Fortinet Gate 60D

To Next Page

To Previous Page

Monitoring VPNs IPSec VPN

FortiGate Version 4.0 Administration Guide

546 01-400-89802-20090424

http://docs.fortinet.com/ • Feedback

Main Page

Default Chapter3
- Table of Contents3
Introduction21
Fortinet Products21
About this Document21
Document Conventions24
- IP Addresses24
- CLI Constraints24
- Cautions, Notes and Tips24
- Typographical Conventions25
Registering Your Fortinet Product25
Customer Service and Technical Support25
Training26
Fortinet Documentation26
- Tools and Documentation CD26
- Fortinet Knowledge Center26
- Comments on Fortinet Technical Documentation26
What's New in Fortios 4.027
Fortios 4.0 Fortigate Models and Features Supported28
UTM Features Grouped under New UTM Menu29
Data Leak Prevention29
Application Control29
SSL Content Scanning and Inspection29
WAN Optimization30
Endpoint Control30
Network Access Control (NAC) Quarantine30
IPS Extensions31
- Dos Policies for Applying IPS Sensors31
- NAC Quarantine in Dos Sensors31
- Adding IPS Sensors to a Dos Policy from the CLI32
- One-Arm IDS (Sniffer Mode)32
- IPS Interface Policies for Ipv633
  - IPS Packet Logging33
Enhanced Antispam Engine (ASE)33
WCCP V2 Support33
- Any" Interface for Firewall Policies35
?Any” Interface for Firewall Policies35
Global View of Firewall Policies35
Identity-Based Firewall Policies35
Traffic Shaping Enhancements36
Firewall Load Balancing Virtual IP Changes36
- User Session Persistence36
- Health Check Monitor36
- Load Balancing Server Monitor36
Web Filtering HTTP Upload Enhancements36
Per-Firewall Policy Session TTL37
Gratuitous ARP for Virtual Ips37
Changes to Protection Profiles37
Changes to Content Archiving37
Customizable Web-Based Manager Pages37
Administration over Modem38
Auto-Bypass and Recovery for AMC Bridge Module38
Rogue Wireless Access Point Detection38
Configurable VDOM and Global Resource Limits38
User Authentication Monitor39
OCSP and SCEP Certificate over HTTPS39
Adding Non-Standard Ports for Firewall Authentication39
Dynamically Assigning VPN Client IP Addresses from a RADIUS Record40
DHCP over Route-Based Ipsec Vpns40
SNMP Upgraded to V3.040
File Quarantine41
Customizable SSL VPN Web Portals41
Logging Improvements41
Web Filtering HTTP POST Traffic (Blocking or Comforting HTTP Post Traffic)41
Web-Based Manager43
Common Web-Based Manager Tasks44
- Connecting to the Web-Based Manager44
- Changing Your Fortigate Administrator Password45
- Changing the Web-Based Manager Language46
- Changing Administrative Access to Your Fortigate Unit46
- Changing the Web-Based Manager Idle Timeout47
- Connecting to the Fortigate CLI from the Web-Based Manager47
Button Bar Features47
Contacting Customer Support48
Backing up Your Fortigate Configuration48
Using Fortigate Online Help49
- Searching the Online Help50
Logging out52
Web-Based Manager Pages52
- Using the Web-Based Manager Menu52
- Using Web-Based Manager Lists53
- Adding Filters to Web-Based Manager Lists53
- Using Page Controls on Web-Based Manager Lists57
- Using Column Settings to Control the Columns Displayed58
- Using Filters with Column Settings59
Web-Based Manager Icons60
System Status63
Status Page63
- Viewing System Status63
- System Information65
Changing System Information78
- Configuring System Time78
- Changing the Fortigate Unit Host Name78
Changing the Fortigate Firmware79
- Upgrading to a New Firmware Version80
- Reverting to a Previous Firmware Version80
Viewing Operational History81
Manually Updating Fortiguard Definitions82
Viewing Statistics83
- Viewing the Session List83
- Viewing Content Archive Information on the Statistics Widget84
- Viewing the Attack Log85
Topology87
- Adding a Subnet Object89
- Customizing the Topology Diagram90
Managing Firmware Versions91
Backing up Your Configuration92
- Backing up Your Configuration through the Web-Based Manager92
- Backing up Your Configuration through the CLI92
