Professional Documents
Culture Documents
Fortios Handbook 50
Fortios Handbook 50
Change Log..................................................................................................... 87
Introduction..................................................................................................... 88
Page 3
Managing Guest Access .............................................................................. 509
Configuring authenticated access.............................................................. 514
Certificate-based authentication ................................................................ 532
SSO using a FortiAuthenticator unit ........................................................... 550
Single Sign-On to Windows AD................................................................... 554
Agent-based FSSO ....................................................................................... 563
SSO using RADIUS accounting records..................................................... 602
Monitoring authenticated users.................................................................. 609
Examples and Troubleshooting .................................................................. 613
Chapter 10: Install and System Administration for FortiOS 5.0 .................................. 1385
Differences between Models and Firmware ............................................ 1386
Using the web-based manager ................................................................. 1387
Using the CLI .............................................................................................. 1405
Basic Administration .................................................................................. 1426
Best practices............................................................................................. 1456
FortiGuard ................................................................................................... 1461
FortiCloud.................................................................................................... 1474
Interfaces .................................................................................................... 1480
Chapter 15: Unified Threat Management for FortiOS 5.0 ............................................ 2018
Security Profiles overview ......................................................................... 2019
Client Reputation........................................................................................ 2025
AntiVirus ...................................................................................................... 2032
Email filter ................................................................................................... 2049
Intrusion protection.................................................................................... 2062
Custom Application & IPS Signatures ...................................................... 2080
Web filter ..................................................................................................... 2095
Data leak prevention .................................................................................. 2130
Application control ..................................................................................... 2152
ICAP ............................................................................................................. 2164
Other Security Profiles considerations .................................................... 2169
Chapter 21: VoIP Solutions: SIP for FortiOS 5.0 ........................................................... 2488
FortiGate VoIP solutions: SIP .................................................................... 2489
Chapter 22: WAN Optimization, Web Cache, Explicit Proxy, and WCCP for FortiOS 5.0..
2577
Example network topologies..................................................................... 2580
Configuring WAN optimization.................................................................. 2590
Peers and authentication groups.............................................................. 2610
Configuration examples............................................................................. 2616
Web caching and SSL offloading .............................................................. 2643
FortiClient WAN optimization .................................................................... 2661
The FortiGate explicit web proxy .............................................................. 2665
The FortiGate explicit FTP proxy .............................................................. 2689
FortiGate WCCP ......................................................................................... 2703
Storage ........................................................................................................ 2716
Diagnose commands ................................................................................. 2719
Index ............................................................................................................ 2728
Change Log..................................................................................................... 87
Introduction..................................................................................................... 88
Page 9
Neighbor cache table for IPv6 ............................................................................. 106
Improved HA diagnose commands ..................................................................... 107
Secure disk erasing ............................................................................................. 107
Anonymize user names in logs ............................................................................ 107
VLAN interface traffic statistics............................................................................ 107
Preserving the Class of Service bit...................................................................... 107
Front panel illustration ......................................................................................... 108
USB entropy token support ................................................................................. 108
Station locate for FortiWiFi units.......................................................................... 108
Switch Controller added models 200D, 240D, 600C, 800C, and 1000C ............ 109
Diagnose command for 5000 series FortiGate units ........................................... 109
New platforms for FortiGate-VM.......................................................................... 109
Supported RFCs .................................................................................................. 109
New features in FortiOS 5.0 Patch 4........................................................... 111
FortiSandbox ....................................................................................................... 111
Wireless Health Dashboard ................................................................................. 111
IPsec VPN ............................................................................................................ 112
Dial-up IPsec VPN Creation Wizard............................................................... 112
Show or Hide policy-based IPsec VPN ......................................................... 112
Managing FortiAP units ....................................................................................... 112
Units remain online when their WiFi Controller goes offline .......................... 113
Assigning the same profile to multiple FortiAP units ..................................... 113
Dynamic VLANs for SSIDs................................................................................... 113
NAT46 & NAT64................................................................................................... 114
Enhancements to Tables ..................................................................................... 114
Policy Table.................................................................................................... 114
Member Display ............................................................................................. 114
Fortinet Top Bar................................................................................................... 115
FortiAnalyzer and FortiManager log encryption................................................... 115
FortiToken Mobile ................................................................................................ 115
Load balancing for explicit web proxy forwarding server groups ....................... 115
Server load balancing enhancements ................................................................. 116
SNMP traps.................................................................................................... 116
HTTP redirects ............................................................................................... 116
Additional filters for IPS and Application Control ................................................ 117
Blocking IPv6 packets by extension headers...................................................... 117
Distinguishing between HTTP GET and POST in DLP ........................................ 117
RADIUS Accounting............................................................................................. 118
H3C Compatibility................................................................................................ 118
Web filter administrative overrides ...................................................................... 118
Configurable idle timeout for console admin login sessions ............................... 118
Chapter 10: Install and System Administration for FortiOS 5.0 .................................. 1385
Differences between Models and Firmware ............................................ 1386
Differences between Models ............................................................................. 1386
Differences between Firmware Versions ........................................................... 1386
Using the web-based manager ................................................................. 1387
Web-based manager overview .......................................................................... 1387
Web-based manager menus and pages ........................................................... 1387
Using information tables .............................................................................. 1388
Using column settings ................................................................................. 1389
Entering text strings........................................................................................... 1389
Entering text strings (names) ....................................................................... 1389
Entering numeric values............................................................................... 1390
Enabling or disabling options ...................................................................... 1390
Dashboard ......................................................................................................... 1390
Adding dashboards and widgets ................................................................. 1391
System Information widget .......................................................................... 1391
License Information widget.......................................................................... 1397
FortiGate unit Operation widget .................................................................. 1399
System Resources widget ........................................................................... 1399
Alert Message Console widget .................................................................... 1399
CLI Console widget...................................................................................... 1399
Session History widget ................................................................................ 1400
Top Sessions widget.................................................................................... 1400
USB Modem widget..................................................................................... 1400
Advanced Threat Protection Statistics widget ............................................ 1400
Features widget ........................................................................................... 1400
RAID monitor widget.................................................................................... 1401
Basic configurations .......................................................................................... 1402
Changing your administrator password....................................................... 1402
Changing the web-based manager language.............................................. 1403
Changing administrative access .................................................................. 1403
Changing the web-based manager idle timeout.......................................... 1403
Switching VDOMs ........................................................................................ 1403
Connecting to the CLI from the web-based manager ................................. 1403
Logging out .................................................................................................. 1404
Using the CLI .............................................................................................. 1405
Connecting to the CLI........................................................................................ 1405
Chapter 15: Unified Threat Management for FortiOS 5.0 ............................................ 2018
Security Profiles overview ......................................................................... 2019
Traffic inspection ............................................................................................... 2019
IPS signatures.............................................................................................. 2019
Suspicious traffic attributes ......................................................................... 2020
Chapter 21: VoIP Solutions: SIP for FortiOS 5.0 ........................................................... 2488
FortiGate VoIP solutions: SIP .................................................................... 2489
SIP overview ...................................................................................................... 2489
Common SIP VoIP configurations ..................................................................... 2490
Peer to peer configuration ........................................................................... 2490
SIP proxy server configuration..................................................................... 2491
SIP redirect server configuration ................................................................. 2491
SIP registrar configuration ........................................................................... 2492
SIP with a FortiGate unit .............................................................................. 2493
SIP messages and media protocols .................................................................. 2495
SIP request messages ................................................................................. 2497
SIP response messages .............................................................................. 2498
SIP message start line ................................................................................. 2500
SIP headers.................................................................................................. 2500
The SIP message body and SDP session profiles....................................... 2502
Example SIP messages ............................................................................... 2504
The SIP session helper ...................................................................................... 2505
SIP session helper configuration overview .................................................. 2506
Configuration example: SIP session helper in Transparent Mode............... 2508
SIP session helper diagnose commands..................................................... 2511
The SIP ALG ...................................................................................................... 2512
SIP ALG configuration overview .................................................................. 2514
Conflicts between the SIP ALG and the session helper .............................. 2517
Stateful SIP tracking, call termination, and session inactivity timeout ........ 2518
SIP and RTP/RTCP ...................................................................................... 2520
How the SIP ALG creates RTP pinholes...................................................... 2520
Configuration example: SIP in Transparent Mode....................................... 2522
RTP enable/disable (RTP bypass) ............................................................... 2525
Opening and closing SIP register, contact, via and record-route pinholes. 2526
Accepting SIP register responses................................................................ 2527
How the SIP ALG performs NAT ....................................................................... 2527
Source address translation .......................................................................... 2528
Destination address translation ................................................................... 2528
Call Re-invite messages .............................................................................. 2529
Chapter 22: WAN Optimization, Web Cache, Explicit Proxy, and WCCP for FortiOS 5.0..
2577
Before you begin................................................................................................ 2577
FortiGate models that support WAN optimization............................................. 2578
How this chapter is organized ........................................................................... 2578
Example network topologies..................................................................... 2580
WAN optimization topologies ............................................................................ 2580
Basic WAN optimization topologies ............................................................ 2581
Out-of-path topology ................................................................................... 2581
Topology for multiple networks ................................................................... 2583
WAN optimization with web caching ........................................................... 2583
WAN optimization and web caching with FortiClient peers......................... 2584
Explicit Web proxy topologies ........................................................................... 2585
Explicit FTP proxy topologies ............................................................................ 2586
Web caching topologies .................................................................................... 2587
WCCP topologies .............................................................................................. 2588
Configuring WAN optimization.................................................................. 2590
Client/server architecture................................................................................... 2590
WAN optimization peers .................................................................................... 2592
Manual (peer-to-peer) and active-passive WAN optimization........................... 2592
Manual (peer to peer) configurations ........................................................... 2592
Active-passive configurations...................................................................... 2594
WAN optimization profiles ................................................................................. 2595
Processing non-HTTP sessions accepted by a WAN optimization profile with
HTTP optimization ..................................................................................... 2597
Processing unknown HTTP sessions .......................................................... 2597
Protocol optimization......................................................................................... 2598
Protocol optimization and MAPI .................................................................. 2598
Byte caching ...................................................................................................... 2598
Dynamic data chunking for byte caching .................................................... 2599
WAN optimization transparent mode ................................................................ 2599
FortiClient WAN optimization............................................................................. 2599
Operating modes and VDOMs........................................................................... 2600
WAN optimization tunnels ................................................................................. 2600
Tunnel sharing.............................................................................................. 2601
WAN optimization and user and device identity policies, load balancing and traffic
shaping ............................................................................................................ 2601
Traffic shaping ............................................................................................. 2602
WAN optimization and HA ................................................................................. 2602
WAN optimization, web caching and memory usage........................................ 2602
June 15, 2015 New section: Exception to policy order (VIPs) on page 956. Also added some info about best
practices with VIPs to Virtual IP Addresses (VIPs) on page 915 and deny policies and VIPs to
Deny Policies on page 969.
January 24, 2015 New version collecting Misc updates and fixes.
March 28, 2014 New chapters: Certifications and Compliances on page 768, Hardware Acceleration on
page 1067, IPv6 for FortiOS 5.0 on page 1828, and Virtual FortiGate Units for FortiOS 5.0 on
page 2445.
Updated for FortiOS 5.0 Patch 6.
Chapters re-organized to be in alphabetical order by title
Page 87
Introduction
This FortiOS Handbook is the definitive guide to configuring and operating FortiOS 5.0. It
contains concept and feature descriptions, as well as configuration examples worked out in
detail for the web-based manager and the CLI. This document also contains operating and
troubleshooting information.
This handbook contains the following chapters:
Chapter 1, Whats New for FortiOS 5.0 describes the new features in FortiOS 5.0.
Chapter 10, Install and System Administration for FortiOS 5.0 describes a number of
administrative tasks to configure and setup the FortiGate unit for the first time. It also
describes the best practices and sample configuration tips to secure your network and the
FortiGate unit itself.
Chapter 7, Firewall for FortiOS 5.0 describes the concepts and techniques needed to
configure the FortiGate firewall on your FortiGate unit.
Chapter 13, Logging and Reporting describes how to begin choosing a log device for your
logging requirements, the types of log files, how to configure your chosen log device,
including detailed explanations of each log type of log message.
Chapter 15, Unified Threat Management for FortiOS 5.0 describes the Unified Threat
Management (UTM) features available on your FortiGate unit, including antivirus, intrusion
prevention system (IPS), anomaly protection (DoS), one-armed IPS (sniffer policies), web
filtering, email filtering, data leak prevention (DLP), and application control. The chapter
includes step-by-step instructions showing how to configure each feature. Example
scenarios are included, with suggested configurations.
Chapter 3, Authentication for FortiOS 5.0 defines authentication and describes the FortiOS
options for configuring authentication for FortiOS.
Chapter 14, Managing Devices for FortiOS 5.0 describes how to control network access for
different types of personal mobile devices and apply client reputation.
Chapter 11, IPsec VPN for FortiOS 5.0 provides a general introduction to IPsec VPN
technology, explains the features available with IPsec VPN and gives guidelines to decide
what features you need to use, and how the FortiGate unit is configured to implement the
features.
Chapter 16, SSL VPN for FortiOS 5.0 provides a general introduction to SSL VPN
technology, explains the features available with SSL VPN and gives guidelines to decide
what features you need to use, and how the FortiGate unit is configured to implement the
features.
Chapter 2, Advanced Routing for FortiOS 5.0 provides detailed information about FortiGate
dynamic routing including common dynamic routing features, troubleshooting, and each of
the protocols including RIP, BGP, and OSPF.
Chapter 19, Virtual Domains describes FortiGate Virtual Domains (VDOMs) and is intended
for administrators who need guidance on solutions to suit different network needs and
information on basic and advanced configuration of VDOMs. Virtual Domains (VDOMs)
Page 88
multiply the capabilities of your FortiGate unit by using virtualization to partition your
resources.
Chapter 9, High Availability for FortiOS 5.0 describes FortiGate HA, the FortiGate Clustering
Protocol (FGCP), FortiGate support of VRRP, and FortiGate standalone TCP session
synchronization.
Chapter 17, Traffic Shaping for FortiOS 5.0 describes how to configure FortiOS traffic
shaping.
Chapter 4, FortiOS Carrier describes FortiOS Carrier Multimedia messaging service (MMS)
protection and GPRS Tunneling Protocol (GTP) protection.
Chapter 6, Deploying Wireless Networks for FortiOS 5.0 describes how to configure wireless
networks with FortiWiFi, FortiGate, and FortiAP units.
Chapter 21, VoIP Solutions: SIP for FortiOS 5.0 describes FortiOS SIP support.
Chapter 22, WAN Optimization, Web Cache, Explicit Proxy, and WCCP for FortiOS 5.0
describes how FortiGate WAN optimization, web caching, and web proxy work and also
describes how to configure these features.
Chapter 12, Load Balancing for FortiOS 5.0 describes firewall HTTP, HTTPS, SSL or generic
TCP/UDP or IP server load balancing.
Page 90 FortiOS Handbook Handbook v5.0 Whats New for FortiOS 5.0
Fortinet Technologies Inc.
Feedback Page 91 FortiOS Handbook Handbook v5.0Whats New for FortiOS 5.0
New Features in FortiOS 5.0 Patch 7
This chapter provides information on the vulnerability fix added in FortiOS 5.0 Patch 7.
Page 92
New Features in FortiOS 5.0 Patch 7 Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 93 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 6
This chapter provides a brief introduction to the following features that were added to Patch 6 of
FortiOS 5.0. See the release notes for a complete list of new features/resolved issues in this
release.
Endpoint Control Daemon Improvement
IPS Hardware Acceleration
802.11g Protection Mode
Miglogd Child Processes
IPv6 in CRL/SCEP
Extended IPS Database for D-series Desktop Models
Logging Options for 3000 and 5000 Series Models
Wireless Controller on FortiGate-30D
New CLI commands have been added for configuring IPS hardware acceleration, replacing the
previous set hardware-accel-mode command, to provide finer control over the settings.
There are now two settings that can be chosen, one for the network processor and one for the
content processor.
Network processor acceleration can be disabled or set to enable basic acceleration. Content
processor acceleration can be disabled or enabled for either basic or advanced acceleration.
Page 94
New features in FortiOS 5.0 Patch 6 Fortinet Technologies Inc.
Syntax
config ips global
set np-accel-mode {none | basic}
set cp-accel-mode {none | basic | advanced}
end
802.11g Protection Mode can now be enabled on managed FortiAP to avoid interference from
802.11b signals. Protection Mode can be set for RTS and CTS protection, or just for CTS.
Syntax
config wireless-controller wtp-profile
edit <name>
config radio-1
set protection-mode {ctsonly | disable | rtscts}
end
end
end
The number of miglogd child processes can now be configured directly through CLI to a value
between 0-15, in order to keep up with logging requirements. The default number of child
processes is 8.
Log messages are not lost if the number of child processes is decreased.
Syntax
config system global
set miglogd-children <integer>
end
Increasing the number of child processes may affect a FortiGate units performance.
IPv6 in CRL/SCEP
IPv6 is now supported for all certificate revocation list (CRL) and Simple Certificate Enrollment
Protocol (SCEP) features.
The extended IPS database has been added for FortiGate D-series Desktop models. The
extended database is disabled by default, but can be enabled in the CLI.
Fortinet Technologies Inc. Page 95 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 6 Fortinet Technologies Inc.
Syntax
config ips global
set database extended
end
Enabling the extended IPS database may affect the performance of a FortiGate unit.
To increase stability of the 3000 series and 5000 series FortiGate models, the following changes
have been made:
Disk logging is disabled by default, but can be enabled through the CLI.
When disk logging is disabled, it will not appear disk logging as an option on these
models.
The default logging method for these models is now memory logging, which has been
reintroduced as an option.
The Wireless Controller has been added to the FortiGate-30D, which is now able to manage a
maximum of 2 FortiAP units.
By default, this feature is only available through the CLI. To enable the Wireless Controller menu
in the web-based manager support, enter the following command in the CLI:
config system global
set gui-wireless-controller enable
end
When enabled, the default WiFi menu will be replaced by the full Wireless Controller menu in the
web-based manager.
You can also use the command set gui-ap-profile enable to enable FortiAP and WIDS
profiles.
Fortinet Technologies Inc. Page 96 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5
This chapter provides a brief introduction to the following features that were added to Patch 5 of
FortiOS 5.0. See the release notes for a complete list of new features in this release.
Improvements to Endpoint Control
FortiAP LAN port support
Automatically allowing basic applications
Pre-authorizing a FortiAP unit
Preventing IP fragmentation of packets in CAPWAP tunnels
Limiting access for unauthenticated users
LDAP browser to import users into a user group
Dedicated management CPU
Improvements to the Traffic History and Threat History widgets
Assigning an IP address to a dynamic IPsec VPN interface
SSL VPN History widget
Port Block Allocation (PBA) for CGN to reduce logs
Neighbor cache table for IPv6
Improved HA diagnose commands
Secure disk erasing
Anonymize user names in logs
VLAN interface traffic statistics
Preserving the Class of Service bit
Front panel illustration
USB entropy token support
Station locate for FortiWiFi units
Switch Controller added models 200D, 240D, 600C, 800C, and 1000C
Diagnose command for 5000 series FortiGate units
New platforms for FortiGate-VM
Supported RFCs
Page 97
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Default profile
A default FortiClient profile has been added that enables AntiVirus, Web Filtering, and VPN for
Windows and Mac. All other features are disabled.
The profile creation screen has also been simplified to allow for easier configuration.
FortiClient Monitor
The FortiClient Monitor displays a variety of information about FortiClient users, including
current status, device type, and FortiClient version. It can be found by going to User & Device >
Monitor > FortiClient.
New functions are now available for FortiAP models that have LAN ports (currently the 11C,
14C, and 28C). The LAN port(s) can now be bridged to either an SSID or to the FortiAP units
WAN port (bridging to the WAN port is the default setting).
LAN port bridging can be done with FortiAP units in either Bridge or Tunnel mode.
Fortinet Technologies Inc. Page 98 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Configuring bridging
A FortiAP LAN port can be configured to bridge with an SSID from either the web-based
manager or the CLI.
On FortiGate models 100D, 200D, 240D, 600C, 800C, and 1000C, go to WiFi & Switch
Controller > WiFi Network > Custom AP Profiles.
2. Create a new custom profile or edit the default profile for your FortiAP model.
3. Under LAN Port, change Mode to Bridge to and select the appropriate option.
4. Select OK.
Fortinet Technologies Inc. Page 99 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Bridging can also be set up configured on a specific FortiAP unit, rather than through the use of
an AP profile by going to WiFi Controller > Managed Devices > Managed FortiAPs.
On FortiGate models 100D, 200D, 240D, 600C, 800C, and 1000C, go to WiFi & Switch
Controller > Managed Devices > Managed FortiAPs.
Restrictions
While the FortiAP-14C has four physical LAN ports, these ports must share the same
configuration.
Any host connected to a LAN port will be taken as authenticated.
The use of dynamic VLANs for the host behind LAN port is not supported.
RADIUS MAC authentication for the host behind LAN port is not supported.
Application control profiles can now be configured from the CLI to allow basic, commonly used
applications to go through without having to separately configure the profile each application.
This is useful when you wish to control the traffic to an entire category of applications without
affecting the traffic for basic applications that are required on a daily basis.
For example, an application sensor that blocks the Category "Network.Service" would normally
also block DNS service, causing Internet service issues. Using the new command, DNS can
now be allowed, eliminating this issue while still blocking other applications within the category.
Fortinet Technologies Inc. Page 100 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Basic traffic can also be allowed for ICMP, generic HTTP web browsing, and generic SSL
communication.
Syntax
config application list
edit appcontrol
set options allow-dns allow-icmp allow-http allow-ssl
end
DNS is set to be allowed be default for all application control profiles, while the other settings
must be enabled to take effect.
Users can now pre-authorize a FortiAP unit by before connecting the unit to the FortiGate unit.
To pre-authorize a FortiAP unit, do the following:
1. Go to WiFi Controller > Managed Access Points > Managed FortiAPs and select Create New.
On FortiGate models 100D, 200D, 240D, 600C, 800C, and 1000C, go to WiFi & Switch
Controller > Managed Devices > Managed FortiAPs
Fortinet Technologies Inc. Page 101 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
If the FortiAP unit will be connecting directly to one of the FortiGate units ports, the port will still
need to have its Addressing mode set to Dedicate to FortiAP.
Fortinet Technologies Inc. Page 102 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
The tcp-mss-adjust option causes the FortiAP unit to limit the maximum segment size
(MSS) of TCP packets sent by wireless clients. The FortiAP does this by adding a reduced MSS
value to the SYN packets sent by the FortiAP unit when negotiating with a wireless client to
establish a session. This results in the wireless client sending packets that are smaller than the
tun-mtu-uplink setting, so that when the CAPWAP headers are added, the CAPWAP
packets have an MTU that matches the tun-mtu-uplink size.
The icmp-unreachable option affects all traffic (UDP and TCP) between wireless clients and
the FortiAP unit. This option causes the FortiAP unit to drop packets that have the "Don't
Fragment" bit set in their IP header and that are large enough to cause fragmentation and then
send an ICMP packet -- type 3 "ICMP Destination unreachable" with code 4 "Fragmentation
Needed and Don't Fragment was Set" back to the wireless controller. This should cause the
wireless client to send smaller TCP and UDP packets.
When configuring User Identity policies, if you select the option Skip this policy for
unauthenticated user the policy will only apply to users who have already authenticated with the
FortiGate unit. This feature is intended for networks with two kinds of users:
Single sign-on users who have authenticated when their devices connected to their network
Other users who do not authenticate with the network so are unauthenticated
Sessions from authenticated users can match this policy and sessions from unauthenticated
users will skip this policy and potentially be matched with policies further down the policy list.
Typically, you would arrange a policy with Skip this policy for unauthenticated user at the top of
a policy list.
You can also use the following CLI command to enable skipping policies for unauthenticated
users:
config firewall policy
edit <id>
set identity-based enable
set fall-through-unauthenticated enable
next
Fortinet Technologies Inc. Page 103 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Figure 4 shows how the FortiGate unit handles packets received from authenticated and
unauthenticated users.
A packet enters
Policy 1. User Identity policy the FortiGate unit
access to internal resources and Internet
Skip this policy for unauthenticated user
No
N o
The packet is
accepted by
policy 2
You can use the new LDAP browser to add LDAP users to a user group.
Fortinet Technologies Inc. Page 104 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
FortiGate units in the 2U or High-End categories (models 1000 and above) can now be
configured to have a dedicated management CPU. This reserves one CPU core, CPU 0, for
running management tasks such as the web GUI, as well as the CLI and related daemons. By
having a dedicated management CPU, access to the management GUI and CLI is guaranteed
even under when the unit is under a heavy traffic load.
Using a dedicated management CPU may have an impact on the overall performance of the
FortiGate unit.
Several changes have been made to the Traffic History and Threat History widgets:
The Show Sessions and Show All Incidents (formerly Show Threats) options has been
improved to show more information about individual sessions or threats.
The drilldown page for the Threat History widget has been improved by adding new
columns and adjusting field formats.
The Threat History widget has replaced the Reputation Score monitor used for Client
Reputation, which has been removed.
An IP addresses can now be assigned to a dynamic IPsec VPN interface to be used for traffic
egressing over the IPsec interface, to avoid traffic being blocked due to an inappropriate
address. An IP address is assigned by going to System > Network > Interfaces and editing the
interface for the IPsec VPN.
Fortinet Technologies Inc. Page 105 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Login history can now be added to the SSL VPN Portal, which shows a user their past logins.
The number of logins shown can be anywhere between 1 and 255 (the default is 5).
The login can be set by going to VPN > SSL > Portal, selecting Include Login History, and
setting an appropriate Number of history entries.
It can also be set using the CLI:
config vpn ssl web portal
edit <portal>
config widget
edit <ID>
set type history
set display-limit <1-255>
end
end
end
end
Port Block Allocation (PBA), a Carrier Grade NAT (CGN) feature, can reduces the number of log
messages generated by NAT operations.
PBA can be configured using by going to Firewall Objects > Virtual IPs > IP Pools. It can also be
configured using the CLI.
config firewall ippool
edit ippool
set type port-block-allocation
set block-size <integer>
set num-blocks-per-user <integer>
end
end
You configure PBA by creating a private IP address range and assigning multiple port ranges (or
blocks) to that IP address range. When a connection is received from the IP range, the source
port is translated to a ports in the first range. A log message is written when this happens.
As more connections are received from this IP address range they are assigned to other ports in
the first port block. Eventually all of the ports in the block will be used. When a new connection
is received, another block of ports is started and a log message is written.
So instead of writing a log message for every NAT event, log messages are only written when a
new block of ports is started and again when its used up.
A table has now been added to configure IPv6 neighbor cache entries and to save the entries
when the FortiGate unit reboots, using the command config system
ipv6-neighbor-cache.
Fortinet Technologies Inc. Page 106 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
In the following example, a neighbor cache entry is configured to use the DMZ interface:
config system ipv6-neighbor-cache
edit 1
set interface dmz
set ipv6 6666::11
set mac 00:09:0f:01:02:03
end
end
The new command diagnose sys ha dump-by has replaced the command diagnose sys
ha dump. The new command has the following syntax:
diagnose sys ha dump-by {all-xdb | all-vcluster| rcache | all-group |
memory | debug-zone | vdom | kernel | device | stat| sesync}
Each option displays different types of information about the cluster.
The following new HA diagnose commands have also been added:
diagnose sys ha sesync-stats
diagnose sys ha extfile-sig
All data on the FortiGate boot device and any hard disks installed in a FortiGate unit can now be
securely and permanently erased using the execute erase-disk command. This command
performs a low-level format and also overwrites every block on the device with random data
three times.
Log messages can now be configured to replace user names with the word anonymous, so
that user names are not visible in log messages. This feature can be enabled from the CLI using
the following command:
config log setting
set user-anonymize enable
end
A VLAN accounting table has been added to the NP4 driver to poll accounting data from the
FortiGate unit in order to monitor traffic statistics from VLAN interfaces. The polling interval is
set to 1 second.
FortiGate units can now preserve the value of the Class of Service (CoS) bit, also called Priority
Code Point (PCP), when a packet traverses a VLAN network.
Fortinet Technologies Inc. Page 107 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
An illustrated version of the FortiGate unit's front panel has been added above the list of
interfaces, found at System > Network > Interfaces. As with the panel found in the Unit
Operation widget, interfaces appears green when connected and further details are shown
when the mouse pointer hovers over a specific port.
Use of a USB entropy token during the boot process is now enabled by default when using a
FortiGate in Federal Information Processing Standards-Common Criteria (FIPS-CC) mode. If a
FortiGate unit in this mode does not have an USB entropy token inserted, it is unable to
complete the boot process will display the following message: Please insert entropy
token to continue boot process.
Entropy token use can be disabled from the CLI. It can also be enabled on a FortiGate unit in
normal mode (by default, entropy tokens are disabled in normal mode).
Syntax
config system fips
set entropy-token {enable | disable}
end
The entropy token must be present during boot process when a FortiGate unit is switched to
FIPS-CC mode.
Station locate allows a FortiWiFi unit to detect all wireless clients whether they are associated or
not. A record is kept of MAC address, statistical time interval and RSSI data.
Station locate is enabled using the following CLI command:
config wireless-controller wtp-profile
edit "FAP220B-default"
config radio-1
set station-locate enable
set station-locate-interval 1
next
config radio-2
set station-locate enable
set station-locate-interval 1
end
end
end
Fortinet Technologies Inc. Page 108 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Switch Controller added models 200D, 240D, 600C, 800C, and 1000C
The Switch Controller, used to managed FortiSwitch units with a FortiGate unit, has been added
to the following models: 200D, 240D, 600C, 800C, and 1000C.
Because of this feature, there have been several web-based manager menu changes to these
units:
WiFi Controller has changed to WiFi & Switch Controller.
Managed Access Points has changed to Managed Devices and now contains the
Managed FortiSwitch option.
The Switch Network menu has been added, which contains the Virtual Switch option.
FortiGate-VM is now supported for Microsoft Hyper-V and Kernel-based Virtual Machine (KVM).
Supported RFCs
The following RFCs are supported by the new features for FortiOS 5 Patch 5:
Table 1: Supported RFCs
Number Title
Fortinet Technologies Inc. Page 109 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 5 Fortinet Technologies Inc.
Number Title
Fortinet Technologies Inc. Page 110 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4
This chapter provides a brief introduction to the following features that were added to Patch 4 of
FortiOS 5.0. See the release notes for a complete list of new features in this release.
FortiSandbox
Wireless Health Dashboard
IPsec VPN
Managing FortiAP units
Dynamic VLANs for SSIDs
NAT46 & NAT64
Enhancements to Tables
FortiAnalyzer and FortiManager log encryption
FortiToken Mobile
Load balancing for explicit web proxy forwarding server groups
Server load balancing enhancements
Additional filters for IPS and Application Control
Blocking IPv6 packets by extension headers
Distinguishing between HTTP GET and POST in DLP
RADIUS Accounting
H3C Compatibility
Web filter administrative overrides
Configurable idle timeout for console admin login sessions
TCP reset
Log Volume Monitor
Invalid Packet log
Server limits
PoE Power Management display
Other new features
FortiSandbox
The new FortiSandbox unit can be used with a FortiGate unit for sandboxing suspicious files.
Sandboxing can also be done using Cloud Sandbox, which was previously known as
FortiGuard Analytics. For more information about this feature, see FortiSandbox on page 138.
The Wireless Health Dashboard provides an easy method for determining the health of your
networks wireless infrastructure. The dashboard is used to display a variety of widgets, which
show information such as AP status, client count over time and login failures.
The dashboard can be found by going to WiFi Controller > Monitor > Wireless Health.
Page 111
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
IPsec VPN
There have been several changes made to how IPsec VPN is configured.
There have been several changes to how FortiAP units are managed by a FortiGate unit.
Fortinet Technologies Inc. Page 112 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
Dynamic VLANs can now be used to divide a single SSID into several VLANs. In Patch 4,
Dynamic VLANs are supported for both tunnel and bridge mode SSIDs.
VLAN assignment is based on the credentials supplied by the user. Dynamic VLANs allow
individual users to be assigned different VLANs resulting in different levels of access even
though all users are connecting to the same SSID.
The task of assigning users to a specific VLAN is handled by a RADIUS authentication server.
When a client attempts to associate to a FortiAP registered with a controller, the FortiAP passes
the credentials of the user to the RADIUS server for validation. Once the authentication is
successful, the RADIUS server passes certain Internet Engineering Task Force (IETF) attributes
to the user. These RADIUS attributes include the VLAN ID that should be assigned to the
wireless client.
Dynamic VLANs are configured by doing the following:
1. Go to User & Device > Authentication > RADIUS Servers and create a new RADIUS server.
2. Go to WiFi Controller > WiFi Network > SSID and create a new SSID.
3. Enable Dynamic VLAN in the CLI, using the following command:
config wireless-controller vap
edit <name>
set dynamic-vlan enable
end
Fortinet Technologies Inc. Page 113 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
4. Go to WiFi Controller > WiFi Network > Custom AP and create a new radio 1 and radio 2 that
use the new SSID.
5. Go to System > Network > Interfaces and create two or more VLAN interfaces that have
DHCP server enabled.
6. Go to Policy > Policy > Policy and create policies that allow outbound traffic from the new
VLANs.
7. Configure a policy on the RADIUS server for each VLAN.
When users scan for available SSIDs, they can connect to the new SSID and be assigned to one
of the VLANs based on their credentials.
See http://docs.fortinet.com/supplement.html for some Dynamic VLAN examples.
Policies and Virtual IPs for NAT46 and NAT64 can now be configured from the web-based
manager. For these options to appear in the web-based manager, this feature must be enabled
using Feature Select. For more information, see Feature Select on page 243.
To configure NAT64 policies go to Policy > Policy > NAT64 Policy.
To configure NAT46 policies go to Policy > Policy > NAT46 Policy.
Enhancements to Tables
Several enhancements have been made to the tables in the web-based manager to improve
access to information.
Policy Table
The following enhancements have been made to the Policy Table:
The Security Features column has been divided so that each feature has an individual
menu, allowing the profile used to be easily visible.
A pulldown menu will appear when a specific element is selected that displays the other
options for the field, as well as showing the Create New option.
The right-click menu has been simplified to show only the options related to the location
that was selected. The menu will also change depending on whether a specific element
name was selected or if the cell background was selected.
Member Display
The member columns for tables under Firewall Objects and User & Device have been improved
to display members in a grid. When there is a high number of members in a single group, some
members will be displayed in the grid, with the hidden members viewed via a dropdown menu.
The number of sub-columns displaying members, the width of sub-columns and the number of
lines used to display members are all customizable by right-clicking on the header and selecting
Members Column Option.
Fortinet Technologies Inc. Page 114 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
In order to ensure that the Fortinet Top Bar appears in all browsers, port 8011 must be allowed
in the firewall policy being used.
Logs sent to a FortiAnalyzer or FortiManager unit from a FortiGate unit can now be encrypted.
Encryption is enabled by going to Log & Report > Log Config > Log Settings.
FortiToken Mobile
Explicit web proxy traffic can now be load balanced among multiple forwarding servers in a
forwarding server group.
To configure load balancing, add multiple forwarding servers to a forwarding server group and
turn on load balancing for the server group. Then add the forwarding server group to a security
policy.
The following example adds three forwarding servers to a forwarding server group. Start by
creating the forwarding servers:
config web-proxy forward-server
edit fwd-srv-1
set ip 10.10.10.10
set port 8080
next
edit fwd-srv-2
set ip 10.10.10.20
set port 8080
next
edit fwd-srv-3
set ip 10.10.10.30
set port 8080
end
Fortinet Technologies Inc. Page 115 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
Server load balancing has been enhanced to alert administrators when a server fails and to
improve handling of HTTP redirects.
SNMP traps
FortiGate units can now send SNMP traps when the FortiGate unit determines that one of the
servers in a server load balance group has gone down. The OID for the trap is
.fgTrapServerLoadBalanceRealServerDown.
You can use the following CLI command to enable this trap:
config system snmp community
edit 0
set events load-balance-real-server-down enable
end
HTTP redirects
Server load balancing now also supports checking HTTP redirects and setting the maximum
number of redirects when 300-level return codes are received.
Fortinet Technologies Inc. Page 116 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
You can set http-max-redirects in the range 0 to 5. The default value is 0 which means do
not check redirects, just assume they are available. This is how redirects functioned previously.
When you set this option to 1 or more, the FortiGate unit will check up to 5 redirect URLs, until it
finds one that is active. Traffic is then re-directed to the first active URL that is found.
Use the following command to check up to 3 redirects:
config firewall ldb=monitor
edit 0
set set type http
set port 80
set http-get "/index.php"
set http-max-redirects 3
end
New filters have been added for IPS and Application Control that will be shown when the
Advanced filter option is selected on the sensor creation page. The new filters for IPS are
Application and Protocol and the new filters for Application Control are Vendor and Protocol.
FortiOS can now block IPv6 packets based on the extension headers, using the CLI syntax
config firewall ipv6-eh-filter.
The following commands are now available:
set hop-opt {disable | enable}: Block packets with Hop-by-Hop Options header.
set dest-opt {disable | enable}: Block packets with Destination Options header.
set hdopt-type <integar>: Block specific Hop-by-Hop and/or Destination Option types
(maximum 7 types, each between 0 and 255).
set routing {disable | enable}: Block packets with Routing header.
set routing-type <integar>: Block specific Routing header types (maximum 7 types,
each between 0 and 255).
set fragment {disable | enable}: Block packets with Fragment header.
set auth {disable | enable}: Block packets with Authentication header.
set no-next {disable | enable}: Block packets with No Next header.
Data Leak Prevention (DLP) can now distinguish between HTTP GET and POST protocols,
allowing the protocols to be selected independently.
HTTP POST protocol can be examined by both message and file filters, while HTTP GET can
only be used for file filters.
Fortinet Technologies Inc. Page 117 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
RADIUS Accounting
Accounting servers can now be configured in a RADIUS setting. For each RADIUS server, four
more accounting servers can be created.
The following example adds an accounting server to a RADIUS server:
config user radius
edit rad159
set server 172.16.62.159
set secret asdfasdf
config accounting-server
edit 1
set status enable
set server 175.18.5.36
set secret asdfasdf
end
end
H3C Compatibility
FortiOS now has H3C compatibility, allowing 802.1x authentication to be supported with two
RADIUS attributes.
The following example enables H3C compatibility:
config user radius
edit rad-jason
set h3c-compability enable
end
Administrative web filter overrides can now be configured by going to Security Profiles > Web
Filter > Web Overrides. Overrides allow specific users to use an alternate web filter profile, in
order to access sites that would normally be blocked.
An idle timeout has been added for FortiGate console sessions (admin sessions connecting to a
FortiGate console port or USB port). By default the console timeout is set to 0 and console
sessions will never timeout. You can enable a timeout in the range of 15-300 seconds from the
CLI. Use the following command to set the timeout to 25 seconds:
config sys global
set admin-console-timeout 25
end
Use the following command to disable the timeout.
config sys global
unset admin-console-timeout
end
Fortinet Technologies Inc. Page 118 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
TCP reset
Security policies can now be configured to send a TCP reset when a specific application
session times out. The following command is used to enable this function:
config firewall policy/policy6
edit 0
set timeout-send-rst enable
end
The Log Monitor has been renamed the Log Volume Monitor and has had several visual
enhancements made. It can be found at Log & Report > Monitor > Logging Volume Monitor.
The Invalid Packet log has been merged with the Local Traffic and Forward Traffic logs. Denied
traffic will now appear in either of these logs.
Server limits
The maximum number of virtual and real servers has been increased. The new maximum values
vary by FortiGate model and are as follows:
Desktop FGT: virtual servers, 128 globally; real servers, 4 per entry.
1U FGT: virtual servers, 512 globally; real servers, 8 per entry
2U FGT: virtual servers, 2048 globally; real servers, 32 per entry.
Fortinet Technologies Inc. Page 119 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 4 Fortinet Technologies Inc.
In the Unit Operation widget, the POE Power Status bar has been added to show the current
power output for Power over Ethernet (POE). The bar displays both used power and reserved
power.
The port display has also been changed so that the ports that are supplying power appear in
blue.
Figure 10:The Unit Operation widget with the POE Power Status bar
Fortinet Technologies Inc. Page 120 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 3
This chapter provides a brief introduction to the following features that were added to Patch 3 of
FortiOS 5.0. See the release notes for a complete list of new features in this release.
Security Features
Exempting IP addresses from IPS
DLP Watermarking Client
Predefined Device Groups
Client Reputation Configuration
Feature Select
Changes to Endpoint Control
Managing FortiAP units
FortiGuard Subscription Services
Adding Explicit Web Proxy services
SSO Authentication failover for the Explicit Web Proxy
User Creation Wizard
FortiClient Registration
DSS and ECDSA Certificates for FortiGate SSL-related features
LDAP Servers
User Monitor
Web Filter Profiles
CAPWAP Administrative Access
IPS Algorithms
NAC-Quarantine Traffic Logs
New System Report Charts
Memory Logging
URL-based Web Proxy Forwarding
Changes to Routing
RADIUS Support for Dynamic VLANs
Dedicated Management Port
URL Filtering
URL Source Tracking
IPv6 Denial of Service Policies
Support for NAT46, VIP64 and VIP46
Packet Capture Filters
Configure hosts in an SNMP v1/2c community to send queries or receive traps
IP in IP tunneling support (RFC 1853)
GTP-u acceleration on FortiGate units with SP3 processors
Page 121
Security Features New features in FortiOS 5.0 Patch 3
Security Features
Features previously known as UTM Security Features are now known as Security
Features. For more information about new Security Features in FortiOS 5.0, see Security
Features on page 138.
IPS filters can be configured so that signatures are not applied to traffic from specific IP
addresses. For more information about IPS exemptions, see Exempting IP addresses
from IPS on page 144.
The DLP watermarking client is now available for Windows as part of FortiExplorer. For
more information about DLP watermarking, see DLP watermarking on page 153.
FortiOS now has Predefined Device Groups for Blackberry Playbook, Router/NAT Device
and Windows Tablet. For more information about Predefined Device Groups, see Device
Groups on page 175.
Client Reputation configuration can be found at Security Profiles > Client Reputation. For
more information about Client Reputation, see Client Reputation on page 181.
Feature Select
Feature Select replaces the Display Options on GUI feature to control which features can
be configured and viewed on the web-based manager. For more information on this
feature, see Feature Select on page 243.
There have been several changes to how FortiAP units are managed by a FortiGate unit.
Firmware Auto-detection
A FortiGate unit now auto-detects what the best firmware version is for the FortiAP units that it
manages. If the FortiAP unit is not running the recommended firmware version you can
download and install in from the FortiGate web-based manager.
Fortinet Technologies Inc. Page 123 FortiOS Handbook - Whats New for FortiOS 5.0
Managing FortiAP units New features in FortiOS 5.0 Patch 3
Locating service is enabled from the CLI, using the following command:
config wireless-controller wtp-profile
edit "FAP220B-default"
set ap-country JP
config radio-1
set station-locate enable
end
config radio-2
set station-locate enable
end
end
After this configuration is complete, the list of devices can be found using the following
command:
diagnose wireless-controller wlac -c sta-locate
The command displays a list of currently located wireless devices. The list includes the
MAC address of each device as well as wireless-related information about the device.
The FortiGuard Subscription Services have been reorganized into three categories: Next
Generation Firewall, ATP Services and Other Services.
Explicit proxy services can now be added and edited by going to Firewall Objects > Service >
Services > Create New > Custom Service and selecting Explicit Proxy. Explicit web proxy
services are used in security policies that control access to the explicit web proxy.
Fortinet Technologies Inc. Page 125 FortiOS Handbook - Whats New for FortiOS 5.0
SSO Authentication failover for the Explicit Web Proxy New features in FortiOS 5.0 Patch 3
SSO authentication failover for the Explicit Web Proxy is now available, allowing two
authentication methods to be configured. If the Single Sing-On Method fails, the
FortiGate unit will use the Default Authentication Method.
To configure failover, the explicit web proxy must first be enabled.
Figure 14:Configuring SSO authentication failover for the explicit web proxy
The User Creation Wizard is used to create new users through a four step process. The four
steps will vary depending on which type of user is being created (for example, when creating an
LDAP user, step 3 requires choosing an LDAP filter).
The User Creation Wizard can be found at User & Device > User > User Definition.
FortiClient Registration
The FortiClient registration process has changed so that the initial confirmation message sent
from FortiClient will be ignored by the FortiGate unit and applied only at the end of the
registration process, to avoid the registration being rejected.
FortiOS now supports DSS and ECDSA certificates for the following features: HTTPS/SSL deep
scanning, HTTPS/SSL server load balancing, HTTPS/SSL offloading and HTTPS over the
explicit web proxy.
LDAP Servers
A Distinguished Name field and query button have been added to the LDAP Server creation
page.
User Monitor
FSSO Logons are now shown in the user monitor, found at User & Device > Monitor > Firewall.
In order for FSSO Logons to appear, Show all FSSO Logons must be enabled.
URL filters, used for website filtering, are now created as part of a Web Filter Profile. This can be
done by going to Security Profiles > Web Filter > Profiles and selecting Enable Web Site Filter. A
filter can then be enabled for all URLs you wish to block.
Fortinet Technologies Inc. Page 127 FortiOS Handbook - Whats New for FortiOS 5.0
CAPWAP Administrative Access New features in FortiOS 5.0 Patch 3
CAPWAP Administrative Access can now be configured for all interfaces except Virtual
Access Points (VAPs). CAPWAP must be used on any interface used to managed a
FortiAP unit.
IPS Algorithms
There is a new algorithms for IPS, super mode, that improves performance for
FortiGate units with more than 4GB of memory. Improvements have also been made for
low mode, which is more efficient for FortiGate units with low memory.
The algorithm used for IPS can be changed from the CLI, using the following command:
config ips global
set algorithm {engine-pick | high | low | super}
Antivirus and DLP NAC-quarantine traffic logs now show whether the IP, user or interface
has been banned. In the case of a virus, the name of the virus and the file in which the
virus was found are also included.
The following charts have been added to the daily FortiGate System Report, based on
data collected by event logs:
VPN Usage
Client Reputation Summary
Memory Logging
Memory logging is available on all FortiGate models. Logging can be enabled by going to
Log & Report > Log Config > Log Settings and enabling Disk.
Logging to flash is also available for the FortiGate-60D and FortiWiFi-60D.
In order to configure URL-based web proxy forwarding, WAN Opt. & Cache must be
enabled using Feature Setting. For more information, see Feature Select on page 243.
FortiOS now supports URL-based web proxy forwarded, which is required for explicit
proxy installations using Threat Management Gateway or Blue Coat.
URL-based web proxy forwarding can be configured by going to WAN Opt. & Cache >
Cache > URL Match List.
Changes to Routing
RADIUS authentication can be used to dynamically route authenticated user traffic to a VLAN.
The name of this VLAN is then added to the users RADIUS record.
The Management (MGMT) port can now be set as Dedicated to Management, in which case no
firewall traffic will be allowed through this port.
URL Filtering
URL filtering has changed to allow certificate-based URL filtering for HTTPS traffic, which is
used when deep-scan is disabled.
Certificate-based filtering extracts the hostname from the TLS handshake. If a valid hostname is
found, it is used for the local or FortiGuard category query. If no hostname is found, HTTPS
server CN web filtering will be used instead.
URL source tracking has been added to transparent proxy and SSL deep-inspection proxy.
There are three current URL source values: HTTP host head, subject CN in the certificate and
server name field in the TLS handshake.
Fortinet Technologies Inc. Page 129 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Denial of Service Policies New features in FortiOS 5.0 Patch 3
Denial of Service (DoS) policies can now be configured by going to Policy > Policy > IPv6
Dos Policy.
Security policies are now supported for NAT46, VIP64 and VIP46. They can be configured
from the CLI, using the following commands:
config firewall policy46
config firewall vip64
config firewall vip46
Packet capture filters can be configured by going to System > Network > Packet Capture.
When you add a host to an SNMP v1/2c community you can now decide whether the
FortiGate unit will accept queries from the host or whether the FortiGate unit will send
traps to the host. You can also configure the host for both traps and queries.
FortiOS 5.0 MR3 supports RFC 1853 IP in IP Tunneling to provide for differential forwarding to
packets. This tunneling mechanism is supported as an interface type and the FortiGate unit
does not inspect the traffic in an IP in IP tunnel
To configure IP in IP tunneling:
config system ipip-tunnel
edit tun0
set interface <interface_name>
set local-gw <local-gw-ip>
set remote-gw <remote-gw-ip>
end
end
FortiGate units with SP3 processors can offload GTP-u packet processing to their SP3
processor. The SP3 processor supports:
GTP-u sanity packet check
GTP-u rate limiting per gtp profile
Encapsulated IP traffic filtering
Fortinet Technologies Inc. Page 131 FortiOS Handbook - Whats New for FortiOS 5.0
New features in FortiOS 5.0 Patch 2
This chapter provides a brief introduction to the following features that were added to Patch 2 of
FortiOS 5.0. See the release notes for a complete list of new features in this release.
Endpoint Profile Changes
Client Reputation Changes
Changes to logging in security policies
Configuring the FortiGate unit to be an NTP Server
Customizing and viewing the local FortiGate UTM Security Analysis Report
Wireless changes: Custom mesh downlink SSIDs and new identifier for local bridge SSIDs
SSL-VPN Realm Support (multiple custom SSL VPN logins)
Automatically add devices found by device identification to the vulnerability scanner
configuration
The SIP ALG can receive SIP traffic on multiple TCP and UDP ports
IPv6 PIM sparse mode multicast routing
Wireless RADIUS-Based MAC Authentication
A number of changes have been made to enhance Client Reputation functionality. For
information about how to configure and use Client Reputation, see Client Reputation on
page 181.
Instead of enabling or disabling traffic logging in security policies three Logging Options are
now available:
No Log, do not record log messages about traffic accepted by this security policy
Log UTM Events, record traffic log messages when a UTM event occurs (such as when a
virus is found by antivirus, a web page is blocked by web filtering, or the application
responsible for a session is identified by application control).
Log all Sessions, record traffic log messages for all sessions. For all sessions, a single traffic
log message is recorded when the session ends. If you select this option, you can choose to
record a traffic log message when a session starts as well. You can also choose to capture
packets.
Enabling logging in a security policy can affect FortiGate performance because of the extra
system resources required to record log messages. The performance hit can be reduced by
selecting Log UTM Events, since fewer log messages will be recorded.
Page 132
New features in FortiOS 5.0 Patch 2 Fortinet Technologies Inc.
You can also enter the following command to write a log message when a session starts:
config firewall policy
edit <policy-index>
set logtraffic-start
end
When you configure system time from the System Information dashboard widget, you can
configure the FortiGate unit to be an NTP server. As part of the NTP server configuration, you
can select one or more interfaces on which to listen for NTP requests.
In order for your FortiGate unit to create a Security Analysis Report, disk logging must be
enabled. To enable disk logging, go to Log & Report > Log Config > Log Settings and under
Logging and Archiving select Disk and Enable Local Reports.
You can go to Log & Report > Report > Local to view Local Reports created by the FortiGate
unit. Local reports are saved as PDF files that you can view and download at any time.
By default, Local reports are produced every day. You customize how the FortiGate unit to
produce reports daily, weekly, or on demand and you can set the day and time when the report
is generated. You can control how many users appear in the Top Users by bandwidth summary
part of the report. Each user gets a separate summary page. You can also configure the
FortiGate unit to email the report to multiple email recipients.
Fortinet Technologies Inc. Page 133 FortiOS Handbook - Whats New for FortiOS 5.0
Wireless changes: Custom mesh downlink SSIDs and new identifier for local bridge SSIDs New features in FortiOS 5.0 Patch 2
You can also select Run Now to run a report at any time. The report is created using
current data.
You can select Customize to change the report layout. You can customize a report to add
headings and text, divide a report into sections, add images, and add, remove, and
rearrange the individual report charts.
Wireless changes: Custom mesh downlink SSIDs and new identifier for
local bridge SSIDs
You can go to WiFi Controller > WiFi Network > SSID and select Create New to add
additional custom mesh downlink SSIDs.
Figure 20:SSID list showing a local-bridge SSID and two mesh downlink SSIDs
Configure a mesh downlink SSID by selecting Create New, setting the Traffic Mode to
Mesh Downlink and entering an SSID.
In order to create a custom login page using the web-based manager, this feature must be
enabled using Feature Select. For more information, see Feature Select on page 243.
You configure a custom SSL VPN login by going to VPN > SSL > Custom Login and selecting
Create New. Users access different portals depending on the URL they enter. The first option in
the custom login page is to enter the path of the custom URL. This path is appended to the
address of the FortiGate unit interface that SSL VPN users connect to. The actual path for the
custom login page appears beside the URL path field. You can also limit the number of users
that can access the custom login at any one time. Finally you can use HTML code to customize
the appearance of the login page.
Fortinet Technologies Inc. Page 135 FortiOS Handbook - Whats New for FortiOS 5.0
Automatically add devices found by device identification to the vulnerability scanner configuration New features in FortiOS 5.0
After adding the custom login, you must associate it with the users that will access the
custom login. Do this by going to Policy > Policy > Policy and creating an SSL VPN
policy. Add an Authentication Rule to the policy and select the users and user groups
who should access the custom login page. Select Custom Login and select the custom
login page that you created.
When you go to System > Network > Interfaces to configure an interface to detect and
identify devices you can also select Add New Devices to Vulnerability Scan List. As
devices are found, they are added to the Asset Definitions list of the Vulnerability scanner.
You can choose to run a scan of all of the devices on the list or of selected items,
including devices found using FortiGate device identification.
The SIP ALG can receive SIP traffic on multiple TCP and UDP ports
You also configure the SIP ALG to listen in two different TCP ports and two different UDP
ports for SIP sessions. For example, if you receive SIP TCP traffic on port 5060 and 5064
and UDP traffic on ports 5061 and 5065, you can enter the following command to receive
the SIP traffic on all of these ports:
config system settings
set sip-tcp-port 5060 5064
set sip-udp-port 5061 5065
end
FortiOS supports PIM sparse mode multicast routing for IPv6 multicast (multicast6) traffic and is
compliant with RFC 4601: Protocol Independent Multicast - Sparse Mode (PIM-SM). You can
use the following command to configure IPv6 PIM sparse multicast routing.
config router multicast6
set multicast-routing {enable | disable}
config interface
edit <interface-name>
set hello-interval <1-65535 seconds>
set hello-holdtime <1-65535 seconds>
end
config pim-sm-global
config rp-address
edit <index>
set ipv6-address <ipv6-address>
end
The following diagnose commands for IPv6 PIM sparse mode are also available:
diagnose ipv6 multicast status
diagnose ipv6 multicast vif
diagnose ipv6 multicast mroute
Wireless clients can be supplementally authenticated by MAC address. A RADIUS server stores
the allowed MAC address for each client and the wireless controller checks the MAC address
independently of other authentication methods.
MAC-based authentication must be configured in the CLI. In the following example,
MAC-based authentication is added to an existing access point vap1 to use a RADIUS server at
192.168.1.95:
config wireless-controller vap
edit vap1
set radius-mac-auth enable
set radius-mac-auth-server 192.168.1.95
end
Fortinet Technologies Inc. Page 137 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features
Features previously known as UTM Security Features are now known as Security Features.
In order to create new profiles for the Security Features, Multiple Security Profiles must be
enabled using Feature Select. For more information, see Feature Select on page 243.
New Security Features in FortiOS 5.0 include:
FortiSandbox
Botnet and phishing protection
Windows file sharing (CIFS) flow-based antivirus scanning
Advanced Application Control and IPS sensor creation
Custom Application Control signatures and IPS signatures
Flow-based inspection improvements
Configuring SSL inspection for flow-based and proxy protection
Explicit web Proxy Extensions SSL inspection, IPS, Application Control, and flow-based
antivirus, web filtering and DLP
Replacement messages for flow-based web filtering of HTTPS traffic
DNS web filtering
FortiGuard Web Filter quotas can be set based on traffic volume
Customizing the authentication replacement message for a FortiGuard web filter category
YouTube Education Filter implemented in Web Filtering Profiles
IPS hardware acceleration
New SIP ALG features
DLP watermarking
SSH inspection
Optimizing SSL encryption/decryption performance
FortiSandbox
The new FortiSandbox unit is used for automated sample tracking, or sandboxing, for files from
a FortiGate unit. This allows suspicious files to be sent to be inspected without risking network
security. If the file exhibits risky behavior, or is found to contain a virus, a new virus signature is
created and added to the FortiGuard antivirus signature database.
Cloud Sandbox, formerly known as FortiGuard Analytics, can also be used for sandboxing if
you have an active FortiCloud subscription.
Configuration
FortiSandbox is configured by going to System > Config > FortiSandbox. After enabling
FortiSandbox, select either: FortiSandbox Appliance or Cloud Sandbox (FortiCloud).
Page 138
Security Features Fortinet Technologies Inc.
In a proxy or flow-based antivirus profile, you can configure the FortiGate unit to detect and
block botnet server connection attempts. This feature also blocks attempted access to phishing
URLs. The antivirus database is constantly updated with the addresses of known command and
control (C&C) sites that Botnet clients attempt to connect to as well as phishing URLs.
To enable Botnet and phishing protection in either a proxy or flow-based antivirus profile, select
Block Connections to Botnet Servers.
Fortinet Technologies Inc. Page 139 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
FortiOS 5.0 now supports virus scanning of Windows file sharing traffic. This includes CIFS,
SMB and SAMBA traffic. This feature is applied by enabling SMB scanning in an antivirus profile
and then adding this profile to a security policy that accepts CIFS traffic. CIFS virus scanning is
available only through flow-based antivirus scanning.
FortiOS 5.0 flow-based virus scanning can detect the same number of viruses in
CIFS/SMB/SAMBA traffic as it can for all supported content protocols.
Use the following command to enable CIFS/SMB/SAMBA virus scanning in an antivirus profile:
Fortinet Technologies Inc. Page 140 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 141 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
In FortiOS 5.0, it is much easier to sort through Fortinets thousands of application definitions
and IPS signatures to find the ones that you want to add to Application Control and IPS
sensors. The creation pages for both of these features include filters for severity, category,
popularity, technology and risk.
Fortinet Technologies Inc. Page 142 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
You can also search through the application or signature list by name.
The application control and IPS signatures provide coverage for most applications and network
vulnerabilities. You can extend the coverage by adding custom application signatures and
custom IPS signatures.
You add custom application signatures by going to Security Policies > Application Control >
Application List and selecting Create New.
You add custom IPS signatures by going to Security Policies > Intrusion Protection > IPS
Signatures and selecting Create New.
Custom application signatures and custom IPS signatures use the same syntax. See the UTM
Guide for a description the signature syntax.
Fortinet Technologies Inc. Page 143 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
IPS filters can be configured so that signatures are not applied to traffic from specific IP
addresses. To exempt an IP address, a filter must be created with the Sensor Type set to
Specify Signatures. Exempt IP can then be enabled and the necessary exemptions configured
using Source and Destination IPs.
Fortinet Technologies Inc. Page 144 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
If your FortiGate unit supports flow-based scanning, you can choose to select flow-based
instead of proxy scanning. Flow-based scanning uses the FortiGate IPS engine to examine
network traffic as it passes through the FortiGate unit without using a proxy to buffer and
potentially change packets.
In FortiOS 5.0, flow-based inspection has been extended to email filtering. The following
sections contain information about additional flow-based scanning improvements.
FortiOS 5.0 fully supports flow-based inspection of SSL sessions. This means that HTTPS,
IMAPS, POP3S, SMTPS and FTPS traffic can now be decrypted and inspected by IPS and
application control and flow-based antivirus, web filtering and email filtering.
FortiOS 5.0 continues to fully support proxy inspection of SSL sessions. In FortiOS 5.0,
configuring proxy SSL inspection has changed as described below.
To enable proxy or flow-based inspection of SSL sessions, you must add an SSL/SSH
Inspection profile to a security policy. You can configure SSL/SSH inspection profiles to inspect
HTTPS, SMTPS, POP3S, IMAPS and FTPS traffic, as well as SSH traffic. You can configure the
profile to control which SSL protocols to inspect, the ports to inspect for each protocol and the
certificate to use with SSL sessions.
To apply proxy virus scanning and web filtering to HTTPS, IMAPS, POP3S, SMTPS and
FTPS sessions
1. Go to Policy > Policy > SSL/SSH Inspection and create or edit an SSL/SSH inspection
profile.
2. Under SSL Inspection Options select the CA certificate to use for SSL sessions. You can
import a new certificate or use one already imported into the FortiGate unit.
3. Under enable the SSL protocols that you want to inspect and set the ports to inspect for
each protocol.
4. Configure other settings as required and select Apply to save your changes.
5. Go to Policy > Policy > Policy and create a new or edit a policy that accepts the SSL traffic to
be inspected.
6. Under Security Profiles, turn on AntiVirus and Web Filter and select profiles for them.
7. Turn on SSL/SSH Inspection and select the SSL/SSH inspection profile that you configured.
8. Select OK.
Fortinet Technologies Inc. Page 145 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
To apply flow-based virus scanning and web filtering and application control to HTTPS,
and POP3S sessions
This example describes adding factory default antivirus, web filtering, application control and
SSL/SSL profiles to a security policy that accepts HTTPS and POP3S traffic to apply
flow-based virus scanning, web filtering and application control to the HTTPS and POP3S traffic
accepted by the security policy.
1. Go to Policy > Policy > Policy and create or edit a policy that accepts the HTTPS and POP3S
traffic to be inspected.
2. Under Security Profiles, turn on AntiVirus and select the AV-flow profile.
3. Turn on Web Filter and select the web-filter-flow profile.
4. Turn on Application Control and select the default profile.
5. Turn on SSL/SSH Inspection and select the default profile.
6. Select OK.
FortiOS 5.0 fully supports SSL inspection of explicit web proxy traffic. This means that HTTPS
traffic accepted by the explicit web proxy can now be subject to deep inspection for antivirus,
web filtering and DLP.
FortiOS 5.0 also fully supports flow-based inspection of explicit web proxy traffic. This includes
full support for IPS and application control, as well as flow-based virus scanning and web
filtering for HTTP, HTTPS and FTP over HTTP traffic.
SSL content inspection and flow-based inspection are added to explicit web proxy sessions by
enabling Security Profiles in a security policy that accepts web-proxy traffic and then selecting
profiles that implement flow-based inspection for the features you need.
The explicit FTP proxy and the IPv6 explicit web proxy do not support SSL inspection or IPS,
application control, and flow-based antivirus, web filtering and DLP.
FortiOS 5.0 now supports replacement messages for flow-based HTTPS web filtering.
Flow-based HTTP and HTTPS web filtering send the same replacement message as proxy web
filtering. For FortiGuard web filtering, the replacement message is the FortiGuard Block Page
and for URL web filtering, the replacement message is the URL Block Page. To edit replacement
messages, go to System > Config > Replacement Messages.
A DNS request is typically the first part of any new session to a new website. DNS web filtering
takes advantage of this by including the web site category in DNS responses. When a FortiGate
unit resolves a URL, it receives a rating in addition to the IP address of the website.
DNS Web filtering uses the same categories as FortiGuard Web Filtering and requires you to
configure your FortiGate unit to use FortiGuard DNS as its DNS Server. DNS web filtering is
lightweight in terms of resource usage because it doesn't involve any actual content inspection.
Fortinet Technologies Inc. Page 146 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
DNS web filtering includes reduced functionality compared to proxy and flow-based web
filtering. DNS web filtering does not support:
Quotas
Setting web filter categories to Warning or Authenticate (Allow, Monitor and Block are
supported)
Safe Search
URL only scanning for HTTPS
Advanced filtering options such as web content filtering, web resume download blocking,
blocking invalid URLs, HTTP post action options, Java applet filtering, ActiveX filtering,
cookie filtering, image rating, allowing websites when a rating error occurs and blocking
HTTP redirects by rating
To configure your FortiGate unit to use DNS web filtering, start by going to System > Network >
DNS and under DNS Settings, make sure Use FortiGuard Servers is selected and select Apply.
Go to Security Profiles > Web Filter > Profiles and edit a web filtering profile or create a new
one. Set Inspection Mode to DNS. Then you can set DNS action to Block or Redirect. If you
select Redirect, every time a web page is blocked by DNS web filtering the URL is re-directed to
a web page on the FortiGuard network that displays a block message. If you select Block, the
page is blocked and the users web browsers display an error message or the connection
attempt will time out.
Set the FortiGuard web filtering categories as required. You can configure DNS web filtering to
block, allow and monitor web pages in each FortiGuard category. Select Apply to save the
profile.
Go to Policy > Policy > Policy and create or edit a security policy, enable web filtering and select
the web filtering profile that you configured for DNS web filtering.
All traffic HTTP accepted by the policy will be inspected by DNS web filtering.
In FortiOS 5.0, FortiGuard web filter quotas can now set based on the amount of traffic as well
as time.
Fortinet Technologies Inc. Page 147 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
You can add traffic quotas to a web filter profile from the CLI. The following command shows
how to add a quota of 20 GB for bandwidth consuming web sites. These command assumes
you have already set up the profile to monitor, warn or require authentication for bandwidth
consuming web sites (category g04).
config webfilter profile
edit default
config ftgd-wf
config quota
edit 0
set category g04
set type traffic
set unit GB
set value 20
end
end
end
FortiOS 5.0 allows you to customize the replacement message that appears for a specific
FortiGuard Web Filtering category. You do this by editing a Web Filter profile, right clicking on a
FortiGuard Web Filtering category, selecting Authenticate and selecting a user group. Then
right-click on the category again and select Customize.
A blank customize replacement message window appears and you can create the custom
replacement message. Select Save and close the replacement message editor. The selected
category has an Authenticate icon next to it. You can select this icon to edit the replacement
message.
Saving the message creates a custom replacement message group. If you go to System >
Config > Replacement Messages Group and open the replacement message group called
web-filter-default you can find a Custom Messages category that contains the new replacement
message.
You can add your organizations YouTube education filter to a web filtering profile. The
Educational filter will be implemented on all YouTube sessions accepted by the security policy
that the web filter profile is added to. This makes it easier to allow your users to only access
educational YouTube content while blocking content not considered educational.
Fortinet Technologies Inc. Page 148 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
6 Select Enable Web Filter and select the web filter profile that includes the YouTube education
filter.
7 Select OK to save the security policy.
Figure 34: Adding a YouTube education filter code to a web filter profile
Use the following CLI command to add a YouTube education code to a web filter profile:
config webfilter profile
edit youtube-EDU
config web
set safe-search youtube-edu
set youtube-edu-filter-id "ABCD1234567890abcdef"
end
end
FortiGate units with CPx and NPx processes can accelerate IPS performance by offloading
pattern matching to the CPx or NPx processor. If your FortiGate hardware supports this feature
the following CLI command will be available:
config ips global
set hardware-accel-mode {engine-pick | none | CP-only | NP-only |
NP+CP}
end
Where:
engine-pick, let the IPS engine pick the best mode.
none, hardware acceleration disabled.
CP-Only, accelerate with content processors only.
NP-only, accelerate with network processor only.
NP+CP, accelerate with both network and content processors.
Fortinet Technologies Inc. Page 149 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
Figure 35:SIP over SSL/TLS between a SIP phone and a SIP server
TCP ACK
Fortinet Technologies Inc. Page 150 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
Other than enabling SSL mode and making sure the security policies accept the encrypted
traffic, the FortiGate configuration for SSL/TLS SIP is the same as any SIP configuration.
SIP over SSL/TLS is supported for all supported SIP configurations.
Fortinet Technologies Inc. Page 151 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
ssl-algorithm {high | low Select the relative strength of the algorithms that can be
| medium} selected. You can select high, the default, to allow only
AES or 3DES, medium, to allow AES, 3DES, or RC4 or low,
to allow AES, 3DES, RC4, or DES.
ssl-min-version {ssl-3.0 Select the minimum level of SSL support to allow. The
| tls-1.0 | tls-1.1} default is ssl-3.0.
ssl-max-version {ssl-3.0 Select the maximum level of SSL support to allow. The
| tls-1.0 | tls-1.1} default is tls-1.1.
Adding the original IP address and port to the SIP header after NAT
In some cases, your SIP configuration may require that the original IP address and port from the
SIP contact request is kept after NAT. For example, the original SIP contact request could
include the following:
Contact: <sip:0150302438@172.20.120.110:5060>;
After the packet goes through the FortiGate unit and NAT is performed, the contact request
could look like the following (the IP address translated to a different IP address and the port to a
different port):
Contact: <sip:0150302438@10.10.10.21:33608>;
You can enable register-contact-trace in a VoIP profile to have the SIP ALG add the
original IP address and port in the following format:
Contact: <sip:0150302438@<nated-ip>:<nated-port>;o=<original-ip>:
<original-port>>;
So the contact line after NAT could look like the following:
Contact: <sip:0150302438@10.10.10.21:33608;o=172.20.120.110:5060>;
Fortinet Technologies Inc. Page 152 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
Enter the following command to enable keeping the original IP address and port:
config voip profile
edit Profile_name
config sip
set register-contract-trace enable
end
DLP watermarking
DLP watermarking involves using DLP to filter files that pass through the FortiGate unit and
contain a corporate identifier (a text string) and a sensitivity level (Critical, Private and Warning)
hidden in a watermark. Watermarked files have this information applied in a way that is not
visible to the user. DLP watermarking requires a FortiGate unit with a hard disk or flash disk.
You must use the Fortinet watermarking client to apply a watermark to a file. Files should be
watermarked before they are distributed. Then, with DLP watermarking enabled, your FortiGate
unit can track and optionally block watermarked files that pass through it.
To configure DLP to filter for watermarked files, go to Security Profiles > Data Leak Prevention >
Sensors and create or edit a DLP sensor. Add a filter to the sensor and set Filter to Files. Then
select Watermark Sensitivity and select Critical, Private or Warning. Then enter the Corporate
Identifier. The corporate identifier is a case-sensitive text string that must exactly match the
corporate identifier text string added by the watermarking client.
Select the services in which to look for watermarked files. Usually you would choose all of the
email protocols active on your network and HTTP. Then set the action for the watermark filter.
When DLP finds a file with a watermark that matches the filter, the action selected in the filter is
performed. Actions include writing a log message, blocking the file or quarantining the user, IP
address or interface.
Files can have multiple watermarks in them. The FortiGate unit only has to find one match in a
file for DLP watermarking to match it and it will ignore watermarks that dont match. Files
without watermarks are ignored by DLP watermarking.
Fortinet Technologies Inc. Page 153 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 154 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
Options:
-h print help
-v verbose information
-I inplace watermarking (don't copy file)
-o output directory
-e encode <to non-readable>
-a add additional watermark (by default replaces watermarks existing
watermarks)
-D delete all watermarks
Fortinet Technologies Inc. Page 155 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
SSH inspection
FortiOS 5.0 includes a new SSH proxy, available on selected models, that supports decrypting
and inspecting SSH sessions to block or log the following:
SSH remote execution
Port forwarding
SSH remote shell
x11 server forwarding
Similar to SSL content inspection, the SSH proxy intercepts the SSH key exchange between the
SSH client and server when an SSH session is being set up. All traffic that is part of the SSH
session is decrypted by the SSH proxy and SSH inspection features are applied according to
the SSH profile in the security policy that accepts the SSH traffic. After inspection, the session
is re-encrypted and forwarded to the recipient.
SSH inspection is enabled by default in a SSL/SSH inspection profile.
3 1
2
Decrypted
packets
Encrypted 3
2
1 3
2
1
Encrypted
packets Firewall packets
Fortinet Technologies Inc. Page 156 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
To configure SSH inspection, go to Policy > Policy > SSL/SSH Inspection and create or edit an
SSL/SSH Inspection profile and ensure that SSH Inspection Options are enabled. Then
configure the port or ports to look for SSH traffic on. The default port is 22 but you can add
more. You can then block or log Exec commands, port-forwarding, SSH shells, and X11 FIlters.
Then add this profile to security policy that accepts SSH traffic. Enable the required Security
Profiles in the policy.
By default, FortiGate units handle SSL decryption/encryption using the SSL functionality built
into their FortiASIC processors. In situations where the FortiGate unit processes large amounts
of SSL traffic and has more than 4 CPUs, you may be able to optimize SSL
encryption/decryption performance by changing how SSL processing is distributed to the
CPUs. You can also use the following command to specify the number of CPUs to use for SSL
processing (in the command, CPU is called an SSL worker):
config system global
set optimize-ssl {enable | disable}
set ssl-worker-count <worker-count>
end
The <worker-count> is the number of CPUs. The range depends on the number of CPUs in
the FortiGate model (this feature only works for FortiGate units with 4 or more CPUs).
You can use the following command to display information about each CPU running in your
FortiGate unit:
get hardware cpu
The command output numbers the CPUs starting at 0. For example, a FortiGate-5001B
contains 8 CPUs and the command output for this model contains information about all 8 CPUs
numbered 0 to 7. Here is the first few output lines for CPU 7:
Fortinet Technologies Inc. Page 157 FortiOS Handbook - Whats New for FortiOS 5.0
Security Features Fortinet Technologies Inc.
...
processor : 7
vendor_id : GenuineIntel
cpu family : 6
model : 14
model name : Intel(R) Xeon(R) CPU C5528 @ 2.13GHz
stepping : 4
cpu MHz : 2128.072
...
If your FortiGate unit includes multiple CPUs and you want to improve SSL performance, use
the following command to begin distributing SSL decryption/encryption to 4 CPUs:
config system global
set optimize-ssl enable
set ssl-worker-count 4
end
Monitor FortiGate performance and if SSL performance improves without affecting other
performance, you can either maintain this configuration or add another CPU to the configuration
(if one is available). Continue in this manner until you achieve optimum performance for your
FortiGate unit.
