Configuration Example: Fortigate Soho and SMB Version 3.0 Mr7
Configuration Example: Fortigate Soho and SMB Version 3.0 Mr7
Configuration Example: Fortigate Soho and SMB Version 3.0 Mr7
www.fortinet.com
FortiGate SOHO and SMB Configuration Example Version 3.0 MR7 9 September 2008 01-30007-0062-20080909 Copyright 2008 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet, Inc. Trademarks Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient, FortiGate, FortiGate Unified Threat Management System, FortiGuard, FortiGuard-Antispam, FortiGuardAntivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
Contents
Contents
Introduction ........................................................................................ 5
Revision history................................................................................................. 5 FortiGate Unified Threat Management Systems ............................................ 5 Other Fortinet products .................................................................................... 7 Fortinet documentation..................................................................................... 8 Comments on Fortinet technical documentation ........................................... 8 Customer service and technical support ........................................................ 8
First steps......................................................................................................... 16 Creating a network plan .............................................................................. 17 Configuring FortiGate network interfaces.................................................... 17 Adding the default route .............................................................................. 18 ............................................................Removing the default firewall policy 19 Configuring DNS forwarding ....................................................................... 19 Setting the time and date ............................................................................ 20 Registering the FortiGate unit ..................................................................... 20 Scheduling automatic antivirus and attack definition updates..................... 21 Configuring administrative access and passwords ..................................... 21 Configuring settings for Finance and Engineering departments ............... 23 Goals........................................................................................................... Adding the Finance and Engineering department addresses ..................... Configuring web category block settings..................................................... Configuring FortiGuard spam filter settings................................................. Configuring antivirus grayware settings ...................................................... Configuring the standard_profile firewall protection profile........................ Configuring firewall policies for Finance and Engineering .......................... 23 23 24 25 26 27 28
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Contents
Configuring settings for the Help Desk department .................................... 29 Goals........................................................................................................... Adding the Help Desk department address ................................................ Creating and Configuring URL filters and filter lists .................................... Creating a recurring schedule ..................................................................... Configuring the help_desk firewall protection profile ................................. Configuring firewall policies for help desk ................................................... Goals........................................................................................................... Adding addresses for home-based workers ............................................... Configuring the FortiGate end of the IPSec VPN tunnels ........................... Configuring firewall policies for the VPN tunnels ........................................ Configuring the FortiClient end of the IPSec VPN tunnels.......................... Goals........................................................................................................... Configuring the FortiGate unit with a virtual IP ........................................... Adding the web server address .................................................................. Configuring firewall policies for the web server........................................... 29 30 30 33 33 36 37 37 38 40 42 42 42 43 43
Configuring the email server.......................................................................... 45 Goals........................................................................................................... 45 Configuring the FortiGate unit with a virtual IP ........................................... 46 Adding the email server address ................................................................... 46 Configuring firewall policies for the email server......................................... 47 ISP web site and email hosting ...................................................................... 49 Company A internal network configuration.................................................. 50 Other features and products for SOHO......................................................... 50
Index.................................................................................................. 51
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Introduction
Revision history
Introduction
The FortiGate Configuration Example for SOHO (small office/home office) and SMB (small- to medium-sized business) provides a brief overview of FortiGate Unified Threat Management Systems, and a comprehensive example of a network implementation for a small company. This example attempts to employ some of the most common features applicable to small networks and can be easily adapted for planning your own network security implementation using a FortiGate firewall. A complete procedure using the web-based manager is included for each network configuration task, followed by the same procedure using the command line interface (CLI).
Revision history
Document 01-30000-0062-20060106 01-30000-0062-20060112 01-30003-0062-20061506 01-30004-0062-20070115 01-30005-0062-20070824 01-30006-0062-20080228 01-30007-0062-20080909 Description of changes First release of SOHO and SMB Guide updated for FortiOS v3.0 Added IM and P2P blocking to the help_desk protection profile. Updated CLI, Web UI, and Graphics. Now consistant with FortiOS V3.0. MR3 Updated any references to IPS, IM, P2P and VoIP. Updated against FortiOS V3.0. MR5. Updated against FortiOS V3.0. MR6. Updated against FortiOS V3.0. MR7.
