate unit will continue to operate while the problem is being resolved.

ips global socket-size

Set the size of the IPS buffer.

450

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

Order of web filtering

Web Filter
The three main sections of the web filtering function, the Web Filter Content Block, the URL Filter, and the FortiGuard Web filter, interact with each other in such a way as to provide maximum control and protection for the Internet users. This section describes: Order of web filtering How web filtering works Web filter controls Content block URL filter FortiGuard - Web Filter

Order of web filtering

Web filters are applied in a specific order: 1 2 3 4 5 6 7 URL Exempt (Web Exempt List) URL Block (Web URL Block) URL Block (Web Pattern Block) FortiGuard Web Filtering (Also called Category Block) Content Block (Web Content Block) Script Filter (Web Script Filter) Antivirus scanning The URL filter list is processed in order from top to bottom. (In FortiOS v2.80 the URL filter is processed as an unordered list.) An exempt match stops all further checking including AV scanning. An allow match exits the URL filter list and checks the other web filters. Local ratings are checked prior to other FortiGuard Web Filtering categories. The FortiGate unit applies the rules in this order and failure to comply with a rule will automatically block a site despite what the setting for later filters might be.

How web filtering works

The following information shows how the filters interact with each other and how to use them to your advantage. The first section, the URL exempt and block filters, will allow you to decide what action to take for specific addresses. For example, if you want to exempt www.google.com from being scanned, you can add it to the URL exempt list. Then no web filtering or virus scanning will be taken to this web site.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

451

Web filter controls

Web Filter

If you have blocked a pattern but want certain users to have access to URLs within that pattern, you can use the Override within the FortiGuard Web Filter. This will allow you to specify which users have access to which blocked URLs and how long they have that access. For example, you want User1 to be able to access www.fakeLAND.com for 1 hour. You can use this section to set up the exemption. Any user listed in an override must fill out an online authentication form before the FortiGuard unit will grant access to the blocked URL. FortiGuard Web Filter also lets you create local categories to block groups of URLs. Once you have created the category, you can use the local rating to add specific sites to the local category you have created. You then use the Firewall > Protection Profile to tell the FortiGuard Unit what action to take with the Local category. The local ratings overwrite the FortiGuard ratings. Finally the FortiGuard unit applies script filtering for ActiveX, Cookie, and Java applet, which can be configured in Firewall > Protection Profile > Web Filtering. Once you have finished configuring all of these settings, you still have to turn them all on in the Firewall > Protection Profile > Web filtering and Firewall > Protection Profile >FortiGuard Web Filtering. By enabling them here, you are telling the FortiGate unit to start using the filters as you have configured them. This section describes how to configure web filtering options. Web filtering functions must be enabled in the active protection profile for the corresponding settings in this section to have any effect.

Web filter controls

As a general rule you go to Web Filter to configure the web filtering settings and to enable the filters for use in a protection profile. To actually activate the enabled filters you go to Firewall> Protection Profile.
Note: Enabled means that the filter will be used when you turn on web filtering. It does not mean that the filter is turned on. To turn on all enabled filters you must go to Firewall> Protection Profile.

FortiGuard - Web Filter is described in detail inFortiGuard Web Filtering options on page 359. Rating corrections as well as suggesting ratings for new pages can be submitted on the FortiGuard Center web page. Visit the Fortinet Knowledge Center for details and a link to the FortiGuard Center. The following tables compare web filtering options in protection profiles and the web filter menu.
Table 42: Web filter and Protection Profile web content block configuration Protection Profile web filtering options Web Content Block Enable or disable web page blocking based on the banned words and patterns in the content block list for HTTP traffic. Web Filter setting Web Filter > Content Block Add words and patterns to block web pages containing those words or patterns.

452

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

Web filter controls

Table 43: Web filter and Protection Profile web URL filtering configuration Protection Profile web filtering options Web URL Filter Web Filter setting Web Filter > URL Filter

Enable or disable web page filtering for HTTP Add URLs and URL patterns to exempt traffic based on the URL filter list. or block web pages from specific sources.

Table 44: Web filter and Protection Profile web script filtering and download configuration Protection Profile web filtering options Enable or disable blocking scripts from web pages for HTTP traffic. Web resume Download Block Enable to block downloading the remainder of a file that has already been partially downloaded. Enabling this option prevents the unintentional download of virus files, but can cause download interruptions. n/a Web Filter setting

Active X Filter, Cookie Filter, Java Applet Filter n/a

Table 45: Web filter and Protection Profile web category filtering configuration Protection Profile web filtering options Enable FortiGuard Web Filtering Overrides (HTTP only). Provide details for blocked HTTP 4xx and 5xx errors (HTTP only.) Rate images by URL (Blocked images will be replaced with blanks) (HTTP only). Allow web sites when a rating error occurs (HTTP only). Strict Blocking (HTTP only) Category / Action FortiGuard Web Filtering service provides many categories by which to filter web traffic. Set the action to take on web pages for each category. Choose from allow, block, log, or allow override. Local Categories can be configured to best suit local requirements. Classification/Action When selected, users can access web sites that provide content cache, and provide searches for image, audio, and video files. Choose from allow, block, log, or allow override. FortiGuard Web Filtering > Local Categories | Local Ratings Web Filter setting FortiGuard Web Filtering > Overrides

Enable FortiGuard Web Filtering (HTTP only). FortiGuard Web Filter > Configuration

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

453

Content block

Web Filter

To access protection profile web filter options 1 2 3 Go to Firewall > Protection Profile. Select edit or Create New. Select Web Filtering or Web Category Filtering.
Note: If virtual domains are enabled on the FortiGate unit, web filtering features are configured globally. To access these features, select Global Configuration on the main menu.

Content block
Control web content by blocking specific words or patterns. If enabled in the protection profile, the FortiGate unit searches for words or patterns in on requested web pages. If matches are found, values assigned to the words are totalled. If a user-defined threshold value is exceeded, the web page is blocked Use Perl regular expressions or wildcards to add banned word patterns to the list.
Note: Perl regular expression patterns are case sensitive for Web Filter content block. To make a word or phrase case insensitive, use the regular expression /i. For example, /bad language/i blocks all instances of bad language regardless of case. Wildcard patterns are not case sensitive.

Viewing the web content block list catalog

You can add multiple web content block lists and then select the best web content block list for each protection profile. To view the web content block list catalog, go to Web Filter > Content Block. To view any individual web content block list, select the edit icon for the list you want to see.
Figure 283:Sample web content block list catalog

The web content block list catalogue has the following icons and features:
Add Name # Entries Profiles Comment To add a new list to the catalog, enter a name and select Add. New lists are empty by default. The available web content block lists. The number of content patterns in each web content block list. The protection profiles each web content block list has been applied to. Optional description of each web content block list. The comment text must be less than 63 characters long. Otherwise, it will be truncated. Spaces will also be replaced by the plus sign ( + ). Select to remove the web content block list from the catalog. The delete icon is only available if the web content block list is not selected in any protection profiles. Select to edit the web content block list, list name, or list comment.

Delete icon

Edit icon

454

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

Content block

Select web content block lists in protection profiles. For more information, see Web Filtering options on page 358.

Creating a new web content block list

To add a web content block list to the web content block list catalog 1 2 Go to Web Filter > Content Block. Select Create New.
Figure 284:New Web Content Block list dialog box

Name Comment

Enter the name of the new list. Enter a comment to describe the list, if required.

Viewing the web content block list

With web content block enabled, every requested web page is checked against the content block list. The score value of each pattern appearing on the page is added, and if the total is greater than the threshold value set in the protection profile, the page is blocked. The score for a pattern is applied only once even if it appears on the page multiple times. To view the web content block list 1 2 Go to Web Filter > Content Block. Select the edit icon of the web content block list you want to view.
Figure 285:Sample web content block list

Note: Enable Web Filtering > Web Content Block in a firewall Protection Profile to activate the content block settings.

The web content block list has the following icons and features:
Name Comment Web content block list name. To change the name, edit text in the name field and select OK. Optional comment. To add or edit comment, enter text in comment field and select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

455

Content block

Web Filter

Create new Total Page up icon Remove All Entries icon Banned word Pattern type Language Score

Select to add a pattern to the web content block list. The number of patterns in the web content block list. Select to view the previous page. Select to clear the table. The current list of patterns. Select the check box to enable all the patterns in the list. The pattern type used in the pattern list entry. Choose from wildcard or regular expression. See Using Perl regular expressions on page 485. The character set to which the pattern belongs: Simplified Chinese, Traditional Chinese, French, Japanese, Korean, Thai, or Western. A numerical weighting applied to the pattern. The score values of all the matching patterns appearing on a page are added, and if the total is greater than the threshold value set in the protection profile, the page is blocked. Select to delete an entry from the list. Select to edit the following information: Banned Word, Pattern Type, Language, and Enable.

Page down icon Select to view the next page.

Delete icon Edit icon

Configuring the web content block list

Web content patterns can be one word or a text string up to 80 characters long. The maximum number of banned words in the list is 5000. To add or edit a content block pattern 1 2 3 Go to Web Filter > Content Block. Select Create New or Select the edit icon of the web content block list you want to view.
Figure 286:New content block pattern

Banned Word

Enter the content block pattern. For a single word, the FortiGate checks all web pages for that word. For a phrase, the FortiGate checks all web pages for any word in the phrase. For a phrase in quotation marks, the FortiGate unit checks all web pages for the entire phrase. Select a pattern type from the dropdown list: Wildcard or regular Expression. Select a language from the dropdown list. Enter a score for the pattern. Select to enable the pattern.

Pattern Type Language Score Enable

456

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

Content block

Viewing the web content exempt list catalog

You can add multiple web content exempt lists and then select the best web content exempt list for each protection profile. To view the web content block list catalog Go to Web Filter > Content Block > Web Content Exempt.

To view any individual web content exempt list Select the edit icon for the list you want to see.

Figure 287:Sample web content exempt list catalog

The web content exempt list catalogue has the following icons and features:
Add Name # Entries Profiles Comment Delete icon To add a new list to the catalog, enter a name and select Add. New lists are empty by default. The available web content block lists. The number of content patterns in each web content block list. The protection profiles each web content block list has been applied to. Optional description of each web content block list. Select to remove the web content block list from the catalog. The delete icon is only available if the web content block list is not selected in any protection profiles. Select to edit the web content block list, list name, or list comment.

Edit icon

Select web content block lists in protection profiles. For more information, see Web Filtering options on page 358.

Creating a new web content exempt list

To add a web content exempt list to the web content exempt list catalog 1 2 Go to Web Filter > Content Block > Web Content Exempt. Select Create New.
Figure 288:New Web Content Exempt list dialog box

Name Comment

Enter the name of the new list. Enter a comment to describe the list, if required.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

457

Content block

Web Filter

Viewing the web content exempt list

Web content exempt allows overriding of the web content block feature. If any patterns defined in the web content exempt list appear on a web page, the page will not be blocked even if the web content block feature would otherwise block it. To view the web content exempt list 1 2 Go to Web Filter > Content Block > Web Content Exempt. Select the edit icon of the web content block list you want to view.
Figure 289:Sample web content exempt list

Note: Enable Web Filtering > Web Content Exempt in a firewall Protection Profile to activate the content exempt settings.

The web content exempt list has the following icons and features:
Name Comment Create new Total Page up icon Remove All Entries icon Pattern Pattern type Language Delete icon Edit icon Web content exempt list name. To change the name, edit text in the name field and select OK. Optional comment. To add or edit comment, enter text in comment field and select OK. Select to add a pattern to the web content exempt list. The number of patterns in the web content exempt list. Select to view the previous page. Select to clear the table. The current list of patterns. Select the check box to enable all the patterns in the list. The pattern type used in the pattern list entry. Choose from wildcard or regular expression. See Using Perl regular expressions on page 485. The character set to which the pattern belongs: Simplified Chinese, Traditional Chinese, French, Japanese, Korean, Thai, or Western. Select to delete an entry from the list. Select to edit the following information: Pattern, Pattern Type, Language, and Enable.

Page down icon Select to view the next page.

458

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

URL filter

Configuring the web content exempt list

Web content patterns can be one word or a text string up to 80 characters long. The maximum number of banned words in the list is 5000. To add or edit a content block pattern 1 2 3 Go to Web Filter > Content Block > Web Content Exempt. Select create New. or Select the edit icon of the web content block pattern you want to view.
Figure 290:New content exempt pattern

Pattern Word

Enter the content exempt pattern. For a single word, the FortiGate checks all web pages for that word. For a phrase, the FortiGate checks all web pages for any word in the phrase. For a phrase in quotation marks, the FortiGate unit checks all web pages for the entire phrase. Select a pattern type from the dropdown list: Wildcard or regular Expression. Select a language from the dropdown list. Select to enable the pattern.

Pattern Type Language Enable

URL filter
Allow or block access to specific URLs by adding them to the URL filter list. Add patterns using text and regular expressions (or wildcard characters) to allow or block URLs. The FortiGate unit allows or blocks web pages matching any specified URLs or patterns and displays a replacement message instead.
Note: Enable Web filtering > Web URL Filter in a firewall Protection Profile to activate the URL filter settings. Note: URL blocking does not block access to other services that users can access with a web browser. For example, URL blocking does not block access to ftp://ftp.example.com. Instead, use firewall policies to deny FTP connections.

Viewing the URL filter list catalog

You can add multiple URL filter lists and then select the best URL filter list for each protection profile. To view the URL filter list catalog Go to Web Filter > URL Filter.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

459

URL filter

Web Filter

To view any individual URL filter list 1 2 Go to Web Filter > URL Filter. Select the edit icon for the list you want to see.
Figure 291:Sample URL filter list catalog

The URL filter list catalogue has the following icons and features:
Add Name # Entries Profiles Comment Delete icon To add a new list to the catalog, enter a name and select Add. New lists are empty by default. The available URL filter lists. The number of URL patterns in each URL filter list. The protection profiles each URL filter list has been applied to. Optional description of each URL filter list. Select to remove the URL filter list from the catalog. The delete icon is only available if the URL filter list is not selected in any protection profiles. Select to edit the URL filter list, list name, or list comment.

Edit icon

Select URL filter lists in protection profiles. For more information, see Web Filtering options on page 358.

Creating a new URL filter list

Different FortiGate models support different maximum numbers of URL filter lists. For details, see the FortiGate Maximum Values Matrix in Fortinets Knowledge Center web site http://kc.forticare.com. To add a URL filter list to the URL filter list catalog 1 2 Go to Web Filter > URL Filter. Select Create New.
Figure 292:New URL Filter list dialog box

Name Comment

Enter the name of the new list. Enter a comment to describe the list, if required.

460

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

URL filter

Viewing the URL filter list

Add specific URLs to block or exempt. Add the following items to the URL filter list: complete URLs IP addresses partial URLs to allow or block all sub-domains

To view the URL filter list 1 2 Go to Web Filter > URL Filter. Select the edit icon of the URL filter list you want to view.
Figure 293:URL filter list

The URL filter list has the following icons and features:
Name Comment Create New Page up icon Page down icon Clear All URL Filters icon URL Type Action URL filter list name. To change the name, edit text in the name field and select OK. Optional comment. To add or edit comment, enter text in comment field and select OK. Select to add a URL to the URL block list. Select to view the previous page. Select to view the next page. Select to clear the table. The current list of blocked/exempt URLs. Select the check box to enable all the URLs in the list. The type of URL: Simple or Regex (regular expression). The action taken when the URL matches: Allow, Block, or Exempt.

An allow match exits the URL filter list and checks the other web filters. An exempt match stops all further checking including AV scanning. A block match blocks the URL and no further checking will be done.
Delete icon Edit icon Move icon Select to remove an entry from the list. Select to edit the following information: URL, Type, Action, and Enable. Select to open the Move URL Filter dialog box.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

461

URL filter

Web Filter

Configuring the URL filter list

Each URL filter list can have up to 5000 entries.
Note: Type a top-level domain suffix (for example, com without the leading period) to block access to all URLs with this suffix.

To add a URL to the URL filter list 1 2 3 4 5 6 7 Go to Web Filter > URL Filter. Select Create New or edit an existing list. Type in a URL or IP address. For details about URL formats, see URL formats on page 462. Select the type of expression. Select the action to be taken. Select the Enable check box. Select OK.
Figure 294:New URL Filter

URL Type Action

Enter the URL. Do not include http:// Select a type from the dropdown list: Simple or Regex (regular expression).

An allow match exits the URL filter list and checks the other web filters. An exempt match stops all further checking including AV scanning. A block match blocks the URL and no further checking will be done.
Select to enable the URL.

Select an action from the dropdown list: Allow, Block, or Exempt.

Enable

URL formats
When adding a URL to the URL filter list (see Configuring the URL filter list on page 462), follow these rules:

HTTPs URL formats

Type a top level domain name for HTTPs URL filtering, for example, www.example.com. HTTPs URL filtering works by extracting the CN from the server certificate during the SSL negotiation. Because the CN only contains the domain name of the site being accessed, HTTPS web filtering can only filter by domain names.

462

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

URL filter

HTTP URL formats

Type a top-level URL or IP address to control access to all pages on a web site. For example, www.example.com or 192.168.144.155 controls access to all pages at this web site. Enter a top-level URL followed by the path and filename to control access to a single page on a web site. For example, www.example.com/news.html or 192.168.144.155/news.html controls the news page on this web site. To control access to all pages with a URL that ends with example.com, add example.com to the filter list. For example, adding example.com controls access to www.example.com, mail.example.com, www.finance.example.com, and so on. Control access to all URLs that match patterns created using text and regular expressions (or wildcard characters). For example, example.* matches example.com, example.org, example.net and so on. FortiGate web pattern blocking supports standard regular expressions.
Note: URLs with an action set to exempt are not scanned for viruses. If users on the network download files through the FortiGate unit from trusted website, add the

URL of this website to the URL filter list with an action set to exempt so the
FortiGate unit does not virus scan files downloaded from this URL. Note: Enable Web Filtering > Web URL Filter > HTTP or HTTPS in a firewall Protection Profile to activate the web URL filter settings for HTTP and/or HTTPS traffic.

Moving URLs in the URL filter list

To make the URL filter list easier to use, the entries can be moved to different positions in the list. To move a URL in the URL filter list 1 2 3 4 5 Go to Web Filter > URL Filter. Select the Edit icon for the URL list. Drag and drop a URL or select the Move icon to the right of the URL to be moved. Specify the location for the URL. Select OK.
Figure 295:Move URL Filter

Move to (URL)

Select the location in the list to place the URL. Enter the URL before or after which the new URL is to be located in the list.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

463

FortiGuard - Web Filter

Web Filter

FortiGuard - Web Filter

FortiGuard Web Filtering is a managed web filtering solution provided by Fortinet. FortiGuard Web Filtering sorts hundreds of millions of web pages into a wide range of categories users can allow, block, or monitor. The FortiGate unit accesses the nearest FortiGuard Web Filtering Service Point to determine the category of a requested web page then follows the firewall policy configured for that user or interface. FortiGuard Web Filtering includes over 60 million individual ratings of web sites applying to hundreds of millions of pages. Pages are sorted and rated into 56 categories users can allow, block, or monitor. Categories may be added to, or updated, as the Internet evolves. To make configuration simpler, users can also choose to allow, block, or monitor entire groups of categories. Blocked pages are replaced with a message indicating that the page is not accessible according to the Internet usage policy. FortiGuard Web Filtering ratings are performed by a combination of proprietary methods including text analysis, exploitation of the Web structure, and human raters. Users can notify the FortiGuard Web Filtering Service Points if they feel a web page is not categorized correctly, and new sites are quickly rated as required. Use the procedure FortiGuard Web Filtering options on page 359 to configure FortiGuard category blocking in a protection profile. To configure the FortiGuard Web service, see Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228.

Configuring FortiGuard Web Filtering

To configure the FortiGuard Web Filtering service Go to System > Maintenance > FortiGuard Center. For additional information, see Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228.

