FortiGate 800Installation andConfiguration GuideEsc EnterCONSOLEINTERNAL EXTERNAL DMZ HA 1234 USB8PWRFortiGate User Manual Volume 1Version 2.50January
Contents10 Fortinet Inc.IPSec VPN... 231Key
100 Fortinet Inc.Changing the FortiGate firmware System status5 To confirm that the FortiGate unit can connect to the TFTP server, use the following c
System status Changing the FortiGate firmwareFortiGate-800 Installation and Configuration Guide 10111 Enter the firmware image filename and press En
102 Fortinet Inc.Changing the FortiGate firmware System statusTo run this procedure you:• access the CLI by connecting to the FortiGate console port u
System status Changing the FortiGate firmwareFortiGate-800 Installation and Configuration Guide 1039 Type the address of the TFTP server and press E
104 Fortinet Inc.Changing the FortiGate firmware System statusTo install a backup firmware image1 Connect to the CLI using the null-modem cable and Fo
System status Changing the FortiGate firmwareFortiGate-800 Installation and Configuration Guide 105Switching to the backup firmware imageUse this pr
106 Fortinet Inc.Manual virus definition updates System statusSwitching back to the default firmware imageUse this procedure to switch the FortiGate u
System status Manual attack definition updatesFortiGate-800 Installation and Configuration Guide 1074 Type the path and filename for the antivirus d
108 Fortinet Inc.Displaying the FortiGate up time System statusDisplaying the FortiGate up time1 Go to System > Status.The FortiGate up time displa
System status Restoring system settings to factory defaultsFortiGate-800 Installation and Configuration Guide 109Restoring system settings to factor
ContentsFortiGate-800 Installation and Configuration Guide 11Network Intrusion Detection System (NIDS) ...
110 Fortinet Inc.Changing to NAT/Route mode System statusChanging to NAT/Route modeUse the following procedure to change the FortiGate unit from Trans
System status System statusFortiGate-800 Installation and Configuration Guide 111System statusYou can use the system status monitor to display Forti
112 Fortinet Inc.System status System statusFigure 19: CPU and memory status monitorViewing sessions and network statusUse the session and network sta
System status System statusFortiGate-800 Installation and Configuration Guide 1134 Select Refresh to manually update the information displayed.Figur
114 Fortinet Inc.Session list System statusFigure 21: Sessions and network status monitorSession listThe session list displays information about the c
System status Session listFortiGate-800 Installation and Configuration Guide 115Each line of the session list displays the following information.Fig
116 Fortinet Inc.Session list System status
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 117Virus and attack definitions upd
118 Fortinet Inc.Updating antivirus and attack definitions Virus and attack definitions updates and registrationThe Update page on the web-based manag
Virus and attack definitions updates and registration Updating antivirus and attack definitionsFortiGate-800 Installation and Configuration Guide 11
Contents12 Fortinet Inc.URL blocking...
120 Fortinet Inc.Scheduling updates Virus and attack definitions updates and registrationConfiguring update loggingUse the following procedure to conf
Virus and attack definitions updates and registration Scheduling updatesFortiGate-800 Installation and Configuration Guide 1214 Select Apply.The For
122 Fortinet Inc.Enabling push updates Virus and attack definitions updates and registrationEnabling scheduled updates through a proxy serverIf your F
Virus and attack definitions updates and registration Enabling push updatesFortiGate-800 Installation and Configuration Guide 123When the network co
124 Fortinet Inc.Enabling push updates Virus and attack definitions updates and registrationEnabling push updates through a NAT deviceIf the FDN can c
Virus and attack definitions updates and registration Enabling push updatesFortiGate-800 Installation and Configuration Guide 125Figure 24: Example
126 Fortinet Inc.Enabling push updates Virus and attack definitions updates and registrationAdding a port forwarding virtual IP to the FortiGate NAT d
Virus and attack definitions updates and registration Enabling push updatesFortiGate-800 Installation and Configuration Guide 127Figure 25: Push upd
128 Fortinet Inc.Registering FortiGate units Virus and attack definitions updates and registration4 Set IP to the external IP address added to the vir
Virus and attack definitions updates and registration Registering FortiGate unitsFortiGate-800 Installation and Configuration Guide 129All registrati
ContentsFortiGate-800 Installation and Configuration Guide 13Viewing logs saved to memory ...
130 Fortinet Inc.Registering FortiGate units Virus and attack definitions updates and registrationRegistering the FortiGate unitBefore registering a F
Virus and attack definitions updates and registration Updating registration informationFortiGate-800 Installation and Configuration Guide 1314 Selec
132 Fortinet Inc.Updating registration information Virus and attack definitions updates and registrationRecovering a lost Fortinet support passwordIf
Virus and attack definitions updates and registration Updating registration informationFortiGate-800 Installation and Configuration Guide 133Figure
134 Fortinet Inc.Updating registration information Virus and attack definitions updates and registration6 Select the Serial Number of the FortiGate un
Virus and attack definitions updates and registration Updating registration informationFortiGate-800 Installation and Configuration Guide 135Downloa
136 Fortinet Inc.Registering a FortiGate unit after an RMA Virus and attack definitions updates and registrationRegistering a FortiGate unit after an
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 137Network configurationYou can use
138 Fortinet Inc.Configuring interfaces Network configurationAdding zonesThe new zone does not appear in the policy grid until you add an interface to
Network configuration Configuring interfacesFortiGate-800 Installation and Configuration Guide 139Viewing the interface listTo view the interface li
Contents14 Fortinet Inc.
