Fortinet FortiGate-50A Instruction Manual

FortiGate 50A Administration Guide
INTERNAL EXTERNAL
LINK 100 LINK 100
PWR STATUS
A
FortiGate-50A Administration Guide
Version 2.80 MR6
5 November 2004
01-28006-0001-20041105

© Copyright 2004 Fortinet Inc. All rights reserved.
No part of this publication including text, examples, diagrams or illustrations may be reproduced,
transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or
otherwise, for any purpose, without prior written permission of Fortinet Inc.
FortiGate-50A Administration Guide
Version 2.80 MR6
5 November 2004
01-28006-0001-20041105
Trademarks
Products mentioned in this document are trademarks or registered trademarks of their respective
holders.
Regulatory Compliance
FCC Class A Part 15 CSA/CUS
CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE.
DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS.
For technical support, please visit http://www.fortinet.com.
Send information about errors or omissions in this document or any Fortinet technical documentation to
[e-mail].

Contents
FortiGate-50A Administration Guide 01-28006-0001-20041105 3
Table of Contents
Introduction.......................................................................................................... 13
About FortiGate Antivirus Firewalls................................................................................... 13
Antivirus protection ....................................................................................................... 14
Web content filtering ..................................................................................................... 14
Spam filtering ................................................................................................................ 15
Firewall.......................................................................................................................... 15
VLANs and virtual domains........................................................................................... 16
Intrusion Prevention System (IPS)................................................................................ 16
VPN............................................................................................................................... 17
Secure installation, configuration, and management .................................................... 17
Document conventions ..................................................................................................... 19
FortiGate documentation .................................................................................................. 20
Comments on Fortinet technical documentation........................................................... 20
Related documentation ..................................................................................................... 21
FortiManager documentation ........................................................................................ 21
FortiClient documentation ............................................................................................. 21
FortiMail documentation................................................................................................ 21
FortiLog documentation ................................................................................................ 22
Customer service and technical support........................................................................... 23
System status....................................................................................................... 25
Console access................................................................................................................. 25
Status................................................................................................................................ 26
Viewing system status .................................................................................................. 26
Changing unit information ............................................................................................. 29
Session list........................................................................................................................ 31
Changing the FortiGate firmware...................................................................................... 32
Upgrading to a new firmware version ........................................................................... 32
Reverting to a previous firmware version...................................................................... 34
Installing firmware images from a system reboot using the CLI ................................... 37
Testing a new firmware image before installing it ......................................................... 40
System network ................................................................................................... 43
Interface............................................................................................................................ 43
Interface settings........................................................................................................... 44
Configuring interfaces ................................................................................................... 49
Zone.................................................................................................................................. 53
Zone settings ................................................................................................................ 54
Management..................................................................................................................... 55
DNS .................................................................................................................................. 56

Contents
401-28006-0001-20041105 Fortinet Inc.
Routing table (Transparent Mode).................................................................................... 57
Routing table list ........................................................................................................... 57
Transparent mode route settings .................................................................................. 58
Configuring the modem interface...................................................................................... 59
Connecting a modem to the FortiGate unit ................................................................... 59
Configuring modem settings ......................................................................................... 60
Connecting and disconnecting the modem................................................................... 61
Backup mode configuration .......................................................................................... 61
Standalone mode configuration .................................................................................... 62
Adding firewall policies for modem connections ........................................................... 63
VLAN overview ................................................................................................................. 63
FortiGate units and VLANs ........................................................................................... 64
VLANs in NAT/Route mode .............................................................................................. 64
Rules for VLAN IDs....................................................................................................... 65
Rules for VLAN IP addresses ....................................................................................... 65
Adding VLAN subinterfaces .......................................................................................... 66
VLANs in Transparent mode............................................................................................. 67
Rules for VLAN IDs....................................................................................................... 69
Transparent mode virtual domains and VLANs ............................................................ 69
Transparent mode VLAN list......................................................................................... 70
Transparent mode VLAN settings................................................................................. 70
FortiGate IPv6 support...................................................................................................... 72
System DHCP ....................................................................................................... 73
Service.............................................................................................................................. 73
DHCP service settings .................................................................................................. 74
Server ............................................................................................................................... 75
DHCP server settings ................................................................................................... 76
Exclude range................................................................................................................... 77
DHCP exclude range settings....................................................................................... 78
IP/MAC binding................................................................................................................. 78
DHCP IP/MAC binding settings .................................................................................... 79
Dynamic IP........................................................................................................................ 79
System config ...................................................................................................... 81
System time ...................................................................................................................... 81
Options.............................................................................................................................. 82
SNMP................................................................................................................................ 84
Configuring SNMP ........................................................................................................ 85
SNMP community ......................................................................................................... 85
FortiGate MIBs.............................................................................................................. 88
FortiGate traps .............................................................................................................. 88
Fortinet MIB fields ......................................................................................................... 90

