Home
Chapter 1 - What's New for FortiOS 5.2
Introduction
New features in FortiOS 5.2.12
New features in FortiOS 5.2.9
New features in FortiOS 5.2.8
New features in FortiOS 5.2.5
New features in FortiOS 5.2.4
New features in FortiOS 5.2.3
New features in FortiOS 5.2.2
New features in FortiOS 5.2.1
Top Features
System Features
Usability Enhancements
Firewall
Security Profiles
IPsec VPN
SSL VPN
Authentication
Managing Devices
Wireless Networking
IPv6
High Availability
WAN Optimization, Web Cache, and Explicit Proxy
Advanced Routing
Logging and Reporting
Other New Features
RFC List
Chapter 2 - Getting Started
Introduction
Differences between Models
Installation
Using the Web-Based Manager
Basic Administration
Next Steps
Chapter 3 - Advanced Routing
Introduction
Advanced Static Routing
Routing concepts
Static routing tips
Policy routing
Transparent mode static routing
Static routing example
Advanced static routing example: ECMP failover and load balancing
Dynamic Routing Overview
What is dynamic routing?
Comparison of dynamic routing protocols
Choosing a routing protocol
Dynamic routing terminology
IPv6 in dynamic routing
Routing Information Protocol (RIP)
RIP background and concepts
Troubleshooting RIP
Simple RIP example
RIPng — RIP and IPv6
Border Gateway Protocol (BGP)
BGP background and concepts
Troubleshooting BGP
Dual-homed BGP example
Redistributing and blocking routes in BGP
Open Shortest Path First (OSPF)
OSPF Background and concepts
Troubleshooting OSPF
Basic OSPF example
Advanced inter-area OSPF example
Controlling redundant links by cost
Intermediate System to Intermediate System Protocol (IS-IS)
IS-IS background and concepts
How IS-IS works
Simple IS-IS example
Chapter 4 - Authentication
Change log
Introduction
Introduction to authentication
Authentication servers
Users and user groups
Managing Guest Access
Configuring authenticated access
Captive portals
Certificate-based authentication
Single Sign-On using a FortiAuthenticator unit
Single Sign-On to Windows AD
Agent-based FSSO
SSO using RADIUS accounting records
Monitoring authenticated users
Examples and Troubleshooting
Chapter 5 - Best Practices
Overview
General Considerations
Customer service and technical support
Fortinet Knowledge Base
System and performance
Performance
Shutting down
Migration
Information gathering
Object and policy migration
Testing and validation
Going live and obtaining feedback
Adding new services
Environmental specifications
Grounding
Rack mounting
Firmware
Firmware change management
Performing a firmware upgrade
Performing a firmware downgrade
Performing a configuration backup
Security Profiles
Firewall
Security
Authentication
Antivirus
Antispam
Intrusion Prevention System (IPS)
Email filter
URL filtering
Web filtering
Patch management
Policy configuration
Networking
Routing configuration
Advanced routing
Network Address Translation (NAT)
Transparent Mode
Using Virtual IPs (VIPs)
High Availability
Heartbeat interfaces
Interface monitoring
WAN Optimization
VDOMs
Per-VDOM resource settings
Virtual domains in NAT/Route mode
Virtual clustering
Explicit proxy
Wireless
Encryption and authentication
Geographic location
Network planning
Lowering the power level to reduce RF interference
Wireless client load balancing
Local bridging
Advertising SSIDs
Using static IPs in a CAPWAP configuration
Logging and reporting
Log management
System memory and hard disks
Chapter 6 - FortiOS Carrier
Introduction
Overview of FortiOS Carrier features
Carrier web-based manager settings
MMS Security features
Message flood protection
Duplicate message protection
Configuring GTP on FortiOS Carrier
GTP message type filtering
GTP identity filtering
Troubleshooting
Chapter 7 - Compliance
Introduction
Configuring FortiGate units for PCI DSS compliance
Chapter 8 - Deploying Wireless Networks
Introduction
Introduction to wireless networking
Wireless concepts
Security
Authentication
Wireless networking equipment
Automatic Radio Resource Provisioning
Configuring a WiFi LAN
Overview of WiFi controller configuration
Setting your geographic location
Creating a FortiAP Profile
Defining a wireless network interface (SSID)
Dynamic VLAN assignment
Configuring user authentication
Configuring firewall policies for the SSID
Configuring the built-in access point on a FortiWiFi unit
Access point deployment
Network topology for managed APs
Discovering and authorizing APs