Continue monitoring performance in case you have to change this setting due changes in your
network traffic patterns.
Fortinet Technologies Inc. Page 158 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices
The FortiGate authentication umbrella has been expanded from just user authentication (or user
identity) to encompass device identification and client reputation. As well, endpoint control and
the vulnerability scanner have become part of FortiOS 5.0 user and device detection,
identification and authentication.
Endpoint control and vulnerability scanner changes are described in this chapter. For
information about device identification, see FortiOS and BYOD on page 173. For information
about client reputation, see Client Reputation on page 181.
New authentication features described in this chapter include:
User authentication menu changes
User identity policy changes
Authentication-based routing
Secondary and tertiary RADIUS, LDAP, and TACAS+ servers
FortiToken two-factor authentication and FortiToken Mobile
SSO using a FortiAuthenticator unit
SSO with Windows AD or Novell
Citrix Agent support for Single Sign On
Configuring guest access
Vulnerability Scanning
The user authentication part of FortiOS is seeing major changes for FortiOS 5.0. To begin, the
User section of the web-based manager has been renamed User & Device. All previously
available user authentication features are still available but the menu structure has changed to
include device identification, the vulnerability scanner, endpoint control, and client reputation:
Go to User & Device > User to configure users, user groups, and guest users (Configuring
guest access on page 167)
Go to User & Device > Authentication to configure single sign-on and add RADIUS, LDAP,
and TACACS+ servers
Go to User & Device > Two-factor Authentication to configure support for two-factor
authentication using FortiToken (FortiToken two-factor authentication and FortiToken
Mobile on page 162)
Go to User & Device > Vulnerability Scan to configure and operate the FortiGate vulnerability
scanner (Vulnerability Scanning on page 170)
Go to User & Device > Monitor to view the firewall and banned user authentication lists
The steps for adding user identity-based policies have changed. To add a user identity based
policy go to Policy > Policy > Policy and create a new security policy. Select the Firewall policy
type and the User Identity subtype. Select the incoming and outgoing interfaces and source
addresses. Configure other features such as NAT and so on.
Page 159
Authentication: users and devices Fortinet Technologies Inc.
Then select Create New to add user authentication rules to the policy. User authentication rules
include the destination addresses, user groups and or individual users, schedule, service,
action, logging, and UTM security profiles.
You select the destination address separately for each authentication rule. This means that you
can apply different features to different user groups depending on the destination address.
Authentication-based routing
Fortinet Technologies Inc. Page 160 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
You can now add secondary and tertiary servers to RADIUS, LDAP, and TACAS+ remote
authentication server configurations. When you add a secondary server, the FortiGate unit will
contact the secondary server only if the primary server is unreachable. The FortiGate unit will
only contact the tertiary server if the both the primary and secondary servers are unreachable.
Enter the following command to add up to three servers to a RADIUS server configuration.
Specify a domain name or IP address for each server as well as the server secret. In the
following example, the RADIUS servers are at IP addresses 172.20.120.10, 172.20.120.20, and
172.20.120.30:
config user radius
edit new-radius-server
set server 172.20.120.10
set secret 1st-secret
set secondary-server 172.20.120.20
set secondary-secret 2nd-secret
set tertiary-server 172.20.120.30
set tertiary-secret 3rd-secret
end
Enter the following command to add up to three servers to an LDAP server configuration.
Specify a domain name or IP address for each server. Other than the domain name or
password, the secondary and tertiary servers must use the same port and LDAP settings such
as the cnid and username. In the following example, the LDAP servers are at IP addresses
192.168.10.10, 192.168.10.20, and 192.168.10.30:
config user ldap
edit "test-ldap"
set server "192.168.10.10"
set cnid "exAccountName"
set dn "dc=americas,dc=example,dc=net"
set port 3268
set type regular
set username "CN=example,OU=Service
Accounts,OU=Admins,DC=example,DC=csplc,DC=net"
set password ENC AAAEAOZh5R5/oqYeUVkO2OOKh9QV6DAVZoAjbv0sonh
set member-attr "ASCCGKraftFortinetVPNInternalUsers"
set secondary-server "192.168.10.20"
set tertiary-server "192.168.10.30"
end
Enter the following command to add up to three servers to an TACAS+ server configuration.
Specify a domain name or IP address and key for each server. In the following example, the
TACAS+ servers are at IP addresses 10.10.10.10, 10.10.10.20, and 10.10.10.30:
Fortinet Technologies Inc. Page 161 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
The web-based manager provides improved management of FortiToken devices. The status of
each current FortiToken device is listed under User & Device > Two-factor Authentication >
Fortitokens. You can also resynchronize FortiToken devices that have gone out of sync. You can
also enter new FortiToken devices individually or by importing a list of FortiToken serial numbers
in a text file.
The latest FortiToken Mobile documentation is available from the FortiToken page of the
Fortinet Technical Documentation website.
To use FortiToken Mobile, a user needs to install the application on their mobile device and then
activate a token. After the token is activated, the user can begin to generate OTPs on their
mobile device.
Two free trial tokens are included with every registered FortiGate unit. Additional tokens can be
purchased from your reseller or from Fortinet.
You can generate the two free tokens from the FortiGate CLI by entering the following
command:
Fortinet Technologies Inc. Page 162 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
To assign a token to a user, go to User & Device > User > User Definition and either add a new
user or select the user to assign the token to. Configure the user as required and select Enable
Two-factor Authentication. Select the token to associate with the user.
Select OK to assign the token to the user. If you have added the users email address or
configured SMS settings and configured your FortiGate unit to send email or send SMS
messages, the FortiGate unit sends the user an activation code. (To configure your FortiGate
unit to send email or SMS messages go to System > Config > Messaging Servers.)
If for some reason you cannot send the activation code to the user through email or an SMS
message, or would rather send the activation code by other means specific to your operation,
you can view the activation code from the CLI. For example, for a token with serial number of
FTKMOB28E0CA6018 you can enter the following commands:
Fortinet Technologies Inc. Page 163 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 164 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
SSO widget
You need to configure the Single Sign-On portal on the FortiAuthenticator unit. Go to
SSO & Dynamic Polices > SSO > Login Portal to do this. Copy the Embeddable login widget
code for use on your organizations home page. Identity-based security policies on the
FortiGate unit determine which users or groups of users can access which network resources.
The FortiGate unit can authenticate users transparently based on their Windows Active
Directory (AD) or Novell eDirectory privileges. This means that users who have logged on to the
network are not asked again for their credentials to access network resources through the
FortiGate unit, hence the term Single Sign-On.
FSSO Collector agent and DC agent have been tested on Windows Server 2003, 2008 and
2012.
On a Microsoft Windows or Novell network, users authenticate with the Microsoft AD or Novell
eDirectory at logon. It would be inconvenient if users then had to enter another username and
password for network access through the FortiGate unit. FSSO agents installed on the network
provide user information, such as IP address and user group memberships, to the FortiGate
unit. Security policies on the FortiGate unit allow network access based on the user groups to
which the user belongs.
There are several mechanisms for passing user authentication information to the FortiGate unit:
FSSO Collector agent software installed on a Windows AD network monitors user logons
and sends the required information to the FortiGate unit. The FSSO software can obtain this
information by polling the AD domain controllers or by using an FSSO agent on each AD
domain controller that monitors user logons in real time. New in FortiOS 5.0, a FortiGate unit
can obtain group information directly from AD using Lightweight Directory Access Protocol
(LDAP).
On a Windows AD network, the FSSO software can also serve NT LAN Manager (NTLM)
requests coming from client browsers (forwarded by the FortiGate unit) with only one or
more Controller agents installed.
FSSO eDirectory agent software installed on a Novell network monitors user logons and
sends the required information to the FortiGate unit. The agent can obtain information from
the Novell eDirectory using either the Novell API or LDAP.
A FortiAuthenticator server can act as a replacement for the Collector agent in polling mode
in a Windows AD network. FortiAuthenticator can also be configured with internal or external
LDAP and RADIUS servers. For more information, see the FortiAuthenticator Administration
Guide.
Fortinet Technologies Inc. Page 165 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
FortiOS 5.0 supports single sign on authentication for Citrix environments by installing a Citrix
FSSO polling agent on the Citrix server, installing an FSSO collector on the network, and then
configuring the FortiGate unit to get user credentials from the Citrix FSSO polling agent.
TSAgent running on the Citrix server XenAPP server version 6 has been tested with FSSO
build0129 running Windows Server 2008.
Configuration steps include:
Install the Fortinet Citrix FSSO agent on the Citrix server.
Install the Fortinet FSSO collector on a server on the network.
Add the Citrix FSSO agent to the FortiGate Single-sign-On configuration.
Add Citrix FSSO groups and users to an FSSO user group.
Add an FSSO identity-based security policy that includes the Citrix FSSO user groups.
After this configuration is complete, Citrix users credentials are made available to the FortiGate
unit by the Citrix FFSO agent when a Citrix Terminal Session is started.When the user starts a
client application (such as a web browser, SAP client, and so on), the users session through the
FortiGate unit is automatically authenticated and allowed by the FSSO identity-based security
policy.
3 2 Microsoft
Domain
Citrix
FSSO
Network A Agent
3
1 Active Directory
Citrix
Network B Users
Fortinet Technologies Inc. Page 166 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
You can create many guest accounts at once using randomly-generated User IDs and
passwords. This reduces administrator workload for large events.
Fortinet Technologies Inc. Page 167 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
Type Guest
Enable Sponsor If enabled, user form has Sponsor field. Select Required or Optional.
Enable Company If enabled, user form has Company field. Select Required or
Optional.
Fortinet Technologies Inc. Page 168 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
Default Expire Time Set the expire time. The administrator can change this for individual
users.
Enable Batch Guest Create multiple accounts automatically. When this is enabled:
Account Creation
User ID and Password are set to Auto-Generate.
The user accounts have only User ID, Password, and Expiration
fields. Only the Expiration field is editable. If the expiry time is a
duration, such as 8 hours, this is the time after first login.
You can print the account information. Users do not receive email
or SMS notification.
Fortinet Technologies Inc. Page 169 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
Print Print all of the user accounts in the group. You can print one or 3
accounts per page.
Send Send the user account information to the guest. Depending on the
group settings and user information, the information can be sent to the
user by email or SMS.
Guest Groups Select the guest group to list. New accounts are added to this group.
User ID The user ID. Depending on the guest group settings, this can be the
users email address, an ID that the administrator specified, or a
randomly-generated ID.
Vulnerability Scanning
The network vulnerability scanner helps you to protect your network assets (servers and
workstations) by scanning them for security weaknesses. Configuration and operation of the
vulnerability scanner has been simplified and the feature has been moved to User & Device >
Vulnerability Scan.
Fortinet Technologies Inc. Page 170 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
This section describes how to configure a single FortiGate unit for network scanning and how to
view the results of the scan.
To configure scanning
1. Go to User & Device > Vulnerability Scan > Scan Definition.
Fortinet Technologies Inc. Page 171 FortiOS Handbook - Whats New for FortiOS 5.0
Authentication: users and devices Fortinet Technologies Inc.
2. Beside Schedule select Change to set the scan schedule and mode:
Recurrence Select Daily, Weekly, or Monthly and configure the details for
the option you have selected.
Suspend Scan Set a time during which the scan should be paused if its
between running.
Vulnerability Scan Quick check only the most commonly used ports
Mode
Standard check the ports used by most known applications
Fortinet Technologies Inc. Page 172 FortiOS Handbook - Whats New for FortiOS 5.0
FortiOS and BYOD
FortiOS can control network access for different types of personal mobile devices that your
employees bring onto your premises. This is done by:
Identifying and monitoring the types of devices connecting to your networks, wireless or
wired
Using MAC address based access control to allow or deny individual devices
Creating policies based on device type
Enforcing endpoint control on devices that can run FortiClient Endpoint Control software
This section describes:
Device monitoring
Controlling access with a MAC Address Access Control List
Device policies
Device policy portal options
Creating the WiFi SSID
Configuring Internet access for guests with mobile devices
Device monitoring
The FortiGate unit can monitor your networks and gather information about the devices
operating on those networks. Collected information includes:
Whether the device is currently online
MAC address
IP address
Operating system
Hostname
User
How long ago the device was detected and on which FortiGate interface
Whether FortiClient is installed on the device
You can go to User & Device > Device > Device Definitions to view this information.
Page 173
FortiOS and BYOD Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 174 FortiOS Handbook - Whats New for FortiOS 5.0
FortiOS and BYOD Fortinet Technologies Inc.
Device Groups
Device Groups are used in device policies to specify which devices match the policy. FortiOS
automatically adds detected devices of well-known device types to predefined device groups.
You can also create custom device groups so that you can create a different policy for specific,
known devices.
Table 2: Predefined Device Groups
Group Devices
Collected Emails All devices from which FortiOS has collected a user email address.
Gaming Console All Gaming consoles listed in the Device Visibility database. This
includes Xbox, PS2, PS3, Wii, PSP.
IP Phone IP phones.
Other Network Device All other network devices not categorized under any other group.
Fortinet Technologies Inc. Page 175 FortiOS Handbook - Whats New for FortiOS 5.0
FortiOS and BYOD Fortinet Technologies Inc.
A MAC Address Access Control List is best used to handle exceptions. If you want to limit
network access to a larger group, such as your employees, it is better to create a custom device
group and specify that group in your device-based security policies.
A MAC Address Access Control List functions as either a list of blocked devices or a list of
allowed devices. This is determined by the Unknown MAC Address entry.
By default, unknown MAC addresses are allowed: Action is Assign IP. You add an entry for
each MAC address that you want to block and set its Action to Block.
If you want to restrict access to a limited set of devices, you set the Unknown MAC Address
entry to Block and add an entry for each allowed MAC address with Action set to Assign IP.
Device policies
Policies based on device identity enable you to implement policies according to device type.
For example:
Gaming consoles cannot connect to the company network or the Internet.
Personal tablet and phone devices can connect to the Internet but not to company servers.
Company-issued laptop computers can connect to the Internet and company servers. Web
filtering and antivirus are applied.
Employee laptop computers can connect to the Internet, but web filtering is applied. They
can also connect to company networks, but only if FortiClient Endpoint Security is installed
to protect against viruses.
Figure 48 shows these policies implemented for WiFi to the company network.
Fortinet Technologies Inc. Page 176 FortiOS Handbook - Whats New for FortiOS 5.0
FortiOS and BYOD Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 177 FortiOS Handbook - Whats New for FortiOS 5.0
FortiOS and BYOD Fortinet Technologies Inc.
6. Configure UTM Security Profiles as you would for any security policy.
7. Select OK.
8. Select OK again to complete creation of the security policy.
The following portal options are available when configuring a device policy:
Attempt to detect all Unknown device types before implicit deny
Redirect all non-compliant/unregistered FortiClient compatible devices to a captive portal
Custom portals are available for Windows, Mac OS, iPhone/iPad and Android devices.
These portals acts as a quarantine for devices that are not protected by FortiClient Endpoint
Security. The portal provides links to obtain the FortiClient software. The user can retry
connecting after installing the FortiClient software.
Prompt E-mail Collection Portal for all devices
This portal is used to collect an email address as a means of identifying the device user.
When the email address has been verified, the device is added to the Collected Emails
device group.
In order to create a WiFi SSID using the web-based manager, the WiFi Controller (called WiFi &
Switch Controller on FortiGate models 100D, 200D, 240D, 600C, 800C, and 1000C) feature
must be enabled using Feature Select. For more information, see Feature Select on page 243.
Both guest and employee devices will need an SSID (WiFi network) with open security. This
means that no passphrase is required to join the SSID. Device policies will determine who gets
access to network resources. By default, open security is not available in the WiFi SSID
configuration.
Fortinet Technologies Inc. Page 178 FortiOS Handbook - Whats New for FortiOS 5.0
FortiOS and BYOD Fortinet Technologies Inc.
Name byod-example
IP/Netmask 10.10.110.1/24
Netmask 255.255.255.0
SSID byod-guest
For detailed information about creating a WiFi SSID, see the Deploying Wireless Networks
chapter of the FortiOS Handbook.
Guest devices have access only to the Internet. You need a device policy that allows traffic to
flow from the WiFi SSID to the Internet interface. Within that policy, you need an authentication
rules to allow access for the various types of devices.
Fortinet Technologies Inc. Page 179 FortiOS Handbook - Whats New for FortiOS 5.0
FortiOS and BYOD Fortinet Technologies Inc.
Schedule always
Service ALL
Action ACCEPT
2. Select OK.
3. If asked, confirm that you accept FortiOS will enable device identification on the source
interface.
The rule is now configured.
4. Select OK to complete configuration of the security policy.
Fortinet Technologies Inc. Page 180 FortiOS Handbook - Whats New for FortiOS 5.0
Client Reputation
The Security scan types available on FortiGate units are varied and tailored to detect specific
attacks. However, sometimes user/client behavior can increase the risk of attack or infection.
For example, if one of your network clients receives email viruses on a daily basis while no other
clients receive these attachments, extra measures may be required to protect the client, or a
discussion with the user about this issue may be worthwhile.
Before you can decide on a course of action, you need to know the problem is occurring. Client
reputation can provide this information by tracking client behavior and reporting on activities
that you determine are risky or otherwise noteworthy.
Activities you can track include:
Bad Connection Attempts: A typical BOT behavior is to connect to some hosts that do not
exist on the Internet. This is because the BOT home needs to constantly change itself to
dodge legislative enforcement or to hide from AV vendors. Bad connection attempts are
tracked by:
Look ups for a DNS name that does not exist.
Connection attempts to an IP address that has no route.
HTTP 404 errors
Packets that are blocked by security policies.
Intrusion protection: Attack detected. The effect on reputation increases with severity of
attack. A subscription to FortiGuard IPS updates is required.
Malware protection: Malware detected. This requires a subscription to FortiGuard Antivirus
updates.
Web activity: Visit to web site in risky categories, including Potentially Liable, Adult/Mature
Content, Bandwidth Consuming and Security Risk. A subscription to FortiGuard Web
Filtering is required.
Application protection: Client uses software in risky categories, including Botnet, P2P, Proxy,
and Games applications. A subscription to FortiGuard IPS updates is required.
Geographical locations that clients are communicating with. Access to the FortiGuard
geographic database and a valid Fortinet support contract is required.
You can configure how severely each type of tracked activity will impact the reputation of the
client in a sliding scale of Low, Medium, High or Critical. You can also choose to ignore an
activity by setting it to Off. When an activity is turned off, it will have no effect on reputation.
You can enable client reputation tracking for your FortiGate unit by going to Security Profiles >
Client Reputation > Threat Level Definition. Turning on client reputation tracking turns on traffic
logging for all security policies, for all DoS policies and for all sniffer policies. While client
reputation is enabled, logging cannot be turned off for these policies. Traffic logging must be
enabled for data to be added to the client reputation database.
Client reputation only highlights risky activity and does not include tools to stop it. Instead,
client reputation is a tool that exposes risky behavior. When you uncover risky behavior that you
are concerned about, you can take additional action to stop it. That action could include adding
more restrictive security policies to block the activity or increase UTM protection. You can also
taking other measures outside your FortiGate unit to stop the activity.
To support client reputation your FortiGate unit must be registered, have a valid support
contract and be licensed for FortiGuard antivirus, IPS and Web Filtering.
Page 181
Client Reputation Fortinet Technologies Inc.
After client reputation is turned on, the FortiGate unit tracks recent behavior using a sliding
window and displays current data for this window. The client reputation monitor displays clients
and their activities in charts ordered according to how risky the behavior exhibited by the client
is.
Client Reputation data is stored in traffic log messages in the newly added client reputation
fields (crscore and craction). When you enable client reputation Log UTM Events or Log all
Sessions is enabled in all security policies. Log UTM Events records traffic log messages for
UTM sessions and Log all Sessions records traffic logs for all sessions. When Client Reputation
is enabled you cannot select No Log in a security policy. Using client reputation data in log
messages, you can configure FortiAnalyzer to produce a client reputation report.
Enabling client reputation can affect system performance if you had not been using traffic
logging.
This chapter describes:
Setting the client reputation profile/definition
Applying client reputation monitoring to your network
Viewing client reputation results
Expanding client reputation to include more types of behavior
Client reputation execute commands
Client reputation diagnose commands
Configure the client reputation profile by going to Security Profiles > Client Reputation > Threat
Level Definition. You configure one client reputation profile for all of the activity monitored by the
FortiGate unit. The profile sets the risk levels for the types of behavior that client reputation
monitors. You can set the risk to off, low, medium, high and critical for the following types of
behavior:
Application Protection
Botnet applications
P2P applications
Proxy applications
Games applications
Intrusion protection (IPS)
Critical severity attack detected
High severity attack detected
Medium severity attack detected
Low severity attack detected
Informational severity attack detected
Malware Protection
Malware detected
Botnet connection detected
Packet based inspection
Blocked by firewall policy
Failed connection attempts
Fortinet Technologies Inc. Page 182 FortiOS Handbook - Whats New for FortiOS 5.0
Client Reputation Fortinet Technologies Inc.
Web Activity
All blocked URLs
Visit to security risk sites
Visit to potentially liable sites
Visit to adult/mature content sites
Visit to bandwidth consuming sites
To configure the profile, decide how risky or dangerous each of the types of behavior are to your
network and rate them accordingly. The higher you rate a type of behavior, the more visible
clients engaging in this behavior will become in the client reputation monitor and the more easily
you can detect this behavior.
For example, if you consider malware a high risk for your network, you can set the client
reputation profile for malware to high or critical (as it is in the default client reputation profile).
Then, whenever any amount of malware is detected, clients that originated the malware will be
very visible in the client reputation monitor.
Set the risk to off for types of activity that you do not want client reputation to report on. This
does not reduce the performance requirements or the amount of data gathered by client
reputation, just the report output.
You can change a profile setting at any time and data that has already been collected will be
used.
It is normally not necessary to change the Risk Level Values but it can be done if you need to
alter the relative importance of the risk settings.
Client reputation monitoring is applied to network traffic by going to Security Profiles > Client
Reputation > Threat Level Definition turning on Client Reputation Tracking and selecting Apply.
You can then either change the client reputation profile used by your FortiGate unit or you can
accept the default profile. The client reputation profile indicates how risky you consider different
types of client behavior to be. See Expanding client reputation to include more types of
behavior on page 184 for details.
Fortinet Technologies Inc. Page 183 FortiOS Handbook - Whats New for FortiOS 5.0
Client Reputation Fortinet Technologies Inc.
Client reputation results can be viewed in the Threat History widget, which is found at System >
Dashboard > Threat History.
The Threat History widget displays threat severity over time. Specific time periods can be
selected, at which point drilldown menus are available to view more information about the
threats, including information about threat types and the sources of each incident.
You can use the following command to change the client reputation profile from the CLI to
include client reputation reporting about more settings:
config client-reputation profile
Fortinet Technologies Inc. Page 184 FortiOS Handbook - Whats New for FortiOS 5.0
Client Reputation Fortinet Technologies Inc.
In addition to the settings configurable from the web-based manager, you can also set the
following options:
geolocation to enable reporting on connections to and from different countries
(geographical locations). For example, use the following command to indicate that you
consider communication with Aruba to be medium risk:
config client-reputation profile
config geolocation
edit 0
set country AW
set level medium
end
end
url-block-detected to report on connections blocked by web filtering. Use the
following command to enable reporting about blocked URLs and set the risk level to
medium:
config client-reputation profile
set url-block-detected medium
end
From the CLI you can configure client reputation to report more FortiGuard web filtering
categories and more types of applications. For example, to report on social network activity
(application control category 23):
config client-reputation-profile
config application
edit 0
set category 23
set level medium
end
end
To report on the local web filtering category (category 22):
config client-reputation-profile
config web
edit 0
set group 22
set level medium
end
end
Fortinet Technologies Inc. Page 185 FortiOS Handbook - Whats New for FortiOS 5.0
Client Reputation Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 186 FortiOS Handbook - Whats New for FortiOS 5.0
Wireless
Wireless IDS
FortiGate wireless IDS monitors wireless traffic for a wide range of security threats by detecting
and reporting on possible intrusion attempts. When an attack is detected, the FortiGate unit
records a log message.
You can create a WIDS profile to enable the following types of intrusion detection among others:
Unauthorized Device Detection
Rogue/Interfering AP Detection
Adhoc Network Detection and Containment
Wireless Bridge Detection
Misconfigured AP Detection
Weak WEP Detection
Multi Tenancy Protection
MAC OUI Checking
You can enable wireless IDS by going to WiFi Controller > WiFi Network > Custom AP Profiles
and editing an access point profile or creating a new one.
Inside the profile, set WIDS Profile to the name of a wireless IDS profile to apply wireless IDS
protection to the access points that uses the profile. FortiGate units include a default wireless
IDS profile. You can customize this profile or create additional profiles by going to WiFi
Controller > WiFi Network > WIDS Profiles.
Page 187
Wireless IDS Wireless
Syntax
config wireless-controller wids-profile
edit <wids-profile_name>
set comment <comment_str>
set asleap-attack {enable | disable}
set assoc-frame-flood {enable | disable}
set auth-frame-flood {enable | disable}
set deauth-broadcast {enable | disable}
set eapol-fail-flood {enable | disable}
set eapol-fail-intv <int>
set eapol-fail-thres <int>
set eapol-logoff-flood {enable | disable}
set eapol-logoff-intv <int>
set eapol-logoff-thres <int>
set eapol-pre-fail-flood {enable | disable}
set eapol-pre-fail-intv <int>
set eapol-pre-fail-thres <int>
set eapol-pre-succ-flood {enable | disable}
set eapol-pre-succ-intv <int>
set eapol-pre-succ-thres <int>
set eapol-start-flood {enable | disable}
set eapol-start-intv <int>
Fortinet Technologies Inc. Page 189 FortiOS Handbook - Whats New for FortiOS 5.0
WiFi performance improvements Wireless
FortiOS 5.0 improves performance for WiFi users connecting to the wifi network on a
FortiWiFi unit or remotely on FortiAP units. WiFi traffic is now handled in the FortiOS
kernel like other network traffic, rather than in a separate application.
You can now log into a FortiAP web-based manager to view FortiAP status as well as
view and change the FortiAP configuration. Logging into the FortiAP web-based manager
is similar to logging into the FortiGate web-based manager.
The FortiAP CLI now includes more configuration commands and a complete set of
diagnose commands.
Fortinet Technologies Inc. Page 191 FortiOS Handbook - Whats New for FortiOS 5.0
WiFi guest access provisioning Wireless
cw_diag -c mesh-veth-acinfo Show mesh veth ac info, and mesh ether type.
Guest access provisioning allows you to easily add guest accounts to your FortiGate unit.
These accounts are mainly used to authenticate guest WiFi users for temporary access to
a WiFi network managed by a FortiGate unit.
Guest access configuration begins by going to User & Device > User Definition > User
Group and adding one or more guest user groups.
A FortiAP unit can provide WiFi access to a LAN, even when the wireless controller is located
remotely. This configuration is useful for the following situations:
Installations where the WiFi controller is remote and most of the traffic is local or uses the
local Internet gateway
Wireless-PCI compliance with remote WiFi controller
Telecommuting, where the FortiAP unit has the WiFi controller IP address pre-configured and
broadcasts the office SSID in the users home or hotel room. In this case, data is sent in the
wireless tunnel across the Internet to the office and should have encryption using DTLS
enabled.
Fortinet Technologies Inc. Page 193 FortiOS Handbook - Whats New for FortiOS 5.0
FortiAP local bridging (Private Cloud-Managed AP) Wireless
On the remote FortiGate wireless controller, the WiFi SSID is created with the Traffic
Mode set to Local Bridge with FortiAPs Interface. In this mode, no IP addresses are
configured. The FortiAP units WiFi and Ethernet interfaces behave like a switch. WiFi
client devices obtain IP addresses from the same DHCP server as wired devices on the
LAN.
There can be only one Bridge mode SSID per FortiAP unit. The Local Bridge feature
cannot be used in conjunction with Wireless Mesh features.
Security Mode Configure security as you would for a regular WiFi network.
Data Encryption
Preshared Key
3. Select OK.
4. Go to WiFi Controller > Managed Access Points > Managed FortiAP, select the FortiAP unit
for editing.
5. Authorize the FortiAP unit.
6. The FortiAP unit can carry regular SSIDs in addition to the Bridge SSID.
You can enhance the security of communication between a FortiGate wireless controller and a
FortiAP unit by applying DTLS encryption to the data channel.
Fortinet Technologies Inc. Page 195 FortiOS Handbook - Whats New for FortiOS 5.0
WiFi data channel encryption Wireless
There are data channel encryption settings on both the FortiGate unit and the FortiAP
unit. At both ends, you can enable Clear Text, DTLS encryption or both. The settings
must agree or the FortiAP unit will not be able to join the WiFi network. By default, both
Clear Text and DTLS-encrypted communication are enabled on the FortiAP unit, allowing
the FortiGate setting to determine whether data channel encryption is used. If the
FortiGate unit also enables both Clear Text and DTLS, Clear Text is used.
Data channel encryption settings are located in the Custom AP profile. If you use
Automatic profile, only Clear Text is supported.
Data channel encryption is software-based and can affect performance. Verify that the system
meets your performance requirements with encryption enabled.
Wireless load balancing allows your wireless network to distribute wireless traffic more
efficiently among wireless access points and available frequency bands. FortiGate wireless
controllers support the following types of client load balancing:
Access Point Hand-off - the wireless controller signals a client to switch to another access
point.
Frequency Hand-off - the wireless controller monitors the usage of 2.4GHz and 5GHz bands,
and signals clients to switch to the lesser-used frequency.
Load balancing is not applied to roaming clients.
Configuration
From the web-based manager, edit a custom AP profile and select Frequency Handoff and AP
Handoff as required for each radio on the AP.
Fortinet Technologies Inc. Page 197 FortiOS Handbook - Whats New for FortiOS 5.0
Bridge SSID to FortiGate wired network Wireless
From the CLI, you configure wireless client load balancing thresholds for each custom AP
profile. Enable access point hand-off and frequency hand-off separately for each radio in
the custom AP profile.
config wireless-controller wtp-profile
edit new-ap-profile
set handoff-rssi <rssi_int>
set handoff-sta-thresh <clients_int>
config radio-1
set frequency-handoff {disable | enable}
set ap-handoff {disable | enable}
end
config radio-2
set frequency-handoff {disable | enable}
set ap-handoff {disable | enable}
end
end
Where:
handoff-rssi is the RSSI threshold. Clients with a 5 Ghz RSSI threshold over this
value are load balanced to the 5GHz frequency band. Default is 25. Range is 20 to 30.
handoff-sta-thresh is the access point handoff threshold. If the access point has
more clients than this threshold it is considered busy and clients are changed to
another access point. Default is 30, range is 5 to 25.
frequency-handoff enable or disable frequency handoff load balancing for this
radio. Disabled by default.
ap-handoff enable or disable access point handoff load balancing for this radio.
Disabled by default.
Frequency handoff must be enabled on the 5GHz radio to learn client capability.
A WiFi network can be combined with a wired LAN so that WiFi and wired clients are on
the same subnet. This is a convenient configuration for users.
This configuration cannot be used in conjunction with Wireless Mesh features because it
enables the FortiAP Local Bridge option.
To create the bridged WiFi and wired LAN configuration, you need to configure the SSID with
the Local Bridge option so that traffic is sent directly over the FortiAP units Ethernet interface to
the FortiGate unit, instead of being tunneled to the WiFi controller.
Fortinet Technologies Inc. Page 199 FortiOS Handbook - Whats New for FortiOS 5.0
Bridge SSID to FortiGate wired network Wireless
In order to configure IPv6 features using the web-based manager, IPv6 must be enabled using
Feature Select. For more information, see Feature Select on page 243.
The following new IPv6 features are available from the FortiOS 5.0 web-based manager:
IPv6 Policy routing
IPv6 security policies
IPv6 Explicit web proxy
IPv6 NAT NAT64, DNS64, NAT66
IPv6 Forwarding Policies - IPS, Application Control, and flow-based antivirus, web filtering
and DLP
New Fortinet FortiGate IPv6 MIB fields
IPv6 Per-IP traffic shaper
DHCPv6 relay
FortiGate interfaces can get IPv6 addresses from an IPv6 DHCP server
IPv6 policy routing functions in the same was as IPv4 policy routing. To add an IPv6 policy
route, go to Router > Static > Policy Routes and select Create New > IPv6 Policy Route.
G d re : d b 8
te
po
rn
ad 001
rt
al
10
N
2
et
w
or
t1
k
Fo
or
p
rtiG
ate
Un
it
Page 201
IPv6 Fortinet Technologies Inc.
You can also use the following command to add IPv6 policy routes:
config router policy6
edit 0
set input-device <interface>
set src <ipv6_ip>
set dst <ipv6_ip>
set protocol <0-255>
set gateway <ipv6_ip>
set output-device <interface>
set tos <bit_pattern>
set tos-mask <bit_mask>
end
IPv6 security policies now support all the features supported by IPv4 security policies. The
following new features were added in FortiOS 5.0:
Policy types and subtypes.
NAT support including using the destination interface IP address, fixed port, and dynamic IP
pools.
All security features (antivirus, web filtering, application control, IPS, email filtering, DLP, VoIP
and ICAP).
All traffic shaping options, including shared traffic shaping, reverse shared traffic shaping
and per-IP traffic shaping.
All user and device authentication options.
Fortinet Technologies Inc. Page 202 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
With FortiOS 5.0, you can use the explicit web proxy for IPv6 traffic. To do this you need to:
Enable the Explicit Proxy from the System Information dashboard widget.
Enable the IPv6 explicit web proxy from the CLI.
Enable the explicit web proxy for one or more FortiGate interfaces. These interfaces also
need IPv6 addresses.
Add IPv6 web proxy security policies to allow the explicit web proxy to accept IPv6 traffic.
Use the following steps to set up a FortiGate unit to accept IPv6 traffic for the explicit web proxy
at the Internal interface and forward IPv6 explicit proxy traffic out the wan1 interface to the
Internet.
1. Enter the following CLI command to enable the IPv6 explicit web proxy:
config web-proxy explicit
set status enable
set ipv6-status enable
end
2. Go to System > Network > Interfaces and edit the internal interface, select Enable Explicit
Web Proxy and select OK.
3. Go to Policy > Policy > IPv6 Policy and select Create New to add an IPv6 explicit web proxy
security policy with the following settings shown in Figure 60.
This IPv6 explicit web proxy policy allows traffic from all IPv6 IP addresses to connect
through the explicit web proxy and through the wan1 interface to any IPv6 addresses that
are accessible from the wan1 interface.
If you have enabled both the IPv4 and the IPv6 explicit web proxy you can combine IPv4 and
IPv6 addresses in a single explicit web proxy policy to allow both IPv4 and IPv6 traffic through
the proxy.
Fortinet Technologies Inc. Page 203 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
Restricting the outgoing source IP address of the IPv6 explicit web proxy
You can use the following command to restrict the source address of outgoing web proxy
packets to a single IPv6 address. The IP address that you specify must be the IPv6 address of
an interface that the explicit HTTP proxy is enabled on. You might want to use this option if the
explicit HTTP proxy is enabled on an interface with multiple IPv6 addresses.
Fortinet Technologies Inc. Page 204 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
NAT66, NAT64 and DNS64 are now supported for IPv6. These options provide IPv6 NAT and
DNS capabilities IPv6-IPv4 tunnelling or dual stack configurations. These are available only in
the CLI.
Fortinet supports all features described in RFC 6146. However, for DNS64 there is no support
for handling Domain Name System Security Extensions (DNSSEC). DNSSEC is for securing
types of information that are provided by the DNS as used on an IP network or networks. You
can find more information about DNS64 in RFC 6147.
In
r n 1:
al db
IP 8:
0
v6 1:
10
N :/48
0.
et
2
.1
w
2. 1
20
17 an
or
w
k
.2 er. r
12 m
Fo 64
72 erv rve
N
12
0. co
AT
rt an
: 1 .s se
0.
iG d
IP ple et
at D
v4 m r n
e NS
U 6
IP xa nte
ni 4
e I
t
To configure NAT64 to allow a host on the IPv6 network to connect to the Internet server
In this example the Internal IPv6 network address is 2001:db8:1::/48 and the external IPv4
network address is 172.20.120.0/24. NAT64 is configured to allow a user on the internal network
to connect to the server at IPv4 address 172.20.120.12. In this configuration, sessions exiting
the wan1 interface must have their source address changed to and IPv4 address in the range
172.20.120.200 to 172.20.120.210.
Fortinet Technologies Inc. Page 205 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
Enabling NAT64 with the config system nat64 command means that all IPv6 traffic
received by the current VDOM can be subject to NAT64 if the source and destination address
matches an NAT64 security policy.
By default, the setting always-senthetize-aaaa-record is not enabled. With this setting
disabled, the DNS proxy will attempt to find an AAAA records for queries to domain names and
therefore resolve the host names to IPv6 addresses. If the DNS proxy cannot find an AAAA
record, it synthesizes one by adding the NAT64 prefix to the A record.
By using the nat64-prefix option of the config system nat64 command to change the
default nat64 prefix (the default is the well known prefix 64:ff9b::/96) and setting
always-senthetize-aaaa-record to enable, the DNS proxy does not check for AAAA
records and always synthesizes AAAA records.
As an alternative to the above entry, there is the optional configuration that would allow the
resolution of CNAME queries.
config system nat64
set status enable
set nat64-prefix 64:ff9b::/96
set always-synthesize-aaaa-record enable
end
2. Enter the following command to add an IPv6 firewall address for the internal network:
config firewall address6
edit internal-net6
set ip6 2001:db8::/48
end
3. Enter the following command to add an IPv4 firewall address for the external network:
config firewall address
edit external-net4
set subnet 172.20.120.0/24
set associated-interface wan1
end
4. Enter the following command to add an IP pool containing the IPv4 address that the should
become the source address of the packets exiting the wan1 interface:
config firewall ippool
edit exit-pool4
set startip 172.20.120.200
set endip 172.20.120.210
end
Fortinet Technologies Inc. Page 206 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
5. Enter the following command to add a NAT64 policy that allows connections from the
internal IPv6 network to the external IPv4 network:
config firewall policy64
edit 0
set srcintf internal
set srcaddr internal-net6
set dstintf wan1
set dstaddr external-net4
set action accept
set schedule always
set service ANY
set logtraffic enable
set ippool enable
set poolname exit-pool4
end
The srcaddr can be any IPv6 firewall address and the dstaddr can be any IPv4 firewall
address.
Other NAT64 policy options include fixedport, that can be used to prevent NAT64 from
changing the destination port. You can also configure traffic shaping for NAT64 policies.
How a host on the internal IPv6 network communicates with example.server.com that
only has IPv4 address on the Internet
1. The host on the internal network does a DNS lookup for example.server.com by sending a
DNS query for an AAAA record for example.server.com.
2. The DNS query is intercepted by the FortiGate DNS proxy.
3. The DNS proxy attempts to resolve the query with a DNS server on the Internet and
discovers that there are no AAAA records for example.server.com.
4. The DNS proxy performs an A-record query for example.server.com and gets back an RRSet
containing a single A record with the IPv4 address 172.20.120.12.
5. The DNS proxy then synthesizes an AAAA record. The IPv6 address in the AAAA record
begins with the configured NAT64 prefix in the upper 96 bits and the received IPv4 address
in the lower 32 bits. By default, the resulting IPv6 address is 64:ff9b::172.20.120.12.
6. The host on the internal network receives the synthetic AAAA record and sends a packet to
the destination address 64:ff9b::172.20.120.12.
7. The packet is routed to the FortiGate internal interface where it is accepted by the NAT64
security policy.
8. The FortiGate unit translates the destination address of the packets from IPv6 address
64:ff9b::172.20.120.12 to IPv4 address 172.20.120.12 and translates the source address of
the packets to 172.20.120.200 (or another address in the IP pool range) and forwards the
packets out the wan1 interface to the Internet.
Fortinet Technologies Inc. Page 207 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
NAT66
NAT66 is used for translating an IPv6 source or destination address to a different IPv6 source or
destination address. NAT66 is not as common or as important as IPv4 NAT, as many IPv6 IP
addresses do not need NAT66 as much as IPv4 NAT. However, NAT66 can be useful for a
number of reasons. For example, you may have changed the IP addresses of some devices on
your network but want traffic to still appear to be coming from their old addresses. You can use
NAT66 to translate the source addresses of packets from the devices to their old source
addresses.
In FortiOS 5.0, NAT66 options can be added to an IPv6 security policy from the CLI.
Configuring NAT66 is very similar to configuring NAT in an IPv4 security policy. For example, use
the following command to add an IPv6 security policy that translates the source address of IPv6
packets to the address of the destination interface (similar to IPv4 source NAT:
config firewall policy6
edit 0
set srcintf internal
set dstintf wan1
set srcaddr internal_net
set dstaddr all
set action accept
set schedule always
set service ANY
set nat enable
end
Its also can be useful to translate one IPv6 source address to another address that is not the
same as the address of the exiting interface. You can do this using IP pools. For example, enter
the following command to add an IPv6 IP pool containing one IPv6 IP address:
configure firewall ippool6
edit example_6_pool
set startip 2001:db8::
set endip 2001:db8::
end
Enter the following command to add an IPv6 firewall address that contains a single IPv6 IP
address.
configure firewall address6
edit device_address
set ip6 2001:db8::132/128
end
Fortinet Technologies Inc. Page 208 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
Enter the following command to add an IPv6 security policy that accepts packets from a device
with IP address 2001:db8::132 and translates the source address to 2001:db8::.
config firewall policy6
edit 0
set srcintf internal
set dstintf wan1
set srcaddr device_address
set dstaddr all
set action accept
set schedule always
set service ANY
set nat enable
set ippool enable
set poolname example_6_pool
end
FortiOS 5.0 fully supports flow-based inspection of IPv6 traffic. This includes full support for
IPS, application control, as well as flow-based virus scanning, and web filtering.
To add flow-based inspection to IPv6 traffic go to Policy > Policy > IPv6 Policy and select
Create New to add an IPv6 Security Policy. Configure the policy to accept the traffic to be
scanned. Select UTM and select the UTM profiles to apply to the traffic. To apply flow-based
Fortinet Technologies Inc. Page 209 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
inspection you can select an IPS and an application control profile. You can also select antivirus
or web filtering profiles in which flow-based inspection has been selected.
The following IPv6 MIB fields have been added to the Fortinet FortiGate MIB. These MIS entries
can be used to display IPv6 session and policy statistics.
IPv6 Session Counters:
fgSysSes6Count
fgSysSes6Rate1
fgSysSes6Rate10
fgSysSes6Rate30
fgSysSes6Rate60
IPv6 Policy Statistics:
fgFwPol6StatsTable
fgFwPol6StatsEntry
FgFwPol6StatsEntry
fgFwPol6ID
fgFwPol6PktCount
fgFwPol6ByteCount
IPv6 Session Statistics:
fgIp6SessStatsTable
fgIp6SessStatsEntry
FgIp6SessStatsEntry
fgIp6SessNumber
The fgSysSesCount and fgSysSesRateX MIBs report statistics for IPv4 plus IPv6 sessions
combined. This behavior was not changed.
Fortinet Technologies Inc. Page 210 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
New OIDs
The following OIDs have been added:
FORTINET-FORTIGATE-MIB:fortinet.fnFortiGateMib.fgSystem.fgSystemInfo
.fgSysSes6Count 1.3.6.1.4.1.12356.101.4.1.15
.fgSysSesRate1 1.3.6.1.4.1.12356.101.4.1.16
.fgSysSesRate10 1.3.6.1.4.1.12356.101.4.1.17
.fgSysSesRate30 1.3.6.1.4.1.12356.101.4.1.18
.fgSysSesRate60 1.3.6.1.4.1.12356.101.4.1.19
FORTINET-FORTIGATE-MIB:fortinet.fnFortiGateMib.fgFirewall.fgFwPolicies
.fgFwPolTables
.fgFwPol6StatsTable.fgFwPol6StatsEntry.fgFwPol6ID 1.3.6.1.4.1.12356.
101.5.1.2.2.1.1
.fgFwPol6StatsTable.fgFwPol6StatsEntry.fgFwPol6PktCount 1.3.6.1.4.1.
12356.101.5.1.2.2.1.2
.fgFwPol6StatsTable.fgFwPol6StatsEntry.fgFwPol6ByteCount 1.3.6.1.4.1
.12356.101.5.1.2.2.1.3
FORTINET-FORTIGATE-MIB:fortinet.fnFortiGateMib.fgInetProto.fgInetProto
Tables
.fgIp6SessStatsTable.fgIp6SessStatsEntry.fgIp6SessNumber
1.3.6.1.4.1.12356.101.11.2.3.1.1
Fortinet Technologies Inc. Page 211 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
// FwPolicy6 table:
snmpwalk -v2c -cpublic 192.168.1.111 1.3.6.1.4.1.12356.101.5.1.2.2
FORTINET-FORTIGATE-MIB::fgFwPol6ID.1.3 = INTEGER: 3
FORTINET-FORTIGATE-MIB::fgFwPol6ID.1.4 = INTEGER: 4
FORTINET-FORTIGATE-MIB::fgFwPol6PktCount.1.3 = Counter64: 4329
FORTINET-FORTIGATE-MIB::fgFwPol6PktCount.1.4 = Counter64: 0
FORTINET-FORTIGATE-MIB::fgFwPol6ByteCount.1.3 = Counter64: 317776
FORTINET-FORTIGATE-MIB::fgFwPol6ByteCount.1.4 = Counter64: 0
// IP6SessNumber:
snmpwalk -v2c -cpublic 192.168.1.111 1.3.6.1.4.1.12356.101.11.2.3.1
FORTINET-FORTIGATE-MIB::fgIp6SessNumber.1 = Counter32: 89
You can add any Per-IP traffic shaper to an IPv6 security policy using the following command:
config firewall policy6
edit 0
set per-ip-shaper new-perip-shaper
end
DHCPv6 relay
You can use the following command to configure a FortiGate interface to relay DHCPv6 queries
and responses from one network to a network with a DHCPv6 server and back. The command
enables DHCPv6 relay and includes adding the IPv6 address of the DHCP server that the
FortiGate unit relays DHCPv6 requests to:
config system interface
edit internal
config ipv6
set dhcp6-relay-service enable
set dhcp6-relay-type regular
set dhcp6-relay-ip 2001:db8:0:2::30
end
Fortinet Technologies Inc. Page 212 FortiOS Handbook - Whats New for FortiOS 5.0
IPv6 Fortinet Technologies Inc.
FortiGate interfaces can get IPv6 addresses from an IPv6 DHCP server
From the CLI you can configure any FortiGate interface to get an IPv6 address from an IPv6
DHCP server. For example, to configure the wan2 interface to get an IPv6 address from an IPv6
DHCP server enter the following command:
config system interface
edit wan2
config ipv6
set ip6-mode dhcp
end
end
Fortinet Technologies Inc. Page 213 FortiOS Handbook - Whats New for FortiOS 5.0
Logging and reporting
FortiOS 5.0 log messages have been re-organized. The new log message format will be
described in the FortiOS 5.0 Logging and Reporting Guide and Log Message Reference.
In FortiOS 5.0, the Log & Report menu provides access to the following types of log messages:
Traffic log
Forward Traffic - log messages for traffic passing through the FortiGate unit. Includes
traffic log messages as well as Security log messages so that you can view messages
about Security events (such as a message indicating that a virus was found) in the same
location as the traffic log messages that recorded the current traffic at the time. From the
forward traffic log viewer, you can also view content logs and quarantined files. Forward
traffic log messages also include log messages created when you enable logging for the
IPv4 and IPv6 security policy implicit security policies.
Local Traffic - Log messages for traffic terminating at the FortiGate unit. All traffic
terminating at the FortiGate unit is allowed or denied by a local in policy. To view local in
policies go to Policy > Policy > Local In Policy. You can enable and disable logging for
local in traffic from here as well.
Multicast Traffic - Log messages for multicast traffic passing through the FortiGate unit
and allowed by multicast traffic policies
Invalid Packets - Log messages recorded when the FortiGate unit receives invalid
packets.
Event log - Event log messages organized into the following categories:
System
Router
VPN
User
WAN Opt. & Cache
WiFi
Page 214
Logging and reporting Fortinet Technologies Inc.
Figure 62:Example Forward Traffic log display showing some Security log messages
From each of these log message viewers, you can download raw log messages, adjust the
column settings to display the ones you are most interested in, filter the messages according to
a wide range of criteria and display detailed information for a selected log message. In addition,
you can control the source of the log messages that are displayed. For example, setting the log
location source can be the disk, if your FortiGate unit has available internal storage.
Other logging improvements include:
New event log types including event logs for FortiClient usage.
Traffic log messages for packets blocked by the implicit policies that appear at the bottom of
IPv4 and IPv6 policy lists. You can enable logging for these policies by editing them and
selecting Log Violation Traffic.
When you enable logging on a security policy and a session begins, the FortiGate unit logs
that session as well as logging when that session closes. These traffic logs contain the log
fields status=start, when a session has started, and status=close, when the session ends.
Email filter log messages now contain a new field, the cc field, which provides all the email
addresses that were copied (or cc'd) to the original email message.
There are two new event logs that contain information about the FSSO polling daemon: one
event log is recorded when a logged on user adds or replaces an old user; the second event
log is recorded when an old user is logged off because of inactivity or when replaced.
From the CLI, all of these and some other options are available from the new config log
setting command. This command configures traffic logging settings per VDOM.
In order for your FortiGate unit to create a Security Analysis Report, disk logging must be
enabled. To enable disk logging, go to Log & Report > Log Config > Log Settings and under
Logging and Archiving select Disk and Enable Local Reports.
Fortinet Technologies Inc. Page 215 FortiOS Handbook - Whats New for FortiOS 5.0
Logging and reporting Fortinet Technologies Inc.
Select Options to change the report schedule to Daily, Weekly or On Demand. You can also
change the time of day at which an old report is saved and a new one started.
Fortinet Technologies Inc. Page 216 FortiOS Handbook - Whats New for FortiOS 5.0
Logging and reporting Fortinet Technologies Inc.
To convert your compact logs to the new FortiOS 5 format, use the following CLI command:
execute log convert-oldlogs
This command is available only if you have upgraded from an earlier version of FortiOS and
have old compact logs on your system.
Fortinet Technologies Inc. Page 217 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall
Creating and editing security policies has been enhanced make creating different types of
security policies easier to understand. Now the first step in creating a security policy, after going
to Policy > Policy > Policy and selecting Create New is to select the Policy Type (Firewall or
VPN) and Policy Subtype. The policy subtype selections depend on the policy type:
If you select Firewall you can also select
Address to create a basic security policy
User Identity to create a policy that identifies users (user authentication)
Device Identity to create a policy that identifies devices (device authentication or BYOD)
If you select VPN you can also select
IPsec to create IPsec VPN policies
SSL-VPN to create SSL VPN policies
This section describes:
Creating a basic security policy
Creating a security policy to authenticate users
Creating a security policy to authenticate devices for BYOD
Creating a policy-based IPsec VPN security policy
Creating a route-based IPsec VPN security policy
Creating an SSL VPN security policy
Page 218
Firewall Fortinet Technologies Inc.
You select the destination address separately for each authentication rule. This means that you
can apply different features to different user groups depending on their destination addresses.
You can also now add individual users to authentication rules instead of just user groups.
Fortinet Technologies Inc. Page 219 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 220 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 221 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
FortiOS 5.0 no longer includes SSL VPN users or user groups. Any type of user group can be
added to an SSL VPN authentication rule.
Fortinet Technologies Inc. Page 222 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
To make Firewall services easier to use and more customizable, the former predefined services
list and custom services have been merged into one list and the list has been organized into
categories. You can go to Firewall Objects > Service > Services to see the new service list.
The order that the categories and services in the services list is maintained when you add a
service to another configuration object, such as a security policy. You can add categories,
change the category that a service is in and rearrange the order of categories in the list.
The single ANY service has been replaced with five ALL services that match all services or all
services of a specific type (ICMP, ICMP6, TCP and UDP). Otherwise, all of the familiar
pre-defined services can be found in the new services list.
By default, the list is organized by categories. You can select Category Settings to change the
order of the categories in the list. You can also choose to organize the list alphabetically by
service name.
Fortinet Technologies Inc. Page 223 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
Local in policies
Read-only local in policies show you all the types of traffic that can connect to or terminate at
the FortiGate unit. For the FortiGate unit to receive local traffic a policy to receive the traffic
must be in the local in policy list. The FortiGate unit needs to be able to receive traffic for a
number of reasons. Among them:
Central management connections from FortiManager
Networking and routing connections, for example accepting or relaying DHCP requests,
accepting routing communication from other routers (for example, OSPF, RIP, VRRP)
Administrative access to FortiGate interfaces over ICMP, HTTP, HTTPS, and so on.
The local-in policy list includes an action column that shows whether the FortiGate unit accepts
or drops sessions identified by the individual local in policies. As you change some
Fortinet Technologies Inc. Page 224 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
configuration settings those changes are reflected in the local in policies. For example,
Administrative Access local in policies change depending on the administrative access settings
of your FortiGate interfaces.
From the local in policy page (Firewall > Policy > Local In Policy), you can enable or disable
logging for local in allowed and denied traffic and for local out traffic.
In addition to the pre-defined local in policies, you can add your own using the following
command:
config firewall {local-in-policy | local-in-policy6}
edit 0
set srcaddr all
set dstaddr all
set action (deny | allow}
set service ALL
set schedule always
set auto-asic-offload {disable | enable}
end
Multicast Policies
A number of popular services use multicast protocols. Examples include the Bonjour service
used for finding devices on a network, EIGRP and OSPF. To make it easier to allow multicast
traffic through the FortiGate unit, you can now add multicast policies from the web-based
manager by going to Policy > Policy > Multicast Policy and selecting Create New.
Similar to a regular security policy, you configure a multicast policy by selecting incoming and
outgoing interfaces, source and destination addresses, enabling NAT, and selecting an action.
Specific to multicast policies, you can also specify a destination NAT (DNAT) address and select
a multicast protocol (options include ANY, ICMP, IGMP, TCP, UDP, OSPF and other). You cannot
add or edit these protocols but, if you select Other, you can add a protocol number.
The destination address of a multicast policy must be a multicast address firewall object.
Multicast addresses are added by going to Firewall Objects > Address > Addresses and
selecting Create New > Multicast Address. The FortiGate default configuration includes some
commonly used multicast addresses. Figure 74 shows the configuration of the default Bonjour
multicast address.
Fortinet Technologies Inc. Page 225 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
New DoS policies allow you to apply DoS anomalies to all traffic that hits a FortiGate interface.
This is the only way to apply DoS anomaly protection.
To add a DoS policy go to Policy > Policy > DoS Policy and select Create New to add a new
DoS policy. Select the FortiGate interface to add the policy to and select the source and
destination addresses and services that will match the packets that you want to apply DoS
anomalies to.
Enable one or more DoS anomalies. For each anomaly you can enable logging, set the action to
pass or block and change the threshold.
Fortinet Technologies Inc. Page 226 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
Use the following command to add a DoS policy from the CLI that adds syn flood protection for
all traffic hitting the wan2 interface:
config firewall DoS-policy
edit 1
set interface wan2
set srcaddr all
set dstaddr all
set service ALL
config anomaly
edit tcp_syn_flood
set status enable
set log enable
set action block
end
end
DoS sensors no longer available. DoS policies are the most common method for applying DoS
anomalies in FortiOS 5.0.
You can also use the following command to apply DoS anomalies to a one-arm sniffer
configuration.
config firewall sniffer
Interface policies are still available in FortiOS 5.0 from the CLI using the following commands:
config firewall interface-policy
config firewall interface-policy6
You can use interface policies to apply application control, intrusion protection, virus scanning,
web filtering, email filtering and data leak protection to traffic received by an interface.
The following commands are also available for adding sniffer interface policies, which are
similar to interface policies:
config firewall sniff-interface-policy
config firewall sniff-interface-policy6
All of these command have similar syntax for applying Security Features to traffic connecting to
or sniffed by a FortiGate interface.
Security proxy profile options are now configured by feature instead of by protocol. Also, SSL
and SSH inspection options have been moved to the new SSL/SSH inspection options profiles.
Fortinet Technologies Inc. Page 227 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
To configure how encrypted SSL or SSH traffic is inspected in security policy that accepts the
SSL or SSH traffic to be inspected, turn on SSL/SSH Inspection and select an SSL/SSH
inspection profile.
You can go to Policy > Policy > SSL/SSH Inspection to change the default SSL and SSH
inspection profile or you can create new profiles.
Fortinet Technologies Inc. Page 228 FortiOS Handbook - Whats New for FortiOS 5.0
Firewall Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 229 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching
In FortiOS 5.0, WAN optimization is enabled in security policies and WAN optimization rules are
no longer required. Instead of adding a security policy that accepts traffic to be optimized and
then creating WAN optimization rules to apply WAN optimization, in FortiOS 5.0 you create
security policies that accept traffic to be optimized and enable WAN optimization in those
policies. WAN optimization is applied by WAN optimization profiles which are created
separately and added to the required security policies.
Because of this change, you can now apply all Security features to WAN optimization traffic
without having to use a configuration that requires two VDOMS (one for applying Security
features and one for applying WAN optimization). Instead, you can enable Security features in
the security policies that accept WAN optimization traffic.
WAN optimization in policies requires you to add extra security policies with the incoming
interface set to the new wanopt interface.
In FortiOS 4.3, you could create web caching only WAN optimization rules while in FortiOS 5.0
you cannot create web caching only WAN optimization profiles. Instead, you simply enable web
caching in security policies, including WAN optimization policies. You can enable web caching
for any WAN optimization policy. You can also enable HTTPS web caching and SSL offloading
from the CLI for any security policy.
This chapter describes:
Configuring WAN optimization profiles
Dynamic data chunking for WAN optimization byte caching
Policy-based WAN optimization configuration changes summary
Combining web caching for HTTP traffic with WAN optimization
Turning on web caching and SSL offloading for HTTPS traffic
Changing the ports on which to look for HTTP and HTTPS traffic to cache
Web proxy URL debugging
FortiOS Web Caching now caches Windows/MS-Office software updates
Use WAN optimization profiles to apply WAN optimization techniques to traffic to be optimized.
In a WAN optimization profile, you can select the protocols to be optimized and for each
protocol you can enable SSL offloading, secure tunneling, byte caching and set the port the
protocol uses. You can also enable transparent mode and select an authentication group. You
can edit the default WAN optimization profile or create new ones.
In order to configure WAN optimization profiles using the web-based manager, this feature must
be enabled using Feature Select. For more information, see Feature Select on page 243.
To configure a WAN optimization profile go to WAN Opt & Cache > WAN Opt. Profile > Profile
and edit a profile or create a new one.
Page 230
WAN optimization and Web Caching Fortinet Technologies Inc.
From the CLI you can use the following command to configure a WAN optimization profile to
optimize HTTP traffic.
config wanopt profile
edit new-profile
config http
set status enable
end
Fortinet Technologies Inc. Page 231 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
Enter the following command to view WAN optimization profile CLI options:
tree wanopt profile
-- [profile] --*name (36)
|- transparent
|- comments
|- auth-group (36)
|- <http> -- status
|- secure-tunnel
|- byte-caching
|- prefer-chunking
|- tunnel-sharing
|- log-traffic
|- port
|- ssl
|- ssl-port
|- unknown-http-version
+- tunnel-non-http
|- <cifs> -- status
|- secure-tunnel
|- byte-caching
|- prefer-chunking
|- tunnel-sharing
|- log-traffic
+- port
|- <mapi> -- status
|- secure-tunnel
|- byte-caching
|- tunnel-sharing
|- log-traffic
+- port
|- <ftp> -- status
|- secure-tunnel
|- byte-caching
|- prefer-chunking
|- tunnel-sharing
|- log-traffic
+- port
+- <tcp> -- status
|- secure-tunnel
|- byte-caching
|- byte-caching-opt
|- tunnel-sharing
|- log-traffic
|- port
|- ssl
+- ssl-port
Fortinet Technologies Inc. Page 232 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
Dynamic data chunking helps to detect persistent data chunks in a changed files or in data
embedded in traffic using an unknown protocol. For example, Lotus notes uses a private
protocol to transfer email attachments in crafted messages. Dynamic data chunking performs
byte caching of data in Lotus notes traffic. Dynamic data chunking is available for HTTP, CIFS
and FTP.
Use the following command to enable dynamic data chunking for HTTP in the default WAN
optimization profile.
config wanopt profile
edit default
config http
set prefer-chunking dynamic
end
By default, dynamic data chunking is disabled and prefer-chunking is set to fix.
Fortinet Technologies Inc. Page 233 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
This section summarizes how basic WAN optimization configurations work in FortiOS 5.0, now
that WAN optimization is enabled in security policies.
Fortinet Technologies Inc. Page 234 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
Security policies
Two client side WAN optimization security policy configurations are possible: one for
active-passive WAN optimization and one for manual WAN optimization.
Fortinet Technologies Inc. Page 235 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
Fortinet Technologies Inc. Page 236 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
Security policies
Two server side WAN optimization security policy configurations are possible: one for
active-passive WAN optimization and one for manual WAN optimization.
Fortinet Technologies Inc. Page 237 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
Web caching can be applied to any HTTP or HTTPS traffic by enabling web caching in a
security policy that accepts the traffic. This includes WAN optimization and explicit web proxy
traffic. Web caching caches all HTTP traffic accepted by a policy on TCP port 80.
You can add web caching to a WAN optimization security policy to combine web caching with
WAN optimization for any WAN optimization security policy. This includes manual, active and
passive WAN optimization policies and WAN optimization tunnel policies. You can enable web
caching on both the client-side and the server-side FortiGate units or on just one or the other.
For optimum performance, you can enable web caching on both the client-side and server-side
FortiGate units. In this way, only uncached content is transmitted through the WAN optimization
tunnel. All cached content is access locally by clients from the client side FortiGate unit.
Web caching can cache the content of HTTPS traffic on TCP port 443. With HTTPS web
caching, the FortiGate unit receives the HTTPS traffic on behalf of the client, opens up the
encrypted traffic and extracts content to be cached. Then FortiGate unit re-encrypts the traffic
and sends it on to its intended recipient. It is very similar to a man-in-the-middle attack. You
enable HTTPS web caching from the CLI in a security policy that accepts the traffic to be
cached using webcache-https:
config firewall policy
edit 0
.
.
.
set webcache enable
set webcache-https any
.
.
.
end
Fortinet Technologies Inc. Page 238 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
The any setting causes the FortiGate unit to re-encrypt the traffic with the FortiGate units
certificate rather than the original certificate. This configuration can cause errors for HTTPS
clients because the name on the certificate does not match the name on the web site.
You can stop these errors from happening by configuring HTTPS web caching to use the web
servers certificate by setting webcache-https to ssl-server:
config firewall policy
edit 0
.
.
.
set webcache enable
set webcache-https ssl-server
.
.
.
end
The ssl-server option causes the FortiGate unit to re-encrypt the traffic with the certificate
that you imported into the FortiGate unit. The certificate is added to an SSL server configuration
using the following command:
config wanopt ssl-server
edit example_server
set ip <Web-Server-IP>
set port 443
set ssl-mode { full | half}
set ssl-cert <Web-Server-Cert>
end
Where:
Web-Server-IP is the web servers IP address.
Web-Server-Cert is the original web server certificate imported into the FortiGate unit.
The SSL server configuration also determines whether the SSL server is operating in half or full
mode and the port used for the HTTPS traffic.
Using the SSL server configuration, web caching also supports SSL offloading that uses the
FortiGate units FortiASIC SSL encryption/decryption engine to accelerate SSL performance.
Changing the ports on which to look for HTTP and HTTPS traffic to
cache
By default, FortiOS assumes HTTP traffic uses TCP port 80 and HTTPS traffic uses port 443
and so web caching is configured for all HTTP traffic accepted by a policy on TCP port 80 and
all HTTPS traffic on TCP port 443. If you want to cache HTTP or HTTPS traffic on other ports,
you can enable Security features for the security policy and add an SSL/SSH inspection profile
that looks for HTTP and HTTPS traffic on other TCP ports.
Setting the HTTP port to Any in the an SSL/SSH inspection profile is not compatible with web
caching. If you set the HTTP port to any, web caching only caches HTTP traffic on port 80.
Fortinet Technologies Inc. Page 239 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
You can use the following CLI commands to get debugging information that shows how the
web cache is handling specific URLs. You can debug web caching for a single web page (such
as docs.fortinet.com/fgt40mr3.html) or for all requests to a URL pattern (such as
docs.fortinet.com to debug all connections to any page on docs.fortinet.com). Wildcard
characters and regular expressions are not supported.
Normally you would use this feature if the web cache was not caching specific pages and sites.
It makes it easier to get debug information just for the pages causing the problem. This feature
works for web caching enabled in any security policy including web proxy and WAN
optimization security policies.
Fortinet Technologies Inc. Page 240 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Fri, 10 Feb 2012 17:05:15 GMT
X-Powered-By: ASP.NET
Connection: close
Content-Type: text/html
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Fri, 10 Feb 2012 17:05:15 GMT
X-Powered-By: ASP.NET
Content-Type: text/html
Connection: close
Fortinet Technologies Inc. Page 241 FortiOS Handbook - Whats New for FortiOS 5.0
WAN optimization and Web Caching Fortinet Technologies Inc.
FortiOS web caching is not always able to cache Windows and MS-Office updates because
they are downloaded using HTTP in multipart or chunked mode and typically run through
multiple TCP connections. To resolve this issue in FortiOS 5.0, the first request for Windows or
MS-Office updates (to download.windowsupdate.com) causes the cache process to download
the new update file in the background.
Once the new update file has been downloaded to the cache, it is available to web cache users
and all subsequent requests for this update will be downloaded from the cache. Because the
update file will not be available in the web cache until it has completely downloaded, the first
update request will not be able to get it from the web cache and neither will any updates
requested while the file is downloading in the background.
Fortinet Technologies Inc. Page 242 FortiOS Handbook - Whats New for FortiOS 5.0
Usability enhancements
FortiOS 5.0 introduces usability enhancements to make configuration easier and management
more effective and efficient.
New usability features include:
Feature Select
Improved list editing
Dynamic comment fields
Setup Wizard enhancements
Fortinet Top Bar
VDOM Mode GUI changes
Enhanced Top Sessions dashboard widget
Improved CLI syntax for multi-value fields
Feature Select
Feature Select is used to disable features which are not required for network administration.
Disabling features also removes all related configuration options from the web-based manager.
This feature replaces the previous GUI display options control.
Feature Select can be managed using the Features widget on the Status page. They can also be
found at System > Config > Features, where additional features are also available by selecting
Show More.
Page 243
Usability enhancements Fortinet Technologies Inc.
If a feature, such as IPv6, has been configured before being removed from the web-based
manager, this configuration will still exist as part of the network, even though it is no longer
visible using the web-based manager.
List editing has been enhanced on most lists of configuration items on the FortiOS 5.0
web-based manager. On most list items, you can click on any item to display a list of options.
The options available depend on the item and context.
Fortinet Technologies Inc. Page 244 FortiOS Handbook - Whats New for FortiOS 5.0
Usability enhancements Fortinet Technologies Inc.
Most comment fields available from the web-based manager and CLI have been extended to a
maximum of 255 characters and others to a maximum of 1023 characters. To save system
memory, the amount of storage space for comment fields is dynamically allocated based on the
size of the comment.
The Setup Wizard is now available for all FortiGate units. On individual models the wizard can
include advanced or model-specific configuration options, such as load balancing, 3G/4G
modem, virtual servers, remote VPN and the opportunity to configure all available interfaces.
The Setup Wizard also allows you to enable central management. When this option is selected,
much of the Wizard is bypassed because a FortiManager unit supplies the configuration
information. The WAN Topology and Primary WAN wizard pages are still presented for
configuration because the FortiGate unit must be able to connect to its network before
FortiManager can contact it.
Fortinet Technologies Inc. Page 245 FortiOS Handbook - Whats New for FortiOS 5.0
Usability enhancements Fortinet Technologies Inc.
The top bar can display a user ID if the user has authenticated with the FortiGate unit (in the
example the user ID is bdickie). You can select the user icon to sign out of the FortiGate unit.
The top bar can also display other information such as:
Application control violations
Endpoint control enforcement
Your web browsing quota
User ID if the user has authenticated
SSL VPN status and bookmarks
When operating a FortiGate unit with VDOMs enabled, when you log in as a system
administrator who can access multiple VDOMs, the VDOMs you can access appear under
Virtual Domains in the left web-based manager menu. Figure 83 shows an example VDOM
menu for a FortiGate unit with three virtual domains.
The Top Sessions dashboard widget has been enhanced to allow you to display information
about sessions according to their source address, destination address and the application
creating the sessions. To demonstrate this new functionality, by default the web-based manager
includes three new dashboards.
You may need to reset your dashboard if these dashboard widgets are not appearing. To reset
the dashboard, select Reset Dashboards from the Dashboard menu.
Top Sources
Top sources displays the top 25 source addresses. For each source address, the widget
displays device information, host name, the number of active sessions and the amount of data
sent/received by the device. You can hover over the device icon to get more information about
Fortinet Technologies Inc. Page 246 FortiOS Handbook - Whats New for FortiOS 5.0
Usability enhancements Fortinet Technologies Inc.
the device. You can also select an entry to see all of the individual sessions from that source
address. The session table includes the destination address, security policy, application name
and amount of data sent and received by the session.
Top Destinations
Top destinations displays the top 25 destination addresses. For each destination address, the
widget displays the destination host name and country, the number of sessions going to the
destination and the amount of data in bytes sent and received by the destination. You can
select an entry to see the individual sessions to that destination address. The session table
includes the source address, security policy, application name and amount of data sent
received by the session.
Fortinet Technologies Inc. Page 247 FortiOS Handbook - Whats New for FortiOS 5.0
Usability enhancements Fortinet Technologies Inc.
Top Applications
Top applications displays the top 25 applications sending traffic through the FortiGate unit. For
this widget to show data, you must enable application control for security policies that allow
traffic through the FortiGate unit.
For each application, the widget displays the application name, the number of sessions and the
amount of data in bytes sent and received. You can select the application name to get more
information about the application. You can select an entry to see the individual sessions for that
application. The session table includes the source address, destination address, security policy,
application name and amount of data sent received by the session.
Fortinet Technologies Inc. Page 248 FortiOS Handbook - Whats New for FortiOS 5.0
Usability enhancements Fortinet Technologies Inc.
You can add multiple IP addresses with this command. This can be useful if your network or
your Skype sessions have more than one public IP address. For example, you may have
multiple Internet connections each with a different IP address. Also, if the external IP address is
set using DHCP or PPPoE it may change and you can add multiple IP addresses to help
account for this. Use the following command to add multiple public IP addresses (separate the
addresses with a comma and no spaces).
config ips global
set skype-client-public-ipaddr 172.20.120.14,10.10.10.20
end
You may not have direct knowledge of your networks public IP address. This can happen for a
number of reasons, depending on your network configuration. For example, your FortiGate unit
may not be connected directly to the Internet. To make sure you are adding the right IP
addresses you can use free services such as WhatIsMyIP.com to verify your networks public IP
address.
Several new subcommands simplify editing of CLI fields that accept multiple values. This
eliminates re-typing of lists of options, IP addresses, and so on, saving time and avoiding errors.
You can simply add or remove individual items from the list.
Table 3: CLI subcommands for multi-value fields
unselect <field_name> <list> Remove one or more values from the list.
Fortinet Technologies Inc. Page 249 FortiOS Handbook - Whats New for FortiOS 5.0
Usability enhancements Fortinet Technologies Inc.
select <field_name> <list> Select one or more values. This is the same as the
set subcommand.
clear <field_name> Reset the multi-value field to its default value. This is
the same as the unset subcommand.
You can continue to use the set and unset subcommands on multi-value fields.
The new subcommands support command completion. For example, in the config system
interface command, if you enter select ?, the response shows only the multi-value fields:
dhcp-relay-ip dhcp relay ip address
allowaccess Allow management access to the interface
Example
Prior to FortiOS 5.0, to add SSH administrative access to an interface that currently allows
HTTPS, FGFM and PING access, you would enter:
set allowaccess https fgfm ping ssh
In FortiOS 5.0, you can do this:
append allowaccess ssh
Similarly, to remove ping from the list, you would enter:
unselect allowaccess ping
To reset allowaccess to its default, you would enter:
clear allowaccess
Fortinet Technologies Inc. Page 250 FortiOS Handbook - Whats New for FortiOS 5.0
SSL VPN
The distinction between SSL VPN user groups and firewall user groups has been removed. Any
use group can be used for SSL VPN authentication, except FSSO user groups.
The former SSL.root interface used in SSL VPN security policies as the source or destination
interface for SSL VPN traffic has been renamed to sslvpn tunnel interface.
You can now assign one or more DNS suffixes to the FortiGate SSL VPN configuration so that
SSL VPN clients do not need to use full-qualified host names to connect to internal resources. If
you add one suffix, it is always attached to DNS queries.
If you add more than one suffix the FortiGate unit will attempt a DNS lookup by adding each
suffix and use the first one that can be found in the DNS database. Multiple suffixes should be
added in the proper search order. You can use up to 253 characters to add one or more DNS
suffixes. Separate the suffixes with a space.
For example, if an organization requires DNS suffixes for example.com and example.org and
you want DNS queries to try example.com first, you can use the following command to add
these suffixes to the SSL VPN configuration:
Page 251
SSL VPN Fortinet Technologies Inc.
Use the following command to add a DNS suffix that is used for SSL VPN sessions:
config vpn ssl settings
set dns-suffix example.com example.org
end
Fortinet Technologies Inc. Page 252 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features
The following FortiGuard services are available for any FortiGate unit free of charge:
System time from FortiGuard NTP servers
Default DNS configuration uses FortiGuard DNS servers
With a valid support contract, the following FortiGuard services are also available:
Antivirus database updates
IPS signature updates
Vulnerability scan signature updates
FortiGuard Web Filtering lookups
DNS-based Web Filtering; the FortiGuard DNS server network returns web filter ratings.
