FortiGate Multi-Threat Security Systems I Course 201 - Administration, Content Inspection and VPNs. Module Objectives •By the end of this module, participants will be able to: »Identify the major features of the FortiGate Unified Threat Management appliance »Modify administrative access restrictions on an interface »Create and manage administrative users »Create and manage administrator access profiles »Backup and restore configuration files »Create a DHCP server on a FortiGatedevice interface »Upgrade or downgrade a FortiGateunit’s firmware The information contained herein is subject to change without notice. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet Inc

1. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
1
© 2013 Fortinet Inc. All rights reserved.
The information contained herein is subject to change without notice. No part of this publication including text, examples, diagrams
or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical
or otherwise, for any purpose, without prior written permission of Fortinet Inc. 01-50003-0201-20131018-D
FortiGate Multi-Threat Security
Systems I
Module 1: Introduction to Fortinet Unified Threat Management
2
Module Objectives
• By the end of this module, participants will be able to:
»Identify the major features of the FortiGate Unified Threat Management appliance
»Modify administrative access restrictions on an interface
»Create and manage administrative users
»Create and manage administrator access profiles
»Backup and restore configuration files
»Create a DHCP server on a FortiGate device interface
»Upgrade or downgrade a FortiGate unit’s firmware

2. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
3
Traditional Network Security Solutions
Firewall
Antivirus
Antispam
WAN Optimization
Web Filtering
Application Control
Intrusion Prevention
VPN
• Many single purpose systems needed to
cope with a variety of threats
4
FortiGate Integrated Network Security Platform
Firewall
Antivirus
Antispam
WAN Optimization
Web Filtering
Application Control
Intrusion Prevention
VPN
and more…
• One device provides a comprehensive
security and networking solution
FortiGate Appliance

3. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
5
Unit Design
Hardware
Purpose-driven hardware
FortiOS
Specialized operating system
Firewall AV
Web
Filter
IPS …
Security and network-level services
FortiGuard Subscription Services
Automated update service
6
FortiGate Unit Capabilities
FirewallAntivirusEmail filteringWeb filteringIntrusion preventionApplication controlData leak preventionWAN optimizationSecure VPNWirelessDynamic routingEndpoint complianceVirtual domainsTraffic shapingHigh availabilityLogging and reporting
1
1
1
1 Authentication

4. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
7
Fortinet Products
• Network Security
»FortiGate appliances
• High-end, mid-range and
desktop models
• Network Access
»Wireless: FortiWiFi, FortiAP
»Switching: FortiSwitch
»End-point and mobility:
FortiClient
»User Identity:
FortiAuthenticator, FortiToken
• Infrastructure Security
»Application and Content Delivery:
FortiADC
»DDos Mitigation: FortiDDos
»Advanced Threat Protection
»Voice and Video: FortiVoice,
FortiCamera, FortiRecorder
• Application Security
»FortiMail, FortiWeb, FortiDB
»FortiCache
• Management
»FortiManager, FortiAnalyzer,
FortiCloud
8
FortiGuard Subscription Services
• Global Update service for AV/IPS (update.fortiguard.com)
• Global Live service for FortiGuard WF/AS (service.fortiguard.net)
• FortiGate unit will prefer servers nearby
»Calculates server “distance” based on time zones
• Major server centers in North America as well as Asia and Europe
• Nearest servers are preferred but will adjust based on server load

5. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
9
• ‘port1’ or ‘internal’ interface will have an IP of 192.168.1.99
• ‘port1’ or ‘internal’ interface will have a DHCP server set up and
enabled (on devices that support DHCP Servers)
• Default login will always be:
user: admin
password: (blank)
• Usernames and passwords are BOTH case sensitive
Device Factory Defaults
10
Device Administration
Web GUI CLI

6. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
11
Admin Profiles
12
Profile Permissions
System Configuration
Network Configuration
Firewall Configuration
UTM Configuration
VPN Configuration
etc.
Read Read-Write
Admin
Profile

7. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
13
Administrators
Full access within
a single virtual
domain
Full access
super_admin
profile
Custom access
custom
profile
prof_admin
profile
14
Administrator Trusted Hosts

8. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
15
Two Factor Authentication
Username and Password (one factor)
FortiToken (two factor)
+
16
Administrator Two Factor Authentication

9. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
17
Device Configuration
• Device configuration settings can be saved to
an external file
»Optional encryption
• The file can be restored to rollback device to a
previous configuration
18
Per VDOM Configuration File

10. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
19
Interface IPs
• Every used interface on the
unit must have an IP
assigned (in NAT mode)
using one of three methods:
»Manual IP, DHCP assigned,
PPPoE
20
• There must be at least one default gateway
• If an interface is DHCP or PPPoE, then a gateway can be added
to the routing dynamically
Static Gateway

11. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
21
DHCP Server Setup
22
DHCP Server IP Reservation
• IP address reserved and always assigned to the same DHCP host
»Select an IP address or choose an existing DHCP lease to add to the reserved list
»Identify the IP address reservation as either DHCP over Ethernet or DHCP over
IPSec
• MAC address of the DHCP host is used to look up the IP address in
the IP reservation table
• Found in the “Advanced” settings of the DHCP server, on the interface

12. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
23
DHCP - Activity
24
FortiGate as a DNS Server
• Resolve DNS lookups from an internal network
• Methods to set up DNS for each interface:
»Forward-only: DNS requests sent to the DNS servers configured for the unit
»Non-recursive: DNS requests resolved using a FortiGate DNS database and
unresolved DNS requests are dropped
»Recursive: DNS requests will be resolved using a FortiGate DNS database and
any unresolved DNS requests will be relayed to DNS servers configured for the
unit
• One DNS database can be shared by all the FortiGate interfaces
»If VDOMs are enabled, a DNS database needs be created in each VDOM

13. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
25
DNS Forwarding
• FortiGate units can forward (or not) DNS requests sent to its
interfaces
»Behavior on each interface is configured separately
• Allows direct control of the DNS
»GUI allows setting to Forward only
»CLI allows Forward, Recursive and Non-recursive behavior
26
DNS Database Configuration
• DNS zones need to be added when configuring the DNS database
» Each zone has its own domain name
»Zone format defined by RFC 1034 and1035
• DNS entries are added to each zone
»An entry includes a hostname and the IP address it resolves to
»Each entry also specifies the type of DNS entry
• IPv4 address (A) or an IPv6 address (AAAA)
• name server (NS)
• canonical name (CNAME)
• mail exchange (MX) name
• IPv4 (PTR) or IPv6 (PTR)

14. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
27
Firmware Upgrade Steps
• Step 1: Backup and store old configuration (Full config backup from CLI)
• Step 2: Have copy of old firmware available
• Step 3: Have disaster recovery option on standby (especially if remote)
• Step 4: READ THE RELEASE NOTES (upgrade path, bug information)
• Step 5: Double check everything
• Step 6: Upgrade
28
Firmware Downgrade Steps
• Step 1: Locate pre-upgrade configuration file
• Step 2: Have copy of old firmware available
• Step 3: Have disaster recovery option on standby (especially if remote)
• Step 4: READ THE RELEASE NOTES (is a downgrade possible?)
• Step 5: Double check everything
• Step 6: Downgrade (all settings except those needed for access are lost)
• Step 7: Restore pre-upgrade configuration

15. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
29
Maintainer Access
• Available on all FortiGate devices and some non-FortiGate devices
• Only available through the console port
»Highly secure (requires physical access)
• Only open after a HARD boot
»About 30 seconds (varies by model, by approximately 1 minute)
»Highly secure (soft boot does not activate user)
User: maintainer
Password: bcpb<serial number> All letters in serial number MUST BE uppercase
• Can be disabled in the CLI if physical security is a risk
» config sys global
» set admin-maintainer disable
» end
30
Console Port
• Depending on the FortiGate model, console port
access is provided in the following ways:
»Serial port (older models)
• Standard null model cable will work for console port access
»RJ-45 port
• RJ-45-serial cable is required for access
»USB 2 port
• Requires FortiExplorer to connect
• Each devices ships with proper console cables

16. Course 201 - Administration, Content Inspection and VPNs Introduction
01-50003-0201-20131018-D
31
Labs
• Lab 1: Initial Setup and Configuration
»Ex 1: Configuring Network Interfaces
»Ex 2: Exploring the Command Line Interface
»Ex 3: Restoring Configuration Files
»Ex 4: Performing Configuration Backups
(OPTIONAL)
• Lab 2: Administrative Access
»Ex 1: Profiles and Administrators
»Ex 2: Restricting Administrator Access
32
Classroom Lab Topology