Fortinet FortiGate-5003, FortiGate-5001FA2, FortiGate-5001, FortiGate-5001SX, FortiGate-5002FB2 Administration Manual
...
FortiGate 5000 series
USB
CONSOLE
PWRACC
CONSOLE
PWRACC
PWRACC
5
4
PWRACC
3
PWRACC
2
1
ShMC
2
1 2 3 4 5 6 7 8
USB
1 2 3 4 5 6 7 8
USB
1 2 3 4 5 6 7 8
CONSOLE
USB
1 2 3 4 5 6 7 8
CONSOLE
USB
1 2 3 4 5 6 7 8
CONSOLE
ETH
O
MANAGEMENT
MANAGEMENT
ETH
O
RS232ZRE0ZRE1ZRE2
SYSTEM
CONSOLE
RS232ZRE0ZRE1ZRE2
SYSTEM
CONSOLE
E1
E2
E1
E2
STA IPM
STA IPM
STA IPM
STA IPM
STA IPM
OKCLK
INTEXT
FLT
9876543210
1514
1312
1110
1514
1312
1110
9876543210
HOT SWAP
RESET
ZRE
LED MODE
FLT
OKCLK
INTEXT
FLT
HOT SWAP
RESET
ZRE
LED MODE
FLT
CRITICAL
MAJOR
ALARM
RESET
ALARMS
HOT SWAP
STATUS
MINOR
Administration Guide
PSUA
PSU B
POWER
ON
ShMC
1
3
4
5
PWRACC
PWRACC
PWRACC
CONSOLE
CONSOLE
USB
USB
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
STA IPM
STA IPM
STA IPM
PWRACC
PWRACC
CONSOLE
USB
1 2 3 4 5 6 7 8
CONSOLE
CONSOLE
USB
USB
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
STA IPM
STA IPM
1
223
PWRACC
MANAGEMENT
MANAGEMENT
E
E
T
T
H
H
O
O
CONSOLE
USB
SYSTEM
SYSTEM
CONSOLE
CONSOLE
R
R
S
S
2
2
3
3
2
2
1 2 3 4 5 6 7 8
Z
Z
R
R
E
E
0
0
Z
Z
R
R
E
E
1
1
Z
Z
R
R
E
E
2
2
E1
E1
E2
E2
1514
1514
1312
1312
1110
1110
98
98
76
76
54
54
32
32
10
10
ZRE
ZRE
OKCLK
OKCLK
INTEXT
INTEXT
FLT
FLT
FLT
FLT
HOT SWAP
HOT SWAP
RESET
RESET
LED MODE
LED MODE
STA IPM
4
5
PWRACC
PWRACC
PWRACC
CONSOLE
USB
1 2 3 4 5 6 7 8
STA IPM
STA IPM
PWRACC
CONSOLE
CONSOLE
USB
1 2 3 4 5 6 7 8
CONSOLE
USB
USB
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
STA IPM
STA IPM
5140
PWRACC
PWRACC
CONSOLE
CONSOLE
USB
USB
1 2 3 4 5 6 7 8
1 2 3 4 5 6 7 8
STA IPM
STA IPM
FortiGate-5000 series Administration Guide
Version 2.80 MR8
4 February 2005
01-28008-0013-20050204
© Copyright 2005 Fortinet Inc. All rights reserved.
No part of this publication including text, examples, diagrams or illustrations may be reproduced,
transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or
otherwise, for any purpose, without prior written permission of Fortinet Inc.
FortiGate-5000 series Administration Guide
Version 2.80 MR8
4 February 2005
01-28008-0013-20050204
Trademarks
Products mentioned in this document are trademarks or registered trademarks of their respective
holders.
Regulatory Compliance
FCC Class A Part 15 CSA/CUS
CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE.
DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS.
For technical support, please visit http://www.fortinet.com.
Send information about errors or omissions in this document or any Fortinet technical documentation to
techdoc@fortinet.com.
Table of Contents
Introduction.......................................................................................................... 13
About FortiGate Antivirus Firewalls................................................................................... 13
Antivirus protection ....................................................................................................... 14
Web content filtering ..................................................................................................... 15
Spam filtering ................................................................................................................ 15
Firewall.......................................................................................................................... 16
VLANs and virtual domains........................................................................................... 17
Intrusion Prevention System (IPS)................................................................................ 17
VPN............................................................................................................................... 17
High availability ............................................................................................................. 18
Secure installation, configuration, and management .................................................... 19
Document conventions ..................................................................................................... 20
FortiGate documentation .................................................................................................. 21
Fortinet Knowledge Center ........................................................................................... 22
Comments on Fortinet technical documentation........................................................... 22
Related documentation ..................................................................................................... 22
FortiManager documentation ........................................................................................ 22
FortiClient documentation ............................................................................................. 23
FortiMail documentation................................................................................................ 23
FortiLog documentation ................................................................................................ 23
Customer service and technical support........................................................................... 24
Contents
Web-based manager............................................................................................ 25
Button bar features ........................................................................................................... 26
Contact Customer Support ........................................................................................... 26
Online Help ................................................................................................................... 27
Easy Setup Wizard ....................................................................................................... 27
Console Access ............................................................................................................ 28
Logout ........................................................................................................................... 28
Web-based manager pages.............................................................................................. 29
Web-based manager menu .......................................................................................... 29
Lists............................................................................................................................... 30
Icons ............................................................................................................................. 30
Status bar...................................................................................................................... 31
Organization of this manual .............................................................................................. 32
System Status ...................................................................................................... 33
Status................................................................................................................................ 33
Viewing system status .................................................................................................. 34
Changing unit information ............................................................................................. 37
Session list........................................................................................................................ 39
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 3
Contents
Changing the FortiGate firmware...................................................................................... 40
Upgrading to a new firmware version ........................................................................... 41
Reverting to a previous firmware version...................................................................... 43
Installing firmware images from a system reboot using the CLI ................................... 45
Testing a new firmware image before installing it ......................................................... 48
Installing and using a backup firmware image .............................................................. 51
System Network................................................................................................... 55
Interface............................................................................................................................ 55
Interface settings........................................................................................................... 56
Configuring interfaces ................................................................................................... 61
Zone.................................................................................................................................. 66
Zone settings ................................................................................................................ 66
Management..................................................................................................................... 67
DNS .................................................................................................................................. 68
Routing table (Transparent Mode).................................................................................... 69
Routing table list ........................................................................................................... 69
Transparent mode route settings .................................................................................. 70
VLAN overview ................................................................................................................. 70
FortiGate units and VLANs ........................................................................................... 71
VLANs in NAT/Route mode .............................................................................................. 71
Rules for VLAN IDs....................................................................................................... 72
Rules for VLAN IP addresses ....................................................................................... 72
Adding VLAN subinterfaces .......................................................................................... 73
VLANs in Transparent mode............................................................................................. 74
Rules for VLAN IDs....................................................................................................... 76
Transparent mode virtual domains and VLANs ............................................................ 76
Transparent mode VLAN list......................................................................................... 76
Transparent mode VLAN settings................................................................................. 76
FortiGate IPv6 support...................................................................................................... 78
System DHCP ....................................................................................................... 79
Service.............................................................................................................................. 79
DHCP service settings .................................................................................................. 80
Server ............................................................................................................................... 81
DHCP server settings ................................................................................................... 82
Exclude range................................................................................................................... 83
DHCP exclude range settings....................................................................................... 84
IP/MAC binding................................................................................................................. 84
DHCP IP/MAC binding settings .................................................................................... 85
Dynamic IP........................................................................................................................ 85
4 01-28008-0013-20050204 Fortinet Inc.