DNS web filtering uses less CPU time, system memory and network bandwidth than
proxy or flow-based FortiGuard web filtering, resulting in better performance.
IP address reputation scores from the FortiGuard DNS server network.
FortiGuard Email filtering lookups
Geographic address database for geographic firewall addressing
BYOD device signature updates
USB Modem Updates
Page 253
Other new features Fortinet Technologies Inc.
FortiOS 5.0 supports uploading a configuration file from a TFTP server to the FortiGate unit to
automatically configure the FortiGate unit with one simple step. Similar to an auto-configuration
feature used for VoIP phones, you can store the domain name or IP address of a TFTP server
and a configuration file name in your DHCP server configuration.
DHCP option 66 is used for the TFTP server domain name (RFC 2132)
DHCP option 67 is used for the configuration file name (RFC 2132)
For example, to use auto-configuration to configure a FortiGate unit, add the TFTP server
information and configuration file name to your DHCP server. Make sure the TFTP server is
running and includes the configuration file. Then, from the CLI of the FortiGate unit to be
auto-configured, enter the following command (assuming the FortiGate internal interface is
connected to the same network as the TFTP server).
execute restore config dhcp internal
The FortiGate unit gets the information it needs from the DHCP server, downloads and installs
the configuration file from the TFTP server and restarts running its new configuration.
If the TFTP server is only available on a VLAN network (for example, VLAN id 224), you can use
the following command to access the TFTP server on the VLAN network:
execute restore config dhcp internal 224
In a network that already includes load balancing (either with load balancers or routers) for
traffic redundancy, two FortiGate units can be integrated into the load balancing configuration
using the FortiGate Session Life Support Protocol (FGSP). The external load balancers or
routers can distribute IPv4 and IPv6 TCP, UDP, ICMP and expectation, and NAT sessions among
the FortiGate units and the FGSP performs session synchronization to keep the session tables
of both FortiGate units synchronized.
If one of the FortiGate units fails, session failover occurs and active sessions fail over to the unit
that is still operating. This failover occurs without any loss of data. As well, the external load
balancers or routers detect the failover and re-distribute all sessions to the unit that is still
operating.
Load balancing and session failover is done by external routers or load balancers and not by the
FGSP. The FortiGate units perform session synchronization which allows session failover to
occur without packet loss.
The FGSP also includes configuration synchronization, allowing you to make configuration
changes at once for both FortiGate units, instead of requiring duplicate configuration changes
on each unit.
Settings that identify the FortiGate unit to the network, for example, interface IP addresses and
BGP neighbor settings, are not synchronized so that each FortiGate unit maintains its identity
on the network. These settings must be configured separately for each FortiGate unit.
In previous versions of FortiOS, the FGSP was called TCP session synchronization or
standalone session synchronization. However, the FGSP has been expanded to include
configuration synchronization and session synchronization of connectionless sessions,
expectation sessions, and NAT sessions.
Fortinet Technologies Inc. Page 254 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
_1
m
2
o
rt
er
d
o
V
P
c
B or
an
ad ter
1
al
rt
Lo ou
o
P
R
t
o
ro
Internal
1.
10
.1 3
10 ort
Network
0.
P
Li ni tio d
ro ura n
nk za n
ch fig n a
n
tio
yn n o
S o ssi
C e
S
er
10 t3
c
B or
an
0. r
.2
.1 Po
ad ter
al
Lo ou
R
10
t
o
ro
_ 1 t2
m or
P
1
rt
o
P
o
d
V
FortiOS 5.0 HA and the FortiGate Clustering Protocol (FGCP) support the following new types of
failover:
IPv6 session failover: if session pickup is enabled, IPv6 sessions are synchronized between
cluster members and, after an HA failover, IPv6 sessions will resume with only minimal
interruption.
NAT64 session failover: if session pickup is enabled, NAT64 sessions are synchronized
between cluster members and, after an HA failover, NAT64 sessions will resume with only
minimal interruption.
Full support for NAT 66 session failover: if session pickup is enabled, after an HA failover,
NAT66 sessions will resume with only minimal interruption.
SSL VPN authentication failover support: if session pick is enabled, SSL VPN sessions will
resume after a failover without requiring SSL VPN users to re-authenticate.
Device identification and management (BYOD).
FortiOS 5.0 includes an extension to the FotiGate Clustering Protocol that combines Switching
HA and Firewall HA into a single unified design. This feature is initially available on the
FortiGate-100D and will be considered for other models in future releases.
A FRUPS setup consists of 2 (and only 2) identical FortiGate-100D units. The setup supports
dual redundant HA links between the units for sharing session and configuration data.
To see a FRUP example, please refer to Cookbook Beta - FortiGate Redundant UTM Protocol.
Fortinet Technologies Inc. Page 255 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
Internet Content Adaptation Protocol (ICAP) profiles can be added to explicit web proxy
security policies. ICAP is a light-weight response/request protocol that allows the FortiGate unit
to offload explicit web proxy traffic to external servers for different kinds of processing. ICAP is
often used for offloading virus scanning and web filtering but has many other applications.
If you enable ICAP in a web proxy security policy, HTTP traffic intercepted by the explicit web
proxy is transferred to an ICAP server in the ICAP profile added to the policy. Responses from
the ICAP server are returned to the FortiGate unit which forwards them to their destination.
You can offload HTTP responses or HTTP requests (or both) to the same or different ICAP
servers. You can also enable streaming media bypass.
Example ICAP sequence for an ICAP server performing web URL filtering on web
proxy HTTP requests
1 A user opens a web browser and sends an HTTP request to connect to a web server.
2 The FortiGate unit intercepts the HTTP request and forwards it to an ICAP server.
3 The ICAP server receives the request and determines if the request is for URL that should be
blocked or allowed.
If the URL should be blocked, the ICAP server sends a response to the FortiGate unit. The
FortiGate unit returns this response to the users web browser. This response could be a
message informing the user that their request was blocked.
If the URL should be allowed, the ICAP server sends a request to the FortiGate unit. The
FortiGate unit forwards the request to the web server that the user originally attempted to
connect to.
When configuring ICAP on the FortiGate unit, you must configure an ICAP profile that contains
the ICAP server information; this profile is then applied to a security policy.
ath
s t Pn
e
qu e-
i er
Re ervic S erv 51
/s P 2.1
P ath ICA 6.12 3
e .1 5
ns ut 172 ort 4
s po ce-o P
Internal Re ervi
/s
Network
F
o
rt
iG
at
e
un
it
Fortinet Technologies Inc. Page 256 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
2 Go to Security Profiles > ICAP > Profiles and select Create New to add an ICAP profile
names New ICAP Profile.
3 Select Enable Request Processing and configure the following:
Server New ICAP Server
Path /service-in
On Failure Error
Fortinet Technologies Inc. Page 257 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
3 Enter the following to configure the ICAP profile to then apply to a security policy:
config icap profile
edit New ICAP Profile
set request enable
set request-failure error
set request-path /service-in
set request-server icap_server
set response enable
set response-failure error
set response-path /service-out
set response-server New ICAP Server
set streaming-content-bypass enable
end
4 In the config firewall policy command, apply the ICAP profile to a security policy:
config firewall policy
edit 0
set srcintf web-proxy
...
set utm-status enable
set icap-profile New ICAP Profile
end
You can add a DHCP server and authentication to any FortiGate interface. This includes
physical interfaces, WiFi interfaces (SSIDs), switch interfaces (software and hardware switch
interfaces), aggregate interfaces, redundant interfaces, loopback interfaces and VLAN
interfaces.
Fortinet Technologies Inc. Page 258 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
You can customize the captive portal for each interface or select from a saved portal.
Fortinet Technologies Inc. Page 259 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
Go to System > Config > Replacement Messages to edit replacement messages. Editing
replacement messages has been enhanced with a new editor that you can use to select and
edit replacement messages and view your changes in real time as you make them.
Fortinet Technologies Inc. Page 260 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
In addition, more replacement messages are available and the replacement message editor
includes simple and extended view. The simple view includes the most commonly edited
replacement messages while the extended view includes all of them.
On high-end FortiGate units that include NP4 processors, you can add inter-VDOM links where
the traffic is accelerated by NP4 processors. This means enhanced performance for traffic
passing between VDOMs that will improve the overall performance and capacity of many
multiple VDOM implementations.
If your FortiGate unit supports accelerated inter-VDOM links, when it is operating in multiple
VDOM mode, the interface list includes interfaces with names such as npu0-vlink0, npu1-vlink
and so on (see Figure 96).
Fortinet Technologies Inc. Page 261 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
By default, all of these links are associated with the root VDOM. However, you can edit each
interface in the link and add it another VDOM, creating an inter-VDOM link between 2 VDOMs
In previous versions of FortiOS, you can use the software switch feature to group independent
interfaces into a single logical switch. In this virtual software switch, all of the interfaces share
the same IP address and be connected to the same subnet and traffic would pass between
them as if they were switch ports, with no firewall or other FortiGate features applied to the
traffic. However, the virtual software switch feature just simulates a switch and, since the
FortiGate CPU must process the switch traffic, performance can be affected if the FortiGate unit
becomes busy processing a lot of traffic.
In FortiOS 5.0, for FortiGate models that have internal hardware switches, you can use the
following command to group interfaces in the hardware switch into virtual hardware switches in
which all traffic between the switch ports is processed on the switch itself and the FortiGate
CPU is not involved resulting in improved performance.
Recent FortiGate models with internal hardware switches support this feature.
Fortinet Technologies Inc. Page 262 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
Use the following command to create a virtual hardware switch using ports p1, p2, p3, and p4:
config system virtual-switch
edit virt-sw-1
set physical-switch sw0
config port
edit 1
set port p1
set speed <speed>
set duplex { up | down}
next
edit 2
set port p2
set speed <speed>
set duplex { up | down}
end
edit 3
set port p3
set speed <speed>
set duplex { up | down}
next
edit 4
set port p4
set speed <speed>
set duplex { up | down}
end
Fortinet Technologies Inc. Page 263 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
FortiOS 5.0 supports inter-VDOM links between NAT and Transparent mode VDOMs. No special
configuration is required and you can create an inter-VDOM link between NAT and Transparent
mode VDOMs in the same way as creating an inter-VDOM link between two NAT mode VDOMs.
Fortinet Technologies Inc. Page 264 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
FortiGate units can operate in one-arm sniffer mode or as a regular traffic sniffer. When the
FortiGate unit has an interface dedicated to its exclusive use (one-arm sniffer mode), all traffic
entering the interface is processed by the sniffer. The traffic is compared to the configured filters
and data that doesnt match the filters is discarded. The selected Security profiles process the
remaining traffic and log their findings. At the same time, the packets triggering the configured
Security features are saved for later examination. After all examination of the traffic is complete,
it is discarded. This continues until the configured maximum number of packets are saved,
when the sniffer stops.
When the sniffer does not have an interface dedicated to its exclusive use, the traffic is
examined by the sniffer, then processed normally by the FortiGate unit. That is, traffic is sniffed
and can then leave the FortiGate unit depending on how it is configured. The sniffed interface
traffic is examined for traffic matching the sniffer filters and matching packets are saved.
Security features can not be used to limit the traffic the sniffer examines when not in one-armed
mode. When the configured maximum number of packets is saved, the sniffer stops. The
FortiGate unit continues to process network traffic as normal.
Fortinet Technologies Inc. Page 265 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
Integrated switch fabric (ISF) access control list (ACL) short-cut path
On FortiGate models that include NP4 and XLR ports and an integrated switch fabric (for
example, the FortiGate-3x40 and 3950/1 models), you can create an ISF ACL security policy
that allows some traffic (for example, multicast traffic) to bypass security inspection, resulting in
reduced CPN and NP4 processor load.
This feature is only available in Transparent mode and only between port pairs.
Traffic accepted and forwarded by an ISF policy is not subject to security inspection. Normally,
you should only create ISF policies for traffic that you consider very low risk.
Fortinet Technologies Inc. Page 266 FortiOS Handbook - Whats New for FortiOS 5.0
Other new features Fortinet Technologies Inc.
Generalized TTL Security Mechanism (GTSM), defined in RFC 5082, prevents attacks based on
forged protocol packets sent from outside the network.
In IP packets, the TTL (time-to-live) value sets the maximum number of routers the packet can
pass through to reach its destination. Each router decrements the TTL value and the packet is
discarded if TTL reaches zero before the packet reaches its destination. In IPv6, TTL is called
Hop Limit.
Most protocol-related packets pass between adjacent routers, so the TTL value at the
destination is within a predictable range. TTL is difficult to spoof, especially the value of 255
which occurs if the sender is directly connected to the destination router.
On the FortiGate firewall, you can define TTL policies that specify the acceptable TTL range for
a particular packet source, destination and service. You do this using the new config
firewall ttl-policy command.
Use the following command to add a TTL policy that sets the TTL range to from 20 to 30:
config firewall ttl-policy
edit 0
set srcintf port1
set srcaddr example_net
set service ALL
set schedule always
set ttl 20-30
end
Firewall services
The CLI command get firewall service predefined command has been removed. All
predefined services have been moved to {get | set} firewall service custom.
Fortinet Technologies Inc. Page 267 FortiOS Handbook - Whats New for FortiOS 5.0
Chapter 2 Advanced Routing for FortiOS
5.0
This chapter describes advanced static routing concepts and how to implement dynamic
routing on FortiGate units.
This FortiOS Handbook chapter contains the following sections:
Advanced Static Routing explains universal and static routing concepts, equal cost multipath
(ECMP) and load balancing, policy routing, and routing in transparent mode.
Dynamic Routing Overview provides an overview of dynamic routing, compares static and
dynamic routing, and helps you decide which dynamic routing protocol is best for you.
Routing Information Protocol (RIP) describes a distance-vector routing protocol intended for
small, relatively homogeneous networks.
Border Gateway Protocol (BGP) describes classless inter-domain routing, and aggregate
routes. BGP is the only routing protocol to use TCP for a transport protocol.
Open Shortest Path First (OSPF) provides background on the specific protocol explaining terms
used and how the protocol works, as well as providing some troubleshooting information and
examples on configuring the protocols in different situations.
Intermediate System to Intermediate System Protocol (IS-IS), which describes the link state
protocol, is well-suited to smaller networks and with near universal support on routing
hardware. The section also provides troubleshooting information and configuration examples.
Page 268
Advanced Static Routing
Advanced static routing includes features and concepts that are used in more complex
networks. Dynamic routing is not addressed in this section.
This section includes:
Routing concepts
Static routing tips
Policy routing
Transparent mode static routing
Static routing example
Advanced static example: ECMP failover and load balancing
Routing concepts
Many routing concepts apply to static routing. However without first understanding these basic
concepts, it is difficult to understand the more complex dynamic routing.
This section includes:
Routing in VDOMs
Default route
Adding a static route
Routing table
Building the routing table
Static routing security
Multipath routing and determining the best route
Routing in VDOMs
Routing on FortiGate units is configured per-VDOM. This means if VDOMs are enabled, you
must enter a VDOM to do any routing configuration. This allows each VDOM to operate
independently, with its own default routes and routing configuration.
In this guide, the procedures assume your FortiGate unit has VDOMs disabled. This is stated in
the assumptions for the examples. If you have VDOMs enabled you will need to perform the
following steps in addition to the procedures steps.
Page 269
Following these commands, you can enter any routing CLI commands as normal.
Default route
The default route is used if either there are no other routes in the routing table or if none of the
other routes apply to a destination. Including the gateway in the default route gives all traffic a
next-hop address to use when leaving the local network. The gateway address is normally
another router on the edge of the local network.
All routers, including FortiGate units, are shipped with default routes in place. This allows
customers to set up and become operational more quickly. Beginner administrators can use the
default route settings until a more advanced configuration is warranted.
FortiGate units come with a default static route with an IPv4 address of 0.0.0.0, an
administration distance of 10, and a gateway IPv4 address.
Select the name of the interface which the static route will
Device
connect through.
Enter the distance value, which will affect which routes are
Distance selected first by different protocols for route management or load
balancing. The default is 10.
Enter the priority if desired, which will artificially weight the route
Priority during route selection. The higher the number, the less likely the
route is to be selected over others. The default is 0.
Routing table
When two computers are directly connected, there is no need for routing because each
computer knows exactly where to find the other computer. They communicate directly.
Networking computers allows many computers to communicate with each other. This requires
each computer to have an IP address to identify its location to the other computers. This is
much like a mailing address - you will not receive your postal mail at home if you do not have an
address for people to send mail to. The routing table on a computer is much like an address
book used to mail letters to people in that the routing table maintains a list of how to reach
computers. Routing tables may also include information about the quality of service (QoS) of the
route, and the interface associated with the route if the device has multiple interfaces.
Looking at routing as delivering letters is more simple than reality. In reality, routers loose power
or have bad cabling, network equipment is moved without warning, and other such events
happen that prevent static routes from reaching their destinations. When any changes such as
these happen along a static route, traffic can no longer reach the destination the route goes
down. Dynamic routing can address these changes to ensure traffic still reaches its destination.
The process of realizing there is a problem, backtracking and finding a route that is operational
is called convergence. If there is fast convergence in a network, users wont even know that
re-routing is taking place.
Fortinet Technologies Inc. Page 270 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The routing table for any device on the network has a limited size. For this reason, routes that
arent used are replaced by new routes. This method ensures the routing table is always
populated with the most current and most used routesthe routes that have the best chance of
being reused. Another method used to maintain the routing tables size is if a route in the table
and a new route are to the same destination, one of the routes is selected as the best route to
that destination and the other route is discarded.
Routing tables are also used in unicast reverse path forwarding (uRPF). In uRPF, the router not
only looks up the destination information, but also the source information to ensure that it
exists. If there is no source to be found, then that packet is dropped because the router
assumes it to be an error or an attack on the network.
The routing table is used to store routes that are learned. The routing table for any device on the
network has a limited size. For this reason, routes that arent used are replaced by new routes.
This method ensures the routing table is always populated with the most current and most used
routes the routes that have the best chance of being reused. Another method used to
maintain the routing tables size is if a route in the table and a new route are to the same
destination, one of the routes is selected as the best route to that destination and the other
route is discarded.
Some actions you can perform on the routing table include:
Viewing the routing table in the web-based manager
Viewing the routing table in the CLI
Searching the routing table
Fortinet Technologies Inc. Page 271 FortiOS Handbook - Advanced Routing for FortiOS 5.0
IP version: Select IPv4 or IPv6. This is available only when IPv6 is enabled in the
web-based manager. The fields displayed in the table depend on which IP
version is selected.
Type: Select one of the following route types to search the routing table and
display routes of the selected type only:
All all routes recorded in the routing table.
Connected all routes associated with direct connections to FortiGate
unit interfaces.
Static the static routes that have been added to the routing table
manually.
RIP all routes learned through RIP. For more information see Routing
Information Protocol (RIP) on page 319.
RIPNG all routes learned through RIP version 6 (which enables the
sharing of routes through IPv6 networks).
BGP all routes learned through BGP. For more information see Border
Gateway Protocol (BGP) on page 358.
OSPF all routes learned through OSPF. For more information see Open
Shortest Path First (OSPF) on page 396.
OSPF6 all routes learned through OSPF version 6 (which enables the
sharing of routes through IPv6 networks).
IS-IS all routes learned through IS-IS. For more information see
Intermediate System to Intermediate System Protocol (IS-IS) on
page 438.
HA RIP, OSPF, and BGP routes synchronized between the primary unit
and the subordinate units of a high availability (HA) cluster. HA routes are
maintained on subordinate units and are visible only if you are viewing the
router monitor from a virtual domain that is configured as a subordinate
virtual domain in a virtual cluster.
Not displayed when IP version IPv6 is selected.
For details about HA routing synchronization, see the FortiGate HA User
Guide.
Apply Filter Select to search the entries in the routing table based on the specified
search criteria and display any matching routes.
Not displayed when IP version IPv6 is selected.
Type The type values assigned to FortiGate unit routes (Static, Connected, RIP,
OSPF, or BGP).
Not displayed when IP version IPv6 is selected.
Fortinet Technologies Inc. Page 272 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Subtype If applicable, the subtype classification assigned to OSPF routes.
An empty string implies an intra-area route. The destination is in an area to
which the FortiGate unit is connected.
OSPF inter area the destination is in the OSPF AS, but the FortiGate unit
is not connected to that area.
External 1 the destination is outside the OSPF AS. This is known as
OSPF E1 type. The metric of a redistributed route is calculated by adding
the external cost and the OSPF cost together.
External 2 the destination is outside the OSPF AS. This is known as
OSPF E2 type. In this case, the metric of the redistributed route is
equivalent to the external cost only, expressed as an OSPF cost.
OSPF NSSA 1 same as External 1, but the route was received through a
not-so-stubby area (NSSA).
OSPF NSSA 2 same as External 2, but the route was received through a
not-so-stubby area.
For more information on OSPF subtypes, see OSPF Background and
concepts on page 396.
Not displayed when IP version 6 is selected.
Network The IP addresses and network masks of destination networks that the
FortiGate unit can reach.
Distance The administrative distance associated with the route. A value of 0 means
the route is preferable compared to other routes to the same destination,
and the FortiGate unit may routinely use the route to communicate with
neighboring routers and access servers.
Modifying this distance for dynamic routes is route distribution. See
Redistributing and blocking routes in BGP on page 389
Not displayed when IP version 6 is selected.
Metric The metric associated with the route type. The metric of a route influences
how the FortiGate unit dynamically adds it to the routing table. The
following are types of metrics and the protocols they are applied to.
Hop count routes learned through RIP.
Relative cost routes learned through OSPF.
Multi-Exit Discriminator (MED) routes learned through BGP. However,
several attributes in addition to MED determine the best path to a
destination network. For more information on BGP attributes, see BGP
attributes on page 364. By default, the MED value associated with a BGP
route is zero. However, the MED value can be modified dynamically. If the
value was changed from the default, the Metric column will display a
non-zero value.
Not displayed when IP version 6 is selected.
Fortinet Technologies Inc. Page 273 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Interface The interface through which packets are forwarded to the gateway of the
destination network.
Up Time The total accumulated amount of time that a route learned through RIP,
OSPF, or BGP has been reachable.
Not displayed when IP version IPv6 is selected.
If VDOMs are enabled on your FortiGate unit, all routing related CLI commands must be
performed within a VDOM and not in the global context.
Examining an entry:
B 10.160.0.0/23 [20/0] via 10.142.0.74, port3, 2d18h02m
Fortinet Technologies Inc. Page 274 FortiOS Handbook - Advanced Routing for FortiOS 5.0
B BGP. The routing protocol used.
2d18h02m How old this route is, in this case almost three days old.
tab table number. This will be either 254 (unicast) or 255 (multicast).
Fortinet Technologies Inc. Page 275 FortiOS Handbook - Advanced Routing for FortiOS 5.0
proto type of installation. This indicates where the route came from. Valid
values include:
0 - unspecific
2 - kernel
11 - ZebOS routing module
14 - FortiOS
15 - HA
16 - authentication based
17 - HA1
gwy gateway - the address of the gateway this route will use
Fortinet Technologies Inc. Page 276 FortiOS Handbook - Advanced Routing for FortiOS 5.0
5. Select Apply Filter.
All of the values that you specify as search criteria must match corresponding values in the
same routing table entry in order for that entry to be displayed.
Fortinet Technologies Inc. Page 277 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Network Address Translation (NAT)
Network address translation (NAT) is a method of changing the address traffic appears to
originate from. This practice is used to hide the IP address on companys internal networks, and
helps prevent malicious attacks that use those specific addresses.
This is accomplished by the router connected to that local network changing all the IP
addresses to its externally connected IP address before sending the traffic out to the other
networks, such as the Internet. Incoming traffic uses the established sessions to determine
which traffic goes to which internal IP address. This also has the benefit of requiring only the
router to be very secure against external attacks, instead of the whole internal network as would
be the case without NAT. Securing one computer is much cheaper and easier to maintain.
Configuring NAT on your FortiGate unit includes the following steps.
1. Configure your internal network. For example use the 10.11.101.0 subnet.
2. Connect your internal subnet to an interface on your FortiGate unit. For example use port1.
3. Connect your external connection, for example an ISP gateway of 172.20.120.2, to
another interface on your Fortigate unit, for example port2.
4. Configure security policies to allow traffic between port1 and port2 on your FortiGate unit,
ensuring that the NAT feature is enabled.
The above steps show that traffic from your internal network will originate on the 10.11.101.0
subnet and pass on to the 172.20.120.0 network. The FortiGate unit moves the traffic to the
proper subnet. In doing that, the traffic appears to originate from the FortiGate unit interface on
that subnet it does not appear to originate from where it actually came from.
NAT hides the internal network from the external network. This provides security through
obscurity. If a hacker tries to directly access your network, they will find the Fortigate unit, but
will not know about your internal network. The hacker would have to get past the
security-hardened FortiGate unit to gain access to your internal network. NAT will not prevent
hacking attempts that piggy back on valid connections between the internal network and the
outside world. However other UTM security measures can deal with these attempts.
Another security aspect of NAT is that many programs and services have problems with NAT.
Consider if someone on the Internet tries to initiate a chat with someone on the internal
network. The outsider only can access the FortiGate units external interface unless the security
policy allows the traffic through to the internal network. If allowed in, the proper internal user
would respond to the chat. However if its not allowed, the request to chat will be refused or
time-out. This is accomplished in the security policy by allowing or denying different protocols.
Blackhole Route
A blackhole route is a route that drops all traffic sent to it. It is very much like /dev/null in Linux
programming.
Fortinet Technologies Inc. Page 278 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Blackhole routes are used to dispose of packets instead of responding to suspicious inquiries.
This provides added security since the originator will not discover any information from the
target network.
Blackhole routes can also limit traffic on a subnet. If some subnet addresses are not in use,
traffic to those addresses (traffic which may be valid or malicious) can be directed to a
blackhole for added security and to reduce traffic on the subnet.
The loopback interface, a virtual interface that does not forward traffic, was added to enable
easier configuration of blackhole routing. Similar to a normal interface, this loopback interface
has fewer parameters to configure, and all traffic sent to it stops there. Since it cannot have
hardware connection or link status problems, it is always available, making it useful for other
dynamic routing roles. Once configured, you can use a loopback interface in security policies,
routing, and other places that refer to interfaces. You configure this feature only from the CLI.
For more information, see the system chapter of the FortiGate CLI Reference.
Fortinet Technologies Inc. Page 279 FortiOS Handbook - Advanced Routing for FortiOS 5.0
speed, and so on. The default administrative distances for any of these routing protocols are
configurable.
Static 10
EBGP 20
OSPF 110
IS-IS 115
RIP 120
IBGP 200
Another method to determine the best route is to manually change the priority of both routes in
question. If the next-hop administrative distances of two routes on the FortiGate unit are equal,
it may not be clear which route the packet will take. Manually configuring the priority for each of
those routes will make it clear which next-hop will be used in the case of a tie. The priority for a
route be set in the CLI, or when editing a specific static route, as described in the next section.
Lower priority routes are preferred. Priority is a Fortinet value that may or may not be present in
other brands of routers.
All entries in the routing table are associated with an administrative distance. If the routing table
contains several entries that point to the same destination (the entries may have different
gateways or interface associations), the FortiGate unit compares the administrative distances of
those entries first, selects the entries having the lowest distances, and installs them as routes in
the FortiGate unit forwarding table. As a result, the FortiGate unit forwarding table contains only
those routes having the lowest distances to every possible destination. While only static routing
uses administrative distance as its routing metric, other routing protocols such as RIP can use
metrics that are similar to administrative distance.
Route priority
After the FortiGate unit selects static routes for the forwarding table based on their
administrative distances, the priority field of those routes determines routing preference. Priority
is a Fortinet value that may or may not be present in other brands of routers.
You can configure the priority field through the CLI or the web-based manager. Priority values
can range from 0 to 4 294 967 295. The route with the lowest value in the priority field is
considered the best route. It is also the primary route.
Fortinet Technologies Inc. Page 280 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To change the priority of a route - CLI
The following command changes the priority to 5 for a route to the address 10.10.10.1 on the
port1 interface.
config router static
edit 1
set device port1
set gateway 10.10.10.10
set dst 10.10.10.1
set priority 5
end
If there are other routes set to priority 10, the route set to priority 5 will be preferred. If there are
routes set to priorities less than 5, those other routes will be preferred instead.
In summary, because you can use the CLI to specify which sequence numbers or priority field
settings to use when defining static routes, you can prioritize routes to the same destination
according to their priority field settings. For a static route to be the preferred route, you must
create the route using the config router static CLI command and specify a low priority
for the route. If two routes have the same administrative distance and the same priority, then
they are equal cost multipath (ECMP) routes.
Since this means there is more than one route to the same destination, it can be confusing
which route or routes to install and use. However, if you have enabled load balancing with
ECMP routes, then different sessions will resolve this problem by using different routes to the
same address.
Ping
Beyond the basic connectivity information, ping can tell you the amount of packet loss (if any),
how long it takes the packet to make the round trip, and the variation in that time from packet to
packet.
If there is no packet loss detected, your basic network connectivity is OK.
If there is some packet loss detected, you should investigate:
possible ECMP, split horizon, network loops
cabling to ensure no loose connections
Fortinet Technologies Inc. Page 281 FortiOS Handbook - Advanced Routing for FortiOS 5.0
If there is total packet loss, you should investigate:
hardware - ensure cabling is correct, and all equipment between the two locations is
accounted for
addresses and routes - ensure all IP addresses and routing information along the route is
configured as expected
firewalls - ensure all firewalls are set to allow PING to pass through
Traceroute
Where ping will only tell you if it reached its destination and came back successfully, traceroute
will show each step of its journey to its destination and how long each step takes. If ping finds
an outage between two points, traceroute can be used to locate exactly where the problem is.
Fortinet Technologies Inc. Page 282 FortiOS Handbook - Advanced Routing for FortiOS 5.0
If the FortiGate is running in NAT mode, verify that all desired routes are in the routing table:
local subnets, default routes, specific static routes, and dynamic routing protocols.
To check the routing table in the web-based manager, use the Routing Monitor go to Router
> Monitor > Routing Monitor. In the CLI, use the command get router info
routing-table all.
When your network goes beyond basic static routing, here are some tips to help you plan and
manage your static routing.
Fortinet Technologies Inc. Page 283 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Policy routing
Policy routing enables you to redirect traffic away from a static route. This can be useful if you
want to route certain types of network traffic differently. You can use incoming traffics protocol,
source address or interface, destination address, or port number to determine where to send
the traffic. For example, generally network traffic would go to the router of a subnet, but you
might want to direct SMTP or POP3 traffic directly to the mail server on that subnet.
If you have configured the FortiGate unit with routing policies and a packet arrives at the
FortiGate unit, the FortiGate unit starts at the top of the Policy Route list and attempts to match
the packet with a policy. If a match is found and the policy contains enough information to route
the packet (a minimum of the IP address of the next-hop router and the FortiGate interface for
forwarding packets to it), the FortiGate unit routes the packet using the information in the policy.
If no policy route matches the packet, the FortiGate unit routes the packet using the routing
table.
Most policy settings are optional, so a matching policy alone might not provide enough
information for forwarding the packet. The FortiGate unit may refer to the routing table
in an attempt to match the information in the packet header with a route in the routing
table. For example, if the outgoing interface is the only item in the policy, the FortiGate
unit looks up the IP address of the next-hop router in the routing table. This situation
could happen when the interfaces are dynamic (such as DHCP or PPPoE) and you do
not want or are unable to specify the IP address of the next-hop router.
Policy route options define which attributes of a incoming packet cause policy routing to occur.
If the attributes of a packet match all the specified conditions, the FortiGate unit routes the
packet through the specified interface to the specified gateway.
To view policy routes go to Router > Static > Policy Routes.
Create New Add a policy route. See Adding a policy route on page 285.
Move the selected policy route. Enter the new position and select OK.
Move To icon
For more information, see Moving a policy route on page 287.
Outgoing The interfaces through which policy routed packets are routed.
The IP source addresses and network masks that cause policy routing
Source
to occur.
Fortinet Technologies Inc. Page 284 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Adding a policy route
To add a policy route, go to Router > Static > Policy Route and select Create New.
Type the IP address of the next-hop router that the FortiGate unit
Gateway Address
can access through the specified interface.
Protocol 6
Fortinet Technologies Inc. Page 285 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Destination Ports From 21 to 21
Type of Service
Type of service (TOS) is an 8-bit field in the IP header that enables you to determine how the IP
datagram should be delivered, with such qualities as delay, priority, reliability, and minimum
cost.
Each quality helps gateways determine the best way to route datagrams. A router maintains a
ToS value for each route in its routing table. The lowest priority TOS is 0, the highest is 7 - when
bits 3, 4, and 5 are all set to 1. The router tries to match the TOS of the datagram to the TOS on
one of the possible routes to the destination. If there is no match, the datagram is sent over a
zero TOS route.
Using increased quality may increase the cost of delivery because better performance may
consume limited network resources. For more information, see RFC 791 and RFC 1349.
Table 5: The role of each bit in the IP header TOS 8-bit field
For example, if you want to assign low delay, and high reliability, say for a VoIP application
where delays are unacceptable, you would use a bit pattern of xxx1x1xx where an x indicates
that bit can be any value. Since all bits are not set, this is a good use for the bit mask; if the
mask is set to 0x14, it will match any TOS packets that are set to low delay and high reliability.
Fortinet Technologies Inc. Page 286 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Moving a policy route
A routing policy is added to the bottom of the routing table when it is created. If you prefer to
use one policy over another, you may want to move it to a different location in the routing policy
table.
The option to use one of two routes happens when both routes are a match, for example
172.20.0.0/255.255.0.0 and 172.20.120.0/255.255.255.0. If both of these routes
are in the policy table, both can match a route to 172.20.120.112 but you consider the
second one as a better match. In that case the best match route should be positioned before
the other route in the policy table.
To change the position of a policy route in the table, go to Router > Static > Policy Routes and
select Move To for the policy route you want to move.
Select Before to place the selected Policy Route before the indicated
Before/After
route. Select After to place it following the indicated route.
Enter the Policy route ID of the route in the Policy route table to move
Policy route ID
the selected route before or after.
FortiOS operating modes allow you to change the configuration of your FortiGate unit
depending on the role it needs to fill in your network.
NAT/Route operating mode is the standard mode where all interfaces are accessed individually,
and traffic can be routed between ports to travel from one network to another.
In transparent operating mode, all physical interfaces act like one interface. The FortiGate unit
essentially becomes a bridge traffic coming in over any interface is broadcast back out over
all the interfaces on the FortiGate unit.
In transparent mode, there is no entry for routing at the main level of the menu on the
web-based manager display as there is in NAT/Route mode. Routing is instead accessed
through the network menu option.
To view the routing table in transparent mode, go to System > Network > Routing Table.
When viewing or creating a static route entry in transparent mode there are only three fields
available.
The destination of the traffic being routed. The first entry is attempted
Destination first for a match, then the next, and so on until a match is found or the
IP/Mask last entry is reached. If no match is found, the traffic will not be routed.
Use 0.0.0.0 to match all traffic destinations. This is the default route.
Specifies the next hop for the traffic. Generally the gateway is the
Gateway
address of a router on the edge of your network.
The priority is used if there is more than one match for a route. This
allows multiple routes to be used, with one preferred. If the preferred
route is unavailable the other routes can be used instead.
Priority Valid range of priority can be from 0 to 4 294 967 295.
If more than one route matches and they have the same priority it
becomes an ECMP situation and traffic is shared among those routes.
See Route priority on page 280.
Fortinet Technologies Inc. Page 287 FortiOS Handbook - Advanced Routing for FortiOS 5.0
When configuring routing on a FortiGate unit in transparent mode, remember that all interfaces
must be connected to the same subnet. That means all traffic will be coming from and leaving
on the same subnet. This is important because it limits your static routing options to only the
gateways attached to this subnet. For example, if you only have one router connecting your
network to the Internet then all static routing on the FortiGate unit will use that gateway. For this
reason static routing on FortiGate units in transparent mode may be a bit different, but it is not
as complex as routing in NAT/Route mode.
This is an example of a typical small network configuration that uses only static routing.
This network is in a dentist office that includes a number of dentists, assistants, and office staff.
The size of the office is not expected to grow significantly in the near future, and the network
usage is very stablethere are no new applications being added to the network.
The users on the network are:
admin staff - access to local patient records, and go online for billing purposes
dentists - access and update local patient records, research online from desk
assistants - access and update local patient records in exam rooms
The distinction here is mainly that only the admin staff and dentists office proper need access
to the internetall the other traffic is local and doesnt need to need to leave the local network.
Routing is only required for the outbound traffic, and the computers that have valid outbound
traffic.
Only configuring routing on computers that need it will act as an additional layer of security by
helping prevent malicious traffic from leaving the network.
Fortinet Technologies Inc. Page 288 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Assumptions about these computers, and network include:
the FortiGate unit is a model with interfaces labeled port1 and port2
the FortiGate unit has been installed and is configured in NAT/Route mode
VDOMs are not enabled
the computers on the network are running MS Windows software
any hubs required in the network are not shown in the network diagram
the network administrator has access to the ISP IP addresses, and is the super_admin
administrator on the FortiGate unit
Exam5 Dentist3
Forti
FortiGate
F o
unit
Exam6
Exam4
Exam3 Dentist1
Exam2 Dentist2
Dentist office
Dental exam Admin
computers
room computers desk
Exam1
Printer
Table 6: Static routing example device names, IP addresses, and level of access
Exam1-5 192.168.10.31-35 NO
Printer 192.168.10.41 NO
Fortinet Technologies Inc. Page 289 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Get your ISP information such as DNS, gateway, etc.
Your local network connects to the Internet through your Internet Service Provider (ISP). They
have IP addresses that you need to configure your network and routing.
The addresses needed for routing are your assigned IP address, DNS servers, and the gateway.
IP/Netmask 172.100.1.1/255.255.255.0
Fortinet Technologies Inc. Page 290 FortiOS Handbook - Advanced Routing for FortiOS 5.0
2. Enter the following:
IP/Netmask 172.100.20.20/255.255.255.0
Fortinet Technologies Inc. Page 291 FortiOS Handbook - Advanced Routing for FortiOS 5.0
to update their software. The FortiGate unit can store an up to date copy of the FortiClient
software and offer a URL to it for users to install it if they need to.
Destination port1
Interface/Zone
Schedule always
Service Multiple.
Select DHCP, DNS,FTP, HTTP,
HTTPS, NTP, POP3, SMTP, SSH.
Action ACCEPT
11.Select OK.
12.Select Create New.
13.Enter the following:
Fortinet Technologies Inc. Page 292 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Source Interface/Zone port1
Destination port2
Interface/Zone
Schedule always
Service Multiple.
Select DHCP, DNS,FTP, HTTP,
HTTPS, NTP, POP3, SMTP, SSH.
Action ACCEPT
14.Select OK.
Fortinet Technologies Inc. Page 293 FortiOS Handbook - Advanced Routing for FortiOS 5.0
set dstaddr all
set action accept
set schedule always
set service "DHCP" "DNS" "FTP" "HTTP" "HTTPS" "NTP" "POP3"
"SMTP" "SSH"
set logtraffic enable
set endpoint-check enable
set label "Section2"
set endpoint-restrict-check no-av db-outdated
next
edit 2
set srcintf port2
set dstintf port1
set srcaddr all
set dstaddr Internet_PCs
set action accept
set schedule always
set service "DHCP" "DNS" "FTP" "HTTP" "HTTPS" "NTP" "POP3"
"SMTP" "SSH"
set logtraffic enable
set endpoint-check enable
set label "Section2"
set endpoint-restrict-check no-av db-outdated
end
end
Device port2
Gateway 172.100.20.5
Distance 10
4. Select OK.
Fortinet Technologies Inc. Page 294 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure Fortinet unit static routing - CLI
configure routing static
edit 1
set gateway 172.100.20.5
set distance 10
set device port2
set dst 0.0.0.0
end
end
The Windows CLI procedure does not configure the DNS entries. It just adds the static routes.
To configure routing and DNS on Admin and Dentist PCs - Windows GUI
1. On PC, select Start > Control Panel > Network Connections.
2. Right click on the network connection to your local network that has a status of Connected,
and select Properties.
3. Under the General tab, from the list select TCP/IP, and Properties.
4. Under Gateway, enter the FortiGate unit address (192.168.10.1).
5. Enter the primary and secondary DNS server addresses from your ISP (172.11.22.33 and
172.11.22.34).
6. Select OK.
Fortinet Technologies Inc. Page 295 FortiOS Handbook - Advanced Routing for FortiOS 5.0
As this step does not require any routing, details have not been included.
Fortinet Technologies Inc. Page 296 FortiOS Handbook - Advanced Routing for FortiOS 5.0
3. If step 2 was not successful, at the command prompt on the PC enter traceroute
22.11.22.33.
The output from this command should appear similar to:
Pinging 22.11.22.33 with 32 bytes of data:
Equal Cost Multi-Path (ECMP) load balancing and failover are methods that extend basic static
routing. They allow you to use your network bandwidth more effectively and with less down time
than if you used basic static routing alone.
The concepts in this section include:
Equal-Cost Multi-Path (ECMP)
Configuring interface status detection for gateway load balancing
Configuring spillover or usage-based ECMP
Configuring weighted static route load balancing
If multiple routes to the same destination have the same priority but different
distances, the route with the lowest distance is used. If multiple routes to the same
destination have the same distance but different priorities, the route with the lowest
priority is used. Distance takes precedence over priority. If multiple routes to the
same destination have different distances and different priorities, the route with the
lowest distance is always used even if it has the highest priority.
If more than one ECMP route is available, you can configure how the FortiGate unit selects the
route to be used for a communication session. If only one ECMP route is available (for example,
because an interface cannot process traffic because interface status detection does not receive
a reply from the configured server) then all traffic uses this route.
Previous versions of FortiOS provided source IP-based load balancing for ECMP routes, but
now FortiOS includes three configuration options for ECMP route failover and load balancing:
Fortinet Technologies Inc. Page 297 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The FortiGate unit load balances sessions among ECMP
Weighted Load
routes based on weights added to ECMP routes. More traffic
Balance (also called
is directed to routes with higher weights. After selecting
weight-based)
weight-based you must add weights to static routes.
You can configure only one of these ECMP route failover and load balancing methods in a single
VDOM. If your FortiGate unit is configured for multiple VDOM operation, each VDOM can have
its own ECMP route failover and load balancing configuration.
To configure the ECMP load balancing method from the web-based manager
1. Go to Router > Static > Settings.
2. Set ECMP Load Balance Method to Source IP based, Weighted Load Balance, or Spillover.
Fortinet Technologies Inc. Page 298 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Since it is possible that a response may not be received, even if the server and the network are
operating normally, the dead gateway detection configuration controls the time interval between
testing the connection to the server and the number of times the test can fail before the unit
assumes that the interface cannot connect to the server.
As long as the unit receives responses for at least one of the protocols that you select,
the unit assumes the server is operating and can forward packets. Responding to
more than one protocol does not enhance the status of the server or interface.
Use TCP echo to confirm that the server is responding. Select this
option if the server is configured to provide TCP echo services. In
some cases a server may be configured to reply to TCP echo
requests but not to reply to ICMP pings.
TCP echo uses TCP packets on port number 7 to send a text string
to the server and expect an echo reply back from the server. The
TCP Echo
echo reply just echoes back the same text to confirm that the server
can respond to TCP requests.
FortiGate units do not recognize RST (reset) packets from TCP
Echo servers as normal TCP echo replies. If the unit receives an
RST response to a TCP echo request, the unit assumes the server
is unreachable.
Use UDP echo to detect the server. Select this option if the server is
configured to provide UDP echo services. In some cases a server
may be configured to reply to UDP echo requests but not to reply
ICMP pings.
UDP Echo
UDP echo uses UDP packets on port number 7 to send a text string
to the server and expects an echo reply from the server. The echo
reply just echoes back the same text to confirm that the server can
respond to UDP requests.
Failover Enter the number of times the test can fail before the unit assumes
Threshold that the interface cannot connect to the server.
Fortinet Technologies Inc. Page 299 FortiOS Handbook - Advanced Routing for FortiOS 5.0
4. Select OK.
Fortinet Technologies Inc. Page 300 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Interface port3
Spillover Threshold 100
Interface port4
Spillover Threshold 200
For example, consider a FortiGate unit with interfaces port3 and port4 both connected to the
Internet through different ISPs. ECMP routing is set to usage-based and route spillover for to
100 Kbps for port3 and 200 Kbps for port4. Two ECMP default routes are added, one for port3
and one for port4.
If the route to port3 is higher in the routing table than the route to port4, the FortiGate unit sends
all default route sessions out port3 until port3 is processing 100Kbps of data. When port3
reaches its configured bandwidth limit, the FortiGate unit sends all default route sessions out
Fortinet Technologies Inc. Page 301 FortiOS Handbook - Advanced Routing for FortiOS 5.0
port4. When the bandwidth usage of port3 falls below 100Kbps, the FortiGate again sends all
default route sessions out port3.
New sessions with destination IP addresses that are already in the routing cache; however, use
the cached routes. This means that even if port3 is exceeding its bandwidth limit, new sessions
can continue to be sent out port3 if their destination addresses are already in the routing cache.
As a result, new sessions are sent out port4 only if port3 exceeds its bandwidth limit and if the
routing cache does not contain a route for the destination IP address of the new session.
Also, the switch over to port4 does not occur as soon as port3 exceeds its bandwidth limit.
Bandwidth usage has to exceed the limit for a period of time before the switch over takes place.
If port3 bandwidth usage drops below the bandwidth limit during this time period, sessions are
not switched over to port4. This delay reduces route flapping.
FortiGate usage-based ECMP routing is not actually load balancing, since routes are not
distributed evenly among FortiGate interfaces. Depending on traffic volumes, most traffic would
usually be processed by the first interface with only spillover traffic being processed by other
interfaces.
If you are configuring usage-based ECMP in most cases you should add spillover thresholds to
all of the interfaces with ECMP routes. The default spillover threshold is 0 which means no
bandwidth limiting. If any interface has a spillover threshold of 0, no sessions will be routed to
interfaces lower in the list unless the interface goes down or is disconnected. An interface can
go down if Detect interface status for Gateway Load Balancing does not receive a response
from the configured server.
Fortinet Technologies Inc. Page 302 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To add weights to static routes from the web-based manager
1. Go to Router > Static > Settings.
2. Set ECMP Load Balance Method to Weighted Load Balance.
3. Go to Router > Static > Static Routes.
4. If needed, add new static routes, for example:
Fortinet Technologies Inc. Page 303 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Dynamic Routing Overview
This section provides an overview of dynamic routing, and how it compares to static routing.
For details on various dynamic routing protocols, see the following chapters for detailed
information.
The following topics are included in this section:
What is dynamic routing?
Comparison of dynamic routing protocols
Choosing a routing protocol
Dynamic routing terminology
IPv6 in dynamic routing
Dynamic routing uses a dynamic routing protocol to automatically select the best route to put
into the routing table. So instead of manually entering static routes in the routing table, dynamic
routing automatically receives routing updates, and dynamically decides which routes are best
to go into the routing table. Its this intelligent and hands-off approach that makes dynamic
routing so useful.
Dynamic routing protocols vary in many ways and this is reflected in the various administrative
distances assigned to routes learned from dynamic routing. These variations take into account
differences in reliability, speed of convergence, and other similar factors. For more information
on these administrative distances, see Multipath routing and determining the best route on
page 279.
This section includes:
Comparing static and dynamic routing
Dynamic routing protocols
Minimum configuration for dynamic routing
Page 304
complexity and some overhead: the routing protocol uses some bandwidth for its own
administration.
Table 7: Comparing static and dynamic routing
Hardware support Supported by all routing May require special, more expensive
hardware routers
Fortinet Technologies Inc. Page 305 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Interior versus exterior routing protocols
The names interior and exterior are very descriptive. Interior routing protocols are designed for
use within a contained network of limited size, whereas exterior routing protocols are designed
to link multiple networks together. They can be used in combination in order to simplify network
administration. For example, a network can be built with only border routers of a network
running the exterior routing protocol, while all the routers on the network run the interior
protocol, which prevents them from connecting outside the network without passing through
the border. Exterior routers in such a configuration must have both exterior and interior
protocols, to communicate with the interior routers and outside the network.
Nearly all routing protocols are interior routing protocols. Only BGP is commonly used as an
exterior routing protocol.
You may see interior gateway protocol (IGP) used to refer to interior routing protocols, and
exterior gateway protocol (EGP) used to refer to interior routing protocols.
Link-state protocols
Link-state protocols are also known as shortest path first protocols. Where distance vector uses
information passed along that may or may not be current and accurate, in link-state protocols
each router passes along only information about networks and devices directly connected to it.
This results in a more accurate picture of the network topology around your router, allowing it to
make better routing decisions. This information is passed between routers using link-state
advertisements (LSAs). To reduce the overhead, LSAs are only sent out when information
Fortinet Technologies Inc. Page 306 FortiOS Handbook - Advanced Routing for FortiOS 5.0
changes, compared to distance vector sending updates at regular intervals even if no
information has changed. The more accurate network picture in link-state protocols greatly
speed up convergence and avoid problems such as routing-loops.
Version no yes no
Router ID no no yes
Each dynamic routing protocol was designed to meet a specific routing need. Each protocol
does some things well, and other things not so well. For this reason, choosing the right dynamic
routing protocol for your situation is not an easy task.
Fortinet Technologies Inc. Page 307 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Table 9: Comparing RIP, BGP, and OSPF dynamic routing protocols (Continued)
Routing protocols
Routing Information Protocol (RIP) uses classful routing, as well as incorporating various
methods to stop incorrect route information from propagating, such as the poisoned horizon
method. However, on larger networks its frequent updates can flood the network and its slow
convergence can be a problem.
Border Gateway Protocol (BGP) has been the core Internet backbone routing protocol since
the mid 1990s, and is the most used interior gateway protocol (IGP). However, some
configurations require full mesh connections which flood the network, and there can be route
flap and load balancing issues for multihomed networks.
Open Shortest Path First (OSPF) is commonly used in large enterprise networks. It is the
protocol of choice mainly due to its fast convergence. However, it can be complicated to setup
properly.
Intermediate System to Intermediate System (IS-IS) Protocol allows routing of ISOs OSI
protocol stack Connectionless Network Service (CLNS). IS-IS is an Interior Gateway Protocol
(IGP) not intended to be used between Autonomous Systems (ASes). IS-IS is a link state
protocol well-suited to smaller networks that is in widespread use and has near universal
support on routing hardware.
Multicast addressing is used to broadcast from one source to many destinations efficiently.
Protocol Independent Multicast (PIM) is the protocol commonly used in enterprises, multimedia
content delivery, and stock exchanges.
Fortinet Technologies Inc. Page 308 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Routing algorithm
Each protocol uses a slightly different algorithm for choosing the best route between two
addresses on the network. The algorithm is the intelligent part of a dynamic protocol because
the algorithm is responsible for deciding which route is best and should be added to the local
routing table. RIP and BGP use distance vector algorithms, where OSPF and IS-IS use
link-state or a shortest path first algorithm.
Vector algorithms are essentially based on the number of hops between the originator and the
destination in a route, possibly weighting hops based on how reliable, fast, and error-free they
are.
The link-state algorithm used by OSPF and IS-IS is called the Dijkstra algorithm. Link-state
treats each interface as a link, and records information about the state of the interface. The
Dijkstra algorithm creates trees to find the shortest paths to the routes it needs based on the
total cost of the parts of the routes in the tree.
For more information on the routing algorithm used, see Distance vector versus link-state
protocols on page 306.
Authentication
If an attacker gains access to your network, they can masquerade as a router on your network
to either gain information about your network or disrupt network traffic. If you have a high
quality firewall configured, it will help your network security and stop many of this type of threat.
However, the main method for protecting your routing information is to use authentication in
your routing protocol. Using authentication on your FortiGate unit and other routers prevents
access by attackers all routers must authenticate with passwords, such as MD5 hash
passwords, to ensure they are legitimate routers.
When configuring authentication on your network, ensure you configure it the same on all
devices on the network. Failure to do so will create errors and outages as those forgotten
devices fail to connect to the rest of the network.
For example, to configure an MD5 key of 123 on an OSPF interface called ospf_test, enter
the following CLI command:
config router ospf
config ospf-interface
edit ospf_test
set authentication md5
set md5-key 123
end
end
Convergence
Convergence is the ability of a networking protocol to re-route around network outages. Static
routing cannot do this. Dynamic routing protocols can all converge, but take various amounts of
time to do this. Slow convergence can cause problems such as network loops which degrade
network performance.
You may also hear robustness and redundancy used to describe networking protocols. In many
ways they are the same thing as convergence. Robustness is the ability to keep working even
though there are problems, including configuration problems as well as network outages.
Redundancy involves having duplicate parts that can continue to function in the event of some
malfunction, error, or outage. It is relatively easy to configure dynamic routing protocols to have
backup routers and configurations that will continue to function no matter the network problem
short of a total network failure.
Fortinet Technologies Inc. Page 309 FortiOS Handbook - Advanced Routing for FortiOS 5.0
IPv6 Support
IPv4 addressing is in common use everywhere around the world. IPv6 has much larger
addresses and it is used by many large companies and government departments. IPv6 is not as
common as IPv4 yet, but more companies are adopting it.
If your network uses IPv6, your dynamic routing protocol must support it. None of the dynamic
routing protocols originally supported IPv6, but they all have additions, expansions, or new
versions that do support IPv6. For more information, see RIP and IPv6 on page 320, BGP
and IPv6 on page 359, OSPFv3 and IPv6 on page 397, or Integrated IS-IS on page 444.
Budget
When making any business decision, the budget must always be considered. Static routing
does not involve special hardware, fancy software, or expensive training courses.
Dynamic routing can include all of these extra expenses. Any new hardware, such as routers
and switches, will need to support your chosen routing protocols. Network management
software and routing protocol drivers may be necessary as well to help configure and maintain
your more complex network. If the network administrators are not well versed in dynamic
routing, either a training course or some hands-on learning time must be budgeted so they can
administer the new network with confidence. Together, these factors can impact your budget.
Additionally, people will always account for network starting costs in the budgets, but usually
leave out the ongoing cost of network maintenance. Any budget must provide for the hours that
will be spent on updating the network routing equipment, and fixing any problems. Without that
money in the budget, you may end up back at static routing before you know it.
Fortinet Technologies Inc. Page 310 FortiOS Handbook - Advanced Routing for FortiOS 5.0
If you have 1000 computers, you definitely need to use dynamic routing no matter how many
locations you have.
Hopefully this section has given you an idea of what results you will likely experience from
different sized networks using different routing protocols. Your choice of which dynamic routing
protocol to use is partly determined by the network size, and topology.
Fortinet Technologies Inc. Page 311 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Choosing a routing protocol
One of that hardest decisions in routing can be choosing which routing protocol to use on your
network. It can be easy to decide when static routing will not meet your needs, but how can you
tell which dynamic routing protocol is best for your network and situation?
Here is a brief look at the routing protocols including their strongest and weakest points. The
steps to choosing your routing protocol are:
1. Answer questions about your network
2. Dynamic routing terminology
3. Evaluate your chosen protocol
4. Implement your dynamic routing protocol
Fortinet Technologies Inc. Page 312 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Evaluate your chosen protocol
Once you have examined the features of the routing protocols listed above and chosen the one
that best meets your needs, you can set up an evaluation or test install of that protocol.
The test install is generally set up in a sandbox configuration so it will not affect critical network
traffic. The aim of the test install is to prove that it will work on a larger scale on your network.
So be sure that the test install mirrors your larger network well enough for you to discover any
problems. If its too simplistic, these problems may not appear.
If your chosen protocol does not meet your goals choose a different protocol and repeat the
evaluation process until either a protocol meets your needs, or you change your criteria.
Dynamic routing is a complex subject. There are many routers on different networks and all can
be configured differently. It become even more complicated when you add to this each routing
protocol having slightly different names for similar features, and many configurable features for
each protocol.
To better understand dynamic routing, here are some explanations of common dynamic routing
terms.
Aggregated routes and addresses
Autonomous system (AS)
Area border router (ABR)
Neighbor routers
Route maps
Access lists
Bi-directional forwarding detection (BFD)
For more details on a term as it applies to a dynamic routing protocol, see one of Border
Gateway Protocol (BGP) on page 358, Routing Information Protocol (RIP) on page 319, or
Open Shortest Path First (OSPF) on page 396.
Fortinet Technologies Inc. Page 313 FortiOS Handbook - Advanced Routing for FortiOS 5.0
For information on aggregated routes in BGP, see ATOMIC_AGGREGATE on page 367, and
Aggregate routes and addresses on page 370.
As of January 2010, AS numbers are 4 bytes long instead of the former 2 bytes. RFC 4893
introduced 32-bit ASNs, which FortiGate units support for BGP and OSPF
Fortinet Technologies Inc. Page 314 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Do you need your own AS?
The main factors in deciding if you need your own AS or if you should be part of someone elses
are:
exchanging external routing information
many prefixes should exist in one AS as long as they use the same routing policy
when you use a different routing protocol than your border gateway peers (for example your
ISP uses BGP, and you use OSPF)
connected to multiple other AS (multi-homed)
You should not create an AS for each prefix on your network. Neither should you be forced into
an AS just so someone else can make AS-based policy decisions on your traffic.
There can be only one AS for any prefix on the Internet. This is to prevent routing issues.
LACNIC Latin America, including Mexico, Caribbean, Central and South America
RIPE NCC Europe, the Middle East, former USSR, and parts of Central Asia
AS numbers from 64512 to 65534 are reserved for private use. Private AS numbers can be used
for any internal networks with no outside connections to the Internet such as test networks,
classroom labs, or other internal-only networks that do not access the outside world. You can
also configure border routers to filter out any private ASNs before routing traffic to the outside
world. If you must use private ASNs with public networks, this is the only way to configure them.
However, it is risky because many other private networks could be using the same ASNs and
conflicts will happen. It would be very much like your local 192.168.0.0 network being made
public the resulting problems would be widespread.
In 1996, when RFC 1930 was written only 5,100 ASes had been allocated and a little under 600
ASes were actively routed in the global Internet. Since that time many more public ASNs have
been assigned, leaving only a small number. For this reason 32-bit ASNs (four-octet ASNs) were
defined to provide more public ASNs. RFC 4893 defines 32-bit ASNs, and FortiGate units
support these larger ASNs.
Fortinet Technologies Inc. Page 315 FortiOS Handbook - Advanced Routing for FortiOS 5.0
redistribute traffic between different ASes that are running different protocols, such as the edge
between an ISPs IS-IS routing network and a large companys OSPF network.
OSPF defines ABRs differently from other routers. In OSPF, an ABR is an OSPF router that
connects another AS to the backbone AS, and is a member of all the areas it connects to. An
OSPF ABR maintains a LSA database for each area that it is connected to. The concept of the
edge router is present, but its the edge of the backbone instead of the edge of the OSPF
supported ASes.
Neighbor routers
Routing involves routers communicating with each other. To do this, routers need to know
information about each other. These routers are called neighbor routers, and are configured in
each routing protocol. Each neighbor has custom settings since some routers may have
functionality others routers lack. Neighbour routers are sometimes called peers.
Generally neighbor routers must be configured, and discovered by the rest of the network
before they can be integrated to the routing calculations. This is a combination of the network
administrator configuring the new router with its neighbor router addresses, and the routing
network discovering the new router, such as the hello packets in OSPF. That discovery initiates
communication between the new router and the rest of the network.
Route maps
Route maps are a way for the FortiGate unit to evaluate optimum routes for forwarding packets
or suppressing the routing of packets to particular destinations. Compared to access lists, route
maps support enhanced packet-matching criteria. In addition, route maps can be configured to
permit or deny the addition of routes to the FortiGate unit routing table and make changes to
routing information dynamically as defined through route-map rules.
Route maps can be used for limiting both received route updates, and sent route updates. This
can include the redistribution of routes learned from other types of routing. For example if you
dont want to advertise local static routes to external networks, you could use a route map to
accomplish this.
The FortiGate unit compares the rules in a route map to the attributes of a route. The rules are
examined in ascending order until one or more of the rules in the route map are found to match
one or more of the route attributes.
As an administrator, route maps allow you to group a set of addresses together and assign them
a meaningful name. Then during your configuration, you can use these route-maps to speed up
configuration. The meaningful names ensure fewer mistakes during configuration as well.
The default rule in the route map (which the FortiGate unit applies last) denies all routes. For a
route map to take effect, it must be called by a FortiGate unit routing process.
The syntax for route maps are:
config router route-map
edit <route_map_name>
set comments
config rule
edit <route_map_rule_id>
set action
set match-*
set set-*
...
end
Fortinet Technologies Inc. Page 316 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The match-* commands allow you to match various parts of a route. The set-* commands
allow you to set routing information once a route is matched.
For an example of how route maps can be used to create receiving or sending groups in
routing, see Redistributing and blocking routes in BGP on page 389.
Access lists
Use this command to add, edit, or delete access lists. Access lists are filters used by FortiGate
unit routing processes. For an access list to take effect, it must be called by a FortiGate unit
routing process (for example, a process that supports RIP or OSPF). Use access-list6 for
IPv6 routing.
Access lists can be used to filter which updates are passed between routers, or which routes
are redistributed to different networks and routing protocols. You can create lists of rules that
will match all routes for a specific router or group of routers.
Each rule in an access list consists of a prefix (IP address and netmask), the action to take for
this prefix (permit or deny), and whether to match the prefix exactly or to match the prefix and
any more specific prefix.
If you are setting a prefix of 128.0.0.0, use the format 128.0.0.0/1. The default route, 0.0.0.0/0
can not be exactly matched with an access-list. A prefix-list must be used for this purpose.
The FortiGate unit attempts to match a packet against the rules in an access list starting at the
top of the list. If it finds a match for the prefix, it takes the action specified for that prefix. If no
match is found the default action is deny.
The syntax for access lists is:
config router access-list, access-list6
edit <access_list_name>
set comments
config rule
edit <access_list_id>
set action
set exact-match
set prefix
set prefix6
set wildcard
For an example of how access lists can be used to create receiving or sending groups in
routing, see Redistributing and blocking routes in BGP on page 389.
Fortinet Technologies Inc. Page 317 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The CLI commands associated with BFD include:
config router bgp
config neighbor
set bfd
Per-VDOM configuration:
config system settings
set bfd
set bfd-desired-min-tx
set bfd-required-min-rx
set bfd-detect-mult
set bfd-dont-enforce-src-port
Per-interface (override) configuration:
config system interface
edit <interface_name>
set bfd enable
set bfd-desired-min-tx
set bfd-detect-mult
set bfd-required-min-rx
For more information about BFD in BGP, see Bi-directional forwarding detection (BFD) on
page 374.
Unless otherwise stated, routing protocols apply to IPv4 addressing. This is the standard
address format used. However, IPv6 is becoming more popular and new versions of the
dynamic routing protocols have been introduced.
Dynamic routing supports IPv6 on your FortiGate unit. The new versions of these protocols and
the corresponding RFCs are:
RIP next generation (RIPng) RFC 2080 - Routing Information Protocol next generation
(RIPng). See RIP and IPv6 on page 320.
BGP4+ RFC 2545, and RFC 2858 Multiprotocol Extensions for IPv6 Inter-Domain
Routing, and Multiprotocol Extensions for BGP-4 (MP-BGP) respectively. See BGP and
IPv6 on page 359.
OSPFv3 RFC 2740 Open Shortest Path First version 3 (OSPFv3) for IPv6 support. See
OSPFv3 and IPv6 on page 397.
Integrated IS-IS RFC 5308 for IPv6 support. See Integrated IS-IS on page 444.
As with most advanced routing features on your FortiGate unit, IPv6 settings for dynamic
routing protocols must be enabled before they will be visible in the GUI. To enable IPv6
configuration in the GUI, enable it in System > Admin > Settings. Alternatively, you can directly
configure IPv6 for RIP, BGP, or OSPF protocols using CLI commands.
Fortinet Technologies Inc. Page 318 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Routing Information Protocol (RIP)
Background
Routing Information Protocol (RIP) is a distance-vector routing protocol intended for small,
relatively homogeneous networks. Its widespread use started when an early version of RIP was
included with BSD v4.3 Linux as the routed daemon. The routing algorithm used by RIP, the
BellmanFord algorithm, first saw widespread use as the initial routing algorithm of the
ARPANET.
RIP benefits include being well suited to smaller networks, is in widespread use, near universal
support on routing hardware, quick to configure, and works well if there are no redundant paths.
However, RIP updates are sent out node-by-node so it can be slow to find a path around
network outages. RIP also lacks good authentication, can not choose routes based on different
quality of service methods, and can create network loops if you are not careful.
The FortiGate implementation of RIP supports RIP version 1 (see RFC 1058), RIP version 2 (see
RFC 2453), and the IPv6 version RIPng (see RFC 2080).
RIP v1
In 1988 RIP version 1, defined in RFC 1058, was released. The RFC even states that RIP v1 is
based on Linux routed due to it being a defacto standard.
It uses classful addressing and uses broadcasting to send out updates to router neighbors.
There is no subnet information included in the routing updates in classful routing, and it does
not support CIDR addressing subnets must all be the same size. Also, route summarization is
not possible.
RIP v1 has no router authentication method, so it is vulnerable to attacks through packet
sniffing, and spoofing.
Page 319
RIP v2
In 1993, RIP version 2 was developed to deal with the limitations of RIP v1. It was not
standardized until 1998. This new version supports classless routing, and subnets of various
sizes.
Router authentication was added in RIP v2 it supports MD5. MD5 hashes are an older
encryption method, but this is much improved over no security at all.
In RIP v2 the hop count limit remained at 15 to be backwards compatible with RIP v1.
RIP v2 uses multicasting to send the entire routing table to router neighbors, thereby reducing
the traffic for devices that are not participating in RIP routing.
Routing tags were added as well, which allow internal routes or redistributed routes to be
identified as such.
RIPng
RIPng, defined in RFC 2080, is an extension of RIP2 designed to support IPv6. However, RIPng
varies from RIPv2 in that it is not fully backwards compatible with RIPv1.
RIPng does not support RIPv1 update authentication, it relies on IPsec
RIPng does not allow attaching tags to routes as in RIPv2
RIPng requires specific encoding of the next hop for a set of route entries, unlike RIPv2 that
encodes the next-hop into each route entry.
Fortinet Technologies Inc. Page 320 FortiOS Handbook - Advanced Routing for FortiOS 5.0
For example, you want to set up a tunnel on the port1 interface starting at 2002:C0A8:3201:: on
your local network and tunnel it to address 2002:A0A:A01:: where it will need access to an IPv4
network again. Use the following command:
config system ipv6-tunnel
edit test_tunnel
set destination 2002:A0A:A01::
set interface port1
set source 2002:C0A8:3201::
end
end
The Timeout period should be at least three times longer than the Update period. If the Update
timer is smaller than Timeout or Garbage timers, you will experience an error.
You can set the three RIP timers in Router > Dynamic > RIP, under Advanced Options, or use the
CLI.
Fortinet Technologies Inc. Page 321 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The CLI commands associated with garbage, timeout, and update timers include:
config router rip
set garbage-timer
set timeout-timer
set update-timer
end
Garbage timer
The garbage timer is the amount of time (in seconds) that the FortiGate unit will advertise a
route as being unreachable before deleting the route from the routing table. If this timer is
shorter, it will keep more up-to-date routes in the routing table and remove old ones faster. This
will result in a smaller routing table which is useful if you have a very large network, or if your
network changes frequently.
Update timer
The update timer determines the interval between routing updates. Generally, this value is set to
30 seconds. There is some randomness added to help prevent network traffic congestion,
which could result from all routers simultaneously attempting to update their neighbors. The
update timer should be at least three times smaller than the timeout timer, otherwise you will
experience an error.
If you are experiencing significant RIP traffic on your network, you can increase this interval to
send fewer updates per minute. However, ensure you increase the interval for all the routers on
your network or you will experience time outs that will degrade your network speed.
Timeout timer
The timeout timer is the maximum amount of time (in seconds) that a route is considered
reachable while no updates are received for the route. This is the maximum time the FortiGate
unit will keep a reachable route in the routing table while no updates for that route are received.
If the FortiGate unit receives an update for the route before the timeout period expires, the timer
is restarted. The timeout period should be at least three times longer than the depute period,
otherwise you will experience an error.
If you are experiencing problems with routers not responding in time to updates, increase this
timer. However, remember that longer timeout intervals result in longer overall update periods
it may be considerable time before the time the FortiGate unit is done waiting for all the timers
to expire on unresponsive routes.
Fortinet Technologies Inc. Page 322 FortiOS Handbook - Advanced Routing for FortiOS 5.0
This example shows how to configure a key-chain with two keys that are valid sequentially in
time. This example creates a key-chain called rip_key that has a password of fortinet. The
accepted and send lifetimes are both set to the same values a start time of 9:00am February
23, 2010 and an end time of 9:00am March 17, 2010. A second key is configured with a
password of my_fortigate that is valid from March 17, 2010 9:01am to April 1 2010 9:00am.
This rip_key keychain is then used on the port1 interface in RIP.
config router key-chain
edit "rip_key"
config key
edit 1
set accept-lifetime 09:00:00 23 02 2010 09:00:00 17 03 2010
set key-string "fortinet"
set send-lifetime 09:00:00 23 02 2010 09:00:00 17 03 2010
next
edit 2
set accept-lifetime 09:01:00 17 03 2010 09:00:00 1 04 2010
set key-string "my_fortigate"
set send-lifetime 09:01:00 17 03 2010 09:00:00 1 04 2010
next
end
end
config router rip
config interface
edit port1
set auth-keychain rip_key
end
end
Access Lists
Access lists are filters used by FortiGate unit RIP and OSPF routing. An access list provides a
list of IP addresses and the action to take for them essentially an access list makes it easy to
group addresses that will be treated the same into the same group, independent of their
subnets or other matching qualities. You add a rule for each address or subnet that you want to
include, specifying the action to take for it. For example if you wanted all traffic from one
department to be routed a particular way, even in different buildings, you can add all the
addresses to an access list and then handle that list all at once.
Fortinet Technologies Inc. Page 323 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Each rule in an access list consists of a prefix (IP address and netmask), the action to take for
this prefix (permit or deny), and whether to match the prefix exactly or to match the prefix and
any more specific prefix.
The FortiGate unit attempts to match a packet against the rules in an access list starting at the
top of the list. If it finds a match for the prefix, it takes the action specified for that prefix. If no
match is found the default action is deny.
Access lists greatly speed up configuration and network management. When there is a problem,
you can check each list instead of individual addresses. Also its easier to troubleshoot since if
all addresses on one list have problems, it eliminates many possible causes right away.
If you are using the RIPng or OSPF+ IPv6 protocols you will need to use access-list6, the IPv6
version of access list. The only difference is that access-list6 uses IPv6 addresses.
For example, if you want to create an access list called test_list that only allows an exact
match of 10.10.10.10 and 11.11.11.11, enter the command:
config router access-list
edit test_list
config rule
edit 1
set prefix 10.10.10.10 255.255.255.255
set action allow
set exact-match enable
next
edit 2
set prefix 11.11.11.11 255.255.255.255
set action allow
set exact-match enable
end
end
Another example is if you want to deny ranges of addresses in IPv6 that start with the IPv6
equivalents of 10.10.10.10 and 11.11.11.11, enter the command access-list6 as follows:
config router access-list6
edit test_list_ip6
config rule
edit 1
set prefix6 2002:A0A:A0A:0:0:0:0:0:/48
set action deny
next
edit 2
set prefix6 2002:B0B:B0B:0:0:0:0:0/48
set action deny
end
end
To use an access_list, you must call it from a routing protocol such as RIP. The following
example uses the access_list from the earlier example called test_list to match routes coming in
Fortinet Technologies Inc. Page 324 FortiOS Handbook - Advanced Routing for FortiOS 5.0
on the port1 interface. When there is a match, it will add 3 to the hop count metric for those
routes to artificially increase . Enter the following command:
config router rip
config offset-list
edit 5
set access-list test_list
set direction in
set interface port1
set offset 3
set status enable
end
If you are setting a prefix of 128.0.0.0, use the format 128.0.0.0/1. The default route, 0.0.0.0/0
can not be exactly matched with an access-list. A prefix-list must be used for this purpose
Fortinet Technologies Inc. Page 325 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Overall, RIP is a large step forward when compared to static routing.
Fortinet Technologies Inc. Page 326 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Figure 100:RIP algorithm example in 4 steps
Step 1 Router4
Router1
Step 2 Router4
Router1
Step 3 Router4
Step 4 Router4
The good part about the Bellman-Ford algorithm in RIP is that the router only uses the
information it needs from the update. If there are no newer, better routes than the ones the
router already has in its routing table, there is no need to change its routing table. And no
change means no additional update, so less traffic. But even when there is update traffic, the
RIP packets are very small so it takes many updates to affect overall network bandwidth. For
more information about RIP packets, see RIP packet structure on page 329.
Fortinet Technologies Inc. Page 327 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The main disadvantage of the BellmanFord algorithm in RIP is that it doesnt take weightings
into consideration. While it is possible to assign different weights to routes in RIP, doing so
severely limits the effective network size by reducing the hop count limit. Also other dynamic
routing protocols can take route qualities, such as reliability or delay, into consideration to
provide not only the physically shortest but also the fastest or more reliable routes as you
choose.
Another disadvantage of the Bellman-Ford algorithm is due to the slow updates passed from
one RIP router to the next. This results in a slow response to changes in the network topology,
which in turn results in more attempts to use routes that are down, which wastes time and
network resources.