Contents
FortiGate-50A Administration Guide 01-28006-0001-20041105 5
Replacement messages ................................................................................................... 92
Replacement messages list .......................................................................................... 93
Changing replacement messages ................................................................................ 94
FortiManager..................................................................................................................... 95
System administration ........................................................................................ 97
Administrators................................................................................................................... 97
Administrators list.......................................................................................................... 98
Administrators options .................................................................................................. 98
Access profiles.................................................................................................................. 99
Access profile list ........................................................................................................ 100
Access profile options ................................................................................................. 100
System maintenance ......................................................................................... 103
Backup and restore......................................................................................................... 103
Backing up and Restoring........................................................................................... 104
Update center ................................................................................................................. 106
Updating antivirus and attack definitions .................................................................... 108
Enabling push updates ............................................................................................... 111
Support ........................................................................................................................... 113
Sending a bug report .................................................................................................. 114
Registering a FortiGate unit ........................................................................................ 115
Shutdown........................................................................................................................ 117
System virtual domain....................................................................................... 119
Virtual domain properties................................................................................................ 120
Exclusive virtual domain properties ............................................................................ 120
Shared configuration settings ..................................................................................... 121
Administration and management ................................................................................ 122
Virtual domains ............................................................................................................... 122
Adding a virtual domain .............................................................................................. 123
Selecting a virtual domain........................................................................................... 123
Selecting a management virtual domain..................................................................... 123
Configuring virtual domains ............................................................................................ 124
Adding interfaces, VLAN subinterfaces, and zones to a virtual domain ..................... 124
Configuring routing for a virtual domain ...................................................................... 126
Configuring firewall policies for a virtual domain......................................................... 126
Configuring IPSec VPN for a virtual domain ............................................................... 128
Router ................................................................................................................. 129
Static............................................................................................................................... 129
Static route list ............................................................................................................ 131
Static route options ..................................................................................................... 132

Contents
601-28006-0001-20041105 Fortinet Inc.
Policy .............................................................................................................................. 133
Policy route list............................................................................................................ 133
Policy route options..................................................................................................... 134
RIP.................................................................................................................................. 134
General ....................................................................................................................... 135
Networks list................................................................................................................ 136
Networks options ........................................................................................................ 137
Interface list................................................................................................................. 137
Interface options ......................................................................................................... 138
Distribute list ............................................................................................................... 139
Distribute list options................................................................................................... 140
Offset list ..................................................................................................................... 141
Offset list options ........................................................................................................ 141
Router objects................................................................................................................. 142
Access list ................................................................................................................... 142
New access list ........................................................................................................... 142
New access list entry .................................................................................................. 143
Prefix list ..................................................................................................................... 143
New Prefix list ............................................................................................................. 144
New prefix list entry..................................................................................................... 145
Route-map list............................................................................................................. 145
New Route-map .......................................................................................................... 146
Route-map list entry.................................................................................................... 147
Key chain list............................................................................................................... 148
New key chain............................................................................................................. 148
Key chain list entry...................................................................................................... 149
Monitor............................................................................................................................ 150
Routing monitor list ..................................................................................................... 150
CLI configuration............................................................................................................. 151
get router info ospf ...................................................................................................... 151
get router info protocols .............................................................................................. 151
get router info rip......................................................................................................... 152
config router ospf ....................................................................................................... 152
config router static6..................................................................................................... 175
Firewall................................................................................................................ 177
Policy .............................................................................................................................. 178
How policy matching works......................................................................................... 178
Policy list ..................................................................................................................... 179
Policy options.............................................................................................................. 179
Advanced policy options ............................................................................................. 182
Configuring firewall policies ........................................................................................ 184
Policy CLI configuration .............................................................................................. 185