System Config...................................................................................................... 87
System time ...................................................................................................................... 87
Options.............................................................................................................................. 88
HA..................................................................................................................................... 90
HA overview.................................................................................................................. 90
HA configuration ........................................................................................................... 92
Configuring an HA cluster ............................................................................................. 98
Managing an HA cluster.............................................................................................. 102
SNMP.............................................................................................................................. 105
Configuring SNMP ...................................................................................................... 106
SNMP community ....................................................................................................... 107
FortiGate MIBs............................................................................................................ 109
FortiGate traps ............................................................................................................ 110
Fortinet MIB fields ....................................................................................................... 112
Replacement messages ................................................................................................. 114
Replacement messages list ........................................................................................ 115
Changing replacement messages .............................................................................. 116
FortiManager................................................................................................................... 117
Contents
System Admin .................................................................................................... 119
Administrators................................................................................................................. 121
Administrators list........................................................................................................ 121
Administrators options ................................................................................................ 121
Access profiles................................................................................................................ 123
Access profile list ........................................................................................................ 123
Access profile options ................................................................................................. 124
System Maintenance ......................................................................................... 125
Backup and restore......................................................................................................... 125
Backing up and Restoring........................................................................................... 126
Update center ................................................................................................................. 128
Updating antivirus and attack definitions .................................................................... 130
Enabling push updates ............................................................................................... 133
Support ........................................................................................................................... 135
Sending a bug report .................................................................................................. 136
Registering a FortiGate unit ........................................................................................ 137
Shutdown........................................................................................................................ 139
System Virtual Domain...................................................................................... 141
Virtual domain properties................................................................................................ 142
Exclusive virtual domain properties ............................................................................ 142
Shared configuration settings ..................................................................................... 143
Administration and management ................................................................................ 144
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 5
Contents
Virtual domains ............................................................................................................... 144
Adding a virtual domain .............................................................................................. 145
Selecting a virtual domain........................................................................................... 145
Selecting a management virtual domain..................................................................... 145
Configuring virtual domains ............................................................................................ 146
Adding interfaces, VLAN subinterfaces, and zones to a virtual domain ..................... 146
Configuring routing for a virtual domain ...................................................................... 148
Configuring firewall policies for a virtual domain......................................................... 148
Configuring IPSec VPN for a virtual domain ............................................................... 150
Router ................................................................................................................. 151
Static............................................................................................................................... 151
Static route list ............................................................................................................ 153
Static route options ..................................................................................................... 154
Policy .............................................................................................................................. 155
Policy route list............................................................................................................ 155
Policy route options..................................................................................................... 156
RIP.................................................................................................................................. 156
General ....................................................................................................................... 157
Networks list................................................................................................................ 158
Networks options ........................................................................................................ 159
Interface list................................................................................................................. 159
Interface options ......................................................................................................... 160
Distribute list ............................................................................................................... 161
Distribute list options................................................................................................... 162
Offset list ..................................................................................................................... 163
Offset list options ........................................................................................................ 163
Router objects................................................................................................................. 164
Access list ................................................................................................................... 164
New access list ........................................................................................................... 165
New access list entry .................................................................................................. 165
Prefix list ..................................................................................................................... 166
New Prefix list ............................................................................................................. 166
New prefix list entry..................................................................................................... 167
Route-map list............................................................................................................. 167
New Route-map .......................................................................................................... 168
Route-map list entry.................................................................................................... 169
Key chain list............................................................................................................... 170
New key chain............................................................................................................. 170
Key chain list entry...................................................................................................... 171
Monitor............................................................................................................................ 172
Routing monitor list ..................................................................................................... 172
6 01-28008-0013-20050204 Fortinet Inc.