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Introduction
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Introduction
FortiGuard service
FortiGuard service includes: virus encyclopedia attack encyclopedia vulnerability and patch list attack and virus definition updates attack and virus engine updates optional automatic push updates when new threats appear
FortiClient software
Fortinet's Remote FortiClient Host Security is designed to provide secure remote access to network resources for telecommuters, mobile workers, remote sites and partners. The FortiClient Host Security is an easy-to-use IPSec software client featuring an integrated personal firewall, Network Address Translation (NAT) Traversal, centralized policy management, multiple policy support for access to multiple devices, strong encryption, and a comprehensive set of tools for troubleshooting. Most popular Microsoft Windows operating systems are supported natively.
FortiManager tools
The FortiManager System is an integrated management and monitoring tool that enables enterprises and service providers to easily manage large numbers of FortiGate Unified Threat Management Systems. It minimizes the administrative effort required to deploy, configure, monitor, and maintain the full range of network protection services provide by FortiGate devices, supporting the needs of enterprises and service providers responsible for establishing and maintaining security policies across multiple, dispersed FortiGate installations.
FortiAnalyzer systems
The FortiAnalyzer Family of real-time logging systems is a series of dedicated hardware solutions that securely aggregate and analyze log data from multiple FortiGate Unified Threat Management Systems. The systems provide network administrators with a comprehensive view of network usage and security information, supporting the needs of enterprises and service providers responsible for discovering and addressing vulnerabilities across dispersed FortiGate installations. The FortiAnalyzer devices minimize the effort required to monitor and maintain acceptable use policies, to identify attack patterns and prosecute attackers, and to comply with governmental regulations regarding privacy and disclosure of security breaches. They accept and process a full range of log records provided by FortiGate devices, including traffic, event, virus, attack, content filtering, and email filtering data.
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Fortinet documentation
Introduction
Fortinet documentation
Information about FortiGate products is available from the following FortiGate User Manual volumes: FortiGate QuickStart Guide Provides basin information about connecting and installing a FortiGate unit. FortiGate Installation Guide Described how to install a FortiGate unit. Includes a hardware reference, default configuration information, installation procedures, connection procedures, and basic configuration procedures. Choose the guide for your product model number. FortiGate Administration Guide Provides basic information about how to configure a FortiGate unit, including how to define FortiGate protection profiles and firewall policies; how to apply intrusion prevention, antivirus protection, web content filtering, and spam filtering; and how to configure a VPN. FortiGate online help Provides a context-sensitive and searchable version of the Administration Guide in HTML format. You can access online help from the web-based manager as you work. FortiGate CLI Reference Guide Describes how to use the FortiGate CLI and contains a reference to all FortiGate CLI commands. FortiGate Log Message Reference Guide Describes the structure of FortiGate log messages and provides information about the log messages generated by the FortiGate unit. FortiGate High Availability Guide Contains in-depth information about the FortiGate high availability feature and the FortiGate Clustering protocol. FortiGate IPS Guide Describes how to configure FortiGate Intrusion Prevention System settings and how the FortiGate IPS deals with some common attacks. FortiGate VPN Guide Explains how to configure VPNs using the web-based manager. The FortiGate online help also contains procedures for using the FortiGate web-based manager to configure and manage the FortiGate unit.
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Introduction
Please visit the Fortinet Technical Support web site at http://support.fortinet.com to learn about the technical support services that Fortinet provides.
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Introduction
10
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Note: IP addresses and domain names used in this document are examples and are not valid outside of this example.
This document includes Example small office network The Fortinet solution First steps Configuring settings for Finance and Engineering departments Configuring settings for the Help Desk department Configuring remote access VPN tunnels Configuring the web server Configuring the email server ISP web site and email hosting Other features and products for SOHO
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
11
Existing topology
Figure 4: Example SOHO network before FortiGate installation
The Company A network provides limited functionality for their needs, including: a very basic router to manage the network traffic an email server hosted by the Internet Service Provider (ISP) a web server hosted by the ISP client-based antivirus software with no reliable central distribution of updates no secure method of providing remote connections for home-based workers
12
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Table 1: Company security goals and FortiGate solutions Security Policy/Goal Protect the internal network from attacks, intrusions, viruses, and spam. Automate network protection as much as possible to make management simpler FortiGate solution Enable IPS, antivirus, and spam filters.