140 Fortinet Inc.Configuring interfaces Network configurationTo add an interface to a zone1 Go to System > Network > Interface.2 Choose the inte
Network configuration Configuring interfacesFortiGate-800 Installation and Configuration Guide 1414 Clear the Retrieve default gateway and DNS from
142 Fortinet Inc.Configuring interfaces Network configuration7 Select Apply. The FortiGate unit attempts to contact the PPPoE server from the interfac
Network configuration Configuring interfacesFortiGate-800 Installation and Configuration Guide 143Controlling administrative access to an interfaceF
144 Fortinet Inc.Configuring interfaces Network configurationChanging the MTU size to improve network performanceTo improve network performance, you c
Network configuration VLAN overviewFortiGate-800 Installation and Configuration Guide 145• Enable secure administrative access to this interface usi
146 Fortinet Inc.VLANs in NAT/Route mode Network configurationIn a typical VLAN configuration, 802.1Q-compliant VLAN layer-2 switches or layer-3 route
Network configuration Virtual domains in Transparent modeFortiGate-800 Installation and Configuration Guide 147Adding VLAN subinterfacesThe VLAN ID
148 Fortinet Inc.Virtual domains in Transparent mode Network configurationTo support VLANs in Transparent mode, you add virtual domains to the FortiGa
Network configuration Virtual domains in Transparent modeFortiGate-800 Installation and Configuration Guide 149Virtual domain propertiesA virtual do
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 15IntroductionFortiGate Antivirus F
150 Fortinet Inc.Virtual domains in Transparent mode Network configurationAdding VLAN subinterfaces to a virtual domainUse the following procedure to
Network configuration Virtual domains in Transparent modeFortiGate-800 Installation and Configuration Guide 151Figure 32: FortiGate unit containing
152 Fortinet Inc.Virtual domains in Transparent mode Network configurationAdding firewall policies for virtual domainsOnce the network configuration f
Network configuration Adding DNS server IP addressesFortiGate-800 Installation and Configuration Guide 153Deleting virtual domains You must remove a
154 Fortinet Inc.Configuring routing Network configurationAdding a default routeYou can add a default route for network traffic leaving the external i
Network configuration Configuring routingFortiGate-800 Installation and Configuration Guide 1556 Set Device #1 to the FortiGate interface or VLAN su
156 Fortinet Inc.Configuring routing Network configuration5 Select OK to save the new route.6 Repeat steps 1 to 5 to add more routes as required.Confi
Network configuration Configuring DHCP servicesFortiGate-800 Installation and Configuration Guide 157Using policy routing you can build a routing po
158 Fortinet Inc.Configuring DHCP services Network configurationConfiguring a DHCP relay agentIn a DHCP relay configuration, the FortiGate unit forwar
Network configuration Configuring DHCP servicesFortiGate-800 Installation and Configuration Guide 159You can add multiple scopes to an interface so
16 Fortinet Inc.Antivirus protection IntroductionAntivirus protectionFortiGate ICSA-certified antivirus protection scans web (HTTP), file transfer (FT
160 Fortinet Inc.Configuring DHCP services Network configurationAdding a reserve IP to a DHCP serverIf you have configured an interface as a DHCP serv
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 161RIP configurationThe FortiGate i
162 Fortinet Inc.RIP settings RIP configuration5 Change the following RIP timer settings, as required.RIP timer defaults are effective in most configu
RIP configuration Configuring RIP for FortiGate interfacesFortiGate-800 Installation and Configuration Guide 163Figure 34: Configuring RIP settingsC
164 Fortinet Inc.Configuring RIP for FortiGate interfaces RIP configuration4 Select OK to save the RIP configuration for the selected interface.Figure
RIP configuration Adding RIP filtersFortiGate-800 Installation and Configuration Guide 165Adding RIP filtersUse the Filter page to create RIP filter
166 Fortinet Inc.Adding RIP filters RIP configuration3 For Filter Name, type a name for the RIP filter list.The name can be 15 characters long and can
RIP configuration Adding RIP filtersFortiGate-800 Installation and Configuration Guide 167Assigning a RIP filter list to the outgoing filterThe outg
168 Fortinet Inc.Adding RIP filters RIP configuration
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 169System configurationUse the Syst
Introduction Email filteringFortiGate-800 Installation and Configuration Guide 17Email filteringFortiGate email filtering can scan all IMAP and POP3
170 Fortinet Inc.Changing system options System configuration9 Select Apply.Figure 36: Example date and time settingChanging system optionsOn the Syst
System configuration Changing system optionsFortiGate-800 Installation and Configuration Guide 1713 Select Apply.Auth Timeout controls the amount of
172 Fortinet Inc.Adding and editing administrator accounts System configurationAdding and editing administrator accountsWhen the FortiGate unit is ini
System configuration Configuring SNMPFortiGate-800 Installation and Configuration Guide 173Editing administrator accountsThe admin account user can
174 Fortinet Inc.Configuring SNMP System configurationRFC support includes support for most of RFC 2665 (Ethernet-like MIB) and most of RFC 1213 (MIB
System configuration Configuring SNMPFortiGate-800 Installation and Configuration Guide 175To configure SNMP community settings1 Go to System > C
176 Fortinet Inc.Configuring SNMP System configurationFigure 37: Sample SNMP configurationFortiGate MIBsThe FortiGate SNMP agent supports FortiGate pr