Advanced WiFi controller discovery
Wireless client load balancing for high-density deployments
LAN port options
Preventing IP fragmentation of packets in CAPWAP tunnels
Wireless Mesh
Overview of Wireless Mesh
Configuring a meshed WiFi network
Configuring a point-to-point bridge
Combining WiFi and wired networks with a software switch
Combining WiFi and wired networks with a software switch
FortiAP local bridging (Private Cloud-Managed AP)
Using bridged FortiAPs to increase scalability
Using Remote FortiAPs
Features for high-density deployments
Protecting the WiFi Network
Wireless IDS
WiFi data channel encryption
Wireless network monitoring
Monitoring wireless clients
Monitoring rogue APs
Suppressing rogue APs
Monitoring wireless network health
Configuring wireless network clients
Windows XP client
Windows 7 client
Mac OS client
Linux client
Troubleshooting
Wireless network examples
Basic wireless network
A more complex example
Using a FortiWiFi unit as a client
Use of client mode
Configuring client mode
Support for location-based services
Overview
Configuring location tracking
Viewing device location data on the FortiGate unit
Reference
Wireless radio channels
FortiAP CLI
Chapter 9 - Firewall
Introduction
How does a FortiGate Protect Your Network
Firewall concepts
What is a Firewall
IPv6
NAT
How Packets are handled by FortiOS
FortiGate Modes
Quality of Service
Interfaces and Zones
Firewall objects
UUID Support
Addresses
Address Groups
Virtual IPs
Virtual IP Groups
IP Pools
Services and TCP ports
Firewall schedules
Schedule Groups
Security policies
Firewall policies
Security profiles
SSL/SSH Inspection
Identity Based Policies
VPN Policies
Interface Policies
DoS Protection
Local-In Policies
Security Policy 0
Deny Policies
Accept Policies
Fixed Port
Endpoint Security
Traffic Logging
Quality of Service
Policy Monitor
Network defense
Monitoring
Blocking external probes
Defending against DoS attacks
GUI & CLI - What You May Not Know
Mouse Tricks
Changing the default column setting on the policy page
Naming Rules and Restrictions
Character Restrictions
Numeric Values
Numeric Values
Selecting options from a list
Enabling or disabling options
To Enable or Disable Optionally Displayed Features
Building firewall objects and policies
Building firewall objects and policies
Example: IPv4 Firewall Addresses
Example: IPv6 Firewall Addresses
Example: FQDN address
Changing the TTL of a FQDN address
Example: Geography-based Address
Example: IPv4 Address Group
Example: IPv6 Address Group
Example: Multicast Address
Example: Service Category
Example: TCP/UDP/SCTP Service
Example: ICMP Service
Example: ICMPv6 Service
Example: Service Group
Example: Virtual IP address
Example: IP Pool
Example: Central NAT Table
Example: Firewall Schedule - Recurring
Example: Firewall Schedule - One-time
Example: Schedule Group
Example: Proxy Option
Example: DoS Policy
Multicast forwarding
Sparse mode
Dense mode
Multicast IP addresses
PIM Support
Multicast forwarding and FortiGate units
Configuring FortiGate multicast forwarding
Multicast routing examples
Chapter 10 - FortiView
Introduction
Overview
Enabling FortiView
Dashboard Interface
FortiView consoles
Sources
Applications
Cloud Applications
Destinations
Web Sites
Threats
All Sessions
System Events
Admin Logins
VPN
Reference
Filtering options
Drilldown options
Columns displayed
Risk level indicators
Troubleshooting FortiView
Chapter 11 - Hardening
Hardening your FortiGate
Install the FortiGate unit in a physically secure location
Maintain the firmware
Add new administrator accounts
Change the admin account name and limit access to this account
Only allow administrative access to the external interface when needed
When enabling remote access, configure Trusted Hosts and Two-factor Authentication
Change the default administrative port to a non-standard port
Modify the device name
Register with support services
Maintain short login timeouts
Enable automatic clock synchronization
Enable Password Policy
Modify administrator account Lockout Duration and Threshold values
Disable auto installation via USB
Configure auditing and logging
Chapter 12 - Hardware Acceleration
Introduction
Hardware acceleration overview
NP6 Acceleration
FortiGate NP6 architectures
FortiGate-300D fast path architecture
FortiGate-400D fast path architecture
FortiGate-500D fast path architecture
FortiGate-600D fast path architecture