Contents
FortiGate-50A Administration Guide 01-28006-0001-20041105 7
Address........................................................................................................................... 186
Address list ................................................................................................................. 187
Address options .......................................................................................................... 187
Configuring addresses ................................................................................................ 188
Address group list ....................................................................................................... 189
Address group options ................................................................................................ 189
Configuring address groups........................................................................................ 190
Service............................................................................................................................ 190
Predefined service list................................................................................................. 191
Custom service list...................................................................................................... 194
Custom service options............................................................................................... 194
Configuring custom services....................................................................................... 195
Service group list ........................................................................................................ 197
Service group options ................................................................................................. 197
Configuring service groups ......................................................................................... 198
Schedule......................................................................................................................... 198
One-time schedule list ................................................................................................ 199
One-time schedule options ......................................................................................... 199
Configuring one-time schedules ................................................................................. 199
Recurring schedule list................................................................................................ 200
Recurring schedule options ........................................................................................ 201
Configuring recurring schedules ................................................................................. 201
Virtual IP ......................................................................................................................... 202
Virtual IP list ................................................................................................................ 203
Virtual IP options......................................................................................................... 203
Configuring virtual IPs................................................................................................. 204
IP pool............................................................................................................................. 206
IP pool list ................................................................................................................... 207
IP pool options ............................................................................................................ 207
Configuring IP pools.................................................................................................... 208
IP Pools for firewall policies that use fixed ports......................................................... 208
IP pools and dynamic NAT ......................................................................................... 208
Protection profile............................................................................................................. 209
Protection profile list.................................................................................................... 209
Default protection profiles ........................................................................................... 210
Protection profile options ............................................................................................ 210
Configuring protection profiles .................................................................................... 214
CLI configuration......................................................................................................... 215
Users and authentication .................................................................................. 221
Setting authentication timeout......................................................................................... 222
Local ............................................................................................................................... 222
Local user list .............................................................................................................. 222
Local user options....................................................................................................... 222

Contents
801-28006-0001-20041105 Fortinet Inc.
RADIUS .......................................................................................................................... 223
RADIUS server list ...................................................................................................... 223
RADIUS server options............................................................................................... 224
LDAP............................................................................................................................... 225
LDAP server list .......................................................................................................... 225
LDAP server options ................................................................................................... 225
User group ...................................................................................................................... 227
User group list............................................................................................................. 227
User group options...................................................................................................... 228
CLI configuration............................................................................................................. 229
peer............................................................................................................................. 229
peergrp........................................................................................................................ 230
VPN...................................................................................................................... 233
Phase 1........................................................................................................................... 234
Phase 1 list ................................................................................................................. 234
Phase 1 basic settings ................................................................................................ 235
Phase 1 advanced options.......................................................................................... 236
Configuring XAuth....................................................................................................... 237
Phase 2........................................................................................................................... 238
Phase 2 list ................................................................................................................. 238
Phase 2 basic settings ................................................................................................ 239
Phase 2 advanced options.......................................................................................... 240
Manual key...................................................................................................................... 241
Manual key list ............................................................................................................ 242
Manual key options ..................................................................................................... 242
Concentrator ................................................................................................................... 243
Concentrator list.......................................................................................................... 243
Concentrator options................................................................................................... 244
Ping Generator................................................................................................................ 244
Ping generator options................................................................................................ 245
Monitor............................................................................................................................ 245
Dialup monitor............................................................................................................. 246
Static IP and dynamic DNS monitor............................................................................ 246
PPTP............................................................................................................................... 247
Setting up a PPTP-based VPN ................................................................................... 247
Enabling PPTP and specifying a PPTP range ............................................................ 248
Configuring a Windows 2000 client for PPTP ............................................................. 249
Configuring a Windows XP client for PPTP ................................................................ 249
PPTP passthrough...................................................................................................... 250