System configuration Configuring SNMPFortiGate-800 Installation and Configuration Guide 177FortiGate trapsThe FortiGate agent can send traps to up t
178 Fortinet Inc.Configuring SNMP System configurationVPN trapsNIDS trapsAntivirus trapsLogging trapsTable 23: FortiGate VPN trapsTrap message Descrip
System configuration Configuring SNMPFortiGate-800 Installation and Configuration Guide 179Fortinet MIB fieldsThe Fortinet MIB contains fields for c
18 Fortinet Inc.VLANs and virtual domains IntroductionNAT/Route modeIn NAT/Route mode, you can create NAT mode policies and Route mode policies.• NAT
180 Fortinet Inc.Configuring SNMP System configurationUsers and authentication configurationVPN configuration and statusNIDS configurationAntivirus co
System configuration Replacement messagesFortiGate-800 Installation and Configuration Guide 181Logging and reporting configurationReplacement messag
182 Fortinet Inc.Replacement messages System configurationCustomizing replacement messagesEach of the replacement messages in the replacement message
System configuration Replacement messagesFortiGate-800 Installation and Configuration Guide 183Customizing alert emailsCustomize alert emails to con
184 Fortinet Inc.Replacement messages System configuration%%SOURCE_IP%% The IP address from which the block file was received. For email this is the I
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 185Firewall configurationFirewall p
186 Fortinet Inc.Default firewall configuration Firewall configurationThis chapter describes:• Default firewall configuration• Adding firewall policie
Firewall configuration Default firewall configurationFortiGate-800 Installation and Configuration Guide 187InterfacesAdd policies to control connect
188 Fortinet Inc.Default firewall configuration Firewall configurationAddressesTo add policies between interfaces, VLAN subinterfaces, and zones, the
Firewall configuration Adding firewall policiesFortiGate-800 Installation and Configuration Guide 189Content profilesAdd content profiles to policie
Introduction VPNFortiGate-800 Installation and Configuration Guide 19VPNUsing FortiGate virtual private networking (VPN), you can provide a secure c
190 Fortinet Inc.Adding firewall policies Firewall configurationFigure 40: Adding a NAT/Route policyFirewall policy optionsThis section describes the
Firewall configuration Adding firewall policiesFortiGate-800 Installation and Configuration Guide 191DestinationSelect an address or address group t
192 Fortinet Inc.Adding firewall policies Firewall configurationNATConfigure the policy for NAT. NAT translates the source address and the source port
Firewall configuration Adding firewall policiesFortiGate-800 Installation and Configuration Guide 193AuthenticationSelect Authentication and select
194 Fortinet Inc.Adding firewall policies Firewall configurationFigure 41: Adding a Transparent mode policyLog TrafficSelect Log Traffic to write mess
Firewall configuration Configuring policy listsFortiGate-800 Installation and Configuration Guide 195Configuring policy listsThe firewall matches po
196 Fortinet Inc.Configuring policy lists Firewall configurationChanging the order of policies in a policy listTo change the order of a policy in a po
Firewall configuration AddressesFortiGate-800 Installation and Configuration Guide 197AddressesAll policies require source and destination addresses
198 Fortinet Inc.Addresses Firewall configuration6 Enter the Netmask.The netmask corresponds to the type of address that you are adding. For example:•
Firewall configuration AddressesFortiGate-800 Installation and Configuration Guide 199Deleting addressesDeleting an address removes it from an addre
© Copyright 2004 Fortinet Inc. All rights reserved.No part of this publication including text, examples, diagrams or illustrations may be reproduced,t
20 Fortinet Inc.Secure installation, configuration, and management IntroductionSecure installation, configuration, and managementThe first time you po
200 Fortinet Inc.Services Firewall configurationFigure 43: Adding an internal address groupServicesUse services to determine the types of communicatio
Firewall configuration ServicesFortiGate-800 Installation and Configuration Guide 201GRE Generic Routing Encapsulation. A protocol that allows an ar
202 Fortinet Inc.Services Firewall configurationLDAP Lightweight Directory Access Protocol is a set of protocols used to access information directorie
Firewall configuration ServicesFortiGate-800 Installation and Configuration Guide 203Adding custom TCP and UDP servicesAdd a custom TCP or UDP servi
204 Fortinet Inc.Services Firewall configurationAdding custom ICMP servicesAdd a custom ICMP service if you need to create a policy for a service that
Firewall configuration SchedulesFortiGate-800 Installation and Configuration Guide 2053 Type a Group Name to identify the group. This name appears i
206 Fortinet Inc.Schedules Firewall configurationCreating one-time schedulesYou can create a one-time schedule that activates or deactivates a policy
Firewall configuration SchedulesFortiGate-800 Installation and Configuration Guide 207Creating recurring schedulesYou can create a recurring schedul
208 Fortinet Inc.Virtual IPs Firewall configurationAdding schedules to policiesAfter you create schedules, you can add them to policies to schedule wh
Firewall configuration Virtual IPsFortiGate-800 Installation and Configuration Guide 209This section describes:• Adding static NAT virtual IPs• Addi
Introduction Secure installation, configuration, and managementFortiGate-800 Installation and Configuration Guide 21Command line interfaceYou can acc
210 Fortinet Inc.Virtual IPs Firewall configuration7 In Map to IP, type the real IP address on the destination network, for example, the IP address of