Viewing the override list

Users may require access to web sites that are blocked by a policy. In this case, an administrator can give the user the ability to override the block for a specified period of time. When a user attempts to access a blocked site, if override is enabled, a link appears on the block page directing the user to an authentication form. The user must provide a correct user name and password or the web site remains blocked. Authentication is based on user groups and can be performed for local, RADIUS, and LDAP users. For more information about authentication and configuring user groups, see User groups on page 409.

Administrative overrides vs. user overrides

In FortiOS v3.0 MR5 and older releases, the URL overrides has an expiry date and would be automatically deleted when this date is reached. In FortiOS v3.0 MR6 and newer releases, the URL overrides are split into two categories: administrative overrides and user overrides.

464

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

FortiGuard - Web Filter

The administrative overrides are backed up with the main configuration and managed by the FortiManager system. The administrative overrides are not cleaned up when they expire and you can reuse these override entries by extending their expiry dates. You can create administrative overrides using both the CLI and the web-based manager. The user overrides are not backed up as part of the main configuration and are not managed by the FortiManager system. These overrides are also purged when they expire. You can create user overrides using the web-based manager only. To view the override list 1 2 Go to Web Filter > FortiGuard - Web Filter > Override. Select the Edit icon for Administrative Overrides or User Overrides.
Figure 296:Override list

The override list has the following icons and features:

Create New Return Clear All icon URL/Category Scope Off-site URLs Select to add a new override rule to the list. Select to return to the override category page. Select to clear the table. The URL or category to which the override applies. The user or user group who may use the override. A green check mark indicates that the off-site URL option is set to Allow, which means that the overwrite web page will display the contents from off-site domains. A gray cross indicates that the offsite URL option is set to Block, which means that the overwrite web page will not display the contents from off-site domains. For details, see Configuring override rules on page 465. The creator of the override rule. The expiry date of the override rule. Select to remove the entry from the list. Select to edit the following information: Type, URL, Scope, User, Off-site URLs, and Override Duration.

Initiator Expiry Date Delete icon Edit icon

Configuring override rules

Override rules can be configured to allow access to blocked web sites based on directory, domain name, or category. To create an override rule for a directory or domain 1 2 3 4 5 Go to Web Filter > FortiGuard - Web Filter > Override. Select the Edit icon for Administrative Overrides or User Overrides. Select Create New. Select the Type. Select the Scope.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

465

FortiGuard - Web Filter

Web Filter

6 7 8 9

Select the information that corresponds with Scope. Select Allow or Block for the off-site URLs. Set the duration of the override. Select OK.
Figure 297:New Override Rule - Directory or Domain

Type URL Scope

Select Directory or Domain. Enter the URL or the domain name of the website. Select one of the following: User, User Group, IP, or Profile. Depending on the option selected, a different option appears below Scope. Enter the name of the user selected in Scope. Select a user group from the dropdown list. User groups must be configured before FortiGuard Web Filtering configuration. For more information, see User groups on page 409. This option defines whether the override web page will display the images and other contents from the blocked offsite URLs. For example, all FortiGuard categories are blocked, and you want to visit a site whose images are served from a different domain. You can create a directory override for the site and view the page. If the offsite feature was set to deny, all the images on the page will appear broken because they come from a different domain for which the existing override rule does not apply. If you set the offsite feature to allow, the images on the page will then show up. Only users that apply under the scope for the page override can see the images from the temporary overrides. The users will not be able to view any pages on the sites where the images come from (unless the pages are served from the same directory as the images themselves) without having to create a new override rule. Specify when the override rule will end.

User User Group

Off-site URLs

Override End Time

To create an override for categories, go to Web Filter > FortiGuard - Web Filter > Override.

466

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

FortiGuard - Web Filter

Figure 298:New Override Rule - Categories

Type Categories

Select Categories. Select the categories to which the override applies. A category group or a subcategory can be selected. Local categories are also displayed. Select the classifications to which the override applies. When selected, users can access web sites that provide content cache, and provide searches for image, audio, and video files. Select one of the following: User, User Group, IP, or Profile. Depending on the option selected, a different option appears below Scope. Enter the name of the user selected in Scope. Select a user group from the dropdown list. Enter the IP address of the computer initiating the override. Select a protection profile from the dropdown list. Select Allow or Block. See the previous table for details about offsite URLs. Specify when the override rule will end.

Classifications

Scope

User User Group IP Profile Off-site URLs Override End Time

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

467

FortiGuard - Web Filter

Web Filter

Creating local categories

User-defined categories can be created to allow users to block groups of URLs on a per-profile basis. The categories defined here appear in the global URL category list when configuring a protection profile. Users can rate URLs based on the local categories.
Figure 299:Local categories list

Add Delete icon

Enter the name of the category then select Add. Select to remove the entry from the list.

Viewing the local ratings list

To view the local ratings list Go to Web Filter > FortiGuard - Web Filter > Local Ratings.

Figure 300:Local ratings list

The local ratings list has the following icons and features:
Create New Search 1 - 3 of 3 Page up icon Page down icon Clear All icon URL Category Select to add a rating to the list. Enter search criteria to filter the list. The total number of local ratings in the list. Select to view the previous page. Select to view the next page. Select to clear the table. The rated URL. Select the green arrow to sort the list by URL. The category or classification in which the URL has been placed. If the URL is rated in more than one category or classification, trailing dots appear. Select the gray funnel to open the Category Filter dialog box. When the list has been filtered, the funnel changes to green. Select to remove the entry from the list. Select to edit the following information: URL, Category Rating, and Classification Rating.

Delete icon Edit icon

468

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

FortiGuard - Web Filter

Figure 301:Category Filter

Clear Filter Category Name Enable Filter Classification Name Enable Filter

Select to remove all filters. Select the blue arrow to expand the category. Select to enable the filter for the category or the individual subcategory. The classifications that can be filtered. Select to enable the classification filter.

Configuring local ratings

Users can create user-defined categories then specify the URLs that belong to the category. This allows users to block groups of web sites on a per profile basis. The ratings are included in the global URL list with associated categories and compared in the same way the URL block list is processed. The local ratings override the FortiGuard server ratings and appear in reports as Local Category. To create a local rating Go to Web Filter > FortiGuard - Web Filter > Local Ratings.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

469

FortiGuard - Web Filter

Web Filter

Figure 302:New Local Rating

URL Category Name Enable Filter Classification Name Enable Filter

Enter the URL to be rated. Select the blue arrow to expand the category. Select to enable the filter for the category or the individual subcategory. The classifications that can be filtered. Select to enable the classification filter.

Category block CLI configuration

Use the hostname keyword for the webfilter fortiguard command to change the default host name (URL) for the FortiGuard Web Filtering Service Point. The FortiGuard Web Filtering Service Point name cannot be changed using the web-based manager. Configure all FortiGuard Web Filtering settings using the CLI. For more information, see the FortiOS CLI Reference for descriptions of the webfilter fortiguard keywords.

FortiGuard Web Filtering reports

Note: FortiGuard Web Filtering reports are only available on FortiGate units with a hard disk.

Generate a text and pie chart format report on FortiGuard Web Filtering for any protection profile. The FortiGate unit maintains statistics for allowed, blocked, and monitored web pages for each category. View reports for a range of hours or days, or view a complete report of all activity. To create a web filter report Go to Web Filter > FortiGuard - Web Filter > Reports.

470

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Web Filter

FortiGuard - Web Filter

Figure 303:Sample FortiGuard Web Filtering report

The following table describes the options for generating reports:

Profile Report Type Report Range Select the protection profile for which to generate a report. Select the time frame for the report. Choose from hour, day, or all historical statistics. Select the time range (24 hour clock) or day range (from six days ago to today) for the report. For example, for an hour report type with a range of 13 to 16, the result is a category block report for 1 pm to 4 pm today. For a day report type with a range of 0 to 3, the result is a category block report for 3 days ago to today. Select to generate the report.

Get Report

A generated report includes a pie chart and the following information:

Category Allowed Blocked Monitored The category for which the statistic was generated. The number of allowed web addresses accessed in the selected time frame. The number of blocked web addresses accessed in the selected time frame. The number of monitored web addresses accessed in the selected time frame.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

471

FortiGuard - Web Filter

Web Filter

472

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Antispam

Antispam
This section explains how to configure the spam filtering options associated with a firewall protection profile. This section describes: Antispam Banned word Black/White List Advanced antispam configuration Using Perl regular expressions

Antispam
Antispam can be configured to manage unsolicited commercial email by detecting spam and identifying spam transmissions from known or suspected spam servers. FortiGuard Antispam is one of the features designed to manage spam. FortiGuard is an antispam system from Fortinet that includes an IP address black list, a URL black list, and spam filtering tools. The FortiGuard Center accepts submission of spam email messages as well as reports of false positives. Visit the Fortinet Knowledge Center for details and a link to the FortiGuard Center.

Order of Spam Filtering

The order in which incoming mail is passed through the FortiGate Antispam filters is determined by the protocol used to transfer the mail:

For SMTP
1 2 3 4 5 6 7 IP address BWL check on last hop IP DNSBL & ORDBL check on last hop IP, FortiGuard Antispam IP check on last hop IP, HELO DNS lookup MIME headers check, E-mail address BWL check Banned word check on email subject IP address BWL check (for IPs extracted from Received headers) Banned word check on email body Return e-mail DNS check, FortiGuard Anti Spam check, DNSBL & ORDBL check on public IP extracted from header

For POP3 and IMAP

1 2 3 MIME headers check, E-mail address BWL check Banned word check on email subject IP BWL check

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

473

Antispam

Antispam

4 5

Banned word check on email body Return e-mail DNS check, FortiGuard AntiSpam check, DNSBL & ORDBL check

For SMTP, POP3, and IMAP

Filters requiring a query to a server and a reply (FortiGuard Antispam Service and DNSBL/ORDBL) are run simultaneously. To avoid delays, queries are sent while other filters are running. The first reply to trigger a spam action takes effect as soon as the reply is received. Each spam filter passes the email to the next if no matches or problems are found. If the action in the filter is Mark as Spam, the FortiGate unit will tag or discard (SMTP only) the email according to the settings in the protection profile. If the action in the filter is Mark as Clear, the email is exempt from any remaining filters. If the action in the filter is Mark as Reject, the email session is dropped. Rejected SMTP email messages are substituted with a configurable replacement message.

Anti-spam filter controls

Spam filters are configured for system-wide use, but enabled on a per profile basis. Table 46 describes the Antispam settings and where to configure and access them.
Table 46: AntiSpam and Protection Profile spam filtering configuration Protection Profile spam filtering options IP address FortiGuard Antispam check Enable or disable Fortinets antispam service called FortiGuard Antispam. FortiGuard Antispam is Fortinets own DNSBL server that provides spam IP address and URL blacklists. Fortinet keeps the FortiGuard Antispam IP and URLs up-to-date as new spam sources are found. IP address BWL check Black/white list check. Enable or disable checking incoming IP addresses against the configured spam filter IP address list. (SMTP only.) AntiSpam setting System > Maintenance > FortiGuard Centre Enable FortiGuard Antispam, check the status of the FortiGuard Antispam server, view the license type and expiry date, and configure the cache. For details, see Configuring the FortiGate unit for FDN and FortiGuard subscription services on page 228 AntiSpam > Black/White List > IP Address Add to and edit IP addresses to the list. You can configure the action to take as spam, clear, or reject for each IP address. You can place an IP address anywhere in the list. The filter checks each IP address in sequence. (SMTP only.) Command line only Add or remove DNSBL and ORDBL servers to and from the list. You can configure the action to take as spam or reject for email identified as spam from each server (SMTP only). DNSBL and ORDBL configuration can only be changed using the command line interface. For more information, see the FortiOS CLI Reference. n/a

DNSBL & ORDBL check Enable or disable checking email traffic against configured DNS Blackhole List (DNSBL) and Open Relay Database List (ORDBL) servers.

HELO DNS lookup

474

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Antispam

Table 46: AntiSpam and Protection Profile spam filtering configuration (Continued) Protection Profile spam filtering options Enable or disable checking the source domain name against the registered IP address in the Domain Name Server. If the source domain name does not match the IP address the email is marked as spam and the action selected in the protection profile is taken. E-mail address BWL check AntiSpam > Black/White List > E-mail Address AntiSpam setting

Enable or disable checking incoming email Add to and edit email addresses to the list, addresses against the configured spam filter with the option of using wildcards and email address list. regular expressions. You can configure the action as spam or clear for each email address. You can place an email address anywhere in the list. The filter checks each email address in sequence. Return e-mail DNS check Enable or disable checking incoming email return address domain against the registered IP address in the Domain Name Server. If the return address domain name does not match the IP address the email is marked as spam and the action selected in the protection profile is taken. MIME headers check Enable or disable checking source MIME headers against the configured spam filter MIME header list. Command line only Add to and edit MIME headers, with the option of using wildcards and regular expressions. You can configure the action for each MIME header as spam or clear. DNSBL and ORDBL configuration can only be changed using the command line interface. For more information, see the FortiOS CLI Reference. AntiSpam > Banned Word Add to and edit banned words to the list, with the option of using wildcards and regular expressions. You can configure the language and whether to search the email body, subject, or both. You can configure the action to take as spam or clear for each word. n/a n/a

Banned word check Enable or disable checking source email against the configured spam filter banned word list.

Spam Action The action to take on email identified as spam. POP3 and IMAP messages are tagged. Choose Tagged or Discard for SMTP messages. You can append a custom word or phrase to the subject or MIME header of tagged email. You can choose to log any spam action in the event log. For IMAP, spam email may be tagged only after the user downloads the entire message by opening the email, since the some IMAP email clients download the envelope portion of the email message initially. For details, see Spam Filtering options on page 361. Tag location: Affix the tag to the subject or MIME header of the email identified as spam.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

475

Banned word

Antispam

Table 46: AntiSpam and Protection Profile spam filtering configuration (Continued) Protection Profile spam filtering options Tag format: Enter a word or phrase (tag) to affix to email identified as spam. Add event into the system log Enable or disable logging of spam actions to the event log. AntiSpam setting

To access protection profile Antispam options go to Firewall > Protection Profile, edit or Create New, Spam Filtering.

Banned word
Control spam by blocking email messages containing specific words or patterns. If enabled in the protection profile, the FortiGate unit searches for words or patterns in email messages. If matches are found, values assigned to the words are totalled. If a user-defined threshold value is exceeded, the message is marked as spam. If no match is found, the email message is passed along to the next filter. Use Perl regular expressions or wildcards to add banned word patterns to the list.
Note: Perl regular expression patterns are case sensitive for antispam banned words. To make a word or phrase case insensitive, use the regular expression /i. For example, /bad language/i will block all instances of bad language regardless of case. Wildcard patterns are not case sensitive.

Viewing the antispam banned word list catalog

You can add multiple antispam banned word lists and then select the best antispam banned word list for each protection profile. To view the antispam banned word list catalog, go to AntiSpam > Banned Word. To view any individual antispam banned word list, select the edit icon for the list you want to see.
Figure 304:Sample antispam banned word list catalog

The antispam banned word list catalogue has the following icons and features:
Add Name # Entries Profiles Comment To add a new list to the catalog, enter a name and select Add. New lists are empty by default. The available antispam banned word lists. The number of entries in each antispam banned word list. The protection profiles each antispam banned word list has been applied to. Optional description of each antispam banned word list.

476

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Banned word

Delete icon

Select to remove the antispam banned word list from the catalog. The delete icon is only available if the antispam banned word list is not selected in any protection profiles. Select to edit the antispam banned word list, list name, or list comment.

Edit icon

Select antispam banned word lists in protection profiles. For more information, see Spam Filtering options on page 361.

Creating a new antispam banned word list

To add an antispam banned word list to the antispam banned word list catalog, go to AntiSpam > Banned Word and select Create New.
Figure 305:New AntiSpam Banned Word list dialog box

Name Comment

Enter the name of the new list. Enter a comment to describe the list, if required.

Viewing the antispam banned word list

Each email message is checked against the antispam banned word list. Add one or more banned words to sort email messages containing those words in the subject, body, or both. The score value of each banned word appearing in the message is added, and if the total is greater than the threshold value set in the protection profile, the message is processed according to the Spam Action setting in the protection profile. The score for a pattern is applied only once even if it appears in the message multiple times. To view the banned word list, go to AntiSpam > Banned Word and select the edit icon of the banned word list you want to view.
Figure 306:Sample banned word List

The banned word list has the following icons and features:
Name Comment Create new Total Banned word list name. To change the name, edit text in the name field and select OK. Optional comment. To add or edit comment, enter text in comment field and select OK. Select to add a word or phrase to the banned word list. The number of items in the list.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

477

Banned word

Antispam

Page up icon Remove All Entries icon Pattern Pattern Type

Select to view the previous page. Select to clear the table. The list of banned words. Select the check box to enable all the banned words in the list. The pattern type used in the banned word list entry. Choose from wildcard or regular expression. For more information, see Using Perl regular expressions on page 485. The character set to which the banned word belongs: Simplified Chinese, Traditional Chinese, French, Japanese, Korean, Thai, or Western. The location which the FortiGate unit searches for the banned word: subject, body, or all. A numerical weighting applied to the banned word. The score values of all the matching words appearing in an email message are added, and if the total is greater than the spamwordthreshold value set in the protection profile, the page is processed according to whether the spam action command for the mail traffic type (e.g. smtp3-spamaction) is set to pass or tag in the protection profile. The score for a banned word is counted once even if the word appears multiple times on the web page. Select to remove the word from the list. Select to edit the following information: Pattern, Pattern Type, Language, Where, Action, and Enable.

Page down icon Select to view the next page.

Language

Where Score

Delete icon Edit icon

Configuring the antispam banned word list

Words can be marked as spam or clear. Banned words can be one word or a phrase up to 127 characters long. For a single word, the FortiGate unit blocks all email containing the word. For a phrase, the FortiGate unit blocks all email containing the exact phrase. To block any word in a phrase, use Perl regular expressions. To add or edit a banned word, go to AntiSpam > Banned Word.
Figure 307:Add Banned Word

Pattern Pattern Type Language

Enter the word or phrase you want to include in the banned word list. Select the pattern type for the banned word. Choose from wildcard or regular expression. See Using Perl regular expressions on page 485. Select the character set for the banned word. Choose from: Chinese Simplified, Chinese Traditional, French, Japanese, Korean, Thai, or Western. Select the location to search for the banned word. Choose from: subject, body, or all. Select to enable scanning for the banned word.

Where Enable

478

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Black/White List

Black/White List
The FortiGate unit uses both an IP address list and an email address list to filter incoming email, if enabled in the protection profile. When doing an IP address list check, the FortiGate unit compares the IP address of the messages sender to the IP address list in sequence. If a match is found, the action associated with the IP address is taken. If no match is found, the message is passed to the next enabled spam filter. When doing an email list check, the FortiGate unit compares the email address of the messages sender to the email address list in sequence. If a match is found, the action associated with the email address is taken. If no match is found, the message is passed to the next enabled antispam filter.

Viewing the antispam IP address list catalogue

You can add multiple antispam IP address lists and then select the best one for each protection profile. To view the antispam IP address list catalog, go to AntiSpam > Black/White List > IP Address. To view any individual antispam IP address list, select the edit icon for the list you want to see.
Figure 308:Sample antispam IP address list catalog

The antispam IP address list catalogue has the following icons and features:
Add Name # Entries Profiles Comment Delete icon To add a new list to the catalog, enter a name and select Add. New lists are empty by default. The available antispam IP address lists. The number of entries in each antispam IP address list. The protection profiles each antispam IP address list has been applied to. Optional description of each antispam IP address list. Select to remove the antispam IP address list from the catalog. The delete icon is only available if the antispam IP address list is not selected in any protection profiles. Select to edit the antispam IP address list, list name, or list comment.

