Fortinet FortiGate FortiGate-60M Instruction Manual

FortiGate 60M Administration Guide
INTERNAL
DMZ4321
LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100
WAN1 WAN2
PWR STATUS
FortiGate-60M Administration Guide
Version 2.80 MR7
17 December 2004
01-28007-0144-20041217

© Copyright 2004 Fortinet Inc. All rights reserved.
No part of this publication including text, examples, diagrams or illustrations may be reproduced,
transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or
otherwise, for any purpose, without prior written permission of Fortinet Inc.
FortiGate-60M Administration Guide
Version 2.80 MR7
17 December 2004
01-28007-0144-20041217
Trademarks
Products mentioned in this document are trademarks or registered trademarks of their respective
holders.
Regulatory Compliance
FCC Class A Part 15 CSA/CUS
CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE.
DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS.
For technical support, please visit http://www.fortinet.com.
Send information about errors or omissions in this document or any Fortinet technical documentation to
[e-mail].

Contents
FortiGate-60M Administration Guide 01-28007-0144-20041217 3
Table of Contents
Introduction.......................................................................................................... 13
About FortiGate Antivirus Firewalls................................................................................... 13
Antivirus protection ....................................................................................................... 14
Web content filtering ..................................................................................................... 14
Spam filtering ................................................................................................................ 15
Firewall.......................................................................................................................... 15
VLANs and virtual domains........................................................................................... 17
Intrusion Prevention System (IPS)................................................................................ 17
VPN............................................................................................................................... 17
High availability ............................................................................................................. 18
Secure installation, configuration, and management .................................................... 19
Document conventions ..................................................................................................... 20
FortiGate documentation .................................................................................................. 22
Fortinet Knowledge Center ........................................................................................... 22
Comments on Fortinet technical documentation........................................................... 22
Related documentation ..................................................................................................... 23
FortiManager documentation ........................................................................................ 23
FortiClient documentation ............................................................................................. 23
FortiMail documentation................................................................................................ 23
FortiLog documentation ................................................................................................ 24
Customer service and technical support........................................................................... 24
System status....................................................................................................... 25
Console access................................................................................................................. 25
Status................................................................................................................................ 26
Viewing system status .................................................................................................. 26
Changing unit information ............................................................................................. 29
Session list........................................................................................................................ 32
Changing the FortiGate firmware...................................................................................... 33
Upgrading to a new firmware version ........................................................................... 33
Reverting to a previous firmware version...................................................................... 35
Installing firmware images from a system reboot using the CLI ................................... 38
Testing a new firmware image before installing it ......................................................... 41
System network ................................................................................................... 45
Interface............................................................................................................................ 45
Interface settings........................................................................................................... 46
Configuring interfaces ................................................................................................... 51
Zone.................................................................................................................................. 56
Zone settings ................................................................................................................ 56
Management..................................................................................................................... 57

Contents
401-28007-0144-20041217 Fortinet Inc.
DNS .................................................................................................................................. 59
Routing table (Transparent Mode).................................................................................... 60
Routing table list ........................................................................................................... 60
Transparent mode route settings .................................................................................. 60
Configuring the modem interface...................................................................................... 61
Configuring modem settings ......................................................................................... 61
Connecting and disconnecting the modem................................................................... 62
Backup mode configuration .......................................................................................... 63
Standalone mode configuration .................................................................................... 64
Adding firewall policies for modem connections ........................................................... 64
VLAN overview ................................................................................................................. 65
FortiGate units and VLANs ........................................................................................... 66
VLANs in NAT/Route mode .............................................................................................. 66
Rules for VLAN IDs....................................................................................................... 66
Rules for VLAN IP addresses ....................................................................................... 66
Adding VLAN subinterfaces .......................................................................................... 67
VLANs in Transparent mode............................................................................................. 68
Rules for VLAN IDs....................................................................................................... 70
Transparent mode virtual domains and VLANs ............................................................ 70
Transparent mode VLAN list......................................................................................... 71
Transparent mode VLAN settings................................................................................. 71
FortiGate IPv6 support...................................................................................................... 73
System DHCP ....................................................................................................... 75
Service.............................................................................................................................. 75
DHCP service settings .................................................................................................. 76
Server ............................................................................................................................... 77
DHCP server settings ................................................................................................... 78
Exclude range................................................................................................................... 79
DHCP exclude range settings....................................................................................... 80
IP/MAC binding................................................................................................................. 80
DHCP IP/MAC binding settings .................................................................................... 81
Dynamic IP........................................................................................................................ 81
System config ...................................................................................................... 83
System time ...................................................................................................................... 83
Options.............................................................................................................................. 84
HA..................................................................................................................................... 86
HA configuration ........................................................................................................... 87
Configuring an HA cluster ............................................................................................. 92
Managing an HA cluster................................................................................................ 96