Firewall configuration Virtual IPsFortiGate-800 Installation and Configuration Guide 2116 Enter the External IP Address that you want to map to an a
212 Fortinet Inc.Virtual IPs Firewall configurationFigure 48: Adding a port forwarding virtual IPAdding policies with virtual IPsUse the following pro
Firewall configuration IP poolsFortiGate-800 Installation and Configuration Guide 2134 Select OK to save the policy.IP poolsAn IP pool (also called
214 Fortinet Inc.IP/MAC binding Firewall configurationFigure 49: Adding an IP PoolIP Pools for firewall policies that use fixed portsSome network conf
Firewall configuration IP/MAC bindingFortiGate-800 Installation and Configuration Guide 215You can enter the static IP addresses and corresponding M
216 Fortinet Inc.IP/MAC binding Firewall configurationFor example, if the IP/MAC pair IP 1.1.1.1 and 12:34:56:78:90:ab:cd is added to the IP/MAC bindi
Firewall configuration IP/MAC bindingFortiGate-800 Installation and Configuration Guide 2173 Enter the IP Address and the MAC Address.You can bind m
218 Fortinet Inc.Content profiles Firewall configurationFigure 50: IP/MAC settingsContent profilesUse content profiles to apply different protection s
Firewall configuration Content profilesFortiGate-800 Installation and Configuration Guide 219Default content profilesThe FortiGate unit has the foll
22 Fortinet Inc.Document conventions IntroductionDocument conventionsThis guide uses the following conventions to describe CLI command syntax.• angle
220 Fortinet Inc.Content profiles Firewall configuration6 Enable the email filter protection options that you want.7 Enable the fragmented email and o
Firewall configuration Content profilesFortiGate-800 Installation and Configuration Guide 221Adding content profiles to policiesYou can add content
222 Fortinet Inc.Content profiles Firewall configuration
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 223Users and authenticationFortiGat
224 Fortinet Inc.Setting authentication timeout Users and authenticationThis chapter describes:• Setting authentication timeout• Adding user names and
Users and authentication Adding user names and configuring authenticationFortiGate-800 Installation and Configuration Guide 2255 Select the Try othe
226 Fortinet Inc.Configuring RADIUS support Users and authenticationConfiguring RADIUS supportIf you have configured RADIUS support and a user is requ
Users and authentication Configuring LDAP supportFortiGate-800 Installation and Configuration Guide 227Configuring LDAP supportIf you have configure
228 Fortinet Inc.Configuring LDAP support Users and authentication7 Enter the distinguished name used to look up entries on the LDAP server.Enter the
Users and authentication Configuring user groupsFortiGate-800 Installation and Configuration Guide 229Configuring user groupsTo enable authenticatio
Introduction Customer service and technical supportFortiGate-800 Installation and Configuration Guide 23• Volume 4: FortiGate NIDS GuideDescribes ho
230 Fortinet Inc.Configuring user groups Users and authenticationFigure 55: Adding a user group3 Enter a Group Name to identify the user group.The nam
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 231IPSec VPNA Virtual Private Netwo
232 Fortinet Inc.Key management IPSec VPNKey managementThere are three basic elements in any encryption system:• an algorithm that changes information
IPSec VPN Manual key IPSec VPNsFortiGate-800 Installation and Configuration Guide 233In some respects, certificates are simpler to manage than manua
234 Fortinet Inc.Manual key IPSec VPNs IPSec VPN5 Enter the Remote SPI. The Remote Security Parameter Index is a hexadecimal number of up to eight dig
IPSec VPN AutoIKE IPSec VPNsFortiGate-800 Installation and Configuration Guide 235AutoIKE IPSec VPNsFortiGate units support two methods of Automatic
236 Fortinet Inc.AutoIKE IPSec VPNs IPSec VPN3 Type a Gateway Name for the remote VPN peer.The remote VPN peer can be either a gateway to another netw
IPSec VPN AutoIKE IPSec VPNsFortiGate-800 Installation and Configuration Guide 23710 Configure the Local ID the that the FortiGate unit sends to the
238 Fortinet Inc.AutoIKE IPSec VPNs IPSec VPN4 Optionally, configure NAT Traversal.5 Optionally, configure Dead Peer Detection.Use these settings to m
IPSec VPN AutoIKE IPSec VPNsFortiGate-800 Installation and Configuration Guide 239Figure 56: Adding a phase 1 configuration (Standard options)Figure
24 Fortinet Inc.Customer service and technical support Introduction
240 Fortinet Inc.AutoIKE IPSec VPNs IPSec VPNAdding a phase 2 configuration for an AutoIKE VPNAdd a phase 2 configuration to specify the parameters us
IPSec VPN AutoIKE IPSec VPNsFortiGate-800 Installation and Configuration Guide 24110 Enable Autokey Keep Alive if you want to keep the VPN tunnel ru
242 Fortinet Inc.Managing digital certificates IPSec VPNManaging digital certificatesUse digital certificates to make sure that both participants in a
IPSec VPN Managing digital certificatesFortiGate-800 Installation and Configuration Guide 2436 Configure the key.7 Select OK to generate the private
244 Fortinet Inc.Managing digital certificates IPSec VPNDownloading the certificate requestUse the following procedure to download a certificate reque
IPSec VPN Configuring encrypt policiesFortiGate-800 Installation and Configuration Guide 245Obtaining CA certificatesFor the VPN peers to authentica
246 Fortinet Inc.Configuring encrypt policies IPSec VPNIn addition to defining membership in the VPN by address, you can configure the encrypt policy
IPSec VPN Configuring encrypt policiesFortiGate-800 Installation and Configuration Guide 247Adding a destination addressThe destination address can