Contents
FortiGate-50A Administration Guide 01-28006-0001-20041105 9
L2TP .............................................................................................................................. 251
Setting up a L2TP-based VPN.................................................................................... 252
Enabling L2TP and specifying an L2TP range............................................................ 252
Configuring a Windows 2000 client for L2TP.............................................................. 253
Configuring a Windows XP client for L2TP ................................................................. 254
Certificates...................................................................................................................... 256
Viewing the certificate list............................................................................................ 257
Generating a certificate request.................................................................................. 257
Installing a signed certificate ...................................................................................... 259
Enabling VPN access for specific certificate holders ................................................. 260
CLI configuration............................................................................................................. 261
ipsec phase1............................................................................................................... 261
ipsec phase2............................................................................................................... 263
ipsec vip ...................................................................................................................... 264
Authenticating peers with preshared keys ...................................................................... 266
Gateway-to-gateway VPN............................................................................................... 266
Dialup VPN ..................................................................................................................... 267
Dynamic DNS VPN......................................................................................................... 267
Manual key IPSec VPN................................................................................................... 268
Adding firewall policies for IPSec VPN tunnels............................................................... 268
Setting the encryption policy direction ........................................................................ 268
Setting the source address for encrypted traffic ......................................................... 268
Setting the destination address for encrypted traffic................................................... 269
Adding an IPSec firewall encryption policy ................................................................. 269
Internet browsing through a VPN tunnel......................................................................... 269
Configuring Internet browsing through a VPN tunnel.................................................. 270
IPSec VPN in Transparent mode.................................................................................... 271
Special rules ............................................................................................................... 271
Hub and spoke VPNs...................................................................................................... 272
Configuring the hub..................................................................................................... 272
Configuring spokes ..................................................................................................... 274
Redundant IPSec VPNs.................................................................................................. 275
Configuring redundant IPSec VPNs............................................................................ 275
Configuring IPSec virtual IP addresses .......................................................................... 276
Troubleshooting .............................................................................................................. 278
IPS ....................................................................................................................... 279
Signature......................................................................................................................... 280
Predefined................................................................................................................... 280
Custom........................................................................................................................ 284
Anomaly.......................................................................................................................... 286
Anomaly CLI configuration.......................................................................................... 289
Configuring IPS logging and alert email.......................................................................... 290
Default fail open setting .................................................................................................. 290

Contents
10 01-28006-0001-20041105 Fortinet Inc.
Antivirus ............................................................................................................. 291
File block......................................................................................................................... 292
File block list ............................................................................................................... 293
Configuring the file block list ....................................................................................... 294
Quarantine ...................................................................................................................... 294
Quarantined files list ................................................................................................... 294
Quarantined files list options....................................................................................... 295
AutoSubmit list ............................................................................................................ 296
AutoSubmit list options ............................................................................................... 296
Configuring the AutoSubmit list................................................................................... 296
Config.......................................................................................................................... 297
Config.............................................................................................................................. 298
Virus list ...................................................................................................................... 298
Config.......................................................................................................................... 298
Grayware .................................................................................................................... 299
Grayware options........................................................................................................ 299
CLI configuration............................................................................................................. 300
heuristic....................................................................................................................... 300
quarantine ................................................................................................................... 301
service http.................................................................................................................. 302
service ftp.................................................................................................................... 303
service pop3................................................................................................................ 304
service imap................................................................................................................ 305
service smtp................................................................................................................ 306
Web filter............................................................................................................. 309
Content block.................................................................................................................. 310
Web content block list ................................................................................................. 311
Web content block options.......................................................................................... 311
Configuring the web content block list ........................................................................ 312
URL block ....................................................................................................................... 312
Web URL block list...................................................................................................... 313
Web URL block options .............................................................................................. 313
Configuring the web URL block list ............................................................................. 313
Web pattern block list.................................................................................................. 314
Web pattern block options .......................................................................................... 315
Configuring web pattern block .................................................................................... 315
URL exempt.................................................................................................................... 315
URL exempt list........................................................................................................... 316
URL exempt list options .............................................................................................. 316
Configuring URL exempt............................................................................................. 316

Contents
FortiGate-50A Administration Guide 01-28006-0001-20041105 11
Category block................................................................................................................ 317
FortiGuard managed web filtering service .................................................................. 317
Category block configuration options.......................................................................... 318
Configuring web category block.................................................................................. 319
Category block reports................................................................................................ 319
Category block reports options ................................................................................... 320
Generating a category block report............................................................................. 320
Category block CLI configuration................................................................................ 320
Script filter....................................................................................................................... 321
Web script filter options............................................................................................... 322
Spam filter .......................................................................................................... 323
IP address....................................................................................................................... 326
IP address list ............................................................................................................. 326
IP address options ...................................................................................................... 326
Configuring the IP address list .................................................................................... 327
RBL & ORDBL ................................................................................................................ 327
RBL & ORDBL list....................................................................................................... 328
RBL & ORDBL options................................................................................................ 328
Configuring the RBL & ORDBL list ............................................................................. 328
Email address ................................................................................................................. 329
Email address list........................................................................................................ 329
Email address options................................................................................................. 329
Configuring the email address list............................................................................... 330
MIME headers................................................................................................................. 330
MIME headers list ....................................................................................................... 331
MIME headers options ................................................................................................ 331
Configuring the MIME headers list.............................................................................. 331
Banned word................................................................................................................... 332
Banned word list ......................................................................................................... 332
Banned word options .................................................................................................. 333
Configuring the banned word list ................................................................................ 334
Using Perl regular expressions....................................................................................... 334
Log & Report ...................................................................................................... 337
Log config ....................................................................................................................... 338
Log Setting options ..................................................................................................... 338
Alert E-mail options..................................................................................................... 342
Log filter options.......................................................................................................... 343
Configuring log filters .................................................................................................. 346
Enabling traffic logging................................................................................................ 346
Log access...................................................................................................................... 347
Viewing log messages ................................................................................................ 347
Searching log messages............................................................................................. 349