- Backing up Your Configuration to a USB Key93
Testing Firmware before Upgrading94
Upgrading Your Fortigate Unit95
- Upgrading to Fortios 4.0 through the Web-Based Manager95
- Upgrading to Fortios 4.0 through the CLI96
- Verifying the Upgrade97
Reverting to a Previous Firmware Image98
- Downgrading to a Previous Firmware through the Web-Based Manager98
- Verifying the Downgrade99
- Downgrading to a Previous Firmware through the CLI99
Restoring Your Configuration101
- Restoring Your Configuration Settings in the Web-Based Manager101
- Restoring Your Configuration Settings in the CLI101
Using Virtual Domains103
Virtual Domains103
- Benefits of Vdoms103
- VDOM Configuration Settings104
- Global Configuration Settings107
Enabling Vdoms108
Configuring Vdoms and Global Settings109
- VDOM Licenses109
- Creating a New VDOM110
- Working with Vdoms and Global Settings111
- Adding Interfaces to a VDOM113
- Inter-VDOM Links113
- Assigning an Interface to a VDOM114
- Assigning an Administrator to a VDOM115
- Changing the Management VDOM116
Configuring Global and VDOM Resource Limits116
- VDOM Resource Limits117
- Global Resource Limits118
System Network119
Interfaces119
- Switch Mode122
- Interface Settings123
- Creating an 802.3Ad Aggregate Interface127
- Creating a Redundant Interface128
- Configuring DHCP on an Interface130
- Configuring an Interface for Pppoe131
- Configuring Dynamic DNS on an Interface132
- Configuring a Virtual Ipsec Interface133
- Configuring Interfaces with CLI Commands134
- Administrative Access to an Interface135
- Interface MTU Packet Size135
- Secondary IP Addresses136
Configuring Zones138
Configuring the Modem Interface139
- Configuring Modem Settings140
- Redundant Mode Configuration142
- Standalone Mode Configuration143
- Adding Firewall Policies for Modem Connections144
- Connecting and Disconnecting the Modem144
- Checking Modem Status144
Configuring Networking Options145
- DNS Servers146
- Dead Gateway Detection146
Web Proxy147
Routing Table (Transparent Mode)149
- Transparent Mode Route Settings149
VLAN Overview150
- Fortigate Units and Vlans151
Vlans in Nat/Route Mode151
- Rules for VLAN Ids152
- Rules for VLAN IP Addresses152
- Adding VLAN Subinterfaces153
Vlans in Transparent Mode154
- Rules for VLAN Ids156
- Transparent Mode Virtual Domains and Vlans156
- Troubleshooting ARP Issues157
System Wireless159
Fortiwifi Wireless Interfaces159
Channel Assignments160
- IEEE 802.11A Channel Numbers160
- IEEE 802.11B Channel Numbers160
- IEEE 802.11G Channel Numbers161
Wireless Settings162
- Adding a Wireless Interface163
Wireless MAC Filter165
- Managing the MAC Filter List166
Wireless Monitor167
Rogue AP Detection168
- Viewing Wireless Access Points168
System DHCP171
Fortigate DHCP Servers and Relays171
Configuring DHCP Services172
- Configuring an Interface as a DHCP Relay Agent173
- Configuring a DHCP Server173
Viewing Address Leases175
- Reserving IP Addresses for Specific Clients175
Ha177
System Config177
- HA Options177
- Cluster Members List180
- Viewing HA Statistics182
- Changing Subordinate Unit Host Name and Device Priority183
- Disconnecting a Cluster Unit from a Cluster184
Snmp185
- Configuring SNMP186
- Configuring an SNMP Community186
- Fortinet Mibs188
- Fortinet and Fortigate Traps189
- Fortinet and Fortigate MIB Fields192
Replacement Messages194
- Replacement Messages List195
- Changing Replacement Messages196
- Mail Replacement Messages197
- HTTP Replacement Messages197
- FTP Replacement Messages198
- NNTP Replacement Messages199
- Alert Mail Replacement Messages199
- Spam Replacement Messages200
- Administration Replacement Message200
- Authentication Replacement Messages201
- Fortiguard Web Filtering Replacement Messages202
- IM and P2P Replacement Messages203
- Endpoint Control Replacement Message204
- NAC Quarantine Replacement Messages204
- SSL VPN Replacement Message205
- Replacement Message Tags205
