Document Outline

• Table of Contents
• Introduction
  • Antivirus protection
  • Web content filtering
  • Email filtering
  • Firewall
    • NAT/Route mode
    • Transparent mode
  • Network intrusion detection
  • VPN
  • Secure installation, configuration, and management
    • Web-based manager
    • Command line interface
    • Logging and reporting
  • What’s new in Version 2.50
    • System administration
      • Network configuration
      • Routing
      • DHCP server
      • RIP
      • SNMP
      • Replacement messages
    • Firewall
    • Users and authentication
    • VPN
    • NIDS
    • Antivirus
    • Web Filter
    • Email filter
    • Logging and Reporting
  • About this document
  • Document conventions
  • Fortinet documentation
    • Comments on Fortinet technical documentation
  • Customer service and technical support
• Getting started
  • Package contents
  • Mounting
    • Dimensions
    • Weight
    • Power requirements
    • Environmental specifications
  • Powering on
  • Connecting to the web-based manager
  • Connecting to the command line interface (CLI)
  • Factory default FortiGate configuration settings
    • Factory default NAT/Route mode network configuration
    • Factory default Transparent mode network configuration
    • Factory default firewall configuration
    • Factory default content profiles
      • Strict content profile
      • Scan content profile
      • Web content profile
      • Unfiltered content profile
  • Planning your FortiGate configuration
    • NAT/Route mode
    • NAT/Route mode with multiple external network connections
    • Transparent mode
    • Configuration options
      • Setup Wizard
      • CLI
  • FortiGate model maximum values matrix
  • Next steps
• NAT/Route mode installation
  • Preparing to configure NAT/Route mode
    • Advanced NAT/Route mode settings
    • DMZ interface
  • Using the setup wizard
    • Starting the setup wizard
    • Reconnecting to the web-based manager
  • Using the command line interface
    • Configuring the FortiGate unit to operate in NAT/Route mode
      • Configuring NAT/Route mode IP addresses
  • Connecting the FortiGate unit to your networks
  • Configuring your networks
  • Completing the configuration
    • Configuring the DMZ interface
    • Setting the date and time
    • Enabling antivirus protection
    • Registering your FortiGate
    • Configuring virus and attack definition updates
  • Configuration example: Multiple connections to the Internet
    • Configuring Ping servers
    • Destination based routing examples
      • Primary and backup links to the Internet
      • Load sharing
      • Load sharing and primary and secondary connections
    • Policy routing examples
      • Routing traffic from internal subnets to different external networks
      • Routing a service to an external network
    • Firewall policy example
      • Adding a redundant default policy
      • Adding more firewall policies
      • Restricting access to a single Internet connection
• Transparent mode installation
  • Preparing to configure Transparent mode
  • Using the setup wizard
    • Changing to Transparent mode
    • Starting the setup wizard
    • Reconnecting to the web-based manager
  • Using the command line interface
    • Changing to Transparent mode
    • Configuring the Transparent mode management IP address
    • Configure the Transparent mode default gateway
  • Connecting the FortiGate unit to your networks
  • Completing the configuration
    • Setting the date and time
    • Enabling antivirus protection
    • Registering your FortiGate
    • Configuring virus and attack definition updates
  • Transparent mode configuration examples
    • Default routes and static routes
    • Example default route to an external network
      • General configuration steps
      • Web-based manager example configuration steps
      • CLI configuration steps
    • Example static route to an external destination
      • General configuration steps
      • Web-based manager example configuration steps
      • CLI configuration steps
    • Example static route to an internal destination
      • General configuration steps
      • Web-based manager example configuration steps
      • CLI configuration steps
• System status
  • Changing the FortiGate host name
  • Changing the FortiGate firmware
    • Upgrade to a new firmware version
      • Upgrading the firmware using the web-based manager
      • Upgrading the firmware using the CLI
    • Revert to a previous firmware version
      • Reverting to a previous firmware version using the web-based manager
      • Reverting to a previous firmware version using the CLI
    • Install a firmware image from a system reboot using the CLI
    • Test a new firmware image before installing it
    • Installing and using a backup firmware image
      • Installing a backup firmware image
      • Switching to the backup firmware image
      • Switching back to the default firmware image
  • Manual virus definition updates
  • Manual attack definition updates
  • Displaying the FortiGate serial number
  • Displaying the FortiGate up time
  • Backing up system settings
  • Restoring system settings
  • Restoring system settings to factory defaults
  • Changing to Transparent mode
  • Changing to NAT/Route mode
  • Restarting the FortiGate unit
  • Shutting down the FortiGate unit
  • System status