Contents
12 01-28006-0001-20041105 Fortinet Inc.
CLI configuration............................................................................................................. 350
fortilog setting.............................................................................................................. 350
syslogd setting ............................................................................................................ 351
FortiGuard categories ....................................................................................... 355
FortiGate maximum values ............................................................................... 361
Glossary ............................................................................................................. 365
Index .................................................................................................................... 369

FortiGate-50A Administration Guide Version 2.80 MR6
FortiGate-50A Administration Guide 01-28006-0001-20041105 13
Introduction
FortiGate Antivirus Firewalls support network-based deployment of application-level
services, including antivirus protection and full-scan content filtering. FortiGate
Antivirus Firewalls improve network security, reduce network misuse and abuse, and
help you use communications resources more efficiently without compromising the
performance of your network. FortiGate Antivirus Firewalls are ICSA-certified for
firewall, IPSec, and antivirus services.
This chapter introduces you to FortiGate Antivirus Firewalls and the following topics:
•About FortiGate Antivirus Firewalls
•Document conventions
•FortiGate documentation
•Related documentation
•Customer service and technical support
About FortiGate Antivirus Firewalls
The FortiGate Antivirus Firewall is a dedicated easily managed security device that
delivers a full suite of capabilities that include:
• application-level services such as virus protection and content filtering,
• network-level services such as firewall, intrusion detection, VPN, and traffic
shaping.
The FortiGate Antivirus Firewall uses Fortinet’s Accelerated Behavior and Content
Analysis System (ABACAS™) technology, which leverages breakthroughs in chip
design, networking, security, and content analysis. The unique ASIC-based
architecture analyzes content and behavior in real-time, enabling key applications to
be deployed right at the network edge, where they are most effective at protecting
your networks. The FortiGate series complements existing solutions, such as host-
based antivirus protection, and enables new applications and services while greatly
lowering costs for equipment, administration, and maintenance.
The FortiGate-50A model is designed for
telecommuters and small remote offices with 10
or fewer employees. The FortiGate-50A
provides complete real-time network protection
through a combination of network-based
antivirus, web and email content filtering, firewall, VPN, network-based intrusion
detection and prevention, and traffic shaping.
INTERNAL EXTERNAL
LINK 100 LINK 100
PWR STATUS
A

14 01-28006-0001-20041105 Fortinet Inc.
About FortiGate Antivirus Firewalls Introduction
Antivirus protection
FortiGate ICSA-certified antivirus protection scans web (HTTP), file transfer (FTP),
and email (SMTP, POP3, and IMAP) content as it passes through the FortiGate unit.
FortiGate antivirus protection uses pattern matching and heuristics to find viruses. If a
virus is found, antivirus protection removes the file containing the virus from the
content stream and forwards a replacement message to the intended recipient.
For extra protection, you can configure antivirus protection to block specified file types
from passing through the FortiGate unit. You can use the feature to stop files that
might contain new viruses.
FortiGate antivirus protection can also identify and remove known grayware
programs. Grayware programs are usually unsolicited commercial software programs
that get installed on PCs, often without the user’s consent or knowledge. Grayware
programs are generally considered an annoyance, but these programs can cause
system performance problems or be used for malicious means.
If the FortiGate unit contains a hard disk, infected or blocked files and grayware files
can be quarantined. The FortiGate administrator can download quarantined files so
that they can be virus scanned, cleaned, and forwarded to the intended recipient. You
can also configure the FortiGate unit to automatically delete quarantined files after a
specified time.
The FortiGate unit can send email alerts to system administrators when it detects and
removes a virus from a content stream. The web and email content can be in normal
network traffic or encrypted IPSec VPN traffic.
ICSA Labs has certified that FortiGate Antivirus Firewalls:
• detect 100% of the viruses listed in the current In The Wild List (www.wildlist.org),
• detect viruses in compressed files using the PKZip format,
• detect viruses in email that has been encoded using uuencode format,
• detect viruses in email that has been encoded using MIME encoding,
• log all actions taken while scanning.
Web content filtering
FortiGate web content filtering can scan all HTTP content protocol streams for URLs,
URL patterns, and web page content. If there is a match between a URL on the URL
block list, or a web page contains a word or phrase that is in the content block list, the
FortiGate unit blocks the web page. The blocked web page is replaced with a
message that you can edit using the FortiGate web-based manager.
FortiGate web content filtering also supports FortiGuard web category blocking. Using
web category blocking you can restrict or allow access to web pages based on
content ratings of web pages.
You can configure URL blocking to block all or some of the pages on a web site. Using
this feature, you can deny access to parts of a web site without denying access to it
completely.
To prevent unintentionally blocking legitimate web pages, you can add URLs to an
exempt list that overrides the URL blocking and content blocking lists. The exempt list
also exempts web traffic this address from virus scanning.