Edit icon

Select antispam banned word lists in protection profiles. For more information, see Spam Filtering options on page 361.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

479

Black/White List

Antispam

Creating a new antispam IP address list

To add an antispam IP address list to the antispam IP address list catalog, go to AntiSpam > Black/White List and select Create New.
Figure 309:New AntiSpam IP Address list dialog box

Name Comment

Enter the name of the new list. Enter a comment to describe the list, if required.

Viewing the antispam IP address list

Configure the FortiGate unit to filter email from specific IP addresses. The FortiGate unit compares the IP address of the sender to the check list in sequence. Mark each IP address as clear, spam, or reject. Filter single IP addresses or a range of addresses at the network level by configuring an address and mask. To view the antispam IP address list, go to AntiSpam > Black/White List > IP Address and select the edit icon of the antispam IP address list you want to view.
Figure 310:Sample IP address list

The antispam IP address list has the following icons and features:
Name Comments Create New Total Page up icon Page down icon Antispam IP address list name. To change the name, edit text in the name field and select OK. Optional comment. To add or edit comment, enter text in the comments field and select OK. Select to add an IP address to the antispam IP address list. The number of items in the list. Select to view the previous page. Select to view the next page.

Remove All Entries Select to clear the table. icon IP address/Mask The current list of IP addresses.

480

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Black/White List

Action

The action to take on email from the configured IP address. Actions are: Mark as Spam to apply the configured spam action, Mark as Clear to bypass this and remaining spam filters, or Mark as Reject (SMTP only) to drop the session. If an IP address is set to reject but mail is delivered from that IP address via POP3 or IMAP, the e-mail messages will be marked as spam. Select to remove the address from the list. Select to edit address information: IP Address/Mask, Insert, Action, and Enable. Select to move the entry to a different position in the list. The firewall executes the list from top to bottom. For example, if you have IP address 1.1.1.1 listed as spam and 1.1.1.0 listed as clear, you must put 1.1.1.1 above 1.1.1.0 for 1.1.1.1 to take effect.

Delete icon Edit icon Move To icon

Configuring the antispam IP address list

To add an IP address to the IP address list, go to AntiSpam > Black/White List > IP Address and select Create New. Enter an IP address or a pair of IP address and mask in the following formats: x.x.x.x, for example, 62.128.69.100. x.x.x.x/x.x.x.x, for example, 62.128.69.100/255.255.255.0 x.x.x.x/x, for example, 62.128.69.100/24

Figure 311:Add IP Address

IP Address/Mask Insert Action

Enter the IP address or the IP address/mask pair. Select the position in the list to place the address. Select an action. Actions are: Mark as Spam to apply the spam action configured in the protection profile, Mark as Clear to bypass this and remaining spam filters, or Mark as Reject (SMTP only) to drop the session. Enable the address.

Enable

Viewing the antispam email address list catalog

You can add multiple antispam email address lists and then select the best one for each protection profile. To view the antispam email address list catalog, go to AntiSpam > Black/White List > E-mail Address. To view any individual antispam email address list, select the edit icon for the list you want to see.
Figure 312:Sample antispam email address list catalog

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

481

Black/White List

Antispam

The antispam email address list catalogue has the following icons and features:
Add Name # Entries Profiles Comment Delete icon To add a new list to the catalog, enter a name and select Add. New lists are empty by default. The available antispam email address lists. The number of entries in each antispam email address list. The protection profiles each antispam email address list has been applied to. Optional description of each antispam email address list. Select to remove the antispam email address list from the catalog. The delete icon is only available if the antispam email address list is not selected in any protection profiles. Select to edit the antispam email address list, list name, or list comment.

Edit icon

Select antispam banned word lists in protection profiles. For more information, see Spam Filtering options on page 361.

Creating a new antispam email address list

To add an antispam email address list to the antispam email address list catalog, go to AntiSpam > Black/White List > E-mail Address and select Create New.
Figure 313:New AntiSpam E-mail Address list dialog box

Name Comment

Enter the name of the new list. Enter a comment to describe the list, if required.

Viewing the antispam email address list

The FortiGate unit can filter email from specific senders or all email from a domain (such as example.net). Mark each email address as clear or spam. To view the antispam email address list, go to AntiSpam > Black/White List > E-mail Address and select the edit icon of the antispam email address list you want to view.
Figure 314:Sample email address list

The antispam email address list has the following icons and features:

482

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Black/White List

Name Comment Create New Total Page up icon Page down icon

Antispam email address list name. To change the name, edit text in the name field and select OK. Optional comment. To add or edit comment, enter text in comment field and select OK. Add an email address to the email address list. The number of items in the list. View the previous page. View the next page.

Remove All Entries Clear the table. icon Email address Pattern Type The current list of email addresses. The pattern type used in the email address entry. Choose from wildcard or regular expression. For more information, see Using Perl regular expressions on page 485. The action to take on email from the configured address. Actions are: Mark as Spam to apply the spam action configured in the protection profile, or Mark as Clear to let the email message bypass this and remaining spam filters. Select to remove the email address from the list. Select to edit the following information: E-Mail Address, Pattern Type, Insert, Action, and Enable. Select to move the entry to a different position in the list. The firewall execute the list from top to bottom. For example, if you have [email protected] listed as clear and *@abc.com as spam, you must put [email protected] above *@abc.com for [email protected] to take effect.

Action

Delete icon Edit icon Move To icon

Configuring the antispam email address list

To add an email address or domain to the list, go to AntiSpam > Black/White List > E-mail Address, select a catalog, then the Edit icon, and then select Create New and enter the email address.
Figure 315:Add E-mail Address

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

483

Advanced antispam configuration

Antispam

E-Mail Address Pattern Type Insert Action

Enter the email address. Select a pattern type: Wildcard or Regular Expression. For more information, see Using Perl regular expressions on page 485. Select the location in the list to insert the email address. Select an action: To apply the spam action configured in the protection profile, select Mark as Spam. Select Mark as Clear to allow the email message bypass this and remaining spam filters.

Enable

Enable the email address.

1 2 3 4 5 6

Enter the email address or pattern. Select a pattern type for the list entry. If required, select before or after another email address in the list to place the new email address in the correct position. Select the action to take on email from the configured address or domain. Select Enable. Select OK.

Advanced antispam configuration

Advanced antispam configuration covers only command line interface (CLI) commands not represented in the web-based manager. For complete descriptions and examples of how to use CLI commands, see the FortiOS CLI Reference.

config spamfilter mheader

Use this command to configure email filtering based on the MIME (Multipurpose Internet Mail Extensions) header. MIME header filtering is enabled within each protection profile. The FortiGate unit compares the MIME header key-value pair of incoming email to the list pair in sequence. If a match is found, the corresponding action is taken. If no match is found, the email is passed on to the next spam filter. MIME headers are added to email to describe content type and content encoding, such as the type of text in the email body or the program that generated the email. Some examples of MIME headers include: X-mailer: outgluck X-Distribution: bulk Content_Type: text/html Content_Type: image/jpg

The first part of the MIME header is called the header key, or just header. The second part is called the value. Spammers often insert comments into header values or leave them blank. These malformed headers can fool some spam and virus filters.

484

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Using Perl regular expressions

Use the MIME headers list to mark email from certain bulk mail programs or with certain types of content that are common in spam messages. Mark the email as spam or clear for each header configured.

config spamfilter dnsbl

Use this command to configure email filtering using DNS-based Blackhole List (DNSBL), and Open Relay Database List (ORDBL) servers. DNSBL and ORDBL filtering is enabled within each protection profile. The FortiGate unit compares the IP address or domain name of the sender to any database lists configured, in sequence. If a match is found, the corresponding action is taken. If no match is found, the email is passed on to the next spam filter. Some spammers use unsecured third party SMTP servers to send unsolicited bulk email. Using DNSBLs and ORDBLs is an effective way to tag or reject spam as it enters the network. These lists act as domain name servers that match the domain of incoming email to a list of IP addresses known to send spam or allow spam to pass through. There are several free and subscription servers available that provide reliable access to continually updated DNSBLs and ORDBLs. Please check with the service being used to confirm the correct domain name for connecting to the server.
Note: Because the FortiGate unit uses the server domain name to connect to the DNSBL or ORDBL server, it must be able to look up this name on the DNS server. For information on configuring DNS, see Networking Options on page 120.

Using Perl regular expressions

Email address list, MIME headers list, and banned word list entries can include wildcards or Perl regular expressions. See http://perldoc.perl.org/perlretut.html for detailed information about using Perl regular expressions.

Regular expression vs. wildcard match pattern

A wildcard character is a special character that represents one or more other characters. The most commonly used wildcard characters are the asterisk (*), which typically represents zero or more characters in a string of characters, and the question mark (?), which typically represents any one character. In Perl regular expressions, the . character refers to any single character. It is similar to the ? character in wildcard match pattern. As a result: fortinet.com not only matches fortinet.com but also fortinetacom, fortinetbcom, fortinetccom, and so on.

To match a special character such as '.' and * use the escape character \. For example: To match fortinet.com, the regular expression should be: fortinet\.com In Perl regular expressions, * means match 0 or more times of the character before it, not 0 or more times of any character. For example: forti*.com matches fortiiii.com but does not match fortinet.com

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

485

Using Perl regular expressions

Antispam

To match any character 0 or more times, use .* where . means any character and the * means 0 or more times. For example, the wildcard match pattern forti*.com should therefore be fort.*\.com.

Word boundary
In Perl regular expressions, the pattern does not have an implicit word boundary. For example, the regular expression test not only matches the word test but also any word that contains test such as atest, mytest, testimony, atestb. The notation \b specifies the word boundary. To match exactly the word test, the expression should be \btest\b.

Case sensitivity
Regular expression pattern matching is case sensitive in the web and antispam filters. To make a word or phrase case insensitive, use the regular expression /i. For example, /bad language/i will block all instances of bad language, regardless of case.

Perl regular expression formats

Table 47 lists and describes some example Perl regular expression formats.
Table 47: Perl regular expression formats Expression abc ^abc abc$ a|b ^abc|abc$ ab{2,4}c ab{2,}c ab*c ab+c ab?c a.c a\.c [abc] [Aa]bc [abc]+ [^abc]+ \d\d /i \w+ Matches abc (the exact character sequence, but anywhere in the string) abc at the beginning of the string abc at the end of the string Either of a and b The string abc at the beginning or at the end of the string a followed by two, three or four bs followed by a c a followed by at least two bs followed by a c a followed by any number (zero or more) of bs followed by a c a followed by one or more b's followed by a c a followed by an optional b followed by a c; that is, either abc or ac a followed by any single character (not newline) followed by a c a.c exactly Any one of a, b and c Either of Abc and abc Any (nonempty) string of as, bs and cs (such as a, abba, acbabcacaa) Any (nonempty) string which does not contain any of a, b, and c (such as defg) Any two decimal digits, such as 42; same as \d{2} Makes the pattern case insensitive. For example, /bad language/i blocks any instance of bad language regardless of case. A word: A nonempty sequence of alphanumeric characters and low lines (underscores), such as foo and 12bar8 and foo_1

486

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Antispam

Using Perl regular expressions

Table 47: Perl regular expression formats (Continued) 100\s*mk abc\b perl\B \x The strings 100 and mk optionally separated by any amount of white space (spaces, tabs, newlines) abc when followed by a word boundary (for example, in abc! but not in abcd) perl when not followed by a word boundary (for example, in perlert but not in perl stuff) Tells the regular expression parser to ignore white space that is neither preceded by a backslash character nor within a character class. Use this to break up a regular expression into (slightly) more readable parts. Used to add regular expressions within other text. If the first character in a pattern is forward slash '/', the '/' is treated as the delimiter. The pattern must contain a second '/'. The pattern between / will be taken as a regular expressions, and anything after the second / will be parsed as a list of regular expression options ('i', 'x', etc). An error occurs If the second '/' is missing. In regular expressions, the leading and trailing space is treated as part of the regular expression.

/x

Example regular expressions To block any word in a phrase

/block|any|word/

To block purposely misspelled words

Spammers often insert other characters between the letters of a word to fool spam blocking software. /^.*v.*i.*a.*g.*r.*o.*$/i /cr[e][\+\\*=<>\.\,;!\?%&@\^\$\{\}()\[\]\|\\_01]dit/i

To block common spam phrases

The following phrases are some examples of common phrases found in spam messages. /try it for free/i /student loans/i /youre already approved/i /special[\+\\*=<>\.\,;!\?%&~#@\^\$\{\}()\[\]\|\\_1]offer/i

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

487

Using Perl regular expressions

Antispam

488

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

IM, P2P & VoIP

Overview

IM, P2P & VoIP

The IM, P2P & VoIP menu provides IM user management tools and statistics for network IM, P2P, and VoIP usage. IM/P2P/VoIP management settings are configured per firewall profile. IM, P2P, and VoIP protocols must be enabled in the active protection profile for the settings in this section to have any effect. FortiOS uses IPS signatures to detect IM/P2P/VoIP sessions. See the following sections for details. Overview Configuring IM/P2P/VoIP protocols Statistics User

Overview
Instant Messenger (IM), Peer to Peer (P2P), and Voice over Internet Protocol (VoIP) protocols are gaining in popularity as an essential way to communicate between two or more individuals in real time. Some companies even rely on IM protocols for critical business applications such as Customer/Technical Support. The most common IM protocols in use today include AOL Instant Messenger, Yahoo Instant Messenger, MSN messenger, and ICQ. Although these are the most popular ones, there are always new protocols being developed as well as newer versions of older ones. P2P protocols are most commonly used to transfer files from one user to another and can use large amounts of bandwidth. VoIP is increasingly being used by businesses to cut down on the cost of long distance voice communications. Some organizations need to control or limit the use of IM/P2P and VoIP protocols in order to more effectively manage bandwidth use. With FortiOS firmware, you can control and monitor the usage of IM/P2P applications and VoIP protocols. FortiOS supports two VoIP protocols: Session Initiation Protocol (SIP) and Skinny Client Control Protocol (SCCP). Fortinet Inc. recognizes that IM/P2P applications are becoming part of doing business but also, if abused, can seriously decrease productivity and network performance. FortiGate units allow you to set up user lists that either allow or block the use of applications, to determine which applications are allowed and how much bandwidth can be used by the applications.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

489

Overview

IM, P2P & VoIP

By combining comprehensive protection policies and easy-to-view statistical reports, you can see which applications are being used and for what purpose, making it easy to control IM/P2P applications and to maximize productivity. The FortiOS system comes with an impressive list of supported IM/P2P protocols and can be kept up-to-date with upgrades available for download from the Fortinet Distribution Network. There is no need to wait for firmware upgrade to stay ahead of the latest protocols. FortiOS also provides ways for you to deal with unknown protocols even before upgrades are available. For details, see Configuring IPS signatures for unsupported IM/P2P protocols on page 492. FortiOS uses IPS signatures to detect IM/P2P/VoIP sessions. Table 48 on page 490 lists the IM/P2P/VoIP applications that are currently recognized by FortiOS. The table includes the IPS signatures, the applications associated with the signatures, and the locations of the signatures
Note: Applications in Table 48 on page 490 marked as bold can connect to multiple P2P networks. Turning on IM and P2P signatures will help improve IPS performance. For example, if you want to use IPS, but you do not want to block IM or P2P applications, you should leave IM/P2P signatures enabled. Normally, if you turn off other signatures, the performance will be better, but for IM/P2P, it is the opposite. Table 48: IM/P2P applications covered by FortiOS 3.0 IPS Instant Messaging AIM (Firewall > Protection Profile > IM/P2P) ICQ (Firewall > Protection Profile > IM/P2P) MSN (Firewall > Protection Profile > IM/P2P) SIMPLE (Firewall > Protection Profile > IM/P2P) qq (Intrusion Protection > Signature > Predefined > qq) Yahoo! (Firewall > Protection Profile > IM/P2P) AIM, AIM Triton ICQ MSN Messenger SIMPLE QQ Yahoo Messenger Applications

msn_web_messenger (Intrusion Protection > Signature > MSN web Messenger Predefined > msn_web_messenger) google_talk (Intrusion Protection > Signature > Predefined > google_talk) rediff (Intrusion Protection > Signature > Predefined > rediff) P2P BitTorrent (Firewall > Protection Profile > IM/P2P) BitComet Bitspirit Azureus Shareaza eMule Overnet Edonkey2K Shareaza BearShare MLdonkey iMesh Google Instant Messenger Rediff Instant Messenger

eDonkey (Firewall > Protection Profile > IM/P2P)

490

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

IM, P2P & VoIP

Configuring IM/P2P/VoIP protocols

Table 48: IM/P2P applications covered by FortiOS 3.0 BearShare Shareaza LimeWire Xolox Swapper iMesh MLdonkey Gnucleus Morpheus Openext Mutella Qtella Qcquisition Acquisition NapShare gtk-gnutella KaZaA Skype WinNY Ares Galaxy

Gnutella (Firewall > Protection Profile > IM/P2P)

KaZaA (Firewall > Protection Profile > IM/P2P) Skype (Firewall > Protection Profile > IM/P2P) WinNY (Firewall > Protection Profile > IM/P2P) ares (Intrusion Protection > Signature > Predefined > Ares.Connect.Detection and Ares.Search.Detection) VoIP SIP (Firewall > Protection Profile > VoIP) SCCP (Firewall > Protection Profile > VoIP)

SIP SCCP

Configuring IM/P2P/VoIP protocols

There are several places and steps you can configure the IM/P2P/VoIP protocols. Go to Intrusion Protection > IPS Sensor to configure the IM/P2P/VoIP signatures. See Configuring IM/P2P/VoIP IPS signatures on page 491. Go to Intrusion Protection > Signature > Custom to create custom signatures for any unsupported protocols. See Configuring IPS signatures for unsupported IM/P2P protocols on page 492. Go to IM, P2P & VoIP > User > Config to configure IM settings for unknown users. See Configuring a policy for unknown IM users on page 497. Go to Firewall > Protection Profile to configure the IM/P2P/VoIP settings. See Configuring IM/P2P/VoIP options within a protection profile on page 492. Finally, go to Firewall > Policy to create policies to use all the settings. See Configuring firewall policies on page 285.

Configuring IM/P2P/VoIP IPS signatures

Since FortiOS uses IPS signatures to detect the IM/P2P/VoIP sessions, you can configure the IPS sensors and apply the sensors to the protections profiles to meet your requirements. Use the filters in the IPS sensor to find the relevant signatures you want to configure. See details, see Configuring IPS sensors on page 443.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

491

Configuring IM/P2P/VoIP protocols

IM, P2P & VoIP

Configuring IPS signatures for unsupported IM/P2P protocols

If you find a protocol that is not supported, ensure that the IPS package is up to date. If the IPS package is up to date and the protocol is still not supported, you can use the custom signature. To create a custom signature 1 2 3 4 Go to Intrusion Protection > Signature > Custom > Create New. Enter a name for the signature. Enter the signature. Select OK.
Note: To detect new IM/P2P applications or new versions of the existing

applications, you only need to update the IPS package, available through the FortiNet Distribution Network (FDN). No firmware upgrade is needed.

Configuring IM/P2P/VoIP options within a protection profile

There are several areas within a protection profile where you can configure the IM/P2P/VoIP settings. For more detailed information, see the Firewall Profile chapter of this guide and the IP, P2P and VoIP Technical Note.

Configuring older versions of IM/P2P applications

Some older versions of IM protocols are able to bypass file blocking because the message types are not recognized. Supported IM protocols include: MSN 6.0 and above ICQ 4.0 and above AIM 5.0 and above Yahoo 6.0 and above

If you want to block a protocol that is older than the ones listed above, use the CLI command: For details see the FortiOS CLI Reference. config imp2p old-version.

492

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

IM, P2P & VoIP

Statistics

Statistics
You can view the IM, P2P and VoIP statistics to gain insight into how the protocols are being used within the network. Overview statistics are provided for all supported IM, P2P and VoIP protocols. Detailed individual statistics are provided for each IM protocol.