There are several features to make maintenance simpler: enable automatic daily updates of antivirus and attack definitions enable automatic push updates so that Fortinet updates the virus list when new threats occur enable FortiGuard web filtering so that web requests are automatically filtered based on configured policies, with no required maintenance enable FortiGuard Antispam, an IP address black list and spam filter service that keeps track of known or suspected spammers, to automatically block spam with no required maintenance
Provide secure access for remote workers with static or dynamic IP addresses. Use a secure VPN client solution.
Configure secure IPSec VPN tunnels for remote access employees. Use Dynamic Domain Name Server (DDNS) VPN for users with dynamic IP addresses. Use the FortiClient software to establish a secure connection between the FortiGate unit and the home-based worker. See Configuring remote access VPN tunnels on page 37. Place the web and email servers on the DMZ network and create appropriate policies. See Configuring the web server on page 42. Enable FortiGuard web content filtering solution. See Configuring web category block settings on page 24.
Serve the web site and email from a DMZ to further protect internal data. Block access by all employees to potentially offensive web content.
Severely limit web access for certain Create a schedule that covers business hours, employees (help desk) during work create a custom web access solution, and include hours. these in a firewall policy for specific addresses. See Configuring settings for the Help Desk department on page 29.
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
13
Table 2: FortiGate models for SOHO/SMB Model FortiGate-50A FortiGate-60 Users* 1 to 5 1 to 25 Interfaces internal, external, modem internal, dmz, wan1, wan2, modem Summary For small remote offices, retail stores, and telecommuters For small offices Dual WAN link support for redundant Internet connections, an integrated 4port switch, and a DMZ interface For small offices requiring wireless connectivity All the features of the FortiGate-60 For small business, remote/satellite offices Includes a DMZ interface to support local email and web servers For small to mid-sized organizations An optional internal high capacity hard drive gives this model internal logging capability Front-panel LCD and keypad ease deployment For medium-sized businesses, enterprise branch offices, and large remote access populations An optional internal high capacity hard drive gives this model internal logging capability Front-panel LCD and keypad ease deployment
FortiWiFi-60
1 to 25
FortiGate-100A 25 to 35
FortiGate-200A 25 to 50
* The number of possible users depends on the use of processor-intensive features such as antivirus and IPS.
14
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Proposed topology
Figure 5 shows the Company A network configuration after installation of the FortiGate-100A.
Figure 5: SOHO network topology with FortiGate-100
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
15
Configuring FortiGate network interfaces on page 17 Configuring DNS forwarding on page 19 Scheduling automatic antivirus and attack definition updates on page 21 Setting the time and date on page 20 Configuring administrative access and passwords on page 21 Registering the FortiGate unit on page 20 Adding the default route on page 18 Removing the default firewall policy on page 19 Adding firewall policies for different addresses and address groups, see Configuring firewall policies for Finance and Engineering on page 28, Configuring firewall policies for help desk on page 36, and Configuring firewall policies for the VPN tunnels on page 40 Adding addresses and address groups, see Adding the Finance and Engineering department addresses on page 23, Adding the Help Desk department address on page 30, Adding addresses for homebased workers on page 37, Adding the web server address on page 43, and Adding the email server address on page 46 Creating a recurring schedule on page 33 Configuring protection profiles, see Configuring the standard_profile firewall protection profile on page 27, and Configuring the help_desk firewall protection profile on page 33 Configuring remote access VPN tunnels on page 37 (IPSec) enabling IPS sensors (see Configuring protection profiles) Scheduling automatic antivirus and attack definition updates on page 21 Configuring antivirus grayware settings on page 26 enabling virus scanning (see Configuring protection profiles) Scheduling automatic antivirus and attack definition updates on page 21 Configuring web category block settings on page 24 (FortiGuard) Creating and Configuring URL filters and filter lists on page 30 Configuring FortiGuard spam filter settings on page 25
Router Firewall
VPN IPS
Antivirus
First steps
First steps includes creating a network plan and configuring the basic FortiGate settings. Creating a network plan Configuring FortiGate network interfaces Adding the default route
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
16
First steps
Removing the default firewall policy Configuring DNS forwarding Setting the time and date Registering the FortiGate unit Scheduling automatic antivirus and attack definition updates Configuring administrative access and passwords
wan1 dmz1
To configure FortiGate network interfaces 1 2 Go to System > Network > Interface. Edit the internal interface:
Addressing mode IP/Netmask Administrative access Manual 192.168.100.1/255.255.255.0 HTTPS, PING, SSH
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
17
3 4
5 6
Select OK. To configure the FortiGate network interfaces using the CLI config system interface edit internal set ip 192.168.100.1 255.255.255.0 set allowaccess ping https ssh next edit wan1 set ip 64.230.120.8 255.255.255.0 set allowaccess https next edit dmz1 set ip 10.10.10.1 255.255.255.0 set allowaccess ping end
Select OK.