Introduction About FortiGate Antivirus Firewalls
FortiGate-50A Administration Guide 01-28006-0001-20041105 15
Web content filtering also includes a script filter feature that can block unsecure web
content such as Java applets, cookies, and ActiveX.
Spam filtering
FortiGate spam filtering can scan all POP3, SMTP, and IMAP email content for spam.
You can configure spam filtering to filter mail according to IP address, email address,
mime headers, and content. Mail messages can be identified as spam or clear.
You can also add the names of known Real-time Blackhole List (RBL) and Open
Relay Database List (ORDBL) servers. These services contain lists of known spam
sources.
If an email message is found to be spam, the FortiGate adds an email tag to the
subject line of the email. The recipient can use the mail client software to filter
messages based on the email tag. Spam filtering can also be configured to delete
SMTP email messages identified as spam.
Firewall
The FortiGate ICSA-certified firewall protects your computer networks from Internet
threats. ICSA has granted FortiGate firewalls version 4.0 firewall certification,
providing assurance that FortiGate firewalls successfully screen and secure corporate
networks against a range of threats from public or other untrusted networks.
After basic installation of the FortiGate unit, the firewall allows users on the protected
network to access the Internet while blocking Internet access to internal networks. You
can configure the firewall to put controls on access to the Internet from the protected
networks and to allow controlled access to internal networks.
FortiGate policies include a range of options that:
• control all incoming and outgoing network traffic,
• control encrypted VPN traffic,
• apply antivirus protection and web content filtering,
• block or allow access for all policy options,
• control when individual policies are in effect,
• accept or deny traffic to and from individual addresses,
• control standard and user defined network services individually or in groups,
• require users to authenticate before gaining access,
• include traffic shaping to set access priorities and guarantee or limit bandwidth for
each policy,
• include logging to track connections for individual policies,
• include Network Address Translation (NAT) mode and Route mode policies,
• include mixed NAT and Route mode policies.
The FortiGate firewall can operate in NAT/Route mode or Transparent mode.
NAT/Route mode
In NAT/Route mode, the FortiGate unit is a Layer 3 device. This means that each of its
interfaces is associated with a different IP subnet and that it appears to other devices
as a router. This is how a firewall is normally deployed.