CLI configuration............................................................................................................. 173
get router info ospf ...................................................................................................... 173
get router info protocols .............................................................................................. 173
get router info rip......................................................................................................... 174
config router ospf ....................................................................................................... 174
config router static6..................................................................................................... 197
Firewall................................................................................................................ 199
Policy .............................................................................................................................. 200
How policy matching works......................................................................................... 200
Policy list ..................................................................................................................... 200
Policy options.............................................................................................................. 202
Advanced policy options ............................................................................................. 204
Configuring firewall policies ........................................................................................ 207
Policy CLI configuration .............................................................................................. 208
Address........................................................................................................................... 209
Address list ................................................................................................................. 210
Address options .......................................................................................................... 210
Configuring addresses ................................................................................................ 211
Address group list ....................................................................................................... 212
Address group options ................................................................................................ 212
Configuring address groups........................................................................................ 213
Service............................................................................................................................ 213
Predefined service list................................................................................................. 214
Custom service list...................................................................................................... 217
Custom service options............................................................................................... 217
Configuring custom services....................................................................................... 219
Service group list ........................................................................................................ 220
Service group options ................................................................................................. 220
Configuring service groups ......................................................................................... 221
Schedule......................................................................................................................... 221
One-time schedule list ................................................................................................ 222
One-time schedule options ......................................................................................... 222
Configuring one-time schedules ................................................................................. 223
Recurring schedule list................................................................................................ 223
Recurring schedule options ........................................................................................ 224
Configuring recurring schedules ................................................................................. 224
Virtual IP ......................................................................................................................... 225
Virtual IP list ................................................................................................................ 226
Virtual IP options......................................................................................................... 226
Configuring virtual IPs................................................................................................. 227
Contents
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 7
Contents
IP pool............................................................................................................................. 229
IP pool list ................................................................................................................... 230
IP pool options ............................................................................................................ 230
Configuring IP pools.................................................................................................... 231
IP Pools for firewall policies that use fixed ports ......................................................... 231
IP pools and dynamic NAT ......................................................................................... 232
Protection profile............................................................................................................. 232
Protection profile list.................................................................................................... 233
Default protection profiles ........................................................................................... 233
Protection profile options ............................................................................................ 234
Configuring protection profiles .................................................................................... 239
Profile CLI configuration.............................................................................................. 240
User..................................................................................................................... 243
Setting authentication timeout......................................................................................... 244
Local ............................................................................................................................... 244
Local user list .............................................................................................................. 244
Local user options....................................................................................................... 244
RADIUS .......................................................................................................................... 245
RADIUS server list ...................................................................................................... 245
RADIUS server options............................................................................................... 246
LDAP............................................................................................................................... 246
LDAP server list .......................................................................................................... 247
LDAP server options ................................................................................................... 247
User group ...................................................................................................................... 249
User group list............................................................................................................. 249
User group options...................................................................................................... 250
CLI configuration............................................................................................................. 251
peer............................................................................................................................. 251
peergrp........................................................................................................................ 252
VPN...................................................................................................................... 255
Phase 1........................................................................................................................... 256
Phase 1 list ................................................................................................................. 256
Phase 1 basic settings ................................................................................................ 257
Phase 1 advanced settings......................................................................................... 259
Phase 2........................................................................................................................... 260
Phase 2 list ................................................................................................................. 261
Phase 2 basic settings ................................................................................................ 261
Phase 2 advanced options.......................................................................................... 262
Manual key...................................................................................................................... 263
Manual key list ............................................................................................................ 264
Manual key options ..................................................................................................... 264
8 01-28008-0013-20050204 Fortinet Inc.
Concentrator ................................................................................................................... 266
Concentrator list.......................................................................................................... 266
Concentrator options................................................................................................... 267
Ping Generator................................................................................................................ 267
Ping generator options................................................................................................ 268
Monitor............................................................................................................................ 268
Dialup monitor............................................................................................................. 269
Static IP and dynamic DNS monitor............................................................................ 269
PPTP............................................................................................................................... 270
PPTP range ................................................................................................................ 270
L2TP .............................................................................................................................. 271
L2TP range ................................................................................................................. 271
Certificates...................................................................................................................... 272
Local certificate list...................................................................................................... 272
Certificate request....................................................................................................... 273
Importing signed certificates ...................................................................................... 274
CA certificate list ......................................................................................................... 275
Importing CA certificates............................................................................................. 275
VPN configuration procedures........................................................................................ 276
IPSec configuration procedures.................................................................................. 276
PPTP configuration procedures .................................................................................. 278
L2TP configuration procedures................................................................................... 278
CLI configuration............................................................................................................. 279
ipsec phase1............................................................................................................... 279
ipsec phase2............................................................................................................... 281
ipsec vip ...................................................................................................................... 281
Contents
IPS ....................................................................................................................... 285
Signature......................................................................................................................... 286
Predefined................................................................................................................... 286
Custom........................................................................................................................ 290
Anomaly.......................................................................................................................... 292
Anomaly CLI configuration.......................................................................................... 295
Configuring IPS logging and alert email.......................................................................... 296
Default fail open setting .................................................................................................. 296
Antivirus ............................................................................................................. 297
File block......................................................................................................................... 298
File block list ............................................................................................................... 299
Configuring the file block list ....................................................................................... 300
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 9
Contents
Quarantine ...................................................................................................................... 300
Quarantined files list ................................................................................................... 300
Quarantined files list options....................................................................................... 301
AutoSubmit list ............................................................................................................ 302
AutoSubmit list options ............................................................................................... 302
Configuring the AutoSubmit list................................................................................... 302
Config.......................................................................................................................... 303
Config.............................................................................................................................. 304
Virus list ...................................................................................................................... 304
Config.......................................................................................................................... 304
Grayware .................................................................................................................... 305
Grayware options........................................................................................................ 305
CLI configuration............................................................................................................. 307
system global av_failopen........................................................................................... 307
system global optimize................................................................................................ 308
config antivirus heuristic.............................................................................................. 308
config antivirus quarantine .......................................................................................... 309
config antivirus service http......................................................................................... 310
config antivirus service ftp........................................................................................... 311
config antivirus service pop3....................................................................................... 313
config antivirus service imap....................................................................................... 315
config antivirus service smtp....................................................................................... 316
Web filter............................................................................................................. 319
Content block.................................................................................................................. 321
Web content block list ................................................................................................. 321
Web content block options.......................................................................................... 321
Configuring the web content block list ........................................................................ 322
URL block ....................................................................................................................... 322
Web URL block list...................................................................................................... 323
Web URL block options .............................................................................................. 323
Configuring the web URL block list ............................................................................. 324
Web pattern block list.................................................................................................. 324
Web pattern block options .......................................................................................... 325
Configuring web pattern block .................................................................................... 325
URL exempt.................................................................................................................... 325
URL exempt list........................................................................................................... 326
URL exempt list options .............................................................................................. 326
Configuring URL exempt............................................................................................. 326
10 01-28008-0013-20050204 Fortinet Inc.