Note: Entering 0.0.0.0 as the IP and mask represents any IP address.
18
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
First steps
To add the default route using the CLI config router static edit 1 set device wan1 set gateway 64.230.254.39 set distance 10 end
3 4
Select internal under Enable DNS forwarding. Select Apply. To configure DNS forwarding using the CLI config system dns set autosvr disable set primary 239.120.20.1 set secondary 239.10.30.31 set fwdintf internal end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
19
3 4
Fill in all the required fields including the product model and serial number. Select Finish.
20
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
First steps
To check server access and enable daily and push updates using the CLI config system autoupdate push-update set status enable end config system autoupdate schedule set frequency daily set status enable set time 05:30 end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
21
5 6 7
Select OK. Go to System > Admin > Administrators. Select Create New and enter or select the following settings:
Administrator Password Confirm Password Trusted Host #1 Trusted Host #2 Access Profile admin_2 <psswrd> <psswrd> 192.168.100.60 / 255.255.255.0 (administrators computer) 192.168.100.51 / 255.255.255.0 (lab computer) admin_monitor
Select OK. To configure a new access profile and administrator account using the CLI config system accprofile edit admin_monitor set admingrp read set authgrp read set avgrp read set fwgrp read set ipsgrp read set loggrp read set mntgrp read set netgrp read set routegrp read set spamgrp read set sysgrp read set updategrp read
22
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
set vpngrp read set webgrp read end config system admin edit admin2 set accprofile admin_monitor set password <psswrd> set trusthost1 192.168.100.60 255.255.255.0 set trusthost2 192.168.100.51 255.255.255.0 end To change the admin password 1 2 Go to System > Admin > Administrators. Select the Change password icon beside the admin administrator.
3 4
Enter the new password and enter it again to confirm. Select OK. To change the admin password using the CLI config system admin edit admin set password <psswrd> end
Protect the network from spam and outside threats. Tasks include:
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
23
Company A adds address ranges to the firewall for Finance and Engineering so they can be included in firewall policies. The two address ranges are included in an address group to further simplify policy configuration. To add address ranges for Finance and Engineering 1 2 Go to Firewall > Address. Select Create New and enter or select the following settings:
Address Name Type Subnet / IP Range Interface Finance Subnet / IP Range 192.168.100.10 192.168.100.20
3 4
Select OK. Repeat to add an address called Eng with the IP Range 192.168.100.51 192.168.100.99. To add address ranges for Finance and Engineering using the CLI config firewall address edit Finance set type iprange set start-ip 192.168.100.10 set end-ip 192.168.100.20 next edit Eng set type iprange set start-ip 192.168.100.51 set end-ip 192.168.100.99 end To include the Finance and Eng addresses in an address group
1 2 3 4 5
Go to Firewall > Address > Group. Select Create New. Enter FinEng as the Group Name. Use the down arrow button to move the Finance and Eng addresses into the Members box. Select OK. To include the Finance and Eng addresses in an address group using the CLI config firewall addrgrp edit FinEng set member Finance Eng end
24
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
To enable the FortiGuard web filtering service 1 2 3 Go to System > Maintenance > FortiGuard. Expand Web Filtering and AntiSpam Options. Select Test Availability to make sure the FortiGate unit can access the FortiGuard server. After a moment, the FDN Status should change from a red/yellow flashing indicator to a solid green. Select the Enable Web Filter check box. Select the Enable CacheTTL check box and enter 3600 in the field. Select Apply.
Note: Enabling cache means web site ratings are stored in memory so that the FortiGuard server need not be contacted each time an often-accessed site is requested.
4 5 6
To enable FortiGuard web filtering using the CLI config system fortiguard set webfilter-status enable set webfilter-cache enable set webfilter-cache-ttl 3600 end
To configure the FortiGuard RBL spam filter settings using the CLI config system fortiguard set antispam-status enable set antispam-cache enable set antispam-cache-ttl 3600 end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
25
To enable grayware using the CLI config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable Adware
BHO
Dial
Download
Game
HackerTool
Hijacker
Joke
26
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end config antivirus grayware set status enable end
Keylog
NMT
P2P
Plugin
RAT
Spy
Toolbar
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
27
General Interest Job Search Shopping and Auction Personal Relationships Block Block Block
6 7
Select Spam Filtering and enable SMTP for IP address BWL check and E-mail address BWL check. Select IPS and and select the all_default IPS sensor. You can create your own IPS sensors. This option does not select denial of service (DoS) sensors. For more information, see the FortiGate Administration Guide.
