Document Outline

• Table of Contents
• Introduction
  • Antivirus protection
  • Web content filtering
  • Email filtering
  • Firewall
    • NAT/Route mode
    • Transparent mode
  • VLANs and virtual domains
  • Network intrusion detection
  • VPN
  • High availability
  • Secure installation, configuration, and management
    • Web-based manager
    • Command line interface
    • Logging and reporting
  • Document conventions
  • Fortinet documentation
    • Comments on Fortinet technical documentation
  • Customer service and technical support
• Getting started
  • Package contents
  • Mounting
    • Dimensions
    • Weight
    • Power requirements
    • Environmental specifications
  • Powering on
  • Connecting to the web-based manager
  • Connecting to the command line interface (CLI)
  • Factory default FortiGate configuration settings
    • Factory default NAT/Route mode network configuration
    • Factory default Transparent mode network configuration
    • Factory default firewall configuration
    • Factory default content profiles
      • Strict content profile
      • Scan content profile
      • Web content profile
      • Unfiltered content profile
  • Planning the FortiGate configuration
    • NAT/Route mode
    • NAT/Route mode with multiple external network connections
    • Transparent mode
    • Configuration options
      • Setup wizard
      • CLI
      • Front keypad and LCD
  • FortiGate model maximum values matrix
  • Next steps
• NAT/Route mode installation
  • Preparing to configure NAT/Route mode
    • Advanced NAT/Route mode settings
    • DMZ and user-defined interfaces
  • Using the setup wizard
    • Starting the setup wizard
    • Reconnecting to the web-based manager
  • Using the front control buttons and LCD
  • Using the command line interface
    • Configuring the FortiGate unit to operate in NAT/Route mode
      • Configuring NAT/Route mode IP addresses
  • Connecting the FortiGate unit to your networks
  • Configuring your networks
  • Completing the configuration
    • Configuring the DMZ interface
    • Configuring interfaces 1 to 4
    • Setting the date and time
    • Changing antivirus protection
    • Registering your FortiGate unit
    • Configuring virus and attack definition updates
  • Configuration example: Multiple connections to the Internet
    • Configuring ping servers
      • Using the CLI
    • Destination-based routing examples
      • Primary and backup links to the Internet
      • Using the CLI
      • Load sharing
      • Load sharing and primary and secondary connections
    • Policy routing examples
      • Routing traffic from internal subnets to different external networks
      • Routing a service to an external network
    • Firewall policy example
      • Adding a redundant default policy
      • Adding more firewall policies
      • Restricting access to a single Internet connection
• Transparent mode installation
  • Preparing to configure Transparent mode
  • Using the setup wizard
    • Changing to Transparent mode using the web-based manager
    • Starting the setup wizard
    • Reconnecting to the web-based manager
  • Using the front control buttons and LCD
  • Using the command line interface
    • Changing to Transparent mode using the CLI
    • Configuring the Transparent mode management IP address
    • Configure the Transparent mode default gateway
  • Completing the configuration
    • Setting the date and time
    • Enabling antivirus protection
    • Registering your FortiGate unit
    • Configuring virus and attack definition updates
  • Connecting the FortiGate unit to your networks
  • Transparent mode configuration examples
    • Default routes and static routes
    • Example default route to an external network
      • General configuration steps
      • Web-based manager example configuration steps
      • CLI configuration steps
    • Example static route to an external destination
      • General configuration steps
      • Web-based manager example configuration steps
      • CLI configuration steps
    • Example static route to an internal destination
      • General configuration steps
      • Web-based manager example configuration steps
      • CLI configuration steps
• High availability
  • Configuring an HA cluster
    • Configuring FortiGate units for HA operation
    • Connecting the cluster
    • Adding a new FortiGate unit to a functioning cluster
  • Managing an HA cluster
    • Configuring cluster interface monitoring
    • Viewing the status of cluster members
    • Monitoring cluster members
    • Viewing cluster sessions
    • Viewing and managing cluster log messages
    • Monitoring cluster units for failover
    • Viewing cluster communication sessions
    • Managing individual cluster units