Category block................................................................................................................ 327
FortiGuard managed web filtering service .................................................................. 327
Category block configuration options.......................................................................... 328
Configuring web category block.................................................................................. 329
Category block reports................................................................................................ 329
Category block reports options ................................................................................... 330
Generating a category block report............................................................................. 330
Category block CLI configuration................................................................................ 330
Script filter....................................................................................................................... 331
Web script filter options............................................................................................... 332
Spam filter .......................................................................................................... 333
FortiShield....................................................................................................................... 335
FortiShield Spam filtering............................................................................................ 335
FortiShield options ...................................................................................................... 337
Configuring the FortiShield cache............................................................................... 337
FortiShield CLI configuration....................................................................................... 338
Contents
IP address....................................................................................................................... 339
IP address list ............................................................................................................. 339
IP address options ...................................................................................................... 339
Configuring the IP address list .................................................................................... 339
DNSBL & ORDBL ........................................................................................................... 340
DNSBL & ORDBL list.................................................................................................. 341
DNSBL & ORDBL options........................................................................................... 341
Configuring the DNSBL & ORDBL list ........................................................................ 341
Email address ................................................................................................................. 342
Email address list........................................................................................................ 342
Email address options................................................................................................. 342
Configuring the email address list............................................................................... 342
MIME headers................................................................................................................. 343
MIME headers list ....................................................................................................... 344
MIME headers options ................................................................................................ 344
Configuring the MIME headers list.............................................................................. 345
Banned word................................................................................................................... 345
Banned word list ......................................................................................................... 346
Banned word options .................................................................................................. 346
Configuring the banned word list ................................................................................ 347
Using Perl regular expressions....................................................................................... 347
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 11
Contents
Log & Report ...................................................................................................... 351
Log config ....................................................................................................................... 352
Log Setting options ..................................................................................................... 352
Alert E-mail options..................................................................................................... 356
Log filter options.......................................................................................................... 357
Configuring log filters .................................................................................................. 360
Enabling traffic logging................................................................................................ 360
Log access...................................................................................................................... 361
Disk log file access ..................................................................................................... 361
Viewing log messages ................................................................................................ 362
Searching log messages............................................................................................. 365
CLI configuration............................................................................................................. 366
fortilog setting.............................................................................................................. 366
syslogd setting ............................................................................................................ 367
FortiGuard categories ....................................................................................... 371
Glossary ............................................................................................................. 377
Index .................................................................................................................... 383
12 01-28008-0013-20050204 Fortinet Inc.
FortiGate-5000 series Administration Guide Version 2.80 MR8
Introduction
FortiGate Antivirus Firewalls support network-based deployment of application-level
services, including antivirus protection and full-scan content filtering. FortiGate
Antivirus Firewalls improve network security, reduce network misuse and abuse, and
help you use communications resources more efficiently without compromising the
performance of your network. FortiGate Antivirus Firewalls are ICSA-certified for
firewall, IPSec, and antivirus services.
This chapter introduces you to FortiGate Antivirus Firewalls and the following topics:
• About FortiGate Antivirus Firewalls
• Document conventions
• FortiGate documentation
• Related documentation
• Customer service and technical support
About FortiGate Antivirus Firewalls
The FortiGate Antivirus Firewall is a dedicated easily managed security device that
delivers a full suite of capabilities that include:
• application-level services such as virus protection and content filtering,
• network-level services such as firewall, intrusion detection, VPN, and traffic
shaping.
The FortiGate Antivirus Firewall uses Fortinet’s Accelerated Behavior and Content
Analysis System (ABACAS™) technology, which leverages breakthroughs in chip
design, networking, security, and content analysis. The unique ASIC-based
architecture analyzes content and behavior in real-time, enabling key applications to
be deployed right at the network edge, where they are most effective at protecting
your networks. The FortiGate series complements existing solutions, such as hostbased antivirus protection, and enables new applications and services while greatly
lowering costs for equipment, administration, and maintenance.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 13
About FortiGate Antivirus Firewalls Introduction
The FortiGate-5000 series
Antivirus Firewalls are
chassis-based systems that
broadband service providers
can use to provide subscriber
security services such as
USB
1 2 3 4 5 6 7 8
CONSOLE
PWRACC
USB
1 2 3 4 5 6 7 8
CONSOLE
PWRACC
PSUA
PSU B
STA IPM
STA IPM
firewall, VPN, antivirus
protection, spam filtering, web
filtering and intrusion prevention (IPS). The wide variety of system configurations
available with FortiGate-5000 series provides flexibility to meet the changing needs of
growing high performance networks. The FortiGate-5000 series chassis support
multiple hot-swappable FortiGate-5001 modules and power supplies.
Each FortiGate-5000 series system can support two or more FortiGate-5001 modules.
Each FortiGate-5001 module is a standalone high-performance antivirus firewall that
supports high-end features including 802.1Q VLANs and multiple virtual domains.
Two or more FortiGate-5001 modules also support stateful failover HA. Each
FortiGate-5001 module includes four Gigabit fibre interfaces, and four Gigabit
ethernet interfaces.
• The FortiGate-5020 system, the first in the FortiGate-5000 series, scales from 1 to
2 FortiGate-5001 modules enabling customers to add incremental performance
and to operate the FortiGate-5020 in HA mode.
Antivirus protection
FortiGate ICSA-certified antivirus protection scans web (HTTP), file transfer (FTP),
and email (SMTP, POP3, and IMAP) content as it passes through the FortiGate unit.
FortiGate antivirus protection uses pattern matching and heuristics to find viruses. If a
virus is found, antivirus protection removes the file containing the virus from the
content stream and forwards a replacement message to the intended recipient.
For extra protection, you can configure antivirus protection to block specified file types
from passing through the FortiGate unit. You can use the feature to stop files that
might contain new viruses.