Select OK. To configure the standard_profile firewall protection profile using the CLI config firewall profile edit standard_profile set ftp scan set http scan fortiguard-wf set imap scan set pop3 scan set smtp scan spamipbwl spamemailbwl set ips-sensor-status enable set ips-sensor all_default set ftgd-wf-deny g01 8 12 14 20 g04 g05 34 37 42 end
Note: The following policy is an internal to wan1 policy which uses the
standard_profile protection profile to provide antivirus, web category blocking, and FortiGuard spam filtering.
28
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
To configure the Finance and Engineering firewall policy 1 2 3 Go to Firewall > Policy. Select Create New. Enter or select the following settings:
Source Interface / Zone Source Address Destination Interface / Zone Destination Address Schedule Service Action NAT Protection Profile internal FinEng wan1 All Always ANY ACCEPT Enable Enable and select standard_profile
Select OK. To configure the Finance and Engineering firewall policy using the CLI config firewall policy edit 1 set action accept set dstaddr all set dstintf wan1 set profile-status enable set schedule always set service ANY set srcaddr FinEng set srcintf internal set profile standard_profile end
Goals
Provide complete control of web access. Tasks include: Adding the Help Desk department address Creating and Configuring URL filters and filter lists Creating a recurring schedule Configuring firewall policies for help desk
Enable greater access at certain times. Tasks include: Control traffic and maintain security. Tasks include:
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
29
Select OK. Adding the help desk department address using the CLI config firewall address edit Help_Desk set type iprange set start-ip 192.168.100.21 set end-ip 192.168.100.50 end
30
.* Regex Block
5 6
Select Enable. Select OK. This pattern blocks all web sites. To configure URL block using the CLI config webfilter urlfilter edit # config entries edit # set action block set type regex set status enable end end
Note: The edit command will only accept a number. Type edit ? for a list of URL filter lists and their corresponding number
To create a filter list for exempt URLs 1 2 3 4 Go to Web Filter > URL Filter. Select Create New. Enter CompanyA_Support as the name. Select OK. To create a filter list for exempt URLs using the CLI config webfilter urlfilter edit # (select any unused number) set name CompanyA_Support end To configure a filter to exempt URLs 1 2 3 4 Go to Web Filter > URL Filter. Select edit for CompanyA_Support. Select Create New. Enter the following settings:
URL Type Action www.CompanyAsupport.com Simple Exempt
5 6 7
Select Enable. Select OK. Repeat for each of the following URLs: intranet.CompanyA.com
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
31
www.dictionary.com www.ExampleReferenceSite.com
To configure URL exempt using the CLI config webfilter urlfilter edit # config entries edit www.CompanyAsupport.com set action exempt set type simple set status enable next edit intranet.CompanyA.com set action exempt set type simple set status enable next edit www.dictionary.com set action exempt set type simple set status enable next edit www.ExampleReferenceSite.com set action exempt set type simple set status enable end
Figure 6: The URL Filter list
32
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
end
Note: The move command will only accept a number. Type move ? for a list of URL filter lists and their corresponding numbers. Figure 7: The properly ordered URL Filter list
Select OK. To create a recurring schedule using the CLI config firewall schedule recurring edit lunch set day monday tuesday wednesday thursday friday set start 11:45 set end 14:00 end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
33
To add the work hours protection profile for help desk employees 1 2 3 4 5 6 Go to Firewall > Protection Profile and select Create New. Enter help_desk_work as the Profile Name. Select Anti-Virus and enable Virus Scan for HTTP, FTP, IMAP, POP3, and SMTP. Select Web Filtering and enable HTTP for Web Content Block and Web Content Exempt. Select Spam Filtering and enable SMTP for IP address BWL check and E-mail address BWL check. Select IPS and and select the all_default IPS sensor. You can create your own IPS sensors. This option does not select denial of service (DoS) sensors. For more information, see the FortiGate Administration Guide. 