    • Changing cluster unit host names
    • Synchronizing the cluster configuration
    • Upgrading firmware
    • Replacing a FortiGate unit after failover
  • Advanced HA options
    • Selecting a FortiGate unit as a permanent primary unit
    • Configuring the priority of each FortiGate unit in the cluster
    • Configuring weighted-round-robin weights
  • Active-Active cluster packet flow
    • NAT/Route mode packet flow
    • Configuring switches to work with a NAT/Route mode cluster
    • Transparent mode packet flow
• System status
  • Changing the FortiGate host name
  • Changing the FortiGate firmware
    • Upgrading to a new firmware version
      • Upgrading the firmware using the web-based manager
      • Upgrading the firmware using the CLI
    • Reverting to a previous firmware version
      • Reverting to a previous firmware version using the web-based manager
      • Reverting to a previous firmware version using the CLI
    • Installing firmware images from a system reboot using the CLI
      • Restoring the previous configuration
    • Testing a new firmware image before installing it
    • Installing and using a backup firmware image
      • Installing a backup firmware image
      • Switching to the backup firmware image
      • Switching back to the default firmware image
  • Manual virus definition updates
  • Manual attack definition updates
  • Displaying the FortiGate serial number
  • Displaying the FortiGate up time
  • Displaying log hard disk status
  • Backing up system settings
  • Restoring system settings
  • Restoring system settings to factory defaults
  • Changing to Transparent mode
  • Changing to NAT/Route mode
  • Restarting the FortiGate unit
  • Shutting down the FortiGate unit
  • System status
    • Viewing CPU and memory status
    • Viewing sessions and network status
    • Viewing virus and intrusions status
  • Session list
• Virus and attack definitions updates and registration
  • Updating antivirus and attack definitions
    • Connecting to the FortiResponse Distribution Network
    • Manually initiating antivirus and attack definitions updates
    • Configuring update logging
  • Scheduling updates
    • Enabling scheduled updates
    • Adding an override server
    • Enabling scheduled updates through a proxy server
  • Enabling push updates
    • Enabling push updates
    • Push updates when FortiGate IP addresses change
    • Enabling push updates through a NAT device
      • Example: push updates through a NAT device
      • Adding a port forwarding virtual IP to the FortiGate NAT device
      • Adding a firewall policy for the port forwarding virtual IP
      • Configuring the FortiGate unit with an override push IP and port
  • Registering FortiGate units
    • FortiCare Service Contracts
    • Registering the FortiGate unit
  • Updating registration information
    • Recovering a lost Fortinet support password
    • Viewing the list of registered FortiGate units
    • Registering a new FortiGate unit
    • Adding or changing a FortiCare Support Contract number
    • Changing your Fortinet support password
    • Changing your contact information or security question
    • Downloading virus and attack definitions updates
  • Registering a FortiGate unit after an RMA
• Network configuration
  • Configuring zones
    • Adding zones
    • Deleting zones
  • Configuring interfaces
    • Viewing the interface list
    • Changing the administrative status of an interface
    • Adding an interface to a zone
    • Configuring an interface with a manual IP address
    • Configuring an interface for DHCP
    • Configuring an interface for PPPoE
    • Adding a secondary IP address to an interface
    • Adding a ping server to an interface
    • Controlling administrative access to an interface
    • Changing the MTU size to improve network performance
    • Configuring traffic logging for connections to an interface
    • Configuring the management interface in Transparent mode
  • VLAN overview
  • VLANs in NAT/Route mode
    • Rules for VLAN IDs
    • Rules for VLAN IP addresses
    • Adding VLAN subinterfaces
  • Virtual domains in Transparent mode
    • Virtual domain properties
    • Configuring a virtual domain
      • Adding a virtual domain
      • Adding VLAN subinterfaces to a virtual domain
      • Adding zones to virtual domains
    • Adding firewall policies for virtual domains
      • Adding addresses for virtual domains
      • Adding firewall policies for virtual domains
    • Deleting virtual domains
  • Adding DNS server IP addresses
  • Configuring routing
    • Adding a default route
    • Adding destination-based routes to the routing table
    • Adding routes in Transparent mode
    • Configuring the routing table