FortiGate antivirus protection can also identify and remove known grayware
programs. Grayware programs are usually unsolicited commercial software programs
that get installed on PCs, often without the user’s consent or knowledge. Grayware
programs are generally considered an annoyance, but these programs can cause
system performance problems or be used for malicious means.
If the FortiGate unit contains a hard disk, infected or blocked files and grayware files
can be quarantined. The FortiGate administrator can download quarantined files so
that they can be virus scanned, cleaned, and forwarded to the intended recipient. You
can also configure the FortiGate unit to automatically delete quarantined files after a
specified time.
The FortiGate unit can send email alerts to system administrators when it detects and
removes a virus from a content stream. The web and email content can be in normal
network traffic or encrypted IPSec VPN traffic.
14 01-28008-0013-20050204 Fortinet Inc.
Introduction About FortiGate Antivirus Firewalls
ICSA Labs has certified that FortiGate Antivirus Firewalls:
• detect 100% of the viruses listed in the current In The Wild List (www.wildlist.org),
• detect viruses in compressed files using the PKZip format,
• detect viruses in email that has been encoded using uuencode format,
• detect viruses in email that has been encoded using MIME encoding,
• log all actions taken while scanning.
Web content filtering
FortiGate web content filtering can scan all HTTP content protocol streams for URLs,
URL patterns, and web page content. If there is a match between a URL on the URL
block list, or a web page contains a word or phrase that is in the content block list, the
FortiGate unit blocks the web page. The blocked web page is replaced with a
message that you can edit using the FortiGate web-based manager.
FortiGate web content filtering also supports FortiGuard web category blocking. Using
web category blocking you can restrict or allow access to web pages based on
content ratings of web pages.
You can configure URL blocking to block all or some of the pages on a web site. Using
this feature, you can deny access to parts of a web site without denying access to it
completely.
To prevent unintentionally blocking legitimate web pages, you can add URLs to an
exempt list that overrides the URL blocking and content blocking lists. The exempt list
also exempts web traffic this address from virus scanning.
Web content filtering also includes a script filter feature that can block unsecure web
content such as Java applets, cookies, and ActiveX.
Spam filtering
FortiGate spam filtering can scan all POP3, SMTP, and IMAP email content for spam.
You can configure spam filtering to filter mail according to IP address, email address,
mime headers, and content. Mail messages can be identified as spam or clear.
FortiShield is an antispam system from Fortinet that includes an IP address black list,
a URL black list, and spam filtering tools. The IP address black list contains IP
addresses of email servers known to be used to generate Spam. The URL black list
contains URLs of websites found in Spam email.
You can also add the names of known third-party DNS-based Blackhole List (DNSBL)
and Open Relay Database List (ORDBL) servers. These services contain lists of
known spam sources.
If an email message is found to be spam, the FortiGate unit adds an email tag to the
subject line of the email. The recipient can use their mail client software to filter
messages based on the email tag. Spam filtering can also be configured to delete
SMTP email messages identified as spam.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 15
About FortiGate Antivirus Firewalls Introduction
Firewall
The FortiGate ICSA-certified firewall protects your computer networks from Internet
threats. ICSA has granted FortiGate firewalls version 4.0 firewall certification,
providing assurance that FortiGate firewalls successfully screen and secure corporate
networks against a range of threats from public or other untrusted networks.
After basic installation of the FortiGate unit, the firewall allows users on the protected
network to access the Internet while blocking Internet access to internal networks.
You can configure the firewall to put controls on access to the Internet from the
protected networks and to allow controlled access to internal networks.
FortiGate policies include a range of options that:
• control all incoming and outgoing network traffic,
• control encrypted VPN traffic,
• apply antivirus protection and web content filtering,
• block or allow access for all policy options,
• control when individual policies are in effect,
• accept or deny traffic to and from individual addresses,
• control standard and user defined network services individually or in groups,
• require users to authenticate before gaining access,
• include traffic shaping to set access priorities and guarantee or limit bandwidth for
each policy,
• include logging to track connections for individual policies,
• include Network Address Translation (NAT) mode and Route mode policies,
• include mixed NAT and Route mode policies.
The FortiGate firewall can operate in NAT/Route mode or Transparent mode.
NAT/Route mode
In NAT/Route mode, the FortiGate unit is a Layer 3 device. This means that each of its
interfaces is associated with a different IP subnet and that it appears to other devices
as a router. This is how a firewall is normally deployed.
In NAT/Route mode, you can create NAT mode policies and Route mode policies.
• NAT mode policies use network address translation to hide the addresses in a
more secure network from users in a less secure network.
• Route mode policies accept or deny connections between networks without
performing address translation.
Transparent mode
In Transparent mode, the FortiGate unit does not change the Layer 3 topology. This
means that all of its interfaces are on the same IP subnet and that it appears to other
devices as a bridge. Typically, the FortiGate unit is deployed in Transparent mode to
provide antivirus and content filtering behind an existing firewall solution.
16 01-28008-0013-20050204 Fortinet Inc.
Introduction About FortiGate Antivirus Firewalls
Transparent mode provides the same basic firewall protection as NAT mode. The
FortiGate unit passes or blocks the packets it receives according to firewall policies.
The FortiGate unit can be inserted in the network at any point without having to make
changes to your network or its components. However, some advanced firewall
features are available only in NAT/Route mode.
VLANs and virtual domains
Fortigate Antivirus Firewalls support IEEE 802.1Q-compliant virtual LAN (VLAN) tags.
Using VLAN technology, a single FortiGate unit can provide security services to, and
control connections between, multiple security domains according to the VLAN IDs
added to VLAN packets. The FortiGate unit can recognize VLAN IDs and apply
security policies to secure network and IPSec VPN traffic between each security
domain. The FortiGate unit can also apply authentication, content filtering, and
antivirus protection to VLAN-tagged network and VPN traffic.
The FortiGate unit supports VLANs in NAT/Route and Transparent mode. In
NAT/Route mode, you enter VLAN subinterfaces to receive and send VLAN packets.