7 Select IM/P2P and enable examination of the five IM protocol types by selecting the check boxes beside their names in the column headings. Select Block Login for each of the five IM protocols In the same IM/P2P section, select Block from the Action drop down for each of the six P2P protocol types. Select OK. To add the work hours protection profile for help desk employees using the CLI config firewall profile edit help_desk set ftp scan set http scan urlfilter set imap scan set pop3 scan set smtp scan spamemailbwl spamipbwl set ips-sensor-status enable set ips-sensor all_default set aim enable-inspect block-im set icq enable-inspect block-im set msn enable-inspect block-im set yahoo enable-inspect block-im set set set set set set set end To add the lunch hour protection profile for help desk employees 1 2 3 Go to Firewall > Protection Profile and select Create New. Enter help_desk_lunch as the Profile Name. Select Anti-Virus and enable Virus Scan for HTTP, FTP, IMAP, POP3, and SMTP. p2p enable bittorrent block edonkey block gnutella block kazaa block skype block winny block
8 9
34
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Select FortiGuard Web Filtering and configure categories in the table as follows:
Potentially Liable Controversial Potentially Non-productive Games Potentially Bandwidth Consuming Potentially Security Violating General Interest Job Search Personal Relationships Shopping and Auction Personal Vehicles Block Block Block Block Block Block Block Block Block
5 6
Select Spam Filtering and enable SMTP for IP address BWL check and E-mail address BWL check. Select IPS and and select the all_default IPS sensor. You can create your own IPS sensors. This option does not select denial of service (DoS) sensors. For more information, see the FortiGate Administration Guide.
Select IM/P2P and enable examination of the five IM protocol types by selecting the check boxes beside their names in the column headings. Select Block Login for each of the five IM protocols In the same IM/P2P section, select Block from the Action drop down for each of the six P2P protocol types. Select OK. To add the lunch hour protection profile for help desk employees using the CLI config firewall profile edit help_desk_lunch set ftp scan set http scan fortiguard-wf set imap scan set pop3 scan set smtp scan spamemailbwl spamipbwl set ips-sensor-status enable set ips-sensor all_default set ftgd-wf-deny g01 g02 20 g04 g05 34 37 42 48 set aim enable-inspect block-im set icq enable-inspect block-im set msn enable-inspect block-im set yahoo enable-inspect block-im set set set set set set p2p enable bittorrent block edonkey block gnutella block kazaa block skype block
8 9
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
35
4 5
Select OK. Select the Insert Policy before icon beside policy 2.
Note: The FortiGate unit checks for matching policies in the order they appear in the list (not by policy ID number). For the lunch policy to work, it must go before the policy using the help-desk protection profile (above).
Select OK.
36
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Configuring firewall policies for help desk with the CLI config firewall policy edit 2 set action accept set dstaddr all set dstintf wan1 set profile-status enable set schedule always set service ANY set srcaddr Help_Desk set srcintf internal set profile help_desk next edit 3 set action accept set dstaddr all set dstintf wan1 set profile-status enable set schedule lunch set service ANY set srcaddr Help_Desk set srcintf internal set profile help_desk_lunch next move 2 before 1 move 3 before 2 end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
37
3 4
Select OK. Select Create New and enter or select the following settings:
Address Name Type Subnet / IP Range Interface Home_User_1 Subnet / IP Range 220.100.65.98 Any
Select OK. To add addresses for home-based workers using the CLI config firewall address edit CompanyA_Network set subnet 192.168.100.0 255.255.255.0 next edit Home_User_1 set subnet 220.100.65.98 255.255.255.0 end
38
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Preshared Key ke8S5hOqpG73Lz4 Note: The key must contain at least 6 printable characters and should only be known by network administrators. For optimum protection against currently known attacks, the key should consist of a minimum of 16 randomly chosen alphanumeric characters. The VPN peers must use the same preshared key. Accept any peer ID
Peer options
4 5 6
Select OK. Select Create Phase 1. Enter or select the following settings for Home_User_2:
Name Home2 (The name for the peer that connects to the Company A network.) example.net wan1 Main (ID protection) Note: The VPN peers must use the same mode. Preshared Key GT3wlf76FKN5f43U Note: The key must contain at least 6 printable characters and should only be known by network administrators. For optimum protection against currently known attacks, the key should consist of a minimum of 16 randomly chosen alphanumeric characters. The VPN peers must use the same preshared key. Accept any peer ID
Remote Gateway Dynamic DNS Dynamic DNS Local Interface Mode Authentication Method Pre-shared Key
Peer options
Select OK.