Contents
FortiGate-60M Administration Guide 01-28007-0144-20041217 5
SNMP................................................................................................................................ 99
Configuring SNMP ...................................................................................................... 100
SNMP community ....................................................................................................... 101
FortiGate MIBs............................................................................................................ 103
FortiGate traps ............................................................................................................ 104
Fortinet MIB fields ....................................................................................................... 105
Replacement messages ................................................................................................. 108
Replacement messages list ........................................................................................ 108
Changing replacement messages .............................................................................. 109
FortiManager................................................................................................................... 110
System administration ...................................................................................... 111
Administrators................................................................................................................. 111
Administrators list........................................................................................................ 112
Administrators options ................................................................................................ 112
Access profiles................................................................................................................ 113
Access profile list ........................................................................................................ 114
Access profile options ................................................................................................. 114
System maintenance ......................................................................................... 117
Backup and restore......................................................................................................... 117
Backing up and Restoring........................................................................................... 118
Update center ................................................................................................................. 120
Updating antivirus and attack definitions .................................................................... 122
Enabling push updates ............................................................................................... 125
Support ........................................................................................................................... 127
Sending a bug report .................................................................................................. 128
Registering a FortiGate unit ........................................................................................ 129
Shutdown........................................................................................................................ 131
System virtual domain....................................................................................... 133
Virtual domain properties................................................................................................ 134
Exclusive virtual domain properties ............................................................................ 134
Shared configuration settings ..................................................................................... 135
Administration and management ................................................................................ 136
Virtual domains ............................................................................................................... 136
Adding a virtual domain .............................................................................................. 137
Selecting a virtual domain........................................................................................... 137
Selecting a management virtual domain..................................................................... 137
Configuring virtual domains ............................................................................................ 138
Adding interfaces, VLAN subinterfaces, and zones to a virtual domain ..................... 138
Configuring routing for a virtual domain ...................................................................... 140
Configuring firewall policies for a virtual domain......................................................... 140
Configuring IPSec VPN for a virtual domain ............................................................... 142

Contents
601-28007-0144-20041217 Fortinet Inc.
Router ................................................................................................................. 143
Static............................................................................................................................... 143
Static route list ............................................................................................................ 145
Static route options ..................................................................................................... 146
Policy .............................................................................................................................. 147
Policy route list............................................................................................................ 147
Policy route options..................................................................................................... 148
RIP.................................................................................................................................. 148
General ....................................................................................................................... 149
Networks list................................................................................................................ 150
Networks options ........................................................................................................ 151
Interface list................................................................................................................. 151
Interface options ......................................................................................................... 152
Distribute list ............................................................................................................... 153
Distribute list options................................................................................................... 154
Offset list ..................................................................................................................... 155
Offset list options ........................................................................................................ 155
Router objects................................................................................................................. 156
Access list ................................................................................................................... 156
New access list ........................................................................................................... 156
New access list entry .................................................................................................. 157
Prefix list ..................................................................................................................... 157
New Prefix list ............................................................................................................. 158
New prefix list entry..................................................................................................... 159
Route-map list............................................................................................................. 159
New Route-map .......................................................................................................... 160
Route-map list entry.................................................................................................... 161
Key chain list............................................................................................................... 162
New key chain............................................................................................................. 162
Key chain list entry...................................................................................................... 163
Monitor............................................................................................................................ 164
Routing monitor list ..................................................................................................... 164
CLI configuration............................................................................................................. 165
get router info ospf ...................................................................................................... 165
get router info protocols .............................................................................................. 165
get router info rip......................................................................................................... 166
config router ospf ....................................................................................................... 166
config router static6..................................................................................................... 189