248 Fortinet Inc.Configuring encrypt policies IPSec VPNFor information about configuring the remaining policy settings, see “Adding firewall policies”
IPSec VPN IPSec VPN concentratorsFortiGate-800 Installation and Configuration Guide 249Figure 60: Adding an encrypt policyIPSec VPN concentrators In
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 25Getting startedThis chapter descr
250 Fortinet Inc.IPSec VPN concentrators IPSec VPNIf the VPN peer is one of the spokes, it requires a tunnel connecting it to the hub (but not to the
IPSec VPN IPSec VPN concentratorsFortiGate-800 Installation and Configuration Guide 251See “Adding an encrypt policy” on page 247.5 Arrange the poli
252 Fortinet Inc.IPSec VPN concentrators IPSec VPNVPN spoke general configuration stepsA remote VPN peer that functions as a spoke requires the follow
IPSec VPN Redundant IPSec VPNsFortiGate-800 Installation and Configuration Guide 253See “Adding an encrypt policy” on page 247.6 Arrange the policie
254 Fortinet Inc.Redundant IPSec VPNs IPSec VPNConfiguring redundant IPSec VPNsPrior to configuring the VPN, make sure that both FortiGate units have
IPSec VPN Monitoring and Troubleshooting VPNsFortiGate-800 Installation and Configuration Guide 255Monitoring and Troubleshooting VPNs• Viewing VPN
256 Fortinet Inc.Monitoring and Troubleshooting VPNs IPSec VPNFigure 63: Dialup MonitorTesting a VPNTo confirm that a VPN between two networks has bee
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 257PPTP and L2TP VPNYou can use PPT
258 Fortinet Inc.Configuring PPTP PPTP and L2TP VPNConfiguring the FortiGate unit as a PPTP gatewayUse the following procedures to configure the Forti
PPTP and L2TP VPN Configuring PPTPFortiGate-800 Installation and Configuration Guide 2593 Select New to add an address.4 Enter the Address Name, IP
26 Fortinet Inc.Package contents Getting startedPackage contentsThe FortiGate-800 package contains the following items:• FortiGate-800 Antivirus Firew
260 Fortinet Inc.Configuring PPTP PPTP and L2TP VPN6 Set Service to match the traffic type inside the PPTP VPN tunnel. For example, if PPTP users can
PPTP and L2TP VPN Configuring PPTPFortiGate-800 Installation and Configuration Guide 261To connect to the PPTP VPN1 Start the dialup connection that
262 Fortinet Inc.Configuring PPTP PPTP and L2TP VPN5 Name the connection and select Next. 6 If the Public Network dialog box appears, choose the appro
PPTP and L2TP VPN Configuring L2TPFortiGate-800 Installation and Configuration Guide 263Configuring L2TPSome implementations of L2TP support element
264 Fortinet Inc.Configuring L2TP PPTP and L2TP VPNFigure 65: Sample L2TP address range configurationTo add source addressesAdd a source address for e
PPTP and L2TP VPN Configuring L2TPFortiGate-800 Installation and Configuration Guide 2656 Select OK to add the address group.To add a destination ad
266 Fortinet Inc.Configuring L2TP PPTP and L2TP VPN7 In the Connect window, select Properties.8 Select the Security tab.9 Make sure that Require data
PPTP and L2TP VPN Configuring L2TPFortiGate-800 Installation and Configuration Guide 2674 In the connect window, enter the User Name and Password th
268 Fortinet Inc.Configuring L2TP PPTP and L2TP VPNTo disable IPSec1 Select the Networking tab.2 Select Internet Protocol (TCP/IP) properties.3 Double
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 269Network Intrusion Detection Syst
Getting started Powering onFortiGate-800 Installation and Configuration Guide 27Power requirements• Power dissipation: 300 W (max)• AC input voltage
270 Fortinet Inc.Detecting attacks Network Intrusion Detection System (NIDS)Selecting the interfaces to monitorTo select the interfaces to monitor for
Network Intrusion Detection System (NIDS) Detecting attacksFortiGate-800 Installation and Configuration Guide 271Viewing the signature listYou can d
272 Fortinet Inc.Detecting attacks Network Intrusion Detection System (NIDS)Figure 67: Example signature group members listDisabling NIDS attack signa
Network Intrusion Detection System (NIDS) Detecting attacksFortiGate-800 Installation and Configuration Guide 273To add user-defined signatures1 Go
274 Fortinet Inc.Preventing attacks Network Intrusion Detection System (NIDS)Preventing attacksNIDS attack prevention protects the FortiGate unit and
Network Intrusion Detection System (NIDS) Preventing attacksFortiGate-800 Installation and Configuration Guide 275Setting signature threshold values
276 Fortinet Inc.Logging attacks Network Intrusion Detection System (NIDS)To set Prevention signature threshold values1 Go to NIDS > Prevention.2 S
Network Intrusion Detection System (NIDS) Logging attacksFortiGate-800 Installation and Configuration Guide 277The FortiGate unit uses an alert emai
278 Fortinet Inc.Logging attacks Network Intrusion Detection System (NIDS)
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 279Antivirus protectionYou can enab
28 Fortinet Inc.Connecting to the web-based manager Getting startedConnecting to the web-based managerUse the following procedure to connect to the we
280 Fortinet Inc.Antivirus scanning Antivirus protection6 Configure the FortiGate unit to send an alert email when it blocks or deletes an infected fi
Antivirus protection File blockingFortiGate-800 Installation and Configuration Guide 281Figure 69: Example content profile for virus scanningFile bl
282 Fortinet Inc.File blocking Antivirus protectionBy default, when blocking is enabled, the FortiGate unit blocks the following file patterns:• execu
Antivirus protection QuarantineFortiGate-800 Installation and Configuration Guide 283QuarantineFortiGate units with a hard disk can quarantine block
284 Fortinet Inc.Quarantine Antivirus protection5 Add this content profile to firewall policies.See “Adding content profiles to policies” on page 221.