Note: Both ends (peers) of the VPN tunnel must use the same mode and authentication method.
To configure IPSec phase 1 using the CLI config vpn ipsec phase1 edit Home1 set type static set interface wan1 set authmethod psk set psksecret ke8S5hOqpG73Lz4 set remote-gw 220.100.65.98 set peertype any next edit Home2 set type ddns set interface wan1 set authmethod psk set psksecret GT3wlf76FKN5f43U set remotewgw-ddns example.net set peertype any end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
39
To configure IPSec phase 2 1 2 3 Go to VPN > IPSEC > Auto Key (IKE) Select Create Phase 2. Enter or select the following settings:
Name Phase 1 Home1_Tunnel Home1
4 5 6
Select OK. Select Create Phase 2. Enter or select the following settings:
Name Phase 1 Home2_Tunnel Home2
Select OK. To configure IPSec phase 2 using the CLI config vpn ipsec phase2 edit Home1_Tunnel set phase1name Home1 next edit Home2_Tunnel set phase1name Home2 end
Select OK
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
40
Select Create New and enter or select the following settings for Home_User_2:
Source Interface / Zone Source Address Destination Interface / Zone Destination Address Schedule Service Action VPN Tunnel Allow Inbound Allow outbound Inbound NAT Outbound NAT Protection Profile internal CompanyA_Network wan1 All Always ANY IPSEC Home2_Tunnel yes yes yes no Enable and select standard_profile
Select OK To configure firewall policies for the VPN tunnels using the CLI config firewall policy edit 5 set srcintf internal set dstintf wan1 set srcaddr CompanyA_Network set dstaddr Home_User_1 set action ipsec set schedule Always set service ANY set profile-status enable set profile standard_profile set inbound enable set outbound enable set natinbound enable set vpntunnel Home1 next edit 6 set srcintf internal set dstintf wan1 set srcaddr CompanyA_Network set dstaddr All set action ipsec set schedule Always set service ANY set profile_status enable set profile standard_profile set inbound enable set outbound enable set natinbound enable set vpntunnel Home2 end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
41
To configure FortiClient for Home_User_1 and Home_User_2 1 2 3 4 Open the FortiClient software on Home_User_1s computer. Go to VPN > Connections. Select Add. Enter the following information:
Connection Name Configuration Remote Gateway Remote Network Home1_home (A descriptive name for the connection.) Manual 64.230.120.8 (The FortiGate external interface IP address.) 192.168.100.1 / 255.255.255.0 (The Company A internal network address and netmask.) ke8S5hOqpG73Lz4 (The preshared key entered in phase 1.)
5 6
Alternately, Company A could have their web server hosted by an ISP. See ISP web site and email hosting on page 49.
42
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
To configure the FortiGate unit with a virtual IP 1 2 Go to Firewall > Virtual IP. Select Create New and enter or select the following settings:
Name External Interface Type External IP Address/ Range Mapped IP Address/ Range Web_Server_VIP wan1 Static NAT 64.230.125.70 10.10.10.2
Select OK. To configure a virtual IP using the CLI config firewall vip edit Web_Server_VIP set extintf wan1 set extip 64.230.125.70 set mappedip 10.10.10.2 end
Select OK. To add the web server address using the CLI config firewall address edit Web_Server set subnet 10.10.10.2 255.255.255.0 end
Configuring firewall policies for the web server wan1 -> dmz1 policies
Add a policy for users on the Internet (wan1) to access the Company A web site on the DMZ network.