    • Policy routing
      • Policy routing command syntax
  • Configuring DHCP services
    • Configuring a DHCP relay agent
    • Configuring a DHCP server
      • Adding a DHCP server to an interface
      • Adding scopes to a DHCP server
      • Adding a reserve IP to a DHCP server
      • Viewing a DHCP server dynamic IP list
• RIP configuration
  • RIP settings
  • Configuring RIP for FortiGate interfaces
  • Adding RIP filters
    • Adding a RIP filter list
    • Assigning a RIP filter list to the neighbors filter
    • Assigning a RIP filter list to the incoming filter
    • Assigning a RIP filter list to the outgoing filter
• System configuration
  • Setting system date and time
  • Changing system options
    • Modifying the Dead Gateway Detection settings
  • Adding and editing administrator accounts
    • Adding new administrator accounts
    • Editing administrator accounts
  • Configuring SNMP
    • Configuring the FortiGate unit for SNMP monitoring
    • Configuring FortiGate SNMP support
      • Configuring SNMP access to an interface
      • Configuring SNMP community settings
    • FortiGate MIBs
    • FortiGate traps
      • General FortiGate traps
      • System traps
      • VPN traps
      • NIDS traps
      • Antivirus traps
      • Logging traps
    • Fortinet MIB fields
      • System configuration and status
      • Firewall configuration
      • Users and authentication configuration
      • VPN configuration and status
      • NIDS configuration
      • Antivirus configuration
      • Web filter configuration
      • Logging and reporting configuration
  • Replacement messages
    • Customizing replacement messages
    • Customizing alert emails
• Firewall configuration
  • Default firewall configuration
    • Interfaces
    • VLAN subinterfaces
    • Zones
    • Addresses
    • Services
    • Schedules
    • Content profiles
  • Adding firewall policies
    • Firewall policy options
      • Source
      • Destination
      • Schedule
      • Service
      • Action
      • NAT
      • VPN Tunnel
      • Traffic Shaping
      • Authentication
      • Anti-Virus & Web filter
      • Log Traffic
      • Comments
  • Configuring policy lists
    • Policy matching in detail
    • Changing the order of policies in a policy list
    • Enabling and disabling policies
      • Disabling policies
      • Enabling policies
  • Addresses
    • Adding addresses
    • Editing addresses
    • Deleting addresses
    • Organizing addresses into address groups
  • Services
    • Predefined services
    • Adding custom TCP and UDP services
    • Adding custom ICMP services
    • Adding custom IP services
    • Grouping services
  • Schedules
    • Creating one-time schedules
    • Creating recurring schedules
    • Adding schedules to policies
  • Virtual IPs
    • Adding static NAT virtual IPs
    • Adding port forwarding virtual IPs
    • Adding policies with virtual IPs
  • IP pools
    • Adding an IP pool
    • IP Pools for firewall policies that use fixed ports
    • IP pools and dynamic NAT
  • IP/MAC binding
    • Configuring IP/MAC binding for packets going through the firewall
    • Configuring IP/MAC binding for packets going to the firewall
    • Adding IP/MAC addresses
    • Viewing the dynamic IP/MAC list
    • Enabling IP/MAC binding
  • Content profiles
    • Default content profiles
    • Adding content profiles
    • Adding content profiles to policies
• Users and authentication
  • Setting authentication timeout
  • Adding user names and configuring authentication
    • Adding user names and configuring authentication
    • Deleting user names from the internal database
  • Configuring RADIUS support
    • Adding RADIUS servers
    • Deleting RADIUS servers
  • Configuring LDAP support
    • Adding LDAP servers
    • Deleting LDAP servers
  • Configuring user groups
    • Adding user groups
    • Deleting user groups
• IPSec VPN
  • Key management
    • Manual Keys
    • Automatic Internet Key Exchange (AutoIKE) with pre-shared keys or certificates
      • AutoIKE with pre-shared keys
      • AutoIKE with certificates
  • Manual key IPSec VPNs
    • General configuration steps for a manual key VPN
    • Adding a manual key VPN tunnel
  • AutoIKE IPSec VPNs
    • General configuration steps for an AutoIKE VPN
    • Adding a phase 1 configuration for an AutoIKE VPN
      • Configuring advanced options
    • Adding a phase 2 configuration for an AutoIKE VPN
  • Managing digital certificates
    • Obtaining a signed local certificate
      • Generating the certificate request
      • Downloading the certificate request
      • Importing the signed local certificate
      • Backing up and restoring the local certificate and private key
    • Obtaining CA certificates
