Fortinet FortiGate Series Administration Guide

DLP Sensors Data Leak Prevention
FortiGate Version 4.0 MR1 Administration Guide
584 01-410-89802-20090903
http://docs.fortinet.com/ • Feedback
Default DLP sensors
The following default DLP sensors are provided with your FortiGate unit. You can use
these as provided, or modify them as required.
Adding and configuring a DLP sensor
You can create a new DLP sensor and configure it to include the DLP rules and DLP
compound rules required to protect the traffic leaving your network.
Create New Select to create a new DLP sensor.
Name The DLP sensor name.
Comment The optional description of the DLP sensor.
Protection Profiles The names of the protection profiles that the DLP sensor has been
added to.
Delete and Edit icons Delete or edit the DLP sensor.
Caution: Before use, examine the sensors and rules in the sensors closely to ensure you
understand how they will affect the traffic on your network.
Note: DLP prevents duplicate action. Even if more than one rule in a sensor matches some
content, DLP will not create more than one DLP archive entry, quarantine item, or ban entry
from the same content.
Content_Archive DLP archive all email (POP3, IMAP, and SMTP), FTP, HTTP, and IM traffic.
For each rule in the sensor, Archive is set to Full. No blocking or quarantine is
performed. See “DLP archiving” on page 588.
You can add the All-Session-Control rule to also archive session control
content.
If you have a FortiGate unit that supports SSL content scanning and
inspection, you can edit the All-Email rule to archive POP3S, IMAPS, and
SMTPS traffic. You can also edit the All-HTTP rule to archive HTTPS traffic.
Content_Summary DLP summary archive all email (POP3, IMAP, and SMTP), FTP, HTTP, and IM
traffic. For each rule in the sensor, Archive is set to Summary Only. No
blocking or quarantine is performed. See “DLP archiving” on page 588.
You can add the All-Session-Control rule to also archive session control
content.
If you have a FortiGate unit that supports SSL content scanning and
inspection, you can edit the All-Email rule to archive POP3S, IMAPS, and
SMTPS traffic. You can also edit the All-HTTP rule to archive HTTPS traffic.
Credit-Card The number formats used by American Express, Visa, and Mastercard credit
cards are detected in HTTP and email traffic.
As provided, the sensor is configured not to archive matching traffic and an
action of None is set. Configure the action and archive options as required.
Large-File Files larger than 5MB will be detected if attached to email messages or if send
using HTTP or FTP.
As provided, the sensor is configured not to archive matching traffic and an
action of None is set. Configure the action and archive options as required.
SSN-Sensor The number formats used by U.S. Social Security and Canadian Social
Insurance numbers are detected in email and HTTP traffic.
As provided, the sensor is configured not to archive matching traffic and an
action of None is set. Configure the action and archive options as required.

Fortinet FortiGate Series Specifications

General

Model	FortiGate Series
Category	Firewall
Throughput	Varies by model
Interfaces	Varies by model
Concurrent Sessions	Varies by model
VPN Support	Yes
High Availability	Yes
Firewall Throughput	Varies by model
VPN Throughput	Varies by model
IPS Throughput	Varies by model
NGFW Throughput	Varies by model
Threat Protection Throughput	Varies by model
New Sessions per Second	Varies by model
Power Supply	Varies by model
Security Features	Firewall, IPS, Application Control, Web Filtering, Antivirus, VPN
Virtual Domains	Yes
Form Factor	Desktop, Rackmount