Fortinet Technologies Inc. Page 328 FortiOS Handbook - Advanced Routing for FortiOS 5.0
RIP packet structure
It is hard to fully understand a routing protocol without knowing what information is carried in its
packets. Knowing what information is exchanged between routers and how will help you better
understand the RIP protocol, and better configure your network for it.
This section provides information on the contents of RIP 1 and RIP 2 packets.
RIP version 1
RIP version 1, or RIP IP packets are 24 bytes in length, with some empty areas left for future
expansion.
Table 10: RIP IP packets
1-byte command 1-byte version 2-byte zero 2-byte AFI 2-byte zero
field field
RIP version 2
RIP version 2 has more features than RIP 1, which is reflected in its packets which carry more
information. All but one of the empty zero fields in RIP 1 packets are used in RIP 2.
Table 11: RIP 2 packets
Fortinet Technologies Inc. Page 329 FortiOS Handbook - Advanced Routing for FortiOS 5.0
A RIP 2 packet contains fields described above in RIP 1, as well as the following:
Unused Has a value set to zero, and is intended for future use
Route tag Provides a method for distinguishing between internal routes learned by RIP
and external routes learned from other protocols.
Subnet mask Contains the subnet mask for the entry. If this field is zero, no subnet mask
has been specified for the entry.
Next hop Indicates the IP address of the next hop to which packets for the entry should
be forwarded.
Troubleshooting RIP
This section is about troubleshooting RIP. For general troubleshooting information, see the
Troubleshooting chapter.
This section includes:
Routing Loops
Holddowns and Triggers for updates
Split horizon and Poison reverse updates
Debugging IPv6 on RIPng
Routing Loops
Normally in routing, a path between two addresses is chosen and traffic is routed along that
path from one address to the other. When there is a routing loop, that normal path doubles back
on itself creating a loop. When there are loops, the network has problems getting information to
its destination and also prevents it from returning to the source to report the inaccessible
destination.
A routing loop happens when a normally functioning network has an outage, and one or more
routers are offline. When packets encounter this, an alternate route is attempted to maneuver
around the outage. During this phase it is possible for a route to be attempted that involves
going back a hop, and trying a different hop forward. If that hop forward is blocked by the
outage as well, a hop back and possibly the original hop forward may be selected. You can see
if this continues, how it can consume not only network bandwidth but also many resources on
those routers affected. The worst part is this situation will continue until the network
administrator changes the router settings, or the downed routers come back online.
Fortinet Technologies Inc. Page 330 FortiOS Handbook - Advanced Routing for FortiOS 5.0
If you arent running SNMP, dead gateway detection, or you have non-Fortinet routers in your
network, you can use networking tools such as ping and traceroute to define the outage on your
network and begin to fix it. Ping, traceroute, and other basic troubleshooting tools are largely
the same between static and dynamic, and are covered in Troubleshooting static routing on
page 281.
Enable Query Select. The Port should be 161. Ensure that your security
policies allow ports 161 and 162 (SNMP queries and traps) to
pass.
SNMP v1/v2
Fortinet Technologies Inc. Page 331 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Queries Enable v1 and/or v2 as needed. The Port should be 161.
Ensure that your security policies allow port 161 to pass.
4. Select the events for which you want notification. For routing loops this should include CPU
usage is high, Memory is low, and possibly Log disk space is low.If there are problems the
log will be filling up quickly, and the FortiGate units resources will be overused.
5. Configure SNMP host (manager) software on your administration computer. This will monitor
the SNMP information sent out by the FortiGate unit. Typically you can configure this
software to alert you to outages or CPU spikes that may indicate a routing loop.
To detect possible routing loops with dead gateway detection and e-mail alerts
1. To configure dead gateway detection, go to Router > Static > Settings and select
Create New.
2. Enter the Ping Server IP address and select the Interface that connects to it.
3. Set the Ping Interval (how often to send a ping), and Failover Threshold (how many lost pings
is considered a failure). A smaller interval and smaller number of lost pings will result in faster
detection, but will create more traffic on your network.
If you have VDOMs configured, you will have to enter the basic SMTP server information in the
Global section, and the rest of the configuration within the VDOM that includes this interface.
After this configuration, when this interface on the FortiGate unit cannot connect to the next
router, the FortiGate unit will bring down the interface and alert you with an email about the
outage.
Fortinet Technologies Inc. Page 332 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Ideally if you debug the flow of the packets, and record the routes that are unreachable, you can
create an accurate picture of the network outage.
Holddown Timers
The holddown timer activates when a route is marked down. Until the timer expires, the router
does not accept any new information about that route. This is very useful if you have a flapping
route because it will prevent your router from sending out updates and being part of the
problem in flooding the network. The potential down side is if the route comes back up while the
timer has not expired, that route will be unavailable for that period of time. This is only a problem
if this is a major route used by the majority of your traffic. Otherwise, this is a minor problem as
traffic can be re-routed around the outage.
Triggers
Triggered RIP is an alternate update structure that is based around limiting updates to only
specific circumstances. The most basic difference is that the routing table will only be updated
when a specific request is sent to update, as opposed to every time the routing table changes.
Updates are also triggered when a unit is powered on, which can include addition of new
interfaces or devices to the routing structure, or devices returning to being available after being
unreachable.
Fortinet Technologies Inc. Page 333 FortiOS Handbook - Advanced Routing for FortiOS 5.0
route to the destination. This poisoned route is marked as unreachable for routers that cannot
use it. In RIP this means that route is marked with a distance of 16.
This is an example of a typical medium sized network configuration using RIP routing.
Your company has 3 small local networks, one for each department. These networks are
connected by RIP, and then connected to the Internet. Each subnet has more than one route, for
redundancy. There are two central routers that are both connected to the internet, and to the
other networks. If one of those routers goes down, the whole network can continue to function
normally.
The ISP is running RIP, so no importing or exporting routes is required on the side of the
network. However, since the internal networks have static networking running those will need to
be redistributed through the RIP network.
To keep the example simple, there will be no authentication of router traffic.
With RIP properly configured, if the device fails or temporarily goes offline, the routes will
change and traffic will continue to flow. RIP is good for a smaller network due to its lack of
complex configurations.
This section includes the following topics:
Network layout and assumptions
General configuration steps
Configuring the FortiGate units system information
Configuring other networking devices
Testing network configuration
Fortinet Technologies Inc. Page 334 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Network layout and assumptions
Fortinet Technologies Inc. Page 335 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Figure 101:Network topology for the simple RIP example
ISP router
(172.20.120.5)
RIP Router2
uter2
RIP Router4
RIP Router1
uter1
R&D Network
Accounting
Network
RIP Router3
RI
Sales Network
Assumptions
The following assumptions have been made concerning this example.
All FortiGate units have 5.0 firmware, and are running factory default settings.
All CLI and web-based manager navigation assumes the unit is running in NAT/Route
operating mode, with VDOMs disabled.
All FortiGate units have interfaces labelled port1 through port4 as required.
All firewalls have been configured for each FortiGate unit to allow the required traffic to flow
across interfaces.
Only FortiGate units are running RIP on the internal networks.
Router2 and Router3 are connected through the internal network for R&D.
Router2 and Router3 each have their own connection to the Internet, indicated in black in
Figure 101.
Fortinet Technologies Inc. Page 336 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Router2 and Router3 have dead gateway detection enabled on the ISP interfaces using Ping.
Remember to contact the ISP and confirm their server has ping enabled.
Gateway 172.20.120.5/255.255.255.0
Distance 40
Gateway 172.20.120.5/255.255.255.0
Distance 40
Alias internal
IP/Netmask 10.11.101.101/255.255.255.0
Administrative Up
Status
Alias router2
IP/Netmask 10.11.201.101/255.255.255.0
Fortinet Technologies Inc. Page 337 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Description Link to R&D network & internet through Router2
Administrative Up
Status
Alias router3
IP/Netmask 10.11.202.101/255.255.255.0
Administrative Up
Status
Fortinet Technologies Inc. Page 338 FortiOS Handbook - Advanced Routing for FortiOS 5.0
config router static
edit 1
set device "port2"
set distance 45
set gateway 10.11.201.102
next
edit 2
set device port3
set distance 45
set gateway 10.11.202.103
end
end
Gateway 172.20.120.5/255.255.255.0
Distance 5
Fortinet Technologies Inc. Page 339 FortiOS Handbook - Advanced Routing for FortiOS 5.0
5. Go to System > Network > Interfaces.
6. Edit port1 (internal) interface.
7. Set the following information, and select OK.
Alias internal
IP/Netmask 10.12.101.102/255.255.255.0
Administrative Status Up
Alias router1
IP/Netmask 10.12.201.102/255.255.255.0
Administrative Status Up
Alias router4
IP/Netmask 10.12.301.102/255.255.255.0
Administrative Status Up
Alias ISP
IP/Netmask 172.20.120.102/255.255.255.0
Fortinet Technologies Inc. Page 340 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Detect Interface Status for enable
Gateway Load Balancing
Administrative Status Up
Fortinet Technologies Inc. Page 341 FortiOS Handbook - Advanced Routing for FortiOS 5.0
4. Edit the default route and enter the following information:
Gateway 172.20.120.5/255.255.255.0
Distance 5
Alias internal
IP/Netmask 10.12.101.103/255.255.255.0
Administrative Status Up
Alias router1
IP/Netmask 10.13.201.103/255.255.255.0
Administrative Status Up
Alias router4
IP/Netmask 10.13.301.103/255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 342 FortiOS Handbook - Advanced Routing for FortiOS 5.0
13.Set the following information, and select OK.
Alias ISP
IP/Netmask 172.20.120.103/255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 343 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure Router3 system information - CLI
config system global
set hostname Router3
end
Fortinet Technologies Inc. Page 344 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Gateway 172.20.120.5/255.255.255.0
Distance 40
Gateway 172.20.120.5/255.255.255.0
Distance 40
Alias internal
IP/Netmask 10.14.101.104/255.255.255.0
Administrative Status Up
Alias router2
IP/Netmask 10.14.201.104/255.255.255.0
Administrative Status Up
Alias router3
IP/Netmask 10.14.301.104/255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 345 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure Router4 system information - CLI
config system global
set hostname Router4
end
Fortinet Technologies Inc. Page 346 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Router1 and Router4 are configured the same. Router2 and Router3 are configured the same.
These routers will be grouped accordingly for the following procedures repeat the
procedures once for each FortiGate unit.
Authentication None
7. For interface, select Create New and set the following information.
Authentication None
8. For interface, select Create New and set the following information.
Authentication None
Fortinet Technologies Inc. Page 347 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Configure RIP settings on Router1 and Router4 - CLI
config router rip
set version 2
config interface
edit "port1"
set receive-version 1 2
set send-version 1 2
next
edit "port2"
set receive-version 1 2
set send-version 1 2
next
edit "port3"
set receive-version 1 2
set send-version 1 2
end
config network
edit 1
set prefix 10.11.0.0 255.255.0.0
next
edit 2
set prefix 10.12.0.0 255.255.0.0
next
edit 3
set prefix 10.14.0.0 255.255.0.0
next
edit 4
set prefix 172.20.120.0 255.255.255.0
end
config redistribute "static"
set status enable
end
end
Fortinet Technologies Inc. Page 348 FortiOS Handbook - Advanced Routing for FortiOS 5.0
6. For interface, select Create New and set the following information.
Authentication None
7. For interface, select Create New and set the following information.
Authentication None
8. For interface, select Create New and set the following information.
Authentication None
9. For interface, select Create New and set the following information.
Authentication None
Fortinet Technologies Inc. Page 349 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Configure RIP settings on Router2 and Router3- web-based manager
config router rip
set version 2
config interface
edit "port1"
set receive-version 1 2
set send-version 1 2
next
edit "port2"
set receive-version 1 2
set send-version 1 2
next
edit "port3"
set receive-version 1 2
set send-version 1 2
end
edit "port4"
set receive-version 1 2
set send-version 1 2
end
config network
edit 1
set prefix 10.11.0.0 255.255.0.0
next
edit 2
set prefix 10.12.0.0 255.255.0.0
next
edit 3
set prefix 10.14.0.0 255.255.0.0
next
edit 4
set prefix 172.20.120.0 255.255.255.0
end
config redistribute "static"
set status enable
end
end
Fortinet Technologies Inc. Page 350 FortiOS Handbook - Advanced Routing for FortiOS 5.0
network such as the IP addresses of the connecting RIP routers, what version of RIP your
network supports, and what authentication (if any) is used.
RIP next generation, or RIPng, is the version of RIP that supports IPv6.
This is an example of a typical small network configuration using RIPng routing.
Your internal R&D network is working on a project for a large international telecom company
that uses IPv6. For this reason, you have to run IPv6 on your internal network and you have
decided to use only IPv6 addresses.
Your network has two FortiGate units running the RIPng dynamic routing protocol. Both
FortiGate units are connected to the ISP router and the internal network. This configuration
provides some redundancy for the R&D internal network enabling it to reach the internet at all
times.
This section includes the following topics:
Network layout and assumptions
Configuring the FortiGate units system information
Configuring RIPng on FortiGate units
Configuring other networking devices
Testing network configuration
Fortinet Technologies Inc. Page 351 FortiOS Handbook - Advanced Routing for FortiOS 5.0
In this example the routers, networks, interfaces used, and IP addresses are as follows.
Table 13: Rip example network topology
ISP router
(2002:AC14:7805::)
RIP Router1
r1 RIP Router2
R
R&D Internal
Network
Assumptions
The following assumptions have been made concerning this example.
All FortiGate units have 5.0 firmware, and are running factory default settings.
All CLI and web-based manager navigation assumes the unit is running in NAT/Route
operating mode, with VDOMs disabled.
All FortiGate units have interfaces labelled port1 and port2 as required.
All firewalls have been configured for each FortiGate unit to allow the required traffic to flow
across interfaces.
All network devices are support IPv6 and are running RIPng.
Fortinet Technologies Inc. Page 352 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure system information on Router1 - web-based manager
1. Go to System > Dashboard > Status.
2. For Host name, select Change.
3. Enter Router1.
4. Go to System > Admin > Settings.
5. In Display Options on GUI, enable IPv6, and select Apply.
6. Go to System > Network > Interfaces.
7. Edit port1 (internal) interface.
8. Set the following information, and select OK.
Alias internal
IP/Netmask 2002:A0B:6565::/0
Administrative Status Up
Alias ISP
IP/Netmask 2002:AC14:7865::/0
Administrative Status Up
Fortinet Technologies Inc. Page 353 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure system information on Router1 - CLI
config system global
set hostname Router1
set gui-ipv6 enable
end
config system interface
edit port1
set alias internal
set allowaccess https ping ssh
set description Internal RnD network
config ipv6
set ip6-address 2002:a0b:6565::/0
end
next
edit port2
set alias ISP
set allowaccess https ping ssh
set description ISP and internet
config ipv6
set ip6-address 2002:AC14:7865::
end
end
Alias internal
IP/Netmask 2002:A0B:6566::/0
Administrative Status Up
Alias ISP
IP/Netmask 2002:AC14:7866::/0
Fortinet Technologies Inc. Page 354 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Administrative Access HTTPS SSH PING
Administrative Status Up
Fortinet Technologies Inc. Page 355 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure RIPng on Router1 - CLI
config router ripng
config interface
edit port1
next
edit port2
end
config neighbor
edit 1
set interface port1
set ipv6 2002:a0b:6566::/0
next
edit 2
set interface port2
set ipv6 2002:AC14:7805::/0
end
Fortinet Technologies Inc. Page 356 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Testing the IPv6 RIPng information
There are some commands to use when checking that your RIPng information is correct on your
network. These are useful to check on your RIPng FortiGate units on your network. Comparing
the output between devices will help you understand your network better, and also track down
any problems.
diagnose ipv6 address list
View the local scope IPv6 addresses used as next-hops by RIPng on the FortiGate unit.
diagnose ipv6 route list
View ipv6 addresses that are installed in the routing table.
get router info6 routing-table
View the routing table. This information is almost the same as the previous command
(diagnose ipv6 route list) however it is presented in an easier to read format.
get router info6 rip interface external
View brief output on the RIP information for the interface listed. The information includes if
the interface is up or down, what routing protocol is being used, and whether passive
interface or split horizon are enabled.
get router info6 neighbor-cache list
View the IPv6/MAC address mapping. This also displays the interface index and name
associated with the address.
Fortinet Technologies Inc. Page 357 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Border Gateway Protocol (BGP)
The border gateway protocol contains two distinct subsets internal BGP (iBGP) and external
BGP (eBGP). iBGP is intended for use within your own networks. eBGP is used to connect
many different networks together, and is the main routing protocol for the Internet backbone.
FortiGate units support iBGP, and eBGP only for communities.
The following topics are included in this section:
Background
Parts and terminology of BGP
How BGP works
Background
BGP was first used in 1989. The current version, BGP-4, was released in 1995 and is defined in
RFC 1771. That RFC has since been replaced by the more recent RFC 4271. The main benefits
of BGP-4 are classless inter-domain routing, and aggregate routes. BGP is the only routing
protocol to use TCP for a transport protocol. Other routing protocols use UDP.
BGP makes routing decisions based on path, network policies and rulesets instead of the
hop-count metric as RIP does, or cost-factor metrics as OSPF does.
BGP-4+ supports IPv6. It was introduced in RFC 2858 and RFC 2545.
BGP is the routing protocol used on the Internet. It was designed to replace the old Exterior
Gateway Protocol (EGP) which had been around since 1982, and was very limited. In doing so,
BGP enabled more networks to take part in the Internet backbone to effectively decentralize it
and make the Internet more robust, and less dependent on a single ISP or backbone network.
Page 358
BGP and IPv6
FortiGate units support IPv6 over BGP using the same config router bgp command as
IPv4, but different subcommands.
The main CLI keywords have IPv6 equivalents that are identified by the 6 on the end of the
keyword, such as with config network6 or set allowas-in6. For more information about
IPv6 BGP keywords, see the FortiGate CLI Reference.
IPv6 BGP commands include:
config router bgp
set activate6 {enable | disable}
set allowas-in6 <max_num_AS_integer>
set allowas-in-enable6 {enable | disable}
set as-override6 {enable | disable}
set attribute-unchanged6 [as-path] [med] [next-hop]
set capability-default-originate6 {enable | disable}
set capability-graceful-restart6 {enable | disable}
set capability-orf6 {both | none | receive | send}
set default-originate-route-map6 <routemap_str>
set distribute-list-in6 <access-list-name_str>
set distribute-list-out6 <access-list-name_str>
set filter-list-in6 <aspath-list-name_str>
set filter-list-out6 <aspath-list-name_str>
set maximum-prefix6 <prefix_integer>
set maximum-prefix-threshold6 <percentage_integer>
set maximum-prefix-warning-only6 {enable | disable}
set next-hop-self6 {enable | disable}
set prefix-list-in6 <prefix-list-name_str>
set prefix-list-out6 <prefix-list-name_str>
set remove-private-as6 {enable | disable}
set route-map-in6 <routemap-name_str>
set route-map-out6 <routemap-name_str>
set route-reflector-client6 {enable | disable}
set route-server-client6 {enable | disable}
set send-community6 {both | disable | extended | standard}
set soft-reconfiguration6 {enable | disable}
set unsuppress-map6 <route-map-name_str>
config network6
config redistribute6
end
Fortinet Technologies Inc. Page 359 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Speaker routers
Any router configured for BGP is considered a BGP speaker. This means that a speaker router
advertises BGP routes to its peers.
Any routers on the network that are not speaker routers, are not treated as BGP routers.
der Router
Router A
Fortinet Technologies Inc. Page 360 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The BGP commands related to neighbors are quite extensive and include:
config router bgp
config neighbor
edit <neighbor_address_ipv4>
set activate {enable | disable}
set advertisement-interval <seconds_integer>
set allowas-in <max_num_AS_integer>
set allowas-in-enable {enable | disable}
set as-override {enable | disable}
set attribute-unchanged [as-path] [med] [next-hop]
set bfd {enable | disable}
set capability-default-originate {enable | disable}
set capability-dynamic {enable | disable}
set capability-graceful-restart {enable | disable}
set capability-orf {both | none | receive | send}
set capability-route-refresh {enable | disable}
set connect-timer <seconds_integer>
set description <text_str>
set distribute-list-in <access-list-name_str>
set distribute-list-out <access-list-name_str>
set dont-capability-negotiate {enable | disable}
set ebgp-enforce-multihop {enable | disable}
set ebgp-multihop {enable | disable}
set ebgp-multihop-ttl <seconds_integer>
set filter-list-in <aspath-list-name_str>
set filter-list-out <aspath-list-name_str>
set holdtime-timer <seconds_integer>
set interface <interface-name_str>
set keep-alive-timer <seconds_integer>
set maximum-prefix <prefix_integer>
set maximum-prefix-threshold <percentage_integer>
set maximum-prefix-warning-only {enable | disable}
set next-hop-self {enable | disable}
set passive {enable | disable}
set password <string>
set prefix-list-in <prefix-list-name_str>
set prefix-list-out <prefix-list-name_str>
set remote-as <id_integer>
set remove-private-as {enable | disable}
set retain-stale-time <seconds_integer>
set route-map-in <routemap-name_str>
set route-map-out <routemap-name_str>
set route-reflector-client {enable | disable}
set route-server-client {enable | disable}
set send-community {both | disable | extended | standard}
set shutdown {enable | disable}
set soft-reconfiguration {enable | disable}
set strict-capability-match {enable | disable}
Fortinet Technologies Inc. Page 361 FortiOS Handbook - Advanced Routing for FortiOS 5.0
set unsuppress-map <route-map-name_str>
set update-source <interface-name_str>
set weight <weight_integer>
end
end
end
Fortinet Technologies Inc. Page 362 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Figure 104:Required sessions within an AS with and without route reflectors
RR
RR
Cluster2
Cluster1
Confederations
Confederations were introduced to reduce the number of BGP advertisements on a segment of
the network, and reduce the size of the routing tables. Confederations essentially break up an
AS into smaller units. Confederations are defined in RFC 3065 and RFC 1965.
Within a confederation, all routers communicate with each other in a full mesh arrangement.
Communications between confederations is more like inter-AS communications in that many of
the attributes are changed as they would be for BGP communications leaving the AS, or eBGP.
Confederations are useful when merging ASs. Each AS being merged can easily become a
confederation, requiring few changes. Any additional permanent changes can then be
implemented over time as required. The figure below shows the group of ASs before merging,
and the corresponding confederations afterward as part of the single AS with the addition of a
new border router. It should be noted that after merging if the border router becomes a route
reflector, then each confederation only needs to communicate with one other router, instead of
five others.
Fortinet Technologies Inc. Page 363 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Figure 105:AS merging using confederations
AS 1
Confed1
Confed1
AS
AS 1 1 (was AS1)
(was AS1) Confed2
AS 2 (was AS2)
rder Router
Border Routter
Border
B d R Router
t
Confed5 Confed3
AS 3 (was AS5) (was AS3)
AS 5 Confed4
AS 4 (was AS4)
Confederations and route reflectors perform similar functions they both sub-divide large
ASes for more efficient operation. They differ in that route reflector clusters can include routers
that are not members of a cluster, where routers in a confederation must belong to that
confederation. Also, confederations place their confederation numbers in the AS_PATH attribute
making it easier to trace.
It is important to note that while confederations essentially create sub-ASs, all the
confederations within an AS appear as a single AS to external ASs.
Confederation related BGP commands include:
config router bgp
set confederation-identifier <peerid_integer>
end
BGP attributes
Each route in a BGP network has a set of attributes associated with it. These attributes define
the route, and are modified as required along the route.
BGP can work well with mostly default settings, but if you are going to change settings you
need to understand the roles of each attribute and how they affect those settings.
The BGP attributes include:
MULTI_EXIT_DESC (MED) Which router to use to exit an AS with more than one
external connection. See MULTI_EXIT_DESC (MED) on
page 366.
Fortinet Technologies Inc. Page 364 FortiOS Handbook - Advanced Routing for FortiOS 5.0
COMMUNITY Used to apply attributes to a group of routes. See
COMMUNITY on page 366.
Inbound policies on FortiGate units can change the NEXT-HOP,LOCAL-PREF, MED and
AS-PATH attributes of an internal BGP (iBGP) route for its local route selection purposes.
However, outbound policies on the unit cannot affect these attributes.
AS_PATH
AS_PATH is the BGP attribute that keeps track of each AS a route advertisement has passed
through. AS_PATH is used by confederations and by exterior BGP (EBGP) to help prevent
routing loops. A router knows there is a loop if it receives an AS_PATH with that routers AS in it.
The figure below shows the route between router A and router B. The AS_PATH from A to B
would read 701,702,703 for each AS the route passes through.
As of the start of 2010, the industry upgraded from 2-byte to 4-byte AS_PATHs. This upgrade
was due to the imminent exhaustion of 2-byte AS_PATH numbers. FortiOS supports 4-byte
AS_PATHs in its BGP implementation.
A
B
Network AS701
Network AS703
3 1
2
Fortinet Technologies Inc. Page 365 FortiOS Handbook - Advanced Routing for FortiOS 5.0
MULTI_EXIT_DESC (MED)
BGP AS systems can have one or more routers that connect them to other ASes. For ASes with
more than one connecting router, the Multi-Exit Discriminator (MED) lists which router is best to
use when leaving the AS. The MED is based on attributes such as delay. It is a recommendation
only, as some networks may have different priorities.
BGP updates advertise the best path to a destination network. When the FortiGate unit receives
a BGP update, the FortiGate unit examines the Multi-Exit Discriminator (MED) attribute of
potential routes to determine the best path to a destination network before recording the path in
the local FortiGate unit routing table.
FortiGate units have the option to treat any routes without an MED attribute as the worst
possible routing choice. This can be useful because a lack of MED information is a lack of
routing information which can be suspicious possibly a hacking attempt or an attack on the
network. At best it signifies an unreliable route to select.
The BGP commands related to MED include:
config router bgp
set always-compare-med {enable | disable}
set bestpath-med-confed {enable | disable}
set bestpath-med-missing-as-worst {enable | disable}
set deterministic-med {enable | disable}
config neighbor
set attribute-unchanged [as-path] [med] [next-hop]
end
end
COMMUNITY
A community is a group of routes that have the same routing policies applied to them. This
saves time and resources. A community is defined by the COMMUNITY attribute of a BGP
route.
The FortiGate unit can set the COMMUNITY attribute of a route to assign the route to
predefined paths (see RFC 1997). The FortiGate unit can examine the COMMUNITY attribute of
learned routes to perform local filtering and/or redistribution.
The BGP commands related to COMMUNITY include:
config router bgp
set send-community {both | disable | extended | standard}
end
NEXT_HOP
The NEXT_HOP attribute says what IP address the packets should be forwarded to next. Each
time the route is advertised, this value is updated. The NEXT_HOP attribute is much like a
gateway in static routing.
FortiGate units allow you to to change the advertising of the FortiGate units IP address (instead
of the neighbors IP address) in the NEXT_HOP information that is sent to IBGP peers. This is
changed with the config neighbor, set next-hop-self command.
Fortinet Technologies Inc. Page 366 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The BGP commands related to NEXT_HOP include:
config router bgp
config neighbor
set attribute-unchanged [as-path] [med] [next-hop]
set next-hop-self {enable | disable}
end
end
ATOMIC_AGGREGATE
The ATOMIC_AGGREGATE attribute is used when routes have been summarized. It indicates
which AS and which router summarize the routes. It also tells downstream routers not to
de-aggregate the route. Summarized routes are routes with similar information that have been
combined, or aggregated, into one route that is easier to send in updates. When it reaches its
destination, the summarized routes are split back up into the individual routes.
Your FortiGate unit doesnt specifically set this attribute in the BGP router command, but it is
used in the route map command.
The commands related to ATOMIC_AGGREGATE include:
config router route-map
edit <route_map_name>
config rule
edit <route_map_rule_id>
set set-aggregator-as <id_integer>
set set-aggregator-ip <address_ipv4>
set set-atomic-aggregate {enable | disable}
end
end
end
ORIGIN
The ORIGIN attribute records where the route came from. The options can be IBGP, EBGP, or
incomplete. This information is important because internal routes (IBGP) are by default higher
priority than external routes (EBGP). However incomplete ORIGINs are the lowest priority of the
three.
The commands related to ORIGIN include:
config router route-map
edit <route_map_name>
set comments <string>
config rule
edit <route_map_rule_id>
set match-origin {egp | igp | incomplete | none}
end
end
end
Fortinet Technologies Inc. Page 367 FortiOS Handbook - Advanced Routing for FortiOS 5.0
been defined as neighbors. BGP routers listen for updates from these configured neighboring
routers on TCP port 179.
A BGP router is a finite state machine with six various states for each connection. As two BGP
routers discover each other, and establish a connection they go from the idle state, through the
various states until they reach the established state. An error can cause the connection to be
dropped and the state of the router to be reset to either active or idle. These errors can be
caused by: TCP port 179 not being open, a random TCP port above port 1023 not being open,
the peer address being incorrect, or the AS number being incorrect.
When BGP routers start a connection, they negotiate which (if any) optional features will be
used such as multiprotocol extensions that can include IPv6 and VPNs.
Fortinet Technologies Inc. Page 368 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Figure 107:Three phases of BGP routing decision
Adj-RIB-IN
(new routes)
Calculate:
iBGP or eBGP?
Phase 1 - Calculate route
local route policies preferences on incoming
LOCAL_PREF routes.
3 9
Adj-RIB-IN
(with route 11 6
preferences) 2 5
22
Phase 2 - Install the best
3 routes into the local
Loc-RIB
(with new 5 6 routing RIB
routes)
9
11
Adj-RIB-OUT
(with routes
to send)
Routes
sent in update
Decision phase 1
At this phase, the decision is to calculate how preferred each route and its NRLI are the
Adjacent Routing Information Base Incoming (Adj-RIBs-In) compared to the other routes. For
internal routes (IBGP), policy information or LOCAL_PREF is used. For external peer learned
routes, it is based strictly on policy. These rules set up a list of which routes are most preferred
going into Phase 2.
Decision phase 2
Phase 2 involves installing the best route to each destination into the local Routing Information
Base (Loc-RIB). Effectively, the Loc-RIB is the master routing table. Each route from Phase 1
has their NEXT_HOP checked to ensure the destination is reachable. If it is reachable, the
Fortinet Technologies Inc. Page 369 FortiOS Handbook - Advanced Routing for FortiOS 5.0
AS_PATH is checked for loops. After that, routes are installed based on the following decision
process:
If there is only one route to a location, it is installed.
If multiple routes to the same location, use the most preferred route from Level 1.
If there is a tie, break the tie based on the following in descending order of importance:
shortest AS_PATH, smallest ORIGIN number, smallest MED, EBGP over IBGP, smallest
metric or cost for reaching the NEXT_HOP, BGP identifier, and lowest IP address.
Note that the new routes that are installed into the Loc-RIB are in addition to any existing routes
in the table. Once Phase 2 is completed the Loc-RIB will consist of the best of both the new and
older routes.
Decision phase 3
Phase 3 is route distribution or dissemination. This is the process of deciding which routes the
router will advertise. If there is any route aggregation or summarizing, it happens here. Also any
route filtering from route maps happens here.
Once Phase 3 is complete, an update can be sent out to update the neighbor of new routes.
Troubleshooting BGP
There are some features in BGP that are used to deal with problems that may arise. Typically the
problems with a BGP network that has been configured, involve routes going offline frequently.
This is called route flap and causes problems for the routers using that route.
Fortinet Technologies Inc. Page 370 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Clearing routing table entries
To see if a new route is being properly added to the routing table, you can clear all or some BGP
neighbor connections (sessions) using the execute router clear bgp command.
For example, if you have 10 routes in the BGP routing table and you want to clear the specific
route to IP address 10.10.10.1, enter the command:
execute router clear bgp ip 10.10.10.1
To remove all routes for AS number 650001, enter the command:
execute router clear bgp as 650001
Route flap
When routers or hardware along a route go offline and back online that is called a route flap.
Flapping is the term if these outages continue, especially if they occur frequently.
Route flap is a problem in BGP because each time a peer or a route goes down, all the peer
routers that are connected to that out-of-service router advertise the change in their routing
tables which creates a lot of administration traffic on the network. And the same traffic happens
again when that router comes back online. If the problem is something like a faulty network
cable that wobbles on and offline every 10 seconds, there could easily be overwhelming
amounts of routing updates sent out unnecessarily.
Another possible reason for route flap occurs with multiple FortiGate units in HA mode. When
an HA cluster fails over to the secondary unit, other routers on the network may see the HA
cluster as being offline resulting in route flap. While this doesnt occur often, or more than once
at a time, it can still result in an interruption in traffic which is unpleasant for network users. The
easy solution for this problem is to increase the timers on the HA cluster, such as TTL timers, so
they do not expire during the failover process. Also configuring graceful restart on the HA
cluster will help with a smooth failover.
The first method of dealing with route flap should be to check your hardware. If a cable is loose
or bad, it can easily be replaced and eliminate the problem. If an interface on the router is bad,
either avoid using that interface or swap in a functioning router. If the power source is bad on a
router, either replace the power supply or use a power conditioning backup power supply.
These quick and easy fixes can save you from configuring more complex BGP options.
However if the route flap is from another source, configuring BGP to deal with the outages will
ensure your network users uninterrupted service.
Some methods of dealing with route flap in BGP include:
Holddown timer
Dampening
Graceful restart
Bi-directional forwarding detection (BFD)
Holddown timer
The first line of defence to a flapping route is the hold down timer. This timer reduces how
frequently a route going down will cause a routing update to be broadcast.
Once activated, the holddown timer wont allow the FortiGate unit to accept any changes to
that route for the duration of the timer. If the route flaps five times during the timer period, only
the first outage will be recognized by the FortiGate unit for the duration of the other outages
there will be no changes because the Fortigate unit is essentially treating this router as down.
After the timer expires, if the route is still flapping it will happen all over again.
Fortinet Technologies Inc. Page 371 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Even if the route isnt flapping if it goes down, comes up, and stays back up the timer still
counts down and the route is ignored for the duration of the timer. In this situation the route will
be seen as down longer than it really is, but there will be only the one set of route updates. This
is not a problem in normal operation because updates are not frequent.
Also the potential for a route to be treated as down when it is really up can be viewed as a
robustness feature. Typically you do not want most of your traffic being routed over an
unreliable route. So if there is route flap going on, it is best to avoid that route if you can. This is
enforced by the holddown timer.
Dampening
Dampening is a method used to limit the amount of network problems due to flapping routes.
With dampening the flapping still occurs, but the peer routers pay less and less attention to that
route as it flaps more often. One flap doesnt start dampening, but the second starts a timer
where the router will not use that route it is considered unstable. If the route flaps again
before the timer expires, the timer continues to increase. There is a period of time called the
reachability half-life after which a route flap will only be suppressed for half the time. This
half-life comes into effect when a route has been stable for a while but not long enough to clear
all the dampening completely. For the flapping route to be included in the routing table again,
the suppression time must expire.
If the route flapping was temporary, you can clear the flapping or dampening from the FortiGate
units cache by using one of the execute router clear bgp commands:
execute router clear bgp dampening {<ip_address> | <ip/netmask>}
or
execute router clear bgp flap-statistics {<ip> | <ip/netmask>}
For example, to remove route flap dampening information for the 10.10.0.0/16 subnet, enter the
command:
execute router clear bgp dampening 10.10.0.0/16
Fortinet Technologies Inc. Page 372 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The BGP commands related to route dampening are:
config router bgp
set dampening {enable | disable}
set dampening-max-suppress-time <minutes_integer>
set dampening-reachability-half-life <minutes_integer>
set dampening-reuse <reuse_integer>
set dampening-route-map <routemap-name_str>
set dampening-suppress <limit_integer>
set dampening-unreachability-half-life <minutes_integer>
end
Graceful restart
BGP4 has the capability to gracefully restart.
In some situations, route flap is caused by routers that appear to be offline but the hardware
portion of the router (control plane) can continue to function normally. One example of this is
when some software is restarting or being upgraded, but the hardware can still function
normally.
Graceful restart is best used for these situations where routing will not be interrupted, but the
router is unresponsive to routing update advertisements. Graceful restart does not have to be
supported by all routers in a network, but the network will benefit when more routers support it.
FortiGate HA clusters can benefit from graceful restart. When a failover takes place, the HA
cluster will advertise it is going offline, and will not appear as a route flap. It will also enable the
new HA main unit to come online with an updated and usable routing table if there is a flap
the HA cluster routing table will be out of date.
For example, your FortiGate unit is one of four BGP routers that send updates to each other.
Any of those routers may support graceful startingwhen a router plans to go offline, it will
send out a message to its neighbors how long it expects to be before being back online. That
way its neighbor routers dont remove it from their routing tables. However if that router isnt
back online when expected, the routers will mark it offline. This prevents routing flap and its
associated problems.
Fortinet Technologies Inc. Page 373 FortiOS Handbook - Advanced Routing for FortiOS 5.0
For example, if a neighbor of your FortiGate unit, with an IP address of 172.20.120.120,
supports graceful restart, enter the command:
config router bgp
config neighbor
edit 172.20.120.120
set capability-graceful-restart enable
end
end
If you want to configure graceful restart on your FortiGate unit where you expect the Fortigate
unit to be offline for no more than 2 minutes, and after 3 minutes the BGP network should
consider the FortiGate unit offline, enter the command:
config router bgp
set graceful-restart enable
set graceful-restart-time 120
set graceful-stalepath-time 180
end
The BGP commands related to BGP graceful restart are:
config router bgp
set graceful-restart { disable| enable}
set graceful-restart-time <seconds_integer>
set graceful-stalepath-time <seconds_integer>
set graceful-update-delay <seconds_integer>
config neighbor
set capability-graceful-restart {enable | disable}
end
end
Configurable granularity
BFD can run on the entire FortiGate unit, selected interfaces, or on BGP for all configured
interfaces. The hierarchy allows each lower level to override the upper levels BFD setting. For
example, if BFD was enabled for the FortiGate unit, it could be disabled only for a single
Fortinet Technologies Inc. Page 374 FortiOS Handbook - Advanced Routing for FortiOS 5.0
interface or for BGP. For information about FortiGate-wide BFD options, see config system
settings in the FortiGate CLI Reference.
BFD can only be configured through the CLI.
The BGP commands related to BFD are:
config system {setting | interface}
set bfd {enable | disable | global}
set bfd-desired-mix-tx <milliseconds>
set bfd-detect-mult <multiplier>
set bfd-required-mix-rx <milliseconds>
set bfd-dont-enforce-src-port {enable | disable}
The config system commands allow you to configure whether BFD is enabled in a particular
unit/vdom or individual interface, and how often the interface requires sending and receiving of
BFD information.
The config router bgp commands allow you to set the addresses of the neighbor units that
are also running BFD. Both units must be configured with BFD in order to make use of it.
This is an example of a small network that uses BGP routing connections to two ISPs. This is a
common configuration for companies that need redundant connections to the Internet for their
business.
This configuration is for a small company connected to two ISPs. The company has one main
office, the Head Office, and uses static routing for internal routing on that network.
Both ISPs use BGP routing, and connect to the Internet directly. They want the company to
connect to the ISP networks using BGP. They also use graceful restart to prevent unneeded
updates, and use smaller timer values to detect network failures faster.
As can be expected, the company wants to keep their BGP configuration relatively simple and
easy to manage. The current configuration has only 3 routers to worry about the 2 ISP
border routers, and the FortiGate unit. This means the FortiGate unit will only have two
neighbour routers to configure.
This configuration has the added benefit of being easy to expand if the Company wants to add
a remote office in the future.
To keep the configuration simple, the Company is allowing only HTTP, HTTPS, FTP, and DNS
traffic out of the local network. This will allow employees access to the Internet and their
web-mail.
Fortinet Technologies Inc. Page 375 FortiOS Handbook - Advanced Routing for FortiOS 5.0
This section includes the following topics:
Network layout and assumptions
Configuring the FortiGate unit
Configuring other networking devices
Testing this configuration
Fortinet Technologies Inc. Page 376 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The components of the layout include:
The Company AS (AS number 1) is connected to ISP1 and ISP2 through the FortiGate unit.
The Company has one internal network the Head Office network at 10.11.101.0/24.
The FortiGate unit internal interface is on the the Company internal network with an IP
address of 10.11.101.110.
The FortiGate unit external1 interface is connected to ISP1s network with an IP address of
172.20.111.5, an address supplied by the ISP.
The FortiGate unit external2 interface is connected to IPS2s network with an IP address of
172.20.222.5, an address supplied by the ISP.
ISP1 AS has an AS number of 650001, and ISP2 has an AS number of 650002.
Both ISPs are connected to the Internet.
The ISP1 border router is a neighbor (peer) of the FortiGate unit. It has an address of
172.21.111.4.
The ISP2 border router is a neighbor (peer) of the FortiGate unit. It has an address of
172.22.222.4.
Apart from graceful restart, and shorter timers (holdtimer, and keepalive) default settings are
to be used whenever possible.
ISP2 AS 650002
ISP1 AS 650001
172.22.222.4
172.21.111.4
e
external2
1
external1 1
172.20.222.5
5
172.20.111.5
rna
nall
internal
10.11.101.110 Head Office BGP Border Router
Company AS (ASN 1)
Assumptions
The basic BGP configuration procedure follows these assumptions:
ISP1 is the preferred route, and ISP2 is the secondary route
all basic configuration can be completed in both GUI and CLI
only one AS is used for the Company
Fortinet Technologies Inc. Page 377 FortiOS Handbook - Advanced Routing for FortiOS 5.0
For these reasons this example configuration does not include:
Bi-directional forwarding detection (BFD)
Route maps
Access lists
changing redistribution defaults make link when example is set up
IPv6
For more information on these features, see the corresponding section.
Fortinet Technologies Inc. Page 378 FortiOS Handbook - Advanced Routing for FortiOS 5.0
3. Set the following information, and select OK.
Alias internal
IP/Netmask 10.11.101.110/255.255.255.0
Administrative Status Up
Alias external1
IP/Netmask 172.21.111.5/255.255.255.0
Administrative Status Up
Alias external2
IP/Netmask 172.22.222.5/255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 379 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure the FortiGate interfaces - CLI
config system interface
edit port1
set alias internal
set ip 10.11.101.110 255.255.255.0
set allowaccess http https ssh
set description Company internal network
set status up
next
edit port2
set alias external1
set ip 172.21.111.5 255.255.255.0
set allowaccess https ssh
set description ISP1 External BGP network
set status up
next
edit port3
set alias external2
set ip 172.22.222.5 255.255.255.0
set allowaccess https ssh
set description ISP2 External BGP network
set status up
next
end
Device port2
Gateway 172.21.111.5
Distance 10
4. Select OK.
5. Select Create New, and set the following information.
Device port3
Gateway 172.22.222.5
Distance 15
6. Select OK.
Fortinet Technologies Inc. Page 380 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure default routes for both ISPs - CLI
config router static
edit 1
set device "port2"
set distance 10
set gateway 172.21.111.5
next
edit 2
set device "port3"
set distance 15
set gateway 172.22.222.5
next
end
For added security, you may want to define a smaller range of addresses for the internal
network. For example if only 20 addresses are used, only allow those addresses in the range.
In the interest of keeping things simple, a zone will be used to group the two ISP interfaces
together. This will allow using one security policy to apply to both ISPs at the same time.
Remember to block intra-zone traffic as this will help prevent one ISP sending traffic to the other
ISP through your FortiGate unit using your bandwidth. The zone keeps configuration simple,
and in the future if there is a need for separate policies for each ISP, they can be created and the
zone can be deleted.
The addresses that will be used are the addresses of the FortiGate unit internal and external
ports, and the internal network.
More policies or services can be added in the future as applications are added to the network.
For more information on security policies, see the firewall chapter of the FortiGate
Administration Guide.
When configuring security policies always enable logging to help you track and debug your
traffic flow.
Fortinet Technologies Inc. Page 381 FortiOS Handbook - Advanced Routing for FortiOS 5.0
2. For Group Name, enter Basic_Services.
3. From Available Services, move the following six services over to the Member list BGP,
FTP, FTP_GET, FTP_PUT, DNS, HTTP, and HTTPS.
4. Select OK.
4. Select OK.
Interface port1
3. Select OK.
Fortinet Technologies Inc. Page 382 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To add the firewall addresses - CLI
config firewall address
edit "Internal_network"
set associated-interface "port1"
set subnet 10.11.101.0 255.255.255.0
next
end
Destination ISPs
Interface/Zone
Schedule always
Service Basic_services
Action ACCEPT
3. Select OK.
4. Select Create New, and set the following information.
Destination port1(internal)
Interface/Zone
Schedule always
Service Basic_services
Action ACCEPT
NAT Enable
Fortinet Technologies Inc. Page 383 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To add the security policies - CLI
config firewall policy
edit 1
set srcintf "port1"
set srcaddr "Internal_network"
set dstintf "ISPs"
set dstaddr "all"
set schedule "always"
set service "Basic_services"
set action accept
set nat enable
set profile-status enable
set logtraffic enable
set comments "ISPs basic services out policy"
next
edit 2
set srcintf "ISPs"
set srcaddr "all"
set dstintf "port1"
set dstaddr "Internal_network"
set schedule "always"
set service "Basic_services"
set action accept
set nat enable
set profile-status enable
set logtraffic enable
set comments "ISPs basic services in policy"
next
end
Local AS 1
Router ID 10.11.101.110
Fortinet Technologies Inc. Page 384 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To set the BGP router information - CLI
config router BGP
set as 1
set router-id 10.11.101.110
end
IP/Netmask 10.11.101.0/255.255.255.0
Fortinet Technologies Inc. Page 385 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Additional FortiGate BGP configuration
At this point that is all the settings that can be done in both the web-based manger and the CLI.
The remaining configuration must be completed in the CLI.
These additional settings are mainly determined by your ISP requirements. They will determine
your timers such as keep alive timers, if extended features like BFD and graceful restart are
being used, and so on. For this example, some common simply features are being used to
promote faster detections of network failures which will result in better service for the
Companys internal network users.
The ISPs do not require authentication between peer routers.
These commands will enable or modify the following features on the FortiGate unit, and where
possible on neighboring routers as well:
bestpath-med-missing-as-worst treats a route without an MED as the worst
possible available route due to expected unreliability
fast-external-failover immediately reset the session information associated with
BGP external peers if the link used to reach them goes down
graceful-restart* advertise reboots to neighbors so they do not see the router as
offline, wait before declaring them offline, and how long to wait when they reboot before
advertising updates. These commands applies to neighbors and are part of the BGP
capabilities. This prevents unneeded routing updates.
holdtime-timer how long the router will wait for a keepalive message before declaring
a router offline. A shorter time will find an offline router faster.
keepalive-timer how often the router sends out keepalive messages to neighbor
routers to maintain those sessions.
log-neighbor-changes log changes to neighbor routers status. This can be useful for
troubleshooting from both internal and external networks.
connect-timer how long in seconds the FortiGate unit will try to reach this neighbor
before declaring it offline.
weight used to prefer routes from one neighbor over the other. In this example ISP1 is
the primary connection so it is weighted higher than ISP2
Fortinet Technologies Inc. Page 386 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure additional BGP options - CLI
config router bgp
set bestpath-med-missing-as-worst enable
set fast-external-failover enable
set graceful-restart enable
set graceful-restart-time 120
set graceful-stalepath-time 180
set graceful-update-delay 180
set holdtime-timer 120
set keepalive-timer 45
set log-neighbor-changes enable
config neighbor
edit 172.21.111.4
set connect-timer 60
set description ISP1
set holdtime-timer 120
set keepalive-timer 45
set weight 250
next
edit 172.22.222.4
set connect-timer 60
set description ISP2
set holdtime-timer 120
set keepalive-timer 45
set weight 100
next
end
end
Fortinet Technologies Inc. Page 387 FortiOS Handbook - Advanced Routing for FortiOS 5.0
In general for routing you need to look at the routing table on different routers to see what routes
are being installed. You also need to sniff packets to see how traffic is being routed in real time.
These two sources of information will normally tell you what you need to know.
Testing of this examples network configuration should be completed in two parts:
Testing network connectivity
Verifying the FortiGate units routing tables
Verifying traffic routing
Verifying the dual-homed side of the configuration
Once you have completed testing the network connectivity, turn off ping support on the
external interfaces for additional security.
Fortinet Technologies Inc. Page 388 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Look for slow hops on the traceroute, or pings to a location, as they may indicate network loops
that need to be fixed.
Any locations that have an unresolved traceroute or ping must be examined and fixed.
Use network packet sniffing to ensure traffic is being routed as you expect.
During normal BGP operation, peer routers redistribute routes from each other. However, in
some specific situations it may be best to not advertise routes from one peer, such as if the peer
is redundant with another peer (they share the same routes exactly), if it might be unreliable in
some way, or some other reason. The FortiGate can also take routes it learns from other
protocols and advertise them in BGP, for example OSPF or RIP. If your Company hosts its own
web or email servers, external locations will require routes to your networks to reach those
services.
In this example the Company has an internal network in an OSPF area, and is connected to a
BGP AS and two BGP peers. Company goes through these two peers to reach the Internet.
However, Peer 1 routes will not be advertised to Peer 2. The Company internal user and server
networks are running OSPF, and will redistribute those routes to BGP so external locations can
reach the web and email servers.
This section includes the following topics:
Network layout and assumptions
Configuring the FortiGate unit
Testing network configuration
Fortinet Technologies Inc. Page 389 FortiOS Handbook - Advanced Routing for FortiOS 5.0
The components of the layout include:
There is only one BGP AS in this example AS 65001, shared by the FortiGate unit and
both peers.
The Companys FortiGate unit connects to the Internet through two BGP peers.
The Company internal networks on the dmz interface of the FortiGate unit with an IP of
10.11.201.0/24.
The FortiGate units interfaces are connected as follows:
port1 (dmz) has IP 10.11.201.110 and is the internal user and server network
port2 (external1) has IP 172.21.111.4 and is connected to Peer 1s network
port3 (external2) has IP 172.22.222.4 and is connected to Peer 2s network
Peer 1 has IP 172.21.111.5, and Peer 2 has IP 172.22.222.5.
OSPF Area 1 is configured on the dmz interface of the FortiGate unit, and is the routing
protocol used by the internal users and servers.
Peer 2
172.22.222.5
Peer 1
external2
172.21.111.5
172.22.222.4
BGP d
dmz
AS 65001 10.11.201.110
1
external1
a1
al
172.21.111.4
.44
OSPF
Area 1
http
email
Assumptions
The the BGP redistributing routes configuration procedure follows these assumptions:
the FortiGate unit has been configured following the Install Guide
interfaces port1, port2, and port 3 exist on the FortiGate unit
we dont know the router manufacturers of Peer 1 and Peer 2
we dont know what other devices are on the BGP AS or OSPF Area
all basic configuration can be completed in both GUI and CLI
access lists and route maps will only be configured in CLI
VDOMs are not enabled on the FortiGate unit
Fortinet Technologies Inc. Page 390 FortiOS Handbook - Advanced Routing for FortiOS 5.0
3. Configuring the FortiGate unit - OSPF
4. Configuring other networking devices
Alias dmz
IP/Netmask 10.11.201.110/255.255.255.0
Administrative Status Up
Alias external1
IP/Netmask 172.21.111.4/255.255.255.0
Administrative Status Up
Alias external2
IP/Netmask 172.22.222.4/255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 391 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure the FortiGate interfaces (CLI)
config system interface
edit port1
set alias dmz
set ip 10.11.201.110 255.255.255.0
set allowaccess https ssh ping
set description "OSPF internal networks"
set status up
next
edit port2
set alias external1
set ip 172.21.111.4 255.255.255.0
set allowaccess https ssh
set description "BGP external1 Peer 1"
set status up
next
edit port3
set alias external2
set ip 172.22.222.4 255.255.255.0
set allowaccess https ssh
set description "BGP external2 Peer 2"
set status up
next
end
Interface port1
3. Select OK.
4. Select Create New, and enter the following information:
5. Select OK.
Fortinet Technologies Inc. Page 392 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure firewall service groups - GUI
1. Go to Firewall Objects > Service > Groups.
2. Select Create New.
3. Name the group BGP_Services.
4. Move the following services to the right list: BGP, DHCP, DNS, FTP, FTP_GET, FTP_PUT,
HTTP, HTTPS, IMAP, MYSQL, NTP, PING, POP3, SMTP, SSH, SYSLOG, and TRACEROUTE.
5. Select OK.
6. Select Create New.
7. Name the group OSPF_Services.
8. Move the following services to the right list: DNS, FTP, FTP_GET, FTP_PUT, HTTP, HTTPS,
IMAP, MYSQL, NTP, OSPF, PING, POP3, SMTP, SSH, SYSLOG, and TRACEROUTE.
9. Select OK.
Fortinet Technologies Inc. Page 393 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To create access list to block Peer 1 - CLI
config access-list
edit block_peer1
config rule
edit 1
set prefix 172.21.111.0 255.255.255.0
set action deny
set exact-match enable
end
end
end
Type Regular
Authentication None
Fortinet Technologies Inc. Page 394 FortiOS Handbook - Advanced Routing for FortiOS 5.0
6. Enter 10.11.201.0/255.255.255.0 for IP/Netmask, and select OK.
7. For Interfaces, select Create New.
8. Enter OSPF_dmz_network for Name.
9. Select port1(dmz) for Interface, and then select OK.
Fortinet Technologies Inc. Page 395 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Open Shortest Path First (OSPF)
OSPF (Open Shortest Path First) is a link-state interior routing protocol, that is widely used in
large enterprise organizations. It only routes packets within a single autonomous system (AS).
This is different from BGP as BGP can communicate between ASes.
This section includes:
Background
The parts and terminology of OSPF
How OSPF works
Background
OSPF version 2 was defined in 1998 in RFC 2328. OSPF was designed to support classless IP
addressing, and variable subnet masks. This was a shortcoming of the earlier RIP protocols.
Updates to OSPF version 2 are included in OSPF version 3 defined in 2008 in RFC 5340.
OSPF3 includes support for IPv6 addressing where previously OSPF2 only supports IPv4
addressing.
The main benefit of OSPF is that it detects link failures in the network quickly and within
seconds has converged network traffic successfully without any networking loops. Also OSPF
has many features to control which routes are propagated and which are not, maintaining
smaller routing tables. OSPF can also provide better load-balancing on external links than other
interior routing protocols.
Page 396
OSPFv3 and IPv6
OSPFv3 (OSPF version 3) includes support for IPv6. Generally, all IP addresses are in IPv6
format instead of IPv4. However, OSPFv3 area numbers use the same 32-bit numbering system
as OSPFv2, as described in RFC 2740. Likewise, the router ID and area ID are in the same
format as OSPFv2.
As with most advanced routing features on your FortiGate unit, IPv6 settings for dynamic
routing protocols must be enabled before they will be visible in the GUI. To enable IPv6
configuration in the GUI, enable it in System > Admin > Settings.
For IPv6, the main difference in OSPFv3 is that, rather than using a network statement to enable
OSPFv3 on an interface, you define OSPF6 (OSPF for IPv6) interfaces, which are bound to
interface and area. This configuration must be done in the CLI, as follows (with sample
interfaces and addresses):
config router ospf6
config area
edit 0.0.0.0
next
end
config ospf6-interface
edit tunnel
set interface to_FGT300A-7
next
edit internal_lan
set interface port1
next
set router-id 10.174.0.113
end
Note that OSPFv3 neighbors use link-local IPv6 addresses, but with broadcast and
point-to-point network types, neighbors are automatically discovered.You only have to
manually configure neighbors when using non-broadcast network types.
Router ID
In OSPF, each router has a unique 32-bit number called its Router ID. Often this 32-bit number
is written the same as a 32-bit IPv4 address would be written in dotted decimal notation.
However some brands of routers, such as Cisco routers, support a router ID entered as an
integer instead of an IP address.
It is a good idea to not use IP address in use on the router for the router ID number. The router
ID does not have to be a particular IP address on the router. By choosing a different number, it
will be harder to get confused which number you are looking at. A good idea can be to use the
as much of the area's number as possible. For example if you have 15 routers in area 0.0.0.0
they could be numbered from 0.0.0.1 to 0.0.0.15. If you have an area 1.1.1.1, then routers in that
area could start at 1.1.1.10 for example.
You can manually set the router ID on your FortiGate unit.
Fortinet Technologies Inc. Page 397 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To manually set an OSPF router ID of 0.0.1.1 - CLI
config router ospf
set router-id 0.0.1.1
end
Adjacency
In an OSPF routing network, when an OSPF router boots up it sends out OSPF Hello packets to
find any neighbors, routers that have access to the same network as the router booting up.
Once neighbors are discovered and Hello packets are exchanged, updates are sent, and the
Link State databases of both neighbors are synchronized. At this point these neighbors are said
to be adjacent.
For two OSPF routers to become neighbors, the following conditions must be met.
The subnet mask used on both routers must be the same subnet.
The subnet number derived using the subnet mask and each router's interface IP address
must match.
The Hello interval & The Dead interval must match.
The routers must have the same OSPF area ID. If they are in different areas, they are not
neighbors.
If authentication is used, they must pass authentication checks.
If any of these parameters are different between the two routers, the routers do not become
OSPF neighbors and cannot be adjacent. If the routers become neighbors, they are adjacent.
Fortinet Technologies Inc. Page 398 FortiOS Handbook - Advanced Routing for FortiOS 5.0
A designated router (DR) is the designated broadcasting router interface for an AS. It looks after
all the initial contact and other routing administration traffic. Having only one router do all this
greatly reduces the network traffic and collisions.
If something happens and the designated router goes offline, the backup designated router
(BDR) takes over. An OSPF FortiGate unit interface can become either a DR or BDR. Both the
DR and the BDR cover the same area, and are elected at the same time. The election process
doesnt have many rules, but the exceptions can become complex.
Benefits
The OSPF concept of the designated router is a big step above RIP. With all RIP routers doing
their own updates all the time, RIP suffers from frequent and sometimes unnecessary updates
that can slow down your network. With OSPF, not only do routing changes only happen when a
link-state changes instead of any tiny change to the routing table, but the designated router
reduces this overhead traffic even more.
However, smaller network topologies may only have a couple routers besides the designated
router. This may seem excessive, but it maintains the proper OSPF form and it will still reduce
the administration traffic but to a lesser extent than on a large network. Also, your network
topology will be ready whenever you choose to expand your network.
Area
An OSPF area is a smaller part of the larger OSPF AS. Areas are used to limit the link-state
updates that are sent out. The flooding used for these updates would overwhelm a large
network, so it is divided into these smaller areas for manageability.
Within an area if there are two or more routers that are viable, there will always be a designated
router (DR) and a backup DR (BDR). For more on these router roles, see Designated router (DR)
and backup router (BDR) on page 398.
Fortinet Technologies Inc. Page 399 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Defining a private OSPF area, involves:
assigning a 32-bit number to the area that is unique on your network
defining the characteristics of one or more OSPF areas
creating associations between the OSPF areas that you defined and the local networks to
include in the OSPF area
if required, adjusting the settings of OSPF-enabled interfaces.
IPv6 OSPF area numbers use the same 32-bit number notation as IPv4 OSPF.
If you are using the web-based manager to perform these tasks, follow the procedures
summarized below.
FortiGate units support the four main types of OSPF area:
Backbone area
NSSA
Stub area
Regular area
Backbone area
Every OSPF network has at least one AS, and every OSPF network has a backbone area. The
backbone is the main area, or possibly the only area. All other OSPF areas are connected to a
backbone area. This means if two areas want to pass routing information back and forth, that
routing information will go through the backbone on its way between those areas. For this
reason the backbone not only has to connect to all other areas in the network, but also be
uninterrupted to be able to pass traffic to all points of the network.
The backbone area is referred to as area 0 because it has an IP address of 0.0.0.0.
Stub area
A stub area is an OSPF area that receives no outside routes advertised into it, and all routing in
it is based on a default route. This essentially isolates it from outside areas.
Stub areas are useful for small networks that are part of a larger organization, especially if the
networking equipment cant handle routing large amounts of traffic passing through, or there are
other reasons to prevent outside traffic, such as security. For example most organizations dont
want their accounting department to be the center of their network with everyones traffic
passing through there. It would increase the security risks, slow down their network, and it
generally doesnt make sense.
A variation on the stub area is the totally stubby area. It is a stub area that does not allow
summarized routes.
NSSA
A not-so-stubby-area (NSSA) is a stub area that allows for external routes to be injected into it.
While it still does not allow routes from external areas, it is not limited to only using he default
route for internal routing.
Fortinet Technologies Inc. Page 400 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Regular area
A regular area is what all the other ASes are, all the non-backbone, non-stub, non-NSSA areas.
A regular area generally has a connection to the backbone, does receive advertisements of
outside routes, and does not have an area number of 0.0.0.0.
Authentication
In the OSPF packet header are two authentication related fields AuType, and Authentication.
All OSPF packet traffic is authenticated. Multiple types of authentication are supported in
OSPFv2. However in OSPFv3, there is no authentication built-in but it is assumed that IPsec will
be used for authentication instead.
Packets that fail authentication are discarded.
Null authentication
Null authentication indicates there is no authentication being used. In this case the 16-byte
Authentication field is not checked, and can be any value. However checksumming is still used
to locate errors. On your FortiGate this is the none option for authentication.
Cryptographic authentication
Cryptographic authentication involves the use of a shared secret key to authenticate all router
traffic on a network. The key is never sent over the network in the cleara packet is sent and a
condensed and encrypted form of the packet is appended to the end of the packet. A
non-repeating sequence number is included in the OSPF packet to protect against replay
attacks that could try to use already sent packets to disrupt the network. When a packet is
accepted as authentic the authentication sequence number is set to the packet sequence
number. If a replay attack is attempted, the packet sent will be out of sequence and ignored.
Your FortiGate unit supports all three levels of authentication through the authentication
keyword associated with creating an OSPF interface .
For example to create an OSPF interface called Accounting on the port1 interface that is a
broadcast interface, has a hello interval of 10 seconds, has a dead interval of 40 seconds, uses
text authentication (simple password) with a password of ospf_test, enter the command:
config router ospf
config ospf-interface
edit Accounting
set interface port1
set network-type broadcast
set hello-interval 10
set dead-interval 40
set authentication text
set authentication-key ospf_test
end
end
Fortinet Technologies Inc. Page 401 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Hello and dead intervals
The OSPF Hello protocol is used to discover and maintain communications with neighboring
routers.
Hello packets are sent out at a regular interval for this purpose. The DR sends out the Hello
packets. In a broadcast network, the multicast address of 224.0.0.5 is used to send out Hello
packets. New routers on the network listen for and reply to these packets to join the OSPF area.
If a new router never receives a Hello packet, other routers will not know it is there and will not
communicate with it. However, once a new router is discovered the DR adds it to the list of
routers in that area and it is integrated into the routing calculations.
Dead interval is the time other routers will wait before declaring a neighbor dead (offline). Setting
a reasonable dead interval is very important. If this interval is too short, routers will be declared
offline when they are just slow or momentarily inaccessible, and link-state updates will happen
more than they need to, using more bandwidth. If the dead interval is too long, it will slow down
network traffic overall if online routers attempt to contact offline ones instead of re-routing
traffic. The CLI syntax for OSPF dead interval follows:
config ospf-interface
edit ospf1
set interface port1
set network-type broadcast
set dead-interval 1
end
Access Lists
Access lists are filters used by FortiGate unit OSPF routing. An access list provides a list of IP
addresses and the action to take for them essentially an access list makes it easy to group
addresses that will be treated the same into the same group, independent of their subnets or
other matching qualities. You add a rule for each address or subnet that you want to include,
specifying the action to take for it. For example if you wanted all traffic from one department to
be routed a particular way, even in different buildings, you can add all the addresses to an
access list and then handle that list all at once.
Each rule in an access list consists of a prefix (IP address and netmask), the action to take for
this prefix (permit or deny), and whether to match the prefix exactly or to match the prefix and
any more specific prefix.
The FortiGate unit attempts to match a packet against the rules in an access list starting at the
top of the list. If it finds a match for the prefix, it takes the action specified for that prefix. If no
match is found the default action is deny.
Access lists greatly speed up configuration and network management. When there is a problem,
you can check each list instead of individual addresses. Also, it eases troubleshooting since if
all addresses on one list have problems, it eliminates many possible causes right away.
If you are using the OSPF+ IPv6 protocols you will need to use access-list6, the IPv6 version of
access list. The only difference is that access-list6 uses IPv6 addresses.
Fortinet Technologies Inc. Page 402 FortiOS Handbook - Advanced Routing for FortiOS 5.0
For example, if you want to create an access list called test_list that only allows an exact
match of 10.10.10.10 and 11.11.11.11, enter the command:
config router access-list
edit test_list
config rule
edit 1
set prefix 10.10.10.10 255.255.255.255
set action allow
set exact-match enable
next
edit 2
set prefix 11.11.11.11 255.255.255.255
set action allow
set exact-match enable
end
end
Another example is if you want to deny ranges of addresses in IPv6 that start with the IPv6
equivalents of 10.10.10.10 and 11.11.11.11, enter the command access-list6 as follows:
config router access-list6
edit test_list_ip6
config rule
edit 1
set prefix6 2002:A0A:A0A:0:0:0:0:0:/48
set action deny
next
edit 2
set prefix6 2002:B0B:B0B:0:0:0:0:0/48
set action deny
end
To use an access_list, you must call it from a routing protocol such as RIP. The following
example uses the access_list from the earlier example called test_list to match routes coming in
on the port1 interface. When there is a match, it will add 3 to the hop count metric for those
routes to artificially decrease their priority. Enter the following command:
config router ospf
config distribute-list
edit 5
set access-list test_list
set protocol connected
end
If you are setting a prefix of 128.0.0.0, use the format 128.0.0.0/1. The default route 0.0.0.0/0
can not be exactly matched with an access-list. A prefix-list must be used for this purpose.
Fortinet Technologies Inc. Page 403 FortiOS Handbook - Advanced Routing for FortiOS 5.0
OSPF is an interior routing protocol. It includes a backbone AS, and possibly additional ASes.
The DR and BDR are elected from potential routers with the highest priorities. The DR handles
much of the administration to lower the network traffic required. New routers are discovered
through hello packets sent from the DR using the multicast address of 224.0.0.5. If the DR goes
offline at any time, the BDR has a complete table of routes that is uses when it takes over as the
DR router.
OSPF does not use UDP or TCP, but is encapsulated directly in IP datagrams as protocol 89.
This is in contrast to RIP, or BGP. OSPF handles its own error detection and correction
functions.
The OSPF protocol, when running on IPv4, can operate securely between routers, optionally
using a variety of authentication methods to allow only trusted routers to participate in routing.
OSPFv3, running on IPv6, no longer supports protocol-internal authentication. Instead, it relies
on IPv6 protocol security (IPsec).
Other important parts of how OSPF works includes:
OSPF router discovery
How OSPF works on FortiGate units
External routes
Link-state Database (LSDB) and route updates
OSPF packets
Fortinet Technologies Inc. Page 404 FortiOS Handbook - Advanced Routing for FortiOS 5.0
External routes
OSPF is an internal routing protocol. OSPF external routes are routes where the destination
using a routing protocol other than OSPF. OSPF handles external routes by adjusting the cost of
the route to include the cost of the other routing protocol. There are two methods of calculating
this cost, used for OSPF E1 and OSPF E2.
Comparing E1 and E2
The best way to understand OSPF E1 and E2 routes is to check routing tables on OSPF routers.
If you look at the routes on an OSPF border router, the redistributed routes will have an
associated cost that represents only the external route, as there is no OSPF cost to the route
due to it already being on the edge of the OSPF domain. However, if you look at that same route
on a different OSPF router inside the OSPF routing domain, it will have a higher associated cost
- essentially the external cost plus the cost over the OSPF domain to that border router. The
border router uses OSPF E2, where the internal OSPF router uses OSPF E1 for the same route.
Fortinet Technologies Inc. Page 405 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Link-state Database (LSDB) and route updates
OSPF is based on links. The links between adjacent neighbor routers allow updates to be
passed along the network. Network links allow the DR to flood the area with Link-state
database (LSDB) updates. External links allow the OSPF area to connect to destinations outside
the OSPF autonomous system. Information about these links is passed throughout the OSPF
network as link-state updates.
The LSDB contains the information that defines the complete OSPF area, but the LSDB is not
the routing table. It contains the information from all the link-state updates passed along the
network. When there are no more changes required, and the network is stable then the LSDB on
each router in the network will be the same. The DR will flood the LSDB to the area to ensure
each router has the same LSDB.
To calculate the best route (shortest path) to a destination, the FortiGate unit applies the
Shortest Path First (SPF) algorithm, based on Dijkstras algorithm, to the accumulated link-state
information. OSPF uses relative path cost metric for choosing the best route. The path cost can
be any metric, but is typically the bandwidth of the path, how fast traffic will get from one point
to another.
The path cost, similar to distance for RIP, imposes a penalty on the outgoing direction of a
FortiGate unit interface. The path cost of a route is calculated by adding together all of the costs
associated with the outgoing interfaces along the path to the destination. The lowest overall
path cost indicates the best route, and generally the fastest route. Some brands of OSPF
routers, such as Cisco, implement cost as a direct result of bandwidth between the routers.
Generally this is a good cost metric because larger bandwidth means more traffic can travel
without slowing down. To achieve this type of cost metric on FortiGate units, you need to set
the cost for each interface manually in the CLI.
The inter-area routes may not be calculated when a Cisco type ABR has no fully adjacent
neighbor in the backbone area. In this situation, the router considers summary-LSAs from all
Actively summary-LSAs from all Actively Attached areas (RFC 3509).
The FortiGate unit dynamically updates its routing table based on the results of the SPF
calculation to ensure that an OSPF packet will be routed using the shortest path to its
destination. Depending on the network topology, the entries in the FortiGate unit routing table
may include:
the addresses of networks in the local OSPF area (to which packets are sent directly)
routes to OSPF area border routers (to which packets destined for another area are sent)
if the network contains OSPF areas and non-OSPF domains, routes to area boundary
routers, which reside on the OSPF network backbone and are configured to forward packets
to destinations outside the OSPF AS.
Fortinet Technologies Inc. Page 406 FortiOS Handbook - Advanced Routing for FortiOS 5.0
4. Once the SPF tree has been created, and shows the shortest paths to all the OSPF routers
on the network, the work is done. If the new route is the best route, it will be part of that tree.
If it is not the shortest route, it will not be included in the LSDB.
5. If there has been a change from the initial LSDB to the new SPF tree, a link state update will
be sent out to let the other routers know about the change so they can update their LSDBs
as well. This is vital since all routers on the OSPF area must have the same LSDB.
6. If there was no change between the LSDB and the SPF tree, no action is taken.
OSPF packets
Every OSPF packet starts with a standard 24-byte header, and another 24 bytes of information
or more. The header contains all the information necessary to determine whether the packet
should be accepted for further processing.
Table 14: OSPF packet
1-byte Version field 1-byte Type field 2-byte Packet 3-byte Router ID
length
4-byte Network Mask 2-byte Hello interval 1-byte Options field 1-byte Router
Priority
4-byte Dead Router 4-byte DR field 4-byte BDR field 4-byte Neighbor ID
interval
Fortinet Technologies Inc. Page 407 FortiOS Handbook - Advanced Routing for FortiOS 5.0
When AuType is set to 2 (Cryptographic authentication), the 64-bit authentication field is split
into the following four fields: Zero field, Key ID field, Authentication data length field, and
Cryptographic sequence field.
The Key ID field indicates the key and algorithm used to create the message digest appended
to the packet. The authentication data length field indicates how many bytes long the message
digest is, and the cryptographic sequence number is at non-decreasing number that is set
when the packet is received and authenticated to prevent replay attacks.
Network MaskThe subnet where this packet is valid.
Hello intervalThe period of time between sending out Hello packets. See Hello and dead
intervals on page 402.
Options field The OSPF protocol defines several optional capabilities. A router indicates the
optional capabilities that it supports in its OSPF Hello packets, Database Description packets
and in its LSAs. This enables routers supporting a mix of optional capabilities to coexist in a
single Autonomous System.
Router priorityThe priority between 0 and 255 that determines which routers become the DR
and BDR. See Designated router (DR) and backup router (BDR) on page 398.
Dead router intervalThe period of time when there is no response from a router before it is
declared dead. See Hello and dead intervals on page 402.
DR and BDR fieldsThe DR and BDR fields each list the router that fills that role on this
network, generally the routers with the highest priorities. See Designated router (DR) and
backup router (BDR) on page 398.
Neighbor IDThe ID number of a neighboring router. This ID is used to discover new routers
and respond to them.
Troubleshooting OSPF
As with other dynamic routing protocols, OSPF has some issues that may need troubleshooting
from time to time. For basic troubleshooting, see the Troubleshooting chapter.
The more common issues include:
Clearing OSPF routes from the routing table
Checking the state of OSPF neighbors
Passive interface problems
Timer problems
Authentication issues
DR and BDR election issues
Fortinet Technologies Inc. Page 408 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Checking the state of OSPF neighbors
In OSPF each router sends out link state advertisements to find other routers on its network
segment, and to create adjacencies with some of those routers. This is important because
routing updates are only passed between adjacent routers. If two routers you believe to be
adjacent are not, that can be the source of routing failures.
To identify this problem, you need to check the state of the OSPF neighbors of your FortiGate
unit. Use the CLI command get router info ospf neighbor all to see all the neighbors
for your FortiGate unit. You will see output in the form of:
FGT1 # get router info ospf neighbor
OSPF process 0:
Neighbor ID Pri State Dead Time Address Interface
10.0.0.2 1 Full/ - 00:00:39 10.1.1.2 tunnel_wan1
10.0.0.2 1 Full/ - 00:00:34 10.1.1.4 tunnel_wan2
The important information here is the State column. Any neighbors that are not adjacent to
your FortiGate unit will be reported in this column as something other than Full. If the state is
Down, that router is offline.