Operation Mode and VDOM Management Access206
- Changing Operation Mode206
- Management Access207
System Admin209
Administrators209
- Viewing the Administrators List211
- Configuring an Administrator Account212
- Configuring Regular (Password) Authentication for Administrators214
- Configuring Remote Authentication for Administrators214
- Configuring PKI Certificate Authentication for Administrators220
Admin Profiles222
- Viewing the Admin Profiles List224
- Configuring an Admin Profile225
Central Management226
Settings228
Monitoring Administrators229
Fortigate Ipv6 Support230
Customizable Web-Based Manager231
System Certificates243
Local Certificates244
- Generating a Certificate Request245
- Downloading and Submitting a Certificate Request246
- Importing a Signed Server Certificate247
- Importing an Exported Server Certificate and Private Key247
- Importing Separate Server Certificate and Private Key Files248
Remote Certificates248
- Importing Remote (OCSP) Certificates249
CA Certificates249
- Importing CA Certificates250
Crl251
- Importing a Certificate Revocation List251
System Maintenance253
About the Maintenance Menu253
Backing up and Restoring254
- Basic Backup and Restore Options255
- Upgrading and Downgrading Firmware259
- Upgrading and Downgrading Firmware through Fortiguard259
- Configuring Advanced Options260
Managing Configuration Revisions261
Using Script Files262
- Creating Script Files263
- Uploading Script Files264
Configuring Fortiguard Services264
- Fortiguard Distribution Network264
- Fortiguard Services265
- Configuring the Fortigate Unit for FDN and Fortiguard Subscription Services266
Troubleshooting FDN Connectivity271
Updating Antivirus and Attack Definitions271
Enabling Push Updates273
- Enabling Push Updates When a Fortigate Unit IP Address Changes273
- Enabling Push Updates through a NAT Device274
Adding VDOM Licenses276
Router Static277
Routing Concepts277
- How the Routing Table Is Built278
- How Routing Decisions Are Made278
- Multipath Routing and Determining the Best Route278
- Route Priority279
- Blackhole Route279
Static Route280
- Working with Static Routes280
- Default Route and Default Gateway281
- Adding a Static Route to the Routing Table284
Policy Route285
- Adding a Policy Route286
- Moving a Policy Route287
Router Dynamic289
Rip289
- Viewing and Editing Basic RIP Settings290
- Selecting Advanced RIP Options292
- Configuring a RIP-Enabled Interface293
Ospf294
- Defining an OSPF AS-Overview295
- Configuring Basic OSPF Settings296
- Selecting Advanced OSPF Options298
- Defining OSPF Areas299
- Specifying OSPF Networks300
- Selecting Operating Parameters for an OSPF Interface301
Bgp302
- Viewing and Editing BGP Settings303
Multicast304
- Viewing and Editing Multicast Settings305
- Overriding the Multicast Settings on an Interface306
- Multicast Destination NAT306
Bi-Directional Forwarding Detection (BFD)307
- Configuring BFD307
Customizable Routing Widgets309
- Access List309
- Distribute List310
- Key Chain310
- Offset List311
- Prefix List312
- Route Map312
Router Monitor315
Viewing Routing Information315
Searching the Fortigate Routing Table317
Firewall Policy319
How List Order Affects Policy Matching319
- Moving a Policy to a Different Position in the Policy List320
Multicast Policies321
Viewing the Firewall Policy List321
Configuring Firewall Policies323
- Adding Authentication to Firewall Policies327
- Identity-Based Firewall Policy Options (Non-SSL-VPN)328
- Ipsec Firewall Policy Options330
- Configuring SSL VPN Identity-Based Firewall Policies331
- Endpoint Compliance Check Options336
Dos Policies337
- Viewing the Dos Policy List337
- Configuring Dos Policies338
Firewall Policy Examples339
- Scenario One: SOHO-Sized Business339
- Scenario Two: Enterprise-Sized Business342
Firewall Address345
About Firewall Addresses345
Viewing the Firewall Address List346
Configuring Addresses347
Viewing the Address Group List348