Viewing overview statistics

The Summary tab provides a summary of statistics for all IM, P2P and VoIP protocols. To view IM/P2P statistics, go to IM/P2P&VoIP > Statistics > Summary.
Figure 316:IM, P2P and VoIP statistics summary

The Summary tab has the following icons and features:

Automatic Refresh Interval Refresh Reset Stats Users Select the automatic refresh interval for statistics. Set the interval from none to 30 seconds. Click to refresh the page with the latest statistics. Click to reset the statistics to zero. For each IM protocol, the following user information is listed: Current Users Chat (Users) Since Last Reset (Users) Blocked.

For each IM protocol, the following chat information is listed: Total Chat Sessions Total Messages. For each IM protocol, the following file transfer information is listed: (File transfers) Since Last Reset and (File transfers) Blocked. For each IM protocol, the following voice chat information is listed: (Voice chats) Since Last Reset (Voice chats) Blocked.

File Transfers

Voice Chat

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

493

Statistics

IM, P2P & VoIP

P2P Usage

For each P2P protocol, the following usage information is listed: Total Bytes transferred Average Bandwidth. When configuring the IM/P2P settings in a protection profile (see IM/P2P options on page 365), you can select Block, Pass, or Rate limit for the P2P protocols. If the action for a protocol is set to Block, the statistics will be zero. If the action for a protocol is set to pass, the statistics will display the total usage of the P2P application by all the firewall policies. If the action for a protocol is set to Rate Limit, the statistics will display the total P2P usage either by all policies or a protection profile, depending on whether your P2P rate limit settings are per policy or per profile. The bandwidth limit can be applied separately for each firewall policy that uses the protection profile, or shared by all firewall policies that use the protection profile. By default, the limit is applied separately to each firewall policy. For information on configuring per policy or per protection profile P2P bandwidth limiting, see P2P rate limiting option in the FortiGate CLI Reference.

VoIP Usage

For SIP and SCCP protocol, the following information is listed: Active Sessions (phones connected) Total calls (since last reset) Calls failed/Dropped Calls Succeeded

Viewing statistics by protocol

The protocol tab provides detailed statistics for individual IM protocols. To view protocol statistics, go to IM, P2P & VoIP > Statistics > Protocol. You can log IM chat information and the limitations placed on it, by enabling Archive full IM chat info to FortiAnalyzer in the protection profile.
Figure 317:IM statistics by Protocol

The IM/P2P Protocol tab has the following icons and features:

494

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

IM, P2P & VoIP

User

Automatic Refresh Interval Protocol Users Chat Messages File Transfers Voice Chat

Select the automatic refresh interval for statistics. Set the interval from none to 30 seconds. Select the protocol for which statistics are to be displayed: AIM, ICQ, MSN, or Yahoo. For the selected protocol, the following user information is displayed: Current Users, (Users) Since Last Reset, and (Users) Blocked. For the selected protocol, the following chat information is displayed: Total Chat Sessions, Server-based Chat, Group Chat, and Direct/Private Chat. For the selected protocol, the following message information is displayed: Total Messages, (Messages) Sent, and (Messages) Received. For the selected protocol, the following file transfer information is displayed: (File transfers) Since Last Reset, (File transfers) Sent, (File transfers) Received, and (File transfers) Blocked. For the selected protocol, the following voice chat information is displayed: (Voice chats) Since Last Reset and (Voice chats) Blocked.

User
After IM users connect through the firewall, the FortiGate unit displays which users are connected in the Current Users list. You can analyze the list and decide which users to allow or block. A policy can be configured to deal with unknown users.
Note: If virtual domains are enabled on the FortiGate unit, IM features are configured globally. To access these features, select Global Configuration on the main menu.

Viewing the Current Users list

The Current User list displays information about instant messaging users who are currently connected. The list can be filtered by protocol. To view current users, go to IM, P2P & VoIP > Users > Current User.
Figure 318:Current Users list

The Current Users list has the following features:

Protocol Protocol User Name Filter the list by selecting the protocol for which to display current users: AIM, ICQ, MSN, or Yahoo. All current users can also be displayed. The protocol being used. The name selected by the user when registering with an IM protocol. The same user name can be used for multiple IM protocols. Each user name/protocol pair appears separately in the list. The Address from which the user initiated the IM session. The last time the current user used the protocol. Select to add the user name to the permanent black list. Each user name/protocol pair must be explicitly blocked by the administrator.

Source IP Last Login Block

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

495

User

IM, P2P & VoIP

Viewing the User List

The User List displays information about users who have been allowed access to (white list) or have been blocked from (black list) instant messaging services. Users can be added using Create New or from the temporary users list. To view the User List, go to IM, P2P & VoIP > Users > User List.
Figure 319:User List

The user list has the following icons and features:

Create New Protocol Policy Protocol Username Select to add a new user to the list. Filter the list by selecting a protocol: AIM, ICQ, MSN, Yahoo, or All. Filter the list by selecting a policy: Allow, Deny, or All. The protocol associated with the user. The name selected by the user when registering with an IM protocol. The same user name can be used for multiple IM protocols. Each user name/protocol pair appears separately in the list. The policy applied to the user when attempting to use the protocol: Block or Deny. Change the following user information: Protocol, Username, and Policy. Permanently remove users from the User List.

Policy Edit icon Delete icon

Adding a new user to the User List

Add users to the User List to allow them to access instant messaging services or to block them from these services. Go to IM, P2P & VoIP > User > User List and select Create New.
Figure 320:Edit User

Protocol Username Policy

Select a protocol from the dropdown list: AIM, ICQ, MSN, or Yahoo! Enter a name for the user. Select a policy from the dropdown list: Allow or Block.

496

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

IM, P2P & VoIP

User

Configuring a policy for unknown IM users

The User Policy determines the action to be taken with unknown users. Unknown users can be either allowed to use some or all of the IM protocols and added to a white list, or blocked from using some or all of the IM protocols and added to a black list. You can later view the white and black lists and add the users to the user list. To configure the IM policy, go to IM, P2P & VoIP > User > Config.
Figure 321:IM User policy

Configure or view the following settings for the IM user policy:

Automatically Allow Automatically Block List of Temporary Users Select the protocols that unknown users are allowed to use. The unknown users are added to a temporary white list. Select the protocols to which unknown users are denied access. The unknown users are added to a temporary black list. New users who have been added to the temporary white or black lists. User information includes Protocol, Username, and the Policy applied to the user. Note: If the FortiGate unit is rebooted, the list is cleared. Select a protocol by which to filter the list of temporary users. The name selected by the user when registering with an IM protocol. The same user name can be used for multiple IM protocols. Each user name/protocol pair appears separately in the list. The policy applied to the user when attempting to use the protocol: Block or Deny. Select to add the user to the permanent white list. The user remains online and is listed in IM, P2P & VoIP > Users > User List. Select to add the user to the permanent black list. The user is listed in IM, P2P & VoIP > Users > User List. Click to apply the global user policy.

Protocol Username

Policy Permanently Allow Permanently Block Apply

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

497

User

IM, P2P & VoIP

498

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

FortiGate Logging

Log&Report
This section provides information on how to enable logging, viewing of log files and reports available through the web-based manager. FortiGate units provide extensive logging capabilities for traffic, system and network protection functions. Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues, reduce and prevent network misuse and abuse. The following topics are included in this section: FortiGate Logging FortiGuard Analysis and Management Service Log severity levels High Availability cluster logging Storing Logs Log types Accessing Logs Viewing log information Customizing the display of log messages Content Archive Alert Email Reports

Note: If the FortiGate unit is in Transparent mode, certain settings and options for logging may not be available because certain features do not support logging, or are not available in Transparent mode. For example, SSL VPN events are not available in Transparent mode. Logging and reporting features are available for most VDOMs; however before configuring logging and reporting features, make sure these features are accessible in the VDOM where you want to configure these features.

FortiGate Logging
A FortiGate unit can log many different network activities and traffic including: overall network traffic system-related events including system restarts, HA and VPN activity anti-virus infection and blocking web filtering, URL and HTTP content blocking signature and anomaly attack and prevention spam filtering Instant Messaging and Peer-to-Peer traffic VoIP telephone calls

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

499

FortiGuard Analysis and Management Service

Log&Report

You can customize the level that the FortiGate unit logs these events at as well as where the FortiGate unit stores the logs. The level these events are logged at, or the severity level, is defined when configuring the logging location. There are six severity levels to choose from. See Log severity levels on page 502 for more information. For better log storage and retrieval, the FortiGate unit can send log messages to a FortiAnalyzer unit. FortiAnalyzer units are network appliances that provide integrated log collection, analysis tools and data storage. Detailed log reports provide historical as well as current analysis of network and email activity. Detailed log reports also help identify security issues, reducing network misuse and abuse. The FortiGate unit can send all log message types, as well as quarantine files, to a FortiAnalyzer unit for storage. The FortiAnalyzer unit can upload log files to an FTP server for archival purposes. See Logging to a FortiAnalyzer unit on page 503 for details on configuring the FortiGate unit to send log messages to a FortiAnalyzer unit. If you have a subscription for the FortiGuard Analysis and Management Service, your FortiGate unit can send logs to a FortiGuard Analysis server. This service provides another way to store and view logs. See FortiGuard Analysis and Management Service on page 500 for more information. Fortinet recommends to review the FortiGuard Analysis and Management Service Administration Guide because it contains detailed information about logging and reporting, as well as registering and remotely managing FortiGate units from the FortiGuard Analysis and Management portal website. The FortiGate unit can send log messages to either a Syslog server or WebTrends server for storage and archival purposes. You can also configure the FortiGate unit to send log messages to its hard disk, if available and is only available in the CLI. See the FortiGate CLI Reference for configuring logging to the hard disk. The FortiGate unit enables you to view log messages available in memory, on a FortiAnalyzer unit running firmware version 3.0 or higher, or the hard disk if available. Customizable filters enable you to easily locate specific information within the log files. See the FortiGate Log Message Reference for details and descriptions of log messages and formats.

FortiGuard Analysis and Management Service

FortiGuard Analysis and Management Service is a subscription-based service that provides logging and reporting solutions for all FortiGate units. This service also provides remote management service. The FortiGuard Analysis and Management Service is available on all FortiGate units running FortiOS 3.0 MR6 and higher. The logging and reporting side of FortiGuard Analysis and Management Service is made up of two types of servers, the primary analysis server and the secondary analysis server. The primary analysis server stores logs generated from the FortiGate unit. The secondary analysis server provides redundancy, ensuring log data is available at all times. There are several secondary analysis servers available for redundancy for each FortiGate unit. The network also includes the main analysis server, which is responsible for monitoring and maintaining the primary and secondary analysis servers.

500

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

FortiGuard Analysis and Management Service

When the FortiGate unit connects for the first time to the logging and reporting network, where the FortiGate unit retrieves its assigned primary analysis server, contract term, and storage space quota from the main analysis server. The main analysis server contains this information so it can maintain and monitor the status of each of the servers. After configuring logging to the assigned primary analysis server, the FortiGate unit begins logging to that primary analysis server. The FortiGate unit sends encrypted logs to the primary analysis server using TCP port 514. The connection to the main analysis server is secured by SSL using port 443. The FortiGuard Analysis and Management Service Administration Guide contains detailed information about registering, remotely managing your FortiGate unit, as well as enabling and configuring logging and reporting. It is recommended to review this guide if you have subscribed to FortiGuard Analysis and Management Service, because of its detailed information about this subscription-based service.
Note: After upgrading, you need to re-enter your account ID and then update the service to re-connect to the servers that support logging and reporting. You may need to update the service from the portal website as well.

FortiGuard Analysis and Management Service portal website

The portal website provides a central location for managing your information about the FortiGate units and service account. The portal website also allows you to view logs and reports, including remote management services such as configuration back ups. You need a service account ID, username and password before entering the portal website. This is available when registering for the FortiGuard Analysis and Management Service on the Fortinet support website. After entering all appropriate information on the Fortinet support website, you can then log into the FortiGuard Analysis and Management Service portal website. See the FortiGuard Analysis and Management Service Administration Guide about registering, enabling and configuring FortiGuard Analysis and Management Services.
Note: The portal also includes remote management features. See System Maintenance on page 215 for more information about remotely managing your FortiGate unit using the FortiGuard Analysis and Management Service.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

501

Log severity levels

Log&Report

Log severity levels

You can define what severity level the FortiGate unit records logs at when configuring the logging location. The FortiGate unit logs all messages at and above the logging severity level you select. For example, if you select Error, the unit logs Error, Critical, Alert and Emergency level messages.
Table 49: Log severity levels Levels 0 - Emergency Description The system has become unstable. Generated by Event logs, specifically administrative events, can generate an emergency severity level. Attack logs are the only logs that generate an Alert severity level. Event, Antivirus, and Spam filter logs. Event and Spam filter logs. Event and Antivirus logs. Traffic and Web Filter logs. Content Archive, Event, and Spam filter logs.

1 - Alert 2 - Critical 3 - Error 4 - Warning 5 - Notification 6 - Information

Immediate action is required. Functionality is affected. An error condition exists and functionality could be affected. Functionality could be affected. Information about normal events. General information about system operations.

The Debug severity level, not shown in Table 49, is rarely used. It is the lowest log severity level and usually contains some firmware status information that is useful when the FortiGate unit is not functioning properly. Debug log messages are only generated if the log severity level is set to Debug. Debug log messages are generated by all types of FortiGate features.

High Availability cluster logging

When configuring logging with a High Availability (HA) cluster, configure the primary unit to send logs to a FortiAnalyzer unit or a Syslog server. The settings are applied to the subordinate units. The subordinate units send the log messages to the primary unit, and the primary unit sends all logs to the FortiAnalyzer unit or Syslog server. If you configured a secure connection via an IPSec VPN tunnel between a FortiAnalyzer unit and a HA cluster, the connection is between the FortiAnalyzer unit and the HA cluster primary unit. See the FortiGate High Availability User Guide for more information.

502

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Storing Logs

Storing Logs
The type and frequency of log messages you intend to save dictates the type of log storage to use. For example, if you want to log traffic and content logs, you need to configure the FortiGate unit to log to a FortiAnalyzer unit or Syslog server. The FortiGate system memory is unable to log traffic and content logs because of their frequency and large file size. Storing log messages to one or more locations, such as a FortiAnalyzer unit or Syslog server, may be a better solution for your logging requirements than the FortiGate system memory. Configuring your FortiGate unit to log to a FortiGuard Analysis server may also be a better log storage solution if you do not have a FortiAnalyzer unit and want to create reports. FortiGuard Analysis Service is available on all FortiGate units running FortiOS 3.0 MR6 and higher. See FortiGuard Analysis and Management Service on page 500 for more information. If your FortiGate unit has a hard disk, you can also enable logging to the hard disk from the CLI. See the FortiOS CLI Reference for more information before enabling logging to the hard disk. If you require logging to multiple FortiAnalyzer units or Syslog servers, see the FortiOS CLI Reference for more information.
Note: Daylight Saving Time (DST) is now extended by four weeks in the United States and Canada and may affect your location. It is recommended to verify if your location observes this change, since it affects the scope of the report. Fortinet has released supporting firmware. See the Fortinet Knowledge Center article, New Daylight Saving Time support, for more information.

Logging to a FortiAnalyzer unit

FortiAnalyzer units are network appliances that provide integrated log collection, analysis tools and data storage. Detailed log reports provide historical as well as current analysis of network and email activity to help identify security issues and reduce network misuse and abuse. You can configure the FortiGate unit to log up to three FortiAnalyzer units. The FortiGate unit sends logs to all three FortiAnalyzer units, where all the logs are stored on each of the FortiAnalyzer units. Logging to multiple FortiAnalyzer units provides real-time backup protection in the event one of the FortiAnalyzer units fails. You can configure logging to multiple FortiAnalyzer units only in the CLI. See FortiOS CLI Reference for more information.
Figure 322:Configuring a connection to the FortiAnalyzer unit

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

503

Storing Logs

Log&Report

To configure the FortiGate unit to send logs to the FortiAnalyzer unit 1 2 3 4 5 6 7 Go to Log&Report > Log Config > Log Setting. Select the blue arrow to expand Remote Logging options. Select FortiAnalyzer. Set the log severity level of the log messages. Select Static IP Address. Enter the static IP address of the FortiAnalyzer unit in the Static IP Address field. Select Apply. The FortiAnalyzer unit needs to be configured to receive logs from the FortiGate unit after configuring log settings on the FortiGate unit. Contact a FortiAnalyzer administrator to complete the rest of the configuration.
Note: You cannot configure logging to both a FortiAnalyzer unit and a FortiGuard Analysis server at the same time. If you require a backup solution, it is recommended to use other options other than a FortiGuard Analysis server when logging to a FortiAnalyzer unit and vice versa.

Connecting to FortiAnalyzer using Automatic Discovery

You can connect to a FortiAnalyzer unit by using the Automatic Discovery feature. Automatic discovery is a method of establishing a connection to a FortiAnalyzer unit and is enabled by default on the FortiGate unit. When you select Automatic Discovery, the FortiGate unit uses HELLO packets to locate any FortiAnalyzer units available on the network within the same subnet. When the FortiGate unit discovers the FortiAnalyzer unit, the FortiGate unit automatically enables logging to the FortiAnalyzer unit and begins sending log data, if logging is configured for traffic and so on, to the FortiAnalyzer unit. The Automatic Discovery feature is disabled by default on the FortiAnalyzer unit and must be enabled on the FortiAnalyzer unit to work properly. The FortiAnalyzer unit requires 3.0 firmware to use this feature. It is recommended to contact a FortiAnalyzer administrator to verify that the Automatic Discovery feature is enabled on the FortiAnalyzer unit before using this feature. To enable automatic discovery 1 2 3 4 5 6 Go to Log&Report > Log Config > Log Setting. Select the blue arrow to expand Remote Logging options. Select FortiAnalyzer. Select Automatic Discovery. Select a FortiAnalyzer unit from the Connect To drop-down list, if available. Select Discover. The FortiGate unit searches within the same subnet for a response from any available FortiAnalyzer units. 7 Select Apply.
Note: If your FortiGate unit is in Transparent mode, the interface using the automatic discovery feature will not carry traffic. Use the Fortinet Knowledge center article, Fortinet Discovery Protocol in Transparent mode, to enable the interface to also carry traffic when using the automatic discovery feature. FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

504

Log&Report

Storing Logs

Testing the FortiAnalyzer configuration

After configuring FortiAnalyzer settings, test the connection between the FortiGate unit and FortiAnalyzer unit to verify both devices are communicating properly. When testing the connection, specific settings for transmitting and receiving logs, reports, content archive and quarantine files display. The FortiGate unit must learn the IP address of the FortiAnalyzer unit before testing the connection. A false test report failure may occur if testing the connection before the FortiGate unit learns the IP address of the FortiAnalyzer unit. To test the connection 1 2 3 Go to Log&Report > Log Config > Log Setting. Select the blue arrow to expand Remote Logging options. Select Test Connectivity.
Figure 323:Test Connectivity with FortiAnalyzer

FortiAnalyzer (Hostname) FortiGate (Device ID) Registration Status Connection Status

The name of the FortiAnalyzer unit. The default name of a FortiAnalyzer unit is its product name, for example, FortiAnalyzer-400. The serial number of the FortiGate unit. The registration status of the FortiGate unit.

The connection status between FortiGate and FortiAnalyzer units. A green checkmark indicates there is a connection and a gray X indicates there is no connection. Disk Space (MB) Allocated The amount of space designated for logs. Space Used Space The amount of used space. Total Free The amount of unused space. Space Privileges Displays the permissions of the device for sending and viewing logs, content archives, quarantined logs, and reports. Tx indicates the FortiGate unit is configured to transmit log packets to the FortiAnalyzer unit. Rx indicates the FortiGate unit is allowed to view reports and logs stored on the FortiAnalyzer unit. A check mark indicates the FortiGate unit has permissions to send or view log information and reports. An X indicates the FortiGate unit is not allowed to send or view log information.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

505

Storing Logs

Log&Report

You can also test the connection status between the FortiGate unit and the FortiAnalyzer unit by using the following CLI command: execute log fortianalyzer test-connectivity The command displays the connection status and the amount of disk usage in percent. See the FortiGate CLI Reference for more information.
Note: The test connectivity feature also provides a warning when a FortiGate unit requires a higher-end FortiAnalyzer unit or when the maximum VDOMs/FortiGate units is reached on the FortiAnalyzer unit.