Timer problems
A timer mismatch is when two routers have different values set for the same timer. For example
if one router declares a router dead after 45 seconds and another waits for 4 minutes that
difference in time will result in those two routers being out of synch for that period of timeone
will still see that offline router as being online.
The easiest method to check the timers is to check the configuration on each router. Another
method is to sniff some packets, and read the timer values in the packets themselves from
different routers. Each packet contains the hello interval, and dead interval periods, so you can
compare them easily enough.
Fortinet Technologies Inc. Page 409 FortiOS Handbook - Advanced Routing for FortiOS 5.0
connection then that router is declared down. BFD then communicates this information to the
routing protocol and the routing information is updated.
Authentication issues
OSPF has a number of authentication methods you can choose from. You may encounter
problems with routers not authenticating as you expect. This will likely appear simply as one or
more routers that have a blind spot in their routing - they wont acknowledge a router. This can
be a problem if that router connects areas to the backbone as it will appear to be offline and
unusable.
To confirm this is the issue, the easiest method is to turn off authentication on the neighboring
routers. With no authentication between any routers, everything should flow normally.
Another method to confirm that authentication is the problem is to sniff packets, and look at
their contents. The authentication type and password are right in the packets which makes it
easy to confirm they are what you expect during real time. Its possible one or more routers is
not configured as you expect and may be using the wrong authentication. This method is
especially useful if there are a group of routers with these problemsit may only be one router
causing the problem that is seen in multiple routers.
Once you have confirmed the problem is authentication related, you can decide how to handle
it. You can turn off authentication and take your time to determine how to get your preferred
authentication type back online. You can try another type of authentication, such as text instead
of md5, which may have more success and still provide some level of protection. The important
part is that once you confirm the problem, you can decide how to fix it properly.
This example sets up an OSPF network at a small office. There are 3 routers, all running OSPF
v2. The border router connects to a BGP network.
All three routers in this example are FortiGate units. Router1 will be the designated router (DR)
and router2 will be the backup DR (BDR) due to their priorities. Router3 will not be considered
for either the DR or BDR elections. Instead, Router3 is the area border router (ASBR) routing all
traffic to the ISPs BGP router on its way to the Internet.
Router2 has a modem connected that provides dialup access to the Internet as well, at a
reduced bandwidth. This is a PPPoE connection to a DSL modem. This provides an alternate
Fortinet Technologies Inc. Page 410 FortiOS Handbook - Advanced Routing for FortiOS 5.0
route to the Internet if the other route goes down. The DSL connection is slow, and is charged
by the amount of traffic. For these reasons OSPF will highly favor Router3s Internet access.
The DSL connection connects to an OSPF network with the ISP, so no redistribution of routes is
required. The ISP network does have to be added to that routers configuration however.
This section includes the following topics:
Network layout and assumptions
Configuring the FortiGate units
Configuring OSPF on the FortiGate units
Configuring other networking devices
Testing network configuration
Router1 (DR) Internal (port1) 10.11.101.1 Head office network, and Router2
Router2 (BDR) Internal (port1) 10.11.101.2 Head office network, and Router1
Fortinet Technologies Inc. Page 411 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Figure 110:Basic OSPF network topology
Router2
Ro
R ou (BDR)
Router1 (DR)
R))
Note that other subnets can be added to the internal interfaces without changing the
configuration.
Assumptions
The FortiGate units used in this example have interfaces named port1, port2, and port3.
All FortiGate units in this example have factory default configuration, and are in NAT/Route
mode.
Basic firewalls are in place to allow unfiltered traffic between all connected interfaces in both
directions.
This OSPF network is not connected to any other OSPF networks.
Both Internet connections are always available.
The modem connection is very slow and expensive.
Other devices may be on the network, but do not affect this basic configuration.
Router3 is responsible for redistributing all routes into and out of the OSPF AS.
Fortinet Technologies Inc. Page 412 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Configuring Router1
Router1 has two interfaces connected to the networkinternal (port1) and external (port2). Its
host name must be changed to Router1.
Alias internal
IP/Netmask 10.11.101.1/255.255.255.0
Administrative Status Up
Alias External
IP/Netmask 10.11.102.1/255.255.255.0
Description Router3
Administrative Status Up
Configuring Router2
Router2 configuration is the same as Router1, except Router2 also has the DSL interface to
configure.
The DSL interface is configured with a username of user1 and a password of ospf_example.
The default gateway will be retrieved from the ISP, and the defaults will be used for the rest of
the PPPoE settings.
Alias internal
IP/Netmask 10.11.101.2/255.255.255.0
Fortinet Technologies Inc. Page 413 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Description Head office and Router1
Administrative Status Up
Alias External
IP/Netmask 10.11.103.2/255.255.255.0
Description Router3
Administrative Status Up
6. Edit DSL (port3), set the following information, and select OK.
Alias DSL
Username user1
Password ospf_example
Description DSL
Administrative Status Up
Configuring Router3
Router3 is similar to Router1 and Router2 configurations. The main difference is the External
(port3) interface connected to the ISP BGP network which has no administration access
enabled for security reasons.
Alias internal
IP/Netmask 10.11.102.3/255.255.255.0
Fortinet Technologies Inc. Page 414 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Description Router1
Administrative Status Up
Alias Internal2
IP/Netmask 10.11.103.3/255.255.255.0
Description Router2
Administrative Status Up
Alias External
IP/Netmask 172.20.120.3/255.255.255.0
Administrative Access
Administrative Status Up
Fortinet Technologies Inc. Page 415 FortiOS Handbook - Advanced Routing for FortiOS 5.0
This section includes:
Configuring OSPF on Router1
Configuring OSPF on Router2
Configuring OSPF on Router3
Area 0.0.0.0
Type Regular
Authentication none
4. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.0.0/255.255.0.0
Area 0.0.0.0
5. In Interfaces, select Create New, set the following information, and select OK.
Name Router1-Internal-DR
IP 0.0.0.0
Authentication none
Timers (seconds)
Hello Interval 10
Dead Interval 40
6. In Interfaces, select Create New, set the following information, and select OK.
Name Router1-External
IP 0.0.0.0
Authentication none
Fortinet Technologies Inc. Page 416 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Timers (seconds)
Hello Interval 10
Dead Interval 40
7. Using the CLI, enter the following commands to set the priority for the Router1-Internal
OSPF interface to maximum, ensuring this interface becomes the DR.
config router ospf
config ospf-interface
edit Router1-Internal-DR
set priority 255
end
Fortinet Technologies Inc. Page 417 FortiOS Handbook - Advanced Routing for FortiOS 5.0
3. In Areas, select Create New, set the following information, and select OK.
Area 0.0.0.0
Type Regular
Authentication none
4. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.0.0/255.255.0.0
Area 0.0.0.0
5. In Interfaces, select Create New, set the following information, and select OK.
Name Router2-Internal
IP 0.0.0.0
Authentication none
Timers (seconds)
Hello Interval 10
Dead Interval 40
6. In Interfaces, select Create New, set the following information, and select OK.
Name Router2-External
IP 0.0.0.0
Authentication none
Timers (seconds)
Hello Interval 10
Dead Interval 40
7. In Interfaces, select Create New, set the following information, and select OK.
Name Router2-DSL
IP 0.0.0.0
Authentication none
Cost 50
Fortinet Technologies Inc. Page 418 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Timers (seconds)
Hello Interval 20
Dead Interval 80
8. Using the CLI, enter the following commands to set the priority for the Router2-Internal
OSPF interface to ensure this interface will become the BDR.
config router ospf
config ospf-interface
edit Router2-Internal
set priority 250
next
end
Fortinet Technologies Inc. Page 419 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure OSPF on Router3 - web-based manager
1. Go to Router > Dynamic > OSPF.
2. Set Router ID to 10.11.101.2 and select Apply.
3. Expand Advanced Options.
4. In Redistribute, set the following information, and select OK.
Connected Enable 15
Static Enable 15
BGP Enable 5
5. In Areas, select Create New, set the following information, and select OK.
Area 0.0.0.0
Type Regular
Authentication none
6. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.0.0/255.255.0.0
Area 0.0.0.0
7. In Interfaces, select Create New, set the following information, and select OK.
Name Router3-Internal
IP 0.0.0.0
Authentication none
Timers (seconds)
Hello Interval 10
Dead Interval 40
8. In Interfaces, select Create New, set the following information, and select OK.
Name Router3-Internal2
IP 0.0.0.0
Fortinet Technologies Inc. Page 420 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Authentication none
Timers (seconds)
Hello Interval 10
Dead Interval 40
9. In Interfaces, select Create New, set the following information, and select OK.
Name Router3-ISP-BGP
IP 0.0.0.0
Authentication none
Cost 2
Timers (seconds)
Hello Interval 20
Dead Interval 80
10.Using the CLI, enter the following commands to set the priority for the Router3-Internal
OSPF interface to ensure this interface will become the BDR.
config router ospf
config ospf-interface
edit Router3-Internal
set priority 250
next
end
Fortinet Technologies Inc. Page 421 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure OSPF on Router3 - CLI
config router ospf
set router-id 10.11.102.3
config area
edit 0.0.0.0
next
end
config network
edit 1
set prefix 10.11.0.0/255.255.255.0
next
edit 2
set prefix 172.20.120.0/255.255.255.0
next
end
config ospf-interface
edit "Router3-Internal"
set interface "port1"
set priority 255
next
edit "Router3-External"
set interface "port2"
next
edit Router3-ISP-BGP
set interface port3
set cost 2
next
end
end
Fortinet Technologies Inc. Page 422 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Advanced inter-area OSPF example
This example sets up an OSPF network at a large office. There are three areas, each with two
routers. Typically OSPF areas would not be this small, and if they were the areas would be
combined into one bigger area. However, the stub area services the accounting department
which is very sensitive about their network and do not want any of their network information
broadcast through the rest of the company. The backbone area contains the bulk of the
company network devices. The regular area was established for various reasons such as
hosting the company servers on a separate area with extra security.
One area is a small stub area that has no independent Internet connection, and only one
connection to the backbone area. That connection between the stub area and the backbone
area is only through a default route. No routes outside the stub area are advertised into that
area. Another area is the backbone, which is connected to the other two areas. The third area
has the Internet connection, and all traffic to and from the Internet must use that areas
connection. If that traffic comes from the stub area, then that traffic is treating the backbone like
a transit area that only uses it to get to another area.
In the stub area, a subnet of computers is running the RIP routing protocol and those routes
must be redistributed into the OSPF areas.
This section includes the following topics:
Network layout and assumptions
Configuring the FortiGate units
Configuring OSPF on the FortiGate units
Configuring other networking devices
Testing network configuration
Fortinet Technologies Inc. Page 423 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Figure 111:Advanced inter-area OSPF network topology
ISP router
(172.20.120.5)
Router4 (DR)
User
Network
Router3 (D
(DR)
DR)) User
Network
Router2 (BDR)
DR
R)
Area 2.2.2.2
Network Administration
Router1 (DR)
DR) (regular area)
User
Network
Area 1.1.1.1 is a stub area with one FortiGate unit OSPF router called Router1 (DR). Its only
access outside of that area is a default route to the backbone area, which is how it accesses the
Internet. Traffic must go from the stub area, through the backbone, to the third area to reach the
Internet. The backbone area in this configuration is called a transit area. Also in area 1.1.1.1
there is a RIP router that will be providing routes to the OSPF area through redistribution.
Area 0.0.0.0 is the backbone area, and has two FortiGate unit routers named Router2 (BDR) and
Router3 (DR).
Area 2.2.2.2 is a regular area that has an Internet connection accessed by both the other two
OSPF areas. There is only one FortiGate unit router in this area called Router4 (DR). This area is
more secure and requires MD5 authentication by routers.
All areas have user networks connected, but they are not important for configuring the network
layout for this example.
Internal interfaces are connected to internal user networks only. External1 interfaces are
connected to the 10.11.110.0 network, joining Area 1.1.1.1 and Area 0.0.0.0.
External2 interfaces are connected to the 10.11.111.0 network, joining Area 0.0.0.0 and Area
2.2.2.2. The ISP interface is called ISP.
Table 16: Routers, areas, interfaces, IP addresses for advanced OSPF network
Fortinet Technologies Inc. Page 424 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Table 16: Routers, areas, interfaces, IP addresses for advanced OSPF network
Note that other subnets can be added to the internal interfaces without changing the
configuration.
Assumptions
The FortiGate units used in this example have interfaces named port1, port2, and port3.
All FortiGate units in this example have factory default configuration, and are in NAT/Route
mode.
During configuration, if settings are not directly referred to they will be left at default settings.
Basic firewalls are in place to allow unfiltered traffic between all connected interfaces in both
directions.
This OSPF network is not connected to any other OSPF areas outside of this example.
The Internet connection is always available.
Other devices may be on the network, but do not affect this configuration.
Configuring Router1
Router1 is part of the Accounting network stub area (1.1.1.1).
Fortinet Technologies Inc. Page 425 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure Router1 interfaces - web-based manager
1. Go to System > Dashboard > Status.
2. Next to hostname, select Change.
3. Enter a hostname of Router1, and select OK.
4. Go to System > Network > Interfaces, edit port1, set the following information, and select
OK.
Alias internal
IP/Netmask 10.11.101.1/255.255.255.0
Administrative Status Up
Alias External1
IP/Netmask 10.11.110.1/255.255.255.0
Administrative Status Up
Configuring Router2
Router2 is part of the R&D network backbone area (0.0.0.0). Router2 and Router3 are in this
area. They provide a redundant connection between area 1.1.1.1 and area 2.2.2.2.
Router2 has three interfaces configured; one to the internal network, and two to Router3 for
redundancy.
Alias internal
IP/Netmask 10.11.102.2/255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 426 FortiOS Handbook - Advanced Routing for FortiOS 5.0
5. Edit port2 (external1), set the following information, and select OK.
Alias external1
IP/Netmask 10.11.110.2/255.255.255.0
Administrative Status Up
6. Edit port3 (external2), set the following information, and select OK.
Alias external2
IP/Netmask 10.11.111.2/255.255.255.0
Administrative Status Up
Configuring Router3
Router3 is part of the R&D network backbone area (0.0.0.0). Router2 and Router3 are in this
area. They provide a redundant connection between area 1.1.1.1 and area 2.2.2.2.
Alias internal
IP/Netmask 10.11.103.3/255.255.255.0
Administrative Status Up
5. Edit port2 (external1), set the following information, and select OK.
Alias external1
IP/Netmask 10.11.110.3/255.255.255.0
Fortinet Technologies Inc. Page 427 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Description Router2 first connection
Administrative Status Up
6. Edit port3 (external2), set the following information, and select OK.
Alias external2
IP/Netmask 10.11.111.3/255.255.255.0
Administrative Status Up
Configuring Router4
Router4 is part of the Network Administration regular area (2.2.2.2). This area provides internet
access for both area 1.1.1.1 and the backbone area.
This section configures interfaces and hostname.
Alias internal
IP/Netmask 10.11.101.4/255.255.255.0
Administrative Status Up
Alias external2
IP/Netmask 10.11.110.4/255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 428 FortiOS Handbook - Advanced Routing for FortiOS 5.0
7. Set the following information, and select OK.
Alias ISP
IP/Netmask 172.20.120.4/255.255.255.0
Administrative Status Up
Area 1.1.1.1
Type Stub
Authentication None
4. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.101.0/255.255.255.0
Area 1.1.1.1
5. In Interfaces, select Create New, set the following information, and select OK.
Name Accounting
IP 10.11.101.1
Authentication None
6. In Interfaces, select Create New, set the following information, and select OK.
Name Backbone1
IP 10.11.110.1
Authentication None
Fortinet Technologies Inc. Page 429 FortiOS Handbook - Advanced Routing for FortiOS 5.0
To configure OSPF on Router2 - web-based manager
1. Go to Router > Dynamic > OSPF.
2. Enter 10.11.102.2 for the Router ID and select Apply.
3. In Areas, select Create New, set the following information, and select OK.
Area 0.0.0.0
Type Regular
Authentication None
4. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.102.2/255.255.255.0
Area 0.0.0.0
5. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.110.2/255.255.255.0
Area 0.0.0.0
6. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.111.2/255.255.255.0
Area 0.0.0.0
7. In Interfaces, select Create New, set the following information, and select OK.
IP 10.11.102.2
Authentication None
8. In Interfaces, select Create New, set the following information, and select OK.
Name Backbone1
IP 10.11.110.2
Authentication None
9. In Interfaces, select Create New, set the following information, and select OK.
Name Backbone2
Fortinet Technologies Inc. Page 430 FortiOS Handbook - Advanced Routing for FortiOS 5.0
IP 10.11.111.2
Authentication None
Area 0.0.0.0
Type Regular
Authentication None
4. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.102.3/255.255.255.0
Area 0.0.0.0
5. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.110.3/255.255.255.0
Area 0.0.0.0
6. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.111.3/255.255.255.0
Area 0.0.0.0
7. In Interfaces, select Create New, set the following information, and select OK.
IP 10.11.103.3
Authentication None
8. In Interfaces, select Create New, set the following information, and select OK.
Name Backbone1
IP 10.11.110.3
Authentication None
Fortinet Technologies Inc. Page 431 FortiOS Handbook - Advanced Routing for FortiOS 5.0
9. In Interfaces, select Create New, set the following information, and select OK.
Name Backbone2
IP 10.11.111.3
Authentication None
Area 2.2.2.2
Type Regular
Authentication None
5. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.104.0/255.255.255.0
Area 0.0.0.0
6. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 10.11.111.0/255.255.255.0
Area 0.0.0.0
7. In Networks, select Create New, set the following information, and select OK.
IP/Netmask 172.20.120.0/255.255.255.0
Area 0.0.0.0
8. In Interfaces, select Create New, set the following information, and select OK.
IP 10.11.104.4
Authentication None
Fortinet Technologies Inc. Page 432 FortiOS Handbook - Advanced Routing for FortiOS 5.0
9. In Interfaces, select Create New, set the following information, and select OK.
Name Backbone2
IP 10.11.111.4
Authentication None
10.In Interfaces, select Create New, set the following information, and select OK.
Name ISP
IP 172.20.120.4
Authentication None
In this scenario, two FortiGate units have redundant links: one link between their WAN1
interfaces and another between their WAN2 interfaces.
Fortinet Technologies Inc. Page 433 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Network 10.160.0.0/23
Wan1
FortiGate 1
Wan2 Wan1
F
FortiGate 2
Wan2
Network 192.168.182.0/23
FortiGate 1 should learn the route to network 192.168.182.0 and FortiGate 2 should learn the
route to network 10.160.0.0. Under normal conditions, they should learn these routes through
the WAN1 link. The WAN2 link should be used only as a backup.
With the default settings, each FortiGate unit learns these routes from both WAN1 and WAN2.
FortiGate 1:
FGT1 # get router info ospf neighbor
OSPF process 0:
Neighbor ID Pri State Dead Time Address Interface
10.2.2.2 1 Full/Backup 00:00:33 10.182.0.187 wan1
10.2.2.2 1 Full/Backup 00:00:31 10.183.0.187 wan2
Fortinet Technologies Inc. Page 434 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Adjusting the route costs
On both FortiGate units, the cost of the route through WAN2 is adjusted higher so that this route
will only be used if the route through WAN1 is unavailable. The default cost is 10. The WAN2
route will be changed to a cost of 200.
On both FortiGate units:
config router ospf
config ospf-interface
edit "WAN2_higher_cost"
set cost 200
set interface "wan2"
end
Now both FortiGate units use only the WAN1 route:
FortiGate 1:
FGT1 # get router info routing-table ospf
O*E2 0.0.0.0/0 [110/10] via 10.182.0.187, wan1, 00:00:40
O 192.168.182.0/23 [110/20] via 10.182.0.187, wan1, 00:00:40
FortiGate 2:
FGT2 # get router info routing-table ospf
O 10.160.0.0/23 [110/20] via 10.182.0.57, wan1, 00:09:37
Fortinet Technologies Inc. Page 435 FortiOS Handbook - Advanced Routing for FortiOS 5.0
LSDB check on FortiGate 1:
FGT1 # get router info ospf database router lsa
Router Link States (Area 0.0.0.0)
LS age: 81
Options: 0x2 (*|-|-|-|-|-|E|-)
Flags: 0x0
LS Type: router-LSA
Link State ID: 10.1.1.1
Advertising Router: 10.1.1.1
LS Seq Number: 8000000b
Checksum: 0xe637
Length: 60
Number of Links: 3
LS age: 83
Options: 0x2 (*|-|-|-|-|-|E|-)
Flags: 0x2 : ASBR
LS Type: router-LSA
Link State ID: 10.2.2.2
Advertising Router: 10.2.2.2
LS Seq Number: 8000000e
Checksum: 0xfc9b
Length: 60
Number of Links: 3
Fortinet Technologies Inc. Page 436 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Link connected to: a Transit Network
(Link ID) Designated Router address: 10.183.0.187
(Link Data) Router Interface address: 10.183.0.187
Number of TOS metrics: 0
TOS 0 Metric: 200
Fortinet Technologies Inc. Page 437 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Intermediate System to Intermediate
System Protocol (IS-IS)
This section describes the Intermediate System to Intermediate System Protocol (IS-IS).
The following topics are included in this section:
IS-IS background and concepts
Troubleshooting IS-IS
Simple IS-IS example
Intermediate System to Intermediate System Protocol (IS-IS) allows routing of ISOs OSI
protocol stack Connectionless Network Service (CLNS). IS-IS is an Interior Gateway Protocol
(IGP) not intended to be used between Autonomous Systems (ASes).
This section contains:
Background
How IS-IS works
Parts and terminology of IS-IS
Background
IS-IS was developed by Digital Equipment Corporation and later standardized by ISO in 1992 as
ISO 19589 (see RFC 1142note this RFC is different from the ISO version). At roughly the same
time, the Internet Engineering Task Force developed OSPF (see Open Shortest Path First
(OSPF) on page 396). After the initial version, IP support was added to IS-IS and this version
was called Integrated IS-IS (see RFC 1195). Its widespread use started when an early version of
IS-IS was included with BSD v4.3 Linux as the routed daemon. The routing algorithm used by
IS-IS, the BellmanFord algorithm, first saw widespread use as the initial routing algorithm of
the ARPANET.
IS-IS is a link state protocol well-suited to smaller networks that is in widespread use and has
near universal support on routing hardware. It is quick to configure, and works well if there are
no redundant paths. However, IS-IS updates are sent out node-by-node, so it can be slow to
find a path around network outages. IS-IS also lacks good authentication, can not choose
routes based on different quality of service methods, and can create network loops if you are
not careful. IS-IS uses Djikstras algorithm to find the best path, like OSPF.
While OSPF is more widely known, IS-IS is a viable alternative to OSPF in enterprise networks
and ISP infrastructures, largely due to its native support for IPv6 and its non-disruptive methods
for splitting, merging, migrating, and renumbering network areas.
The FortiGate implementation supports both IS-IS (see RFCs 1142 and 1162) and Integrated
IS-IS (see RFCs 1195 and 5308).
Page 438
How IS-IS works
As one of the original modern dynamic routing protocols, IS-IS is straightforward. Its routing
algorithm is not complex, there are some options to allow fine tuning, and it is straightforward to
configure IS-IS on FortiGate units.
From RFC 1142:
The routing algorithm used by the Decision Process is a shortest path first (SPF) algorithm.
Instances of the algorithm are run independently and concurrently by all intermediate
systems in a routing domain. IntraDomain routing of a PDU occurs on a hop-by-hop basis:
that is, the algorithm determines only the next hop, not the complete path, that a data PDU
will take to reach its destination.
TLV
IS-IS uses type-length-variable (TLV) parameters to carry information in Link-State PDUs (LSPs).
Each IS-IS LSP consists of a variable-length header to which TLVs are appended in order to
extend IS-IS for IP routing. The TLV field consists of one octet of type (T), one octet of length (L),
and L octets of Value (V). They are included in all of the IS-IS Packet types. For a complete
breakdown of the LSP, refer to LSP structure on page 439.
In IS-IS, TLVs are used to determine route-leaking and authentication, and are also used for
IPv4 and IPv6 awareness and reachability.
To determine which TLVs are responsible for route-leaking, refer to Default routing on
page 442.
To determine which TLVs are responsible for authentication, refer to Authentication on
page 443.
To determine which TLVs are responsible for IPv4 and IPv6 awareness and reachability, refer
to Integrated IS-IS on page 444.
For a complete list of reserved TLV codepoints, refer to RFC 3359.
LSP structure
It is difficult to fully understand a routing protocol without knowing what information is carried in
its packets. Knowing how routers exchange each type of information will help you better
understand the IS-IS protocol and will allow you to configure your network more appropriately.
This section provides information on the contents of the IS-IS LSP. LSPs describe the network
topology and can include IP routes and checksums.
Fortinet Technologies Inc. Page 439 FortiOS Handbook - Advanced Routing for FortiOS 5.0
order for adjacencies to form in IS-IS, the NSEL must necessarily be set to zero, to indicate this
system. The total NET can be anywhere between 8 and 20 bytes long due to the support for
variable length area addressing.
The following diagram identifies the individual parts of the NSAP, with explanations below.
Table 17: NSAP and NET example
AFI The Authority and Format Identifier (AFI) specifies the format of the addressing family
used. IS-IS is designed to carry routing information for several different protocols. Each entry
has an address family identifier that identifies the globally unique Interdomain Part (IDP). For
example, 49 is the AFI for private addresses, whereas 47 is the AFI for international
organizations.
IDI The Initial Domain Identifier (IDI) identifies the routing domain within an interconnected
network. The length of the IDI is typically determined by the AFI. If you are using an AFI of 49,
you do not need to specify an IDI, since the network is private.
HODSP The High Order Domain-Specific Part (HODSP) identifies the unique address within
a specific routing domain. Together, the AFI, IDI, and HODSP define the area address. All of the
nodes within an area must have the same area address.
System ID The System ID represents the 6-8 byte router identifier. The ID could be Media
Access Control (MAC) format, as in the example above, or a static length IP address expressed
in binary-coded decimal (BCD) format.
NSEL The n-selector (NSEL), as previously described, identifies the network layer transport
service and must always be set to zero for IS-IS NETs.
Fortinet Technologies Inc. Page 440 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Unlike OSPF, which elects a designated router (DR) and backup designated router (BDR), the
DIS has no backup and determines the election of a new DIS whenever a router is added to the
LAN or whenever the current DIS drops. A backup DIS is irrelevant since all of the routers on an
IS-IS system are synchronized, and the short Hello interval used by the DIS quickly detects
failures and the subsequent replacement of the DIS.
Synchronization of all the nodes in an IS-IS area could prove troublesome when updating the
network infrastructure, and would demand ever-increasing resources each time a new router is
added (at an exponential scale). For this purpose the DIS creates a pseudonode, which is
essentially a virtual, logical node representing the LAN. The pseudonode requests adjacency
status from all the routers in a multi-access network by sending IS-IS Hello (IIH) PDUs to Level 1
and Level 2 routers (where Level 1 routers share the same address as the DIS and Level 2
routers do not). Using a pseudonode to alter the representation of the LAN in the link-state
database (LSD) greatly reduces the amount of adjacencies that area routers have to report. In
essence, a pseudonode collapses a LAN topology, which allows a more linear scale to link-state
advertising.
In order to maintain the database synchronization, the DIS periodically sends complete
sequence number packets (CSNPs) to all participating routers.
Packet types
Four general packet types (PDUs) are communicated through IS-IS, appearing at both Level 1
and Level 2. They are described below.
Intermediate System-to-Intermediate System Hello (IIH) PDU As mentioned previously,
the IIH PDU, or Hello packet, detects neighboring routers and indicates to the pseudonode the
areas adjacency mesh. The Hello packet, flooded to the multicast address, contains the system
ID of the sending router, the holding time, the circuit type of the interface on which the PDU was
sent, the PDU length, the DIS identifier, and the interface priority (used in DIS election). The
Hello packet also informs its area routers that it is the DIS.
Hello packets are padded to the maximum IS-IS PDU size of 1492 bytes (the full MTU size) to
assist in the detection of transmission errors with large frames or with MTU mismatches
between adjacencies.
The DIS typically floods Hello packets to the entire LAN every three seconds.
Link-state PDU (LSP) The LSP contains information about each router in an area and its
connected interfaces. LSPs are refreshed periodically and acknowledged on the network by
way of sequence number PDUs. If new LSP information is found, based on the most recent
complete sequence number PDU (CSNP), then out-of-date entries in the link-state database
(LSDB) are removed and the LSDB is updated.
For a more detailed breakdown of the LSP, see LSP structure on page 439.
Complete sequence number PDU (CSNP) CSNPs contain a list of all LSPs in the current
LSDB. The CSNP informs other area routers of missing or outdated links in the adjacency mesh.
The receiving routers then use this information to update their own database to ensure that all
area routers converge.
In contrast to Hello packets, CSNPs are sent every ten seconds and only between neighbor. In
other words, they are never flooded.
Partial sequence number PDU (PSNP) PSNPs are used to request and acknowledge LSP
information from an adjacency. When a router compares a CSNP with its local database and
determines a discrepancy, the router requests an updated LSP using a PSNP. Once received,
the router stores the LSP in its local database and responds to the DIS with acknowledgement.
Fortinet Technologies Inc. Page 441 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Default routing
The default route is used if either there are no other routes in the routing table or if none of the
other routes apply to a destination. Including the gateway in the default route gives all traffic a
next-hop address to use when leaving the local network. The gateway address is normally
another router on the edge of the local network.
FortiGate units come with a default static route with an IPv4 address of 0.0.0.0, an
administration distance of 10, and a gateway IPv4 address. Beginner administrators can use the
default route settings until a more advanced configuration is warranted.
By default, all routes are displayed in the Routing Monitor list. To display the routes in the
routing table, go to Route > Monitor > Routing Monitor.
Route leaking
Route leaking is the term used to describe the bi-directional flow of information between
internal and external routing interfaces. By default, IS-IS leaks routing information from a Level 1
area into a Level 2 area. In order to leak Level 2 routing information into a Level 1 area, you must
configure an export policy. Whether or not a route is leaked is determined by the ATT bit, using
TLV 128 (for internal IP reachability) and TLV 130 (for external IP address information). For more
information on TLVs, see Troubleshooting IS-IS on page 445.
To configure IS-IS route leaking, use the following CLI commands.
1. On a Level 1-2 router:
config router isis
set redistribute-l2 enable
end
2. On a Level 1 router:
config router isis
get router info routing-table isis
get router info isis route
end
Timer options
IS-IS uses various timers to regulate its performance including a garbage timer, update timer,
and timeout timer. The FortiGate unit default timer settings (30, 180, and 120 seconds
respectively) are effective in most configurationsif you change these settings, ensure that the
new settings are compatible with local routers and access servers.
Fortinet Technologies Inc. Page 442 FortiOS Handbook - Advanced Routing for FortiOS 5.0
You can configure the three IS-IS timers in the CLI, using the following commands:
config router isis
set garbage-timer
set update-timer
set timeout-timer
end
You will find more information on each timer below.
Garbage timer
The garbage timer is the amount of time (in seconds) that the DIS will advertise a route as being
unreachable before deleting the route from the routing table. If this timer is shorter, it will keep
more up-to-date routes in the routing table and remove old ones faster. This results in a smaller
routing table which is useful if you have a very large network, or if your network changes
frequently.
Update timer
The update timer determines the interval between routing updates. Generally, this value is set to
30 seconds. There is some randomness added to help prevent network traffic congestion,
which could result from all routers simultaneously attempting to update their neighbors. The
update timer should be at least three times smaller than the timeout timer, otherwise you will
experience an error.
If you are experiencing significant traffic on your network, you can increase this interval to send
fewer updates per minute. However, ensure you increase the interval for all the routers on your
network or you will experience timeouts that will degrade your network speed.
Timeout timer
The timeout timer is the maximum amount of time (in seconds) that a route is considered
reachable while no updates are received for the route. This is the maximum time the DIS will
keep a reachable route in the routing table while no updates for that route are received. If the
DIS receives an update for the route before the timeout period expires, the timer is restarted.
The timeout period should be at least three times longer than the update period, otherwise you
will experience an error.
If you are experiencing problems with routers not responding in time to updates, increase this
timer. However, remember that longer timeout intervals result in longer overall update periods
it may be considerable time before the DIS is done waiting for all the timers to expire on
unresponsive routes.
Authentication
In routing protocols, it is typically desirable to establish authentication rules that prevent
malicious and otherwise unwanted information from being injected into the routing table. IS-IS
routing protocol utilizes TLV 10 to establish authentication. For more information on TLVs, see
TLV on page 439.
Initially, IS-IS used plain Clear Text to navigate the authentication rules, but this was found to be
insecure since the Clear Text packets were unencrypted and could be exposed to packet
sniffers. As per RFC 3567, HMAC-MD5 and Enhanced Clear Text authentication features were
introduced to IS-IS, both of which encrypt authentication data, making them considerably more
secure than using plain Clear Text authentication.
HMAC-MD5 authentication
Hashed Message Authentication Codes - Message Digest 5 (HMAC-MD5) is a mechanism for
applying a cryptographic hash function to the message authentication process. It is applied at
Fortinet Technologies Inc. Page 443 FortiOS Handbook - Advanced Routing for FortiOS 5.0
both Level 1 and Level 2 routing. In IS-IS, an HMAC-MD5 can be applied to each type of LSP,
on different interfaces, and with different passwords.
Authentication data is hashed using an AH (Authentication Header) key. From RFC 2085:
The AH Key is used as a shared secret between two communicating parties. The Key is not
a cryptographic key as used in a traditional sense. Instead, the AH key (shared secret) is
hashed with the transmitted data and thus, assures that an intervening party cannot
duplicate the authentication data. [...] Implementation should, and as frequently as possible,
change the AH key. Keys need to be chosen at random, or generated using a
cryptographically strong pseudo-random generator seeded with a random seed.
Clear Text authentication uses the configuration commands area-password and
domain-password for authentication, but when migrating from Clear Text authentication to
HMAC-MD5, these command settings are automatically overwritten.
By the year 2005, the MD5 hash function had been identified as vulnerable to collision search
attacks and various weaknesses. While such vulnerabilities do not compromise the use of MD5
within HMAC, administrators need to be aware of potential developments in cryptanalysis and
cryptographic hash functions in the likely event that the underlying hash function needs to be
replaced.
Integrated IS-IS
Integrated IS-IS is an extended version of IS-IS that includes support for both IPv4 and IPv6.
IPv4 and IPv6 interface addresses are determined by TLVs 132 and 232, respectively. The
parameter responsible for IPv6 reachability is TLV 236. For more information on TLVs, see
Troubleshooting IS-IS on page 445.
The FortiGate unit command config router isis is almost the same except that IPv6
addresses are used. Also, if you are going to use prefix or access lists with Integrated IS-IS, you
must use the config router access-list6 or config prefix-list6 versions of those
commands.
If you want to route IPv4 traffic over an IPv6 network, you can use the command config
system ipv6-tunnel to configure the FortiGate unit to do this. The IPv6 interface is
configured under config system interface. All subnets between the source and
destination addresses must support IPv6. This command is not supported in Transparent mode.
Fortinet Technologies Inc. Page 444 FortiOS Handbook - Advanced Routing for FortiOS 5.0
For example, you want to set up a tunnel on the port1 interface starting at 2002:C0A8:3201:: on
your local network and tunnel it to address 2002:A0A:A01:: where it will need access to an IPv4
network again. Use the following command:
config system ipv6-tunnel
edit test_tunnel
set destination 2002:A0A:A01::
set interface port1
set source 2002:C0A8:3201::
end
end
Troubleshooting IS-IS
If you want to troubleshoot Integrated IS-IS, it is the same as with IS-IS but you must specify
the different protocol, and use IPv6 addresses. This applies to commands such as get router
info6 when you want to see the routing table, or other related information.
This section includes:
Routing loops
Split horizon and Poison reverse updates
Routing loops
Normally in routing, a path between two addresses is chosen and traffic is routed along that
path from one address to the other. When there is a routing loop, that normal path doubles back
on itself creating a loop. When there are loops, the network has problems.
A routing loop happens when a normally functioning network has an outage, and one or more
routers are offline. When packets encounter this, an alternate route is attempted to maneuver
around the outage. During this phase it is possible for a route to be attempted that involves
going back a hop, and trying a different hop forward. If that hop forward is blocked by the
outage as well, a hop back and possibly the original hop forward may be selected. You can see
if this continues, how it can consume not only network bandwidth but also many resources on
those routers affected. The worst part is this situation will continue until the network
administrator changes the router settings, or the downed routers come back online.
Fortinet Technologies Inc. Page 445 FortiOS Handbook - Advanced Routing for FortiOS 5.0
How can you spot a routing loop
Any time network traffic slows down, you will be asking yourself if it is a network loop or not.
Often slowdowns are normal, they are not a full stoppage, and normal traffic resumes in a short
period of time.
If the slow down is a full halt of traffic or a major slowdown does not return to normal quickly,
you need to do serious troubleshooting quickly.
Some methods to troubleshoot your outage include:
Checking your logs
Using SNMP network monitoring
Using dead gateway detection and e-mail alerts
Looking at the packet flow
If you arent running SNMP, dead gateway detection, or you have non-Fortinet routers in your
network, you can use networking tools such as ping and traceroute to define the outage on your
network and begin to fix it.
Fortinet Technologies Inc. Page 446 FortiOS Handbook - Advanced Routing for FortiOS 5.0
problems, the log will be filling up quickly, and the FortiGate units resources will be
overused.
9. Select OK.
10.Configure SNMP host (manager) software on your administration computer. This will monitor
the SNMP information sent out by the FortiGate unit. Typically you can configure this
software to alert you to outages or CPU spikes that may indicate a routing loop.
To detect possible routing loops with dead gateway detection and e-mail alerts
1. To configure dead gateway detection, go to Router > Static > Settings and select
Create New.
2. Set the Ping Interval (how often to send a ping), and Failover Threshold (how many lost pings
is considered a failure). A smaller interval and smaller number of lost pings will result in faster
detection, but will create more traffic on your network.
3. To configure interface status change notification, go to Log & Report > Log Config > Alert
E-mail.
4. After you enter your email details, select the events you want to be alerted about in our
case Configuration changes. You may also want to log CPU and Memory usage as a network
outage will cause your CPU activity to spike.
If you have VDOMs configured, you will have to enter the basic SMTP server information in the
Global section, and the rest of the configuration within the VDOM that includes this interface.
After this configuration, when this interface on the FortiGate unit cannot connect to the next
router, the FortiGate unit will bring down the interface and alert you with an email to the outage.
Fortinet Technologies Inc. Page 447 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Split horizon and Poison reverse updates
Split horizon is best explained with an example. You have three routers linked serially, lets call
them A, B, and C. A is only linked to B, C is only linked to B, and B is linked to both A and C. To
get to C, A must go through B. If the link to C goes down, it is possible that B will try to use As
route to get to C. This route is A-B-C, so it will not work. However, if B tries to use it this begins
an endless loop.
This situation is called a split horizon because from Bs point of view the horizon stretches out in
each direction, but in reality it only is on one side.
Poison reverse is the method used to prevent routes from running into split horizon problems.
Poison reverse poisons routes away from the destination that use the current router in their
route to the destination. This poisoned route is marked as unreachable for routers that cannot
use it. In IS-IS this means that route is marked with a distance of 16.
Fortinet Technologies Inc. Page 448 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Network layout and assumptions
Routing domains
FGT2
g IS-
tin IS
r ou L
RIP L1 48 Are 2 rou
IS 00 a- tin
RTR1 do IS- ea - 00
48
g
ma Ar
in
PF g
tin
OS in FGT1
F
FG
GT1 r ou FGT3
FGT3
ma L2 49
do IS 00
IS- ea -
Ar
RTR2
FGT4
FGT2
Local subnets
10.1.1.0/24
10.2.2.0/24
24 . 10
.0/ .2 3 Po 2 .40
10 0 rt rt 2 .40
.10
.10 .3 0.3 Po .0/
10 24
RTR1 .0/
24
Po 3
.1 ort wa .
rt 2
P n1 1
/24
2 0.0 t 5 24 .1 1
.20
.
Po
r F
FG
GT1
FGT1 0 .0/ z FGT3
FGT3
10 0.5 dm
1 0.5
Local subnets .2 an1
10.3.3.0/24 w
10.4.4.0/24 RTR2
FGT4
Loopback
10.60.60.1/32
Expectations
FGT4 must get the IS-IS route updates for RTR1 and RTR2 local subnets (10.1.1.0, 10.2.2.0,
10.3.3.0, 10.4.4.0).
RTR1 must receive (via RIP2) the loopback subnet of FGT4 (10.60.60.1/32).
Fortinet Technologies Inc. Page 449 FortiOS Handbook - Advanced Routing for FortiOS 5.0
CLI configuration
The following CLI configuration occurs on each FortiGate (as identified), including only the
relevant parts.
FGT1
config router isis
config isis-interface
edit "port3"
set circuit-type level-1
set network-type broadcast
set status enable
next
end
config isis-net
edit 1
set net 49.0048.1921.6818.2136.00
next
end
config redistribute "connected"
end
config redistribute "rip"
set status enable
set level level-1
end
config redistribute "ospf"
set status enable
set level level-1
end
end
config router rip
config interface
edit "port2"
set receive-version 2
set send-version 2
next
end
config network
edit 1
set prefix 10.10.10.0 255.255.255.0
next
end
config redistribute "isis"
set status enable
end
end
Fortinet Technologies Inc. Page 450 FortiOS Handbook - Advanced Routing for FortiOS 5.0
FGT2
config router isis
config isis-interface
edit "port3"
set circuit-type level-1
set network-type broadcast
set status enable
next
edit "port2"
set network-type broadcast
set status enable
next
end
config isis-net
edit 1
set net 49.0048.1221.6818.2110.00
next
end
set redistribute-l1 enable
set redistribute-l2 enable
end
FGT3
config router isis
set is-type level-2-only
config isis-interface
edit "wan1"
set network-type broadcast
set status enable
next
edit "dmz1"
set network-type broadcast
set status enable
next
end
config isis-net
edit 1
set net 49.0048.1921.6818.2108.00
next
edit 2
set net 49.0049.1921.6818.2108.00
next
end
end
Fortinet Technologies Inc. Page 451 FortiOS Handbook - Advanced Routing for FortiOS 5.0
FGT4
config router isis
set is-type level-2-only
config isis-interface
edit "wan1"
set network-type broadcast
set status enable
next
end
config isis-net
edit 1
set net 49.0049.1721.0160.1004.00
next
end
config redistribute "connected"
set status enable
end
end
Verification
Once the network has been configured, you need to test that it works as expected. Use the
following CLI commands on the devices indicated.
Verification on FGT2, which is the border between L1 and L2 routing levels; looking at
IS-IS information
FGT2 # get router info isis interface
Result:
port2 is up, line protocol is up
Routing Protocol: IS-IS ((null))
Network Type: Broadcast
Circuit Type: level-1-2
Local circuit ID: 0x01
Extended Local circuit ID: 0x00000003
Local SNPA: 0009.0f85.ad8c
Fortinet Technologies Inc. Page 452 FortiOS Handbook - Advanced Routing for FortiOS 5.0
IP interface address:
10.40.40.2/24
IPv6 interface address:
Level-1 Metric: 10/10, Priority: 64, Circuit ID: 1221.6818.2110.01
Number of active level-1 adjacencies: 0
Level-2 Metric: 10/10, Priority: 64, Circuit ID: 1221.6818.2110.01
Number of active level-2 adjacencies: 1
Next IS-IS LAN Level-1 Hello in 6 seconds
Next IS-IS LAN Level-2 Hello in 1 seconds
port3 is up, line protocol is up
Routing Protocol: IS-IS ((null))
Network Type: Broadcast
Circuit Type: level-1
Local circuit ID: 0x02
Extended Local circuit ID: 0x00000004
Local SNPA: 0009.0f85.ad8d
IP interface address:
10.30.30.2/24
IPv6 interface address:
Level-1 Metric: 10/10, Priority: 64, Circuit ID: 1221.6818.2110.02
Number of active level-1 adjacencies: 1
Next IS-IS LAN Level-1 Hello in 2 seconds
Fortinet Technologies Inc. Page 453 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Local SNPA: 0009.0f04.0794
IP interface address:
10.40.40.1/24
IPv6 interface address:
Level-2 Metric: 10/10, Priority: 64, Circuit ID: 1221.6818.2110.01
Number of active level-2 adjacencies: 1
Next IS-IS LAN Level-2 Hello in 3 seconds
Verification on FGT4 that the remote subnets from RTR1 and RTR2 are in the routing table
and learned with IS-IS
FGT4 # get router info routing-table all
Result:
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default
Fortinet Technologies Inc. Page 454 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Troubleshooting
The following diagnose commands are available for further IS-IS troubleshooting and will
display all IS-IS activity (sent and received packets):
FGT # diagnose ip router isis level info
FGT # diagnose ip router isis all enable
FGT # diagnose debug enable
...to stop the debug type output :
FGT # diagnose ip router isis level none
Output and interpretation depends on the issue faced. You can provide this information to TAC
if you open a support ticket.
Fortinet Technologies Inc. Page 455 FortiOS Handbook - Advanced Routing for FortiOS 5.0
Chapter 3 Authentication for FortiOS 5.0
Fortinet Technologies Inc. Page 456 FortiOS Handbook - Authentication for FortiOS 5.0
Introduction to authentication
Identifying users and other computersauthenticationis a key part of network security. This
section describes some basic elements and concepts of authentication.
The following topics are included in this section:
What is authentication?
Methods of authentication
Types of authentication
Users view of authentication
FortiGate administrators view of authentication
What is authentication?
Businesses need to authenticate people who have access to company resources. In the
physical world this may be a swipe card to enter the building, or a code to enter a locked door.
If a person has this swipe card or code, they have been authenticated as someone allowed in
that building or room.
Authentication is the act of confirming the identity of a person or other entity. In the context of a
private computer network, the identities of users or host computers must be established to
ensure that only authorized parties can access the network. The FortiGate unit enables
controlled network access and applies authentication to users of security policies and VPN
clients.
Methods of authentication
FortiGate unit authentication is divided into three basic types: password authentication for
people, certificate authentication for hosts or endpoints, and two-factor authentication for
additional security beyond just passwords. An exception to this is that FortiGate units in an HA
cluster and FortiManager units use password authentication.
Password authentication verifies individual user identities, but access to network resources is
based on membership in user groups. For example, a security policy can be configured to
permit access only to the members of one or more user groups. Any user who attempts to
access the network through that policy is then authenticated through a request for their
username and password.
Methods of authentication include:
Local password authentication
Server-based password authentication
Certificate-based authentication
Two-factor authentication
Page 457
Local password authentication
The simplest authentication is based on user accounts stored locally on the FortiGate unit. For
each account, a username and password is stored. The account also has a disable option so
that you can suspend the account without deleting it.
Local user accounts work well for a single-FortiGate installation. If your network has multiple
FortiGate units that will use the same accounts, the use of an external authentication server can
simplify account configuration and maintenance.
You create local user accounts in the web-based manager under User & Device > User >
User Definition. This page is also used to create accounts where an external authentication
server stores and verifies the password.
Certificate-based authentication
An RSA X.509 server certificate is a small file issued by a Certificate Authority (CA) that is
installed on a computer or FortiGate unit to authenticate itself to other devices on the network.
When one party on a network presents the certificate as authentication, the other party can
validate that the certificate was issued by the CA. The identification is therefore as trustworthy
as the Certificate Authority (CA) that issued the certificate.
To protect against compromised or misused certificates, CAs can revoke any certificate by
adding it to a Certificate Revocation List (CRL). Certificate status can also be checked online
using Online Certificate Status Protocol (OCSP).
RSA X.509 certificates are based on public-key cryptography, in which there are two keys: the
private key and the public key. Data encrypted with the private key can be decrypted only with
the public key and vice versa. As the names suggest, the private key is never revealed to
anyone and the public key can be freely distributed. Encryption with the recipients public key
creates a message that only the intended recipient can read. Encryption with the senders
private key creates a message whose authenticity is proven because it can be decrypted only
with the senders public key.
Fortinet Technologies Inc. Page 458 FortiOS Handbook - Authentication for FortiOS 5.0
Server certificates contain a signature string encrypted with the CAs private key. The CAs
public key is contained in a CA root certificate. If the signature string can be decrypted with the
CAs public key, the certificate is genuine.
Certificate authorities
A certificate authority can be:
an organization, such as VeriSign Inc., that provides certificate services
a software application, such as Microsoft Certificate Services or OpenSSH
For a company web portal or customer-facing SSL VPN, a third-party certificate service has
some advantages. The CA certificates are already included in popular web browsers and
customers trust the third-party. On the other hand, third-party services have a cost.
For administrators and for employee VPN users, the local CA based on a software application
provides the required security at low cost. You can generate and distribute certificates as
needed. If an employee leaves the organization, you can simply revoke their certificate.
Two-factor authentication
A user can be required to provide both something they know (their username and password
combination) and something they have (certificate or a random token code). Certificates are
installed on the users computer.
Two-factor authentication is available for PKI users. For more information, see Certificate on
page 495.
Another type of two-factor authentication is to use a randomly generated token (multi-digit
number) along with the username and password combination. One method is a FortiToken a
one time passcode (OTP) generator that generates a unique code every 60 seconds. Others use
email or SMS text messaging to deliver the random token code to the user or administrator.
When one of these methods is configured, the user enters this code at login after the username
and password have been verified. The FortiGate unit verifies the token code after as well as the
password and username. For more information, see Two-factor authentication on page 494
Types of authentication
FortiOS supports two different types of authentication based on your situation and needs.
Security policy authentication, or identity-based policies, is easily applied to all users logging on
to a network, or network service. For example if a group of users on your network such as the
accounting department who have access to sensitive data need to access the Internet, it is a
good idea to make sure the user is a valid user and not someone trying to send company
secrets to the Internet. Security policy authentication can be applied to as many or as few users
Fortinet Technologies Inc. Page 459 FortiOS Handbook - Authentication for FortiOS 5.0
as needed, and it supports a number of authentication protocols to easily fit with your existing
network.
VPN authentication can be for both the remote VPN device as well as the VPN users. VPNs are
used to communicate with locations outside the company network as if they were part of the
company network. This level of trust, once a VPN is established, is easily established with
authentication to verify the remote user is in fact a valid user. In this situation without
authentication, anyone malicious or otherwise could connect to the company network with
potentially full access.
FSSO
Fortinet Single Sign on (FSSO) provides seamless authentication support for Microsoft
Windows Active Directory (AD) and Novell eDirectory users in a FortiGate environment.
On a Microsoft Windows or Novell network, users authenticate with the Active Directory or
Novell eDirectory at logon. FSSO provides authentication information to the FortiGate unit so
that users automatically get access to permitted resources. See Introduction to FSSO agents
on page 564.
NTLM
The NT LAN Manager (NTLM) protocol is used when the MS Windows Active Directory (AD)
domain controller can not be contacted. NTLM is a browser-based method of authentication.
The FSSO software is installed on each AD server and the FortiGate unit is configured to
communicate with each FSSO client. When a user successfully logs into their Windows PC (and
is authenticated by the AD Server), the FSSO client communicates the user's name, IP address,
and group login information to the FortiGate unit. The FortiGate unit sets up a temporary access
policy for the user, so when they attempt access through the firewall they do not need to
re-authenticate. This model works well in environments where the FSSO client can be installed
on all AD servers.
In system configurations where it is not possible to install FSSO clients on all AD servers, the
FortiGate unit must be able to query the AD servers to find out if a user has been properly
authenticated. This is achieved using the NTLM messaging features of Active Directory and
Internet Explorer.
Even when NTLM authentication is used, the user is not asked again for their username and
password. Internet Explorer stores the users credentials and the FortiGate unit uses NTLM
messaging to validate them in the Windows AD environment.
Note that if the authentication reaches the timeout period, the NTLM message exchange
restarts. For more information on NTLM, see NTLM authentication on page 524 and FSSO
NTLM authentication support on page 569.
Fortinet Technologies Inc. Page 460 FortiOS Handbook - Authentication for FortiOS 5.0
Certificates
Certificates can be used as part of an identity-based policy. All users being authenticated
against the policy are required to have the proper certificate. See Certificate-based
authentication on page 458
RADIUS SSO
RADIUS Single Sign-On (RSSO) is a remote authentication method that does not require any
local users to be configured, and relies on RADIUS Start records to provide the FortiGate unit
with authentication information. That information identifies the user and user group, which is
then matched using a security policy. See SSO using RADIUS accounting records on
page 602.
VPN authentication
Authentication involves authenticating the user. In IPsec VPNs authenticating the user is
optional, but authentication of the peer device is required.
This section includes:
Authenticating IPsec VPN peers (devices)
Authenticating IPsec VPN users
Authenticating SSL VPN users
Authenticating PPTP and L2TP VPN users
Fortinet Technologies Inc. Page 461 FortiOS Handbook - Authentication for FortiOS 5.0
You can supplement either preshared key or certificate authentication by requiring the other
peer to provide a specific peer ID value. The peer ID is a text string configured on the peer
device. On a FortiGate peer or FortiClient Endpoint Security peer, the peer ID provided to the
remote peer is called the Local ID.
Single Sign-On means that users logged on to a computer network are authenticated for
access to network resources through the FortiGate unit without having to enter their username
and password again. FortiGate units directly provide Single Sign On capability for:
Microsoft Windows networks using either Active Directory or NTLM authentication
Novell networks, using eDirectory
Fortinet Technologies Inc. Page 462 FortiOS Handbook - Authentication for FortiOS 5.0
In combination with a FortiAuthenticator unit, the FortiGate unit can provide Single Sign-On
capability that integrates multiple external network authentication systems such as Windows
Active Directory, Novell e-Directory, RADIUS and LDAP. The FortiAuthenticator unit gathers user
logon information from all of these sources and sends it to the FortiGate unit.
Through the SSO feature, the FortiGate unit knows the username, IP address, and external user
groups to which the user belongs. When the user tries to access network resources, the
FortiGate unit selects the appropriate security policy for the destination. If the user belongs to
one of the permitted user groups, the connection is allowed.
For detailed information about SSO, see
SSO using a FortiAuthenticator unit on page 550
Agent-based FSSO on page 563
From the users point of view, they see a request for authentication when they try to access a
protected resource, such as an FTP repository of intellectual property or simply access a
website on the Internet. The way the request is presented to the user depends on the method of
access to that resource.
VPN authentication usually controls remote access to a private network.
After a defined period of user inactivity (the authentication timeout, defined by the FortiGate
administrator), the users access expires. The default is 5 minutes. To access the resource, the
user will have to authenticate again.
Fortinet Technologies Inc. Page 463 FortiOS Handbook - Authentication for FortiOS 5.0
SSL VPN is a form of VPN that can be used with a standard Web browser. There are two modes
of SSL VPN operation (supported in NAT/Route mode only):
web-only mode, for remote clients equipped with a web-browser only
tunnel mode, for remote computers that run a variety of client and server applications.
After a defined period of user inactivity on the VPN connection (the idle timeout, defined by the
FortiGate administrator), the users access expires. The default is 30 minutes. To access the
resource, the user will have to authenticate again.
Go to User & Device > Authentication > Settings to configure authentication timeout, protocol
support, and authentication certificates.
When user authentication is enabled within a security policy, the authentication challenge is
normally issued for any of the four protocols (depending on the connection protocol):
HTTP (can also be set to redirect to HTTPS)
HTTPS
FTP
Telnet.
Fortinet Technologies Inc. Page 464 FortiOS Handbook - Authentication for FortiOS 5.0
The selections made in the Protocol Support list of the Authentication Settings screen control
which protocols support the authentication challenge. Users must connect with a supported
protocol first so they can subsequently connect with other protocols. If HTTPS is selected as a
method of protocol support, it allows the user to authenticate with a customized Local
certificate.
When you enable user authentication within a security policy, the security policy user will be
challenged to authenticate. For user ID and password authentication, users must provide their
user names and passwords. For certificate authentication (HTTPS or HTTP redirected to HTTPS
only), you can install customized certificates on the unit and the users can also have customized
certificates installed on their browsers. Otherwise, users will see a warning message and have
to accept a default Fortinet certificate.
When you use certificate authentication, if you do not specify any certificate when you create
the security policy, the global settings will be used. If you specify a certificate, the per-policy
setting will overwrite the global setting.
Fortinet Technologies Inc. Page 465 FortiOS Handbook - Authentication for FortiOS 5.0
Authentication servers
FortiGate units support the use of external authentication servers. An authentication server can
provide password checking for selected FortiGate users or it can be added as a member of a
FortiGate user group.
If you are going to use authentication servers, you must configure the servers before you
configure FortiGate users or user groups that require them.
MAC OS and iOS devices, including iPhones and iPads, can perform user authentication with
FortiOS units using RADIUS servers, but not with LDAP or TACACS+ servers.
FortiAuthenticator servers
RADIUS servers
Remote Authentication and Dial-in User Service (RADIUS) is a broadly supported client-server
protocol that provides centralized authentication, authorization, and accounting functions.
RADIUS clients are built into gateways that allow access to networks such as Virtual Private
Network servers, Network Access Servers (NAS), as well as network switches and firewalls that
use authentication. FortiGate units fall into the last category.
RADIUS servers use UDP packets to communicate with the RADIUS clients on the network to
authenticate users before allowing them access to the network, to authorize access to
resources by appropriate users, and to account or bill for those resources that are used.
RADIUS servers are currently defined by RFC 2865 (RADIUS) and RFC 2866 (Accounting), and
listen on either UDP ports 1812 (authentication) and 1813 (accounting) or ports 1645
(authentication) and 1646 (accounting) requests. RADIUS servers exist for all major operating
systems.
Page 466
You must configure the RADIUS server to accept the FortiGate unit as a client. FortiGate units
use the authentication and accounting functions of the RADIUS server.
FortiOS does not accept all characters from auto generated keys from MS Windows 2008.
These keys are very long and as a result RADIUS authentication will not work. Maximum key
length for MS Windows 2008 is 128 bytes. In older versions of FSAE, it was 40 bytes.
Fortinet Technologies Inc. Page 467 FortiOS Handbook - Authentication for FortiOS 5.0
RADIUS attribute value pairs
RADIUS packets include a set of attribute value pairs (AVP) to identify information about the
user, their location and other information. The FortiGate unit sends the following RADIUS
attributes.
Table 18: FortiOS supported RADIUS attributes
Table 19 describes the supported authentication events and the RADIUS attributes that are sent
in the RADIUS accounting message.
Table 19: RADIUS attributes sent in RADIUS accounting message
RADIUS Attributes
Authentication Method 1 2 3 4 5 6 7
Web a a a a
SSL-VPN a a a a
Fortinet Technologies Inc. Page 468 FortiOS Handbook - Authentication for FortiOS 5.0
Vendor-specific attributes
Vendor specific attributes (VSA) are the method RADIUS servers and client companies use to
extend the basic functionality of RADIUS. Some major vendors, such as Microsoft, have
published their VSAs, however many do not.
In order to support vendor-specific attributes (VSA), the RADIUS server requires a dictionary to
define which VSAs to support. This dictionary is typically supplied by the client or server vendor.
The Fortinet RADIUS vendor ID is 12356.
The FortiGate unit RADIUS VSA dictionary is supplied by Fortinet and is available through the
Fortinet Knowledge Base (http://kb.forticare.com) or through Technical Support. Fortinets
dictionary for FortiOS 4.0 and up is configured this way:
##
Fortinets VSAs
#
VENDOR fortinet 12356
BEGIN-VENDOR fortinet
ATTRIBUTE Fortinet-Group-Name 1 string
ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr
ATTRIBUTE Fortinet-Vdom-Name 3 string
ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets
ATTRIBUTE Fortinet-Interface-Name 5 string
ATTRIBUTE Fortinet-Access-Profile 6 string
#
# Integer Translations
#
END-VENDOR Fortinet
Note that using the Fortinet-Vdom-Name, users can be tied to a specific VDOM on the
FortiGate unit. See the documentation provided with your RADIUS server for configuration
details.
Fortinet Technologies Inc. Page 469 FortiOS Handbook - Authentication for FortiOS 5.0
Configuring the FortiGate unit to use a RADIUS server
The information you need to configure the FortiGate unit to use a RADIUS server includes
the RADIUS servers domain name or IP address
the RADIUS servers shared secret key.
You can optionally specify the NAS IP or Called Station ID. When configuring the FortiGate to
use a RADIUS server, the FortiGate is a Network Access Server (NAS). If the FortiGate interface
has multiple IP addresses, or you want the RADIUS requests to come from a different address
you can specify it here. Called Station ID applies to carrier networks. However, if the NAS IP is
not included in the RADIUS configuration, the IP of the FortiGate unit interface that
communicates with the RADIUS server is used instead.
A maximum of 10 remote RADIUS servers can be configured on the FortiGate unit. One or more
servers must be configured on FortiGate before remote users can be configured. To configure
remote users, see Creating users on page 491.
On the FortiGate unit, the default port for RADIUS traffic is 1812. Some RADIUS servers use
port 1645. If this is the case with your server, you can either:
Re-configure the RADIUS server to use port 1812. See your RADIUS server documentation
for more information on this procedure.
or
Change the FortiGate unit default RADIUS port to 1645 using the CLI:
config system global
set radius-port 1645
end
One wildcard admin account can be added to the FortiGate unit when using RADIUS
authentication. This uses the wildcard character to allow multiple admin accounts on RADIUS to
use a single account on the FortiGate unit. See Example wildcard admin accounts - CLI on
page 476.
Primary Server Enter the domain name (such as fgt.exmaple.com) or the IP address
Name/IP of the RADIUS server.
Primary Server Enter the server secret key, such as radiusSecret. This can be a
Secret maximum of 16 characters long.
This must match the secret on the RADIUS primary server.
Secondary Server Optionally enter the domain name (such as fgt.exmaple.com) or the
Name/IP IP address of the secondary RADIUS server.
Secondary Server Optionally, enter the secondary server secret key, such as
Secret radiusSecret2. This can be a maximum of 16 characters long.
This must match the secret on the RADIUS secondary server.
Fortinet Technologies Inc. Page 470 FortiOS Handbook - Authentication for FortiOS 5.0
NAS IP/ Called Enter the IP address to be used as an attribute in RADIUS access
Station ID requests.
NAS-IP-Address is RADIUS setting or IP address of FortiGate
interface used to talk to RADIUS server, if not configured.
Called Station ID is same value as NAS-IP Address but in text
format.
Include in every When enabled this RADIUS server will automatically be included in
User Group all user groups. This is useful if all users will be authenticating with
the remote RADIUS server.
For MAC OS and iOS devices to authenticate, you must use MS-CHAP-v2 authentication. In
the CLI, the command is set auth-type ms_chap_v2.
3. Select OK.
Troubleshooting RADIUS
To test the connection to the RADIUS server use the following command:
diagnose test authserver radius-direct <server_name or IP> <port
number> <secret>
For the port number, enter -1 to use the default port. Otherwise enter the port number to check.
Additional RADIUS related troubleshooting is located at Troubleshooting FSSO on page 596
LDAP servers
Fortinet Technologies Inc. Page 471 FortiOS Handbook - Authentication for FortiOS 5.0
This section includes:
Components and topology
LDAP directory organization
Configuring the FortiGate unit to use an LDAP server
Example wildcard admin accounts - CLI
Example of LDAP to allow Dial-in through member-attribute - CLI
Troubleshooting LDAP
Binding
Binding is the step where the LDAP server authenticates the user. If the user is successfully
authenticated, binding allows the user access to the LDAP server based on that users
permissions.
The FortiGate unit can be configured to use one of three types of binding:
anonymous - bind using anonymous user search
regular - bind using username/password and then search
simple - bind using a simple password authentication without a search
You can use simple authentication if the user records all fall under one domain name (dn). If the
users are under more than one dn, use the anonymous or regular type, which can search the
entire LDAP database for the required username.
If your LDAP server requires authentication to perform searches, use the regular type and
provide values for username and password.
Supported versions
The FortiGate unit supports LDAP protocol functionality defined in RFC 2251: Lightweight
Directory Access Protocol v3, for looking up and validating user names and passwords.
FortiGate LDAP supports all LDAP servers compliant with LDAP v3, including
FortiAuthenticator. In addition, FortiGate LDAP supports LDAP over SSL/TLS, which can be
configured only in the CLI.
FortiGate LDAP does not support proprietary functionality, such as notification of password
expiration, which is available from some LDAP servers. FortiGate LDAP does not supply
information to the user about why authentication failed.
Fortinet Technologies Inc. Page 472 FortiOS Handbook - Authentication for FortiOS 5.0
LDAP directory organization
To configure your FortiGate unit to work with an LDAP server, you need to understand the
organization of the information on the server.
The top of the hierarchy is the organization itself. Usually this is defined as Domain Component
(DC), a DNS domain. If the name contains a dot, such as example.com, it is written as two
parts separated by a comma: dc=example,dc=com.
In this example, Common Name (CN) identifiers reside at the Organization Unit (OU) level, just
below DC. The Distinguished Name (DN) is ou=People,dc=example,dc=com.
In addition to the DN, the FortiGate unit needs an identifier for the individual person. Although
the FortiGate unit GUI calls this the Common Name (CN), the identifier you use is not
necessarily CN. On some servers, CN is the full name of a person. It might be more convenient
to use the same identifier used on the local computer network. In this example, User ID (UID) is
used.
Fortinet Technologies Inc. Page 473 FortiOS Handbook - Authentication for FortiOS 5.0
The output is lengthy, but the information you need is in the first few lines:
version: 2
#
# filter: (objectclass=*)
# requesting: ALL
dn: dc=example,dc=com
dc: example
objectClass: top
objectClass: domain
dn: ou=People,dc=example,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
...
dn: uid=tbrown,ou=People,dc=example,dc=com
uid: tbrown
cn: Tom Brown
In the output above, you can see tbrown (uid) and Tom Brown(cn). Also note the dn is
ou=People, dc=example, dc=com.
Fortinet Technologies Inc. Page 474 FortiOS Handbook - Authentication for FortiOS 5.0
11.Select OK.
To verify your Distinguished Name field is correct, you can select the Test button. If your DN
field entry is valid, you will see the part of the LDAP database it defines. If your DN field entry is
not valid, it will display an error message and return no information.
For detailed information about configuration options for LDAP servers, see the Online Help on
your FortiGate unit or the FortiGate CLI Reference.
On an OpenLDAP server, when a user attempts to logon with an expired password they are
allowed to logon on but only to change their password.
When changing passwords on a Windows AD system, the connection must be SSL-protected.
Fortinet Technologies Inc. Page 475 FortiOS Handbook - Authentication for FortiOS 5.0
Figure 113:LDAP server Distinguished Name Query tree
Fortinet Technologies Inc. Page 476 FortiOS Handbook - Authentication for FortiOS 5.0
Configuring the LDAP server
The important parts of this configuration are the username and group lines. The username is the
domain administrator account. The group binding allows only the group with the name GRP to
access.
The dn used here is as an example only. On your network use your own domain name.
To configure the user group and add the LDAP server - CLI
config user group
edit "ldap_grp"
set member "ldap"
config match
edit 1
set server-name "ldap_server"
set group-name "TRUE"
next
end
next
end
Fortinet Technologies Inc. Page 477 FortiOS Handbook - Authentication for FortiOS 5.0
To configure the admin account - CLI
config system admin
edit test
set remote-auth enable
set accprofile super_admin
set wildcard enable
set remote-group ldap_grp
next
end
For troubleshooting, test that the admin account is operational, and see Troubleshooting
LDAP on page 479.
Fortinet Technologies Inc. Page 478 FortiOS Handbook - Authentication for FortiOS 5.0
To configure LDAP group settings - CLI
config user group
edit "ldap_grp"
set member "ldap"
config match
edit 1
set server-name "ldap"
set group-name "TRUE"
next
end
end
Once these settings are in place, users can authenticate.
Troubleshooting LDAP
The examples in this section use the values from the previous example.
Fortinet Technologies Inc. Page 479 FortiOS Handbook - Authentication for FortiOS 5.0
If the Allow Dial-in attribute is not set but it is expected, the last line of the above output will
instead be:
fnbamd_auth_poll_ldap-Failed group matching
TACACS+ servers
When users connect to their corporate network remotely, they do so through a remote access
server. As remote access technology has evolved, the need for security when accessing
networks has become increasingly important. This need can be filled using a Terminal Access
Controller Access-Control System (TACACS+) server.
TACACS+ is a remote authentication protocol that provides access control for routers, network
access servers, and other networked computing devices via one or more centralized servers.
TACACS+ allows a client to accept a username and password and send a query to a TACACS+
authentication server. The server host determines whether to accept or deny the request and
sends a response back that allows or denies the user access to the network.
TACACS+ offers fully encrypted packet bodies, and supports both IP and AppleTalk protocols.
TACACS+ uses TCP port 49, which is seen as more reliable than RADIUSs UDP protocol.
There are several different authentication protocols that TACACS+ can use during the
authentication process:
Table 20: Authentication protocols
Protocol Definition
default The default protocol configuration, Auto, uses PAP, MS-CHAP, and CHAP, in
that order.
Fortinet Technologies Inc. Page 480 FortiOS Handbook - Authentication for FortiOS 5.0
2. Enter the following information, and select OK.
Server Name/IP Enter the server domain name or IP address of the TACACS+ server.
Authentication Type Select the authentication type to use for the TACACS+ server. Auto
tries PAP, MSCHAP, and CHAP (in that order).
SSO servers
Novell and Microsoft Windows networks provide user authentication based on directory
services: eDirectory for Novell, Active Directory for Windows. Users can log on at any computer
in the domain and have access to resources as defined in their user account. The Fortinet
Single Sign On (FSSO) agent enables FortiGate units to authenticate these network users for
security policy or VPN access without asking them again for their username and password.
When a user logs in to the Windows or Novell domain, the FSSO agent sends the FortiGate unit
the users IP address and the names of the user groups to which the user belongs. The
FortiGate unit uses this information to maintain a copy of the domain controller user group
database. Because the domain controller authenticates users, the FortiGate unit does not
perform authentication. It recognizes group members by their IP address.
In the FortiOS FSSO configuration, you specify the server where the FSSO Collector agent is
installed. The Collector agent retrieves the names of the Novell or Active Directory user groups
from the domain controllers on the domains, and then the FortiGate unit gets them from the
Collector agent. You cannot use these groups directly. You must define FSSO type user groups
on your FortiGate unit and then add the Novell or Active Directory user groups to them. The
FSSO user groups that you created are used in security policies and VPN configurations to
provide access to different services and resources.
FortiAuthenticator servers can replace the Collector agent when FSSO is using polling mode.
The benefits of this is that FortiAuthenticator is a stand-alone server that has the necessary
FSSO software pre-installed. For more information, see the FortiAuthenticator Administration
Guide.
Fortinet Technologies Inc. Page 481 FortiOS Handbook - Authentication for FortiOS 5.0
Single Sign-on Agent configuration settings
The following are SSO configuration settings in User & Device > Authentication >
Single Sign-On.
Create New Creates a new agent. When you select Create New, you are
automatically redirected to the New page.
Password Enter the password for the account used to access the DC.
LDAP Server Select the check box and select an LDAP server to access the Directory
Service.
Enable Polling Enable to allow the FortiGate unit to poll this DC.
Users/Groups A list of user and user group names retrieved from the DC.
Primary Agent Enter the IP address or name of the Directory Service server where this
IP/Name SSO agent is installed. The maximum number of characters is 63.
Secondary Agent
IP/Name
Password Enter the password for the collector agent. This is required only if you
configured your Fortinet Single Sign On Agent collector agent to require
authenticated access.
Users/Groups A list of user and user group names retrieved from the server.
Fortinet Technologies Inc. Page 482 FortiOS Handbook - Authentication for FortiOS 5.0
RSA ACE (SecurID) servers
Components
When using SecurID, users carry a small device or token that generates and displays a
random password. According to RSA, each SecurID authenticator token has a unique 64-bit
symmetric key that is combined with a powerful algorithm to generate a new code every 60
seconds. The token is time-synchronized with the SecurID RSA ACE/Server.
The RSA ACE/Server is the management component of the SecurID system. It stores and
validates the information about the SecurID tokens allowed on your network. Alternately the
server could be an RSA SecurID 130 Appliance.
The Agent Host is the server on your network, in this case it is the FortiGate unit, that intercepts
user logon attempts. The Agent Host gathers the user ID and password entered from their
SecurID token, and sends that information to the RSA ACE/Server to be validated. If valid, a
reply comes back indicating it is a valid logon and the FortiGate unit allows the user access to
the network resources specified in the associated security policy.
Fortinet Technologies Inc. Page 483 FortiOS Handbook - Authentication for FortiOS 5.0
Associated RSA FortiGate
Agent
IP Address 192.168.100.3
The IP address of the FortiGate unit internal interface.
Name FortiGate
Name RSA
Type Query
Fortinet Technologies Inc. Page 484 FortiOS Handbook - Authentication for FortiOS 5.0
To create a SecurID user group and user
1. Go to User & Device > User > User Groups, and select Create New.
2. Enter the following information, and select OK.
Name RSA_group
3. Go to User & Device > User > User Definition, and select Create New.
4. Enter the following information, and select OK.
To test this configuration, on your FortiGate unit use the CLI command:
diag test auth rad RSA auto wloman 111111111
The series of 1s is the one time password that your RSA SecurID token generates and you
enter.
Security policy
To use SecurID in a security policy, you must include the SecurID user group in an
identity-based security policy. This procedure will create a security policy that allows HTTP, FTP,
and POP3 traffic from the internal interface to wan1. If these interfaces are not available on
your FortiGate unit, substitute other similar interfaces.