16 01-28006-0001-20041105 Fortinet Inc.
About FortiGate Antivirus Firewalls Introduction
In NAT/Route mode, you can create NAT mode policies and Route mode policies.
• NAT mode policies use network address translation to hide the addresses in a
more secure network from users in a less secure network.
• Route mode policies accept or deny connections between networks without
performing address translation.
Transparent mode
In Transparent mode, the FortiGate unit does not change the Layer 3 topology. This
means that all of its interfaces are on the same IP subnet and that it appears to other
devices as a bridge. Typically, the FortiGate unit is deployed in Transparent mode to
provide antivirus and content filtering behind an existing firewall solution.
Transparent mode provides the same basic firewall protection as NAT mode. The
FortiGate unit passes or blocks the packets it receives according to firewall policies.
The FortiGate unit can be inserted in the network at any point without having to make
changes to your network or its components. However, some advanced firewall
features are available only in NAT/Route mode.
VLANs and virtual domains
Fortigate Antivirus Firewalls support IEEE 802.1Q-compliant virtual LAN (VLAN) tags.
Using VLAN technology, a single FortiGate unit can provide security services to, and
control connections between, multiple security domains according to the VLAN IDs
added to VLAN packets. The FortiGate unit can recognize VLAN IDs and apply
security policies to secure network and IPSec VPN traffic between each security
domain. The FortiGate unit can also apply authentication, content filtering, and
antivirus protection to VLAN-tagged network and VPN traffic.
The FortiGate unit supports VLANs in NAT/Route and Transparent mode. In
NAT/Route mode, you enter VLAN subinterfaces to receive and send VLAN packets.
FortiGate virtual domains provide multiple logical firewalls and routers in a single
FortiGate unit. Using virtual domains, one FortiGate unit can provide exclusive firewall
and routing services to multiple networks so that traffic from each network is
effectively separated from every other network.
You can develop and manage interfaces, VLAN subinterfaces, zones, firewall policies,
routing, and VPN configuration for each virtual domain separately. For these
configuration settings, each virtual domain is functionally similar to a single FortiGate
unit. This separation simplifies configuration because you do not have to manage as
many routes or firewall policies at one time.
Intrusion Prevention System (IPS)
The FortiGate Intrusion Prevention System (IPS) combines signature and anomaly
based intrusion detection and prevention. The FortiGate unit can record suspicious
traffic in logs, can send alert email to system administrators, and can log, pass, drop,
reset, or clear suspicious packets or sessions. Both the IPS predefined signatures and
the IPS engine are upgradeable through the FortiProtect Distribution Network (FDN).
You can also create custom signatures.

Introduction About FortiGate Antivirus Firewalls
FortiGate-50A Administration Guide 01-28006-0001-20041105 17
VPN
Using FortiGate virtual private networking (VPN), you can provide a secure
connection between widely separated office networks or securely link telecommuters
or travellers to an office network.
FortiGate VPN features include the following:
• Industry standard and ICSA-certified IPSec VPN, including:
• IPSec VPN in NAT/Route and Transparent mode,
• IPSec, ESP security in tunnel mode,
• DES, 3DES (triple-DES), and AES hardware accelerated encryption,
• HMAC MD5 and HMAC SHA1 authentication and data integrity,
• AutoIKE key based on pre-shared key tunnels,
• IPSec VPN using local or CA certificates,
• Manual Keys tunnels,
• Diffie-Hellman groups 1, 2, and 5,
• Aggressive and Main Mode,
• Replay Detection,
• Perfect Forward Secrecy,
• XAuth authentication,
• Dead peer detection,
• DHCP over IPSec,
• Secure Internet browsing.
• PPTP for easy connectivity with the VPN standard supported by the most popular
operating systems.
• L2TP for easy connectivity with a more secure VPN standard, also supported by
many popular operating systems.
• Firewall policy based control of IPSec VPN traffic.
• IPSec NAT traversal so that remote IPSec VPN gateways or clients behind a NAT
can connect to an IPSec VPN tunnel.
• VPN hub and spoke using a VPN concentrator to allow VPN traffic to pass from
one tunnel to another through the FortiGate unit.
• IPSec Redundancy to create a redundant AutoIKE key IPSec VPN connection to a
remote network.
Secure installation, configuration, and management
The first time you power on the FortiGate unit, it is already configured with default IP
addresses and security policies. Connect to the web-based manager, set the
operating mode, and use the Setup wizard to customize FortiGate IP addresses for
your network, and the FortiGate unit is ready to protect your network. You can then
use the web-based manager to customize advanced FortiGate features.
Web-based manager
Using HTTP or a secure HTTPS connection from any computer running Internet
Explorer, you can configure and manage the FortiGate unit. The web-based manager
supports multiple languages. You can configure the FortiGate unit for HTTP and
HTTPS administration from any FortiGate interface.