Logging to a FortiGuard Analysis server

You can configure logging to a FortiGuard Analysis server after registering for the FortiGuard Analysis and Management Service on the Fortinet support website. It is recommended to verify that the connection is working properly before configuring logging to a FortiGuard Analysis server. You can enable FortiGate features from the FortiGate web-based manager. See Log types on page 509 for more information. Traffic and summary content archiving is available for logging. Full content archiving will be available in future releases. To log to a FortiGuard Analysis server 1 2 3 4 5 Go to Log&Report > Log Config. Select the blue arrow to expand Remote Logging options. Select FortiGuard Analysis Service. Enter the account ID in the Account ID field. Select one of the following:
Overwrite oldest logs Do not log Select to delete the oldest log entry and continue logging when the maximum log disk space is reached. Select to stop log message going to the FortiGuard Analysis server when the maximum log disk space is reached.

6 7

Select a severity level. Select Apply.

Logging to memory
The FortiGate system memory has a limited capacity for log messages. The FortiGate system memory only displays the most recent log entries. Traffic and Content logs are not stored in system memory due to their size and frequency of log entries. When the memory is full, the FortiGate unit overwrites the oldest messages. All log entries are cleared when the FortiGate unit restarts. If your FortiGate unit has a hard disk, use the CLI to enable logging to the FortiGate hard disk. You can also upload logs stored on the hard disk to a FortiAnalyzer unit. See the FortiGate CLI Reference for more information. To configure the FortiGate unit to save logs in memory 1 2 Go to Log&Report > Log Config > Log Setting. Select Memory.

506

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Storing Logs

3 4

Select the blue arrow to expand the Memory options. Select a severity level. The FortiGate unit logs all messages at and above the logging severity level you select. For details on the logging levels, see Table 49, Log severity levels, on page 502.
Note: You can configure logging to an AMC disk and schedule log upload to a FortiAnalyzer unit; however, if system memory is enabled, logging to the AMC disk is disabled. It is recommended to verify that logging to system memory is disabled before configuring logging to the AMC disk. The AMC disk is available on FortiGate-3600A, FortiGate-3016B and FortiGate-3810A units.

Logging to a Syslog server

A Syslog server is a remote computer running Syslog software and is an industry standard for logging. Syslog is used to capture log information provided by network devices. The Syslog server is both a convenient and flexible logging device, since any computer can run syslog software, such as Linux, Unix, and intel-based Windows systems. When configuring logging to a Syslog server, you need to configure the facility and log file format, normal or Comma Separated Values (CSV). The CSV format contains commas whereas the normal format contains spaces. Configuring a facility easily identifies the device that recorded the log file.
Figure 324:Logging to a Syslog server

To configure the FortiGate unit to send logs to a syslog server

Note: If more than one Syslog server is configured, the Syslog servers and their settings display on the Log Settings page. Configuring multiple Syslog servers is done in the CLI. See the FortiGate CLI Reference for more information.

1 2 3 4

Go to Log&Report > Log Config > Log Setting. Select Syslog. Select the blue arrow to expand the Syslog options. Set the following syslog options:
Name/IP Port Minimum log level The domain name or IP address of the syslog server. The port number for communication with the syslog server, typically port 514. The FortiGate unit logs all messages at and above the logging severity level you select. For details on the logging levels, see Table 49, Log severity levels, on page 502.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

507

Storing Logs

Log&Report

Facility

Facility indicates to the syslog server the source of a log message. By default, FortiGate reports Facility as local7. You may want to change Facility to distinguish log messages from different FortiGate units. If you enable CSV format, the FortiGate unit produces the log in Comma Separated Value (CSV) format. If you do not enable CSV format the FortiGate unit produces plain text files.

Enable CSV Format

Select Apply.

Logging to WebTrends
WebTrends is a remote computer running a NetIQ WebTrends firewall reporting server. FortiGate log formats comply with WebTrends Enhanced Log Format (WELF) and are compatible with NetIQ WebTrends Security Reporting Center and Firewall Suite 4.1. Use the command line interface to configure the FortiGate unit to send log messages to WebTrends. After logging into the CLI, enter the following commands: config log webtrends setting set server <address_ipv4> set status {disable | enable} end
Keywords and variables server <address_ipv4> status {disable | enable} Description Enter the IP address of the WebTrends server that stores the logs. Enter enable to enable logging to a WebTrends server. Default No default. disable

Example
This example shows how to enable logging to a WebTrends server and to set an IP address for the server. config log webtrends setting set status enable set server 220.210.200.190 end See the Log chapter in the FortiOS CLI Reference for details on setting the options for the types of logs sent to WebTrends.

508

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Log types

Log types
The FortiGate unit provides a wide range of FortiGate features to log, enabling you to better monitor activity that is occurring on your network. For example, you can enable logging IM/P2P features, providing detailed information on the activity occurring on your network where IM/P2P programs are used. This topic also provides details on each log type and how to enable logging of the log type. Before enabling FortiGate features, you need to configure what type of logging device will store the logs. See Storing Logs on page 503 for more information.
Note: If the FortiGate unit is in Transparent mode, certain settings and options for logging may not be available because certain features do not support logging, or are not available in Transparent mode. For example, SSL VPN events are not available in Transparent mode.

Traffic log
The Traffic Log records all the traffic to and through the FortiGate interfaces. You can configure logging of traffic controlled by firewall policies and for traffic between any source and destination addresses. You can apply the following filters:
Allowed traffic Violation traffic The FortiGate unit logs all traffic that is allowed according to the firewall policy settings. The FortiGate unit logs all traffic that violates the firewall policy settings.

Traffic logging puts a significant system load on the FortiGate unit. It is recommended to log firewall policy traffic since this minimizes system load.
Note: You need to set the logging severity level to Notification when configuring a logging location to record traffic log messages. Traffic log messages generally have a severity level no higher than Notification. If VDOMs are enabled, make sure the VDOM you are currently in allows access for enabling traffic logs.

Enabling traffic logging

Traffic logging records any traffic to or from the interface or VLAN subinterface. You need to set the logging severity level to Notification or lower to record traffic logs. To enable traffic logging for an interface or VLAN subinterface 1 2 3 4 Go to System > Network > Interface. Select the Edit icon for an interface. Select Log. Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

509

Log types

Log&Report

Enabling firewall policy traffic logging

Firewall policy traffic logging records the traffic that is both permitted and denied by the firewall policy, based on the protection profile. Firewall policy traffic logging records packets that match the policy. This method of traffic logging is preferred because it reduces system load on the FortiGate unit. To enable firewall policy traffic logging 1 2 3 4 5 Go to Firewall > Policy. Select the blue arrow to expand the policy list for a policy. Select the Edit icon. If required, create a new firewall policy by selecting Create. Select Log Allowed Traffic. Select OK.

Event log
The Event Log records management and activity events. For example, when a configuration has changed, or VPN and High Availability (HA) events occur. To enable the event logs 1 2 Go to Log&Report > Log Config > Event Log. Select from the following logs:
System Activity event IPSec negotiation event DHCP service event L2TP/PPTP/PPPoE service event Admin event HA activity event Firewall authentication event Pattern update event SSL VPN user authentication event The FortiGate unit logs all system-related events, such as ping server failure and gateway status. The FortiGate unit logs all IPSec negotiation events, such as progress and error reports. The FortiGate unit logs all DHCP-events, such as the request and response log. The FortiGate unit logs all protocol-related events, such as manager and socket creation processes. The FortiGate unit logs all administrative events, such as user logins, resets, and configuration updates. The FortiGate unit logs all high availability events, such as link, member, and state information. The FortiGate unit logs all firewall-related events, such as user authentication. The FortiGate unit logs all pattern update events, such as antivirus and IPS pattern updates and update failures. The FortiGate unit logs all user authentication events for an SSL VPN connection, such as logging in, logging out and timeout due to inactivity.

SSL VPN The FortiGate unit logs all administrator events related to SSL administrator event VPN, such as SSL configuration and CA certificate loading and removal. SSL VPN session event The FortiGate unit logs all session activity such as application launches and blocks, timeouts, verifications and so on.

510

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Log types

VIP ssl event VIP server health monitor event

The FortiGate unit logs all server-load balancing events, informing you of what is happening with SSL sessions, especially details about handshaking. The FortiGate unit logs all related VIP server health monitor events that occur when the feature, VIP health monitor, is configured. For example, an interface goes down.

Select Apply.

Antivirus log
The Antivirus Log records virus incidents in Web, FTP, and email traffic. For example, when the FortiGate unit detects an infected file, blocks a file type, or blocks an oversized file or email that is logged, an antivirus log is recorded. You can apply the following filters:
Viruses Blocked Files Oversized Files/ Emails AV Monitor The FortiGate unit logs all virus infections. The FortiGate unit logs all instances of blocked files. The FortiGate unit logs all instances of files and email messages exceeding defined thresholds. The FortiGate unit logs all instances of viruses, blocked files, and oversized files and email. This applies to HTTP, FTP, IMAP, POP3, SMTP, and IM traffic.

To enable antivirus logs 1 2 3 4 5 Go to Firewall > Protection Profile. Select the Edit icon beside the protection profile to enable logging of antivirus events. Select the blue arrow to expand the Logging options. Select the antivirus events you want logged. Select OK.

Web filter log

The Web Filter Log records HTTP FortiGuard log rating errors including web content blocking actions. To enable web filter logs 1 2 3 4 5 6 Go to Firewall > Protection Profile. Select edit for a protection profile. Select the blue arrow to expand the Logging options. Select the web filtering events to log. Select the FortiGuard Web Filtering Log rating errors (HTTP only), to log FortiGuard filtering. Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

511

Log types

Log&Report

Attack log
The Attack Log records attacks detected and prevented by the FortiGate unit. The FortiGate unit logs the following:
Attack Signature Attack Anomaly The FortiGate unit logs all detected and prevented attacks based on the attack signature, and the action taken by the FortiGate unit. The FortiGate unit logs all detected and prevented attacks based on unknown or suspicious traffic patterns, and the action taken by the FortiGate unit.

To enable the attack logs 1 2 3 4 5 Go to Firewall > Protection Profile. Select edit for a protection profile. Select the blue arrow to expand the Logging options. Select Log Intrusions Select OK.
Note: Make sure attack signature and attack anomaly settings are enabled to log the attack. The logging options for the signatures included with the FortiGate unit are set by default. Ensure any custom signatures also have the logging option enabled. For details, see Intrusion Protection on page 435.

Spam filter log

The Spam Filter Log records blocking of email address patterns and content in SMTP, IMAP and POP3 traffic. To enable the Spam log 1 2 3 4 5 Go to Firewall > Protection Profile. Select edit for a protection profile. Select the blue arrow to expand the Logging options. Select the Log Spam. Select OK.

IM and P2P log

The Instant Message (IM) and Peer-to-Peer (P2P) log records instant message text, audio communications, and file transfers attempted by users. This type of log file also records the time a transmission was attempted, the type of IM application used, and the content of the transmission. To enable IM and P2P logs 1 2 3 4 5 6 Go to Firewall > Protection Profile. Select the Edit icon for a protection profile. Select the blue arrow to expand the Logging options. Select Log IM Activity Select Log P2P Activity Select OK.

512

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Accessing Logs

VoIP log
You can now log Voice over Internet Protocol (VoIP) calls. You can also configure VoIP rate limiting for Session Initiated Protocol (SIP) and Skinny Client Control Protocol (SCCP) or Skinny protocol. SIP and SCCP are two types of VoIP protocols. Rate limiting is generally different between SCCP and SIP. For SIP, rate limiting is for that SIP traffic flowing through the FortiGate unit. For SCCP, the call setup rate is between the FortiGate unit and the clients because the call manager normally resides on the opposite side of the FortiGate unit from the clients. To enable VoIP logs 1 2 3 4 5 Go to Firewall > Protection Profile. Select the Edit icon for a protection profile. Select the blue arrow to expand the Logging options. Select Log VoIP Activity. Select OK. To configure VoIP activity (rate limiting) 1 2 3 4 5 6 7 8 Go to Firewall > Protection Profile. Select the Edit icon for a protection profile. Select the blue arrow to expand the VoIP options. Select the SIP and SCCP checkboxes. Enter a number for requests per second in the Limit REGISTER request (requests/sec) (SIP only) field. Enter a number for requests per second in the Limit INVITE request (requests/sec) (SIP only) field Enter a number for the maximum calls per minute in the Limit Call Setup (calls/min) (SCCP only) field. Select OK.

Accessing Logs
The FortiGate unit enables you to view logs stored in memory, hard disk, stored on a FortiAnalyzer unit running FortiAnalyzer 3.0, or on the FortiGuard Analysis server. Logs are accessed in the Log Access menu. The Log Access menu provides tabs for viewing logs stored in system memory, hard disk, FortiGuard Analysis server, and on FortiAnalyzer unit. Each tab provides options for viewing log messages, such as search and filtering options, including selecting the log type you want to view. The Remote Logging tab displays logs stored on either the FortiGuard Analysis server or FortiAnalyzer unit. When accessing logs on a FortiAnalyzer unit, the FortiAnalyzer unit requires running firmware version 3.0 or higher for viewing logs from the FortiGate unit.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

513

Accessing Logs

Log&Report

Accessing log messages stored in memory

From the Log Access page, you can access logs stored in the FortiGate system memory. Traffic logs are not stored in memory because of the amount of space required to store them. To view log messages in the FortiGate memory buffer 1 2 3 Go to Log&Report > Log Access. Select the Memory tab. Select a log type from the Log Type list.

Accessing log message stored on the hard disk

You can access logs stored on the hard disk if your FortiGate unit has a hard disk. The logs are accessible the same way as when accessing logs stored on the FortiGate system memory. You can view, navigate, and download logs stored on the hard disk. To access log files on the hard disk 1 2 3 Go to Log & Report > Log Access. Select the Disk tab. Select a log type from the Log Type list.
Figure 325:Viewing log files stored on the FortiGate hard disk

Download icon Clear log icon View icon

Delete icon
Log Type Select the type of log you want to view. Some log files, such as the traffic log, cannot be stored to memory due to the volume of information logged. The name(s) of the log file(s) of that type stored on the FortiGate hard disk. When a log file reaches its maximum size, the FortiGate unit saves the log files with an incremental number, and starts a new log file with the same name. For example, the current attack log is alog.log. Any subsequent saved logs appear as alog.n, where n is the number of rolled logs. The size of the log file in bytes. The time a log message was recorded on the FortiGate unit. The time is in the format name of day month date hh:mm:ss yyyy, for example Fri Feb 16 12:30:54 2007. Select to clear the current log file. Clearing deletes only the current log messages of that log file. The log file is not deleted. Select to download the log file or rolled log file. Select either Download file in Normal format link or Download file in CSV format link. Select the Return link to return to the Disk tab page. Downloading the log file only includes current log messages.

File name

Size (bytes) Last access time Clear log icon Download icon

514

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Accessing Logs

View icon Delete icon

Display the log file through the web-based manager. Select to delete rolled logs. It is recommended to download the rolled log file before deleting it because the rolled log file cannot be retrieve after deleting it.

Accessing logs stored on the FortiAnalyzer unit

You can view and navigate through logs saved to the FortiAnalyzer unit. See Logging to a FortiAnalyzer unit on page 503 for information about configuring the FortiGate unit to send log files to the FortiAnalyzer unit. Logs accessed on a remote logging device such as the FortiAnalyzer unit, automatically display in the Remote tab. To access log files on the FortiAnalyzer unit 1 2 3 Go to Log&Report > Log Access. Select the Remote tab. Select a log type from the Log Type list.
Figure 326:Viewing log files stored on the FortiAnalyzer unit

Log Type

Select the type of log you want to view. Some log files, such as the traffic log, cannot be stored to memory due to the volume of information logged. Page Control Select from the various arrows to go to the next page, previous page, last or first page. You can also enter a number to view that page of log icons messages. For example, entering the number 5 displays the fifth page. For more information about page control, see Using page controls on web-based manager lists on page 49. Column Settings Select to add or remove columns. This changes what log information displays in Log Access. See Column settings on page 517 for more information. Raw Select to view the current log messages in their non-formatted format. By default, the FortiGate unit displays log messages in formatted format. Clear All Filters Select to clear all filter settings. See Filtering log messages on page 518 for more information. Note: The FortiAnalyzer unit must be running firmware version 3.0 or higher to view logs from the FortiGate unit.

Accessing logs stored on the FortiGuard Analysis server

Log files stored on the FortiGuard Analysis server can also be accessed from the FortiGate web-based manager. After enabling logging to the FortiGuard Analysis server, a FortiGuard tab appears in the Log Access menu. See the FortiGuard Analysis and Management Service Guide for more information about viewing real-time and historical log files as well. To access log files on the FortiGuard Analysis server 1 2 3 Go to Log&Report > Log Access. Select the Remote tab. Select a log type from the Log Type list.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

515

Viewing log information

Log&Report

Viewing log information

Log information displays in the Log Access menu. Each tab in the Log Access menu displays log information stored on the FortiAnalyzer unit, FortiGate system memory and hard disk if available, including the FortiGuard Analysis server. The FortiGuard tab enables you to view log messages stored on the FortiGuard Analysis server. The columns that appear reflect the content found in the log file. The top portion of the Log Access page includes navigational features to help you move through the log messages and locate specific information.
Figure 327:Viewing log messages

Log Type

Select the type of log you want to view. Some log files, such as the traffic log, cannot be stored to memory due to the volume of information logged. Select from the various arrows to go to the next page, previous page, last or first page. You can also enter a number to view that page of log messages. For example, entering the number 5 displays the fifth page. Select to add or remove log information columns to display.

Page Navigation

Column settings

Raw or Formatted Select Raw to switch to an unformatted log message display. Select Formatted to switch to a log message display organized into columns. Clear All Filters Select to remove applied filtering options for the log file.

Customizing the display of log messages

By customizing how log messages display, you can view certain parts or different formats of log messages. For example, log messages can be viewed in Formatted view or Raw view. When log messages display in Formatted view, you can customize the columns, or filter log messages. When log messages display in Raw view, the log message displays as it would in the log file.

516

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Customizing the display of log messages

Filtering is also another way to customize the display of log messages. By using the filter icon, you can display specific information of log messages. For example, you want to display only event log messages that have a severity level of alert. You can only customize columns and filter log messages in Formatted view.
Note: If you are filtering log messages, see Adding filters to web-based manager lists on page 46 for more information.

Column settings
Column Settings enables you to customize the view of log messages in Formatted view. By adding columns, changing the order of columns, or removing columns, you are able to view only the log information you want displayed. The Column Settings feature is only available when you are viewing logs in Formatted view.
Figure 328:Column settings for viewing log messages

To customize the columns 1 2 3 4 5 6 Go to Log&Report > Log Access. Select the tab to view logs from, Memory or Remote. Select a log type from the Log Type list. Select the View icon if you are viewing a log file on a FortiAnalyzer unit. Select the Column Settings icon. Select a column name and select one of the following to change the views of the log information:
-> <Move up Move down Select the right arrow to move selected fields from Available fields list to Show these fields in this order list. Select the left arrow to move selected fields from the Show these fields in this order list to the Available fields list. Move the selected field up one position in the Show these fields list. Move the selected field down one position in the Show these fields list.