FortiGate-800D fast path architecture
FortiGate-900D fast path architecture
FortiGate-1000D fast path architecture
FortiGate-1200D fast path architecture
FortiGate-1500D fast path architecture
FortiGate-1500DT fast path architecture
FortiGate-3000D fast path architecture
FortiGate-3100D fast path architecture
FortiGate-3200D fast path architecture
FortiGate-3700D fast path architecture
FortiGate-3700DX fast path architecture
FortiGate-3810D fast path architecture
FortiGate-3815D fast path architecture
FortiGate-5001D fast path architecture
FortiController-5902D fast path architecture
NP4 Acceleration
FortiGate NP4 architectures
NP4 and NP6 diagnose commands
Chapter 13 - High Availability
Introduction
Solving the High Availability problem
An introduction to the FGCP
About the FGCP
Synchronizing the configuration (and settings that are not synchronized)
Preparing the FortiGates before you set up a FGCP cluster
Configuring FortiGate units for FGCP HA operation
Active-passive and active-active HA
Identifying the cluster and cluster units
Device failover, link failover, and session failover
Primary unit selection
HA override
FortiGate HA compatibility with DHCP and PPPoE
HA and distributed clustering
Clusters of three or four FortiGate units
Disk storage configuration and HA
FGCP high availability best practices
FGCP HA terminology
HA GUI options
FGCP configuration examples and troubleshooting
About the examples in this chapter
How to set up FGCP clustering (recommended steps)
Setting up two new FortiGates as an FGCP cluster
Adding a new FortiGate to an operating cluster
Active-active HA cluster in Transparent mode
FortiGate-5000 active-active HA cluster with FortiClient licenses
Example converting a standalone FortiGate unit to a cluster
Example replacing a failed cluster unit
Example FGCP HA and 802.3ad aggregated interfaces
Example HA and redundant interfaces
Troubleshooting HA clusters
Virtual clusters
Full mesh HA
Operating a cluster
HA and failover protection
HA and load balancing
HA with third-party products
VRRP
FortiGate Session Life Support Protocol (FGSP)
Configuring FRUP
Chapter 14 - IPsec VPN
Introduction
IPsec VPN concepts
VPN tunnels
VPN gateways
Clients, servers, and peers
Encryption
Authentication
Phase 1 and Phase 2 settings
Security Association
IKE and IPsec packet processing
IPsec VPN overview
Types of VPNs
Planning your VPN
General preparation steps
How to use this guide to configure an IPsec VPN
IPsec VPN in the web-based manager
Auto Key (IKE)
Concentrator
IPsec Monitor
Phase 1 parameters
Overview
Defining the tunnel ends
Choosing Main mode or Aggressive mode
Authenticating the FortiGate unit
Authenticating remote peers and clients
Defining IKE negotiation parameters
Using XAuth authentication
Dynamic IPsec route control
Phase 2 parameters
Phase 2 settings
Configuring the Phase 2 parameters
Defining VPN security policies
Defining policy addresses
Defining VPN security policies
Gateway-to-gateway configurations
Configuration overview
General configuration steps
Configuring the two VPN peers
How to work with overlapping subnets
Testing
Hub-and-spoke configurations
Configuration overview
Configure the hub
Configure the spokes
Dynamic spokes configuration example
Dynamic DNS configuration
Dynamic DNS over VPN concepts
Dynamic DNS topology
General configuration steps
Configure the dynamically-addressed VPN peer
Configure the fixed-address VPN peer
Testing
FortiClient dialup-client configurations
Configuration overview
FortiClient-to-FortiGate VPN configuration steps
Configure the FortiGate unit
Configure the FortiClient Endpoint Security application
Adding XAuth authentication
FortiClient dialup-client configuration example
FortiGate dialup-client configurations
Configuration overview
FortiGate dialup-client configuration steps
Configure the server to accept FortiGate dialup-client connections
Configure the FortiGate dialup client
Supporting IKE Mode config clients
Automatic configuration overview
IKE Mode Config overview
Configuring IKE Mode Config
Example FortiGate unit as IKE Mode Config server
Example FortiGate unit as IKE Mode Config client
Internet-browsing configuration
Configuration overview
Creating an Internet browsing security policy
Routing all remote traffic through the VPN tunnel
Redundant VPN configurations
Configuration overview
General configuration steps