Contents
FortiGate-60M Administration Guide 01-28007-0144-20041217 7
Firewall................................................................................................................ 191
Policy .............................................................................................................................. 192
How policy matching works......................................................................................... 192
Policy list ..................................................................................................................... 193
Policy options.............................................................................................................. 193
Advanced policy options ............................................................................................. 196
Configuring firewall policies ........................................................................................ 198
Policy CLI configuration .............................................................................................. 199
Address........................................................................................................................... 200
Address list ................................................................................................................. 201
Address options .......................................................................................................... 201
Configuring addresses ................................................................................................ 202
Address group list ....................................................................................................... 203
Address group options ................................................................................................ 203
Configuring address groups........................................................................................ 204
Service............................................................................................................................ 205
Predefined service list................................................................................................. 205
Custom service list...................................................................................................... 208
Custom service options............................................................................................... 209
Configuring custom services....................................................................................... 210
Service group list ........................................................................................................ 211
Service group options ................................................................................................. 211
Configuring service groups ......................................................................................... 212
Schedule......................................................................................................................... 213
One-time schedule list ................................................................................................ 213
One-time schedule options ......................................................................................... 214
Configuring one-time schedules ................................................................................. 214
Recurring schedule list................................................................................................ 215
Recurring schedule options ........................................................................................ 215
Configuring recurring schedules ................................................................................. 216
Virtual IP ......................................................................................................................... 216
Virtual IP list ................................................................................................................ 217
Virtual IP options......................................................................................................... 217
Configuring virtual IPs................................................................................................. 218
IP pool............................................................................................................................. 221
IP pool list ................................................................................................................... 222
IP pool options ............................................................................................................ 222
Configuring IP pools.................................................................................................... 222
IP Pools for firewall policies that use fixed ports......................................................... 223
IP pools and dynamic NAT ......................................................................................... 223

Contents
801-28007-0144-20041217 Fortinet Inc.
Protection profile............................................................................................................. 224
Protection profile list.................................................................................................... 224
Default protection profiles ........................................................................................... 225
Protection profile options ............................................................................................ 225
Configuring protection profiles .................................................................................... 230
Profile CLI configuration.............................................................................................. 231
Users and authentication .................................................................................. 235
Setting authentication timeout......................................................................................... 236
Local ............................................................................................................................... 236
Local user list .............................................................................................................. 236
Local user options....................................................................................................... 236
RADIUS .......................................................................................................................... 237
RADIUS server list ...................................................................................................... 237
RADIUS server options............................................................................................... 238
LDAP............................................................................................................................... 238
LDAP server list .......................................................................................................... 239
LDAP server options ................................................................................................... 239
User group ...................................................................................................................... 241
User group list............................................................................................................. 241
User group options...................................................................................................... 242
CLI configuration............................................................................................................. 243
peer............................................................................................................................. 243
peergrp........................................................................................................................ 244
VPN...................................................................................................................... 247
Phase 1........................................................................................................................... 248
Phase 1 list ................................................................................................................. 248
Phase 1 basic settings ................................................................................................ 249
Phase 1 advanced settings......................................................................................... 251
Phase 2........................................................................................................................... 252
Phase 2 list ................................................................................................................. 253
Phase 2 basic settings ................................................................................................ 253
Phase 2 advanced options.......................................................................................... 254
Manual key...................................................................................................................... 255
Manual key list ............................................................................................................ 256
Manual key options ..................................................................................................... 257
Concentrator ................................................................................................................... 258
Concentrator list.......................................................................................................... 258
Concentrator options................................................................................................... 259
Ping Generator................................................................................................................ 259
Ping generator options................................................................................................ 260