Select OK.
Note: The Detailed Information column provides the entire raw log entry and is only needed if the log contains information not available in any of the other columns. The VDOM column displays which VDOM the log was recorded in.

uir

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

517

Customizing the display of log messages

Log&Report

Filtering log messages

You can filter log messages by removing, adding or moving columns using the Filter icon. By using the filter icon, you can display specific information of log messages.
Figure 329:Log filters

Column Filter

Filter icon

The filter settings that are applied remain until you log out of the web-based manager. Log filters automatically reset to default settings when you log into the web-based manager. To filter log messages 1 2 3 4 5 6 7 8 Go to Log&Report > Log Access. Select the tab to view logs from, Memory, Remote or Disk. Select a log type from the Log Type drop-down list. Select the Filter icon in the column to view logs. Select Enable to enable filtering for the column. Enter the appropriate information in the appropriate fields. Select OK. Select the columns to filter in the Filter list. You can also select the columns that display in the Filter list instead of selecting the actual column. You can view log messages in Raw format only after configuring the filters. If you want to delete all filter settings, select the Clear All Filters link that displays at the bottom of all filter setting dialog boxes.
Note: See Adding filters to web-based manager lists on page 46 for more information about using the filter icons to filter log messages.

518

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Content Archive

Content Archive
The Content Archive menu enables you to view archived logs stored on the FortiAnalyzer unit from the FortiGate web-based manager. The Content Archive menu allows you to view the content archives of HTTP, FTP, Email, IM, and VoIP ) that are stored on the FortiAnalyzer unit. The Content Archive menu also allows you to view content summaries of HTTP, FTP, Email, IM, and VoIP if you have subscribed to the FortiGuard Analysis and Management Service. Before viewing content archives, you need to enable this feature on your FortiGate unit. Content archiving is enabled within a protection profile. See Firewall Protection Profile on page 353 for more information about enabling content archiving in a protection profile. When configuring content archive for HTTP, HTTPS, FTP, ICQ, AIM, MSN, and Yahoo!, certain settings need to be enabled so that content archiving of these features works properly. For more information about configuring content archiving of these features, see Content archiving requirements and behavior on page 364. The FortiGate unit only allows one sixteenth of its memory for transferring content archive files. For example, for FortiGate units with 128RAM, only 8MB of memory is used when transferring content archive files. It is recommended not to enable full content archiving if antivirus scanning is also configured because of these memory constraints.
Note: NNTP options will be supported in future releases.

Configuring content archiving

Content archiving is configured and enabled in the Firewall menu. Content archiving is available when the FortiGate unit is configured to log to either a FortiAnalyzer unit or FortiGuard Analysis server. The FortiGuard Analysis and Management Service provides only content summary. If you are logging to the FortiGuard Analysis server, only None and Summary are available in the Archive to FortiAnalyzer/FortiGuard drop-down list. To enable content archiving for your FortiGate unit 1 2 3 4 5 6 7 Go to Firewall > Protection Profile. Select the Edit icon beside a protection profile. Select the blue triangle to expand the Content Archive option. Select the check boxes you require for Display content meta-information on the system dashboard. Select the available options in each drop-down list you require for Archive to FortiAnalyzer/FortiGuard. Select the check boxes for Archive SPAMed email to FortiAnalyzer, if required. Select OK.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

519

Content Archive

Log&Report

Viewing content archives

The Content Archive menu enables you to view all archived logs in the web-based manager. You can view either content archive logs stored on a FortiAnalyzer unit or FortiGuard Analysis server from the Content Archive menu. The FortiGuard Analysis server only stores content summary of logs. If you require to view logs in Raw format, select Raw beside the Column Settings icon. See Column settings on page 517 for more information about the Column Settings icon. Regardless of the remote logging device chosen, content archives are displayed if enabled in the protection profile for that remote logging device. For example, if FortiAnalyzer unit is configured to receive content archives, then only content archives from the FortiAnalyzer unit display in the Content Archive menu. To view content archives 1 2 Go to Log&Report > Content Archive. Select the tab of the archived log type to view. To view content summary logs from the FortiGuard Analysis server 1 2 3 Go to Log&Report > Content Archive. Select FortiGuard from Select Log Device. Select the tab of the content summary log type to view.

520

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Alert Email

Alert Email
The Alert Email feature enables the FortiGate unit to monitor logs for log messages, notifying by email of a specific activity or event logged. For example, if you require notification about administrator(s) logging in and out, you can configure an alert email that is sent whenever an administrator(s) logs in and out. This feature sends out an alert email based on the severity level logged as well.
Figure 330:Alert Email options

Configuring Alert Email

When configuring alert email, you must configure at least one DNS server. The FortiGate unit uses the SMTP server name to connect to the mail server, and must look up this name on your DNS server. To configure alert email 1 2 Go to Log&Report > Log Config > Alert E-mail. Set the following options and select Apply.
SMTP Server Email from Email To The name/address of the SMTP email server. The SMTP user name. Enter up to three email address recipients for the alert email message.

Authentication Select the Authentication Enable check box to enable SMTP authentication. Enable

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

521

Alert Email

Log&Report

SMTP user

Enter the user name for logging on to the SMTP server to send alert email messages. You only need to do this if you have enabled the SMTP authentication. Enter the password for logging on to the SMTP server to send alert email. You only need to do this if you selected SMTP authentication.

Password

3 4

Select Test Connectivity to send a test email message to the email account you configured in the above step. Select Send alert email for the following if you require sending an email based on one or all of the following:
Interval Time Intrusion detected Virus detected Web access blocked HA status changes Violation traffic detected Enter the number of minutes before an alert email is sent to the recipient. Select if you require an alert email message based on attempted intrusion detection. Select if you require an alert email message based on virus detection. Select if you require an alert email message based on blocked web sites that were accessed. Select if you require an alert email message based on HA status changes. Select if you require an alert email message based on violated traffic the FortiGate unit detects.

Firewall authentication Select if you require an alert email message based on firewall authentication. device SSL VPN login failure Administrator login/logout IPSec tunnel errors L2TP/PPTP/PPPoE errors Select if you require an alert email message based on any SSL VPN logins that failed. Select if you require an alert email message based on whether the administrator(s) logs in and logs out. Select if you require an alert email message based on whether there is an error in the IPSec tunnel configuration. Select if you require an alert email message based on errors that occurred in L2TP, PPTP, or PPPoE.

Configuration changes Select if you require an alert email message based on any changes made to the FortiGate configuration. FortiGuard license expiry time (in days) Enter the number of days for notification of the FortiGuard license expiry time.

Disk usage (in percent) Enter a number for the percentage of disk usage that an alert email will be sent. FortiGuard log disk quota Select if you require an alert email message based on the FortiGuard Analysis server log disk quota.

5 6 7

Select Send an alert based on severity if you require sending an alert email based on log severity level. Select the minimum severity level in the Minimum severity level list if you are sending an alert based on severity. Select Apply.
Note: The default minimum log severity level is Alert. If the FortiGate unit collects more than one log message before an interval is reached, the FortiGate unit combines the messages and sends out one alert email.

522

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Reports

Reports
The FortiAnalyzer reporting features are now more integrated with the FortiGate unit. From the Log&Report menu, you can configure a simple FortiAnalyzer report, view the report, and print the report. You can even view content archive logs stored on the FortiAnalyzer unit. You can configure basic traffic reports from the Log&Report menu. Basic traffic reports use the log information stored in your FortiGate memory to present basic traffic information in a graphical format.

Basic traffic reports

The FortiGate unit uses collected log information and presents it in graphical format to show network usage for a number of services. The charts show the bytes used for the service traffic. You can view logs from Log&Report > Report Access > Memory.
Figure 331:Viewing the Bandwidth Per Service graph

Time Period

Select a time range to view for the graphical analysis. You can choose from one day, three days, one week or one month. The default is one day. When you refresh your browser or go to a different menu, the settings revert to default. By default all services are selected. When you refresh your browser or go to a different menu, all services revert to default settings. Deselect the services you do not want to include in the graphical analysis. Browsing DNS Email FTP Gaming Instant Messaging Newsgroups P2P Streaming TFTP VoIP Generic TCP Generic UDP Generic ICMP Generic IP

Services

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

523

Reports

Log&Report

The report is not updated in real-time. You can refresh the report by selecting the Memory tab.
Note: The data used to present the graphs is stored in memory. When the FortiGate unit is reset or rebooted, the data is erased.

Configuring the graphical view

The FortiGate basic traffic report includes a wide range of services you can monitor. For example, you can view only email services for the last three days. To change the graphical information 1 2 3 4 Go to Log&Report > Report Access > Memory. Select the time period to include in the graph from the Time Period list. Deselect the services to not include in the graph. All services are selected by default. Select Apply. The graph refreshes and displays with the content you specified in the above procedure. The Top Protocols Ordered by Total Volume graph does not change.
Note: If you require a more specific and detailed report, configure a report from the FortiAnalyzer web-based manager or CLI. See Configuring a FortiAnalyzer report on page 524 if you require a simple FortiAnalyzer report. The FortiAnalyzer unit can generate over 140 different reports providing you with more options than the FortiGate unit provides.

FortiAnalyzer reports
You can configure a simple FortiAnalyzer report from FortiGate logs in the web-based manager or CLI. If you want to configure a report using the CLI interface, see the FortiOS CLI Reference for more information. See the FortiAnalyzer Administration Guide for details on how to add and configure additional report profiles.
Note: FortiAnalyzer reports do not appear if the FortiGate unit is not connected to a FortiAnalyzer unit, or if the FortiAnalyzer unit is not running firmware 3.0 or higher.

Configuring a FortiAnalyzer report

You can configure a FortiAnalyzer report from the Report Config menu. The Report Config menu also includes the CLI command, multi-report, enabling you to configure multiple FortiAnalyzer reports. The multi-report command is disabled by default. By default, only the default FortiAnalyzer report is available in the Report Config menu. The default FortiAnalyzer report is automatically configured by the FortiAnalyzer unit and is specific to your FortiGate unit. The report is also given a default name, for example, Default_100281021024. The default report name is taken from the FortiGate unit identification number. You can edit either scheduled reports or the default FortiAnalyzer report. See Editing FortiAnalyzer reports on page 532 to edit a scheduled report or the default FortiAnalyzer report.

524

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Reports

To configure the FortiAnalyzer report profile 1 2 Log into the CLI on the FortiGate unit. Enter the following commands: config log fortianalyzer setting set multi-report enable end 3 4 5 6 7 8 Log into the web-based manager. Go to Log&Report > Report Config. Enter a name for the report. Enter a title for the report. Enter a description of what the report includes, if required. Select the blue arrow next to the options you need to configure
:

Properties

Select to customize the header and footer and include the company name. See Configuring the report properties on page 525 for more information. Select the type of results to include in the report. See Configuring the report scope on page 525 for more information. Select the types of reports to include. See Configuring the report types on page 527 for more information. Select to resolve host names or rank reports using variables. See Configuring the report format on page 528 for more information. Select the file format for the reports. See Configuring the report output on page 529 for more information. Configure when the FortiAnalyzer unit runs the report, for example, weekly, or monthly. See Configuring the report schedule on page 530 for more information. Configure a customized layout of summarize categories. See Configuring the summary layout on page 531 for more information.

Report Scope Report Types Report Format Output Schedule

Summary Layout

Select OK.

Configuring the report properties

Enter your companys name, a header comment, and if applicable, choose a footer for the report. These are optional.
Figure 332:Report properties options

Configuring the report scope

Select the time period and/or log filters for the report. You can select different time periods, for example, if you want the report to include log files from July 31, 2005 to September 9, 2005.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

525

Reports

Log&Report

Figure 333:Report configuration time period

Time Period

Select the time period for the report. When you select last n hours, days or weeks, a field will appear. Enter a number in the field, for example, eight, for last 8 hours. Select to configure the start date of the report. For example, you may want to begin the report on May 5, 2005 at 13:00. The hours are in the 24-hour format. Select to configure the end date of the report.

From Date

To Date

Figure 334:Report configuration data log filter

Filter logs Include logs that match

Select None to not apply a filter to the logs in the report. Select Custom to apply filters to the log report. Select the matching criteria for the filter. Select all to include logs in the report that match all filter settings. If information within a log does not match all the criteria, the FortiAnalyzer unit will not include the log in the report. Select any to include logs in the report that match any of the filter settings. If any of the filter content, even one filter setting, matches information in a log file, the log the FortiAnalyzer unit includes the log in the report. Select the check box to enable the priority level filter options. Set the priority level to look for in the logs, and set whether the information should be less than, greater than or equal to the priority level. Enter the source IP address for the matching criteria. Use a comma to separate multiple sources. Select Not to exclude the source IP address from the report. For example, do not include any information from a specific source IP address in the log report.

Priority

Source(s)

526

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Reports

Destination(s)

Enter the destination IP address for the matching criteria. Use a comma to separate multiple sources. Select Not to exclude the destination IP address from the report. For example, do not include any information from a specific destination IP address in the log report. You can filter IP ranges, including subnets to report on groups within the company. For example: 172.20.110.0-255 filters all IP addresses in the 172.20.110.0/255.255.255.0 or 172.20.110.0/24 subnet 172.20.110.0-140.255 filters all IP addresses from 172.20.110.0 to 172.20.140.255 172.16.0.0-20.255.255 filters all IP addresses from 172.16.0.0 to 172.20.255.255)

Interface(s)

Enter the interface you want to include in the report. Separate multiple interface names with a comma. Select Not to exclude the interface information from the report. For example, do not include any information from a specific interface in the log report. Enter the user names to include in the report. Separate multiple user names with a comma. Enter the group names to include in the report. Separate multiple group names with a comma. Enter the virtual domains (VDOM) to include in the report. Separate multiple VDOMs with a comma. Select Not to exclude the VDOM from the report. For example, do not include any information from the root VDOM in the log report. Enter the firewall policy ID numbers to include in the report. The report will include the traffic information from the FortiGate firewall policies in the logs. Separate multiple policy IDs with a comma. Enter specific services to include in the report. Separate multiple services with a comma. Select Not to exclude the service from the report. For example, do not include any information from a specific service in the log report. Enter specific email messages you want the report to include from the email reports. Separate multiple messages with a comma. Select the days of the week that the information is pulled from the log files to include in the report.

Users Groups Virtual Domain(s)

Policy IDs

Service(s)

Messages Day of the Week

Configuring the report types

Select the type of information you want to include in the report: Select Basic to include the most common report types. Select All to include all report types. If data does not exist for a report type, that report will appear with the message No matching log data for this report. Select Custom to select the reports you want to include. Select the blue arrow to expand the report categories and select individual reports. Select None to not include any report types in the report.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

527

Reports

Log&Report

Configuring the report format

Select to resolve service names, host names or rank the top items for the report using variables.
Figure 335:Report configuration formats

Display category Select to display the category summary reports. summary reports Include reports Select to include reports that have no matching data. with no matching data Resolve Service Select to display network service names rather than port numbers. For example, HTTP rather than port 80. Names Resolve Host Names Obfuscate User (Group) Names Advanced Select to display host names by a recognizable name rather than IP addresses. For example, Sally_Accounting. For details on configuring IP address host names see the FortiAnalyzer Administration Guide. Select to include obscure user group names. Select to include the top ranked items for your report, summary information, and/or a table of contents. In 'Ranked Reports' show top For some report types, you can set the top ranked items for the report. These reports have Top in their name, and will always show only the top number of entries. For example, report on the most active mail clients within the organization rather than all mail clients. Reports that do not include Top in their name will always show all information. Changing the values for top field will not affect these reports. Select to include a roll up of the report contents, if required.

Include Summary Information

Include Table of Select to include a table of contents for your report. Contents Limit audit Select to include the top audit query results. The query results to audit activity displays a subset of event logs. Top [1-1000] Entries

528

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Reports

Configuring the report output

Select a destination and format(s) for the report. You can select from several different formats, including Text format. You can also select a different format for file output and email output. When configuring the FortiAnalyzer unit to email a report, you must configure the mail server on the FortiAnalyzer unit. See the FortiAnalyzer Administration Guide for more information or contact a FortiAnalyzer administrator.
Note: If you are emailing HTML reports to a user, and their email client does not support HTML, they will see the HTML code for each report in the message body. Figure 336:Report configuration output

File output Email output Email Subject Email attachment name Email body Email from Email server Email to Email list

Select the file format for the generated reports that are saved to the FortiAnalyzer hard disk. Select the file formats for the generated reports that the FortiAnalyzer unit sends as an email attachment. Enter to customize the subject line of the email. Enter the name of the attachment sent in the email. Enter the body of the email message. Enter the senders email address. Select an email server from the drop-down list. Enter the recipients email address. Enter the email addresses of the recipients of the report. Add multiple recipients by selecting Add. Select Delete if you want to delete a recipient in the list.

Upload Report to FTP Select to upload completed report files to an FTP server. Server Server Type IP address Username Select the type of server to upload the report to. You can select to upload the report to an FTP server, SFTP server, or SCP server. Enter the IP address of the FTP server. Enter the user name to log onto the FTP server.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

529

Reports

Log&Report

Password Upload report(s) in gzipped format Delete file(s) after uploading

Enter the password to log onto the FTP server. Select to compress the report files as gzip files before uploading to the FTP server. Select to delete the report files from the FortiAnalyzer hard disk after the FortiAnalyzer unit completes the upload to the FTP server.

Configuring the report schedule

Set a schedule for when the FortiAnalyzer unit generates the reports. Choose a recurring schedule, for example, to generate weekly reports on mail traffic.
Figure 337:Report configuration schedule

Schedule Select to set a schedule when the FortiAnalyzer report generates. Not Scheduled Daily These Dates Time Select to not generate a daily report. Use this setting when you want to run the report as needed. Select to generate the report every day at the same time. Select specific days of the month to generate the report. For example, to generate the report on the first and fifteenth of every month, enter 1,15. Select the time of the day when the FortiAnalyzer generates the report.

These Days Select specific days of the week to generate the report.

Select the time of day when the FortiAnalyzer generates the report. Time

530

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Reports

Configuring the summary layout

Select Customize List to configure a customized layout of charts from the specified categories.
Figure 338:An example of a customized summary layout for a report

Customize Select the number of columns, charts to add to the layout, and edit or remove the charts. Chart Columns Select a number from the drop-down list to specify how many columns to include in the chart. You can choose only one column or up to four columns. The default is 2.

Available Select to add the different types of charts to your Charts to Add summary layout. You can edit or delete each chart individually, if required. There are 25 different types of charts to choose from. Edit icon Select to edit each individual chart. You can edit the style of the chart or the TopN number. Select OK to save your changes. Chart Name The name of the chart. Chart Style Select the style of the chart. You can choose from line, pie, and column. The default is pie. TopN X icon Enter a number for the Top number of that particular item.

Removes the chart from the layout.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

531

Reports

Log&Report

Viewing FortiAnalyzer reports from a FortiGate unit

The FortiAnalyzer unit can generate a number of specific reports for a FortiGate unit, and run these reports at scheduled times, or on demand. If you are using a FortiGate unit with FortiOS 3.0 MR2 or higher, you can view any report generated from the FortiAnalyzer unit for that FortiGate unit on the Report Access page. To view FortiAnalyzer reports 1 2 3 Go to Log&Report > Report Access > FortiAnalyzer. Select Historical Reports. Select the report name to view the report.
Note: The FortiAnalyzer report that appears on the FortiAnalyzer page may not be the report you want to view. Always select Historical Reports to find the report you want to view.

Viewing parts of a FortiAnalyzer report

You can view different parts of a FortiAnalyzer report in the FortiGate web-based manager. The following procedure enables you to view the Mail Activity section of a report. To view Mail Filter Activity in a report 1 2 3 4 Go to Log&Report > Report Access > FortiAnalyzer. Select Historical Reports. Select the blue arrow to expand the report. Select MailFilter Activity.html. Use the above procedure for viewing other sections of a report. For example, select Content Activity.html instead of selecting MailFilter Activity.html.