Configure the VPN peers - route-based VPN
Redundant route-based VPN configuration example
Partially-redundant route-based VPN example
Creating a backup IPsec interface
Transparent mode VPNs
Configuration overview
Configure the VPN peers
IPv6 IPsec VPNs
Overview of IPv6 IPsec support
Configuring IPv6 IPsec VPNs
Site-to-site IPv6 over IPv6 VPN example
Site-to-site IPv4 over IPv6 VPN example
Site-to-site IPv6 over IPv4 VPN example
L2TP and IPsec (Microsoft VPN)
Overview
Assumptions
Configuring the FortiGate unit
Configuring the Windows PC
Troubleshooting
GRE over IPsec (Cisco VPN)
Overview
Configuring the FortiGate unit
Configuring the Cisco router
Troubleshooting
Protecting OSPF with IPsec
Overview
OSPF over IPsec configuration
Creating a redundant configuration
Redundant OSPF routing over IPsec
OSPF over dynamic IPsec
BGP over dynamic IPsec
Logging and monitoring
Monitoring VPN connections
Logging VPN events
Troubleshooting
VPN troubleshooting tips
General troubleshooting tips
Chapter 15 - IPv6
Introduction
IPv6 packet structure
Benefits of IPv6
IPv6 Features
IPv6 policies
IPv6 Network Address Translation
ICMPv6
IPv6 in dynamic routing
Dual stack routing
IPv6 tunnelling
SIP over IPv6
New Fortinet FortiGate IPv6 MIB fields
IPv6 Per-IP traffic shaper
DHCPv6
IPv6 forwarding
Obtaining IPv6 addresses from an IPv6 DHCP server
IPv6 Configuration
IPv6 address groups
IPv6 address ranges
IPv6 firewall addresses
ICMPv6
IPv6 IPsec VPN
TCP MSS values
BGP and IPv6
RIPng — RIP and IPv6
IPv6 RSSO support
IPv6 IPS
Blocking IPv6 packets by extension headers
IPv6 Denial of Service policies
Configure hosts in an SNMP v1/2c community to send queries or receive traps
IPv6 PIM sparse mode multicast routing
Chapter 16 - Load Balancing
Introduction
Configuring load balancing
Load balancing configuration examples
Load Balancing Videos
Chapter 17 - Logging and Reporting
Introduction
Logging and reporting overview
Logging and reporting for small networks
Logging and reporting for large networks
Advanced logging
Troubleshooting and logging
Chapter 18 - Managing Devices
Introduction
Managing “bring your own device”
Endpoint Protection
Vulnerability Scan
Chapter 19 - Managing a FortiSwitch with a FortiGate
Introduction
Set-up
VLAN configuration
Port Configuration
Scenarios
Chapter 20 - Parallel Path Processing - Life of a Packet
Introduction
Packet flow
Comparison of inspection layers
Example 1 Client/Server Connection
Example 2 Routing table update
Example 3 Dialup IPsec VPN with Application Control
Chapter 21 - Security Profiles
Introduction
Security Profiles overview
AntiVirus
Antivirus concepts
Enabling AntiVirus scanning
Testing your antivirus configuration
Example Scenerios
Web filter
Web filter concepts
Inspection Modes
FortiGuard Web Filtering Service
Overriding FortiGuard website categorization
SafeSearch
YouTube Education Filter
Static URL Filter
Web content filter
Advanced web filter configurations
Configuring Web Filter Profiles
Web Filter Examples
Application control
Application control concepts
Application Control Actions
Application considerations
Working with other FortiOS components
Application traffic shaping
Application control monitor
Enable Application Control
Application control examples
Intrusion protection
IPS concepts
Enable IPS scanning
IPS processing in an HA cluster
Configure IPS options
Enable IPS packet logging
IPS examples
Custom Application & IPS Signatures
Custom signature syntax
Custom signature keywords
Creating a custom signature to block access to example.com
Creating a custom signature to block the SMTP “vrfy” command
Creating a custom signature to block files according to the file's hash value
Email filter
Email filter concepts
Email filter techniques
Order of spam filtering
Spam actions
Email traffic types to inspect
Configuring an Email Filters
Email filter examples
Data leak prevention
Data leak prevention concepts
DLP archiving
Enable data leak prevention
Creating/editing a DLP sensor
DLP examples
ICAP
The Protocol
Offloading using ICAP
Configuration Settings
Example ICAP sequence
Example Scenario
Other Security Profiles considerations
Security Profiles and Virtual domains (VDOMs)
Conserve mode
SSL content scanning and inspection
Using wildcards and Perl regular expressions
Chapter 22 - SSL VPN
Overview
Introduction to SSL VPN
SSL VPN modes of operation
Port forwarding mode
Traveling and security
SSL VPN and IPv6