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
43
To add a policy for web server access 1 2 Go to Firewall > Policy. Select Create New and enter or select the following settings:
Source Interface / Zone Source Address Destination Interface / Zone Destination Address Schedule Service Action Protection Profile wan1 All dmz1 Web_Server_VIP Always HTTP ACCEPT Enable and select standard_profile
Select OK. To add a policy for web server access using the CLI config firewall policy edit 7 set action accept set schedule always set service HTTP set srcaddr all set srcintf wan1 set dstaddr Web_Server_VIP set dstintf dmz1 set profile-status enable set profile standard_profile end
44
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
192.162.100.63/255.255.255.0 Any
Select OK. To add the web master address to the firewall using the CLI config firewall address edit Web_Master_J set subnet 192.168.100.63 255.255.255.0 end To add a policy for web master access to the web server
1 2
Go to Firewall > Policy. Select Create New and enter or select the following settings:
Source Interface / Zone Source Address Destination Interface / Zone Destination Address Schedule Service Action Protection Profile internal Web_Master_J dmz1 Web_Server Always FTP ACCEPT Enable and select standard_profile
Select OK. To add a policy for web master access to the web server using the CLI config firewall policy edit 8 set action accept set dstaddr Web_Server set dstintf dmz1 set schedule always set service FTP set srcaddr Web_Master_J set srcintf internal set profile-status enable set profile standard_profile end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
45
Control traffic and maintain security. Tasks include: Adding the email server address Configuring firewall policies for the email server
Alternately, Company A could have their email server hosted by an ISP. See ISP web site and email hosting on page 49.
Select OK. To configure a virtual IP using the CLI config firewall vip edit Email_Server_VIP set extintf wan1 set extip 64.230.120.8 set mappedip 10.10.10.3 end
46
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Select OK. To add the email server address to the firewall using the CLI config firewall address edit Email_Server set subnet 64.230.120.8 255.255.255.0 end
Select OK. To add a dmz1 -> wan1 firewall policy using the CLI config firewall policy edit 9 set action accept set dstaddr all set dstintf wan1 set schedule always set service SMTP set srcaddr Email_Server set srcintf dmz1 set profile-status enable set profile standard_profile end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
47
To add a wan1 -> dmz1 firewall policy 1 2 Go to Firewall > Policy and select Create New. Enter or select the following settings:
Source Interface / Zone Source Address Destination Interface / Zone Destination Address Schedule Service Action Protection Profile wan1 All dmz1 Email_Server_VIP Always SMTP ACCEPT Enable and select standard_profile
Select OK. To add a wan1 -> dmz1 firewall policy using the CLI config firewall policy edit 10 set action accept set srcintf wan1 set srcaddr all set dstintf dmz1 set dstaddr Email_Server_VIP set schedule always set service SMTP set profile-status enable set profile standard_profile end
48
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
3 4
Select OK. Select Create New and enter or select the following settings:
Source Interface / Zone Source Address Destination Interface / Zone Destination Address Schedule Service Action Protection Profile internal All dmz1 Email_Server Always POP3 ACCEPT Enable and select standard_profile
Select OK. To add internal -> dmz1 firewall policies using the CLI config firewall policy edit 11 set action accept set dstaddr Email_Server set dstintf dmz1 set schedule always set service SMTP set srcaddr all set srcintf internal set profile-status enable set profile standard_profile next edit 12 set action accept set dstaddr Email_Server set dstintf dmz1 set schedule always set service POP3 set srcaddr all set srcintf internal set profile_status enable set profile standard_profile end
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
49
add an internal -> wan1 firewall policy for the web master to upload web site updates via FTP add an internal -> wan1 POP3 firewall policy so that users can use POP3 to download email add an internal -> wan1 SMTP firewall policy so that users can use SMTP to send email
50
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
Index
Index
A
address adding 23, 30, 37, 43, 46 group 24 antivirus configuring automatic updates 21 definition updates 21 grayware 26 attack automatic updates 21 definition updates 21 VPN tunnels 38
N
network plan 17
P
policy configuring 28, 36, 40, 43, 47 default 19 email server 47 VPN tunnels 40 web server 43 protection profile 27, 33
C
Customer service 8
D
default route 18 DMZ network 13, 42 DNS forwarding 19
R
remote access VPN tunnels 37
S
schedule automatic updates 21 recurring 33 server email 45 web 42
E
email server configuring 45
F
firewalls about 5 FortiClient 7, 14, 42 FortiGate firewalls 5 models 13 FortiGuard 25 FortiLog 7 FortiManager 7 FortiProtect 7
T
time and date configuring 20 topology design 17 existing 12 proposed 15
U
URL filter 30
G
grayware configuring 26
V
virtual IP 42, 46 VPN configuring 37 VPN tunnels FortiClient 42 policies 40
I
interface configuring 17 dmz 17 external 17 internal 17 IPSec phase1 38 phase2 40 FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
W
web category block 24 web filter URL block 30 web server configuring 42
51
Index
52
FortiGate SOHO and SMB Version 3.0 MR7 Configuration Example 01-30007-0062-20080909
www.fortinet.com
www.fortinet.com