Editing FortiAnalyzer reports

After a scheduled FortiAnalyzer report is configured and generated, you can then edit the report from the Report Config menu in the FortiGate web-based manager. The FortiAnalyzer tab enables you to edit the report, and view information about other scheduled FortiAnalyzer reports. You can view and edit scheduled reports from the FortiAnalyzer tab. You can also edit the default FortiAnalyzer report that the FortiAnalyzer unit automatically generates for your FortiGate unit. After enabling the multi-report command from the CLI, the FortiAnalyzer page displays if there is a report currently being generated by the FortiAnalyzer unit, when the next scheduled report will be generated, and if the Report Engine is active or inactive. To edit a scheduled or default FortiAnalyzer report 1 2 3 4 Go to Log&Report > Report Config > FortiAnalyzer. Select the Edit icon beside a report if you are not editing the default FortiAnalyzer report. Edit the settings you want for the scheduled report. Select OK.

532

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Log&Report

Reports

Printing your FortiAnalyzer report

After the FortiAnalyzer unit generates the report, you may want to print the report to have as a hardcopy reference or for a presentation. You can print your report(s) from the web-based manager in the Report Access menu. To print a FortiAnalyzer report 1 2 3 4 Go to Log&Report > Report Access > FortiAnalyzer. Select Historical Reports. In the list of FortiAnalyzer reports, select the report you want to print. Select Print.
Note: Make sure to check the Report Title of the report displayed on the FortiAnalyzer page before printing.

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

533

Reports

Log&Report

534

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Index

Index
Numerics
802.3ad aggregate interface creating 101

A
accept action firewall policy 288 accessing logs stored in hard disk 514 action firewall policy 284 protection profile P2P option 365 Spam filter banned word 478 Spam filter IP address 481 action type Spam filter email address 483 active sessions HA statistics 158 ActiveX filter protection profile 358 add signature to outgoing email protection profile 357 address firewall address group 306 list 304 address group 306 adding 307 create new 306 list 306 Address Name firewall address 306 administrative access interface settings 99, 108, 112 monitoring logins 202 administrative distance 246 administrator account netmask 192, 193 trusted host 193 administrators, monitoring 202 ADSL 100 Advanced Mezzanine Card (AMC) 60 adware grayware category 433 age limit quarantine 431 aggregate interface creating 101 AH, predefined service 311 alert email options 521 alert mail messages 173 Alert Message Console clearing messages 62 allow inbound FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

IPSEC firewall policy 295 allow outbound IPSEC firewall policy 295 allow web sites when a rating error occurs protection profile 360 allowed web category report 471 AMC module 95 amount, comfort clients protection profile 357 antispam port 53 231 port 8888 231 antivirus 421 adware grayware 433 av_failopen 434 BHO grayware 433 CLI configuration 434 configure antivirus heuristic 434 dial grayware 433 download grayware 433 file block 424 file block list 426 game grayware 433 grayware 233, 432 heuristics 434 hijacker grayware 433 joke grayware 433 keylog grayware 433 misc grayware 433 NMT grayware 433 optimize 434 P2P grayware 433 plugin grayware 434 quarantine 427 quarantine files list 428 RAT grayware 434 scanning large files 434 splice 356 spy grayware 434 streaming mode 356 system global av_failopen 434 system global optimize 434 toolbar grayware 434 view virus list 431 virus list 431 antivirus options protection profile 356 antivirus updates 234 through a proxy server 234 ANY service 311 AOL service 311 append to

535

Index

protection profile 363 append with protection profile 363 archive content meta-information protection profile 364 area border router (ABR) 262 area border routers 267 ARP 328 proxy ARP 328 AS OSPF 262 attack updates scheduling 234 through a proxy server 234 Authentication IPSec VPN, phase 2 379 authentication firewall policy 289, 290 RIP 262 Authentication Algorithm IPSec VPN, manual key 381, 383 Authentication Key IPSec VPN, manual key 383 Authentication Method IPSec VPN, phase 1 373 Auto Key list IPSec VPN 371 Autokey Keep Alive IPSec VPN, phase 2 379 Autonomous System (AS) 270 autonomous system (AS) 262 AutoSubmit quarantine 431 autosubmit list configuring 430 enabling uploading 430 quarantine files 429 av_failopen antivirus 434

list 477 pattern 478 pattern type 478 where 478 banned word check protection profile 362 beacon interval wireless setting 137, 141 BGP AS 270 flap 271 graceful restart 271 MED 271 RFC 1771 270 service 311 stabilizing the network 271 BHO grayware category 433 blackhole routing 109, 248 blades chassis monitoring 240 block audio (IM) protection profile 365 block file transfers (IM) protection profile 365 block login (IM) protection profile 365 blocked web category report 471 bookmark online help icon 42 Boot Strap Router (BSR) 272 BOOTP 148 browsing log information 516

C
catalog banned word 476 content block 454 content exempt 457 email address back/white list 481 file pattern 425 IP address black/white list 479 URL filter 459 category protection profile 360 web category report 471 category block configuration options 464 reports 470 central management 198 Certificate Name IPSec VPN, phase 1 373 channel wireless setting 136 channel, wireless setting FortiWiFi-60 140 chassis monitoring 239 blades 240 example temperature displays 241 example voltage displays 242

B
back to HA monitor HA statistics 157 backup (redundant) mode modem 113 backup and restore, system maintenance 217 backup mode modem 116 band wireless setting 136 bandwidth guaranteed 295 maximum 295 banned word adding words to the Spam filter banned word list 478 catalog 476 web content block 456, 458 banned word (Spam filter) action 478 language 478

536

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Index

FortiGate-5000 modules 240 SMC 239 temperature 241 voltage 241 CIDR 303 CLI configuration antivirus 434 web category block 470 cluster member 155 cluster members list 156 priority 156 role 156 cluster unit connect to a cluster 159 disconnect from a cluster 159 code 315 column settings 517 configuring 50 used with filters 51 comfort clients protection profile 357 comments firewall policy 289 on documentation, sending 37 concentrator IPSec VPN, policy-based 384 Concentrator Name IPSec VPN, concentrator 384 concentrator options IPSec VPN, concentrator 384 concentrator, equivalent for route-based VPN 370 concentrator, IPSec tunnel mode 384 config antivirus heuristic CLI command 434 connect to server 101 contact information SNMP 160 content archive options full 363 metadata 363 protection profile 363 summary 363 content block catalog 454 web filter 454 content exempt catalog 457 content streams, replacement messages 172 contents online help icon 42 cookie filter protection profile 358 CPU usage HA statistics 158 Create New firewall policy 283, 442 custom service adding 314 adding a TCP or UDP custom service 314 list 314 custom signature intrusion protection 439 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

customer service 37

D
dashboard 39, 55 data encryption wireless setting 138 date quarantine files list 428 DC quarantine files list 429 DCE-RPC firewall service 311 Dead Peer Detection IPSec VPN, phase 1 377 default gateway 250 delete after upload report 530 denial of service (DoS) sensor 363 deny action firewall policy 288 Designated Routers (DR) 272 dest firewall policy 284 destination firewall policy 287 destination network address translation virtual IPs 288, 325, 326 destination port 315 destination port, custom services 315 device priority HA 153 subordinate unit 158 DH Group IPSec VPN, phase 1 376 IPSec VPN, phase 2 379 DHCP and IP Pools 288 service 311 DHCP-IPSec IPSec VPN, phase 2 379 diagram topology viewer 76 dial grayware category 433 dialup VPN monitor 385 differentiated services firewall policy 297 differentiated services code point 297 DiffServ firewall policy 297 disk space quarantine 431 display content meta-information on dashboard protection profile option 364 DNAT virtual IPs 288, 325, 326 DNS service 311 documentation commenting on 37

537

Index

Fortinet 36 domain name 304 DoS sensor 446 list 447 download grayware category 433 quarantine files list 429 DSCP 297 duplicates quarantine files list 429 Dynamic DNS IPSec VPN, phase 1 373 monitor 385 on network interface 107 VPN IPSec monitor 385 Dynamic Host Configuration Protocol (DHCP) 100 dynamic IP pool NAT option firewall policy 288 dynamic routing 257 OSPF 262 PIM 272

external interface virtual IP 328 external IP address virtual IP 328 external service port virtual IP 329

F
fail open 450 FDN FortiGuard Distribution Network 226 HTTPS 233 override server 230 port 443 233 port 53 231 port 8888 231 port forwarding connection 235 proxy server 234 push update 230 troubleshooting 233 FDN, attack updates 179 FDS FortiGuard Distribution Server 226 file block antivirus 424 default list of patterns 424 list, antivirus 426 protection profile 356 file name quarantine files list 428 file pattern catalog 425 quarantine autosubmit list 429 filter filtering information on web-based manager lists 46 quarantine files list 428 used with column settings 51 web-based manager lists 46 FINGER service 311 firewall 281, 303, 309, 319, 323, 353 address list 304 configuring 281, 303, 309, 319, 323, 353 custom service list 314 one-time schedule 319 overview 281, 303, 309, 319, 323, 353 policy list 283 policy matching 281 predefined services 309 recurring schedule 320 virtual IP list 327 firewall address adding 305 address group 306 address name 306 create new 305 IP range/subnet 306 list 304 name 305 subnet 306 firewall address group adding 307

E
ECMP 248 email online help icon 42 email address action type 483 adding to the email address list 483 back/white list catalog 481 BWL check, protection profile 362 list, Spam filter 482 pattern type 483 email blocked as spam 173 Enable category block (HTTP only) protection profile 359 Enable FortiGuard Web Filtering overrides protection profile 360 Enable perfect forward secrecy (PFS) IPSec VPN, phase 2 379 Enable replay detection IPSec VPN, phase 2 379 enable session pickup HA 154 Encryption IPSec VPN, phase 2 378 Encryption Algorithm IPSec VPN, manual key 381, 383 Encryption Key IPSec VPN, manual key 383 end IP IP pool 348 Equal Cost Multipath (ECMP) 248 ESP service 311 Ethernet over ATM (EoA) 100 exclude range adding to DHCP server 149 expire system status 73 Expired 229

538

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Index

available addresses 307 group name 307 members 307 firewall IP pool list 348 firewall IP pool options 349 firewall policy accept action 288 action 284 adding 285 adding a protection profile 367 allow inbound 295 allow outbound 295 authentication 289, 290 changing the position in the policy list 284 comments 289 configuring 285 create new 283, 442 deleting 284 deny action 288 dest 284 destination 287 differentiated services 297 DiffServ 297 dynamic IP pool NAT option 288 fixed port NAT option 288 guaranteed bandwidth 295 ID 284 inbound NAT 295 insert policy before 284 IPSec action 288 log traffic 288, 289 maximum bandwidth 295 modem 117 move to 284 moving 284 outbound NAT 295 protection profile 288 schedule 284, 287 service 284, 287 source 284, 286 traffic priority 295 traffic shaping 289, 292 firewall protection profile default protection profiles 354 list 354 options 355 firewall service AH 311 ANY 311 AOL 311 BGP 311 DCE-RPC 311 DHCP 311 DNS 311 ESP 311 FINGER 311 FTP 311 FTP_GET 311 FTP_PUT 311 GOPHER 311 GRE 311 H323 311 HTTP 311 HTTPS 311 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

ICMP_ANY 312 IKE 312 IMAP 312 INFO_ADRESS 312 INFO_REQUEST 312 Internet-Locator-Service 312 IRC 312 L2TP 312 LDAP 312 MGCP 312 NetMeeting 312 NFS 312 NNTP 312 NTP 312 OSPF 312 PC-Anywhere 312 PING 312 PING6 312 POP3 312 PPTP 312 QUAKE 313 RAUDIO 313 REXEC 313 RIP 313 RLOGIN 313 RSH 313 SAMBA 313 SCCP 313 SIP 313 SIP-MSNmessenger 313 SMTP 313 SNMP 313 SSH 313 SYSLOG 313 TALK 313 TCP 313 TELNET 313 TFTP 313 TIMESTAMP 313 UDP 313 UUCP 313 VDOLIVE 313 WAIS 314 WINFRAME 314 X-WINDOWS 314 firmware upgrading to a new version 69 fixed port firewall policy NAT option 288 IP pool 347 FortiAnalyzer 31, 82, 503 accessing logs 515 configuring reports 524 editing reports 532 logging to 503 printing reports 533 reports, viewing 532 viewing parts of reports 532 FortiBridge 31 FortiClient 31, 216 FortiGate 4000 95 FortiGate 5001 164 FortiGate documentation commenting on 37

539

Index

FortiGate logging 499 FortiGate proxy 365 FortiGate SNMP event 162 FortiGate traps 163 FortiGate unit registering 40 FortiGate-224B 27 FortiGate-5000 chassis monitoring 239 FortiGate-5001FA2 introduction 22 FortiGate-5001SX introduction 22 FortiGate-5002FB2 introduction 22 FortiGate-5020 chassis 22 FortiGate-5050 chassis 21 FortiGate-5140 chassis 21 FortiGate-ASM-FB4 95 FortiGuard 31 changing the host name 470 CLI configuration 470 configuration options 464 report allowed 471 report blocked 471 report category 471 report profiles 471 report range 471 report type 471 reports 470 FortiGuard Analysis Service 500 FortiGuard Analysis Services accessing logs on FortiGuard Analysis server 515 FortiGuard Antispam email checksum check 362 IP address check 361 spam submission 362 URL check 362 FortiGuard Distribution Network 226 FortiGuard Distribution Network (FDN) 58 FortiGuard Distribution Server 226 FortiGuard management services remote management options 220 FortiGuard Services antispam service 227 configuring antispam service 227 configuring updates for FDN and services 228 configuring web filter service 227 FortiGuard management and analysis services 227 licenses 227 management and analysis service options 232 support contract 228 web filtering 227 web filtering and antispam options 231 FortiGuard services 226 FortiMail 31 FortiManager 31 FortiManager management services revision control 225

Fortinet Analysis Service portal website 501 Fortinet customer service 37 Fortinet documentation 36 Fortinet Family Products 31 Fortinet Knowledge Center 37 Fortinet MIB 163, 166 FortiReporter 31 FortiWiFi-50B wireless settings 136 FortiWiFi-60A wireless settings 136 FortiWiFi-60AM wireless settings 136 FortiWiFi-60B wireless settings 136 fragmentation threshold wireless setting 139, 141 from IP system status 72 from port system status 72, 119 FTP service 311 FTP_GET service 311 FTP_PUT service 311 fully qualified domain name (FQDN) 304

G
game grayware category 433 geography wireless setting 136, 140 GOPHER service 311 graceful restart 271 grayware 233 adware 433 antivirus 432 BHO 433 dial 433 download 433 game 433 hijacker 433 joke 433 keylog 433 misc 433 NMT 433 P2P 433 plugin 434 RAT 434 spy 434 toolbar 434 GRE 262 service 311 group name HA 154 grouping services 316 groups user 409 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

540

Index

guaranteed bandwidth firewall policy 295 traffic shaping 295

H
H323 service 311 HA 151, 156 changing cluster unit host names 156 cluster logging 502 cluster member 156 cluster members list 155 configuration 151 connect a cluster unit 159 device priority 153 disconnect a cluster unit 159 enable session pickup 154 group name 154 heartbeat interface 154 host name 156 interface monitoring 154 mode 153 out of band management 95 password 154 port monitor 154 router monitor 278 routes 278 session pickup 154 subordinate unit device priority 158 subordinate unit host name 158 VDOM partitioning 154 viewing HA statistics 157 HA statistics active sessions 158 back to HA monitor 157 CPU usage 158 intrusion detected 158 memory usage 158 monitor 157 network utilization 158 refresh every 157 status 157 total bytes 158 total packets 158 unit 157 up time 157 virus detected 158 heartbeat, HA interface 154 HELO DNS lookup protection profile 362 help navigate using keyboard shortcuts 43 searching the online help 42 heuristics antivirus 434 quarantine 434 high availability See HA 151 hijacker grayware category 433 host name changing for a cluster 156 hostname FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

cluster members list 156 HTTP 345 service 311 virus scanning large files 434 HTTPS 39, 179 service 311

I
ICMP custom service 315 code 315 protocol type 315 type 315 ICMP echo request 345 ICMP_ANY service 312 ID firewall policy 284 IEEE 802.11a, channels 134 IEEE 802.11b, channels 135 IEEE 802.11g, channels 135 IEEE standard 802.3ad 101 IKE service 312 IMAP service 312 inbound NAT IPSEC firewall policy 295 index online help icon 42 INFO_ADDRESS service 312 INFO_REQUEST service 312 insert policy before firewall policy 284 inspect non-standard port (IM) protection profile 365 interface administrative access 99, 108, 112 administrative status 95 IP pool 349 loopback 95, 248 MTU 100 proxy ARP 328 software switch 98 wireless 133 WLAN 133 Interface Mode 97 interface monitoring HA 154 internet browsing IPSec VPN configuration 380 Internet-Locator-Service service 312 interval, comfort clients protection profile 357 introduction Fortinet documentation 36 intrusion detected HA statistics 158 Intrusion protection

541

Index

DoS sensor, protection profile 363 IPS sensor, protection profile 363 intrusion protection custom signatures 439 DoS sensor 446 DoS sensor list 447 IPS sensor list 442 predefined signature list 437 protection profile options 363 protocol decoder 440 protocol decoder list 440 signature 437 IP virtual IP 327 IP address Action, Antispam 481 antispam black/white list catalog 479 BWL check, protection profile 362 IPSec VPN, phase 1 373 list, Spam filter 480 Spam filter 479 IP custom service 316 protocol number 316 protocol type 316 IP over ATM (IPoA) 100 IP pool 288 adding 349 configuring 349 create new 348 DHCP 288 end IP 348 fixed port 347 interface 349 IP range/subnet 349, 350 list 348 name 349, 350 options 349 PPPoE 288 proxy ARP 328 start IP 348 IP range/subnet firewall address 306 IP pool 349, 350 IPS see intrusion protection IPS sensor list 442 options, protection profile 363 IPSec 262 IPSec action firewall policy 288 ipsec firewall policy allow inbound 295 allow outbound 295 inbound NAT 295 outbound NAT 295 IPSec Interface Mode IPSec VPN, manual key 383 IPSec VPN, phase 1 375 IPSec VPN authentication for user group 409 Auto Key 371 monitor 385

remote gateway 409 IPv6 203, 248 IRC service 312 ISP 100

J
java applet filter protection profile 358 joke grayware category 433

K
Keepalive Frequency IPSec VPN, phase 1 377 key wireless setting 138, 140 keyboard shortcut online help 43 Keylife IPSec VPN, phase 1 376 IPSec VPN, phase 2 379 keylog grayware category 433

L
L2TP 409 service 312 language Spam filter banned word 478 web content block 456, 458 web-based manager 202 LDAP service 312 license key 238 limit (P2P) protection profile 365 lists web-based manager 45 Local certificate list 205 options 207 Local Gateway IP IPSec VPN, phase 1 375 Local ID IPSec VPN, phase 1 376 Local Interface IPSec VPN, manual key 383 IPSec VPN, phase 1 373 Local SPI IPSec VPN, manual key 382 log attack anomaly 512 attack signature 512 column settings 517 messages 516 to FortiAnalyzer 503 traffic, firewall policy 288 log traffic firewall policy 289 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

542

Index

log types 509 antivirus 511 attack 512 event 510 IM, P2P 512 spam filter 512 traffic 509 VOIP 513 web filter 511 logging 514 accessing logs 513 accessing logs in memory 514 accessing logs on FortiAnalyzer unit 515 accessing logs on FortiGuard Analysis server 515 ActiveX filter 367 alert email, configuring 521 basic traffic reports 523 blocked files 367 browsing log messages 516 cluster, HA 502 configuring content archive 519 configuring FortiAnalyzer reports 524 configuring graphical system memory report 524 connecting using automatic discovery 504 content archive 519 content block 367 cookie filter 367 customizing display of log messages 516 editing FortiAnalyzer reports 532 FortiGuard Analysis server 506 IM activity 367 intrusions 367 java applet filter 367 log severity levels 502 log types 509 oversized files/emails 367 P2P activity 367 printing FortiAnalyzer reports 533 rating errors 367 reports 523 searching, filtering logs 518 spam 367 storing logs 503 testing FortiAnalyzer configuration 505 to a FortiAnalyzer unit 503 to memory 506 to syslog server 507 to webtrends 508 URL block 367 viewing content archives 520 viewing FortiAnalyzer reports 532 viewing parts of FortiAnalyzer reports 532 viewing raw or formatted logs 516 viruses 367 website, Fortinet Analysis Service 501 logs raw or formatted 516 loopback 248 loopback interface 95, 248 low disk space quarantine 431