    • Viewing CPU and memory status
    • Viewing sessions and network status
    • Viewing virus and intrusions status
  • Session list
• Virus and attack definitions updates and registration
  • Updating antivirus and attack definitions
    • Connecting to the FortiResponse Distribution Network
    • Configuring scheduled updates
    • Configuring update logging
    • Adding an override server
    • Manually updating antivirus and attack definitions
    • Configuring push updates
      • To enable push updates
      • About push updates
      • Push updates and external dynamic IP addresses
    • Push updates through a NAT device
      • Example: push updates through a NAT device
    • Scheduled updates through a proxy server
  • Registering FortiGate units
    • FortiCare Service Contracts
    • Registering the FortiGate unit
  • Updating registration information
    • Recovering a lost Fortinet support password
    • Viewing the list of registered FortiGate units
    • Registering a new FortiGate unit
    • Adding or changing a FortiCare Support Contract number
    • Changing your Fortinet support password
    • Changing your contact information or security question
    • Downloading virus and attack definitions updates
  • Registering a FortiGate unit after an RMA
• Network configuration
  • Configuring interfaces
    • Viewing the interface list
    • Bringing up an interface
    • Changing an interface static IP address
    • Adding a secondary IP address to an interface
    • Adding a ping server to an interface
    • Controlling management access to an interface
    • Configuring traffic logging for connections to an interface
    • Configuring the external interface with a static IP address
    • Configuring the external interface for DHCP
    • Configuring the external interface for PPPoE
    • Changing the external interface MTU size to improve network performance
    • Configuring the management interface (Transparent mode)
  • Adding DNS server IP addresses
  • Configuring routing
    • Adding a default route
    • Adding destination-based routes to the routing table
    • Adding routes in Transparent mode
    • Configuring the routing table
    • Policy routing
      • Policy routing command syntax
  • Providing DHCP services to your internal network
    • Viewing the dynamic IP list
• RIP configuration
  • RIP settings
  • Configuring RIP for FortiGate interfaces
  • Adding RIP neighbors
  • Adding RIP filters
    • Adding a single RIP filter
    • Adding a RIP filter list
    • Adding a neighbors filter
    • Adding a routes filter
• System configuration
  • Setting system date and time
  • Changing web-based manager options
  • Adding and editing administrator accounts
    • Adding new administrator accounts
    • Editing administrator accounts
  • Configuring SNMP
    • Configuring the FortiGate unit for SNMP monitoring
    • Configuring FortiGate SNMP support
    • FortiGate MIBs
    • FortiGate traps
  • Customizing replacement messages
    • Customizing replacement messages
    • Customizing alert emails
• Firewall configuration
  • Default firewall configuration
    • Addresses
    • Services
    • Schedules
    • Content profiles
  • Adding firewall policies
    • Firewall policy options
      • Source
      • Destination
      • Schedule
      • Service
      • Action
      • NAT
      • VPN Tunnel
      • Traffic Shaping
      • Authentication
      • Anti-Virus & Web filter
      • Log Traffic
      • Comments
  • Configuring policy lists
    • Policy matching in detail
    • Changing the order of policies in a policy list
    • Enabling and disabling policies
      • Disabling a policy
      • Enabling a policy
  • Addresses
    • Adding addresses
    • Editing addresses
    • Deleting addresses
    • Organizing addresses into address groups
  • Services
    • Predefined services
    • Providing access to custom services
    • Grouping services
  • Schedules
    • Creating one-time schedules
    • Creating recurring schedules
    • Adding a schedule to a policy
  • Virtual IPs
    • Adding static NAT virtual IPs
    • Adding port forwarding virtual IPs
    • Adding policies with virtual IPs
  • IP pools
    • Adding an IP pool
    • IP Pools for firewall policies that use fixed ports
    • IP pools and dynamic NAT
  • IP/MAC binding
    • Configuring IP/MAC binding for packets going through the firewall
    • Configuring IP/MAC binding for packets going to the firewall
    • Adding IP/MAC addresses
    • Viewing the dynamic IP/MAC list
    • Enabling IP/MAC binding
  • Content profiles
    • Default content profiles
    • Adding a content profile
    • Adding a content profile to a policy
• Users and authentication
  • Setting authentication timeout
  • Adding user names and configuring authentication
    • Adding user names and configuring authentication
    • Deleting user names from the internal database
  • Configuring RADIUS support
    • Adding RADIUS servers
    • Deleting RADIUS servers
  • Configuring LDAP support
    • Adding LDAP servers
    • Deleting LDAP servers
  • Configuring user groups
    • Adding user groups
    • Deleting user groups
• IPSec VPN
  • Key management
    • Manual Keys
    • Automatic Internet Key Exchange (AutoIKE) with pre-shared keys or certificates
      • AutoIKE with pre-shared keys
      • AutoIKE with certificates
  • Manual key IPSec VPNs