Configuring Address Groups348
Firewall Service351
Viewing the Predefined Service List351
Viewing the Custom Service List356
Configuring Custom Services357
Viewing the Service Group List359
Configuring Service Groups359
Firewall Schedule361
Viewing the Recurring Schedule List361
Configuring Recurring Schedules362
Viewing the One-Time Schedule List362
Configuring One-Time Schedules363
Firewall Virtual IP365
How Virtual Ips Map Connections through Fortigate Units365
- Inbound Connections365
- Outbound Connections368
- VIP Requirements369
Viewing the Virtual IP List369
Configuring Virtual Ips370
- Adding a Static NAT Virtual IP for a Single IP Address372
- Adding a Static NAT Virtual IP for an IP Address Range373
- Adding Static NAT Port Forwarding for a Single IP Address and a Single Port375
- Adding Static NAT Port Forwarding for an IP Address Range and a Port Range377
- Adding Dynamic Virtual Ips378
- Adding a Virtual IP with Port Translation Only379
Virtual IP Groups380
Viewing the VIP Group List380
Configuring VIP Groups380
IP Pools381
- IP Pools and Dynamic NAT382
- IP Pools for Firewall Policies that Use Fixed Ports382
- Source IP Address and IP Pool Address Matching382
Viewing the IP Pool List383
Configuring IP Pools383
Double NAT: Combining IP Pool with Virtual IP384
Adding NAT Firewall Policies in Transparent Mode386
Firewall Load Balance389
How Load Balancer Works389
Configuring Virtual Servers390
Configuring Real Servers392
Configuring Health Check Monitors393
Monitoring the Servers395
Firewall Protection Profile397
What Is a Protection Profile397
Adding a Protection Profile to a Firewall Policy398
Default Protection Profiles398
SSL Content Scanning and Inspection399
- Supported Fortigate Models400
- Setting up Certificates to Avoid Client Warnings400
- Configuring SSL Content Scanning and Inspection402
Viewing the Protection Profile List399
Configuring a Protection Profile404
- Protocol Recognition Options405
- Anti-Virus Options407
- IPS Options411
- Web Filtering Options411
- Fortiguard Web Filtering Options413
- Spam Filtering Options416
- Data Leak Prevention Sensor Options419
- Application Control Options420
- Logging Options421
Traffic Shaping423
Guaranteed Bandwidth and Maximum Bandwidth423
Traffic Priority424
Traffic Shaping Considerations424
Configuring Traffic Shaping425
SIP Support427
Voip and SIP427
The Fortigate Unit and Voip Security429
- Sip Nat429
How SIP Support Works431
Configuring SIP432
- Enabling SIP Support and Setting Rate Limiting from the Web-Based Manager432
- Enabling SIP Support from the CLI433
- Enabling SIP Logging434
- Enabling Advanced SIP Features in an Application List434
Antivirus439
Order of Operations439
Antivirus Tasks440
- Fortiguard Antivirus441
Antivirus Settings and Controls441
File Filter443
- Built-In Patterns and Supported File Types443
- Viewing the File Filter List Catalog444
- Creating a New File Filter List444
- Viewing the File Filter List445
- Configuring the File Filter List445
File Quarantine446
- Viewing the File Quarantine List447
- Viewing the Autosubmit List448
- Configuring the Autosubmit List449
- Configuring Quarantine Options449
Viewing the Virus Database Information451
Viewing and Configuring the Grayware List452
Antivirus CLI Configuration453
Intrusion Protection455
About Intrusion Protection455
- Intrusion Protection Settings and Controls456
- When to Use Intrusion Protection456
Signatures456
- Viewing the Predefined Signature List457
- Using Display Filters458
Custom Signatures459
- Viewing the Custom Signature List459
- Creating Custom Signatures459
Protocol Decoders460
- Viewing the Protocol Decoder List460
- Upgrading the IPS Protocol Decoder List461
IPS Sensors461
- Viewing the IPS Sensor List461
- Adding an IPS Sensor462
- Configuring IPS Sensors462
- Configuring Filters464
- Configuring Pre-Defined and Custom Overrides465
- Packet Logging467
Dos Sensors469
- Viewing the Dos Sensor List470