Fortinet Technologies Inc. Page 485 FortiOS Handbook - Authentication for FortiOS 5.0
4. Enter
Group(s) securIDgrp
Schedule always
Action ACCEPT
7. To generate usage reports on traffic authenticated with this policy, enable Log Allowed
Traffic.
8. To either limit traffic or guarantee minimum bandwidth for traffic that uses the SecurID
security policy, enable Traffic Shaping and Shared Traffic Shaper and then select one of the
default shapers from the list such as guarantee-100kbps.
9. Select OK.
You are returned to the security policy creation page, with the information you just entered in
the Configure Authentication Rules table.
10.Optionally, you can modify any challenge pages or logon pages users will see. Select
Customize Authentication Messages and select the Edit icon that appears.
11.Select OK.
The SecurID security policy is configured.
For more detail on configuring security policies, see the FortiOS Handbook FortiGate
Fundamentals chapter.
Fortinet Technologies Inc. Page 486 FortiOS Handbook - Authentication for FortiOS 5.0
2. Select Create Phase 1 and enter
Name securIDxAuth
4. Select OK.
PPTP VPN
PPTP VPN is configured in the CLI. In the PPTP configuration (config vpn pptp), set usrgrp
to the SecurID user group.
SSL VPN
In the SecurID user group, select the appropriate web portal for these users. In the security
policy for the SSL VPN, include the SecurID user group in the list of selected user groups.
Fortinet Technologies Inc. Page 487 FortiOS Handbook - Authentication for FortiOS 5.0
Users and user groups
FortiGate authentication controls system access by user group. By assigning individual users to
the appropriate user groups you can control each users access to network resources. The
members of user groups are user accounts, of which there are several types. Local users and
peer users are defined on the FortiGate unit. User accounts can also be defined on remote
authentication servers.
This section describes how to configure local users and peer users and then how to configure
user groups. For information about configuration of authentication servers see Authentication
servers on page 466.
This section contains the following topics:
Users
User groups
Users
A user is a user account consisting of username, password, and in some cases other
information, configured on the FortiGate unit or on an external authentication server. Users can
access resources that require authentication only if they are members of an allowed user group.
There are several different types of user accounts with slightly different methods of
authentication:
Local user, The username and password must match a user account stored
password stored on on the FortiGate unit. Authentication by FortiGate security policy.
the FortiGate unit
Local user, The username must match a user account stored on the
password stored on FortiGate unit and the username and password must match a
a remote server user account stored on the remote authentication server.
Authentication A FortiGate user group can include user accounts or groups that
server user exist on a remote authentication server.
Peer user with A peer user is a digital certificate holder that authenticates using
certificate a client certificate. No password is required, unless two-factor
authentication authentication is enabled.
Page 488
User type Authentication
IM Users IM users are not authenticated. The FortiGate unit can allow or
block each IM user name from accessing the IM protocols. A
global policy for each IM protocol governs access to these
protocols by unknown users.
Guest Users Guest user accounts are temporary. The account expires after a
selected period of time.
Local users
Local users are defined on the FortiGate unit in User & Device > User > User Definition.
User page
Lists each individual local users list that you created. On this page, you can edit, delete or
create a new local users list.
Note: If you want to have users always authenticate whenever their time expires, use the
hard-timeout value in the auth-type command. This is available only in the CLI.
Create New Creates a new local user account. When you select Create New, you are
automatically redirected to New User page.
Edit Modifies a users account settings. When you select Edit, you are
automatically redirected to the Edit User page.
Delete Removes a user from the list. Removing the user name removes the
authentication configured for the user.
The Delete icon is not available if the user belongs to a user group.
To remove multiple local user accounts from within the list, on the User
page, in each of the rows of user accounts you want removed, select
the check box and then select Delete.
To remove all local user accounts from the list, on the User page, select
the check box in the check box column and then select Delete.
User Name The local user name. If the user is authenticated externally, the
username on the FortiGate unit must be identical to the username on
the authentication server.
Type The authentication type to use for this user. The authentication types are
Local (user and password stored on Fortinet unit), LDAP, RADIUS, and
TACACS+ (user and password matches a user account stored on the
authentication server).
Fortinet Technologies Inc. Page 489 FortiOS Handbook - Authentication for FortiOS 5.0
Two-factor Indicates whether two-factor authentication is configured for the user.
Authentication Gray X not enabled
Green check mark enabled
Ref. Displays the number of times this object is referenced by other objects.
Select the number to open the Object Usage window and view the list of
referring objects. The list is grouped into expandable categories, such
as Firewall Policy. Numbers of objects are shown in parentheses.
To view more information about the referring object, use the icons:
View the list page for these objects available for object
categories. Goes to the page where the object is listed. For example,
if the category is User Groups, opens User Groups list.
Edit this object opens the object for editing. modifies
View the details for this object displays current settings for the
object.
Match users on Select to authenticate this user using a password stored on an LDAP
LDAP servers server. Select the LDAP server from the list.
You can select only an LDAP server that has been added to the Fortinet
LDAP configuration. For more information, see Configuring the
FortiGate unit to use an LDAP server on page 474.
Match users on Select to authenticate this user using a password stored on a RADIUS
RADIUS server server. Select the RADIUS server from the list.
You can select only a RADIUS server that has been added to the
Fortinet RADIUS configuration. For more information, see Configuring
the FortiGate unit to use a RADIUS server on page 470.
Match users on Select to authenticate this user using a password stored on a TACACS
TACACS+ server server. Select the TACACS+ server from the list.
You can select only a TACACS server that has been added to the
Fortinet TACACS configuration. For more information, see TACACS+
servers on page 480.
Fortinet Technologies Inc. Page 490 FortiOS Handbook - Authentication for FortiOS 5.0
Contact Info Provide the email address or SMS cell number at which the user will
receive token password codes. For custom SMS service, you must first
enter the SMS service provider in System > Config > Messaging Servers
before you can select it from the drop-down list. See FortiToken on
page 497.
Creating users
Before configuring any authentication, except RADIUS SSO, you must first create local users.
For more about RADIUS SSO, see SSO using RADIUS accounting records on page 602.
When creating a new user, there are only two differences between a local and a remote user:
local users require a password to be configured
remote users do not require a password, but do require a remote authentication server to be
configured
To authenticate this user using an external authentication server, select the Match user option
for the appropriate type of server and select the server name. Password is not required. You
must configure the remote server access first. See Authentication servers on page 466.
3. Optionally select Enable Two-factor Authentication to use that option with this user.
When enabled, additional options will be displayed. Select one of the following options and
configure it as stated.
Select FortiToken, and choose the FortiToken serial number to associate with this user.
Select Email to and enter the users email address to email them the token code.
Select SMS and enter the Mobile Provider from the list, and enter the users mobile
phone number that will receive the token code in a text message.
4. Select OK.
The Mobile Provider for SMS must be entered in the CLI using the config system
sms-server command before it will be available to select in the web-based manager.
Fortinet Technologies Inc. Page 491 FortiOS Handbook - Authentication for FortiOS 5.0
To create a local user - CLI examples
Locally authenticated user
config user local
edit user1
set type password
set passwd ljt_pj2gpepfdw
end
User authenticated on an LDAP server
config user local
edit user2
set type ldap
set ldap_server ourLDAPsrv
end
User authenticated on a RADIUS server
config user local
edit user3
set type radius
set radius_server ourRADIUSsrv
end
User authenticated on a TACACS+ server
config user local
edit user4
set type tacacs+
set tacacs+_server ourTACACS+srv
end
User authenticated with a FortiToken
config user local
edit user5
set type password
set passwd ljt_pj2gpepfdw
set two_factor fortitoken
set fortitoken 182937197
end
User authenticated using email
config user local
edit user6
set type password
set passwd ljt_pj4h7epfdw
set two_factor email
set email-to user6@sample.com
end
Fortinet Technologies Inc. Page 492 FortiOS Handbook - Authentication for FortiOS 5.0
User authenticated using SMS text message
config system sms-server
edit Sample Mobile Inc
set mail-server mail.sample.com
end
Removing users
Best practices dictate that when a user account is no longer in use, it be deleted. Removing
local and remote users from FortiOS involve the same steps.
If the user account is references by any configuration objects those references must be
removed before the user can be deleted. See Removing references to users on page 493.
Fortinet Technologies Inc. Page 493 FortiOS Handbook - Authentication for FortiOS 5.0
certificate. Peer users can be included in firewall user groups or peer certificate groups used in
IPsec VPNs. For more on certificates, see Certificates overview on page 533.
To define a peer user you need:
a peer username
the text from the subject field of the users certificate, or the name of the CA certificate used
to validate the users certificate
Two-factor authentication
The standard logon requires a username and password. This is one factor authenticationyour
password is one piece of information you need to know to gain access to the system.
Two factor authentication adds the requirement for another piece of information for your logon.
Generally the two factors are something you know (password) and something you have
(certificate, token, etc.). This makes it harder for a hacker to steal your logon information. For
example if you have a FortiToken device, the hacker would need to both use it and know your
password to gain entry to your account.
Two-factor authentication is available on both user and admin accounts. But before you enable
two-factor authentication on an administrator account, you need to ensure you have a second
administrator account configured to guarantee administrator access to the FortiGate unit if you
are unable to authenticate on the main admin account for some reason.
Fortinet Technologies Inc. Page 494 FortiOS Handbook - Authentication for FortiOS 5.0
Certificate
You can increase security by requiring both certificate and password authentication for PKI
users. Certificates are installed on the users computer. Requiring a password also protects
against unauthorized use of that computer.
Optionally peer users can enter the code from their FortiToken instead of the certificate.
Email
Two-factor email authentication sends a randomly generated six digit numeric code to the
specified email address. Enter that code when prompted at logon. This token code is valid for
60 seconds. If you enter this code after that time, it will not be accepted.
A benefit is that you do not require mobile service to authenticate. However, a potential issue is
if your email server does not deliver the email before the 60 second life of the token expires.
The code will be generated and emailed at the time of logon, so you must have email access at
that time to be able to receive the code.
Fortinet Technologies Inc. Page 495 FortiOS Handbook - Authentication for FortiOS 5.0
To enable email two-factor authentication - CLI
config user local
edit <user_name>
set email-to <user_email>
set two-factor email
end
SMS
SMS two-factor authentication sends the token code in an SMS text message to the mobile
device indicated when this user attempts to logon. This token code is valid for 60 seconds. If
you enter this code after that time, it will not be accepted. Enter this code when prompted at
logon to be authenticated.
SMS two-factor authentication has the benefit that you do not require email service before
logging on. A potential issue is if the mobile service provider does not send the SMS text
message before the 60 second life of the token expires.
If you do not use the FortiGuard Messaging Service, you need to configure an SMS service.
Fortinet Technologies Inc. Page 496 FortiOS Handbook - Authentication for FortiOS 5.0
To enable SMS two-factor authentication - CLI
config user local
edit <user_name>
set sms-phone <user_phone>
set sms-server fortiguard
set two-factor sms
end
If you have problems receiving the token codes via SMS messaging, contact your mobile
provider to ensure you are using the correct phone number format to receive text messages and
that your current mobile plan allows text messages.
FortiToken
FortiToken is a disconnected one-time password (OTP) generator. It is a small physical device
with a button that when pressed displays a six digit authentication code. This code is entered
with a users username and password as two-factor authentication. The code displayed
changes every 60 seconds, and when not in use the LCD screen is blanked to extend the
battery life.
There is also a mobile phone application, FortiToken Mobile, that performs much the same
function.
FortiTokens have a small hole in one end. This is intended for a lanyard to be inserted so the
device can be worn around the neck, or easily stored with other electronic devices. Do not put
the FortiToken on a key ring as the metal ring and other metal objects can damage it. The
FortiToken is an electronic device like a cell phone and must be treated with similar care.
Any time information about the FortiToken is transmitted, it is encrypted. When the FortiGate
unit receives the code that matches the serial number for a particular FortiToken, it is delivered
and stored encrypted. This is in keeping with the Fortinets commitment to keeping your
network highly secured.
FortiTokens can be added to user accounts that are local, IPsec VPN, SSL VPN, and even
Administrators. See Associating FortiTokens with accounts on page 500.
A FortiToken can be associated with only one account on one FortiGate unit.
If a user loses their FortiToken, it can be locked out using the FortiGate so it will not be used to
falsely access the network. Later if found, that FortiToken can be unlocked on the FortiGate to
allow access once again. See FortiToken maintenance on page 501.
There are three tasks to complete before FortiTokens can be used to authenticate accounts:
1. Adding FortiTokens to the FortiGate
2. Activating a FortiToken on the FortiGate
3. Associating FortiTokens with accounts
Fortinet Technologies Inc. Page 497 FortiOS Handbook - Authentication for FortiOS 5.0
6. User enters current code at the prompt.
7. FortiGate unit verifies the FortiToken code, and if valid allows access to the network
resources such as the Internet.
The following steps are only if the time on the FortiToken has drifted from the time on the
FortiGate unit and needs to be synchronized.
8. If time on FortiToken has drifted, FortiGate unit will prompt user to enter a second code to
confirm.
9. User gets the next code from their FortiToken device
10.User enters the second code at the prompt.
11.FortiGate unit uses both codes to update its clock to match the FortiToken and then
proceeds as in step 7.
F RTINET
198490
When configured the FortiGate unit accepts the username and password, authenticates them
either locally or remotely, and prompts the user for the FortiToken code. The FortiGate then
authenticates the FortiToken code. When FortiToken authentication is enabled, the prompt field
for entering the FortiToken code is automatically added to the authentication screens.
Even when an Administrator is logging in through a serial or Telnet connection and their account
is linked to a FortiToken, that Administrator will be prompted for the tokens code at each login.
If you have attempted to add invalid FortiToken serial numbers, there will be no error message.
The serial numbers will simply not be added to the list.
Fortinet Technologies Inc. Page 498 FortiOS Handbook - Authentication for FortiOS 5.0
Adding FortiTokens to the FortiGate
Before one or more FortiTokens can be used to authenticate logons, they must be added to the
FortiGate. The import feature is used to enter many FortiToken serial numbers at one time. The
serial number file must be a text file with one FortiToken serial number per line.
One FortiToken can be added to multiple FortiGate units. This is useful for maintaining
two-factor authentication for employees over multiple office locations, such as for employees
who travel frequently between offices.
Fortinet Technologies Inc. Page 499 FortiOS Handbook - Authentication for FortiOS 5.0
2. Select one or more FortiTokens with a status of New.
3. Select Activate.
4. Refresh web browser. The status of selected FortiTokens will change to Activated.
The selected FortiTokens are now available for use with user and admin accounts.
Fortinet Technologies Inc. Page 500 FortiOS Handbook - Authentication for FortiOS 5.0
To add a FortiToken to a local user account - CLI
config user local
edit <username>
set type password
set passwd myPassword
set two-factor fortitoken
set fortitoken <serial_number>
set status enable
next
end
The fortitoken keyword will not be visible until fortitoken is selected for the two-factor
keyword.
Before a new FortiToken can be used, it may need to be synchronized due to clock drift.
FortiToken maintenance
Once FortiTokens are entered into the FortiGate unit, there are only two tasks to maintain them
changing the status,
To change the status of a FortiToken between Activated and Locked - CLI
config user fortitoken
edit <token_serial_num>
set status lock
next
end
Any user attempting to login using this FortiToken will not be able to authenticate.
To list the drift on all FortiTokens configured on this FortiGate unit - CLI
# diag fortitoken drift
FORTITOKEN DRIFT
This command lists the serial number and drift for each FortiToken configured on this FortiGate
unit. This command is useful to check if it is necessary to synchronize the FortiGate and any
particular FortiTokens.
IM users
Instant Messenger (IM) protocols are gaining in popularity as an essential way to communicate
between two or more individuals in real time. Some companies even rely on IM protocols for
critical business applications such as Customer/Technical Support.
The most common IM protocols in use today include AOL Instant Messenger (AIM), Yahoo
Instant Messenger, MSN messenger, and ICQ. You configure each IM user as either allowed or
denied use of IM applications. For each protocol, a global allow or deny policy configured in
config imp2p policy governs unknown IM users. IM User settings are not available in the
web-based manager.
Fortinet Technologies Inc. Page 501 FortiOS Handbook - Authentication for FortiOS 5.0
Monitoring users
To monitor user activity in the web-based manager, go to User & Device > Monitor > Firewall.
The list of users who are logged on is displayed with some information about them such as their
user group, security policy ID, how long they have been logged on, their IP address, traffic
volume, and their authentication method as one of FSSO, NTLM, or firewall (FW-auth).
From this screen you can de-authenticate all users who are logged on. The de-authenticate
button is at the top left of this screen.
To see information about banned users go to User & Device > Monitor > Banned User.
Displayed information about users who have been banned includes what application the
triggered the ban (Application Protocol), the reason for the ban (Cause or rule), Created, and
when the ban expires.
Fortinet Technologies Inc. Page 502 FortiOS Handbook - Authentication for FortiOS 5.0
User groups
You cannot change the type of a group unless the group is empty.
In most cases, the FortiGate unit authenticates users by requesting their username and
password. The FortiGate unit checks local user accounts first. If a match is not found, the
FortiGate unit checks the RADIUS, LDAP, or TACACS+ servers that belong to the user group.
Authentication succeeds when a matching username and password are found. If the user
belongs to multiple groups on a server, those groups will be matched as well.
FortiOS does not allow username overlaps between RADIUS, LDAP, or TACACS+ servers.
There are two types of FortiGate user groups: Firewall user groups, and FSSO user groups.
Fortinet Technologies Inc. Page 503 FortiOS Handbook - Authentication for FortiOS 5.0
SSL VPN access
In any firewall user group, you can enable SSL VPN access and select the web-portal that the
users can access. When the user connects to the FortiGate unit via HTTPS on the SSL VPN port
(default 10443), the FortiGate unit requests a username and password.
SSL VPN access also requires an SSL VPN security policy (Action is SSL VPN) with an
identity-based rule enabling access for the user group. For more information, see the FortiOS
Handbook SSL VPN chapter.
A user group cannot be used as a dialup group if any member of the group is authenticated
using an external authentication server.
For more information, see the FortiOS Handbook IPsec VPN chapter.
Fortinet Technologies Inc. Page 504 FortiOS Handbook - Authentication for FortiOS 5.0
9. Select OK.
Matching user group names from an external authentication server might not work if the list of
group memberships for the user is longer than 8000 bytes. Group names beyond this limit are
ignored.
server_name is the name of the RADIUS, LDAP, or TACACS+ server, but it must be a member
of this group first and must also be a configured remote server on the FortiGate unit.
group_name is the name of the group on the RADIUS, LDAP, or TACACS+ server such as
engineering or cn=users,dc=test,dc=com.
Before using group matching with TACACS+, you must first enable authentication. For example
if you have a configured TACACS+ server called myTACS, use the following CLI commands.
config user tacacs+
edit myTACS
set authorization enable
next
end
For more information about user group CLI commands, see the Fortinet CLI Guide.
Fortinet Technologies Inc. Page 505 FortiOS Handbook - Authentication for FortiOS 5.0
User group timeouts
User groups can have timeout values per group in addition to FortiGate-wide timeouts. There
are essentially three different types of timeouts that are configurable for user authentication on
the FortiGate unit idle timeout, hard timeout, and session timeout. These are in addition to
any external timeouts such as those associated with RADIUS servers.
If VDOMs are enabled, the global level user setting authtimeout is the default all VDOMs
inherit. If VDOMs are not enabled, user settings authtimeout is the default. The default timeout
value is used when the authtimeout keyword for a user group is set to zero.
Each type of timeout will be demonstrated using the existing user group example_group.
Timeout units are minutes. A value of zero indicates the global timeout is used.
Idle timeout
The default type of timeout is idle timeout. When a user initiates a session, it starts a timer. As
long as data is transferred in this session, the timer continually resets. If data flow stops, the
timer is allowed to advance until it reaches its limit. At that time the user has been idle for too
long, and the user is forced to re-authenticate before traffic is allowed to continue in that
session.
Hard timeout
Where the idle timeout is reset with traffic, the hard timeout is absolute. From the time the first
session a user establishes starts, the hard timeout counter starts. When the timeout is reached,
all the sessions for that user must be re-authenticated. This timeout is not affected by any
event.
Fortinet Technologies Inc. Page 506 FortiOS Handbook - Authentication for FortiOS 5.0
To configure user group authentication hard timeout - CLI
config user settings
set auth-timeout-type hard-timeout
end
config user group
edit example_group
set auth-timeout 480
next
end
Session timeout
The session timeout works much like the hard timeout in that its an absolute timer that can not
be affected by events. However, when the timeout is reached existing sessions may continue
but new sessions are not allowed until re-authentication takes place. The timeout can be set
from 1 to 480 minutes. Setting the timeout value to zero removes the timeout value allowing the
user to remain logged on without limit.
Fortinet Technologies Inc. Page 507 FortiOS Handbook - Authentication for FortiOS 5.0
To create a peer group - CLI example
config user peergrp
edit vpn_peergrp1
set member pki_user1 pki_user2 pki_user3
end
Fortinet Technologies Inc. Page 508 FortiOS Handbook - Authentication for FortiOS 5.0
Managing Guest Access
Introduction
Visitors to your premises might need user accounts on your network for the duration of their
stay. If you are hosting a large event such as a conference, you might need to create many such
temporary accounts. The FortiOS Guest Management feature is designed for this purpose.
A guest user account User ID can be the users email address, a randomly generated string, or
an ID that the administrator assigns. Similarly, the password can be administrator-assigned or
randomly generated.
You can create many guest accounts at once using randomly-generated User IDs and
passwords. This reduces administrator workload for large events.
Page 509
Creating guest user groups
The guest group configuration determines the fields that are provided when you create a guest
user account.
Type Guest
Default Expire Time Set the expire time. The administrator can change this for individual
users.
Enable Sponsor If enabled, user form has Sponsor field. Select Required or Optional.
Enable Company If enabled, user form has Company field. Select Required or
Optional.
Fortinet Technologies Inc. Page 510 FortiOS Handbook - Authentication for FortiOS 5.0
Creating guest user accounts
Guest user accounts are not the same as local user accounts created in User & Device > User >
User Definition. Guest accounts are not permanent; they expire after a defined time period. You
create guest accounts in User & Device > User > Guest Management.
Guest Groups Select the guest group to list. New accounts are added to this group.
User ID The user ID. Depending on the guest group settings, this can be the
users email address, an ID that the administrator specified, or a
randomly-generated ID.
Fortinet Technologies Inc. Page 511 FortiOS Handbook - Authentication for FortiOS 5.0
Guest access in a retail environment
Some retail businesses such as coffee shops provide free WiFi Internet access for their
customers. For this type of application, the FortiOS guest management feature is not required;
the WiFi access point is open and customers do not need logon credentials. However, the
business might want to contact its customers later with promotional offers to encourage further
patronage. Using FortiOS device-based security policies, it is possible to collect customer email
addresses for this purpose.
The first time a customers device attempts to use the WiFi connection, FortiOS requests an
email address, which it validates. The customers subsequent connections go directly to the
Internet without interruption.
Schedule always
Service ALL
Fortinet Technologies Inc. Page 512 FortiOS Handbook - Authentication for FortiOS 5.0
Action ACCEPT
2. Select OK.
3. If asked, confirm that you accept FortiOS will enable device identification on the source
interface.
4. In Device Policy Options, select Prompt E-mail Collection Portal for all devices.
5. Optionally, customize authentication messages.
6. Select OK to complete configuration of the security policy.
Fortinet Technologies Inc. Page 513 FortiOS Handbook - Authentication for FortiOS 5.0
Configuring authenticated access
When you have configured authentication servers, users, and user groups, you are ready to
configure security policies and certain types of VPNs to require user authentication.
This section describes:
Authentication timeout
Password policy
Authentication protocols
Authentication in security policies
Limited access for unauthenticated users
VPN authentication
Authentication timeout
Page 514
Password policy
Password authentication is effective only if the password is sufficiently strong and is changed
periodically. By default, the FortiGate unit requires only that passwords be at least eight
characters in length. You can set a password policy to enforce higher standards for both length
and complexity of passwords. Password policies can apply to administrator passwords or
IPsec VPN preshared keys.
To set a password policy in the web-based manager, go to System > Admin > Settings. In the
CLI, use the config system password-policy command.
The default minimum password length on the FortiGate unit is eight characters, but up to 32
characters is permitted. Fortinet suggests a minimum length of 14 characters.
Users usually create passwords composed of alphabetic characters and perhaps some
numbers. Password policy can require the inclusion of uppercase letters, lowercase letters,
numerals or punctuation characters.
uppercase Letters 2
Numerical Digits 2
Non-alphanumeric 1
Letters
Fortinet Technologies Inc. Page 515 FortiOS Handbook - Authentication for FortiOS 5.0
To change administrator password minimum requirements - CLI
config system password-policy
set status enable
set apply-to admin-password
set min-upper-case-letter 2
set min-lower-case-letter 4
set min-number 2
set min-non-alphanumeric 1
set change-4-characters enable
end
The change-4-characters option forces new passwords to change a minimum of four
characters in the old password. Changing fewer characters results in the new password being
rejected. This option is only available in the CLI.
Fortinet Technologies Inc. Page 516 FortiOS Handbook - Authentication for FortiOS 5.0
Authentication protocols
FTP and Telnet authentication replacement messages cannot be customized. For HTTP and
HTTPS replacement messages see Authentication replacement messages on page 518.
For certificate-based authentication, you must install customized certificates on the FortiGate
unit and on the browsers of network users. If you do not install certificates on the network users
web browser, the network users may see an SSL certificate warning message and have to
manually accept the default FortiGate certificate. The network users web browser may deem
the default certificate as invalid.
When you use certificate authentication, if you do not specify any certificate when you create
the security policy, the global settings are used. If you specify a certificate, the per-policy setting
will overwrite the global setting. For more information about the use of certification
authentication see Certificate-based authentication on page 532.
Security policies control traffic between FortiGate interfaces, both physical interfaces and VLAN
subinterfaces. Without authentication, a security policy enables access from one network to
another for all users on the source network. Authentication enables you to allow access only for
users who are members of selected user groups. To include authentication in a security policy,
you must create an identity-based policy.
You can configure user authentication for security policies only when Action is set to Accept. If
the policy is set to Deny, IPsec, or SSL VPN the options will be different.
The style of the authentication method varies by the authentication protocol. If you have
selected HTTP, FTP or Telnet, a username and password-based authentication occurs. The
FortiGate unit prompts network users to input their security username and password. If you
Fortinet Technologies Inc. Page 517 FortiOS Handbook - Authentication for FortiOS 5.0
have selected HTTPS, certificate-based authentication (HTTPS or HTTP redirected to HTTPS
only) occurs. You must install customized certificates on the FortiGate unit and on the browsers
of network users, which the FortiGate unit matches.
This section includes:
Enabling authentication protocols
Authentication replacement messages
Access to the Internet
Configuring authentication security policies
Identity-based policy
NTLM authentication
Certificate authentication
Restricting number of concurrent user logons
Fortinet Technologies Inc. Page 518 FortiOS Handbook - Authentication for FortiOS 5.0
The authentication login page and the authentication disclaimer include replacement tags and
controls not found on other replacement messages.
More information about replacement messages can be found in the config system
replacemsg section of the FortiOS CLI Reference.
Login challenge page This HTML page is displayed if security users are required to
(auth-challenge-page) answer a question to complete authentication. The page
displays the question and includes a field in which to type the
answer. This feature is supported by RADIUS and uses the
generic RADIUS challenge-access auth response. Usually,
challenge-access responses contain a Reply-Message
attribute that contains a message for the user (for example,
Please enter new PIN). This message is displayed on the
login challenge page. The user enters a response that is sent
back to the RADIUS server to be verified.
The Login challenge page is most often used with RSA
RADIUS server for RSA SecurID authentication. The login
challenge appears when the server needs the user to enter a
new PIN. You can customize the replacement message to ask
the user for a SecurID PIN.
This page uses the %%QUESTION%% tag.
Disclaimer page Prompts user to accept the displayed disclaimer when leaving
(auth-disclaimer-page-1) protected network.
(auth-disclaimer-page-2)
The web-based manager refers to this as User Authentication
(auth-disclaimer-page-3)
Disclaimer, and it is enabled with a security policy that also
includes at least one identity-based policy. When a security
user attempts to browse a network through the FortiGate unit
using HTTP or HTTPS this disclaimer page is displayed.
The extra pages seamlessly extend the size of the page from
8 192 characters to 16 384 and 24 576 characters
respectively. When configuring the disclaimer page in the
web-based manager this is shown by its size being 24 576
characters.
See Disclaimer on page 521.
Email token page The page prompting a user to enter their email token. See
(auth-email-token-page) Email on page 495.
FortiToken page The page prompting a user to enter their FortiToken code. See
(auth-fortitoken-page) FortiToken on page 497.
Fortinet Technologies Inc. Page 519 FortiOS Handbook - Authentication for FortiOS 5.0
Table 21: List of authentication replacement messages
Login failed page The Disclaimer page replacement message does not re-direct
(auth-login-failed-page) the user to a redirect URL or the security policy does not
include a redirect URL. When a user selects the button on the
disclaimer page to decline access through the FortiGate unit,
the Declined disclaimer page is displayed.
Login page The authentication HTML page displayed when users who are
(auth-login-page) required to authenticate connect through the FortiGate unit
using HTTP or HTTPS.
Prompts the user for their username and password to login.
This page includes %%USERNAMEID%% and
%%PASSWORDID%% tags.
Declined disclaimer page The page displayed if a user declines the disclaimer page.
(auth-reject-page) See Disclaimer on page 521.
SMS Token page The page prompting a user to enter their SMS token. See
(auth-sms-token-page) SMS on page 496.
Fortinet Technologies Inc. Page 520 FortiOS Handbook - Authentication for FortiOS 5.0
Configuring authentication security policies
To include authentication in a security policy, you must create an identity-based policy. An
identity-based policy can authenticate by certificate, FSSO, and NTLM. The two exceptions to
this are RADIUS SSO and FSSO Agents. See SSO using RADIUS accounting records on
page 602, and Introduction to FSSO agents on page 564.
Before creating an identity-based security policy, you need to configure one or more users and
firewall user groups.For more information, see Users and user groups on page 488.
Creating the security policy is the same as a regular security policy except you must select the
action specific to your authentication method:
ACCEPT FSSO Agent or identity-based policy See Agent-based FSSO on page 563.
FSSO
Disclaimer
When configuring a User Identity authentication security policy, there is an option to enable a
disclaimer. The disclaimer is a replacement message that when enabled, web traffic matching
this policy will be presented with the disclaimer that the user must choose to agree or decline.
The default disclaimer contains a warning that any content the user is about to access is the
responsibility of the user and not the company or owner of the network. It is presented in
Figure 115. You can customize the text and the appearance as required.
Fortinet Technologies Inc. Page 521 FortiOS Handbook - Authentication for FortiOS 5.0
Figure 115:Default disclaimer message
Fortinet Technologies Inc. Page 522 FortiOS Handbook - Authentication for FortiOS 5.0
You must enable logging within a security policy, as well as the options that are applied to a
security policy, such as UTM features. Event logs are enabled within the Event Log page,
For more information on logging, see the FortiOS Log and Reporting chapter.
For more information on specific types of log messages, see the FortiOS Log Message
Reference.
You need to set the logging severity level to Notification when configuring a logging location to
record traffic log messages.
Identity-based policy
An identity-based policy (IBP) performs user authentication in addition to the normal security
policy duties. If the user does not authenticate, access to network resources is refused. This
enforces Role Based Access Control (RBAC) to your organizations network and resources.
Identity-based policies also support Single Sign-On operation. The user groups selected in the
policy are of the Fortinet Single Sign-On (FSSO) type.
User authentication can occur through any of the following supported protocols, including:
HTTP, HTTPS, FTP, and Telnet. The authentication style depends on which of these protocols is
included in the selected security services group and which of those enabled protocols the
network user applies to trigger the authentication challenge.
For username and password-based authentication (HTTP, FTP, and Telnet) the FortiGate unit
prompts network users to enter their username, password, and token code if two-factor
authentication is selected for that user account. See Two-factor authentication on page 494.
For certificate-based authentication, including HTTPS or HTTP redirected to HTTPS only, see
Certificate authentication on page 525.
FortiManager does not support pushing identity based policies down to FortiGate units.
Fortinet Technologies Inc. Page 523 FortiOS Handbook - Authentication for FortiOS 5.0
Set these commands in the CLI to see the other identity-based commands that were hidden
before. In the following procedure, this is policy number 7.
config firewall policy
edit 7
set action ACCEPT
set identity-based enable
next
end
With identity-based policies, once the FortiGate unit matches the source and destination
addresses, it processes the identity sub-policies for the user groups and services. This means
unique security policies must be placed before an identity-based policy to be effective.
When the identity-based policy has been configured, the option to customize authentication
messages is available. This allows you to change the text, style, layout, and graphics of the
replacement messages associated with this firewall policy. When enabled, customizing these
messages follows the same method as changing the disclaimer. See Disclaimer on page 521.
Types of authentication also available in identity-based policies are
NTLM authentication
Certificate authentication
Identity-based sub-policies
Once IBP is enabled in a policy, a table appears. Selecting Add allows you to configure
authentication rules which are added to this table as sub-policies.
Just as with regular security policies, with these identity-based sub-policies traffic is matched
from the top of the list of sub-policies down until the criteria is met. If there is no matching policy
packets are dropped, even if they have been authenticated. Each sub-policy has its own UTM
profile fields, traffic shaping, logging, and so on that take effect when the User Group, Service
and Schedule are matched.
The order of these sub-policies is just as important as with regular security policies. For
example if a user is a member of two groups, and each group has a separate sub-policy entry,
the top one in the list will be matched first.
NTLM authentication
The NT LAN Manager (NTLM) protocol is used when the MS Windows Active Directory (AD)
domain controller can not be contacted. NTLM uses web browsers to send and receive
authentication information. See NTLM on page 460 and FSSO NTLM authentication support
on page 569.
NTLM authentication is enabled when you configure FSSO and enable NTLM in the
identity-based policy (IBP). There must be at least one FSSO Collector agent configured on the
FortiGate. Any users and user groups associated with the security policy will use NTLM to
authenticate without further configuration. However some extra configuration in the CLI may be
required for certain cases including guest access, and defining NTLM enabled browsers.
If there are multiple domains, a trust relation must exist between them. This is automatic if they
are in a forest. With the trust relation, only one FSSO DC agent needs to be installed. Without
the trust relation, FSSO DC agents must be installed on each domain controller.
Fortinet Technologies Inc. Page 524 FortiOS Handbook - Authentication for FortiOS 5.0
NTLM guest access - CLI
Guest profile access may be granted to users failing NTLM authentication, such as visitors who
have no user credentials on the network. To allow guest users in NTLM, use the following CLI
command:
config firewall policy
edit 8
set action accept
set identity-based enable
set ntlm enable
set ntlm-guest enable
next
end
Certificate authentication
Certificates can be used as part of an identity-based policy. A customized certificate must be
installed on the FortiGate unit and in the web browser, which the FortiGate unit will attempt to
match.
All users being authenticated against the policy are required to have the proper certificate,
which must be imported into the FortiGate unit. See Certificate-based authentication on
page 532.
To require the user to accept a disclaimer to connect to the destination, select Enable
Disclaimer. If the user is to be redirected after accepting the disclaimer, enter the URL in the
Redirect URL to field. You can edit the User Authentication Disclaimer replacement message
text in System > Config > Replacement Messages.
Fortinet Technologies Inc. Page 525 FortiOS Handbook - Authentication for FortiOS 5.0
Certificate redirect authentication
Under User & Device > Authentication > Settings, select Redirect HTTP Challenge to a Secure
Channel (HTTPS). This forces users to use secure connections to send their authentication
information.
The following steps happen during a redirect:
1. User tries to access the Internet and the HTTP traffic hits the FortiGate security policy with
authentication and HTTPS redirect enabled.
2. The FortiGate redirects the user with the HTTPS port and IP address of the interface
connected to the user, such as internal.
3. User authenticates over the HTTPS connection as with normal authentication.
4. On successful authentication, the FortiGate provides access to the Internet as originally
requested.
When configuring User Identity policies, if you select the option Skip this policy for
unauthenticated user the policy will only apply to users who have already authenticated with the
FortiGate unit. This feature is intended for networks with two kinds of users:
Single sign-on users who have authenticated when their devices connected to their network
Other users who do not authenticate with the network so are unauthenticated
Sessions from authenticated users can match this policy and sessions from unauthenticated
users will skip this policy and potentially be matched with policies further down the policy list.
Typically, you would arrange a policy with Skip this policy for unauthenticated user at the top of
a policy list.
Fortinet Technologies Inc. Page 526 FortiOS Handbook - Authentication for FortiOS 5.0
You can also use the following CLI command to enable skipping policies for unauthenticated
users:
config firewall policy
edit <id>
set identity-based enable
set fall-through-unauthenticated enable
next
A packet enters
Policy 1. User Identity policy the FortiGate unit
access to internal resources and Internet
Skip this policy for unauthenticated user
No
N o
The packet is
accepted by
policy 2
Fortinet Technologies Inc. Page 527 FortiOS Handbook - Authentication for FortiOS 5.0
through the FortiGate unit. The result is different levels of authentication: Single sign on for
some users and firewall authentication for others.
VPN authentication
All VPN configurations require users to authenticate. Authentication based on user groups
applies to:
SSL VPNs
PPTP and L2TP VPNs
an IPsec VPN that authenticates users using dialup groups
a dialup IPsec VPN that uses XAUTH authentication (Phase 1)
You must create user accounts and user groups before performing the procedures in this
section. If you create a user group for dialup IPsec clients or peers that have unique peer IDs,
their user accounts must be stored locally on the FortiGate unit. You cannot authenticate these
types of users using a RADIUS or LDAP server.
Fortinet Technologies Inc. Page 528 FortiOS Handbook - Authentication for FortiOS 5.0
Authentication through user groups is supported for groups containing only local users. To
authenticate users using a RADIUS or LDAP server, you must configure XAUTH settings. See
Configuring XAuth authentication on page 529.
Name Name for group of dialup users using the VPN for
authentication.
Remote Gateway List of the types of remote gateways for VPN. Select
Dialup User.
Peer Options Select Accept peer ID in dialup group. Select the user group
that is to be allowed access to the VPN. The listed user groups
contain only users with passwords on the FortiGate unit.
3. Select Advanced to reveal additional parameters and configure other VPN gateway
parameters as needed.
4. Select OK.
Fortinet Technologies Inc. Page 529 FortiOS Handbook - Authentication for FortiOS 5.0
To configure authentication for a dialup IPsec VPN - web-based manager
1. Configure the users who are permitted to use this VPN. Create a user group and add the
users to the group.
For more information, see Users and user groups on page 488.
2. Go to VPN > IPsec > Auto Key (IKE).
3. Select Create Phase 1 and configure the basic VPN phase1 settings.
Remote Gateway must be Dialup User.
4. Select Advanced to reveal additional parameters and enter the following information.
Server Type Select PAP, CHAP, or AUTO. Use CHAP whenever possible. Use PAP
with all implementations of LDAP and with other authentication
servers that do not support CHAP, including some implementations
of Microsoft RADIUS. Use AUTO with the Fortinet Remote VPN
Client and where the authentication server supports CHAP but the
XAuth client does not.
User Group Select the user group that is to have access to the VPN. The list of
user groups does not include any group that has members whose
password is stored on the FortiGate unit.
5. Select OK.
For more information about XAUTH configuration, see the IPsec VPN chapter of this FortiOS
Handbook.
Fortinet Technologies Inc. Page 530 FortiOS Handbook - Authentication for FortiOS 5.0
2. Configure the PPTP VPN in the CLI as in this example.
config vpn pptp
set status enable
set sip 192.168.0.100
set eip 192.168.0.110
set usrgrp PPTP_Group
end
The sip and eip fields define a range of virtual IP addresses assigned to PPTP clients.
3. Configure a security policy. The source interface is the one through which the clients will
connect. The source address is the PPTP virtual IP address range. The destination interface
and address depend on the network to which the clients will connect. The policy action is
ACCEPT.
Fortinet Technologies Inc. Page 531 FortiOS Handbook - Authentication for FortiOS 5.0
Certificate-based authentication
This section provides an overview of how the FortiGate unit verifies the identities of
administrators, SSL VPN users, or IPsec VPN peers using X.509 security certificates.
The following topics are included in this section:
What is a security certificate?
Certificates overview
Managing X.509 certificates
Configuring certificate-based authentication
Example Generate a CSR on the FortiGate unit
Example Generate and Import CA certificate with private key pair on OpenSSL
Example Generate an SSL certificate in OpenSSL
A security certificate is a small text file that is part of a third-party generated public key
infrastructure (PKI) to help guarantee the identity of both the user logging on and the web site
they where they are logging in.
A certificate includes identifying information such as the company and location information for
the web site, as well as the third-party company name, the expiry date of the certificate, and the
encrypted public key.
FortiGate units use X.509 certificates to authenticate single sign-on (SSO) for users. The X.509
standard has been in use since before 2000, but has gained popularity with the Internets
increased popularity. X.509 v3 is defined in RFC 5280 and specifies standard formats for public
key certificates, certificate revocation lists, and a certification path validation algorithm. The
unused earlier X.509 version 1 was defined in RFC 1422.
The main difference between X.509 and PGP certificates is that where in PGP anyone can sign
a certificate, for X.509 only a trusted authority can sign certificates. This limits the source of
certificates to well known and trustworthy sources. Where PGP is well suited for one-on-one
communications, the X.509 infrastructure is intended to be used in many different situations
including one-to-many communications. Some common filename extensions for X.509
certificates are listed in Table 23.
.pem Privacy Enhanced Mail Base64 encoded DER certificate, that uses
(PEM)
-----BEGIN CERTIFICATE----- and -----END
CERTIFICATE-----
Page 532
Table 23: Common certificate filename extensions
Certificates overview
Certificates play a major role in authentication of clients connecting to network services via
HTTPS, both for administrators and SSL VPN users. Certificate authentication is optional for
IPsec VPN peers.
Certificates and protocols
IPsec VPNs and certificates
Certificate types on the FortiGate unit
Fortinet Technologies Inc. Page 533 FortiOS Handbook - Authentication for FortiOS 5.0
Certificate-related protocols
There are multiple protocols that are required for handling certificates. These include the Online
Certificate Status Protocol (OCSP), Secure Certificate Enrollment Protocol (SCEP), and
Server-based Certificate Validation Protocol (SCVP).
Local certificates
Local certificates are issued for a specific server, or web site. Generally they are very specific,
and often for an internal enterprise network. For example a personal web site for John Smith at
www.example.com (such as http://www.example.com/home/jsmith) would have its own local
certificate.
These can optionally be just the certificate file, or also include a private key file and PEM
passphrase for added security.
For information about generating a certificate request, see Generating a certificate signing
request on page 536. For information about installing a local certificate, see Obtaining and
installing a signed server certificate from an external CA on page 538.
Fortinet Technologies Inc. Page 534 FortiOS Handbook - Authentication for FortiOS 5.0
Remote certificates
Remote certificates are public certificates without a private key. For dynamic certificate
revocation, you need to use an Online Certificate Status Protocol (OCSP) server. The OCSP is
configured in the CLI only. Installed Remote (OCSP) certificates are displayed in the Remote
Certificates list. You can select Import to install a certificate from the management PC.
CA root certificates
CA root certificates are similar to local certificates, however they apply to a broader range of
addresses or to whole company; they are one step higher up in the organizational chain. Using
the local certificate example, a CA root certificate would be issued for all of www.example.com
instead of just the smaller single web page.
Certificate signing
The trust in a certificate comes from the authority that signs it. For example if VeriSign signs
your CA root certificate, it is trusted by everyone. While these certificates are universally
accepted, it is cumbersome and expensive to have all certificates on a corporate network
signed with this level of trust.
With self-signed certificates nobody, except the other end of your communication, knows who
you are and therefore they do not trust you as an authority. However this level is useful for
encryption between two points neither point may care about who signed the certificate, just
that it allows both points to communicate. This is very useful for internal networks and
communications.
A general rule is that CA signed certificates are accepted and sometimes required, but it is
easier to self-sign certificates when you are able.
For more on the methods of certificate signing see Generating a certificate signing request on
page 536.
Managing security certificates is required due to the number of steps involved in both having a
certificate request signed, and then distributing the correct files for use.
You use the FortiGate unit or CA software such as OpenSSL to generate a certificate request.
That request is a text file that you send to the CA for verification, or alternately you use CA
software to self-validate. Once validated, the certificate file is generated and must be imported
to the FortiGate unit before it can be used. These steps are explained in more detail later in this
section.
This section provides procedures for generating certificate requests, installing signed server
certificates, and importing CA root certificates and CRLs to the FortiGate unit.
For information about how to install root certificates, CRLs, and personal or group certificates
on a remote client browser, refer to your browsers documentation.
Fortinet Technologies Inc. Page 535 FortiOS Handbook - Authentication for FortiOS 5.0
This section includes:
Generating a certificate signing request
Generating certificates with CA software
Obtaining and installing a signed server certificate from an external CA
Installing a CA root certificate and CRL to authenticate remote clients
Troubleshooting certificates
Do not include spaces in the certificate name. This will ensure compatibility of a signed
certificate as a PKCS12 file to be exported later on if required.
4. Enter values in the Subject Information area to identify the FortiGate unit:
If the FortiGate unit has a static IP address, select Host IP and enter the public IP address
of the FortiGate unit. If the FortiGate unit does not have a public IP address, use an email
address (or fully qualified domain name (FQDN) if available) instead.
If the FortiGate unit has a dynamic IP address and subscribes to a dynamic DNS service,
use a FQDN if available to identify the FortiGate unit. If you select Domain Name, enter
the FQDN of the FortiGate unit. Do not include the protocol specification (http://) or any
port number or path names.
If a domain name is not available and the FortiGate unit subscribes to a dynamic DNS service,
an unable to verify certificate type message may be displayed in the users browser whenever
the public IP address of the FortiGate unit changes.
Fortinet Technologies Inc. Page 536 FortiOS Handbook - Authentication for FortiOS 5.0
If you select E-Mail, enter the email address of the owner of the FortiGate unit.
5. Enter values in the Optional Information area to further identify the FortiGate unit.
Organization Unit Name of your department. You can enter a series of OUs up to
a maximum of 5. To add or remove an OU, use the plus (+) or
minus (-) icon.
Locality (City) Name of the city or town where the FortiGate unit is installed.
Subject Alternative Optionally, enter one or more alternative names for which the
Name certificate is also valid. Separate names with a comma. A name
can be:
e-mail address
IP address
URI
DNS name (alternatives to the Common Name)
directory name (alternatives to the Distinguished Name)
You must precede the name with the name type. Examples:
IP:1.1.1.1
email:test@fortinet.com
email:my@other.address
URI:http://my.url.here/
6. From the Key Size list, select 1024 Bit, 1536 Bit or 2048 Bit. Larger keys are slower to
generate but more secure.
7. In Enrollment Method, you have two methods to choose from. Select File Based to generate
the certificate request, or Online SCEP to obtain a signed SCEP-based certificate
automatically over the network. For the SCEP method, enter the URL of the SCEP server
from which to retrieve the CA certificate, and the CA server challenge password.
8. Select OK.
9. The request is generated and displayed in the Local Certificates list with a status of
PENDING.
10.Select the Download button to download the request to the management computer.
11.In the File Download dialog box, select Save and save the Certificate Signing Request on the
local file system of the management computer.
12.Name the file and save it on the local file system of the management computer.
The certificate request is ready for the certificate to be generated.
Fortinet Technologies Inc. Page 537 FortiOS Handbook - Authentication for FortiOS 5.0
Generating certificates with CA software
CA software allows you to generate unmanaged certificates and CA certificates for managing
other certificates locally without using an external CA service. Examples of CA software include
ssl-ca from OpenSSL (available for Linux, Windows, and Mac) or gensslcert from SuSE, MS
Windows Server 2000 and 2003 come with a CA as part of their certificate services, and in MS
Windows 2008 CA software can be installed as part of the Active Directory installation. See
Example Generate and Import CA certificate with private key pair on OpenSSL on
page 546.
The general steps for generating certificates with CA software are
1. Install the CA software as a stand-alone root CA.
2. Provide identifying information for your self-administered CA.
While following these steps, the methods vary slightly when generating server certificates, CA
certificates, and PKI certificates.
Server certificate
1. Generate a Certificate Signing Request (CSR) on the FortiGate unit.
2. Copy the CSR base-64 encoded text (PKCS10 or PKCS7) into the CA software and generate
the certificate.
PKCS10 is the format used to send the certificate request to the signing authority. PKCS7 is
the format the signing authority can use for the newly signed certificate.
3. Export the certificate as a X.509 DER encoded binary file with .CER extension
4. Upload the certificate file to the FortiGate unit Local Certificates page (type is Certificate).
CA certificate
1 Retrieve the CA Certificate from the CA software as a DER encoded file.
2 Upload the CA certificate file to the FortiGate unit CA Certificates page at System >
Certificates > CA Certificates.
PKI certificate
1. Generate a Certificate Signing Request (CSR) on the FortiGate unit.
2. Copy the CSR base-64 encoded text (PKCS#10 or PKCS#7) into the CA software and
generate the certificate.
PKCS10 is the format used to send the certificate request to the signing authority. PKCS7 is
the format the signing authority can use for the newly signed certificate.
3. Export the certificate as a X.509 DER encoded binary file with .CER extension.
4. Install the certificate in the users web browser or IPsec VPN client as needed.
Fortinet Technologies Inc. Page 538 FortiOS Handbook - Authentication for FortiOS 5.0
3. Follow the CA instructions to download their root certificate and CRL.
When you receive the signed server certificate from the CA, install the certificate on the
FortiGate unit.
Fortinet Technologies Inc. Page 539 FortiOS Handbook - Authentication for FortiOS 5.0
4. Do one of the following:
To import using an HTTP server, select HTTP and enter the URL of the HTTP server.
To import using an LDAP server see this KB article.
To import using an SCEP server, select SCEP and select the Local Certificate from the
list. Enter the URL of the SCEP server from which the CRL can be retrieved.
To import from a file, select Local PC, then select Browse and find the location on the
management computer where the CRL has been saved. Select the CRL and then select
Open.
5. Select OK, and then select Return.
Troubleshooting certificates
There are times when there are problems with certificates a certificate is seen as expired
when its not, or it cant be found. Often the problem is with a third party web site, and not
FortiOS. However, some problems can be traced back to FortiOS such as DNS or routing
issues.
Fortinet Technologies Inc. Page 540 FortiOS Handbook - Authentication for FortiOS 5.0
that is not valid for marketing.example.com. If you encounter this problem, contact the
webmaster for the web site to inform them of the problem.
There is a DNS or routing problem. If the web sites certificate cannot be verified, it will not
be accepted. Generally to be verified, your system checks with the third party certificate
signing authority to verify the certificate is valid. If you cannot reach that third party due to
some DNS or routing error, the certificate will not be verified.
Firewall is blocking required ports. Ensure that any firewalls between the requesting
computer and the web site allow the secure traffic through the firewall. Otherwise a hole
must be opened to allow it through. This includes ports such as 443 (HTTPS) and 22 SSH).
Local certificates
In the config vpn certificate local command, you can specify automatic certificate
renewal. The relevant fields are:
scep-url <URL_str> The URL of the SCEP server. This can be HTTP or HTTPS.
The following options appear after you add the
<URL_str>.
scep-password The password for the SCEP server.
<password_str>
auto-regenerate-days How many days before expiry the FortiGate unit requests
<days_int> an updated local certificate. The default is 0, no
auto-update.
auto-regenerate-days How many days before local certificate expiry the
-warning FortiGate generates a warning message. The default is
<days_int> 0,no warning.
CA certificates
In the config vpn certificate ca command, you can specify automatic certificate
renewal. The relevant fields are:
scep-url <URL_str> The URL of the SCEP server. This can be HTTP or HTTPS.
auto-update-days How many days before expiry the FortiGate unit requests
<days_int> an updated CA certificate. The default is 0, no
auto-update.
auto-update-days-war How many days before CA certificate expiry the FortiGate
ning <days_int> generates a warning message. The default is 0,no
warning.
Fortinet Technologies Inc. Page 541 FortiOS Handbook - Authentication for FortiOS 5.0
In this example, an updated certificate is requested three days before it expires.
config vpn certificate ca
edit mycert
set scep-url http://scep.example.com/scep
set auto-update-days 3
set auto-update-days-warning 2
end
Variable Description
http-url <http_url> URL of the server used for automatic CRL
certificate updates. This can be HTTP or
HTTPS.
scep-cert <scep_certificate> Local certificate used for SCEP
communication for CRL auto-update.
scep-url <scep_url> URL of the SCEP CA server used for
automatic CRL certificate updates. This can
be HTTP or HTTPS.
update-interval <seconds> How frequently, in seconds, the FortiGate unit
checks for an updated CRL. Enter 0 to update
the CRL only when it expires. Not available for
http URLs.
update-vdom <update_vdom> VDOM used to communicate with remote
SCEP server for CRL auto-update.
As an alternative, you can back up and restore the entire FortiGate configuration through the
System Information widget on the Dashboard of the web-based manager. Look for [Backup]
and [Restore] in the System Configuration row. The backup file is created in a
FortiGate-proprietary format.
Fortinet Technologies Inc. Page 542 FortiOS Handbook - Authentication for FortiOS 5.0
To export a server certificate and private key - CLI
This procedure exports a server (local) certificate and private key together as a password
protected PKCS12 file. The export file is created through a customer-supplied TFTP server.
Ensure that your TFTP server is running and accessible to the FortiGate unit before you enter
the command.
1. Connect to the FortiGate unit through the CLI.
2. Type the following command:
execute vpn certificate local export tftp <cert_name> <exp_filename>
<tftp_ip>
where:
<cert_name> is the name of the server certificate; typing ? displays a list of installed server
certificates.
<exp_filename> is a name for the output file.
<tftp_ip> is the IP address assigned to the TFTP server host interface.
3 Move the output file from the TFTP server location to the management computer for future
reference.
To import separate server certificate and private key files - web-based manager
Use the following procedure to import a server certificate and the associated private key file
when the server certificate request and private key were not generated by the FortiGate unit.
The two files to import must be available on the management computer.
1. Go to System > Certificates > Local Certificates and select Import.
2. In Type, select Certificate.
3. Select the Browse button beside the Certificate file field. Browse to the location on the
management computer where the certificate file has been saved, select the file, and then
select Open.
4. Select the Browse button beside the Key file field. Browse to the location on the
management computer where the key file has been saved, select the file, and then select
Open.
5. If required, in the Password field, type the associated password, and then select OK.
6. Select Return.
You can configure certificate-based authentication for FortiGate administrators, SSL VPN users,
and IPsec VPN users.
In Microsoft Windows 7, you can use the certificate manager to keep track of all the different
certificates on your local computer. To access certificate manager, in Windows 7 press the
Windows key, enter certmgr.msc at the search prompt, and select the displayed match.
Fortinet Technologies Inc. Page 543 FortiOS Handbook - Authentication for FortiOS 5.0
Remember that in addition to these system certificates, many applications require you to
register certificates with them directly.
To see FortiClient certificates, open the FortiClient Console, and select VPN. The VPN menu has
options for My Certificates (local or client) and CA Certificates (root or intermediary certificate
authorities). Use Import on those screens to import certificate files from other sources.
Fortinet Technologies Inc. Page 544 FortiOS Handbook - Authentication for FortiOS 5.0
8. Select SSL Client Certificate Restrictive.
9. Select OK.
This example follows all the steps required to create and install a local certificate on the
FortiGate unit, without using CA software.
The FortiGate unit is called myFortiGate60, and is located at 10.11.101.101 (a private IP
address) and http://myfortigate.example.com. Mr. John Smith
(john.smith@myfortigate.example.com) is the IT administrator for this FortiGate unit,a nd the
unit belongs to the Sales department located in Greenwich, London, England.
Fortinet Technologies Inc. Page 545 FortiOS Handbook - Authentication for FortiOS 5.0
3. In the Certificate Name field, enter myFortiGate60.
Do not include spaces in the certificate name. This will ensure compatibility of a signed
certificate as a PKCS12 file to be exported later on if required.
Organization Example.com
State/Province London
Country England
e-mail john.smith@myfortigate.example.com
6. From the Key Size list, select 2048 Bit or the most secure option available to you.
7. In Enrollment Method, select File Based to generate the certificate request
8. Select OK.
The request is generated and displayed in the Local Certificates list with a status of PENDING.
9. Select the Download button to download the request to the management computer.
10.In the File Download dialog box, select Save and save the Certificate Signing Request on the
local file system of the management computer.
11.Name the file and save it on the local file system of the management computer.
This example explains how to generate a certificate using OpenSSL on MS Windows. OpenSSL
is available for Linux and Mac OS as well, however their terminology will vary slightly from what
is presented here.
Assumptions
Before starting this procedure, ensure that you have downloaded and installed OpenSSL on
Windows. One source is http://www.slproweb.com/products/Win32OpenSSL.html.
Fortinet Technologies Inc. Page 546 FortiOS Handbook - Authentication for FortiOS 5.0
To generate the private key and certificate
1. At the Windows command prompt, go to the OpenSSL bin directory. If you installed to the
default location this will be the following command:
cd c:\OpenSSL-Win32\bin
2. Enter the following command to generate the private key. You will be prompted to enter your
PEM pass phrase. Choose something easy to remember such as fortinet123.
openssl genrsa -des3 -out fgtcapriv.key 2048
This command generates an RSA DES3 2038-bit encryption key.
3. The following command will generate the certificate using the key from the previous step.
openssl req -new -x509 -days 3650 -extensions v3_ca -key
fgtcapriv.key -out fgtca.crt
This step generates an X509 CA certificate good for 10 years that uses the key generated in
the previous step. The certificate filename is fgtca.crt.
You will be prompted to enter information such as PEM Pass Phrase from the previous step,
Country Name, State, Organization Name, Organizational Unit (such as department name),
Common Name (the FQDN), and Email Address.
This example explains how to generate a CA signed SSL certificate using OpenSSL on MS
Windows. OpenSSL is available for Linux and Mac OS as well, however their terminology will
vary slightly from what is presented here.
This example includes:
Assumptions
Generating a CA signed SSL certificate
Generating a self-signed SSL certificate
Import the SSL certificate into FortiOS
Fortinet Technologies Inc. Page 547 FortiOS Handbook - Authentication for FortiOS 5.0
Assumptions
Before starting this procedure, ensure that you have downloaded and installed OpenSSL on
MS Windows. One download source is
http://www.slproweb.com/products/Win32OpenSSL.html.
Fortinet Technologies Inc. Page 548 FortiOS Handbook - Authentication for FortiOS 5.0
Import the SSL certificate into FortiOS
To import the certificate to FortiOS- web-based manager
1. Go to System > Certificates > Local Certificates.
2. Select Import.
3. Select Certificate for Type.
Fields for Certificate file, Key file, and Password are displayed.
4. For Certificate file, enter c:\OpenSSL-Win32\bin\fgtssl.crt.
5. For Key file, enter c:\OpenSSL-Win32\bin\fgtssl.key.
6. For Password, enter the PEM Pass Phrase you entered, such as fortinet.
7. Select OK.
The SSL certificate you just uploaded can be found under System > Certificates > Local
Certificates under the name of the file you uploaded fgtssl.
Fortinet Technologies Inc. Page 549 FortiOS Handbook - Authentication for FortiOS 5.0
SSO using a FortiAuthenticator unit
There are two different ways users can authenticate through a FortiAuthenticator unit.
The SSO widget sets a cookie on the users browser. When the user browses to a page
containing the login widget, the FortiAuthenticator unit recognizes the user and updates its
database if the users IP address has changed. The user will not need to re-authenticate until
the login timeout expires, which can be up to 30 days.
Page 550
Administrators view of FortiAuthenticator SSO authentication
You can configure either or both of these authentication types on your network.
SSO widget
You need to configure the Single Sign-On portal on the FortiAuthenticator unit. Go to
SSO & Dynamic Polices > SSO > Login Portal to do this. Copy the Embeddable login widget
code for use on your organizations home page. Identity-based security policies on the
FortiGate unit determine which users or groups of users can access which network resources.
The FortiAuthenticator unit can poll FortiGate units, Windows Active Directory, RADIUS servers,
LDAP servers, and FortiClients for information about user logon activity.
Enable Windows Active Directory Select for integration with Windows Active Directory.
domain controllers
Enable Radius accounting service Select if you want to use a Remote LDAP server.
Use remote LDAP server for SSO Optionally, you can provide SSO only to certain
groups lookup groups. If so, enable this option and select the remote
LDAP server.
Enable FortiClient service Select both options to enable single sign-on by clients
Enable Authentication running FortiClient Endpoint Security. Enter the
Secret key. Be sure to use the same secret key in the
FortiClient Single Sign-On Mobility Agent settings.
5. Select OK.
For more information, see the FortiAuthenticator Administration Guide.
Fortinet Technologies Inc. Page 551 FortiOS Handbook - Authentication for FortiOS 5.0
Configuring the FortiGate unit
When you open the server, you can see the list of groups. You can use the groups in
identity-based security policies.
Fortinet Technologies Inc. Page 552 FortiOS Handbook - Authentication for FortiOS 5.0
Configuring the FortiClient SSO Mobility Agent
The users device must have FortiClient Endpoint Security v5.0 installed. Only two pieces of
information are required to set up the SSO Mobility Agent feature: the FortiAuthenticator unit IP
address and the preshared secret.
The user needs to know the FortiAuthenticator IP address and preshared secret to set up the
SSO Mobility Agent. Or, you could preconfigure FortiClient
User authentication events are logged in the FortiGate event log. Go to Log & Report >
Event Log > User.
Fortinet Technologies Inc. Page 553 FortiOS Handbook - Authentication for FortiOS 5.0
Single Sign-On to Windows AD
The FortiGate unit can authenticate users transparently and allow them network access based
on their privileges in Windows AD. This means that users who have logged on to the network
are not asked again for their credentials to access network resources through the FortiGate unit,
hence the term Single Sign-On.
The following topics are included:
Introduction to Single Sign-On with Windows AD
Configuring Single Sign On to Windows AD
FortiOS FSSO log messages
Testing FSSO
Troubleshooting FSSO
Introduced in FortiOS 5.0, Single Sign-On (SSO) support provided by FortiGate polling of
domain controllers is simpler than the earlier method that relies on agent software installed on
Windows AD network servers. No Fortinet software needs to be installed on the Windows
network. The FortiGate unit needs access only to the Windows AD global catalog and event log.
When a Windows AD user logs on at a workstation in a monitored domain, the FortiGate unit
detects the logon event in the domain controllers event log and records the workstation
name, domain, and user,
resolves the workstation name to an IP address,
uses the domain controllers LDAP server to determine which groups the user belongs to,
creates one or more log entries on the FortiGate unit for this logon event as appropriate.
When the user tries to access network resources, the FortiGate unit selects the appropriate
security policy for the destination. The selection consist of matching the FSSO group or groups
the user belongs to with the security policy or policies that match that group. If the user belongs
to one of the permitted user groups associated with that policy, the connection is allowed.
Otherwise the connection is denied.
On the FortiGate unit, security policies control access to network resources based on user
groups. With Fortinet Single Sign On, this is also true but each FortiGate user group is
associated with one or more Windows AD user groups. This is how Windows AD user groups
get authenticated in the FortiGate security policy.
Fortinet Single Sign On sends information about Windows user logons to FortiGate units. If
there are many users on your Windows AD domains, the large amount of information might
affect the performance of the FortiGate units.
Page 554
To configure your FortiGate unit to operate with either a Windows AD or a Novell eDirectory
FSSO install, you
Configure LDAP access to the Windows AD global catalog. See Configuring LDAP server
access on page 555.
Add Active Directory user groups to FortiGate FSSO user groups. See Creating Fortinet
Single Sign-On (FSSO) user groups on page 557.
Configure the LDAP Server as a Single Sign-On server. See Configuring the LDAP Server as
a Single Sign-On server on page 557
Create security policies for FSSO-authenticated groups. See Creating security policies on
page 557.
Optionally, specify a guest protection profile to allow guest access. See Enabling guest
access through FSSO security policies on page 559.
Fortinet Technologies Inc. Page 555 FortiOS Handbook - Authentication for FortiOS 5.0
Figure 117: Authenticated DN query
You can expand any of the DNs that contain entries. When you select an expandable DN, the
Distinguished Name field is updated. Look for the DN that contains the users or groups
whose logon you want to monitor.
11.Select the DN that you want to monitor and then select OK.
This closes the window and updates the Distinguished Name field of the LDAP Server
configuration with the selected Domain Name Identifier (DNI).
12.Check the following fields and select OK:
Common Name The default common name identifier is cn. This is correct for
Identifier most LDAP servers. However some servers use other identifiers
such as uid.
Secure Optional.
Connection
Fortinet Technologies Inc. Page 556 FortiOS Handbook - Authentication for FortiOS 5.0
Creating Fortinet Single Sign-On (FSSO) user groups
You cannot use Windows or Novell groups directly in FortiGate security policies. You must
create FortiGate user groups of the FSSO type and add Windows or Novell groups to them.
3. Select OK.
Fortinet Technologies Inc. Page 557 FortiOS Handbook - Authentication for FortiOS 5.0
requires FSSO authentication to access network resources on the Internet. The following
procedure configures the security policy for FSSO authentication. FSSO is installed and
configured including the RADIUS server, FSSO Collector agent, and user groups on the
FortiGate
For the following procedure, the internal interface is port1 and the external interface
connected to the Internet is port2. There is an address group for the internal network called
company_network. The FSSO user group is called fsso_group, and the FSSO RADIUS
server is fsso_rad_server.
Groups Select from the FSSO user groups that you created earlier.
FSSO_Guest_users is a default user group enabled when FSSO is
configured. It allows guest users on the network who do not have an
FSSO account to still authenticate and have access to network
resources. See Enabling guest access through FSSO security
policies on page 559.
Schedule always
Action ACCEPT
Log Allowed Traffic Select. Logging FSSO logon events helps troubleshoot any FSSO
related issues.
UTM Security Enable AntiVirus, IPS, Web Filter, and Email Filter default profiles.
Profiles
5. Select OK.
A new line of information will appear in the identity-based policy table, listing the user
groups, services, schedule, UTM, and logging selected for the rule.
6. Select OK.
7. Ensure the FSSO authentication policy is higher in the policy list than more general policies
for the same interfaces.
Fortinet Technologies Inc. Page 558 FortiOS Handbook - Authentication for FortiOS 5.0
To create a security policy for FSSO authentication - CLI
config firewall policy
edit 0
set srcintf internal
set dstintf wan1
set srcaddr company_network
set dstaddr all
set action accept
set identity-based enable
set nat enable
config identity-based-policy
edit 1
set schedule any
set groups company_network FSSO_guest_users
set service HTTP HTTPS FTP TELNET
end
end
Here is an example of how this FSSO authentication policy is used. Example.com employee on
the internal company network logs on to the internal network using their RADIUS username and
password. When that user attempts to access the Internet, which requires FSSO authentication,
the FortiGate authentication security policy intercepts the session, checks with the FSSO
Collector agent to verify the users identity and credentials, and then if everything is verified the
user is allowed access to the Internet.
There are two types of FortiOS log messages firewall and event. FSSO related log messages
are generated from authentication events. These include user logon and log off events, and
NTLM authentication events. These log messages are central to network accounting policies,
and can also be useful in troubleshooting issues. For more information on firewall logging, see
Enabling security logging on page 522. For more information on logging, see the FortiOS
Handbook Log and Reporting chapter.
Fortinet Technologies Inc. Page 559 FortiOS Handbook - Authentication for FortiOS 5.0
To ensure you log all the events need, set the minimum log level to Notification or Information.
Firewall logging requires Notification as a minimum. The closer to Debug level, the more
information will be logged. While this extra information is useful, you must
System activity event All system-related events, such as ping server failure and
gateway status.
User activity event All administration events, such as user logins, resets, and
configuration updates.
Optionally you can enable any or all of the other logging event options.
3. Select Apply.
Fortinet Technologies Inc. Page 560 FortiOS Handbook - Authentication for FortiOS 5.0
For more information on logging, see the FortiOS Handbook Log and Reporting chapter.
Testing FSSO
Once FSSO is configured, you can easily test to ensure your configuration is working as
expected. For additional FSSO testing, see Troubleshooting FSSO on page 561.
1. Logon to one of the stations on the FSSO domain, and access an Internet resource.
2. Connect to the CLI of the FortiGate unit, and if possible log the output.
3. Enter the following command:
diagnose debug authd fsso list
4. Check the output. If FSSO is functioning properly you will see something similar to the
following:
----FSSO logons----
IP: 192.168.1.230 User: ADMINISTRATOR Groups: VLAD-AD/DOMAIN USERS
IP: 192.168.1.240 User: ADMINISTRATOR Groups: VLAD-AD/DOMAIN USERS
Total number of users logged on: 2
----end of FSSO logons----
The exact information will vary based on your installation.
5. Check the FortiGate event log, for FSSO-auth action or other FSSO related events with
FSSO information in the message field. For a list of FSSO log message IDs, see Table 24 on
page 560.
6. To check server connectivity, run the following commands from the CLI:
FGT# diagnose debug enable
FGT# diagnose debug authd fsso server-status
FGT# Server Name Connection Status
----------- -----------------
SBS-2003 connected
Troubleshooting FSSO
When installing, configuring, and working with FSSO some problems are quite common. A
selection of these problems follows including explanations and solutions.
Some common Windows AD problems include:
General troubleshooting tips for FSSO
Users on a particular computer (IP address) can not access the network
Guest users do not have access to network
Fortinet Technologies Inc. Page 561 FortiOS Handbook - Authentication for FortiOS 5.0
Users on a particular computer (IP address) can not access the network
Windows AD Domain Controller agent gets the username and workstation where the logon
attempt is coming from. If there are two computers with the same IP address and the same user
trying to logon, it is possible for the authentication system to become confused and believe that
the user on computer_1 is actually trying to access computer_2.
Windows AD does not track when a user logs out. It is possible that a user logs out on one
computer, and immediate logs onto a second computer while the system still believes the user
is logged on the original computer. While this is allowed, information that is intended for the
session on one computer may mistakenly end up going to the other computer instead. The
result would look similar to a hijacked session.
Solutions
Ensure each computer has separate IP addresses.
Encourage users to logout on one machine before logging onto another machine.
If multiple users have the same username, change the usernames to be unique.
Shorten timeout timer to flush inactive sessions after a shorter time.
Solution
The group of the guest users was not included in a policy, so they do not fall under the guest
account. To give them access, associate their group with a security policy.
Additionally, there is a default group called FSSO_Guest_Users. Ensure that group is part of an
identity-based security policy to allow traffic.
Fortinet Technologies Inc. Page 562 FortiOS Handbook - Authentication for FortiOS 5.0
Agent-based FSSO
FortiOS can provide single sign-on capabilities to Windows AD, Citrix, or Novell eDirectory
users with the help of agent software installed on these networks. The agent software sends
information about user logons to the FortiGate unit. With user information such as IP address
and user group memberships from the network, FortiGate security policies can allow
authenticated network access to users who belong to the appropriate user groups without
requesting their credentials again.
For Windows AD networks, FortiGate units can provide SSO capability without agent software
by directly polling the Windows AD domain controllers. For information about this type of SSO,
see Single Sign-On to Windows AD on page 554.
The following topics are included:
Introduction to agent-based FSSO
FSSO NTLM authentication support
Agent installation
Configuring the FSSO Collector agent for Windows AD
Configuring the FSSO TS agent for Citrix
Configuring the FSSO eDirectory agent for Novell eDirectory
Configuring FSSO on FortiGate units
FortiOS FSSO log messages
Testing FSSO
Troubleshooting FSSO
Fortinet Single Sign-On (FSSO), through agents installed on the network, monitors user logons
and passes that information to the FortiGate unit. When a user logs on at a workstation in a
monitored domain, FSSO
detects the logon event and records the workstation name, domain, and user,
resolves the workstation name to an IP address,
determines which user groups the user belongs to,
sends the user logon information, including IP address and groups list, to the FortiGate unit
creates one or more log entries on the FortiGate unit for this logon event as appropriate.
When the user tries to access network resources, the FortiGate unit selects the appropriate
security policy for the destination. If the user belongs to one of the permitted user groups
associated with that policy, the connection is allowed. Otherwise the connection is denied.
FSSO can also provide NTLM authentication service for requests coming from FortiGate. SSO
is very convenient for users, but may not be supported across all platforms. NTLM is not as
convenient, but it enjoys wider support. See FSSO NTLM authentication support on
page 569.
Page 563
Introduction to FSSO agents
There are several different FSSO agents that can be used in an FSSO implementation.
Domain Controller (DC) agent
eDirectory agent
Citrix/Terminal Server (TS) agent
Collector (CA) agent
Consult the latest FortiOS and FSSO Release Notes for operating system compatibility
information.
eDirectory agent
The eDirectory agent is installed on a Novell network to monitor user logons and send the
required information to the FortiGate unit. It functions much like the Collector agent on a
Windows AD domain controller.The agent can obtain information from the Novell eDirectory
using either the Novell API or LDAP.
Fortinet Technologies Inc. Page 564 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
All DC agents must point to the correct Collector agent port number and IP address on domains
with multiple DCs.
See Configuring Collector agent settings on page 577.
A FortiAuthenticator unit can act much like a Collector agent, collecting Windows AD user
logon information and sending it to the FortiGate unit. It is particularly useful in large
installations with several FortiGate units. For more information, see the FortiAuthenticator
Administration Guide.
Network load Each DC agent requires minimum Increase polling period during busy
64kpbs bandwidth, adding to period to reduce network load
network load
DC Agent mode
DC Agent mode is the standard mode for FSSO. In DC Agent mode (see Figure 119), a Fortinet
authentication agent is installed on each domain controller. These DC agents monitor user
logon events and pass the information to the Collector agent, which stores the information and
sends it to the FortiGate unit.