Antivirus protection QuarantineFortiGate-800 Installation and Configuration Guide 285Filtering the quarantine listYou can filter the quarantine list
286 Fortinet Inc.Blocking oversized files and emails Antivirus protection3 Type the Age Limit (TTL) in hours to specify how long files are left in qua
Antivirus protection Exempting fragmented email from blockingFortiGate-800 Installation and Configuration Guide 287Exempting fragmented email from b
288 Fortinet Inc.Viewing the virus list Antivirus protection
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 289Web filteringWhen you enable Ant
Getting started Connecting to the command line interface (CLI)FortiGate-800 Installation and Configuration Guide 29Connecting to the command line in
290 Fortinet Inc.Content blocking Web filtering3 Configure web filtering settings to control how the FortiGate unit applies web filtering to the HTTP
Web filtering Content blockingFortiGate-800 Installation and Configuration Guide 2914 Type a banned word or phrase.If you type a single word (for ex
292 Fortinet Inc.Content blocking Web filteringBacking up the Banned Word listYou can back up the banned word list by downloading it to a text file on
Web filtering URL blockingFortiGate-800 Installation and Configuration Guide 2935 Select Return to display the updated Banned Word List.6 You can co
294 Fortinet Inc.URL blocking Web filtering4 Ensure that the Enable checkbox has been selected and then select OK.5 Select OK to add the URL to the We
Web filtering URL blockingFortiGate-800 Installation and Configuration Guide 295Downloading the Web URL block listYou can back up the Web URL block
296 Fortinet Inc.Configuring Cerberian URL filtering Web filtering8 You can continue to maintain the Web URL block list by making changes to the text
Web filtering Configuring Cerberian URL filteringFortiGate-800 Installation and Configuration Guide 297Installing a Cerberian license keyBefore you
298 Fortinet Inc.Configuring Cerberian URL filtering Web filteringYou can add users to the default group and apply any policies to the group.Use the d
Web filtering Script filteringFortiGate-800 Installation and Configuration Guide 299Script filteringYou can configure the FortiGate unit to remove J
ContentsFortiGate-800 Installation and Configuration Guide 3Table of ContentsIntroduction ...
30 Fortinet Inc.Factory default FortiGate configuration settings Getting startedFactory default FortiGate configuration settingsThe FortiGate unit is
300 Fortinet Inc.Exempt URL list Web filteringExempt URL listAdd URLs to the exempt URL list to allow legitimate traffic that might otherwise be block
Web filtering Exempt URL listFortiGate-800 Installation and Configuration Guide 301Figure 75: Example URL Exempt listDownloading the URL Exempt List
302 Fortinet Inc.Exempt URL list Web filtering3 Select Upload URL Exempt List .4 Type the path and filename of your URL Exempt List text file, or sel
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 303Email filterEmail filtering is e
304 Fortinet Inc.Email banned word list Email filterEmail banned word listWhen the FortiGate unit detects an email that contains a word or phrase in t
Email filter Email banned word listFortiGate-800 Installation and Configuration Guide 305Downloading the email banned word listYou can back up the b
306 Fortinet Inc.Email block list Email filterEmail block listYou can configure the FortiGate unit to tag all IMAP and POP3 protocol traffic sent from
Email filter Email exempt listFortiGate-800 Installation and Configuration Guide 307Uploading an email block listYou can create a email block list i
308 Fortinet Inc.Adding a subject tag Email filterAdding address patterns to the email exempt listTo add an address pattern to the email exempt list1
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 309Logging and reportingYou can con
Getting started Factory default FortiGate configuration settingsFortiGate-800 Installation and Configuration Guide 31Factory default Transparent mod
310 Fortinet Inc.Recording logs Logging and reportingRecording logs on a remote computerYou can configure the FortiGate unit to record log messages on
Logging and reporting Recording logsFortiGate-800 Installation and Configuration Guide 3115 Select Config Policy.To configure the FortiGate unit to
312 Fortinet Inc.Recording logs Logging and reportingRecording logs in system memoryIf your FortiGate unit does not contain a hard disk, you can confi
Logging and reporting Filtering log messagesFortiGate-800 Installation and Configuration Guide 313Filtering log messagesYou can configure the logs t
314 Fortinet Inc.Configuring traffic logging Logging and reportingFigure 79: Example log filter configurationConfiguring traffic loggingYou can config
Logging and reporting Configuring traffic loggingFortiGate-800 Installation and Configuration Guide 315Enabling traffic loggingYou can enable loggin
316 Fortinet Inc.Configuring traffic logging Logging and reportingConfiguring traffic filter settingsYou can configure the information recorded in all
Logging and reporting Viewing logs saved to memoryFortiGate-800 Installation and Configuration Guide 3174 Select OK.The traffic filter list displays
318 Fortinet Inc.Viewing and managing logs saved to the hard disk Logging and reporting4 To view a specific line in the log, type a line number in the