M
MAC address wireless setting 140 MAC address filtering 141 MAC filter wireless 141 management VDOM 87, 90 Manual Key list IPSec VPN 381 map to IP virtual IP 327 map to port virtual IP 327, 329 Matched Content 346 matching policy 281 max filesize to quarantine quarantine 431 maximum bandwidth 295 firewall policy 295 traffic shaping 295 MD5 OSPF authentication 268, 270 Members IPSec VPN, concentrator 384 memory usage HA statistics 158 messages, log 516 MGCP service 312 mheader 484 MIB 166 FortiGate 163 RFC 1213 163 RFC 2665 163 misc grayware category 433 Mode HA 153 IPSec VPN, phase 1 373 modem adding firewall policies 117 backup mode 116 redundant (backup) mode 113 standalone mode 113, 117 monitor administrator logins 202 HA statistics 157 IPSec VPN 385 routing 277 move to firewall policy 284 MTU 100 MTU size 111 multicast policy 283 Multi-Exit Discriminator (MED) 271

N
Name IP pool 349, 350

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

543

Index

IPSec VPN, manual key 382 IPSec VPN, Phase 1 372 IPSec VPN, phase 2 377 NAT inbound, ipsec firewall policy 295 outbound, ipsec firewall policy 295 push update 235 symmetric 326 Nat-traversal IPSec VPN, phase 1 376 netmask administrator account 192, 193 NetMeeting service 312 network topology viewer 76 network address translation (NAT) 324 network utilization HA statistics 158 next online help icon 41 NFS service 312 NMT grayware category 433 NNTP service 312 Not Registered 229 Not-so-stubby Area (NSSA) 267 NTP service 312

metrics for redistributing routes 266 multiple interface parameter sets 269 neighbor 262 Network 265 network address space 270 NSSA 267 regular area 267 service 312 settings 264 stub 267 virtual lan 269 virtual link 267 VLAN 269 OSPF AS 262 defining 263 out of band 95 outbound NAT IPSEC firewall policy 295 oversized file/email protection profile 357

P
P1 Proposal IPSec Phase 1 375 P2 Proposal IPSec VPN, phase 2 378 P2P grayware category 433 page controls web-based manager 49 pass fragmented email protection profile 356 password HA 154 PAT virtual IPs 324 pattern default list of file block patterns 424 Spam filter banned word 478 pattern type Spam filter banned word 478 Spam filter email address 483 web content block 456, 458 PC-Anywhere service 312 Peer option IPSec VPN, phase 1 373 Perl regular expressions Spam filter 485 Phase 1 IPSec VPN 372 IPSec VPN, phase 2 377 Phase 1 advanced options IPSec VPN 374 Phase 2 IPSec VPN 377 Phase 2 advanced options IPSec VPN 378 PIM BSR 272 dense mode 272 DR 272 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

O
one-time schedule adding 320 configuring 320 create new 319 list 319 start 320 stop 320 online help keyboard shortcuts 43 search 42 Operation Mode 178 operation mode wireless setting 136, 140 optimize antivirus 434 OSPF advanced options 266 area ID 268 AS 265 authentication 268, 270 Dead Interval 270 Dead interval 270 dead packets 270 GRE 269 Hello Interval 270 interface definition 269 IPSec 269 link-state 262 LSA 270

544

Index

RFC 2362 272 RFC 3973 272 RP 272 sparse mode 272 PING 345 service 312 PING6 firewall service 312 PKI 405 plugin grayware category 434 Point-to-Point Protocol over ATM (PPPoA) 100 Point-to-Point Protocol over Ethernet (PPPoE) 100 policy accept action 288 action 284 adding 285 authentication 289, 290 changing the position in the policy list 284 comments 289 configuring 285 create new 283, 442 deleting 284 deny action 288 dest 284 differentiated services 297 DiffServ 297 dynamic IP pool NAT option 288 fixed port NAT option 288 guaranteed bandwidth 295 ID 284 inbound NAT 295 insert policy before 284 IPSec action 288 list 283 log traffic 288, 289 matching 281 maximum bandwidth 295 move 284 move to 284 multicast 283 outbound NAT 295 protection profile 288 schedule 284, 287 service 284, 287 source 284 traffic priority 295 traffic shaping 289, 292 policy-based routing 253 POP3 service 312 port 53 231 port 8888 231 port 9443 235 port address translation virtual IPs 324 port forwarding 324 port monitor HA 154 PPPoE and IP Pools 288 RFC 2516 105 PPTP 409 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

service 312 predefined services 309 predefined signature action 438 list 437 Pre-shared Key IPSec VPN, phase 1 373 wireless setting 139, 140 previous online help icon 41 print online help icon 42 priority cluster members 156 product registration 40 products, family 31 profile category block reports 471 proposal IPSec Phase 1 375 IPSec VPN, phase 2 378 protection profile action (P2P) 365 ActiveX 358 add signature to outgoing email 357 adding to a firewall policy 367 allow web sites when a rating error occurs 360 amount, comfort clients 357 antivirus options 356 append to 363 append with 363 archive content meta-information 364 banned word check 362 block audio (IM) 365 block file transfers (IM) 365 block login (IM) 365 category 360 comfort clients 357 content archive options 363 cookie filter 358 default protection profiles 354 display content meta-information on dashboard 364 DoS sensor 363 email address BWL check 362 enable category block (HTTP only) 359 enable FortiGuard Web Filtering overrides 360 file block 356 firewall policy 288 FortiGuard Antispam IP address check 361 FortiGuard Antispam URL check 362 FortiGuard email checksum check 362 FortiGuard spam submission 362 HELO DNS lookup 362 inspect non-standard port (IM) 365 interval, comfort clients 357 IP address BWL check 362 IPS sensor 363 IPS sensor options 363 java applet filter 358 limit (P2P) 365 list 354 logging, ActiveX filter 367

545

Index

logging, blocked files 367 logging, content block 367 logging, cookie filter 367 logging, IM activity 367 logging, intrusions 367 logging, java applet filter 367 logging, oversized files/emails 367 logging, P2P activity 367 logging, rating errors 367 logging, spam 367 logging, URL block 367 logging, viruses 367 options 355 oversized file/email 357 pass fragmented email 356 provide details for blocked HTTP errors 360 quarantine 356 rate images by URL 360 rate URLs by domain and IP address 360 return email DNS check 362 scan (default protection profile) 354 spam action 362 spam filtering options 361 strict (default protection profile) 354 strict blocking (HTTP only) 360 threshold, banned word check 362 threshold, oversized file/email 357 threshold, web content block 358 unfiltered (default protection profile) 354 virus scan 356 web (default protection profile) 354 web content block 358 web content exempt 358 web filtering options 358 web resume download block 358 web URL block 358 protocol number, custom service 316 service 311 system status 72 type, custom service 315 virtual IP 329 protocol decoder 440 list 440 Protocol Independent Multicast (PIM) 272 protocol type 316 provide details for blocked HTTP errors protection profile 360 proxy ARP 328 FortiGate interface 328 IP pool 328 virtual IP 328 Proxy ID Destination IPSec interface mode 385 Proxy ID Source IPSec interface mode 385 proxy server 234 push updates 234 push update 230 configuring 235 external IP address changes 235 IP addresses change 235 management IP address changes 235

through a proxy server 234

Q
QoS 297 QUAKE service 313 quality of service 297 quarantine age limit 431 antivirus 427 autosubmit list 429 autosubmit list file pattern 429 configuration 430 configuring the autosubmit list 430 enable AutoSubmit 431 enabling uploading autosubmit file patterns 430 heuristics 434 low disk space 431 max filesize to quarantine 431 options 430 protection profile 356 quarantine files list antivirus 428 apply 428 date 428 DC 429 download 429 duplicates 429 file name 428 filter 428 service 428 sort by 428 status 428 status description 428 TTL 429 upload status 429 Quick Mode Selector IPSec VPN, phase 2 380

R
RADIUS WPA Radius 139 RADIUS server wireless setting 139 RADIUS server name wireless setting 140 range web category reports 471 RAT grayware category 434 rate images by URL protection profile 360 rate URLs by domain and IP address protection profile 360 RAUDIO service 313 read & write access level administrator account 67, 190 read only access level administrator account 67, 190, 192 reading log messages 516

546

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Index

recurring schedule adding 321 configuring 321 create new 320 list 320 select 321 start 321 stop 321 refresh every HA statistics 157 register FortiGate unit 40 remote administration 110, 179 Remote Gateway IPSec manual key setting 382 IPSec VPN, phase 1 372 VPN IPSec monitor field 385 Remote gateway IPSec VPN, manual key 381 remote peer manual key configuration 382 Remote SPI IPSec VPN, manual key 382 Rendezvous Point (RP) 272 report delete after upload 530 FortiGuard 470 gzip 530 type, category block 471 upload to FTP 529 web category block 470 reports basic traffic 523 FortiAnalyzer, configuring 524 FortiAnalyzer, editing 532 FortiAnalyzer, printing 533 FortiAnalyzer, viewing from FortiGate unit 532 FortiAnalyzer, viewing parts of report 532 report scope, FortiAnalyzer 525 return email DNS check protection profile 362 Reverse Path Forwarding (RPF) 274 REXEC firewall service 313 RFC 272 2474 297 2475 297 RFC 1058 257 RFC 1213 159, 163 RFC 1215 163 RFC 1771 270 RFC 2132 148 RFC 2362 272 RFC 2453 257 RFC 2516 105 RFC 2665 159, 163 RFC 3509 263 RFC 3973 272 RIP authentication 262 hop count 258 RFC 1058 257 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

RFC 2453 257 service 313 split horizon 261 version 1 257 version 2 257 RLOGIN service 313 role cluster members 156 route HA 278 router monitor HA 278 routing administrative distance 246 configuring 122 ECMP 248 loopback interface 248 monitor 277 static 248 routing table 277 RSH firewall service 313 RTS threshold wireless setting 139, 141

S
SAMBA service 313 scan default protection profile 354 SCCP firewall service 313 schedule automatic antivirus and attack definition updates 234 firewall policy 284, 287 one-time schedule list 319 recurring schedule list 320 scheduled antivirus and attack updates 234 scheduled updates through a proxy server 234 scheduling 234 search online help 42 online help icon 42 online help wildcard 42 security MAC address filtering 141 security mode wireless setting 138, 140 select recurring schedule 321 sensor Dos 446 server log webtrends setting 508 server health 346 service AH 311 ANY 311

547

Index

AOL 311 BGP 311 custom service list 314 DCE-RPC 311 DHCP 311 DNS 311 ESP 311 FINGER 311 firewall policy 284, 287 FTP 311 FTP_GET 311 FTP_PUT 311 GOPHER 311 GRE 311 group 316 H323 311 HTTPS 311 ICMP_ANY 312 IKE 312 IMAP 312 INFO_ADDRESS 312 INFO_REQUEST 312 Internet-Locator-Service 312 IRC 312 L2TP 312 LDAP 312 MGCP 312 NetMeeting 312 NFS 312 NNTP 312 NTP 312 organizing services into groups 317 OSPF 312 PC-Anywhere 312 PING 312 PING6 312 POP3 312 PPTP 312 predefined 309 QUAKE 313 quarantine files list 428 RAUDIO 313 REXEC 313 RIP 313 RLOGIN 313 RSH 313 SAMBA 313 SCCP 313 service name 311 SIP 313 SIP-MSNmessenger 313 SMTP 313 SNMP 313 SSH 313 SYSLOG 313 TALK 313 TCP 313 TELNET 313 TFTP 313 TIMESTAMP 313 UDP 313 UUCP 313 VDOLIVE 313 WAIS 314

WINFRAME 314 X-WINDOWS 314 service group 316 adding 317 create new 316 list 316 service port virtual IP 327 service set identifier (SSID) 93 session pickup HA 154 shelf manager chassis monitoring 239 shelf manager card 239 shelf monitoring shelf manager 239 Shortest Path First (SPF) 263 show in contents online help icon 42 show navigation online help icon 41 signature custom, intrusion protection signatures 439 intrusion protection 437 SIP service 313 SIP-MSNmessenger service 313 SMC 239 chassis monitoring 239 SMTP service 313 SNAT virtual IPs 288, 325 SNMP contact information 160 MIBs 163 RFC 12123 163 RFC 1215 163 RFC 2665 163 service 313 traps 163 SNMP Agent 160 SNMP communities 160 SNMP community, configuring 160 SNMP manager 159 SNMP managers 160 SNMP, event 162 SNMP, MIB 166 SNMP, queries 162 SNMP, traps 162, 163 software switch 98 sort by quarantine files list 428 source firewall policy 284, 286 source port 315 spam action protection profile 362 Spam filter 473 adding an email address or domain to the email ad-

548

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

Index

dress list 483 adding words to the Spam filter banned word list 478 banned word list 477 email address list 482 IP address 479 IP address list 480 Perl regular expressions 485 spam filtering options protection profile 361 splice 356 spy grayware category 434 SSH 179 service 313 SSID wireless setting 138, 140 SSID broadcast wireless setting 138, 140 SSL service definition 311 SSL VPN bookmark 392 bookmark group 394 checking client certificates 391 configuration settings 390 monitoring sessions 391 setting the cipher suite 391 specifying server certificate 391 specifying timeout values 391 terminating sessions 392 tunnel IP range 391 SSL VPN login message 176 Standalone mode modem 113, 117 start one-time schedule 320 recurring schedule 321 start IP IP pool 348 static IP monitor 385 static route adding 252 adding policy 254 administrative distance 246 concepts 245 creating 248 default gateway 250 default route 250 editing 248 overview 245 policy 253 policy list 253 selecting 246 table building 246 table priority 247 table sequence 247 statistics viewing HA statistics 157 status HA statistics 157 interface 95 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

log webtrends setting 508 quarantine files list 428 status description quarantine files list 428 stop one-time schedule 320 recurring schedule 321 streaming mode 356 Strict default protection profile 354 strict blocking (HTTP only) protection profile 360 stub OSPF area 267 subnet firewall address 306 Subscription Expired 229 Not Registered 229 Valid license 229 Switch mode 96 switch mode 97 syn interval 68 SYSLOG service 313 system chassis monitoring 239 system configuration 151 system global av_failopen antivirus 434 system global optimize antivirus 434 system idle timeout 179 system maintenance 216 advanced 223 backup and restore 217 enabling push updates 235 firmware 221 firmware upgrade 222 FortiClient 216, 223 managing configuration 215 push update through a NAT device 235 Remote FortiManager options 219 remote management options 220 revision control 225 updating antivirus and attack definitions 233 usb disks 224

T
TALK service 313 TCP 345 service 313 TCP custom service 315 adding 314 destination port 315 protocol type 315 source port 315 technical support 37 TELNET service 313

549

Index

temperature chassis monitoring 241 chassis monitoring examples 241 FortiGate-5000 module 241 TFTP service 313 threshold banned word check, protection profile 362 oversized file/email, protection profile 357 web content block, protection profile 358 TIMESTAMP service 313 to IP system status 72 toolbar grayware category 434 topology viewer 76 total bytes HA statistics 158 total packets HA statistics 158 Traffic Priority 295 traffic priority firewall policy 295 traffic shaping 295 traffic shaping firewall policy 289, 292 guaranteed bandwidth 295 maximum bandwidth 295 traffic priority 295 Transparent mode VLANs 128 traps SNMP 163 trusted host administrator account 193 Administrators options 192 security issues 193 TTL quarantine files list 429 Tunnel Name IPSec VPN, manual key 381 Tx Power wireless setting 136, 141 type 315 virtual IP 328

push 235 upgrade firmware 69 upload status quarantine files list 429 URL block add a URL to the web filter block list 462 web filter 459 URL filter catalog 459 user authentication PKI 405 user groups configuring 409 UUCP service 313

V
Valid license 229 VDOLIVE service 313 VDOM configuration settings 83 license key 238 management VDOM 87 multiple VDOMs 84 NAT/Route 82 Transparent 82 VDOM partitioning HA 154 Virtual Circuit Identification (VCI) 101 virtual IP 328 configuring 328 create new 327, 344 destination network address translation 288, 325, 326 DNAT 288, 325, 326 external interface 328 external IP address 328 external service port 329 health check monitor 345 IP 327 list 327 map to IP 327 map to port 327, 329 NAT 324 PAT 324 port address translation 324 protocol 329 server down 346 service port 327 SNAT 288, 325 source network address translation 288, 325 type 328 virus detected HA statistics 158 virus list 431 view, update 431 virus name 175 virus protection See also antivirus 421 virus scan protection profile 356 FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

U
UDP custom service 315 adding 314 destination port 315 protocol type 315 source port 315 UDP service 313 Unfiltered default protection profile 354 unit HA statistics 157 up time HA statistics 157 update

550

Index

virus-infected attachments 173 VLAN jumbo frames 111 OSPF 269 overview 123 voltage chassis monitoring 241 chassis monitoring examples 242 FortiGate-5000 module 241 VPN tunnel IPSEC VPN, firewall policy 295 VPN, IPSec 369 auto key 371 concentrator 384 firewall policies 295 manual key 381, 382 Phase 1 configuration 372 Phase 2 configuration 377 route-based vs. policy-based 370 VPNs 205, 387

W
WAIS service 314 Web default protection profile 354 web category block changing the host name 470 CLI configuration 470 configuration options 464 report allowed 471 report blocked 471 report category 471 report profiles 471 report range 471 report type 471 reports 470 web content block banned word 456, 458 language 456, 458 pattern type 456, 458 protection profile 358 web filter 456 web content block list web filter 455 web content exempt protection profile 358 web equivalent privacy 138, 140 Web Filter URL category 232 web filter 451 add a URL to the web URL block list 462 configuring the web content block list 456 configuring the web URL block list 462 content block 454 URL block 459 web content block list 455 web URL block list 461 web filtering options protection profile 358 web filtering service 175 web resume download block FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

protection profile 358 web site, content category 174 web URL block configuring the web URL block list 462 list 461 list, web filter 461 protection profile 358 web-based manager language 202 WEP 138, 140 WEP128 133, 138, 140 WEP64 133, 138, 140 where Spam filter banned word 478 Wi-Fi protected access 138, 140 wildcard online help search 42 WINFRAME service 314 wireless advanced settings 140 band 136 beacon interval 137, 141 channel 136 channel, FortiWiFi-60 140 configuration 133 data encryption 138 fragmentation threshold 139, 141 geography 136, 140 interface 133 key 138, 140 MAC address 140 MAC filter 141 operation mode 136, 140 pre-shared key 139, 140 RADIUS server 139 RADIUS server name 140 RTS threshold 139, 141 security mode 138, 140 settings for WiFi-60 139 settings FortiWiFi-50B 136 settings FortiWiFi-60A 136 settings FortiWiFi-60AM 136 settings FortiWiFi-60B 136 SSID 138, 140 SSID broadcast 138, 140 Tx power 136, 141 Wireless, geography 140 wireless, security 138, 140 Wireless, SSID 138, 140 WLAN interface 133 interface, creating on WiFi-60 139 wlan interface adding to a FortiWiFi-50B 137 adding to a FortiWiFi-60A 137 adding to a FortiWiFi-60AM 137 adding to a FortiWiFi-60B 137 WPA 133, 138, 140 WPA Radius wireless security 139 WPA2 133, 138

551

Index

WPA2 Auto 133, 138 WPA2 Radius wireless security 139

X
XAuth IPSec VPN, phase 1 376 X-WINDOWS service 314

552

FortiGate Version 3.0 MR6 Administration Guide 01-30006-0203-20080313

www.fortinet.com

www.fortinet.com