- Configuring Dos Sensors470
- Understanding the Anomalies472
Intrusion Protection CLI Configuration472
Web Filter475
Order of Web Filtering475
How Web Filtering Works475
Web Filter Controls476
Web Content Block478
- Viewing the Web Content Block List Catalog479
- Creating a New Web Content Block List479
- Viewing the Web Content Block List479
- Configuring the Web Content Block List480
- Viewing the Web Content Exempt List Catalog481
- Creating a New Web Content Exempt List482
- Viewing the Web Content Exempt List482
- Configuring the Web Content Exempt List483
URL Filter483
- Viewing the URL Filter List Catalog484
- Creating a New URL Filter List484
- Viewing the URL Filter List485
- Configuring the URL Filter List485
- URL Formats486
- Moving Urls in the URL Filter List487
Fortiguard - Web Filter487
- Configuring Fortiguard Web Filtering488
- Viewing the Override List488
- Configuring Administrative Override Rules489
- Creating Local Categories491
- Viewing the Local Ratings List491
- Configuring Local Ratings492
- Category Block CLI Configuration493
Antispam495
- Order of Spam Filtering495
- Anti-Spam Filter Controls496
Banned Word498
- Viewing the Banned Word List Catalog498
- Creating a New Banned Word List499
- Viewing the Antispam Banned Word List499
- Adding Words to the Banned Word List500
IP Address and Email Address Black/White Lists501
- Viewing the Antispam IP Address List Catalog501
- Creating a New Antispam IP Address List501
- Viewing the Antispam IP Address List502
- Adding an Antispam IP Address503
- Viewing the Antispam Email Address List Catalog503
- Creating a New Antispam Email Address List504
- Viewing the Antispam Email Address List504
- Configuring the Antispam Email Address List505
Advanced Antispam Configuration505
- Config Spamfilter Mheader505
- Config Spamfilter Dnsbl506
Using Wildcards and Perl Regular Expressions506
- Perl Regular Expression Formats507
- Example Regular Expressions508
Data Leak Prevention511
DLP Sensors511
- Viewing the DLP Sensor List511
- Adding and Configuring a DLP Sensor512
- Adding or Editing a Rule in a DLP Sensor513
DLP Rules515
- Viewing the DLP Rule List515
- Adding or Configuring DLP Rules516
DLP Compound Rules519
- Viewing the DLP Compound Rule List520
- Adding and Configuring DLP Compound Rules520
Application Control523
What Is Application Control523
Fortiguard Application Control Database523
Viewing the Application Control Lists524
Creating a New Application Control List524
Configuring an Application Control List525
Adding or Configuring an Application Control List Entry526
Application Control Statistics527
Ipsec VPN531
Overview of Ipsec VPN Configuration531
Policy-Based Versus Route-Based Vpns532
Auto Key533
- Creating a New Phase 1 Configuration534
- Defining Phase 1 Advanced Settings536
- Creating a New Phase 2 Configuration538
- Defining Phase 2 Advanced Settings539
Manual Key541
- Creating a New Manual Key Configuration542
Internet Browsing Configuration544
Concentrator544
- Defining Concentrator Options545
Monitoring Vpns545
Pptp Vpn547
PPTP Configuration Using Fortigate Web-Based Manager547
PPTP Configuration Using CLI Commands549
Ssl Vpn551
Ssl.root551
Configuring SSL VPN552
Monitoring SSL VPN Sessions553
SSL VPN Web Portal554
Default Web Portal Configurations554
- General Tab556
- Advanced Tab556
- Adding and Editing Widgets558
- Session Information Widget559
- Bookmarks Widget559
- Connection Tool Widget563
- Tunnel Mode Widget564
User567
Getting Started - User Authentication567
Local User Accounts568
- Configuring Local User Accounts568
Remote571
Radius571
- Configuring a RADIUS Server572
- Dynamically Assigning VPN Client IP Addresses from a RADIUS Record573
Ldap575
- Configuring an LDAP Server575
Tacacs578
- Configuring TACACS+ Servers578
Directory Service579
- Configuring a Directory Service Server581
Pki581
- Configuring Peer Users and Peer Groups582
User Group583