The DC agent installed on the domain controllers is not a service like the Collector agent it is
a DLL file called dcagent.dll and is installed in the Windows\system32 directory. It must be
installed on all domain controllers of the domains that are being monitored.
Fortinet Technologies Inc. Page 565 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Figure 119:FSSO in DC agent mode
update
2. Pass
in
user login ma rs
info to CA Do trolle
n O
Co FSS s
h t
wit agen
r
se
1. U DC
U
nt
ser
ie
log
Cl
in t
o th
eD
om
ain
DC Agent mode provides reliable user logon information, however you must install a DC agent
on every domain controller. A reboot is needed after the agent is installed. Each installation
requires some maintenance as well. For these reasons it may not be possible to use the DC
Agent mode.
Each domain controller connection needs a minimum guaranteed 64kpbs bandwidth to ensure
proper FSSO functionality. You can optionally configure traffic shapers on the FortiGate unit to
ensure this minimum bandwidth is guaranteed for the domain controller connections.
Polling mode
In Polling mode there are two options NetAPI polling, and Event log polling. Both share the
advantages of being transparent and agentless.
NetAPI polling is used to retrieve server logon sessions. This includes the logon event
information for the Controller agent. NetAPI runs faster than Event log polling but it may miss
some user logon events under heavy system load. It requires a query round trip time of less than
10 seconds.
Event log polling may run a bit slower, but will not miss events, even when the installation site
has many users that require authentication. It does not have the 10 second limit or NetAPI
polling. Event log polling requires fast network links. Event log polling is required if there are
Mac OS users logging into Windows AD.
In Polling mode (see Figure 120), the Collector agent polls port 445 of each domain controller
for user logon information every few seconds and forwards it to the FortiGate unit. There are no
DC Agents installed, so the Collector agent polls the domain controllers directly.
Fortinet Technologies Inc. Page 566 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Figure 120:FSSO in Polling mode
d
h alle
wit inst
e r ver gent
ss ra
uni
t update ow cto
nd lle
ate Wi O Co
rtiG FSS
Fo
poll
ers
oll
ntr s)
Co gent
r
se
U
i n a
nt
ma SO
lie
Do o FS
C
(n
A major benefit of Polling mode is that no FSSO DC Agents are required. If it is not possible to
install FSSO DC Agents on your domain controllers, this is the alternate configuration available
to you. Polling mode results in a less complex install, and reduces ongoing maintenance. The
minimum permissions required in Polling mode are to read the event log or call NetAPI. To install
FSSO with minimum permissions, see Installing FSSO without using an administrator account
on page 574.
Fortinet Technologies Inc. Page 567 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Figure 121:Citrix SSO topology
Citrix
Users
3 2 Microsoft
Domain
Citrix
FSSO
Network A Agent
3
1 Active Directory
Citrix
Network B Users
Citrix users do not have unique IP addresses. When a Citrix user logs on, the TS agent assigns
that user a range of ports. By default each user has a range of 200 ports.
For a Novell network, there is only one FSSO component to install the eDirectory agent. In
some cases, you also need to install the Novell Client.
Fortinet Technologies Inc. Page 568 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
FSSO security issues
When the different components of FSSO are communicating there are some inherent security
features.
FSSO installation requires an account with network admin privileges. The security inherent in
these types of accounts helps ensure access to FSSO configurations is not tampered with.
User passwords are never sent between FSSO components. The information that is sent is
information to identify a user including the username, group or groups, and IP address.
NTLM uses base-64 encoded packets, and uses a unique randomly generated challenge nonce
to avoid sending user information and password between the client and the server. For more
information on NTLM, see FSSO NTLM authentication support on page 569.
In a Windows AD network, FSSO can also provide NTLM authentication service to the FortiGate
unit. When the user makes a request that requires authentication, the FortiGate unit initiates
NTLM negotiation with the client browser. The FortiGate unit does not process the NTLM
packets itself. Instead, it forwards all the NTLM packets to the FSSO service to process.
NTLM has the benefit of not requiring an FSSO agent, but it is not transparent to users, and the
users web browser must support NTLM.
The NTLM protocol protects the users password by not sending it over the network. Instead,
the server sends the client a random number that the client must encrypt with the hash value of
the user's password. The server compares the result of the client's encryption with the result of
its own encryption. The two will match only if both parties used the same password.
unit
ate
rtiG
Fo
If the NTLM authentication with the Windows AD network is successful, and the user belongs to
one of the groups permitted in the applicable security policy, the FortiGate unit allows the
connection.
Fortinet has tested NTLM authentication with Internet Explorer and Firefox browsers.
Fortinet Technologies Inc. Page 569 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
NTLM in a multiple domain environment
In a multiple domain environment for NTLM, the important factor is that there is a trust relation
between the domains. In a forest, this relation is automatically created. So you can install FSSO
agent on one of the domain controllers without worry.
But in case of multiple domains that are not in a forest, you need to create a trust relation
between the domains. If you do not want to have a trust relation between your multiple
domains, you need to use FSAE 4.0 MR1 and the DC agent needs to be installed once on each
domain. Then you can use security policies to configure server access.
In Figure 123, three domains are shown connected to the FSSO Collector agent server. The
Client logs on to their local Domain Controller, which then sends the user logon event
information to the Collector Agent. When the Client attempts to access the Internet, the
FortiGate unit contacts the Collector Agent for the logon information, sees the Client is
authenticated, and allows access to the Internet. There are multiple domains each with a
domain controller agent (DCagent) that sends logon information to the Collector agent. If the
multiple domains have a trust relationship, only one DCagent is required instead of one per
domain.
FS en
SO t
A
g
D
C 1
ain
in1 om
ma r D
Do trolle AD
n
O r Co
FSS ecto
ll
Co nt
FS en
e
ag
SO t
A
g
t
C
uni
i G ate
rt 3
Fo in2 ain
ma r om
Do trolle AD
D
n
A em r
Co
D b
M rve
se
er
FS en
SO t
A
g
D
C
3
in3 ain
ma r D om
Do trolle AD
n
Co
://
http
r
se
U
nt
lie
C
Fortinet Technologies Inc. Page 570 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
4. The FortiGate unit replies with a 401 proxy auth required status code, and a
Proxy-Authenticate: NTLM <challenge string> (a base 64-encoded NTLM Type 2
challenge packet). In this packet is the challenge nonce, a random number chosen for this
negotiation that is used once and prevents replay attacks.
The TCP connection must be kept alive, as all subsequent authentication-related information is
tied to the TCP connection. If it is dropped, the authentication process must start again from
the beginning.
If the authentication policy reaches the authentication timeout period, a new NTLM handshake
occurs.
Agent installation
After reading the appropriate sections of Introduction to agent-based FSSO on page 563 to
determine which FSSO agents you need, you can proceed to perform the necessary
installations.
Ensure you have administrative rights on the servers where you are installing FSSO agents. It is
best practice to install FSSO agents using the built-in local administrator account. Optionally,
you can install FSSO without an admin account. See Installing FSSO without using an
administrator account on page 574.
In Windows 2008 by default, you do not have administrative user rights if you are logged on as
a user other than as the built-in administrator, even if you were added to the local
Administrators group on the computer.
The FSSO installer first installs the Collector agent. You can then continue with installation of the
DC agent, or you can install it later by going to Start > Programs > Fortinet >
Fortinet Technologies Inc. Page 571 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Fortinet Single Sign On Agent > Install DC Agent. The installer will install a DC agent on the
domain controllers of all of the trusted domains in your network.
Each domain controller connection needs a minimum guaranteed 64kpbs bandwidth to ensure
proper FSSO functionality.Traffic shapers configured on the FortiGate can help guarantee these
minimum bandwidths.
Fortinet Technologies Inc. Page 572 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
If you see an error such as Service Fortinet Single Sign On agent (service_FSAE) failed to start,
there are two possible reasons for this. Verify the user account you selected has sufficient
privileges to run the FSSO service. Also verify the computer system you are attempting to install
on is a supported operating system and version.
DC agent installation
The FSSO_Setup file contains both the Collector agent and DC Agent installers, but the DC
Agent installer is also available separately as either a .exe or .msi file named DCAgent_Setup.
If you reinstall the FSSO software on this computer, your FSSO configuration is replaced with
default settings.
Fortinet Technologies Inc. Page 573 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
If you want to create a redundant configuration, repeat the procedure To install the Collector
agent on page 572 on at least one other Windows AD server.
When you start to install a second Collector agent, cancel the Install Wizard dialog appears the
second time. From the configuration GUI, the monitored domain controller list will show your
domain controllers un-selected. Select the ones you wish to monitor with this Collector agent,
and select Apply.
Before you can use FSSO, you need to configure it on both Windows AD and on the FortiGate
units. Configuring FSSO on FortiGate units on page 589 will help you accomplish these two
tasks.
The following instructions for Windows 2003 are specific to the event log polling mode only. Do
not use this procedure with other FSSO configurations.
Windows 2003
There are two methods in Windows 2003 AD for installing FSSO without an admin account
add the non-admin user to the security log list, and use a non-admin account with read-only
permissions. A problem with the first method is that full rights (read, write, and clear) are
provided to the event log. This can be a problem when audits require limited or no write access
to logs. In those situations, the non-admin account with read-only permissions is the solution.
To add the non-admin user account to the Windows 2003 security log list
1. Go to Default Domain Controller Security Settings > Security Settings > User Rights
Assignment > Manage auditing and security log.
2. Add the user account to this list.
3. Repeat these steps on every domain controller in Windows 2003 AD.
4. A reboot is required.
To use a non-admin account with read-only permissions to install FSSO on Windows 2003
The following procedure provides the user account specified with read only access to the
Windows 2003 AD Domain Controller Security Event Log which allows FSSO to function.
1. Find out the SID of the account you intend to use.
Tools for this can be downloaded for free from
http://technet.microsoft.com/en-us/sysinternals/bb897417.
2. Then create the permission string. For example:
(A;;0x1;;;S-1-5-21-4136056096-764329382-1249792191-1107)
A means Allow,
0x1 means Read, and
S-1-5-21-4136056096-764329382-1249792191-1107 is the SID.
3. Then, append it to the registry key
Fortinet Technologies Inc. Page 574 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
4. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Securit
y\CustomSD.
5. Repeat these steps on every domain controller in Windows 2003 AD.
6. A reboot is required.
Windows 2008
In Windows 2008 AD, if you do not want to use the Domain Admin account then the user
account that starts the FSSO agent needs to be added to the Event Log Readers group.
When the user is added to the Event Log Readers group, that user is now allowed to have read
only access to the event log and this is the minimal rights required for FSSO to work.
Fortinet Technologies Inc. Page 575 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
7. Enter:
eDirectory Server
Use secure connection (SSL) Select to connect to the eDirectory server using
SSL security.
Search Base DN Enter the base Distinguished Name for the user
search.
eDirectory Authentication
8. Select Next.
9. Select Install. When the installation completes, select Finish.
On the FortiGate unit, security policies control access to network resources based on user
groups. With Fortinet Single Sign On, this is also true but each FortiGate user group is
associated with one or more Windows AD user groups. This is how Windows AD user groups
get authenticated in the FortiGate security policy.
Fortinet Single Sign On sends information about Windows user logons to FortiGate units. If
there are many users on your Windows AD domains, the large amount of information might
affect the performance of the FortiGate units.
Fortinet Technologies Inc. Page 576 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
To avoid this problem, you can configure the Fortinet Single Sign On Collector agent to send
logon information only for groups named in the FortiGate units security policies. See
Configuring FortiGate group filters on page 583.
On each server with a Collector agent, you will be
Configuring Windows AD server user groups
Configuring Collector agent settings, including the domain controllers to be monitored
Configuring Directory Access settings
Configuring the Ignore User List
Configuring FortiGate group filters for each FortiGate unit
Configuring FSSO ports
Configuring alternate user IP address tracking
If you change a users group membership, the change does not take effect until the user logs off
and then logs on again.
The FSSO Agent sends only Domain Local Security Group and Global Security Group
information to FortiGate units. You cannot use Distribution group types for FortiGate access. No
information is sent for empty groups.
Refer to Microsoft documentation for information about creating and managing Windows AD
user groups.
Fortinet Technologies Inc. Page 577 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
To configure the Collector agent
1. From the Start menu, select Programs > FortiNet > Fortinet Single Sign On Agent >
Configure Fortinet Single Sign On Agent.
Logging
Log file size limit (MB) Enter the maximum size for the log file in MB.
Fortinet Technologies Inc. Page 578 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Log logon events in separate Record user login-related information separately
logs from other logs. The information in this log
includes
data received from DC agents
user logon/logoff information
workstation IP change information
data sent to FortiGate units
Authentication
Timers
Workstation verify interval Enter the interval in minutes at which the Fortinet
(minutes) Single Sign On Collector agent connects to client
computers to determine whether the user is still
logged on. The default is every 5 minutes. The
interval may be increased if your network has too
much traffic.
Note: This verification process creates security
log entries on the client computer.
If ports 139 or 445 cannot be opened on your
network, set the interval to 0 to prevent checking.
See Configuring FSSO ports on page 584.
Dead entry timeout interval Enter the interval in minutes after which Fortinet
Single Sign On Agent purges information for user
logons that it cannot verify. The default is 480
minutes (8 hours).
Dead entries usually occur because the computer
is unreachable (such as in standby mode or
disconnected) but the user has not logged off. A
common reason for this is when users forget to
logoff before leaving the office for the day.
You can also prevent dead entry checking by
setting the interval to 0.
Fortinet Technologies Inc. Page 579 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
IP address change verify Fortinet Single Sign On Agent periodically checks
interval the IP addresses of logged-in users and updates
the FortiGate unit when user IP addresses
change. IP address verification prevents users
from being locked out if they change IP
addresses, as may happen with DHCP assigned
addresses.
Enter the verification interval in seconds. The
default is 60 seconds. You can enter 0 to prevent
IP address checking if you use static IP
addresses.
This does not apply to users authenticated
through NTLM.
3. You can select Save&Close now or leave the agent configuration window open to complete
additional configuration in the following sections.
To view the version and build number information for your FSSO Collector Agent configuration,
selecting the Fortinet icon in the upper left corner of the Collector agent Configuration screen
and select About Fortinet Single Sign On Agent configuration.
Fortinet Technologies Inc. Page 580 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
3. Select Select DC to Monitor.
If you change AD access mode, you must reconfigure your group filters to ensure that the group
information is in the correct format.
Fortinet Technologies Inc. Page 581 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
2. In the Common Tasks section, select Set Directory Access Information.
3. The Set Directory Access Information dialog box opens.
4. From the AD access mode list, select either Standard or Advanced.
5. If you selected Advanced AD access mode, select Advanced Setting and configure the
following settings and then select OK:
AD server address Enter the address of your networks global catalog server.
AD server port The default AD server port is 3268. This must match your
server port.
BaseDN Enter the Base distinguished name for the global catalog.
This is the point in the tree that will be considered the starting
point by default.
BaseDN example
An example DN for Training Fortinet, Canada is DN = ou=training, ou=canada,
dc=fortinet, dc=com. If you set the BaseDN to ou=canada, dc=fortinet, dc=com
then when Fortinet Single Sign On Agent is looking up user credentials, it will only search the
Canada organizational unit, instead of all the possible countries in the company. Its a short cut
to entering less information and faster searches.
However, you may have problems if you narrow the BaseDN too much when you have
international employees from the company visiting different offices. If someone from Fortinet
Japan is visiting the Canada office in the example above, their account credentials will not be
matched because they are in DN = ou=japan, dc=fortinet, dc=com instead of the
BaseDN ou=canada, dc=fortinet, dc=com. The easy solution is to change the BaseDN to
simply be dc=fortinet, dc=com. Then any search will check all the users in the company.
Fortinet Technologies Inc. Page 582 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Configuring FortiGate group filters
FortiGate group filters actively control which user logon information is sent to each FortiGate
unit. You need to configure the group filter list so that each FortiGate unit receives the correct
user logon information for the user groups that are named in its security policies. These group
filters help limit the traffic sent to the FortiGate unit, and help limit the logon events logged.
The maximum number of Windows AD user groups allowed on a FortiGate depends on the
model. Low end models up to 300A support 256 Windows AD user groups, where mid and high
end models support 1024 groups. This is per VDOM if VDOMs are enabled on the FortiGate
unit.
You do not need to configure a group filter on the Collector agent if the FortiGate unit retrieves
group information from Windows AD using LDAP. In that case, the Collector agent uses the list
of groups you selected on the FortiGate unit as its group filter.
The filter list is initially empty. You need to configure filters for your FortiGate units using the Add
function. At a minimum, create a default filter that applies to all FortiGate units without a defined
filter.
If no filter is defined for a FortiGate unit and there is no default filter, the Collector agent sends
all Windows AD group and user logon events to the FortiGate unit. While this normally is not a
problem, limiting the amount of data sent to the FortiGate unit improves performance by
reducing the amount of memory the unit uses to store the group list and resulting logs.
FortiGate SN The serial number of the FortiGate unit to which this filter applies.
Monitored Groups The Windows AD user groups that are relevant to the security
policies on this FortiGate unit.
3. Select Add to create a new filter. If you want to modify an existing filter, select it in the list and
then select Edit.
Fortinet Technologies Inc. Page 583 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
4. Enter the following information and then select OK.
Default filter Select to create the default filter. The default filter applies to any
FortiGate unit that does not have a specific filter defined in the list.
FortiGate Serial Enter the serial number of the FortiGate unit to which this filter
Number applies. This field is not available if Default is selected.
Description Enter a description of this FortiGate units role in your network. For
example, you could list the resources accessed through this unit.
This field is not available if Default is selected.
Monitor the The Collector agent sends to the FortiGate unit the user logon
following groups information for the Windows AD user groups in this list. Edit this list
using the Add, Advanced and Remove buttons.
Advanced Select Advanced, select the user groups from the list, and then
select Add.
Fortinet Technologies Inc. Page 584 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Configuring alternate user IP address tracking
In environments where user IP addresses change frequently, you can configure Fortinet Single
Sign On Agent to use an alternate method to track user IP address changes. Using this method,
Fortinet Single Sign On Agent responds more quickly to user IP address changes because it
directly queries workstation IP addresses to match users and IP addresses.
This feature requires FSAE version 3.5.27 or later, Fortinet Single Sign On Agent any version,
and FortiOS 3.0 MR7 or later.
Fortinet Technologies Inc. Page 585 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
2. In the Common Tasks section, select Show Monitored DCs.
For each DC Agent, the following information is displayed:
IP address
number of logon events received
the last logon event
when last logon was received.
To change which DC agents are monitored or change the working mode for logon event
monitoring, select Select DC to Monitor.
The FSSO TS agent works with the same FSSO Collector agent that is used for integration with
Windows Active Directory. Install the Collector agent first. Follow the Collector agent installation
procedure in Collector agent installation on page 572.
Configuration steps include:
Install the Fortinet Citrix FSSO agent on the Citrix server.
Install the Fortinet FSSO collector on a server on the network.
Add the Citrix FSSO agent to the FortiGate Single-sign-On configuration.
Add Citrix FSSO groups and users to an FSSO user group.
Add an FSSO identity-based security policy that includes the Citrix FSSO user groups.
To change the TS agent configuration, select from the Start menu Programs > Fortinet > Fortinet
Single Sign-On Agent > TSAgent Config. In addition to the host and Collector agent IP
addresses that you set during installation, you can adjust port allocations for Citrix users. When
a Citrix user logs on, the TS agent assigns that user a range of ports. By default each user has a
range of 200 ports.
Fortinet Technologies Inc. Page 586 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Configuring the FSSO eDirectory agent for Novell eDirectory
You need to configure the eDirectory agent for it to communicate with eDirectory servers. You
may have provided some of this information during installation.
This section includes:
Configuring the eDirectory agent
Adding an eDirectory server
Configuring a group filter
eDirectory Authentication
Listening port Enter the TCP port on which Fortinet Single Sign On
Agent listens for connections from FortiGate units. The
default is 8000. You can change the port if necessary.
User logon Info Search Select how the eDirectory agent accesses user logon
Method information: LDAP or Native (Novell API). LDAP is the
default.
If you select Native, you must also have the Novell
Client installed on the PC.
Logging
Log file size limit (MB) Enter the maximum size for the log file in MB.
Fortinet Technologies Inc. Page 587 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Dump Session List the currently logged-on users in the log file. This
can be useful for troubleshooting.
Set Group Filters... Select the user groups whose user logons will be
reported to the FortiGate unit. This is used only if user
groups are not selected on the FortiGate unit.
Port If the eDirectory server does not use the default port
389, clear the Default check box and enter the port
number.
Use secure connection Select to connect to the eDirectory server using SSL
(SSL) security.
Search Base DN Enter the base Distinguished Name for the user
search.
Fortinet Technologies Inc. Page 588 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
If both the FortiGate LDAP configuration and the eDirectory agent group filter are present, the
FortiGate user group selections are used.
Fortinet Technologies Inc. Page 589 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
To configure LDAP for FSSO - CLI example
config user ldap
edit "ADserver"
set server "10.11.101.160"
set cnid "cn"
set dn "cn=users,dc=office,dc=example,dc=com"
set type regular
set username
"cn=administrator,cn=users,dc=office,dc=example,dc=com"
set password set_a_secure_password
next
end
Agent IP/Name Enter the IP address or the name of the server where this agent is
installed. Maximum name length is 63 characters.
If the TCP port used for FSSO is not the default, 8000, you can
change the setting in the CLI using the config user fsso
command.
See Configuring Collector agent settings on page 577 .
Password Enter the password for the Collector agent or eDirectory agent. For
the Collector agent, this is required only if you configured the agent
to require authenticated access.
5. For Novell eDirectory or Windows AD with Collector agent in Advanced AD access mode
a. select the LDAP Server you configured previously. See Configuring LDAP server access
on page 589.
b. In Users/Groups, select the Edit Users/Groups tab and then select the users or groups
that you want to monitor. Select the View Users/Groups tab to check your selection.
6. Select OK.
Fortinet Technologies Inc. Page 590 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
To specify the FSSO Collector agent - CLI
In this example, the SSO server name is WinAD_1 and the LDAP server is ADserver.
config user fsso
edit WinAD_1
set ldap-server ADserver
set password ENC
G7GQV7NEqilCM9jKmVmJJFVvhQ2+wtNEe9T0iYA5Sa+EqT2J8zhOrbkJFD
r0RmY3c4LaoXdsoBczA1dONmcGfthTxxwGsigzGpbJdC71spFlQYtj
set server 10.11.101.160
set port 8000
end
config user adgrp
edit
Fortinet Technologies Inc. Page 591 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
For the following procedure, the internal interface is port1 and the external interface
connected to the Internet is port2. There is an address group for the internal network called
company_network. The FSSO user group is called fsso_group, and the FSSO RADIUS
server is fsso_rad_server.
Groups Select from the FSSO user groups that you created earlier.
FSSO_Guest_users is a default user group enabled when FSSO is
configured. It allows guest users on the network who do not have
FSSO account to still authenticate and have access to network
resources. See Enabling guest access through FSSO security
policies on page 594.
Schedule always
Action ACCEPT
Logging Options Select Log all Sessions. Logging FSSO logon events helps
troubleshoot any FSSO related issues.
UTM Security Enable AntiVirus, IPS, Web Filter, and Email Filter default profiles.
Profiles
5. Select OK.
A new line of information will appear in the identity-based policy table. The table lists the ID,
user group or groups, the service or services, schedule, UTM, and logging selected for the
rule. Use this display to verify your information was entered correctly.
6. Select OK.
7. Ensure the FSSO authentication policy is at the top of the list so it will be attempted to be
matched before any other policy.
Fortinet Technologies Inc. Page 592 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
To create a security policy for FSSO authentication - CLI
config firewall policy
edit 0
set srcintf internal
set dstintf wan1
set srcaddr company_network
set dstaddr all
set action accept
set identity-based enable
set nat enable
config identity-based-policy
edit 1
set schedule any
set groups company_network FSSO_guest_users
set service HTTP HTTPS FTP TELNET
end
end
Here is an example of how this FSSO authentication policy is used. Example.com employee on
the internal company network logs on to the internal network using their RADIUS username and
password. When that user attempts to access the Internet, which requires FSSO authentication,
the FortiGate authentication security policy intercepts the session, checks with the FSSO
Collector agent to verify the users identity and credentials, and then if everything is verified the
user is allowed access to the Internet.
Fortinet Technologies Inc. Page 593 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Enabling guest access through FSSO security policies
You can enable guest users to access FSSO security policies. Guests are users who are
unknown to the Windows AD or Novell network and servers that do not logon to a Windows AD
domain.
To enable guest access in your FSSO security policy, add an identity-based policy assigned to
the built-in user group FSSO_Guest_Users. Specify the services, schedule and protection
profile that apply to guest users typically guests receive reduced access to a reduced set of
services. See Creating security policies on page 591.
There are two types of FortiOS log messages firewall and event. FSSO-related log messages
are generated from authentication events. These include user logon and log off events, and
NTLM authentication events. These log messages are central to network accounting policies,
and can also be useful in troubleshooting issues. For more information on firewall logging, see
Enabling security logging on page 522. For more information on logging, see the FortiOS
Handbook Log and Reporting chapter.
System activity event All system-related events, such as ping server failure and
gateway status.
User activity event All administration events, such as user logins, resets, and
configuration updates.
Optionally you can enable any or all of the other logging event options.
3. Select Apply.
Fortinet Technologies Inc. Page 594 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Figure 125:Authentication log messages
For more information on logging, see the FortiOS Handbook Log and Reporting chapter.
Testing FSSO
Once FSSO is configured, you can easily test to ensure your configuration is working as
expected. For additional FSSO testing, see Troubleshooting FSSO on page 596.
1. Logon to one of the stations on the FSSO domain, and access an Internet resource.
2. Connect to the CLI of the FortiGate unit, and if possible log the output.
3. Enter the following command:
diagnose debug authd fsso list
Fortinet Technologies Inc. Page 595 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
4. Check the output. If FSSO is functioning properly you will see something similar to the
following:
----FSSO logons----
IP: 192.168.1.230 User: ADMINISTRATOR Groups: VLAD-AD/DOMAIN USERS
IP: 192.168.1.240 User: ADMINISTRATOR Groups: VLAD-AD/DOMAIN USERS
Total number of users logged on: 2
----end of FSSO logons----
The exact information will vary based on your installation.
5. Check the FortiGate event log, for FSSO-auth action or other FSSO related events with
FSSO information in the message field. For a list of FSSO log message IDs, see Table 26 on
page 595.
6. To check server connectivity, run the following commands from the CLI:
FGT# diagnose debug enable
FGT# diagnose debug authd fsso server-status
FGT# Server Name Connection Status
----------- -----------------
SBS-2003 connected
Troubleshooting FSSO
When installing, configuring, and working with FSSO some problems are quite common. A
selection of these problems follows including explanations and solutions.
Some common Windows AD problems include:
General troubleshooting tips for FSSO
User status Not Verified on the Collector agent
After initial configuration, there is no connection to the Collector agent
FortiGate performance is slow on a large network with many users
Users from the Windows AD network are not able to access the network
Users on a particular computer (IP address) can not access the network
Guest users do not have access to network
Cant find the DCagent service
User logon events not received by FSSO Collector agent
User list from Windows AD is empty
Mac OS X users cant access external resources after waking from sleep mode
Fortinet Technologies Inc. Page 596 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
General troubleshooting tips for FSSO
The following tips are useful in many FSSO troubleshooting situations.
To help locate the problem, configure a sniffer policy to capture FSSO logon messages along
with other information.
If FSSO is in use the log messages captured by a sniffer policy will include a user name if the
IP address in the log message corresponds to the IP address if a user who has been
authenticated with FSSO.
Ensure all firewalls are allowing the FSSO required ports through.
FSSO has a number of required ports that must be allowed through all firewalls or
connections will fail. These include: ports 139, 389 (LDAP), 445, 636 (LDAP) 8000, and 8002.
Ensure the Collector agent has at least 64kbps bandwidth to the FortiGate unit.
If not the Collector agent does not have this amount of bandwidth, information FSSO
information may not reach the FortiGate unit resulting in outages. The best solution is to
configure traffic shaping between the FortiGate unit and the Collector agent to ensure that
minimum bandwidth is always available.
Solution
There are a few things that can cause the Collector agent not to be able to connect to the user's
work station. Below is a list of the most common causes:
Most commonly, a host firewall on the user's workstation or a router on the network prevents
remote access on ports 139 and/or 445. Try opening the ports on the host firewall.
If the remote registry service is not running on the user's workstation, the Collector agent will
not be able to connect to the registry remotely. Make sure the remote registry service is
running.
This problem may also be caused by a known MS upgrade issue.
Using Regedit.exe, edit HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SecurePipeServers, set permissions for winreg and allow Local Service with
R and W permissions.
Fortinet Technologies Inc. Page 597 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Solution
If there are no network problems that can be identified, try the following solutions.
The Windows AD network must be configured before configuring the FortiGate unit. This
includes the domain controller agents, and Collector agents.
Ensure the DC agents point to the correct collector agent port and IP address.
Ensure that TCP port 8000, and UDP port 8002 are not blocked.
FSSO is very dependent on DNS, ensure the forward DNS zone has no stale records and
after adding it to the domain if the DNS entry is not in the zone add it.
An error in the DNI field on the FortiGate unit will prevent connections. Select the browse
button next to the field to confirm it can connect correctly to the Windows AD server and
return information. See
If the secure check box is selected, ensure that LDAP v3 is being used since earlier LDAP
does not support secure TLS connections.
Ensure that the default LDAP ports are not being blocked on the network. These ports
include port 389, and port 636. If you change the default ports, ensure both the FortiGate
unit and the Windows AD server are using the same port numbers and that those ports are
allowed through all firewalls on your network.
If you are using FSSO in polling mode, ensure that port 445 is not blocked by firewalls.
Solution
Reinstall FSSO.
Fortinet Technologies Inc. Page 598 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Solution
Add users to the Ignore User list. This a best practice for admin accounts whose logon
information will not be sent to the FortiGate unit. This is useful for automated accounts that may
logon many times. Examples of accounts in this category include:
IIS services
AV
other system accounts
For more information on configuring the Ignore users list, see Configuring the Ignore User List
on page 582.
Users from the Windows AD network are not able to access the network
If nobody can access the network and your network has only one Collector agent, when it goes
offline no users will have access. However if only some users can not access the network, it is
likely that user group changes were made recently that are causing the problems.
Solutions
If there is only one Collector agent, configure additional Collector agents in the domain to act
as backups. They will provide the redundancy required if the original collector goes offline.
Remember to add them to the Fortinet Single Sign-On Agent entry under User & Device >
Authentication > Single Sign-On on the web-based manager or config user fsso in the
CLI. If the server and port for the new agent are not in the list, it will not be contacted.
Ensure the Collector agent has at least 64kbps bandwidth to the FortiGate unit. If not,
information FSSO information may not reach the FortiGate unit resulting in outages. The best
solution is to configure traffic shaping between the FortiGate unit and the Collector agent to
ensure that minimum bandwidth is always available.
If some users can not connect, verify their Windows AD records to find groups in common,
and investigate the state of those groups focusing on any recent changes. It may be a group
or permission change is the reason.
There may be a a problem with the user list. See User list from Windows AD is empty on
page 600.
Users on a particular computer (IP address) can not access the network
Windows AD Domain Controller agent gets the username and workstation where the logon
attempt is coming from. If there are two computers with the same IP address and the same user
trying to logon, it is possible for the authentication system to become confused and believe that
the user on computer_1 is actually trying to access computer_2.
Windows AD does not track when a user logs out. It is possible that a user logs out on one
computer, and immediate logs onto a second computer while the system still believes the user
is logged on the original computer. While this is allowed, information that is intended for the
session on one computer may mistakenly end up going to the other computer instead. The
result would look similar to a hijacked session.
Solutions
Ensure each computer has separate IP addresses.
Encourage users to logout on one machine before logging onto another machine.
If multiple users have the same username, change the usernames to be unique.
Shorten timeout timer to flush inactive sessions after a shorter time.
Fortinet Technologies Inc. Page 599 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
Guest users do not have access to network
A group of guest users was created, but they dont have access.
Solution
The group of the guest users was not included in a policy, so they do not fall under the guest
account. To give them access, associate their group with a security policy.
Additionally, there is a default group called FSSO_Guest_Users. Ensure that group is part of an
identity-based security policy to allow traffic.
Solution
Solution
There could be 2 problems:
In most cases, the FortiGate receives login information, but can't translate the Windows AD
group into the protection profile. Make sure that all the required Windows AD groups are
included in the FortiGate user groups and that all FortiGate user groups are included into the
authentication security policy.
There may be a problem with AD FSSO service running on the Windows AD server.
Fortinet Technologies Inc. Page 600 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
To ensure the problem is on windows side
1. Go to Log&Report > Log Config.
2. Enable firewall authentication event logging and debug level logging on the FortiGate.
3. Ask one or more users to log in into windows.
4. Check the FortiGate logs for the logon event from the Windows AD server.
If there is no new logon event entry in the logs, the problem is with Windows side. Use MS
Windows AD documentation to troubleshoot the problem.
Mac OS X users cant access external resources after waking from sleep mode
When client computers running Mac OS X (10.6.X and higher) wake up from sleep mode, the
user must authenticate again to be able to access external resources. If the user does not
re-authenticate, the user will maintain access to internal web sites, but will be unable to access
any external resources.
This issue is caused by Mac OS X not providing sufficient information to the FSAE. This results
in the FortiGate blocking access to the user because they cannot be authenticated.
Solution
The security settings on client computer(s) must be configured to require that a username and
password be entered when exiting sleep mode or screen saver. With this feature enabled in Mac
OS X, the FortiGate will receive the authentication information it requires to authenticate the
user and allow them access.
Note that if the user reverts their settings to disable the password requirement, this will cause
the issue to reappear.
Fortinet Technologies Inc. Page 601 FortiOS Handbook v5.0 MR0 Authentication for FortiOS 5.0
SSO using RADIUS accounting records
A FortiGate unit can authenticate users transparently who have already authenticated on an
external RADIUS server. Based on the user group to which the user belongs, the security policy
applies the appropriate UTM profiles. RADIUS SSO is relatively simple because the FortiGate
unit does not interact with the RADIUS server, it only monitors RADIUS accounting records that
the server emits. These records include the users IP address and user group.
After the initial set-up, changes to the user database, including changes to user group
memberships, are made on the external RADIUS server, not on the FortiGate unit.
This section describes:
Users view of RADIUS SSO authentication
Configuration Overview
Configuring the RADIUS server
Creating the FortiGate RADIUS SSO agent
Defining local user groups for RADIUS SSO
Creating security policies
Example: webfiltering for student and teacher accounts
Configuration Overview
Page 602
Configuring the RADIUS server
You can configure FortiGate RSSO to work with most RADIUS-based accounting systems. In
most cases, you only need to do the following to your RADIUS accounting system:
Add a user group name field to customer accounts on the RADIUS server so that the name
is added to the RADIUS Start record sent by the accounting system to the FortiOS unit. User
group names do not need to be added for all users, only to the accounts of users who will
use RSSO feature on the FortiGate unit.
Configure your accounting system to send RADIUS Start records to the FortiOS unit. You
can send the RADIUS Start records to any FortiGate network interface. If your FortiGate unit
is operating with virtual domains (VDOMs) enabled, the RADIUS Start records must be sent
to a network interface in the management VDOM.
Once you define a RADIUS SSO (RSSO) agent, the FortiGate unit will accept user logon
information from any RADIUS server that has the same shared secret. You can create only one
RSSO agent in each VDOM.
Before you create the RSSO agent, you need to allow RADIUS accounting information on the
interface that connects to the RADIUS server.
Fortinet Technologies Inc. Page 603 FortiOS Handbook - Authentication for FortiOS 5.0
To create a RADIUS SSO agent - CLI
In this example, the RADIUS server secret is fortinet.
config user radius
edit RSSO_Agent
set rsso enable
set rsso-validate-request-secret enable
set rsso-secret fortinet
set rsso-radius-response enable
end
When the RSSO agent is created in the web-based manager, it is automatically named
RSSO_Agent. You can use any name when creating the agent in the CLI.
The Endpoint block attribute can be used to block a user. If the attribute value is Block,
FortiOS blocks all traffic from that users IP address. The RSSO fields are visible only when
rsso is set to enable.
Fortinet Technologies Inc. Page 604 FortiOS Handbook - Authentication for FortiOS 5.0
profile-missing FortiOS cannot find a user group name in a RADIUS start message that
matches the name of an RSSO user group in FortiOS.
protocol-error A RADIUS protocol error occurred.
radiusd-other Other events, described in the log message.
You cannot use RADIUS user groups directly in security policies. Instead, you create
locally-defined user groups on the FortiGate unit and associate each of them with a RADIUS
user group.
RADIUS SSO uses regular identity-based security policies. The RSSO user group you specify
determines which users are permitted to use the policy. You can create multiple authentication
rules so that various user groups can have different UTM features enabled, different permitted
services, schedules, and so on.
Fortinet Technologies Inc. Page 605 FortiOS Handbook - Authentication for FortiOS 5.0
4. In Configure Authentication Rules, select Create New and enter:
Group(s) Select the user groups you created for RSSO. See Defining local
user groups for RADIUS SSO on page 605.
Schedule as needed
Service
Action ACCEPT
UTM Security Profiles Select UTM security profiles appropriate for the user group.
5. Select OK.
6. Repeat steps 4 and 5 for each user group that is allowed to use this security policy.
Schedule, Service, and UTM profiles can be different for each group.
7. Select OK.
To ensure an RSSO-related policy is matched first, the policy should be placed higher in the
security policy list than more general policies for the same interfaces.
Fortinet Technologies Inc. Page 606 FortiOS Handbook - Authentication for FortiOS 5.0
Example: webfiltering for student and teacher accounts
The following example uses RADIUS SSO to apply web filtering to students, but not to teachers.
Assume that the RADIUS server is already configured to send RADIUS Start and Stop records
to the FortiGate unit. There are two RADIUS user groups, students and teachers, recorded in the
default attribute Class. The workstations are connected to port1, port2 connects to the RADIUS
server, and port3 connects to the Internet.
Name student
FortiGuard Enable. Right-click the Potentially Liable category and select Block.
Categories Repeat for Adult/Mature Content and Security Risk.
Define local user groups associated with the RADIUS SSO user groups
1. Go to User & Device > User > User Groups and select Create New.
2. Enter the following and select OK.
Name RSSO-students
Name RSSO-teachers
Fortinet Technologies Inc. Page 607 FortiOS Handbook - Authentication for FortiOS 5.0
Create a security policy for RSSO
1. Go to Policy > Policy > Policy and select Create New.
2. Enter
Group(s) RSSO-students
Schedule always
Action ACCEPT
4. Select OK.
5. In Configure Authentication Rules, select Create New and enter:
Group(s) RSSO-teachers
Schedule always
Service ALL
Action ACCEPT
6. Select OK.
7. Select OK to save the policy.
8. Repeat steps 4 and 5 for each user group that is allowed to use this security policy.
Schedule, Service, and UTM profiles can be different for each group.
9. Select OK.
Fortinet Technologies Inc. Page 608 FortiOS Handbook - Authentication for FortiOS 5.0
Monitoring authenticated users
This section describes how to view lists of currently logged-in firewall and VPN users. It also
describes how to disconnect users.
The following topics are included in this section:
Monitoring firewall users
Monitoring SSL VPN users
Monitoring IPsec VPN users
To monitor firewall users, go to User & Device > Monitor > Firewall.
You can de-authenticate a user by selecting the Delete icon for that entry.
You can filter the list of displayed users either by selecting the funnel icon for one of the column
titles or selecting Filter Settings.
Select Column Settings to add or remove columns to the display, or rearrange the order of the
columns displayed.
Optionally, you can select De-authenticate all users. Best practices dictate that this only be
used in extreme cases since all users will momentarily loose their network resource
connections.
You can monitor web-mode and tunnel-mode SSL VPN users by username and IP address.
To monitor SSL VPN users, go to VPN > Monitor > SSL-VPN Monitor. To disconnect a user,
select the user and then select the Delete icon.
The first line, listing the username and IP address, is present for a user with either a web-mode
or tunnel-mode connection. The Subsession line is present only if the user has a tunnel mode
connection. The Description column displays the virtual IP address assigned to the users
tunnel-mode connection.
For more information about SSL VPN, see the FortiOS Handbook SSL VPN chapter.
Page 609
To monitor SSL VPN users - CLI
To list all of the SSL VPN sessions and their index numbers:
execute vpn sslvpn list
The output looks like this:
SSL-VPN Login Users:
Index User Auth Type Timeout From HTTPS in/out
0 user1 1 256 172.20.120.51 0/0
SSL-VPN sessions:
Index User Source IP Tunnel/Dest IP
0 user2 172.20.120.51 10.0.0.1
You can use the Index value in the following commands to disconnect user sessions:
To monitor IPsec VPN tunnels in the web-based manager, go to VPN > Monitor > IPsec Monitor.
user names are available only for users who authenticate with XAuth.
You can close a tunnel by selecting its Bring Down link in the Status column.
The Banned User list shows all IP addresses and interfaces blocked by NAC quarantine. The list
also shows all IP addresses, authenticated users, senders, and interfaces blocked by Data Leak
Prevention (DLP). The system administrator can selectively release users or interfaces from
quarantine or configure quarantine to expire after a selected time period.
Fortinet Technologies Inc. Page 610 FortiOS Handbook - Authentication for FortiOS 5.0
All sessions started by users or IP addresses on the Banned User list are blocked until the user
or IP address is removed from the list. All sessions to an interface on the list are blocked until
the interface is removed from the list.
You can configure NAC quarantine to add users or IP addresses to the Banned User list under
the following conditions:
Users or IP addresses that originate attacks detected by IPS - To quarantine users or IP
addresses that originate attacks, enable and configure Quarantine Attackers in an IPS
Sensor Filter.
IP addresses or interfaces that send viruses detected by virus scanning - To quarantine
IP addresses that send viruses or interfaces that accept traffic containing a virus, enable
Quarantine Virus Sender in an antivirus profile.
Users or IP addresses that are banned or quarantined by Data Leak Prevention -Set
various options in a DLP sensor to add users or IP addresses to the Banned User list.
For more information, see FortiOS Handbook UTM chapter.
Banned users are viewed from User & Device > Monitor > Banned User.
Clear Removes all users and IP addresses from the Banned User list.
Application The protocol that was used by the user or IP address added to the
Protocol Banned User list.
Cause or The Fortinet function that caused the user or IP address to be added to
rule the Banned User list. Cause or rule can be IPS, Antivirus, or Data Leak
Prevention.
Created The date and time the user or IP address was added to the Banned User
list.
Expires The date and time the user or IP address will be automatically removed
from the Banned User list. If Expires is Indefinite, you must manually
remove the user or host from the list.
Delete Removes the selected user or IP address from the Banned User list.
Monitoring IM users
User lists can be managed to allow or block certain users. Each user can be assigned a policy
to allow or block activity for each IM protocol. Each IM function can be individually allowed or
blocked providing the administrator the granularity to block the more bandwidth consuming
features such as voice chat while still allowing text messaging. The IM user monitor list displays
information about instant messaging users who are currently connected. The list can be filtered
by protocol. After IM users connect through the firewall, the unit displays which users are
Fortinet Technologies Inc. Page 611 FortiOS Handbook - Authentication for FortiOS 5.0
connected. You can analyze the list and decide which users to allow or block. A policy can be
configured to handle unknown users.
Active IM users are viewed from User & Device > Monitor > IM.
IM users who are already logged on before changes are made to the IM user profile will not be
affected until their next login. You cannot disconnect users who have already logged on by
enabling logon blocking.
IM page
Lists all active IM users that are currently active. This page allows you to view blocked
users as well as users that are currently using a particular IM protocol, such as MSN.
Protocol Filter the list by selecting the protocol for which to display current users:
AIM, ICQ, MSN, or Yahoo. All current users can also be displayed.
User The name selected by the user when registering with an IM protocol. The
Name same user name can be used for multiple IM protocols. Each user
name/protocol pair appears separately in the list.
Source IP The IP address where the user initiated the IM session from.
Last The last time the current user used the protocol.
Login
Block Select to add the user name to the permanent black list. Each user
name/protocol pair must be explicitly blocked by the administrator.
Fortinet Technologies Inc. Page 612 FortiOS Handbook - Authentication for FortiOS 5.0
Examples and Troubleshooting
This chapter provides an example of a FortiGate unit providing authenticated access to the
Internet for both Windows network users and local users.
The following topics are included in this section:
Firewall authentication example
LDAP Dial-in using member-attribute
RADIUS SSO example
Troubleshooting
17
2.2
0.1 Port 00
rt 3 2.1
20 1
.14 Po 1.10
. 1
1 10
Network_1
Windows network
10.11.102.0/24
10.11.101.0/24 rt 2
Po 00 _1
1 .1 ate
.10 rtiG
.11 Fo
10
ain
d om O
D S
s A ith FS
ow
i nd ller w 0
W tro .16
1
con 1.10
.1
10
Overview
In this example, there is a Windows network connected to Port 2 on the FortiGate unit and
another LAN, Network_1, connected to Port 3.
All Windows network users authenticate when they logon to their network. Members of the
Engineering and Sales groups can access the Internet without entering their authentication
credentials again. The example assumes that the Fortinet Single Sign On (FSSO) has already
been installed and configured on the domain controller.
LAN users who belong to the Internet_users group can access the Internet after entering their
username and password to authenticate. This example shows only two users, User1 is
authenticated by a password stored on the FortiGate unit, User2 is authenticated on an external
authentication server. Both of these users are referred to as local users because the user
account is created on the FortiGate unit.
Page 613
Creating a locally-authenticated user account
User1 is authenticated by a password stored on the FortiGate unit. It is very simple to create
this type of account.
username User1
Password hardtoguess
3. Select OK.
Name OurRADIUSsrv
Fortinet Technologies Inc. Page 614 FortiOS Handbook - Authentication for FortiOS 5.0
2. Enter the following information and select OK:
Match user on RADIUS server Select this option and then select OurRADIUSsrv from
the list.
Name ADserver
User DN cn=FSSO_Admin,cn=users,dc=office,dc=example,dc=com
Password set_a_secure_password
Fortinet Technologies Inc. Page 615 FortiOS Handbook - Authentication for FortiOS 5.0
To configure LDAP for FSSO - CLI
config user ldap
edit "ADserver"
set server "10.11.101.160"
set dn "cn=users,dc=office,dc=example,dc=com"
set type regular
set username
"cn=administrator,cn=users,dc=office,dc=example,dc=com"
set password set_a_secure_password
next
end
Name WinGroups
Password fortinet_canada
Fortinet Technologies Inc. Page 616 FortiOS Handbook - Authentication for FortiOS 5.0
To create the FSSO_Internet-users user group - CLI
config user group
edit FSSO_Internet_users
set group-type fsso-service
set member CN=Engineering,cn=users,dc=office,dc=example,dc=com
CN=Sales,cn=users,dc=office,dc=example,dc=com
end
Name Internet_users
Type Firewall
Type Subnet
Interface Port 3
Type Subnet
Interface Port 2
Fortinet Technologies Inc. Page 617 FortiOS Handbook - Authentication for FortiOS 5.0
Creating security policies
Two security policies are needed: one for firewall group who connect through port3 and one for
FSSO group who connect through port2.
Group(s) FSSO_Internet_users
Schedule always
Service ALL
4 Select OK.
Fortinet Technologies Inc. Page 618 FortiOS Handbook - Authentication for FortiOS 5.0
To create a security policy for local user authentication - web-based manager
1. Go to Policy > Policy and select Create New.
2. Enter the following information:
Group(s) Internet_users
Schedule always
Service ALL
4 Select OK.
Fortinet Technologies Inc. Page 619 FortiOS Handbook - Authentication for FortiOS 5.0
LDAP Dial-in using member-attribute
In this example, users defined in MicroSoft Windows Active Directory (AD) are allowed to set up
a VPN connection simply based on an attribute that is set to TRUE, instead of based on their
user group. In AD the "Allow Dialin" property is activated in the user properties, and this sets the
msNPAllowDialin attribute to "TRUE".
This same procedure can be used for other member attributes, as your system requires.
To accomplish this with a FortiGate unit, member-attribute must be set. This can only be
accomplished through the CLI - the option is not available through the web-based manager.
Before configuring the FortiGate unit, ensure the AD server has the msNPAllowDialin
attribute set to "TRUE" for the users in question. If not, those users will not be able to
authenticate.
Once these settings are in place, users that are a member of the ldap user group will be able to
authenticate.
To ensure your settings are correct, here is the sample output from a diag debug command that
shows the authentication process.
Fortinet Technologies Inc. Page 620 FortiOS Handbook - Authentication for FortiOS 5.0
When the "Allow Dial-in" attribute is set to "TRUE" the following will likely be in the output:
get_member_of_groups-Get the memberOf groups.
get_member_of_groups- attr='msNPAllowDialin', found 1 values
get_member_of_groups-val[0]='TRUE'
fnbamd_ldap_get_result-Auth accepted
fnbamd_ldap_get_result-Going to DONE state res=0
fnbamd_auth_poll_ldap-Result for ldap svr 192.168.201.3 is SUCCESS
fnbamd_auth_poll_ldap-Passed group matching
If the attribute is not set but it is expected, the following will likely be in the output:
get_member_of_groups-Get the memberOf groups.
get_member_of_groups- attr='msNPAllowDialin', found 1 values
get_member_of_groups-val[0]='FALSE'
fnbamd_ldap_get_result-Auth accepted
fnbamd_ldap_get_result-Going to DONE state res=0
fnbamd_auth_poll_ldap-Result for ldap svr 192.168.201.3 is SUCCESS
fnbamd_auth_poll_ldap-Failed group matching
The only difference between these two outputs is the last line which is either passed or failed
based on if the member-attribute is set to the expected value or not.
A common RADIUS SSO topology involves a medium sized company network of users
connecting to the Internet through the FortiGate unit, and authenticating with a RADIUS server.
RADIUS SSO authentication was selected because it is fast and relatively easy to configure.
This section includes:
Assumptions
Topology
General configuration
Configuring RADIUS
Configuring FortiGate regular and RADIUS SSO security policies
Testing
Assumptions
VDOMs are not enabled
The admin super_admin administrator account will be used for all FortiGate unit
configuration.
Any other devices on the network do not affect the topology of this example, and therefore
are not included.
Anywhere settings are not described, they are assumed to be default values.
A RADIUS server is installed on a server or FortiAuthenticator unit and uses default
attributes.
BGP is used for any dynamic routing.
Authentication event logging under Log&Report has been configured.
Fortinet Technologies Inc. Page 621 FortiOS Handbook - Authentication for FortiOS 5.0
Topology
Example.com has an office with 20 users on the internal network. These users need access to
the Internet to do their jobs. The office network is protected by a FortiGate-60C unit with access
to the Internet through the wan1 interface, the user network on the internal interface, and all the
servers are on the DMZ interface. This includes an Ubuntu Linux server running FreeRADIUS.
For this example only two users will be configured Pat Lee with an account name plee, or
plee@example.com, and Kelly Green with an account name kgreen, or
kgreen@example.com.
e
Wa fac
n
17 1 in nter 00 er S
i
Z 1. 1 erv IU
2.2 ter
0.1 fac DM 1.10 u x s eRAD
20 e .1 Lin Fre .161
.14 10 h 1
1 wit 1.10
.1
10
Fo Int
rtiG 10 ernal
ate .11 in
.10 ter
2.1 fac
00 e
Main_network
10.11.102.0/24
General configuration
1. Configuring RADIUS with users, user group, and FortiGate information.
2. Configuring FortiGate interfaces
3. Configuring FortiGate regular and RADIUS SSO security policies
Configuring RADIUS
Configuring RADIUS includes configuring the RADIUS server such as FreeRADIUS, a radius
client on users computers, and configuring users in the system. For this example the two users
will be Pat Lee, and Kelly Green. They belong to a group called exampledotcom_employees.
When it is all configured, the RADIUS daemon needs to started.
The users have a RADIUS client installed on their PCs that allows them to authenticate through
the RADIUS server.
FreeRADIUS can be found on the freeradius.org website. For any problems installing
FreeRADIUS, see the FreeRADIUS documentation.
Fortinet Technologies Inc. Page 622 FortiOS Handbook - Authentication for FortiOS 5.0
Table 28: FortiGate interfaces used in this example
Alias Internet
Comments Internet
Administrative Status Up
Alias Servers
Comments Servers
Administrative Status Up
Fortinet Technologies Inc. Page 623 FortiOS Handbook - Authentication for FortiOS 5.0
7. Enter the following information and select OK.
Netmask 255.255.255.0
Administrative Status Up
Fortinet Technologies Inc. Page 624 FortiOS Handbook - Authentication for FortiOS 5.0
Configuring FortiGate regular and RADIUS SSO security policies
With the RADIUS server and FortiGate interfaces configured, security policies can be
configured. This includes both RADIUS SSO and regular policies, as well as addresses and
address groups. All policies require NAT to be enabled.
Table 29: security policies needed for RADIUS SSO
2 internal -> wan1 regular always Allow essential network services and
VoIP.
5 any -> any deny always Implicit policy denying all traffic that
hasnt been matched
The RADIUS SSO policy must be placed at the top of the policy list so it is matched first. The
only exception to this is if you have a policy to deny access to a list of banned users. In this
case, that policy must go at the top so the RADIUS SSO does not mistakenly match a banned
user or IP address.
Schedules
Only one schedule needs to be configured business_hours. This is a fairly standard
Monday to Friday 8am to 5pm schedule, or whatever days and hours covers standard work
hours at the company.
Address groups
The following address groups need to be configured before the security policies.
Table 30:
Fortinet Technologies Inc. Page 625 FortiOS Handbook - Authentication for FortiOS 5.0
Table 30:
Service groups
The following service groups need to be configured before the security policies. Note that the
services listed are suggestions and may include more or less as required.
Table 31:
The following security policy configurations are basic and only include logging, and default AV
and IPS.
Schedule always
Service essential_network_services
Action ACCEPT
UTM enable
Fortinet Technologies Inc. Page 626 FortiOS Handbook - Authentication for FortiOS 5.0
Enable Antivirus enable Default
3. Select Create New, enter the following information, and select OK.
Schedule always
Service essential_server_services
Action ACCEPT
UTM enable
4. Select Create New, enter the following information, and select OK.
Schedule always
Service all
Action ACCEPT
UTM enable
Fortinet Technologies Inc. Page 627 FortiOS Handbook - Authentication for FortiOS 5.0
Enable Antivirus enable Default
Schedule business_hours
Service ALL
Action ACCEPT
UTM Security Profiles Enable AntiVirus, WebFilter, IPS, and Email Filter. In each case,
select the default profile.
5. Select OK.
6. Repeat steps 4 and 5 for each user group that is allowed to use this security policy.
Schedule, Service, and UTM profiles can be different for each group.
7. Select OK.
To ensure an RSSO-related policy is matched first, the policy should be placed higher in the
security policy list than more general policies for the same interfaces.
Testing
Once configured, a user only needs to logon to their PC using their RADIUS account. After that
when they attempt to access an Internet website, the FortiGate unit will use their session
Fortinet Technologies Inc. Page 628 FortiOS Handbook - Authentication for FortiOS 5.0
information to get their RADIUS information. Once the user is verified, they are allowed access
to the website.
To test the configuration perform the following steps.
1. Have user plee logon to their PC, and try to access an Internet website.
2. The FortiGate unit will contact the RADUS server for user plees information.
3. Once confirmed, plee will have access to the website.
Each step generates log entries that enable you to verify that each step was successful.
If a step is unsuccessful, confirm your configuration is correct and see Troubleshooting
dynamic profiles on page 230.
Company Servers
10.11.101.0/24
2
ver
3 S ser
DIU
wa RA
n1 z
dm
Fo
rtiG int 1 10
ern .11 User
ate al .10 pl
2.1 ee
10
internal_network
10.11.102.0/24
Troubleshooting
In the web-based manager, a good tool for troubleshooting is the packet counter column on the
security policy page (Policy > Policy). This column displays the number of packets that have
passed through this security policy. Its value when you are troubleshooting is that when you are
testing your configuration (end to end connectivity, user authentication, policy use) watching the
packet count for an increase confirms any other methods you may be using for troubleshooting.
It provides the key of which policy is allowing the traffic, useful information if you expect a user
to require authentication and it never happens. For more information about authentication
security policies, see Authentication in security policies on page 517.
This section addresses how to get more information from the CLI about users and user
authentication attempts to help troubleshoot failed authentication attempts.
diag firewall iprope authuser
Shows the IP of where your computer is connected from. This is useful to confirm
authorization and VPN settings.
Fortinet Technologies Inc. Page 629 FortiOS Handbook - Authentication for FortiOS 5.0
diag firewall auth list
List all the authorized users on this system.
Fortinet Technologies Inc. Page 630 FortiOS Handbook - Authentication for FortiOS 5.0
Chapter 4 FortiOS Carrier
Page 631
Overview of FortiOS Carrier features
FortiOS Carrier specific features include Multimedia messaging service (MMS) protection, and
GPRS Tunneling Protocol (GTP) protection.
All FortiGate units, carrier-enabled or not, are capable of handling Stream Control Transmission
Protocol (SCTP) traffic, which is a protocol designed for and primarily used in Carrier networks.
This section includes:
Overview
Registering FortiOS Carrier
MMS background
How FortiOS Carrier processes MMS messages
MMS protection profiles
Bypassing MMS protection profile filtering based on carrier endpoints
Applying MMS protection profiles to MMS traffic
GTP basic concepts
Parts of a GTPv1 network
GPRS network common interfaces
Packet flow through the GPRS network
SCTP
Overview
FortiOS Carrier provides all the features found on FortiGate units plus added features specific to
carrier networks: MMS and GTP.
MMS
MMS is a standard for sending messages that include multimedia content between mobile
phones. MMS is also popular as a method of delivering news and entertainment content
including videos, pictures, and text. Carrier networks include four different MMS types of
messages MM1, MM3, MM4, and MM7. See MMS background on page 633.
GTP
The GPRS Tunneling Protocol (GTP) runs on GPRS carrier networks. GPRS is a GSM packet
radio standard. It provides more efficient usage of the radio interface so that mobile devices can
share the same radio channel. FortiOS supports GTPv1 release 7.15.0 and GTPv1 release
8.12.0.
GPRS provides direct connections to the Internet (TCP/IP) and X.25 networks for point-to-point
services (connection-less/connection oriented) and point-to-multipoint services (broadcast).
GPRS currently supports data rates from 9.6 kbps to more than 100 kbps, and it is best suited
for burst forms of traffic. GPRS involves both radio and wired components. The mobile phone
sends the message to a base station unit (radio based) that converts the message from radio to
Page 632
wired, and sends the message to the carrier network and eventually the Internet (wired carrier
network). See GTP basic concepts on page 645.
In FortiOS 5.0, the Carrier registration process has changed. Devices are no longer shipped with
Carrier functions built-in, so that administrators will have more leeway in configuring Carrier
functions on existing devices.
A license is purchased from Fortinet, and is delivered by mail as a scratch card. The contained
registration code is entered into the CLI according to the instructions on the card. The FortiGate
will then factory reset itself into Carrier mode.
Only certain models support Carrier mode. Contact Fortinet Support for more information and
firmware images.
MMS background
MMS is a common method for mobile users to send and receive multimedia content. A Carrier
network supports MMS across its network. This makes up the MMS Service Provider Network
(MSPN).
Messages can be sent or received between the MMSC and a number of other services
including the Internet, content providers, or other carriers. Each of these different service
connections uses different MMS formats including MM1 and MM7 messages (essentially HTTP
format), and MM3 and MM4 messages (SMTP formatted). These different formats reflect the
different purposes and content for each type of MMS message.
Content
Provider
MM7
(HTTP/SOAP)
MMS
Service
Provider
Mobile Network
Users
MM1 MM3
(HTTP)
(SMTP)
MMSC
Fortinet Technologies Inc. Page 633 FortiOS Handbook - Carrier for FortiOS 5.0
Center (MMSC). MMS content to be monitored and controlled comes from these mobile users
and is going to the provider network.
Other MMS content interfaces that connect a service provider network to other external sources
can pose threats as well. MM3 handles communication between the Internet and the MMSC
and is a possible source of viruses and other content problems from the Internet. MM4 handles
communication between different content provider MMSCs. Filtering MM4 content protects the
service provider network from content sent from foriegn service providers and their subscribers.
Finally MM7 is used for communication between content providers and the MMSC. Filtering
MM3 content can also keep harmful content off of the service provider network.
Fortinet Technologies Inc. Page 634 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 133:MM1 transactions between senders and receivers and the MMSC
5. WSP/HTTP GET.req
(Requests the MM.content)
If the recipient is on another carrier, the MMSC forwards the message to the recipient's carrier.
This forwarding uses the MM4 content interface for forwarding content between operator
MMSCs (see Figure 134).
Before the MMSC can forward the message to the final recipient, it must first determine if the
receivers handset can receive MMS messages using the MM1 content interface. If the recipient
can use the MM1 content interface, the content is extracted and sent to a temporary storage
server with an HTTP front-end.
To retrieve the message, the receivers handset establishes a connection with the MMSC. An
HTTP get request is then sent from the recipient to the MMSC.This message contains the URL
where the content of the message is stored. The MMSC responds with a retrieve confirmation
(m-retrieve.conf) HTTP response that contains the message.
Fortinet Technologies Inc. Page 635 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 134:MM4 messages sent between operator MMSCs
3. MM4-delivery-report.req (feedback
required by UA pr VASP)
This causes the receivers handset to retrieve the content from the embedded URL. Several
messages are exchanged to indicate status of the delivery attempt. Before delivering content,
some MMSCs also include a content adaptation service that attempts to modify the multimedia
content into a format suitable for the recipients handset.
If the receivers handset is not MM1 capable, the message can be delivered to a web based
service and the receiver can view the content from a normal Internet browser. The URL for the
content can be sent to the receiver in an SMS text message. Using this method, non-MM1
capable recipients can still receive MMS content.
The method for determining whether a handset is MMS capable is not specified by the
standards. A database is usually maintained by the operator, and in it each mobile phone
number is marked as being associated with a legacy handset or not. It can be a bit hit and miss
since customers can change their handset at will and this database is not usually updated
dynamically.
Email and web-based gateways from MMSC to the Internet use the MM3 content interface. On
the receiving side, the content servers can typically receive service requests both from WAP
and normal HTTP browsers, so delivery via the web is simple. For sending from external
sources to handsets, most carriers allow MIME encoded message to be sent to the receiver's
phone number with a special domain.
MMS messages can be vectors for propagating undesirable content such as spam and viruses.
FortiOS Carrier can scan MMS messages sent using the MM1, MM3, MM4, and MM7 content
interfaces. You can configure FortiOS Carrier to scan MMS messages for spam and viruses by
configuring and adding MMS protection profiles and adding the MMS protection profiles to
security policies. You can also use MMS protection profiles to apply content blocking, carrier
Fortinet Technologies Inc. Page 636 FortiOS Handbook - Carrier for FortiOS 5.0
endpoint filtering, MMS address translation, sending MMS notifications, DLP archiving of MMS
messages, and logging of MMS message activity.
Content
Provider
MM7
FortiOS Carrier
(HTTP/SOAP)
MM1 (HTTP)
Mobile
Users
MM3
(SMTP)
MM1
MM3
MM7 MMS
Service
Provider
Network
MMSC
Foreign Foreign
Operator Mobile
MM4 MM1 Users
FortiOS Carrier (SMTP) (HTTP)
FortiOS Carrier can send MMS messages to senders informing those senders that their devices
are infected. FortiOS Carrier can also send MMS notifications to administrators to inform them
of suspicious activity on their networks.
For message floods and duplicate messages, FortiOS Carrier does not send notifications to
message senders but does send notifications to administrators and sends messages to sender
handsets to complete MM1 and MM4 sessions.
Where MMS messaging uses the TCP/IP set of protocols, SMS text messaging uses the
Signaling System Number 7 (SS7) set of protocols, which is not supported by FortiOS.
Fortinet Technologies Inc. Page 637 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 136:MM1 MMS scanning of message sent by sender (blocking m.send.req messages)
3. m-send.req
5. Reset TCP session
4. Content blocked
6. m-send.conf replacement
message
9. Notification message to
administrators (various protocols)
Sent once per notification period,
regardless of how many messages
are blocked
FortiOS Carrier also sends m-send.rec notifications messages to the MMSC that are then
forwarded to the sender to notify them of blocked messages.
Fortinet Technologies Inc. Page 638 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 137:MM1 MMS scanning of messages received by receiver (blocking
m.retrieve.conf messages)
3. m-retrieve.conf mesage
5. m-retrieve.conf replacement
message
4. Content blocked
7. Notification message to
administrators (various protocols)
Sent once per notification period,
regardless of how many messages
are blocked
Filtering MM3 and MM4 messages works in an similar way to MM1 (see Figure 138 and
Figure 139). FortiOS Carrier intercepts connections to the MMSC, and scans messages
as configured. When messages are blocked, FortiOS Carrier closes sessions as required,
sends confirmation messages to the sender, notifies administrators, and notifies senders
and receivers of messages.
Fortinet Technologies Inc. Page 639 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 138:MM3 MMS scanning of messages sent from a sender on the Internet to an MMSC
Internet
Fortinet Technologies Inc. Page 640 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 139:MM4 MMS scanning of messages sent between operator MMSCs
Fortinet Technologies Inc. Page 641 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 140:MM7 MMS scanning of messages sent between a VASP and an MMSC
3. submit.req or delivery.req
6. submit.resp/delivery.resp
replacement message
8. submit.req/delivery.req
notification message
Sent once per notification period, 9. Notification message to
regardless of how many messages administrators (various protocols)
are blocked
Sent once per notification period,
regardless of how many messages
are blocked
Fortinet Technologies Inc. Page 642 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 141:MM1 message flood and duplicate message blocking of sent messages
3. m-send.req
5. Reset TCP session
4. Flood or duplicate blocked
6. m-send.conf replacement
message
Figure 142:MM1 message flood and duplicate message blocking of received messages
3. m-retrieve.conf mesage
5. m-retrieve.conf replacement
message
4. Flood or duplicate blocked
6. Notification message to
administrators (various protocols)
Sent once per notification period,
regardless of how many messages
are blocked
Fortinet Technologies Inc. Page 643 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 143:MM4 message flood and duplicate message blocking
An MMS protection profile is a group of settings that you can apply to an MMS session
matched by a security policy.
MMS protection profiles are easy to configure and can be used by more than one security
policy. You can configure a single MMS protection profile for the different traffic types handled
by a set of security policies that require identical protection levels and types. This eliminates the
need to repeatedly configure those same MMS protection profile settings for each individual
security policy.
For example, while traffic between trusted and untrusted networks might need strict protection,
traffic between trusted internal addresses might need only moderate protection. You would
configure two separate MMS protection profiles to provide the different levels of protection: one
for traffic between trusted networks, and one for traffic between trusted and untrusted
networks.
Once you have configured the MMS Protection Profile, you need to add it to a security policy to
apply the profile to MMS traffic.
See MMS Security features on page 701.
Fortinet Technologies Inc. Page 644 FortiOS Handbook - Carrier for FortiOS 5.0
Bypassing MMS protection profile filtering based on carrier endpoints
You can use carrier endpoint filtering to exempt MMS sessions from MMS protection profile
filtering. Carrier endpoint filtering matches carrier endpoints in MMS sessions with carrier
endpoint patterns. If you add a carrier endpoint pattern to a filter list and set the action to
exempt from all scanning, all messages from matching carrier endpoints bypass MMS
protection profile filtering. See Bypassing message flood protection based on users carrier
endpoints on page 727.
To apply an MMS protection profile you must first create the MMS protection profile and then
add the MMS protection profile to a security policy by enabling the Carrier security profile. The
MMS protection profile then applies itself to the traffic accepted by that security policy.
MMS protection profiles can contain settings relevant to many different services. Each security
policy uses the subset of the MMS protection profile settings that apply to the sessions
accepted by the security policy. In this way, you might define just one MMS protection profile
that can be used by many security policies, each policy using a different or overlapping subset
of the MMS protection profile.
GPRS currently supports data rates from 9.6kbps to more than 100 kbps, and is best suited for
burst forms of traffic. GPRS involves both radio and wired components. The mobile phone
sends the message to a base station unit (radio based), and the base station unit sends the
message to the carrier network and eventually the Internet (wired carrier network).
The network system then either sends the message back to a base station and to the
destination mobile unit, or forwards the message to the proper carriers network where it gets
routed to the mobile unit.
This section includes:
PDP Context
GPRS security
PDP Context
The packet data protocol (PDP) context is a connection between a mobile station and the end
address that goes through the SGSN and GGSN. It includes identifying information about the
Fortinet Technologies Inc. Page 645 FortiOS Handbook - Carrier for FortiOS 5.0
mobile customer used by each server or device to properly forward the call data to the next hop
in the carrier network, typically using a GTP tunnel between the SGSN and GGSN.
When a mobile customer has an active voice or data connection open, both the SGSN and
GGSN have the PDP context information for that customer and session.
When a mobile phone attempts to communicate with an address on an external packet
network, either an IP or X.25 address, the mobile station that phone is connected to opens a
PDP context through the SGSN and GGSN to the end address. Before any traffic is sent, the
PDP context must first be activated.
The information included in the PDP context includes the customers IP address, the IMSI
number of the mobile handset, and the tunnel endpoint ID for both the SGSN and GGSN. The ID
is a unique number, much like a session ID on a TCP/IP firewall. All this information ensures a
uniquely identifiable connection is made.
Since one mobile device may have multiple connections open at one time, such as data
connections to different Internet services and voice connections to different locations, there
may be more than one PDP context with the same IP address making the extra identifying
information required.
The endpoint that the mobile phone is connecting to only knows about the GGSN the rest of
the GPRS connection is masked by the GGSN.
Along the PDP context path, communication is accomplished in using three different protocols.
The connection between the Mobile Station and SGSN uses the SM protocol.
Between SGSN and GGSN GTP is used.
Between GGSN and the endpoint either IP or X.25 is used.
FortiOS Carrier is concerned with the SGSN to GGSN part of the PDP context the part that
uses GTP.
For more about PDP context, see Tunnel Management Messages on page 745.
Fortinet Technologies Inc. Page 646 FortiOS Handbook - Carrier for FortiOS 5.0
A GGSN creates a PDP context
1. The network receives an IP packet from an external network.
2. The GGSN checks if the PDP Context has already been created.
3. If not, the GGSN sends a PDU notification request to the SGSN in order to initiate a
PDP context activation.
4. The GGSN retrieves the IP address of the appropriate SGSN address by interrogating the
HLR from the IMSI identifier of the MS.
5. The SGSN sends to the MS a request to activate the indicated PDP context.
6. The PDP context activation procedure follows the one initiated by the MS. See A Mobile
Station creates a PDP context on page 646.
7. When the PDP context is activated, the IP packet can be sent from the GGSN to the MS.
GPRS security
The GPRS network has some built-in security in the form of GPRS authentication. However this
is minimal, and is not sufficient for carrier network security needs. A GTP firewall, such as
FortiOS Carrier, is required to secure the Gi, Gn, and Gp interfaces.
GPRS authentication
GPRS authentication is handled by the SGSN to prevent unauthorized GPRS calls from
reaching the GSM network beyond the SGSN (the base station system, and mobile station).
Authentication is accomplished using some of the customers information with a random
number and uses two algorithms to create ciphers that then allow authentication for that
customer.
User identity confidentiality ensures that customer information stays between the mobile station
and the SGSN no identifying information goes past the SGSN. Past that point other numbers
are used to identify the customer and their connection on the network.
Periodically the SGSN may request identity information from the mobile station to compare to
what is on record, using the IMEI number.
Call confidentiality is achieved through the use of a cipher, similar to the GPRS authentication
described earlier. The cipher is applied between the mobile station and the SGSN. Essentially a
cipher mask is XORd with each outgoing frame, and the receiving side XORs with its own cipher
to result in the original frame and data.
Fortinet Technologies Inc. Page 647 FortiOS Handbook - Carrier for FortiOS 5.0
Parts of a GTPv1 network
A sample GTP network consists of the end handset sender, the senders mobile station, the
carriers network including the SGSN and GGSN, the receiver's mobile station, and the receiver
handset.
When a handset moves from one mobile station and SGSN to another, the handsets
connection to the Internet is preserved because the tunnel the handset has to the Internet using
GTP tracks the users location and information. For example, the handset could move from one
cell to another, or between countries.
The parts of a GPRS network can be separated into the following groups according to the roles
of the devices:
Radio access to the GPRS network is accomplished by mobile phones and mobile stations
(MS). See Radio access on page 649.
Transport the GPRS packets across the GPRS network is accomplished by SGSNs and
GGSNs, both local and remote, by delivering packets to the external services. See
Transport on page 649.
Billing and records are handled by CDF, CFR, HLR, and VLR devices. See Billing and
records on page 652.
GPRS networks also rely on access points and PDP contexts as central parts of the
communication structure. These are not actual devices, but they are still critical .
For more information on APN, see Access Point Number (APN) on page 753. For more
information on PDP Context, see PDP Context on page 645.
These devices, their roles, neighboring devices, the interfaces and protocols they use are
outlined in the following table. These devices and their connections can be viewed in the
Packet flow through the GPRS network on page 654.