Basic configuration
User accounts and groups
Configuring SSL VPN web portals
Configuring security policies
Configuring encryption key algorithms
Additional configuration options
The SSL VPN client
FortiClient
Tunnel mode client configuration
The SSL VPN web portal
Connecting to the FortiGate unit
Web portal overview
Portal configuration
Using the My Bookmarks widget
Using the Connection Tool
Tunnel-mode features
Using the SSL VPN virtual desktop
Using FortiClient
Setup examples
Secure Internet browsing
Split Tunnel
Multiple user groups with different access permissions
Troubleshooting
Chapter 23 - System Administration
Introduction
Using the CLI
Firmware
Backing up the current configuration
Restoring a configuration file
Downloading firmware
Testing new firmware before installing
Upgrading the firmware - web-based manager
Upgrading the firmware - CLI
Installing firmware from a system reboot using the CLI
Reverting to a previous firmware version - web-based manager
Reverting to a previous firmware version - CLI
Configuration revision
Controlled upgrade
Interfaces
Central management
Monitoring
VLANs
PPTP and L2TP
Session helpers
Advanced concepts
Chapter 24 - Traffic Shaping
Introduction
The purpose of traffic shaping
Traffic shaping methods
Examples
Troubleshooting traffic shaping
Chapter 25 - Transparent Mode
Introduction
Feature matrix - Maximum values
FortiGate features and capabilities matrix - NAT and Transparent mode
Maximum number of Interfaces in Transparent Mode
Installation
Installing a FortiGate in Transparent mode
Using Port Pairing to Simplify Transparent Mode
Networking
Introduction
Firewall policies
Firewall policy lookup
Security Scanning
Firewall session list
ISF ACL policies
FortiGate remote management
Management IP configuration in Transparent mode
FortiManager, FortiAnalyzer
Transparent mode and HA
Transparent mode and HA
HA MAC address assignment
Virtual cluster
IPsec VPN in Transparent mode
Rules and details
IPsec configuration example 1 - remote sites in different subnets
IPsec configuration example 2 - remote sites in the same subnet and one remote subnet
Replay traffic scenario
Replay traffic scenario
Transparent mode reminder and best practices
Chapter 26 - Troubleshooting
Introduction
Troubleshooting methodologies
Troubleshooting tools
Common questions
Troubleshooting resources
Technical Support Organization Overview
Chapter 27 - Virtual Domains
Introduction
Virtual Domains
Virtual Domains in NAT/Route mode
Virtual Domains in Transparent mode
Inter-VDOM routing
Troubleshooting Virtual Domains
Chapter 28 - VM Installation
Introduction
FortiGate VM Overview
vm-models-and-licensing
reg-vm
download-vm-deploy-pkg
vm-deploy-pkg-contents
vm-deploy-overview
Deployment example: VMware
vm-ovf-file-open-with-vSphere
vm-vmware-fgt-cfg
vm-tp-vmware
vm-ha-vmware
power-on-vm-vm-ware
Deployment example: MS Hyper-V
vm-hyperv-create-vm
vm-hyperv-fgt-cfg
vm-ha-hyperv
power-on-vm-hyperv
Deployment example: KVM
vm-kvm-create-vm
vm-kvm-fgt-cfg
vm-power-on-kvm
Deployment example: OpenXen
vm-openxen-create-vmm
Deployment example: Citrix XenServer
vm-citrixxen-create-vm
vm-citrixxen-cfg-vm
FortiGate VM Initial Configuration
vm-set-port1-ip
vm-connect-to-web-manager
vm-upload-license
vm-validate-license
vm-cfg-fgt-vm
Chapter 29 - VoIP Solutions: SIP
Introduction
FortiGate VoIP solutions: SIP
Chapter 30 - WAN Optimization, Web Cache, Explicit Proxy, and WCCP
Introduction
Example network topologies
Configuring WAN optimization
Peers and authentication groups
Configuration examples
Web caching and SSL offloading
FortiClient WAN optimization
The FortiGate explicit web proxy
The FortiGate explicit FTP proxy
FortiGate WCCP
Diagnose commands
All Files
Home
Video
FortiGuard
Fuse
KB
Support
Introduction
Introduction to wireless networking
Configuring a WiFi LAN
Access point deployment
Wireless Mesh
Combining WiFi and wired networks with a software switch
Using Remote FortiAPs
Features for high-density deployments
Protecting the WiFi Network
Wireless IDS
WiFi data channel encryption
Wireless network monitoring
Configuring wireless network clients
Wireless network examples
Using a FortiWiFi unit as a client
Support for location-based services
Reference
All Files
Home
>
Online Help
>
Chapter 8 - Deploying Wireless Networks
>
Protecting the WiFi Network
Protecting the WiFi Network
Wireless IDS
WiFi data channel encryption