18 01-28006-0001-20041105 Fortinet Inc.
About FortiGate Antivirus Firewalls Introduction
You can use the web-based manager to configure most FortiGate settings. You can
also use the web-based manager to monitor the status of the FortiGate unit.
Configuration changes made using the web-based manager are effective immediately
without resetting the firewall or interrupting service. Once you are satisfied with a
configuration, you can download and save it. The saved configuration can be restored
at any time.
Command line interface
You can access the FortiGate command line interface (CLI) by connecting a
management computer serial port to the FortiGate RS-232 serial console connector.
You can also use Telnet or a secure SSH connection to connect to the CLI from any
network that is connected to the FortiGate unit, including the Internet.
The CLI supports the same configuration and monitoring functionality as the
web-based manager. In addition, you can use the CLI for advanced configuration
options that are not available from the web-based manager.
This Administration Guide contains information about basic and advanced CLI
commands. For a more complete description about connecting to and using the
FortiGate CLI, see the FortiGate CLI Reference Guide.
Logging and reporting
The FortiGate unit supports logging for various categories of traffic and configuration
changes. You can configure logging to:
• report traffic that connects to the firewall,
• report network services used,
• report traffic that was permitted by firewall policies,
• report traffic that was denied by firewall policies,
• report events such as configuration changes and other management events, IPSec
tunnel negotiation, virus detection, attacks, and web page blocking,
• report attacks detected by the IPS,
• send alert email to system administrators to report virus incidents, intrusions, and
firewall or VPN events or violations.
Logs can be sent to a remote syslog server or a WebTrends NetIQ Security Reporting
Center and Firewall Suite server using the WebTrends enhanced log format. Some
models can also save logs to an optional internal hard drive. If a hard drive is not
installed, you can configure most FortiGate units to log the most recent events and
attacks detected by the IPS to the system memory.

Introduction Document conventions
FortiGate-50A Administration Guide 01-28006-0001-20041105 19
Document conventions
This guide uses the following conventions to describe CLI command syntax.
• Angle brackets < > to indicate variables.
For example:
execute restore config <filename_str>
You enter:
execute restore config myfile.bak
<xxx_str> indicates an ASCII string that does not contain new-lines or carriage
returns.
<xxx_integer> indicates an integer string that is a decimal (base 10) number.
<xxx_octet> indicates a hexadecimal string that uses the digits 0-9 and letters
A-F.
<xxx_ipv4> indicates a dotted decimal IPv4 address.
<xxx_v4mask> indicates a dotted decimal IPv4 netmask.
<xxx_ipv4mask> indicates a dotted decimal IPv4 address followed by a dotted
decimal IPv4 netmask.
<xxx_ipv6> indicates a dotted decimal IPv6 address.
<xxx_v6mask> indicates a dotted decimal IPv6 netmask.
<xxx_ipv6mask> indicates a dotted decimal IPv6 address followed by a dotted
decimal IPv6 netmask.
• Vertical bar and curly brackets {|} to separate alternative, mutually exclusive
required keywords.
For example:
set opmode {nat | transparent}
You can enter set opmode nat or set opmode transparent.
• Square brackets [ ] to indicate that a keyword or variable is optional.
For example:
show system interface [<name_str>]
To show the settings for all interfaces, you can enter show system interface.
To show the settings for the internal interface, you can enter show system
interface internal.
• A space to separate options that can be entered in any combination and must be
separated by spaces.
For example:
set allowaccess {ping https ssh snmp http telnet}
You can enter any of the following:
set allowaccess ping
set allowaccess ping https ssh
set allowaccess https ping ssh

20 01-28006-0001-20041105 Fortinet Inc.
FortiGate documentation Introduction
set allowaccess snmp
In most cases to make changes to lists that contain options separated by spaces,
you need to retype the whole list including all the options you want to apply and
excluding all the options you want to remove.
FortiGate documentation
Information about FortiGate products is available from the following guides:
•FortiGate QuickStart Guide
Provides basic information about connecting and installing a FortiGate unit.
•FortiGate Installation Guide
Describes how to install a FortiGate unit. Includes a hardware reference, default
configuration information, installation procedures, connection procedures, and
basic configuration procedures. Choose the guide for your product model number.
•FortiGate Administration Guide
Provides basic information about how to configure a FortiGate unit, including how
to define FortiGate protection profiles and firewall policies; how to apply intrusion
prevention, antivirus protection, web content filtering, and spam filtering; and how
to configure a VPN.
•FortiGate online help
Provides a context-sensitive and searchable version of the Administration Guide in
HTML format. You can access online help from the web-based manager as you
work.
•FortiGate CLI Reference Guide
Describes how to use the FortiGate CLI and contains a reference to all FortiGate
CLI commands.
•FortiGate Log Message Reference Guide
Describes the structure of FortiGate log messages and provides information about
the log messages that are generated by FortiGate units.
• FortiGate High Availability Guide
Contains in-depth information about the FortiGate high availability feature and the
FortiGate clustering protocol.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this document, or any
Fortinet technical documentation, to [e-mail].