FortiGate virtual domains provide multiple logical firewalls and routers in a single
FortiGate unit. Using virtual domains, one FortiGate unit can provide exclusive firewall
and routing services to multiple networks so that traffic from each network is
effectively separated from every other network.
You can develop and manage interfaces, VLAN subinterfaces, zones, firewall policies,
routing, and VPN configuration for each virtual domain separately. For these
configuration settings, each virtual domain is functionally similar to a single FortiGate
unit. This separation simplifies configuration because you do not have to manage as
many routes or firewall policies at one time.
Intrusion Prevention System (IPS)
The FortiGate Intrusion Prevention System (IPS) combines signature and anomaly
based intrusion detection and prevention. The FortiGate unit can record suspicious
traffic in logs, can send alert email to system administrators, and can log, pass, drop,
reset, or clear suspicious packets or sessions. Both the IPS predefined signatures and
the IPS engine are upgradeable through the FortiProtect Distribution Network (FDN).
You can also create custom signatures.
VPN
Using FortiGate virtual private networking (VPN), you can provide a secure
connection between widely separated office networks or securely link telecommuters
or travellers to an office network.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 17
About FortiGate Antivirus Firewalls Introduction
FortiGate VPN features include the following:
• Industry standard and ICSA-certified IPSec VPN, including:
• IPSec VPN in NAT/Route and Transparent mode,
• IPSec, ESP security in tunnel mode,
• DES, 3DES (triple-DES), and AES hardware accelerated encryption,
• HMAC MD5 and HMAC SHA1 authentication and data integrity,
• AutoIKE key based on pre-shared key tunnels,
• IPSec VPN using local or CA certificates,
• Manual Keys tunnels,
• Diffie-Hellman groups 1, 2, and 5,
• Aggressive and Main Mode,
• Replay Detection,
• Perfect Forward Secrecy,
• XAuth authentication,
• Dead peer detection,
• DHCP over IPSec,
• Secure Internet browsing.
• PPTP for easy connectivity with the VPN standard supported by the most popular
operating systems.
• L2TP for easy connectivity with a more secure VPN standard, also supported by
many popular operating systems.
• Firewall policy based control of IPSec VPN traffic.
• IPSec NAT traversal so that remote IPSec VPN gateways or clients behind a NAT
can connect to an IPSec VPN tunnel.
• VPN hub and spoke using a VPN concentrator to allow VPN traffic to pass from
one tunnel to another through the FortiGate unit.
• IPSec Redundancy to create a redundant AutoIKE key IPSec VPN connection to a
remote network.
High availability
Fortinet achieves high availability (HA) using redundant hardware and the FortiGate
Clustering Protocol (FGCP). Each FortiGate unit in an HA cluster enforces the same
overall security policy and shares the same configuration settings. You can add up to
32 FortiGate units to an HA cluster. Each FortiGate unit in an HA cluster must be the
same model and must be running the same FortiOS firmware image.
FortiGate HA supports link redundancy and device redundancy.
FortiGate units can be configured to operate in active-passive (A-P) or active-active
(A-A) HA mode. Active-active and active-passive clusters can run in either NAT/Route
or Transparent mode.
An active-passive (A-P) HA cluster, also referred to as hot standby HA, consists of a
primary FortiGate unit that processes traffic, and one or more subordinate FortiGate
units. The subordinate FortiGate units are connected to the network and to the
primary FortiGate unit but do not process traffic.
18 01-28008-0013-20050204 Fortinet Inc.
Introduction About FortiGate Antivirus Firewalls
Active-active (A-A) HA load balances virus scanning among all the FortiGate units in
the cluster. An active-active HA cluster consists of a primary FortiGate unit that
processes traffic and one or more secondary units that also process traffic. The
primary FortiGate unit uses a load balancing algorithm to distribute virus scanning to
all the FortiGate units in the HA cluster.
Secure installation, configuration, and management
The first time you power on the FortiGate unit, it is already configured with default IP
addresses and security policies. Connect to the web-based manager, set the
operating mode, and use the Setup wizard to customize FortiGate IP addresses for
your network, and the FortiGate unit is ready to protect your network. You can then
use the web-based manager to customize advanced FortiGate features.
Web-based manager
Using HTTP or a secure HTTPS connection from any computer running Internet
Explorer, you can configure and manage the FortiGate unit. The web-based manager
supports multiple languages. You can configure the FortiGate unit for HTTP and
HTTPS administration from any FortiGate interface.
You can use the web-based manager to configure most FortiGate settings. You can
also use the web-based manager to monitor the status of the FortiGate unit.
Configuration changes made using the web-based manager are effective immediately
without resetting the firewall or interrupting service. Once you are satisfied with a
configuration, you can download and save it. The saved configuration can be restored
at any time.
Command line interface
You can access the FortiGate command line interface (CLI) by connecting a
management computer serial port to the FortiGate RS-232 serial console connector.
You can also use Telnet or a secure SSH connection to connect to the CLI from any
network that is connected to the FortiGate unit, including the Internet.
The CLI supports the same configuration and monitoring functionality as the
web-based manager. In addition, you can use the CLI for advanced configuration
options that are not available from the web-based manager.
This Administration Guide contains information about basic and advanced CLI
commands. For a more complete description about connecting to and using the
FortiGate CLI, see the FortiGate CLI Reference Guide.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 19
Document conventions Introduction
Logging and reporting
The FortiGate unit supports logging for various categories of traffic and configuration
changes. You can configure logging to:
• report traffic that connects to the firewall,
• report network services used,
• report traffic that was permitted by firewall policies,
• report traffic that was denied by firewall policies,
• report events such as configuration changes and other management events,
IPSec tunnel negotiation, virus detection, attacks, and web page blocking,
• report attacks detected by the IPS,
• send alert email to system administrators to report virus incidents, intrusions, and
firewall or VPN events or violations.
Logs can be sent to a remote syslog server or a WebTrends NetIQ Security Reporting
Center and Firewall Suite server using the WebTrends enhanced log format. Some
models can also save logs to an optional internal hard drive. If a hard drive is not
installed, you can configure most FortiGate units to log the most recent events and
attacks detected by the IPS to the system memory.