Logging and reporting Viewing and managing logs saved to the hard diskFortiGate-800 Installation and Configuration Guide 319Viewing logsLog messages
32 Fortinet Inc.Factory default FortiGate configuration settings Getting startedFactory default firewall configurationThe factory default firewall con
320 Fortinet Inc.Viewing and managing logs saved to the hard disk Logging and reportingDownloading a log file to the management computerYou can downlo
Logging and reporting Configuring alert emailFortiGate-800 Installation and Configuration Guide 321Configuring alert emailYou can configure the Fort
322 Fortinet Inc.Configuring alert email Logging and reportingEnabling alert emailYou can configure the FortiGate unit to send alert email in response
FortiGate-800 Installation and Configuration Guide 323FortiGate-800 Installation and Configuration Guide Version 2.50GlossaryConnection: A link betwe
324 Fortinet Inc.GlossaryLAN, Local Area Network: A computer network that spans a relatively small area. Most LANs connect workstations and personal c
GlossaryFortiGate-800 Installation and Configuration Guide 325SSH, Secure shell: A secure Telnet replacement that you can use to log into another c
326 Fortinet Inc.Glossary
FortiGate-800 Installation and Configuration Guide 327FortiGate-800 Installation and Configuration Guide Version 2.50IndexAacceptpolicy 191actionpoli
328 Fortinet Inc.Indexattack updatesconfiguring 121scheduling 120through a proxy server 122authentication 193, 223configuring 224enabling 229LDAP serv
IndexFortiGate-800 Installation and Configuration Guide 329DHCPadding a DHCP server to an interface 158adding a reserved IP to a DHCP server 160add
Getting started Factory default FortiGate configuration settingsFortiGate-800 Installation and Configuration Guide 33Factory default content profile
330 Fortinet Inc.IndexFortiResponse Distribution Network 118connecting to 118FortiResponse Distribution Server 118from IPsystem status 115from portsys
IndexFortiGate-800 Installation and Configuration Guide 331IPSec VPNauthentication for user group 229AutoIKE 232certificates 232disabling 266, 268m
332 Fortinet Inc.IndexmodeTransparent 18monitorsystem status 114monitored interfaces 270monitoringsystem status 111MTU size 144changing 144definition
IndexFortiGate-800 Installation and Configuration Guide 333PPTP dialup connectionconfiguring Windows 2000 client 261configuring Windows 98 client 2
334 Fortinet Inc.Indexschedule 205applying to policy 208automatic antivirus and attack definition updates 120creating one-time 206creating recurring 2
IndexFortiGate-800 Installation and Configuration Guide 335system settingsbacking up 108restoring 108restoring to factory default 109system status
336 Fortinet Inc.Indexviewingdialup connection status 255logs 318, 319logs saved to memory 317VPN tunnel status 255virtual domainadding 149adding a VL
34 Fortinet Inc.Factory default FortiGate configuration settings Getting startedScan content profileUse the scan content profile to apply antivirus sc
Getting started Factory default FortiGate configuration settingsFortiGate-800 Installation and Configuration Guide 35Web content profileUse the web
36 Fortinet Inc.Planning the FortiGate configuration Getting startedPlanning the FortiGate configurationBefore you configure the FortiGate unit, you n
Getting started Planning the FortiGate configurationFortiGate-800 Installation and Configuration Guide 37NAT/Route mode with multiple external netwo
38 Fortinet Inc.Planning the FortiGate configuration Getting startedFigure 6: Example Transparent mode network configurationYou can connect up to 8 ne
Getting started FortiGate model maximum values matrixFortiGate-800 Installation and Configuration Guide 39Front keypad and LCDIf you are configuring
Contents4 Fortinet Inc.NAT/Route mode installation... 41Preparing to conf
40 Fortinet Inc.Next steps Getting startedNext stepsNow that your FortiGate unit is operating, you can proceed to configure it to connect to networks:
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 41NAT/Route mode installationThis c
42 Fortinet Inc.Preparing to configure NAT/Route mode NAT/Route mode installationAdvanced NAT/Route mode settingsUse Tab le 11 to gather the informat
NAT/Route mode installation Using the setup wizardFortiGate-800 Installation and Configuration Guide 43DMZ and user-defined interfacesUse Tab le 12
44 Fortinet Inc.Using the front control buttons and LCD NAT/Route mode installationUsing the front control buttons and LCDAs an alternative to the set
NAT/Route mode installation Using the command line interfaceFortiGate-800 Installation and Configuration Guide 453 Set the IP address and netmask of
46 Fortinet Inc.Connecting the FortiGate unit to your networks NAT/Route mode installation9 Set the default route to the Default Gateway IP address (n
NAT/Route mode installation Connecting the FortiGate unit to your networksFortiGate-800 Installation and Configuration Guide 47Figure 7: FortiGate-8
48 Fortinet Inc.Configuring your networks NAT/Route mode installationFigure 8: Example FortiGate-800 user-defined interface connectionsConfiguring you
NAT/Route mode installation Completing the configurationFortiGate-800 Installation and Configuration Guide 49Completing the configurationUse the inf
ContentsFortiGate-800 Installation and Configuration Guide 5Transparent mode configuration examples...