Contents
FortiGate-60M Administration Guide 01-28007-0144-20041217 9
Monitor............................................................................................................................ 260
Dialup monitor............................................................................................................. 261
Static IP and dynamic DNS monitor............................................................................ 261
PPTP............................................................................................................................... 262
PPTP range ................................................................................................................ 262
L2TP .............................................................................................................................. 263
L2TP range ................................................................................................................. 263
Certificates...................................................................................................................... 264
Local certificate list...................................................................................................... 264
Certificate request....................................................................................................... 265
Importing signed certificates ...................................................................................... 266
CA certificate list ......................................................................................................... 267
Importing CA certificates............................................................................................. 267
VPN configuration procedures........................................................................................ 268
IPSec configuration procedures.................................................................................. 268
PPTP configuration procedures .................................................................................. 270
L2TP configuration procedures................................................................................... 270
CLI configuration............................................................................................................. 271
ipsec phase1............................................................................................................... 271
ipsec phase2............................................................................................................... 273
ipsec vip ...................................................................................................................... 274
IPS ....................................................................................................................... 279
Signature......................................................................................................................... 280
Predefined................................................................................................................... 280
Custom........................................................................................................................ 284
Anomaly.......................................................................................................................... 286
Anomaly CLI configuration.......................................................................................... 289
Configuring IPS logging and alert email.......................................................................... 290
Default fail open setting .................................................................................................. 290
Antivirus ............................................................................................................. 291
File block......................................................................................................................... 292
File block list ............................................................................................................... 293
Configuring the file block list ....................................................................................... 294
Quarantine ...................................................................................................................... 294
Quarantined files list ................................................................................................... 294
Quarantined files list options....................................................................................... 295
AutoSubmit list ............................................................................................................ 296
AutoSubmit list options ............................................................................................... 296
Configuring the AutoSubmit list................................................................................... 296
Config.......................................................................................................................... 297

Contents
10 01-28007-0144-20041217 Fortinet Inc.
Config.............................................................................................................................. 298
Virus list ...................................................................................................................... 298
Config.......................................................................................................................... 298
Grayware .................................................................................................................... 299
Grayware options........................................................................................................ 299
CLI configuration............................................................................................................. 301
config antivirus heuristic.............................................................................................. 301
config antivirus quarantine .......................................................................................... 302
config antivirus service http......................................................................................... 302
config antivirus service ftp........................................................................................... 304
config antivirus service pop3....................................................................................... 306
config antivirus service imap....................................................................................... 307
config antivirus service smtp....................................................................................... 309
Web filter............................................................................................................. 311
Content block.................................................................................................................. 313
Web content block list ................................................................................................. 313
Web content block options.......................................................................................... 313
Configuring the web content block list ........................................................................ 314
URL block ....................................................................................................................... 314
Web URL block list...................................................................................................... 315
Web URL block options .............................................................................................. 315
Configuring the web URL block list ............................................................................. 316
Web pattern block list.................................................................................................. 316
Web pattern block options .......................................................................................... 317
Configuring web pattern block .................................................................................... 317
URL exempt.................................................................................................................... 317
URL exempt list........................................................................................................... 318
URL exempt list options .............................................................................................. 318
Configuring URL exempt............................................................................................. 318
Category block................................................................................................................ 319
FortiGuard managed web filtering service .................................................................. 319
Category block configuration options.......................................................................... 320
Configuring web category block.................................................................................. 321
Category block reports................................................................................................ 321
Category block reports options ................................................................................... 322
Generating a category block report............................................................................. 322
Category block CLI configuration................................................................................ 322
Script filter....................................................................................................................... 323
Web script filter options............................................................................................... 324