Document conventions
This guide uses the following conventions to describe CLI command syntax.
• Angle brackets < > to indicate variables.
For example:
execute restore config <filename_str>
You enter:
execute restore config myfile.bak
<xxx_str> indicates an ASCII string that does not contain new-lines or carriage
returns.
<xxx_integer> indicates an integer string that is a decimal (base 10) number.
<xxx_octet> indicates a hexadecimal string that uses the digits 0-9 and letters
A-F.
<xxx_ipv4> indicates a dotted decimal IPv4 address.
<xxx_v4mask> indicates a dotted decimal IPv4 netmask.
<xxx_ipv4mask> indicates a dotted decimal IPv4 address followed by a dotted
decimal IPv4 netmask.
<xxx_ipv6> indicates a dotted decimal IPv6 address.
<xxx_v6mask> indicates a dotted decimal IPv6 netmask.
<xxx_ipv6mask> indicates a dotted decimal IPv6 address followed by a dotted
decimal IPv6 netmask.
20 01-28008-0013-20050204 Fortinet Inc.
Introduction FortiGate documentation
• Vertical bar and curly brackets {|} to separate alternative, mutually exclusive
required keywords.
For example:
set opmode {nat | transparent}
You can enter set opmode nat or set opmode transparent.
• Square brackets [ ] to indicate that a keyword or variable is optional.
For example:
show system interface [<name_str>]
To show the settings for all interfaces, you can enter show system interface.
To show the settings for the internal interface, you can enter show system
interface internal.
• A space to separate options that can be entered in any combination and must be
separated by spaces.
For example:
set allowaccess {ping https ssh snmp http telnet}
You can enter any of the following:
set allowaccess ping
set allowaccess ping https ssh
set allowaccess https ping ssh
set allowaccess snmp
In most cases to make changes to lists that contain options separated by spaces,
you need to retype the whole list including all the options you want to apply and
excluding all the options you want to remove.
FortiGate documentation
Information about FortiGate products is available from the following guides:
• FortiGate QuickStart Guide
Provides basic information about connecting and installing a FortiGate unit.
• FortiGate Installation Guide
Describes how to install a FortiGate unit. Includes a hardware reference, default
configuration information, installation procedures, connection procedures, and
basic configuration procedures. Choose the guide for your product model number.
• FortiGate Administration Guide
Provides basic information about how to configure a FortiGate unit, including how
to define FortiGate protection profiles and firewall policies; how to apply intrusion
prevention, antivirus protection, web content filtering, and spam filtering; and how
to configure a VPN.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 21
Related documentation Introduction
• FortiGate online help
Provides a context-sensitive and searchable version of the Administration Guide in
HTML format. You can access online help from the web-based manager as you
work.
• FortiGate CLI Reference Guide
Describes how to use the FortiGate CLI and contains a reference to all FortiGate
CLI commands.
• FortiGate Log Message Reference Guide
Describes the structure of FortiGate log messages and provides information about
the log messages that are generated by FortiGate units.
• FortiGate High Availability Guide
Contains in-depth information about the FortiGate high availability feature and the
FortiGate clustering protocol.
• FortiGate IPS Guide
Describes how to configure the FortiGate Intrusion Prevention System settings and
how the FortiGate IPS deals with some common attacks.
• FortiGate VPN Guide
Explains how to configure VPNs using the web-based manager.
Fortinet Knowledge Center
The most recent Fortinet technical documentation is available from the Fortinet
Knowledge Center. The knowledge center contains short how-to articles, FAQs,
technical notes, product and feature guides, and much more. Visit the Fortinet
Knowledge Center at http://kc.forticare.com.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this document, or any
Fortinet technical documentation, to techdoc@fortinet.com.
Related documentation
Additional information about Fortinet products is available from the following related
documentation.
FortiManager documentation
• FortiManager QuickStart Guide
Explains how to install the FortiManager Console, set up the FortiManager Server,
and configure basic settings.
• FortiManager System Administration Guide
Describes how to use the FortiManager System to manage FortiGate devices.
• FortiManager System online help
Provides a searchable version of the Administration Guide in HTML format. You
can access online help from the FortiManager Console as you work.
22 01-28008-0013-20050204 Fortinet Inc.
Introduction Related documentation
FortiClient documentation
• FortiClient Host Security User Guide
Describes how to use FortiClient Host Security software to set up a VPN
connection from your computer to remote networks, scan your computer for
viruses, and restrict access to your computer and applications by setting up firewall
policies.
• FortiClient Host Security online help
Provides information and procedures for using and configuring the FortiClient
software.
FortiMail documentation
• FortiMail Administration Guide
Describes how to install, configure, and manage a FortiMail unit in gateway mode
and server mode, including how to configure the unit; create profiles and policies;
configure antispam and antivirus filters; create user accounts; and set up logging
and reporting.
• FortiMail online help
Provides a searchable version of the Administration Guide in HTML format. You
can access online help from the web-based manager as you work.
• FortiMail Web Mail Online Help
Describes how to use the FortiMail web-based email client, including how to send
and receive email; how to add, import, and export addresses; and how to configure
message display preferences.
FortiLog documentation
• FortiLog Administration Guide
Describes how to install and configure a FortiLog unit to collect FortiGate and
FortiMail log files. It also describes how to view FortiGate and FortiMail log files,
generate and view log reports, and use the FortiLog unit as a NAS server.
• FortiLog online help
Provides a searchable version of the Administration Guide in HTML format. You
can access online help from the web-based manager as you work.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 23
Customer service and technical support Introduction
Customer service and technical support
For antivirus and attack definition updates, firmware updates, updated product
documentation, technical support information, and other resources, please visit the
Fortinet Technical Support web site at http://support.fortinet.com.
You can also register Fortinet products and service contracts from
http://support.fortinet.com and change your registration information at any time.
Technical support is available through email from any of the following addresses.