      • Importing CA certificates
  • Configuring encrypt policies
    • Adding a source address
    • Adding a destination address
    • Adding an encrypt policy
  • IPSec VPN concentrators
    • VPN concentrator (hub) general configuration steps
    • Adding a VPN concentrator
    • VPN spoke general configuration steps
  • Redundant IPSec VPNs
    • Configuring redundant IPSec VPNs
  • Monitoring and Troubleshooting VPNs
    • Viewing VPN tunnel status
    • Viewing dialup VPN connection status
    • Testing a VPN
• PPTP and L2TP VPN
  • Configuring PPTP
    • Configuring the FortiGate unit as a PPTP gateway
    • Configuring a Windows 98 client for PPTP
    • Configuring a Windows 2000 client for PPTP
    • Configuring a Windows XP client for PPTP
  • Configuring L2TP
    • Configuring the FortiGate unit as an L2TP gateway
    • Configuring a Windows 2000 client for L2TP
    • Configuring a Windows XP client for L2TP
• Network Intrusion Detection System (NIDS)
  • Detecting attacks
    • Selecting the interfaces to monitor
    • Disabling monitoring interfaces
    • Configuring checksum verification
    • Viewing the signature list
    • Viewing attack descriptions
    • Disabling NIDS attack signatures
    • Adding user-defined signatures
      • Downloading the user-defined signature list
  • Preventing attacks
    • Enabling NIDS attack prevention
    • Enabling NIDS attack prevention signatures
    • Setting signature threshold values
  • Logging attacks
    • Logging attack messages to the attack log
    • Reducing the number of NIDS attack log and email messages
      • Automatic message reduction
      • Manual message reduction
• Antivirus protection
  • General configuration steps
  • Antivirus scanning
  • File blocking
    • Blocking files in firewall traffic
    • Adding file patterns to block
  • Quarantine
    • Quarantining infected files
    • Quarantining blocked files
    • Viewing the quarantine list
    • Sorting the quarantine list
    • Filtering the quarantine list
    • Deleting files from the quarantine list
    • Downloading quarantined files
    • Configuring quarantine options
  • Blocking oversized files and emails
    • Configuring limits for oversized files and email
  • Exempting fragmented email from blocking
  • Viewing the virus list
• Web filtering
  • General configuration steps
  • Content blocking
    • Adding words and phrases to the Banned Word list
    • Clearing the Banned Word list
    • Backing up the Banned Word list
    • Restoring the Banned Word list
  • URL blocking
    • Configuring FortiGate Web URL blocking
      • Adding URLs to the Web URL block list
      • Clearing the Web URL block list
      • Downloading the Web URL block list
      • Uploading a URL block list
    • Configuring FortiGate Web pattern blocking
  • Configuring Cerberian URL filtering
    • Installing a Cerberian license key
    • Adding a Cerberian user
    • Configuring Cerberian web filter
      • About the default group and policy
    • Enabling Cerberian URL filtering
  • Script filtering
    • Enabling script filtering
    • Selecting script filter options
  • Exempt URL list
    • Adding URLs to the URL Exempt list
    • Downloading the URL Exempt List
    • Uploading a URL Exempt List
• Email filter
  • General configuration steps
  • Email banned word list
    • Adding words and phrases to the email banned word list
    • Downloading the email banned word list
    • Uploading the email banned word list
  • Email block list
    • Adding address patterns to the email block list
    • Downloading the email block list
    • Uploading an email block list
  • Email exempt list
    • Adding address patterns to the email exempt list
  • Adding a subject tag
• Logging and reporting
  • Recording logs
    • Recording logs on a remote computer
    • Recording logs on a NetIQ WebTrends server
    • Recording logs on the FortiGate hard disk
    • Recording logs in system memory
    • Log message levels
  • Filtering log messages
  • Configuring traffic logging
    • Enabling traffic logging
      • Enabling traffic logging for an interface
      • Enabling traffic logging for a VLAN subinterface
      • Enabling traffic logging for a firewall policy
    • Configuring traffic filter settings
    • Adding traffic filter entries
  • Viewing logs saved to memory
    • Viewing logs
    • Searching logs
  • Viewing and managing logs saved to the hard disk
    • Viewing logs
    • Searching logs
    • Downloading a log file to the management computer
    • Deleting all messages from an active log
    • Deleting a saved log file
  • Configuring alert email
    • Adding alert email addresses
    • Testing alert email
    • Enabling alert email
• Glossary
• Index