50 Fortinet Inc.Configuration example: Multiple connections to the Internet NAT/Route mode installationRegistering your FortiGate unitAfter purchasing
NAT/Route mode installation Configuration example: Multiple connections to the InternetFortiGate-800 Installation and Configuration Guide 51Figure 9
52 Fortinet Inc.Configuration example: Multiple connections to the Internet NAT/Route mode installationUsing the CLI1 Add a ping server to the externa
NAT/Route mode installation Configuration example: Multiple connections to the InternetFortiGate-800 Installation and Configuration Guide 53Load sha
54 Fortinet Inc.Configuration example: Multiple connections to the Internet NAT/Route mode installation3 Select New to add a route for connections to
NAT/Route mode installation Configuration example: Multiple connections to the InternetFortiGate-800 Installation and Configuration Guide 55Policy r
56 Fortinet Inc.Configuration example: Multiple connections to the Internet NAT/Route mode installationFirewall policy exampleFirewall policies contro
NAT/Route mode installation Configuration example: Multiple connections to the InternetFortiGate-800 Installation and Configuration Guide 57Restrict
58 Fortinet Inc.Configuration example: Multiple connections to the Internet NAT/Route mode installation
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 59Transparent mode installationThis
Contents6 Fortinet Inc.Displaying the FortiGate up time... 108Disp
60 Fortinet Inc.Using the setup wizard Transparent mode installationUsing the setup wizardFrom the web-based manager, you can use the setup wizard to
Transparent mode installation Using the front control buttons and LCDFortiGate-800 Installation and Configuration Guide 61Using the front control bu
62 Fortinet Inc.Completing the configuration Transparent mode installationConfiguring the Transparent mode management IP address1 Make sure that you a
Transparent mode installation Connecting the FortiGate unit to your networksFortiGate-800 Installation and Configuration Guide 63Registering your Fo
64 Fortinet Inc.Transparent mode configuration examples Transparent mode installationFigure 10: FortiGate-800 Transparent mode connectionsTransparent
Transparent mode installation Transparent mode configuration examplesFortiGate-800 Installation and Configuration Guide 65This section describes:• D
66 Fortinet Inc.Transparent mode configuration examples Transparent mode installationFigure 11: Default route to an external networkGeneral configura
Transparent mode installation Transparent mode configuration examplesFortiGate-800 Installation and Configuration Guide 67Web-based manager example
68 Fortinet Inc.Transparent mode configuration examples Transparent mode installationFigure 12: Static route to an external destinationGeneral configu
Transparent mode installation Transparent mode configuration examplesFortiGate-800 Installation and Configuration Guide 692 Go to System > Networ
ContentsFortiGate-800 Installation and Configuration Guide 7Network configuration...
70 Fortinet Inc.Transparent mode configuration examples Transparent mode installationFigure 13: Static route to an internal destinationGeneral configu
Transparent mode installation Transparent mode configuration examplesFortiGate-800 Installation and Configuration Guide 71Web-based manager example
72 Fortinet Inc.Transparent mode configuration examples Transparent mode installation
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 73High availabilityFortinet achieve
74 Fortinet Inc.Configuring an HA cluster High availabilityAn active-passive (A-P) HA cluster, also referred to as hot standby HA, consists of a prima
High availability Configuring an HA clusterFortiGate-800 Installation and Configuration Guide 756 Select the HA mode.Select Active-Active mode to cr
76 Fortinet Inc.Configuring an HA cluster High availabilityFigure 14: Example Active-Active HA configuration11 If you are configuring a NAT/Route mode
High availability Configuring an HA clusterFortiGate-800 Installation and Configuration Guide 77Inserting an HA cluster into your network temporaril
78 Fortinet Inc.Managing an HA cluster High availability2 Power on all the FortiGate units in the cluster.As the units power on they negotiate to choo
High availability Managing an HA clusterFortiGate-800 Installation and Configuration Guide 79You can also use SNMP to manage the cluster by configur
Contents8 Fortinet Inc.Adding RIP filters ...
80 Fortinet Inc.Managing an HA cluster High availabilityTo monitor cluster interfaces1 Connect to the cluster and log into the web-based manager.2 Go
High availability Managing an HA clusterFortiGate-800 Installation and Configuration Guide 813 Select Sessions & Network.The cluster displays se
82 Fortinet Inc.Managing an HA cluster High availabilityViewing cluster sessionsTo view the cluster communication sessions1 Connect to the cluster and
High availability Managing an HA clusterFortiGate-800 Installation and Configuration Guide 83Monitoring cluster units for failoverIf the primary uni
84 Fortinet Inc.Managing an HA cluster High availabilityTo manage a cluster unit1 Use SSH to connect to the cluster and log into the CLI.Connect to an
High availability Managing an HA clusterFortiGate-800 Installation and Configuration Guide 85Synchronizing the cluster configurationCluster synchron
86 Fortinet Inc.Managing an HA cluster High availability4 Repeat steps 2 and 3 for all the subordinate units in the HA cluster.Upgrading firmwareTo up
High availability Advanced HA optionsFortiGate-800 Installation and Configuration Guide 87Replacing a FortiGate unit after failoverA failover can oc
88 Fortinet Inc.Advanced HA options High availabilityset system ha override enableEnable override so that the permanent primary unit overrides any oth
High availability Active-Active cluster packet flowFortiGate-800 Installation and Configuration Guide 89Weight values are entered in order according
ContentsFortiGate-800 Installation and Configuration Guide 9Services ...
90 Fortinet Inc.Active-Active cluster packet flow High availabilityNAT/Route mode packet flowIn NAT/Route mode, five MAC addresses are involved in act
High availability Active-Active cluster packet flowFortiGate-800 Installation and Configuration Guide 91The following are examples of switches that
92 Fortinet Inc.Active-Active cluster packet flow High availability
FortiGate-800 Installation and Configuration Guide Version 2.50FortiGate-800 Installation and Configuration Guide 93System statusYou can connect to t
94 Fortinet Inc.Changing the FortiGate host name System statusChanging the FortiGate host nameThe FortiGate host name appears on the Status page and i
System status Changing the FortiGate firmwareFortiGate-800 Installation and Configuration Guide 95Upgrading to a new firmware versionUse the followi
96 Fortinet Inc.Changing the FortiGate firmware System status4 Make sure the FortiGate unit can connect to the TFTP server.You can use the following c
System status Changing the FortiGate firmwareFortiGate-800 Installation and Configuration Guide 97If you are reverting to a previous FortiOS version
98 Fortinet Inc.Changing the FortiGate firmware System statusIf you are reverting to a previous FortiOS version (for example, reverting from FortiOS v
System status Changing the FortiGate firmwareFortiGate-800 Installation and Configuration Guide 9911 Update antivirus and attack definitions. For in
Comments to this Manuals