    • General configuration steps for a manual key VPN
    • Adding a manual key VPN tunnel
  • AutoIKE IPSec VPNs
    • General configuration steps for an AutoIKE VPN
    • Adding a phase 1 configuration for an AutoIKE VPN
    • Adding a phase 2 configuration for an AutoIKE VPN
  • Managing digital certificates
    • Obtaining a signed local certificate
      • Generating the certificate request
      • Downloading the certificate request
      • Requesting the signed local certificate
      • Retrieving the signed local certificate
      • Importing the signed local certificate
    • Obtaining a CA certificate
      • Retrieving a CA certificate
      • Importing a CA certificate
  • Configuring encrypt policies
    • Adding a source address
    • Adding a destination address
    • Adding an encrypt policy
  • IPSec VPN concentrators
    • VPN concentrator (hub) general configuration steps
    • Adding a VPN concentrator
    • VPN spoke general configuration steps
  • Redundant IPSec VPNs
    • Configuring redundant IPSec VPN
  • Monitoring and Troubleshooting VPNs
    • Viewing VPN tunnel status
    • Viewing dialup VPN connection status
    • Testing a VPN
• PPTP and L2TP VPN
  • Configuring PPTP
    • Configuring the FortiGate unit as a PPTP gateway
      • Adding users and user groups
      • Enabling PPTP and specifying an address range
      • Adding a source address
      • Adding an address group
      • Adding a destination address
      • Adding a firewall policy
    • Configuring a Windows 98 client for PPTP
      • Installing PPTP support
      • Configuring a PPTP dialup connection
      • Connecting to the PPTP VPN
    • Configuring a Windows 2000 client for PPTP
      • Configuring a PPTP dialup connection
      • Connecting to the PPTP VPN
    • Configuring a Windows XP client for PPTP
      • Configuring a PPTP dialup connection
      • Configuring the VPN connection
      • Connecting to the PPTP VPN
  • Configuring L2TP
    • Configuring the FortiGate unit as a L2TP gateway
      • Adding users and user groups
      • Enabling L2TP and specifying an address range
      • Adding a source address
      • Adding an address group
      • Adding a destination address
      • Adding a firewall policy
    • Configuring a Windows 2000 client for L2TP
      • Configuring an L2TP dialup connection
      • Disabling IPSec
      • Connecting to the L2TP VPN
    • Configuring a Windows XP client for L2TP
      • Configuring an L2TP VPN dialup connection
      • Configuring the VPN connection
      • Disabling IPSec
      • Connecting to the L2TP VPN
• Network Intrusion Detection System (NIDS)
  • Detecting attacks
    • Selecting the interfaces to monitor
    • Disabling the NIDS
    • Configuring checksum verification
    • Viewing the signature list
    • Viewing attack descriptions
    • Enabling and disabling NIDS attack signatures
    • Adding user-defined signatures
      • Downloading the user-defined signature list
  • Preventing attacks
    • Enabling NIDS attack prevention
    • Enabling NIDS attack prevention signatures
    • Setting signature threshold values
    • Configuring synflood signature values
  • Logging attacks
    • Logging attack messages to the attack log
    • Reducing the number of NIDS attack log and email messages
      • Automatic message reduction
      • Manual message reduction
• Antivirus protection
  • General configuration steps
  • Antivirus scanning
  • File blocking
    • Blocking files in firewall traffic
    • Adding file patterns to block
  • Blocking oversized files and emails
    • Configuring limits for oversized files and email
  • Exempting fragmented email from blocking
  • Viewing the virus list
• Web filtering
  • General configuration steps
  • Content blocking
    • Adding words and phrases to the banned word list
  • URL blocking
    • Using the FortiGate web filter
      • Adding URLs or URL patterns to the block list
      • Clearing the URL block list
      • Downloading the URL block list
      • Uploading a URL block list
    • Using the Cerberian web filter
      • General configuration steps
      • Installing a Cerberian license key on the FortiGate unit
      • Adding a Cerberian user to the FortiGate unit
      • Configuring Cerberian web filter
      • Enabling Cerberian URL filtering
  • Script filtering
    • Enabling the script filter
    • Selecting script filter options
  • Exempt URL list
    • Adding URLs to the exempt URL list
• Email filter
  • General configuration steps
  • Email banned word list
    • Adding words and phrases to the banned word list
  • Email block list
    • Adding address patterns to the email block list
  • Email exempt list
    • Adding address patterns to the email exempt list
  • Adding a subject tag
• Logging and reporting
  • Recording logs
    • Recording logs on a remote computer
    • Recording logs on a NetIQ WebTrends server
    • Recording logs in system memory
  • Filtering log messages
  • Configuring traffic logging
    • Enabling traffic logging
      • Enabling traffic logging for an interface
      • Enabling traffic logging for a firewall policy
    • Configuring traffic filter settings
    • Adding traffic filter entries
  • Viewing logs saved to memory
    • Viewing logs
    • Searching logs
  • Configuring alert email
    • Adding alert email addresses
    • Testing alert email
    • Enabling alert email
• Glossary
• Index