Choose the email address for your region:
amer_support@fortinet.com For customers in the United States, Canada, Mexico, Latin
apac_support@fortinet.com For customers in Japan, Korea, China, Hong Kong, Singapore,
eu_support@fortinet.com For customers in the United Kingdom, Scandinavia, Mainland
America and South America.
Malaysia, all other Asian countries, and Australia.
Europe, Africa, and the Middle East.
For information about our priority support hotline (live support), see
http://support.fortinet.com.
When requesting technical support, please provide the following information:
• your name
• your company’s name and location
• your email address
• your telephone number
• your support contract number (if applicable)
• the product name and model number
• the product serial number (if applicable)
• the software or firmware version number
• a detailed description of the problem
24 01-28008-0013-20050204 Fortinet Inc.
FortiGate-5000 series Administration Guide Version 2.80 MR8
Web-based manager
Using HTTP or a secure HTTPS connection from any computer running a web
browser, you can configure and manage the FortiGate unit. The web-based manager
supports multiple languages. You can configure the FortiGate unit for HTTP and
HTTPS administration from any FortiGate interface.
Figure 1: Web-based manager screen
You can use the web-based manager to configure most FortiGate settings. You can
also use the web-based manager to monitor the status of the FortiGate unit.
Configuration changes made using the web-based manager are effective immediately
without resetting the firewall or interrupting service. Once you are satisfied with a
configuration, you can back it up. The saved configuration can be restored at any
time.
For information about connecting to the web-based manager, see “Connecting to the
web-based manager” in the Installation Guide for your unit.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 25
Button bar features Web-based manager
This chapter includes:
• Button bar features
• Web-based manager pages
Button bar features
The button bar in the upper right corner of the web-based manager provides access to
several important FortiGate features.
Figure 2: Web-based manager button bar
Contact Customer Support
Online Help
Easy Setup Wizard
Contact Customer Support
The Contact Customer Support button opens the Fortinet support web page in a new
browser window. From this page you can
• Register your FortiGate unit (Product Registration). Fortinet will email you your
username and password to log in to the customer support center.
• Log in to the Customer Support Center.
• Visit the FortiProtect Center.
• Download virus and attack definition updates.
• Find out about training and certification programs.
• Read about Fortinet and its products.
Console Access
Logout
26 01-28008-0013-20050204 Fortinet Inc.
Web-based manager Button bar features
Online Help
The Online Help button opens web-based help for the current web-based manager
page. There are hyperlinks to related topics and procedures related to the controls on
the current web-based manager page.
Figure 3: Online Help window
You can view other parts of the help system as you like. The help system includes a
navigation pane with table of contents, index and a text search function.
Easy Setup Wizard
The FortiGate setup wizard provides an easy way to configure basic initial settings for
the FortiGate unit. The wizard walks through the configuration of a new administrator
password, FortiGate interfaces, DHCP server settings, internal servers (web, FTP,
etc.), and basic antivirus settings. For detailed instructions on the initial setup of your
FortiGate unit, see the Installation Guide for your unit.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 27
Button bar features Web-based manager
Console Access
An alternative to the web-based manager user interface is the text-based command
line interface (CLI). There are some options that are configurable only from the CLI.
The Console Access button opens a Java-based terminal application. The
management computer must have Java version 1.3 or higher installed.
For information on how to use the CLI, see the FortiGate CLI Reference Guide.
Figure 4: Console access
Logout
Connect Connect to the FortiGate unit using the CLI.
Disconnect Disconnect from the FortiGate unit.
Clear screen Clear the screen.
The Logout button immediately logs you out of the web-based manager. Log out
before you close the browser window. If you simply close the browser or leave the
web-based manager, you remain logged-in until the idle timeout (default 5 minutes)
expires.
28 01-28008-0013-20050204 Fortinet Inc.
Web-based manager Web-based manager pages
Web-based manager pages
The web-based manager interface consists of a menu and pages, many of which
have multiple tabs. When you select a menu item, such as System, it expands to
reveal a submenu. When you select one of the submenu items, the associated page
opens at its first tab. To view a different tab, select the tab.
The procedures in this manual direct you to a page by specifying the menu item, the
submenu item and the tab, like this:
1 Go to System > Network > Interface.
Figure 5: Parts of the web-based manager
Menu
Status
bar
Web-based manager menu
Ta bs
Page Button bar
The menu provides access to configuration options for all major features of the
FortiGate unit.
System Configure system facilities, such as network interfaces, virtual domains,
Router Configure the router.
Firewall Configure firewall policies and protection profiles that apply the network
User Configure user accounts for use with firewall policies that require user
VPN Configure virtual private networks.
IPS Configure the intrusion prevention system.
FortiGate-5000 series Administration Guide 01-28008-0013-20050204 29
DHCP services, time and set system options.
protection features. Also configure virtual IP addresses and IP pools.
authentication. Also configure external authentication servers.
Web-based manager pages Web-based manager
Antivirus Configure antivirus protection.
Web Filter Configure web filtering.
Spam Filter Configure email spam filtering.
Log & Report Configure logging. View log messages.
Lists
Many of the web-based manager pages are lists. There are lists of network interfaces,
firewall policies, administrators, users, and so on.
Figure 6: Example of a web-based manager list
Delete
Edit
The list shows some information about each item and the icons in the rightmost
column enable you to take action on the item. In this example, you can select Delete
to remove the item or select Edit to modify the item.
Icons
To add another item to the list, you select Create New. This opens a dialog box in
which you define the new item. The dialog box for creating a new item is similar to the
one for editing an existing item.
The web-based manager has icons in addition to buttons to enable you to interact with
the system. There are tooltips to assist you in understanding the function of the icon.
Pause the mouse pointer over the icon to view the tooltip. The following table
describes the icons that you will see in the web-based manager.
Icon Name Description
Change
Password
Clear Clear a log file.
Column
Settings
Delete Delete an item. This icon appears in lists where the item is
Change the administrator password. This icon appears in the
Administrators list if your access profile enables write permission
on Admin Users.
Select log columns to display.
deletable and you have write permission on the page.
30 01-28008-0013-20050204 Fortinet Inc.
Loading...