- Firewall User Groups584
- Directory Service User Groups585
- SSL VPN User Groups585
- Viewing the User Group List586
- Configuring a User Group586
- Configuring Fortiguard Web Filtering Override Options589
Options590
Monitor591
- Firewall User Monitor List591
- IPSEC Monitor List592
- SSL VPN Monitor List593
- IM User Monitor List594
NAC Quarantine and the Banned User List595
- NAC Quarantine and DLP595
- NAC Quarantine and DLP Replacement Messages595
- Configuring NAC Quarantine596
- The Banned User List596
WAN Optimization and Web Caching599
Frequently Asked Questions about Fortigate WAN Optimization599
Overview of Fortigate WAN Optimization601
- WAN Optimization Tunnels602
- WAN Optimization Peer Authentication602
- Authentication Groups603
- WAN Optimization Rules and Firewall Policies603
- WAN Optimization Transparent Mode604
- Fortigate Models that Support WAN Optimization604
Configuring WAN Optimization605
- How List Order Affects Rule Matching606
- Moving a Rule to a Different Position in the Rule List607
Configuring a WAN Optimization Rule608
Web Caching610
- Web Cache Only Topology611
- Configuring Web Cache Only WAN Optimization611
- Configuring Client/Server (Active-Passive) Web Caching612
- Configuring Peer to Peer Web Caching614
Client/Server or Active Passive WAN Optimization617
- Configuring Client/Server (Active-Passive) WAN Optimization617
Peer to Peer WAN Optimization620
- Configuring Peer to Peer WAN Optimization620
- About WAN Optimization Addresses622
Protocol Optimization623
Byte Caching624
SSL Offloading for WAN Optimization and Web Caching624
- Example Configuration: SSL Offloading for a WAN Optimization Tunnel625
- SSL Offloading and Reverse Proxy Web Caching for an Internet Web Server627
WAN Optimization with Forticlient630
Secure Tunnelling630
- WAN Optimization over Ipsec VPN630
Configuring WAN Optimization Storage631
- Example WAN Optimization Iscsi Configuration632
- About Partition Labels633
WAN Optimization and HA634
Configuring Peers634
Configuring Authentication Groups635
- Details about WAN Optimization Peer Authentication636
Monitoring WAN Optimization637
Changing Web Cache Settings638
Endpoint Control641
Configuring Endpoint Control641
- Viewing Forticlient Required Version Information642
- Configuring Forticlient Required Version and Installer Download642
- Viewing and Configuring the Software Detection List643
Monitoring Endpoints644
Log&Report647
Fortigate Logging647
Fortiguard Analysis and Management Service648
- Fortiguard Analysis and Management Service Portal Web Site649
Log Severity Levels649
High Availability Cluster Logging650
Storing Logs650
- Logging to a Fortianalyzer Unit650
- Connecting to Fortianalyzer Using Automatic Discovery651
- Testing the Fortianalyzer Configuration652
- Logging to a Fortiguard Analysis Server653
- Logging to Memory654
- Logging to a Syslog Server654
- Logging to Webtrends655
Log Types657
- Traffic Log657
- Example Configuration: Logging All Fortigate Traffic658
- Event Log659
- Data Leak Prevention Log660
- Application Control Log660
- Antivirus Log660
- Web Filter Log661
- Spam Filter Log661
- Attack Log (IPS)661
Accessing Logs662
- Accessing Logs Stored in Memory662
- Accessing Logs Stored on the Hard Disk662
- Accessing Logs Stored on the Fortianalyzer Unit663
- Accessing Logs Stored on the Fortiguard Analysis Server664
Viewing Log Information664
Customizing the Display of Log Messages665
- Column Settings666
- Filtering Log Messages667
Content Archive667
- Content Archiving and Data Leak Prevention668
- Configuring Spam Email Message Content Archiving668
- Configuring Voip Content Archiving669
- Viewing Content Archives670
Alert Email670
- Configuring Alert Email672
Reports673
- Viewing Basic Traffic Reports673
- Fortianalyzer Report Schedules674
- Viewing Fortianalyzer Reports677
- Printing Your Fortianalyzer Report677
Index679

Fortinet Gate 60D - Page 546

Table of Contents