FortiOS
Carrier FortiOS
SGSN GGSN Carrier
Mobile
Users Gn Gn Gi Gi
Gp
Foriegn Foriegn
Operators Mobile
Users
Fortinet Technologies Inc. Page 648 FortiOS Handbook - Carrier for FortiOS 5.0
Table 33: Devices on a GTPv1 network
SGSN (local) MS, SGSN (local or remote), Ga, Gb, Gn, IP, Frame
GGSN (local and remote), CDR, Gp, Gz Relay, GTP,
CFR, HLR, VLR GTP
GGSN (local) SGSN (local or remote), GGSN Ga, Gi, Gn, Gp, IP, GTP, GTP
(local and remote), CDR, CFR, Gz
HLR, VLR
Radio access
For a mobile phone to access the GPRS core network, it must first connect to a mobile station.
This is a cellular tower that is connected to the carrier network.
How the mobile phone connects to the mobile station (MS) is determined by what Radio Access
Technologies (RATs) are supported by the MS.
Transport
Transport protocols move data along the carrier network between radio access and the Internet
or other carrier networks.
FortiOS Carrier should be present where information enters the Carrier network, to ensure the
information entering is correct and not malicious. This means a Carrier-enabled FortiGate unit
intercepts the data coming from the SGSN or foreign networks destined for the SSGN or GGSN
onto the network, and after the GGSN as the data is leaving the network.
GTP
GPRS Tunnelling Protocol (GTP) is a group of IP-based communications protocols used to carry
General Packet Radio Service (GPRS) within Global System for Mobile Communications (GSM)
and Universal Mobile Telecommunications System (UMTS) networks. It allows carriers to
transport actual cellular packets over their network via tunneling. This tunneling allows users to
move between SGSNs and still maintain connection to the the Internet through the GGSN.
GTP has three versions version 0, 1, and 2. GTP1 and GTP2 are supported by FortiOS Carrier.
The only GTP commands that are common to all forms of GTP are the echo request/response
commands that allow GSNs to verify up to once every 60 seconds that neighboring GSNs are
alive.
Fortinet Technologies Inc. Page 649 FortiOS Handbook - Carrier for FortiOS 5.0
GTPv0
There have been three versions of GTP to date. The original version of GTP (version 0) has the
following differences from version GTPv1.
the tunnel identification is not random
there are options for transporting X.25
the fixed port number 3386 is used for all functions, not just charging
optionally TCP is allowed as a transport instead of UDP
not all message types are supported in version 0
GTPv1
On a GPRS network, Packet Data Protocol (PDP) context is a data structure used by both the
Serving GPRS Support Node (SGSN) and the Gateway GPRS Support Node (GGSN). The PDP
context contains the subscribers information including their access point, IP address, IMSI
number, and their tunnel endpoint ID for each of the SGSN and GGSN.
The Serving GPRS Support Node (SGSN) is responsible for the delivery of data packets from
and to the mobile stations within its geographical service area. Its tasks include packet routing
and transfer, mobility management (attach/detach and location management), logical link
management, and authentication and charging functions. The location register of the SGSN
stores location information (e.g., current cell, current VLR) and user profiles (e.g., IMSI,
address(es) used in the packet data network) of all GPRS users registered with this SGSN.
GTPv1-C
GTPv1-C refers to the control layer of the GPRS Transmission network. This part of the protocol
deals with network related traffic.
FortiOS Carrier handles GTPv1-C in GTPv1 by using the Tunnel Endpoint IDentifier (TEID), IP
address and a Network layer Service Access Point Identifier (NSAPI), sometimes called the
application identifier, as an integer value that is part of the PDP context header information used
to identify a unique PDP context in a mobile station, and SGSN.
For more information on GTPv1-C, see GTP-C messages on page 745.
GTPv1-U
GTPv1-U is defined in 3GPP TS 29.281 and refers to the user layer of the GPRS Tunneling
network. This part of the protocol deals with user related traffic, user tunnels, and user
administration issues.
A GTPv1-U tunnel is identified by a TEID, an IP address, and a UDP port number. This
information uniquely identifies the limb of a GTPv1 PDP context. The IP address and the UDP
port number define a UDP/IP path, a connectionless path between two endpoints (i.e. SGSN or
GGSN). The TEID identifies the tunnel endpoint in the receiving GTPv1-U protocol entity; it
allows for the multiplexing and demultiplexing of GTP tunnels on a UDP/IP path between a
given GSN-GSN pair. For more information on GTPv1-U, see GTP-U messages on page 746.
The GTP core network consists of one or more SGSNs and GGSNs.
GGSN
The Gateway GPRS Support Node (GGSN) connects the GPRS network on one side via the
SGSN to outside networks such as the Internet. These outside networks are called packet data
networks (PDNs). The GGSN acts as an edge router between the two different networks the
GGSN forwards incoming packets from the external PDN to the addressed SGSN and the
Fortinet Technologies Inc. Page 650 FortiOS Handbook - Carrier for FortiOS 5.0
GGSN also forwards outgoing packets to the external PDN. the GGSN also converts the
packets from the GPRS packets with SGSN to the external packets, such as IP or X.25.
SGSN
The Serving GPRS Support Node (SGSN) connects the GPRS network to GTPv1 compatible
mobile stations, and mobile units (such as UTRAN and ETRAN) on one side and to the gateway
node (GGSN), which leads to external networks, on the other side. Each SGSN has a
geographical area, and mobile phones in that area connect to the GPRS network through this
SGSN. The SGSN also maintains a location register that contains customers location and user
profiles until they connect through a different SGSN at which time the customer information is
moved to the new SGSN. This information is used for packet routing and transfer, mobility
management also known as location management, logical link management, and authentication
and billing functions.
GTPv2
GTPv2, defined in 3GPP TS 29.274, is dramatically differnet from GTPv1, defined in 3GPP TS
29.060. Where in GTPv1 the tunnel is between the SGSN and the GGSN, in GTPv2 The SGSN is
between the MME and the LTE Serving Gateway (S-GW), beyond which is the PDN gateway
(P-GW). Even tunnel management messages have changed significantly.
SGSN
GTPv2-C
GTPv1-U FortiOS
Carrier
S-GW PDN-GW
Mobile
Users
GTPv2-C
C FortiOS
F tiOS
tiO
Carrier
MME SGW
Fortinet Technologies Inc. Page 651 FortiOS Handbook - Carrier for FortiOS 5.0
Table 34: Device roles on a GTPv2 network
GTPv2-C
GTPv2-C is the control layer messaging for GTPv2. It is used by LTE mobile stations, SGSN
units for backwards compatibility, and SGWs that are the gateway to other networks. The
messaging is very different from GTPv1. GTPv2-C is required to communicate with the Mobility
Management Entity (MME) to create, change and delete EPS bearers when handover events
happen, and to create Forwarding tunnels. The protocol is also used to communicate with the
Serving Gateway (SGW) which has the S-GW and PDN-GW interfaces, and the Serving GPRS
Support Node (SGSN).
MME
MME essentially fills the role of the SGSN in a GTPv1 network it is how the mobile stations
gain access to the Carrier network. GTPv2 supports different mobile stations than GTPv1, so
MME handles the GTPv2 MSes and SGSN handles the GTPv1 MSes
HLR
The Home Location Register (HLR) is a central database that contains details of each mobile
phone subscriber that is authorized to use the GSM core network. There can be several logical,
and physical, HLRs per public land mobile network (PLMN), though one international mobile
subscriber identity (IMSI)/MSISDN pair can be associated with only one logical HLR (which can
span several physical nodes) at a time. The HLRs store details of every SIM card issued by the
mobile phone operator. Each SIM has a unique identifier called an IMSI which is the primary key
to each HLR record.
Fortinet Technologies Inc. Page 652 FortiOS Handbook - Carrier for FortiOS 5.0
VLR
The Visitor Location Register (VLR) is a database which stores information about all the mobile
devices that are currently under the jurisdiction of the Mobile Switching Center which it serves.
Of all the information the VLR stores about each Mobile Station, the most important is the
current Location Area Identity (LAI). This information is vital in the call setup process.
Whenever an MSC detects a new MS in its network, in addition to creating a new record in the
VLR, it also updates the HLR of the mobile subscriber, informing it of the new location of that
MS.
For more information on GTP, see GTP-U and Charging Management Messages on
page 746.
There are interfaces for each connection on the GPRS network. An interface is an established
standard form of communication between two devices. Consider a TCP/IP network. In addition
to the transport protocol (TCP) there are other protocols on that network that describe how
devices can expect communications to be organized, just like GPRS interfaces.
The Carrier-enabled FortiGate unit only provides protection on the Gn, Gp,
and Gi interfaces.
Ga CDR and GSN (SGSNs GTP - GTP CDR have the accounting records,
and GGSNs) modified to that are compiled in the GSN and
include CDR then sent to the Charging Gateway
role (CG)
Fortinet Technologies Inc. Page 653 FortiOS Handbook - Carrier for FortiOS 5.0
Table 35: GPRS network interfaces, their roles, and billing
Gi GGSN and public data IP based This is the connection to the Internet.
networks (PDNs) If the GTP tunnel is deleted without
notifying the Gi interface, the
connection may remain open
incurring additional charges. FortiOS
Carrier adds this interface to a
firewall. See Anti-overbilling with
FortiOS Carrier on page 742.
Corporate customers may have a direct connection to the Gi interface for higher security. The Gi
interface is normally an IP network, though a tunnelling protocol such as GRE or IPsec may be
used instead.
To better understand the GPRS network, we will follow the path data takes for a normal
connection. For this example a call placed from a mobile phone involves accessing services on
the Internet.
Fortinet Technologies Inc. Page 654 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 146:Sample GPRS network topology
Billing
HLR, VLR
CDF, CGF
Mobile Phone Mobile
(Sender_location1) Station
(MS) 1 Internal
Internal
/z
Sending GPRS
G
Ga
Gateway GPRS
a/
System Node 1
z
System Node
(SGSN)
(GGSN)
Gb Gn
Gi
Gp Internet
WAP gateway
Gn
Corporate IP
Gi network
Gb Gn
1 A mobile phone places a call using a mobile station (MS). This connection between the
mobile phone and the MS is a radio connection using one of the radio access technologies.
See Radio Access Technology (RAT) type on page 753.
2. The MS connects to a GPRS System Node (GSN) specifically a Sending GSN. This
connection uses the Gb interface and typically uses IP address or Frame Relay.
3. The SGSN checks the mobile phone information located in the home location register (HLR)
or visitor location register (VLR) to ensure there is subscriber information for that phone. If
this mobile phone is from another network, the SGSN uses the VLR and updates its home
carriers information with its current location and information. This connection involves the
Ga or Gz interfaces, and uses the GTP protocol for communication.
4. The SGSN checks to make sure the phone did not transfer this connection from a different
MS. If it did, the connection has already been established (along with the billing) and is
handed off to this SGSN. If the call is being handed over from another SGSN, it will use the
Gn interface between the two SGSNs.
5. The SGSN sends GTP messages to the local external Gateway GSN (GGSN) to create a GTP
tunnel for this PDP context to access the Internet. It is possible that a remote GGSN has
access to a service, such as a WAP gateway, that the local GGSN is missing. In this
situation, the local SGSN uses the Gp interface to connect to the remote GGSN. Both the Gn
and Gp interfaces use GTP.
6. The both the local and remote GGSNs connect to external services outside the GPRS
network. These services can include a WAP gateway, a corporate IP network directly
connected to the GPRS network, or the Internet. The connection from the GGSN to the
external services uses the Gi interface.
SCTP
As of FortiOS version 5.0, the FortiGate can now natively handle SCTP (Stream Control
Transport Protocol) traffic, as an alternative to TCP and UDP for use in Carrier networks. The
FortiGate handles SCTP as if it would any other traffic.
Fortinet Technologies Inc. Page 655 FortiOS Handbook - Carrier for FortiOS 5.0
Overview
SCTP is a connection-oriented transport protocol that overcomes some of the limitations of
both TCP and UDP that prevent reliable transfer of data over IP-based networks (such as those
used by telephony systems and carrier networks). The Stream in SCTP refers to the sequence
of user messages or packets that are considered at the same time to be individual objects and
also treated as a whole by networked systems. SCTP is less vulnerable to congestion and
flooding due to more advanced error handling and flood protection built into the protocol.
Table 36: SCTP features as compared to TCP and UDP
All of these features are built into the design of the Protocol, and the structure of SCTP packets
and networks. The FortiGate unit interprets the traffic and provides the necessary support for
maintenance and verification features, but the features are not FortiGate specific. These
features are documented in greater detail below.
Fortinet Technologies Inc. Page 656 FortiOS Handbook - Carrier for FortiOS 5.0
Message boundary conservation
SCTP is designed in such a way that no matter how messages are divided, redirected, or
fragmented, the message boundaries will be maintained within the packets, and all messages
cannot be appended without tripping verification mechanisms.
Message bundling
SCTP is a message-oriented protocol, which means that despite being a streaming data
protocol, it transports a sequence of specific messages, rather than transporting a stream of
bytes (like TCP). Since some data transmissions are small enough to not require a complete
messages worth of content, so multiple pieces of content will be transmitted simultaneously
within the messages.
Multi-stream support
Due to the message bundling feature allowing for multiple pieces of content to be sent in
messages at once, SCTP can multi-stream content, by deliberately dividing it among
messages at a fixed rate, so that multiple types of content (eg. both images and text) can be
loaded at once, at the same pace.
Fortinet Technologies Inc. Page 657 FortiOS Handbook - Carrier for FortiOS 5.0
SCTP Firewall
FortiGate stateful firewalls will protect and inspect SCTP traffic, according to RFC4960. SCTP
over IPSec VPN is also supported. The FortiGate device is inserted as a router between SCTP
endpoints. It checks SCTP Syntax for the following information:
Source and destination port
Verification Tag
Chunk type, chunk flags, chunk length
Sequence of chunk types
Associations
The firewall also oversees and maintains several SCTP security mechanisms:
SCTP four-way handshake
SCTP heartbeat
NAT over SCTP
The firewall has IPS DoS protection against known threats to SCTP traffic, including INIT/ACK
flood attacks, and SCTP fuzzing.
Fortinet Technologies Inc. Page 658 FortiOS Handbook - Carrier for FortiOS 5.0
Figure 147:Sample SCTP Network Topology
Outward-facing servers:
Sales, billing, etc.
Internet
Central Carrier STP node
and services, behind FW SCTP Firewall Layer Public Internet
(secured) (HA Setup) (unsecured)
In this example, the firewall layer is configured with two FortiGate devices to act as an HA
cluster, providing automatic load balancing and failover detection for the main firewall.
The two devices together make up the firewall, through which all traffic passes. Virtual Domains
are created within the FortiGate units, distributing services and traffic into individual VDOMs,
allowing them to be monitored and secured individually, to help mitigate possible threats to
Carrier networks that target specific services. Individual departments or administrators can
manage specific VDOMs, or the FortiGates can be collectively managed centrally by network
administrators.
Fortinet Technologies Inc. Page 659 FortiOS Handbook - Carrier for FortiOS 5.0
The VDOMs are distributed as below:
SCTP SCTP
VDOM Slave Master VDOM
Virtual
GTP VDOM Cluster 2 GTP VDOM
Corporate Corporate
VDOM VDOM
Master Slave
Services Services
VDOM Virtual VDOM
Cluster 1
Root VDOM Root VDOM
FGT_1 FGT_2
One FortiGate handles basic FortiGate services and non-Carrier traffic. Configuring virtual
clustering across the two FortiGates allows one to mirror its VDOMs across to the other unit.
The second FortiGate can then primarily provide Carrier-specific services and handle SCTP, Gi
and GTP traffic, using the first FortiGate as the slave unit in a second virtual cluster.
Fortinet Technologies Inc. Page 660 FortiOS Handbook - Carrier for FortiOS 5.0
Carrier web-based manager settings
The Carrier menu provides settings for configuring FortiOS Carrier features within the Security
Profiles menu. These features include MMS and GTP profiles.
In Security Profiles > Carrier, you can configure profiles and settings for MMS and GTP. In the
Carrier menu, you can configure an MMS profile and then apply it to a security policy. You can
also configure GTP profiles and apply those to security policies as well.
This topic includes the following:
MMS profiles
MMS Content Checksum
Notification List
Message Flood
Duplicate Message
Carrier Endpoint Filter Lists
GTP Profile
MMS profiles
Since MMS profiles can be used by more than one security policy, you can configure one profile
for the traffic types handled by a set of security policies requiring identical protection levels and
types, rather than repeatedly configuring those same profile settings for each individual security
policy.
If the security policy requires authentication, do not select the MMS profile in the security
policy. This type of profile is specific to the authenticating user group. For details on
configuring the profile associated with the user group, see User Groups in the User
Authentication guide.
For example, while traffic between trusted and untrusted networks might need strict protection,
traffic between trusted internal addresses might need moderate protection. To provide the
different levels of protection, you might configure two separate protection profiles: one for traffic
between trusted networks, and one for traffic between trusted and untrusted networks.
Once you have configured the MMS profile, you can then apply the profile to MMS traffic by
applying it to a security policy.
MMS profiles can contain settings relevant to many different services. Each security policy uses
the subset of the MMS profile settings that apply to the sessions accepted by the security
policy. In this way, you might define just one MMS profile that can be used by many security
policies, each policy using a different or overlapping subset of the MMS profile.
The MMS Profile page contains options for each of the following:
MMS scanning
MMS Bulk Email Filtering Detection
MMS Address Translation
MMS Notifications
DLP Archive
Logging
Page 661
MMS profile configuration settings
The following are MMS profile configuration settings in Security Profiles > Carrier > MMS Profile.
Create New Creates a new MMS profile. When you select Create New, you
are automatically redirected to the New MMS Profile page.
Edit Modifies settings within an MMS profile. When you select Edit,
you are automatically redirected to the Edit MMS Profile.
Delete Removes an MMS profile from the list on the MMS Profile page.
To remove multiple MMS profiles from within the list, on the MMS
Profile page, in each of the rows of the profiles you want
removed, select the check box and then select Delete.
To remove all MMS profiles from the list, on the MMS Profile
page, select the check box in the check box column, and then
select Delete.
Fortinet Technologies Inc. Page 662 FortiOS Handbook - Carrier for FortiOS 5.0
Comments Enter a description about the profile. This is optional.
MMS Scanning Configure MMS Scanning options. See MMS scanning options
on page 663.
MMS Bulk Email Configure MMS Bulk Email options. See MMS bulk email
Filtering filtering options on page 665.
Detection
MMS Address Configure MMS Address Translation options. See MMS Address
Translation Translation options on page 668
DLP Archive Configure DLP archive option. See DLP Archive options on
page 672
Monitor Only Select to cause the unit to record log messages when
MMS scanning options find a virus, match a file name, or
match content using any of the other MMS scanning
options. Select this option to be able to report on viruses
and other problems in MMS traffic without affecting users.
Tip: Select Remove Blocked if you want the unit to
actually remove content intercepted by MMS scanning
options.
Scan MM1 message Select to scan message retrievals that use MM1. If you
retrieval enable Virus Scan for all MMS interfaces, messages are
also scanned while being sent. In this case, you can
disable MM1 message retrieval scanning to improve
performance.
Fortinet Technologies Inc. Page 663 FortiOS Handbook - Carrier for FortiOS 5.0
Quarantine Select to quarantine the selected MMS traffic
Remove Blocked Select to remove blocked content from each protocol and
replace it with the replacement message.
Select Constant if the unit is to preserve the length of the
message when removing blocked content, as may occur
when billing is affected by the length of the message.
Tip: If you only want to monitor blocked content, select
Monitor Only.
Comfort Clients Select client comforting for MM1 and MM7 sessions.
Since MM1 and MM7 messages use HTTP, MM1 and
MM7 client comforting operates like HTTP client
comforting.
Interval (1-900 Enter the time in seconds before client and server
seconds) comforting starts after the download has begun, and the
time between sending subsequent data.
Fortinet Technologies Inc. Page 664 FortiOS Handbook - Carrier for FortiOS 5.0
Oversized MMS Select Block or Pass for files and email messages
Message exceeding configured thresholds for each protocol.
The oversize threshold refers to the final size of the
message, including attachments, after encoding by the
client. Clients can use a variety of encoding types; some
result in larger file sizes than the original attachment. As a
result, a file may be blocked or logged as oversized even if
the attachment is several megabytes smaller than the
oversize threshold.
Threshold (1KB - Enter the oversized file threshold and select KB or MB. If a
800 MB) file is larger than the threshold the file is passed or blocked
depending on the Oversized MMS Message setting. The
web-based manager displays the allowed threshold range.
The threshold maximum is 10% of the units RAM.
Fortinet Technologies Inc. Page 665 FortiOS Handbook - Carrier for FortiOS 5.0
MMS Bulk Email Filtering Detection section of the New MMS Profile page
This section of the New MMS Profile page contains numerous sections where you
can configure specific settings for flood threshold, duplicate threshold and
recipient MSISDNs.
Flood Threshold 1 Expand to reveal the flood threshold settings for Flood
Threshold 1. The settings for Flood Threshold 1 are the
same for Flood Threshold 2 and 3.
Message Flood Enter the period of time during which a message flood will
Window be detected if the Message Flood Limit is exceeded. The
message flood window can be 1 to 2880 minutes (48
hours).
Message Flood Limit Enter the number of messages which signifies a message
flood if exceeded within the Message Flood Window.
Message Flood Enter the amount of time during which the unit performs
Block Time the Message Flood Action after a message flood is
detected.
Message Flood Select one or more actions that the unit is to perform when
Action a message flood is detected.
MM1 Retrieve Duplicate Select to scan MM1 mm1-retr messages for duplicates.
Enable By default, mm1-retr messages are not scanned for
duplicates as they may often be the same without
necessarily being bulk or spam.
Duplicate Message Enter the period of time during which excessive message
Window duplicates will be detected if the Duplicate message Limit
it exceeded. The duplicate message window can be 1 to
2880 minutes (48 hours).
Fortinet Technologies Inc. Page 666 FortiOS Handbook - Carrier for FortiOS 5.0
Duplicate Message Enter the amount of time during which the unit will perform
Block Time the Duplicate Message Action after a message flood is
detected.
Duplicate Message Select one or more actions that the unit is to perform when
Action excessive message duplication is detected.
Create New Creates a new Recipient MSISDN. When you select Create
New, you are automatically redirected to the New MSISDN
page.
Fortinet Technologies Inc. Page 667 FortiOS Handbook - Carrier for FortiOS 5.0
Flood Threshold 3 Select to apply Flood Threshold 3 to the MSISDN
exception.
Sender Address Source Select to extract the senders address from the HTTP
Header Field or a Cookie. You must also specify the
identifier that contains the carrier endpoint.
Fortinet Technologies Inc. Page 668 FortiOS Handbook - Carrier for FortiOS 5.0
Sender Address Enter the sender address identifier that includes the
Identifier carrier endpoint. The default identifier is
x-up-calling-line-id.
If the Sender Address Source is HTTP Header Field, the
address and its identifier in the HTTP request header
takes the format:
<Sender Address Identifier>: <MSISDN_value>
Where the <MSISDN_value> is the carrier endpoint. For
example, the HTTP header might contain:
x-up-calling-line-id: 6044301297
where x-up-calling-line-id would be the Sender
Address Identifier.
If the Sender Address Source is Cookie, the address and
its identifier in the HTTP request headers Cookie field
takes the format of attribute-value pairs:
Cookie: id=<cookie-id>;
<Sender Address Identifier>=<MSISDN Value>
For example, the HTTP request headers might contain:
Cookie:
id=0123jf!a;x-up-calling-line-id=6044301297
where x-up-calling-line-id would be the Sender
Address Identifier.
Convert Sender Address Select to convert the sender address from ASCII to
From / To HEX hexadecimal or from hexadecimal to ASCII. This is
required by some applications.
Add Carrier Endpoint Select the following to enable adding endpoint prefixes
Prefix for Logging / for logging and notification.
Notification
MMS Notifications
MMS notifications are messages that a unit sends when an MMS profile matches content in an
MM1, MM3, MM4 or MM7 session. For example, the MMS profile detects a virus or uses
Fortinet Technologies Inc. Page 669 FortiOS Handbook - Carrier for FortiOS 5.0
content blocking to block a web page, text message or email. You can send notifications to the
sender of the message using same protocol and the addressing headers in the original
message. You can also configure MMS notifications to send notification messages to another
destination (such as a system administrator) using the MM1, MM3, MM4 or MM7 protocol.
You need to enable one or more Notification Types or you can add an Antivirus Notification List
to enable sending notifications,.
You can also use MMS notifications options to configure how often notifications are sent. The
unit sends notification messages immediately for the first event, then at a configurable interval if
events continue to occur. If the interval does not coincide with the window of time during which
notices may be sent, the unit waits to send the notice in the next available window. Subsequent
notices contain a count of the number of events that have occurred since the previous
notification.
There are separate notifications for each notification type, including virus events. Virus event
notifications include the virus name. Up to three viruses are tracked for each user at a time. If a
fourth virus is found, one of the existing tracked viruses is removed from the list.
The notifications are MM1 m-send-req messages sent from the unit directly to the MMSC for
delivery to the client. The host name of the MMSC, the URL to which m-send-req messages
are sent, and the port must be specified.
Message Protocol In each column, select the protocol used to send notification
messages. You can use a different protocol to send the
notification message than the protocol on which the violation
was sent. The MMS Notifications options change depending
on the message protocol that you select.
If you select a different message protocol, you must also
enter the User Domain. If selecting MM7 you must also enter
the Message Type.
Message Type Select the MM7 message type to use if sending notifications
using MM7. Options include deliver.REQ and submit.REQ
Fortinet Technologies Inc. Page 670 FortiOS Handbook - Carrier for FortiOS 5.0
Detect Server Details Select to use the information in the headers of the original
message to set the address of the notification message. If
you do not select this option, you can enter the required
addressing information manually.
You cannot select Detect Server Details if you are sending
notification messages using a different message protocol.
If you select Detect Server Details, you cannot change the
Port where the notification is being sent.
Hostname Enter the FQDN or the IP address of the server where the
notifications will be sent.
URL Enter the URL of the server. For example if the notificaiton is
going to www.example.com/home/alerts , the URL is
/home/alerts.
This option is available only when Message Protocol is mm1
or mm7.
Username Enter the user name required for sending messages using
this server (optional).
This option is available only when Message Protocol is mm7.
Password Enter the password required for sending messages using this
server (optional).
This option is available only when Message Protocol is mm7.
All Notification Types In each column, select notification for all MMS event types for
that MMS protocol, then enter the amount of time and select
the time unit for notice intervals.
Alternatively, expand All Notification Types, and then select
notification for individual MMS event types for each MMS
protocol. Then enter the amount of time and select the time
unit for notice intervals.
Not all event types are available for all MMS protocols.
Fortinet Technologies Inc. Page 671 FortiOS Handbook - Carrier for FortiOS 5.0
Content Filter In each column, select to notify when messages are blocked
by the content filter, then enter the amount of time and select
the time unit for notice intervals.
File Block In each column, select to notify when messages are blocked
by file block, then enter the amount of time and select the
time unit for notice intervals.
Carrier Endpoint In each column, select to notify when messages are blocked,
Block then enter the amount of time and select the time unit for
notice intervals.
MMS Content In each column, select to notify when the content within an
Checksum MMS message is scanned and banned because of the
checksum value that was matched.
Virus Scan In each column, select to notify when the content within an
MMS message is scanned for viruses.
Notifications Per For each MMS protocol, enter the number of notifications to
Second Limit send per second. If you enter zero(0), the notification rate is
not limited.
Day of Week For each MMS protocol, select the days of the week the unit
is allowed to send notifications.
Window Start Time For each MMS protocol, select the time of day to begin the
message alert window. By default, the message window
starts at 00:00. You can change this if you want to start the
message window later in the day. When configured,
notification outside this window will not be sent.
Window Duration For each MMS protocol, select the time of day at which to
end the message alert window. By default, the message
window ends at 00:24. You can change this if you want to
end the message window earlier in the day.
When configured, notification outside this window will not be
sent
Fortinet Technologies Inc. Page 672 FortiOS Handbook - Carrier for FortiOS 5.0
The unit only allows one sixteenth of its memory for transferring content archive files. For
example, for units with 128MB RAM, only 8MB of memory is used when transferring content
archive files. Best practices dictate to not enable full content archiving if antivirus scanning is
also configured because of these memory constraints.
Archive to Select the type of archiving that you want for the protocol
FortiAnalyzer/FortiGuard (MM1, MM3, MM4, and MM7). You can choose from Full,
Summary or None.
None Do not send content archives.
Summary Send content archive metadata only.
Includes information such as date and time, source and
destination, request and response size, and scan result.
Full Send content archive both metadata and copies of
files or messages.
In some cases, FortiOS Carrier may not archive content, or
may make only a partial content archive, regardless of
your selected option. This behavior varies by prerequisites
for each protocol.
This option is available only if a FortiAnalyzer unit or
FortiGuard Analysis and Management Service is
configured.
Logging
You can enable logging in an MMS profile to write event log messages when the MMS profile
options that you have enabled perform an action. For example, if you enable MMS antivirus
protection, you could also use the MMS profile logging options to write an event log message
every time a virus is detected.
You must first configure how the unit stores log messages so that you can then record these
logs messages. For more information, see the FortiOS Handbook Logging and Reporting
chapter.
MMS-Antivirus If antivirus settings are enabled for this MMS profile, select
the following options to record Antivirus Log messages.
Blocked Files Record a log message when antivirus file filtering enabled
in this MMS profile blocks a file.
Fortinet Technologies Inc. Page 673 FortiOS Handbook - Carrier for FortiOS 5.0
Intercepted Files Record a log message when this MMS profile intercepts a
file.
MMS Scanning If MMS scanning settings are enabled for this MMS profile,
select the following options to record Email Filter Log
messages.
Bulk Messages Select to log MMS Bulk AntiSpam events. You must also
select which protocols to write log messages for in the
MMS bulk email filtering part of the MMS profile. For more
information, see MMS bulk email filtering options on
page 665.
Carrier Endpoint Select to log MMS carrier endpoint filter events, such as
Filter Block MSISDN filtering.
Create New Creates a new MMS content checksum list. When you
select Create New, you are automatically redirected to the
New List. This page provides a name field and comment
field. You must enter a name to go to MMS Content
Checksum Settings page.
Fortinet Technologies Inc. Page 674 FortiOS Handbook - Carrier for FortiOS 5.0
Delete Removes an MMS content checksum from the page.
To remove multiple content checksum lists from within the
list, on the MMS Content Checksum page, in each of the
rows of the content checksum lists you want removed,
select the check box and then select Delete.
To remove all content checksum lists from list, on the
MMS Content Checksum page, select the check box in
the check box column and then select Delete.
Name The name of the MMS content checksum list that you
created.
MMS Profiles The MMS profile or profiles that have the MMS content
checksum list applied. For example if two different MMS
profiles use this content checksum list, they will both be
listed here.
Notification List
The Notification List menu allows you to configure a list of viruses. This virus list provides a list
for scanning viruses in MMS messages. You can use one virus list in multiple MMS profiles, and
configure multiple virus lists.
Fortinet Technologies Inc. Page 675 FortiOS Handbook - Carrier for FortiOS 5.0
Notification list configuration settings
The following are notification list configuration settings in Security Profiles > Carrier >
Notification List.
Create New Creates a new notification list. When you select Create New, you
are automatically redirected to the New List page. You must enter
a name to go to the Notification List Settings page.
Edit Modifies settings within the notification list. When you select Edit,
you are automatically redirected to the Notification List Settings
page.
Delete Removes a notification list from the list on the Notification List
page.
To remove multiple notification lists from within the list, on the
Notification List page, in each of the rows of the notification lists
you want removed, select the check box and then select Delete.
To remove all notification lists from the list, on the Notification List
page, select the check box in the check box column and then
select Delete.
Name The name of the MMS content checksum list that you created.
MMS Profiles The MMS profile or profiles that are associated with
Fortinet Technologies Inc. Page 676 FortiOS Handbook - Carrier for FortiOS 5.0
Ref. Displays the number of times the object is referenced to other
objects. For example, av_1 profile is applied to a security policy;
on the Profile page (Security Profiles > Antivirus > Profiles), 1
appears in Ref. .
To view the location of the referenced object, select the number in
Ref., and the Object Usage window appears displaying the various
locations of the referenced object.
To view more information about how the object is being used, use
one of the following icons that is avialable within the Object Usage
window:
View the list page for these objects automatically redirects
you to the list page where the object is referenced at.
Edit this object modifies settings within that particular setting
that the object is referenced with. For example, av_1 profile is
referenced with a security policy and so, when this icon is
selected, the user is redirected to the Edit Policy page.
View the details for this object table, similar to the log
viewer table, contains information about what settings are
configured within that particular setting that the object is
referenced with. For example, av_1 profile is referenced with a
security policy, and that security policys settings appear within
the table.
Name If editing the name of a notification list, enter the new name in this
field. You must select OK to save the change.
Comments If you want to enter a comment, enter the comment in the field.
You must select OK to save the change.
Create New Creates a notification entry in the list. When you select Create
New, you are automatically redirected to the New Entry page.
Edit Modifies settings within a notification list. When you select Edit,
you are automatically redirected to the Edit Entry page.
Disable Disables a notification entry so that it is not active and available for
use, but it is not deleted.
Fortinet Technologies Inc. Page 677 FortiOS Handbook - Carrier for FortiOS 5.0
Remove All Entries Removes all notification entries that are listed on the Notification
List Settings page.
Virus Name/Profile The name of the virus that was added to the list.
Entry Type The type of match that will be used to match the virus stated in the
notification list to the actual virus that is found.
Entry Type Select the type of match that will be used to match the virus stated
in the notification list to the actual virus that is found.
Message Flood
The convenience offered by MM1 and MM4 messaging can be abused by users sending spam
or attempting to overload the network with an excess of messages. MMS flood prevention can
help prevent this type of abuse. A message flood occurs when a single subscriber sends a
volume of messages that exceed the flood threshold that you set. The threshold defines the
maximum number of messages allowed, the period during which the subscriber sent messages
are considered, and the length of time the sender is restricted from sending messages after a
flood is detected. For example, for the first threshold you may determine that any subscriber
who sends more than 100 MM1 messages in an hour (60 minutes) will have all outgoing
messages blocked for 30 minutes.
Action Description
Log Add a log entry indicating that a message flood has occurred.
You must also enable logging for MMS Scanning > Bulk
Messages in the Logging section of the MMS protection
profile.
DLP Archive Save the first message to exceed the flood threshold, or all
the messages that exceed the flood threshold, in the DLP
archive. DLP archiving flood messages may not always
produce useful results. Since different messages can be
causing the flood, reviewing the archived messages may not
be a good indication of what is causing the problem since the
messages could be completely random.
All messages All the messages that exceed the flood threshold will be saved
in the DLP archive.
First message only Save only the first message to exceed the flood threshold in
the DLP archive. Other messages in the flood are not saved.
For message floods this may not produce much useful
information since a legitimate message could trigger the flood
threshold.
Fortinet Technologies Inc. Page 678 FortiOS Handbook - Carrier for FortiOS 5.0
Action Description
Intercept Messages that exceed the flood threshold are passed to the
recipients, but if quarantine is enabled for intercepted
messages, a copy of each message will also quarantined for
later examination. If the quarantine of intercepted messages is
disabled, the Intercept action has no effect.
Block Messages that exceed the flood threshold are blocked and
will not be delivered to the message recipients. If quarantine is
enabled for blocked messages, a copy of each message will
quarantined for later examination.
Flood protection for MM1 messages prevents your subscribers from sending too many
messages to your MMSC. Configuring flood protection for MM4 messages prevents another
service provider from sending too many messages from the same subscriber to your MMSC.
Count The count column can be up or down and these settings can be
turned off by selecting beside the columns name.
Fortinet Technologies Inc. Page 679 FortiOS Handbook - Carrier for FortiOS 5.0
Timer The time in seconds and in minutes. The timer column can be up
(minutes:seconds) or down and these settings turned off by selecting beside the
columns name.
Duplicate Message
Duplicate message protection for MM1 messages prevents multiple subscribers from sending
duplicate messages to your MMSC. Duplicate message protection for MM4 messages prevents
another service provider from sending duplicate messages from the same subscriber to your
MMSC.
The unit keeps track of the sent messages. If the same message appears more often than the
threshold value that you have configured, action is taken. Possible actions are logging the
duplicate messages, blocking or intercepting them, archiving, and sending an alert to inform an
administrator that duplicate messages are occurring.
Remove All Entries Removes all duplicate messages from the list.
Fortinet Technologies Inc. Page 680 FortiOS Handbook - Carrier for FortiOS 5.0
Window Size The period of time during which a message flood will be
(minutes) detected if the Message Flood Limit is exceeded.
Create New Creates a new endpoint filter list. When you select Create
New, you are automatically redirected to the New List
page. You must enter a name to go to the Carrier Endpoint
Filter Lists Settings page.
MMS Profiles The MMS profile that the carrier endpoint filter list is added
to.
Fortinet Technologies Inc. Page 681 FortiOS Handbook - Carrier for FortiOS 5.0
Ref. Displays the number of times the object is referenced to
other objects. For example, av_1 profile is applied to a
security policy; on the Profile page (Security Profiles >
Antivirus > Profiles), 1 appears in Ref. .
To view the location of the referenced object, select the
number in Ref., and the Object Usage window appears
displaying the various locations of the referenced object.
To view more information about how the object is being
used, use one of the following icons that is avialable within
the Object Usage window:
View the list page for these objects automatically
redirects you to the list page where the object is
referenced at.
Edit this object modifies settings within that
particular setting that the object is referenced with. For
example, av_1 profile is referenced with a security
policy and so, when this icon is selected, the user is
redirected to the Edit Policy page.
View the details for this object table, similar to the
log viewer table, contains information about what
settings are configured within that particular setting
that the object is referenced with. For example, av_1
profile is referenced with a security policy, and that
security policys settings appear within the table.
Name The name you entered on the New List page, after
selecting Create New on the Carrier Endpoint Filter page.
Comments A description about the endpoint filter. You can add one
here if you did not enter one on the New List page.
Create New Creates a new endpoint filter list. When you select Create
New, you are automatically redirected to the New Entry
page.
Remove All Entries Removes all patterns in the list on the Carrier Endpoint
Filter Lists Settings page.
Fortinet Technologies Inc. Page 682 FortiOS Handbook - Carrier for FortiOS 5.0
Pattern Enter or change the pattern that FortiOS Carrier uses to
match with carrier endpoints. The pattern can be a single
carrier endpoint or consist of wildcards or Perl regular
expressions that will match more than one carrier
endpoint. Set Pattern Type to correspond to the pattern
that you want to use.
Content Archive MMS messages from the carrier endpoint are delivered,
the message content is DLP archived according to MMS
DLP archive settings. Content archiving is also called DLP
archiving.
GTP Profile
You can configure multiple GTP profiles within the GTP menu. GTP profiles concern GTP
activity flowing through the unit. These GTP profiles are then applied to a security policy.
Fortinet Technologies Inc. Page 683 FortiOS Handbook - Carrier for FortiOS 5.0
GTP Profile page
Lists each GTP profile that you have created. On this page, you can edit, delete or create
a new GTP profile.
Create New Creates a new GTP profile. When you select Create New, you are
automatically redirected to the New page.
Edit Modifies settings within a GTP profile in the list. When you select
Edit, you are automatically redirected to Edit page.
General Settings Configure general options for the GTP profile. See General
settings options on page 685.
Message Type Configure filtering for messages. See Message type filtering
Filtering options on page 687.
Fortinet Technologies Inc. Page 684 FortiOS Handbook - Carrier for FortiOS 5.0
APN Filtering Configure filtering options for APN. See APN filtering options on
page 687.
IMSI Filtering Configure filtering options for IMSI. See Basic filtering options on
page 689.
IE removal policy Configure IE removal policy options. See Information Element (IE)
removal policy options on page 694.
Sequence Number Enable to check that packets are not duplicated or out of order.
Validation GTP packets contain a Sequence Number field.
This number tells the receiving GGSN the order of the packets it is
receiving. Normally the GGSN compares this sequence number in
the packets with its own sequence counter if the two do not
match, the packet is dropped. This sequence number validation
can be off-loaded to the FortiOS Carrier freeing up resources on
the GGSN.
Minimum Message Enter the shortest possible message length in bytes. Normally this
Length is controlled by the protocol, and will vary for different message
types. If a packet is smaller than this limit, it is discarded as it is
likely malformed and a potential security risk.
The default minimum message length is 0 bytes.
Fortinet Technologies Inc. Page 685 FortiOS Handbook - Carrier for FortiOS 5.0
Maximum Message Enter the maximum allowed length of a GTP packet in bytes.
Length
A GTP packet contains three headers and corresponding parts
GTP, UDP, and IP. If a packet is larger than the maximum
transmission unit (MTU) size, it is fragmented to be delivered in
multiple packets. This is inefficient, resource intensive, and may
cause problems with some applications.
By default the maximum message length is 1452 bytes.
Tunnel Limit Enter the maximum number of tunnels allowed open at one time.
For additional GTP tunnels to be opened, existing tunnels must
first be closed.
This feature can help prevent a form of denial of service attack on
your network. This attack involves opening more tunnels than the
network can handle and consuming all the network resources
doing so. By limiting the number of tunnels at any one time, this
form of attack will be avoided.
The tunnel limiting applies to the Handover Group, and Authorized
SGSNs and GGSNs.
Tunnel Timeout Enter the maximum number of seconds that a GTP tunnel is
allowed to remain active. After the timeout the unit deletes GTP
tunnels that have stopped processing data. A GTP tunnel may
hang for various reasons. For example, during the GTP tunnel
tear-down stage, the "delete pdap context response" message
may get lost. By setting a timeout value, you can configure the
FortiOS Carrier firewall to remove the hanging tunnels.
The default is 86400 seconds, or 24 hours.
Control plane Enter the number of packets per second to limit the traffic rate to
message rate limit protect the GSNs from possible Denial of Service (DoS) attacks.
The default limit of 0 does not limit the message rate.
GTP DoS attacks can include:
Border gateway bandwidth saturation: A malicious operator
can connect to your GRX and generate high traffic towards
your Border Gateway to consume all the bandwidth.
GTP flood: A GSN can be flooded by illegitimate traffic
Handover Group Select the allowed list of IP addresses allowed to take over a GTP
session when the mobile device moves locations.
Handover is a fundamental feature of GPRS/UMTS, which
enables subscribers to seamlessly move from one area of
coverage to another with no interruption of active sessions.
Session hijacking can come from the SGSN or the GGSN, where a
fraudulent GSN can intercept another GSN and redirect traffic to
it. This can be exploited to hijack GTP tunnels or cause a denial of
service.
When the handover group is defined it acts like a whitelist with an
implicit default deny at the end the GTP address must be in the
group or the GTP message will be blocked. This stops handover
requests from untrusted GSNs.
Fortinet Technologies Inc. Page 686 FortiOS Handbook - Carrier for FortiOS 5.0
Authorized SGSNs Use Authorized SGSNs to only allow authorized SGSNs to send
packets through the unit and to block unauthorized SGSNs. Go to
Firewall Objects > Address > Addresses and add the IP addresses
of the authorized SGSNs to a firewall address or address group.
Then set Authorized SGSNs to this firewall address or address
group.
You can use Authorized SGSNs to allow packets from SGSNs that
have a roaming agreement with your organization.
Authorized GGSNs Use Authorized GGSNs to only allow authorized GGSNs to send
packets through the unit and to block unauthorized GGSNs. Go to
Firewall Objects > Address > Addresses and add the IP addresses
of the authorized GGSNs to a firewall address or address group.
Then set Authorized GGSNs to this firewall address or address
group.
You can use Authorized GGSNs to allow packets from SGSNs
that have a roaming agreement with your organization.
For enhanced security, Fortinet best practices dictate that you set Unknown Message
Action to deny. This will block all unknown GTP message types, some of which may be
malicious.
To configure message type filter options, expand Message Type Filtering in the GTP profile.
Fortinet Technologies Inc. Page 687 FortiOS Handbook - Carrier for FortiOS 5.0
Additionally, the unit can filter GTP packets based on the combination of an IMSI prefix and an
APN. For more information, see Basic filtering options on page 689.
Default APN Action Select the default action for APN filtering. If you select
Allow, all sessions are allowed except those blocked by
individual APN filters. If you select Deny, all sessions are
blocked except those allowed by individual APN filters.
Mode The type of mode chosen that indicates where the APN
originated and whether the Home Location Register (HLR)
has verified the user subscription:
Edit Modifies the settings within the filter. When you select Edit,
the Edit window appears, which allows you to modify the
settings of the APN.
Delete Removes the APN from the list within the table, in the APN
Filtering section.
Add APN Adds a new APN filter to the list. When you select Add
APN, the New window appears, which allows you to
configure the APN settings.
Fortinet Technologies Inc. Page 688 FortiOS Handbook - Carrier for FortiOS 5.0
Subscription MS or Network-provided APN, subscription verified,
Verified indicates that the MS or the network provided the APN
and that the HLR verified the user's subscription to the
network
You cannot add an IMSI when creating a new profile. You must add it after the profile
has been created and you are editing the profile.
Default IMSI Action Select the default action for IMSI filtering. If you select
Allow, all sessions are allowed except those blocked by
individual IMSI filters. If you select Deny, all sessions are
blocked except those allowed by individual IMSI filters.
APN The APN that is part of the IMSI that will be filtered.
Mode The type of mode that indicates where the APN originated
and whether the Home Location Register (HLR) has
verified the user subscription.
Delete Removes an IMSI filter from within the table, in the IMSI
Filtering section.
Fortinet Technologies Inc. Page 689 FortiOS Handbook - Carrier for FortiOS 5.0
Add IMSI Adds a new IMSI filter to the list. When you select Add
IMSI, the New window appears, which allows you to
configure IMSI filter settings.
IMEI-SV yes - - -
Fortinet Technologies Inc. Page 690 FortiOS Handbook - Carrier for FortiOS 5.0
Table 37: Attributes supported by FortiCarrier firewalls
When editing a GTP profile, select Advanced Filtering > Add to create and add a rule. When the
rule matches traffic it will either allow or deny that traffic as selected in the rule.
Default Action Select the default action for advanced filtering. If you select
Allow, all sessions are allowed except those blocked by
individual advanced filters. If you select Deny, all sessions are
blocked except those allowed by individual advanced filters.
Edit Modifies the filters settings. When you select Edit, the Edit
window appears, which allows you to modify the filters settings.
Add Adds a filter to the list. When you select Add, the New window
appears, which allows you to configure settings for messages,
APN, IMSI, MSISDN, RAT type, ULI, RAI, IMEI patterns as well
as the type of action.
Fortinet Technologies Inc. Page 691 FortiOS Handbook - Carrier for FortiOS 5.0
Create PDP Select to allow create PDP context responses.
Context
Response
APN Restriction Select the type of restriction that you want. You can choose all
of the types, or one of the types. You cannot choose multiple
types. Types include:
all
Public-1
Public-2
Private-1
Private-2
Fortinet Technologies Inc. Page 692 FortiOS Handbook - Carrier for FortiOS 5.0
RAT Type Optionally select the RAT type as any combination of the
following:
Any
UTRAN
GERAN
Wifi
GAN
HSPA
Some RAT types are GTPv1 specific.
You cannot add an advanced filtering rule when creating a new profile. You must add it
after the profile has been created and you are editing the profile.
Fortinet Technologies Inc. Page 693 FortiOS Handbook - Carrier for FortiOS 5.0
Information Element (IE) removal policy options
In some roaming scenarios, the unit is installed on the border of the PLMN and the GRX. In this
configuration, the unit supports information element (IE) removal policies to remove any
combination of R6 IEs (RAT, RAI, ULI, IMEI-SV and APN restrictions) from the types of
messages described in Advanced filtering options on page 690, prior to forwarding the
messages to the HGGSN (proxy mode).
SGSN address of The firewall address or address group that contains the SGSN
message IE addresses.
IEs to be removed The IE types that will be removed. These include APN
Restriction, RAT, RAI, ULI, and IMEI.
Add Adds an IE removal policy. When you select Add, the New
window appears, which allows you to configure the IE policy.
Edit Modifies settings from within the IE removal policy. When you
select Edit, the Edit window appears, which allows you to modify
the settings within the policy.
SGSN address Select a firewall address or address group that contains SGSN
addresses.
IEs to be removed Select one or more IE types to be removed. These include APN
Restriction, RAT, RAI, ULI, and IMEI.
Default IP Action Select the default action for encapsulated IP traffic filtering. If
you select Allow, all sessions are allowed except those
blocked by individual encapsulated IP traffic filters. If you
select Deny, all sessions are blocked except those allowed by
individual encapsulated IP traffic filters.
Fortinet Technologies Inc. Page 694 FortiOS Handbook - Carrier for FortiOS 5.0
Source Select a source IP address from the configured firewall IP
address or address group lists. Any encapsulated traffic
originating from this IP address will be a match if the
destination also matches.
Add IP Policy Adds a new encapsulated IP traffic filter. When you select Add
IP Policy, the New window appears which allows you to
configure IP policy settings.
New (window)
Encapsulated Non-IP End User Address Filtering section of the New GTP Profile
page
Default Non-IP Select the default action for encapsulated non-IP traffic filtering.
Action If you select Allow, all sessions are allowed except those
blocked by individual encapsulated non-IP traffic filters. If you
select Deny, all sessions are blocked except those allowed by
individual encapsulated non-IP traffic filters.
Fortinet Technologies Inc. Page 695 FortiOS Handbook - Carrier for FortiOS 5.0
End Protocol The end of the protocol port number range.
Edit Modify a non-IP filter's settings in the list. When you select Edit,
the Edit window appears, which allows you to modify the Non-IP
policy settings.
Add Non-IP Policy Add a new encapsulated non-IP traffic filter. When you select
Add Non-IP Policy, you are automatically redirected to the New
page.
New (window)
Start Protocol Select a start and end protocol from the list of protocols in RFC
End Protocol 1700. Allowed range includes 0 to 255 (0x00 to 0xff). Some
common protocols include:
33 (0x0021) Internet Protocol
35 (0x0023) OSI Network Layer
63 (0x003f) NETBIOS Framing
65 (0x0041) Cisco Systems
79 (0x004f) IP6 Header Compression
83 (0x0053) Encryption
Invalid Reserved GTP version 0 (GSM 09.60) headers specify a number of fields
Field that are marked as ''Spare and contain all ones (1). GTP
packets that have different values in these fields are flagged as
anomalies. GTP version 1 (GSM 29.060) makes better use of
the header space and only has one, 1-bit, reserved field. In the
first octet of the GTP version1 header, bit 4 is set to zero.
Miss Mandatory IE GTP packets with missing mandatory Information Elements (IE)
will not be passed to the GGSN.
Fortinet Technologies Inc. Page 696 FortiOS Handbook - Carrier for FortiOS 5.0
Out of State The GTP protocol requires a certain level of state to be kept by
Message both the GGSN and SGSN. Some message types can only be
sent when in a specific GTP state. Packets that do not make
sense in the current state are filtered or rejected
Both versions of GTP allow up to 255 different message types.
However, a number of message type values are undefined or
reserved.
Best practices dictate that packets with reserved or undefined
values will be filtered.
Out of State IE GTP Packets with out of order Information Elements are
discarded.
Spoofed Source The End User Address Information Element in the PDP Context
Address Create & Response messages contain the address that the
mobile station (MS) will use on the remote network. If the MS
does not have an address, the SGSN will set the End User
Address field to zero when sending the initial PDP Context
Create message. The PDP Context Response packet from the
GGSN will then contain an address to be assigned to the MS. In
environments where static addresses are allowed, the MS will
relay its address to the SGSN, which will include the address in
the PDP Context Create Message. As the MS address is
negotiated within the PDP Context creation handshake, any
packets originating from the MS that contain a different source
address are detected and dropped.
Anti-Overbilling options
You can configure the FortiOS Carrier firewall to prevent overbilling subscribers for traffic over
the. To enable anti-overbilling, you must configure both the Gn/Gp firewall and the Gi firewall.
Expand Anti-Overbilling in the GTP profile to reveal these settings.
Security Context Enter the security context ID. This ID must match the ID
ID entered on the server Gi firewall. The default security
context ID is 696.
Log options
All the GTP logs are treated as a subtype of the event logs. To enable GTP logging, you must:
configure the GTP log settings in a GTP profile
enable GTP logging when you configure log and report settings.
Fortinet Technologies Inc. Page 697 FortiOS Handbook - Carrier for FortiOS 5.0
To enable GTP logging after a GTP profile has been configured
1. Go to Log & Report > Log Config > Log Settings.
2. Select Event Logging, and select GTP service event.
3. Select Apply.
Log Frequency Enter the number of messages to drop between logged messages.
An overflow of log messages can sometimes occur when logging
rate-limited GTP packets exceed their defined threshold. To
conserve resources on the syslog server and the Carrier-enabled
FortiGate unit, you can specify that some log messages are
dropped. For example, if you want only every twentieth message to
be logged, set a logging frequency of 20. This way, 20 messages are
skipped and the next logged.
Acceptable frequency values range from 0 to 2147483674. When set
to 0, no messages are skipped.
Denied Log Select to log GTP packets denied or blocked by this GTP profile.
State Invalid Log Select to log GTP packets that have failed stateful inspection.
Tunnel Limit Log Select to log packets dropped because the maximum limit of GTP
tunnels for the destination GSN is reached.
Fortinet Technologies Inc. Page 698 FortiOS Handbook - Carrier for FortiOS 5.0
Extension Log Select to log extended information about GTP packets. When
enabled, this additional information will be included in log entries:
IMSI
MSISDN
APN
Selection Mode
SGSN address for signaling
SGSN address for user data
GGSN address for signaling
GGSN address for user data
Traffic count Log Select to log the total number of control and user data messages
received from and forwarded to the GGSNs and SGSNs that the unit
protects.
The unit can report the total number of user data and control
messages received from and forwarded to the GGSNs and SGSNs it
protects. Alternately, the total size of the user data and control
messages can be reported in bytes. The unit differentiates between
traffic carried by each GTP tunnel, and also between GTP-User and
GTP-Control messages.
The number of messages or the number of bytes of data received
from and forwarded to the SGSN or GGSN are totaled and logged if
a tunnel is deleted.
When a tunnel is deleted, the log entry contains:
Timestamp
Interface name (if applicable)
SGSN IP address
GGSN IP address
TID
Tunnel duration time in seconds
Number of messages sent to the SGSN
Number of messages sent to the GGSN
Fortinet Technologies Inc. Page 699 FortiOS Handbook - Carrier for FortiOS 5.0
The following information is contained in each log entry:
Timestamp
Source IP address
Destination IP address
Tunnel Identifier (TID) or Tunnel Endpoint Identifier (TEID)
Message type
Packet status: forwarded, prohibited, state-invalid, rate-limited, or tunnel-limited
Virtual domain ID or name
Reason to be denied if applicable.
Fortinet Technologies Inc. Page 700 FortiOS Handbook - Carrier for FortiOS 5.0
MMS Security features
FortiOS Carrier includes all the Security features of FortiOS with extra features specific to MMS
carrier networks.
This section includes:
Why scan MMS messages for viruses and malware?
MMS virus scanning
MMS file filtering
MMS content-based Antispam protection
MMS DLP archiving
The requirement for scanning MM1 content comes from the fact that MMS is an increasingly
popular technique for propagating malware between mobile devices. See MMS virus
scanning on page 702.
Example: COMMWARRIOR
This is a virus for Series 60 type cell phones, such as Nokia, operating Symbian OS version 6 [or
higher]. The object of the virus is to spread to other phones using Bluetooth and MMS as
transport avenues. The targets are selected from the contact list of the infected phone and also
sought via Bluetooth searching for other Bluetooth-enabled devices (phones, printers, gaming
devices etc.) in the proximity of the infected phone.
This virus is more than a proof of concept - it has proven successfully its ability to migrate from
a zoo collection to being in-the-wild. Currently, this virus is being reported in over 18 different
countries around Europe, Asia and North America.
When the virus first infects a cell phone, a prompt is displayed asking the recipient if they want
to install Caribe. Symptoms of an infected phone may include rapid battery power loss due to
constant efforts by the virus to spread to other phones via a Bluetooth seek-and-connect
outreach.
The following variants among others are currently scanned by the FortiOS Carrier devices, in
addition to more signatures that cover all known threats.
SymbOS/COMWAR.V10B!WORM
Aliases: SymbOS.Commwarrior.B, SymbOS/Commwar.B, SymbOS/Commwar.B!wm,
SymbOS/Commwar.B-net, SymbOS/Commwarrior.b!sis, SymbOS/Comwar.B,
Page 701
SymbOS/Comwar.B!wm, SymbOS/Comwar.B-wm, SYMBOS_COMWAR.B,
SymbOS/Comwar.1.0.B!wormSYMBOS/COMWAR.V10B.SP!WORM [spanish version]
First Discovered In The Wild: July 04, 2007
Impact Level: 1
Virus Class: Worm
Virus Name Size: 23,320
SymbOS/Commwar.A!worm
Aliases: Commwarrior-A, SymbOS.Commwarrior.A [NAV], SymbOS/Commwar.A-net,
SymbOS/Commwar_ezboot.A-ne, SymbOS/Comwar.A, SymbOS/Comwar.A-wm,
SYMBOS_COMWAR.A [Trend]
First Discovered In The Wild: May 16 2005
Impact Level: 1
Virus Class: Worm
Virus Name Size: 27,936
SymbOS/Commwarriie.C-wm
Aliases: None
First Discovered In The Wild: Oct 17 2005
Impact Level: 1
Virus Class: File Virus
Virus Name Size: None
For the latest list of threats Fortinet devices detect, go to the FortiGuard Center Resource
Librarys Mobile index.
You can use MMS virus scanning to scan content contained within MMS messages for viruses.
FortiOS Carrier virus scanning can be applied to the MM1, MM3, MM4, and MM7 interfaces to
detect and remove content containing viruses at many points in an MMS network. Perhaps the
most useful interface to apply virus scanning would be the MM1 interface to block viruses sent
by mobile users before they get into the service provider network.
To go to MMS virus scanning, go to Security Profiles > Carrier > MMS Profile, select an existing
or create a new profile, and expand MMS Scanning. See MMS scanning options on page 663.
This section includes:
MMS virus monitoring
MMS virus scanning blocks messages (not just attachments)
Scanning MM1 retrieval messages
Configuring MMS virus scanning
Removing or replacing blocked messages
Carrier Endpoint Block
MMS Content Checksum
Passing or blocking fragmented messages
Client comforting
Server comforting
Handling oversized MMS messages
Fortinet Technologies Inc. Page 702 FortiOS Handbook - Carrier for FortiOS 5.0
MMS virus monitoring
To enable MMS virus monitoring, expand MMS Scanning and enable Monitor only for the
selected MMS types.
This feature causes the FortiOS Carrier unit to record log messages when MMS scanning
options find a virus, match a file name, or match content using any of the other MMS scanning
options. Selecting this option enables reporting on viruses and other problems in MMS traffic
without affecting users.
Fortinet Technologies Inc. Page 703 FortiOS Handbook - Carrier for FortiOS 5.0
removing blocked content, as may occur when billing is affected by the length of the message,
select Constant.
If you only want to monitor blocked content, select Monitor Only.
Fortinet Technologies Inc. Page 704 FortiOS Handbook - Carrier for FortiOS 5.0
For example a blocked_clients filter list may include entries for single endpoints added as
each one needs to be blocked and a group of clients from a country that does not allow certain
services.
Check/Uncheck All Select the check box to enable all endpoint patterns in the MMS
filter list.
Clear the check box to disable all entries on the MMS filter list.
You can also select or clear individual check boxes to enable or
disable individual endpoint patterns.
Pattern The pattern that FortiOS Carrier uses to match with endpoints.
The pattern can be a single endpoint or consist of wildcards or
Perl regular expressions that will match more than one endpoint.
For more on wildcard and regular expressions, see Using
wildcards and Perl regular expressions in the UTM handbook
chapter.
Action Select the action taken by FortiOS Carrier for messages from a
carrier endpoint that matches the endpoint pattern:
None - No action is taken.
Block - MMS messages from the endpoint are not delivered and
FortiOS Carrier records a log message.
Exempt from mass MMS - MMS messages from the endpoint
are delivered and are exempt from mass MMS filtering. Mass
MMS filtering is configured in MMS protection profiles and is also
called MMS Bulk Email Filtering and includes MMS message
flood protection and MMS duplicate message detection. A valid
use of mass MMS would be when a service provider notifies
customers of a system-wide event such as a shutdown.
Exempt from all scanning - MMS messages from the endpoint
are delivered and are exempt from all MMS protection profile
scanning.
Content Archive MMS messages from the endpoint are delivered, the message
content is DLP archived according to MMS DLP archive settings.
Content archiving is also called DLP archiving.
Intercept MMS messages from the endpoint are delivered. Based on the
quarantine configuration, attached files may be removed and
quarantined.
Fortinet Technologies Inc. Page 705 FortiOS Handbook - Carrier for FortiOS 5.0
Pattern Type The pattern type: Wildcard, Regular Expression, or Single
Endpoint.
You cannot add endpoint patterns to the endpoint IP filter list. You must enter complete
and specific endpoints that are valid for your network.
The only action available is block. You cannot use endpoint IP filtering to exempt
endpoints from IP filtering or to content archive or quarantine communication sessions.
FortiOS Carrier looks in the current user context list for the endpoints in the IP filter list and
extracts the source IP addresses for these endpoints. Then any communication session with a
source IP address that matches one of these IP addresses is blocked at the IP level, before the
communication session is accepted by a security policy.
FortiOS Carrier dynamically updates the list of IP addresses to block as the user context list
changes. Only these updated IP addresses are blocked by endpoint IP filtering.
For information about the carrier endpoints and the user context list, including how entries are
added to and removed from this list, see For more information on carrier endpoints, see the
FortiOS Handbook User Authentication chapter.
Fortinet Technologies Inc. Page 706 FortiOS Handbook - Carrier for FortiOS 5.0
To configure an MMS content checksum list
1. Go to Security Profiles > Carrier > MMS Content Checksum.
2. Select Create New.
3. Enter a name for the list of checksums, and select OK.
You are taken to the edit screen for that new list.
4. Select Create New to add a checksum.
5. Enter the Name and Checksum, and select OK.
The checksum is added to the list.
To add more checksums to the list, repeat steps 4 and 5.
To to remove a checksum from the list you can either delete the checksum or simply disable it
and leave it in the list.
To enable MMS content checksums, expand MMS Scanning and select MMS Content
Checksum for the selected MMS types. Select the checksum list to match.
Client comforting
In general, client comforting is available for for MM1 and MM7 messaging and provides a visual
display of progress for web page loading or HTTP or FTP file downloads. Client comforting
does this by sending the first few packets of the file or web page being downloaded to the client
at configured time intervals so that the client is not aware that the download has been delayed.
The client is the web browser or FTP client. Without client comforting, clients and their users
have no indication that the download has started until the Carrier-enabled FortiGate unit has
completely buffered and scanned the download. During this delay users may cancel or
repeatedly retry the transfer, thinking it has failed.
The appearance of a client comforting message (for example, a progress bar) is
client-dependent. In some instances, there will be no visual client comforting cue.
During client comforting, if the file being downloaded is found to be infected, then the
Carrier-enabled FortiGate unit caches the URL and drops the connection. The client does not
receive any notification of what happened because the download to the client had already
started. Instead the download stops, and the user is left with a partially downloaded file.
If the user tries to download the same file again within a short period of time, then the cached
URL is matched and the download is blocked. The client receives the Infection cache message
replacement message as a notification that the download has been blocked. The number of
URLs in the cache is limited by the size of the cache.
Client comforting can send unscanned (and therefore potentially infected) content to the
client. Only enable client comforting if you are prepared to accept this risk. Keeping the
client comforting interval high and the amount low will reduce the amount of potentially
infected data that is downloaded.
Fortinet Technologies Inc. Page 707 FortiOS Handbook - Carrier for FortiOS 5.0
MM1 and MM7 client comforting steps
Since MM1 and MM7 messages use HTTP, MM1 and MM7 client comforting operates like HTTP
client comforting.
The following steps show how client comforting works for a download of a 1 Mbyte file with the
client comforting interval set to 20 seconds and the client comforting amount set to 512 bytes.
1. The client requests the file.
2. The Carrier-enabled FortiGate unit buffers the file from the server. The connection is slow, so
after 20 seconds about one half of the file has been buffered.
3. The Carrier-enabled FortiGate unit continues buffering the file from the server, and also
sends 512 bytes to the client.
4. After 20 more seconds, the FortiGate unit sends the next 512 bytes of the buffered file to the
client.
5. When the file has been completely buffered, the client has received the following amount of
data:
ca * (T/ci) bytes == 512 * (40/20) == 512 * 2 == 1024 bytes,
where ca is the client comforting amount, T is the buffering time and ci is the client
comforting interval.
6. If the file does not contain a virus, the Carrier-enabled FortiGate unit sends the rest of the file
to the client. If the file is infected, the FortiGate closes the data connection but cannot send
a message to the client.
Server comforting
Server comforting can be selected for each protocol.
Similar to client comforting, you can use server comforting to prevent server connection
timeouts that can occur while waiting for FortiOS Carrier to buffer and scan large POST requests
from slow clients.
The Interval is the time in seconds before client and server comforting starts after the download
has begun, and the time between sending subsequent data.
The Amount is the number of bytes sent by client or server comforting at each interval.
Fortinet Technologies Inc. Page 708 FortiOS Handbook - Carrier for FortiOS 5.0
Window size: 24840
Checksum: 0x63c1 (correct)
HTTP proxy
Hypertext Transfer Protocol
POST / HTTP/1.1\r\n
Request Method: POST
Request URI: /
Request Version: HTTP/1.1
Host: 10.129.192.190\r\n
Accept: */*,
application/vnd.wap.sic,application/vnd.wap.mms-message,text/x-hdml,im
age/mng,image/x-mng,video/mng,video/x-mng,image/bmp\r\n
Accept-Charset: utf-8,*\r\n
Accept-Language: en\r\n
Content-Length: 25902\r\n
Content-Type: application/vnd.wap.mms-message\r\n
User-Agent: Nokia7650/1.0 SymbianOS/6.1 Series60/0.9
Profile/MIDP-1.0 Configuration/CLDC-1.0 UP.Link/6.2.1\r\n
x-up-devcap-charset: utf-8\r\n
x-up-devcap-max-pdu: 102400\r\n
x-up-uplink: magh-ip.mi.vas.omnitel.it\r\n
x-wap-profile: "http://nds.nokia.com/uaprof/N7650r200.xml"\r\n
x-up-subno: 1046428312-826\r\n
x-up-calling-line-id: 393475171234\r\n
x-up-forwarded-for: 10.211.4.12\r\n
x-forwarded-for: 10.211.4.12\r\n
Via: 1.1 magh-ip.mi.vas.omnitel.it\r\n
\r\n
Scan engine
MMS Message Encapsulation, Type: m-send-req
X-Mms-Message-Type: m-send-req (0x80)
X-Mms-Transaction-ID: 1458481935
X-Mms-MMS-Version: 1.0
From: <insert address>
To: 3475171234/TYPE=PLMN
X-Mms-Message-Class: Personal (0x80)
X-Mms-Expiry: 21600.000000000 seconds
X-Mms-Priority: Normal (0x81)
X-Mms-Delivery-Report: No (0x81)
X-Mms-Read-Report: No (0x81)
Content-Type: application/vnd.wap.multipart.related;
start=<1822989907>; type=application/smil
Start: <1822989907>
Type: application/smil
Data (Post)
Multipart body
Part: 1, content-type: text/plain
Content-Type: text/plain; charset=iso-10646-ucs-2;
name=Ciao.txt
Charset: iso-10646-ucs-2
Name: Ciao.txt
Headers
Content-Location: Ciao.txt
Fortinet Technologies Inc. Page 709 FortiOS Handbook - Carrier for FortiOS 5.0
Line-based text data: text/plain
\377\376C\000i\000a\000o\000
[Unreassembled Packet: MMSE]
Use MMS file filtering to apply antivirus file filtering to MMS traffic. Select a file filter list to apply.
To configure MMS file filtering, go to Security Profiles > Carrier > MMS Profile, select an existing
or create a new profile, and expand MMS Scanning.
Configure the FortiGate file filter to block files by:
File pattern: Files can be blocked by name, extension, or any other pattern. File pattern
blocking provides the flexibility to block potentially harmful content.
File pattern entries are not case sensitive. For example, adding *.exe to the file pattern list
also blocks any files ending in .EXE.
In addition to the built-in patterns, you can specify more file patterns to block.
File type: Files can be blocked by type, without relying on the file name to indicate what type
of files they are. When blocking by file type, the FortiGate unit analyzes the file and
determines the file type regardless of the file name.
For standard operation, you can choose to disable file filter in the protection profile, and enable
it temporarily to block specific threats as they occur.
The FortiGate unit can take either of these actions toward files that match a configured file
pattern or type:
Allow: the file is allowed to pass.
Block: the file is blocked and a replacement messages will be sent to the user. If both file
filter and virus scan are enabled, the Carrier-enabled FortiGate unit blocks files that match
the enabled file filter and does not scan these files for viruses.
Intercept: the file will be archived to the local hard disk or the FortiAnalyzer unit.
The Carrier-enabled FortiGate unit also writes a message to the virus log and sends an alert
email message if configured to do so.
Files are compared to the enabled file patterns and then the file types from top to bottom. If a
file does not match any specified patterns or types, it is passed along to antivirus scanning (if
enabled). In effect, files are passed if not explicitly blocked.
Using the allow action, this behavior can be reversed with all files being blocked unless
explicitly passed. Simply enter all the file patterns or types to be passed with the allow attribute.
At the end of the list, add an all-inclusive wildcard (*.*) with a block action. Allowed files continue
to antivirus scanning (if enabled) while files not matching any allowed patterns are blocked by
the wildcard at the end.
Fortinet Technologies Inc. Page 710 FortiOS Handbook - Carrier for FortiOS 5.0
Built-in patterns and supported file types
The FortiGate unit is preconfigured with a default list of file patterns:
executable files (*.bat, *.com, and *.exe)
compressed or archive files (*.gz, *.rar, *.tar, *.tgz, and *.zip)
dynamic link libraries (*.dll)
HTML application (*.hta)
Microsoft Office files (*.doc, *.ppt, *.xl?)
Microsoft Works files (*.wps)
Visual Basic files (*.vb?)
screen saver files (*.scr)
program information files (*.pif)
control panel files (*.cpl)
The FortiGate unit can take actions against the following file types:
unknown ignored
The unknown type is any file type that is not listed in the table. The ignored type is
the traffic the FortiGate unit typically does not scan. This includes primarily streaming
audio and video.
Fortinet Technologies Inc. Page 711 FortiOS Handbook - Carrier for FortiOS 5.0
4. Select Create New to add a filter to the list.
5. Select File Name Pattern for Filter Type.
6. Enter exampleTrojanFile.abc .
7. Enter Block for the Action.
8. Select Enable, and OK.
9. Select Create New to add a filter to the list.
10.Select File Name Pattern for Filter Type.
11.Enter *trojan*.def .
12.Enter Block for the Action.
13.Select Enable, and OK.
To filter files based on file type using file name pattern - web-based manager
1. Go to Security Profiles > Data Leak Prevention > File Filter.
2. Select Create New and name the list blockedFileTypes.
3. Select Create New to add files to the list.
4. Select File name pattern for Filter Type.
5. Enter *.bat for Pattern.
6. Select an Action of Block.
7. Select Enable and OK.
8. At the file filter list, select OK.
The file filter is now available to be used in an MMS profile, and will block all .bat files that
MMS profile matches.
To filter files based on file type using file type - web-based manager
1. Go to Security Profiles > Data Leak Prevention > File Filter.
2. Select Create New and name the list blockedFileTypes.
3. Select Create New to add files to the list.
4. Select File Type for Filter Type.
5. Select Batch File (bat) for File Type.
6. Select an Action of Block.
7. Select Enable and OK.
8. At the file filter list, select OK.
Fortinet Technologies Inc. Page 712 FortiOS Handbook - Carrier for FortiOS 5.0
The file filter is now available to be used in an MMS profile, and will block all batch files (that use
.bat file extension) that the MMS profile matches.
In most cases you will notify the sender that they are causing problems on the network either
by sending malware content, flooding the network, or some other unwanted activity. The
notification assumes the sender is unaware of their activity and will stop or correct it when
notified.
However, senders who are notified may use this information to circumvent administrations
precautions. For example if flood notification is set to 1000 messages per minute, a notified
user may simply reduce their message to 990 messages per minute if this flood is intentional.
For this reason, not all problems include sender notifications.
Fortinet Technologies Inc. Page 713 FortiOS Handbook - Carrier for FortiOS 5.0
There are two methods of notifying senders:
MMS notifications
Replacement messages
And three details to consider for logging and notifying administrators:
Logging and reporting
MMS logging options
SNMP
MMS notifications
MMS notifications enable you to customize notifications for many different situations and
differently for all the supported MMS message protocols MM1, MM3, MM4, and MM7.
MMS notification types include:
Content Filter
File Block
Carrier Endpoint Block
Flood
Duplicate
MMS Content Checksum
Virus Scan
Day of Week, Window start time and Window Duration define what days and what time of day
alert notifications will be sent. This allows you to control what alerts are sent on weekends. It
also lets you control when to start sending notifications each day. This can be useful if system
maintenance is performed at the same time each night you might want to start alert
notifications after maintenance has completed. Another reason to limit the time alert messages
are sent could be to limit message traffic to business hours.
Fortinet Technologies Inc. Page 714 FortiOS Handbook - Carrier for FortiOS 5.0
Replacement messages
FortiGate units send replacement messages when messages or content is blocked,
quarantined, or otherwise diverted from the receiver. In its place a message is sent to notify the
receiver what happened.
With FortiOS Carrier MMS replacement messages, send and receive message types are
supported separately and receive their own custom replacement messages. This allows the
network to potentially notify both the sender and reciever of the problem.
For example the replacement message MM1 send-req file block message is sent to the device
that sent one or more files that were banned. The default message that is sent is This device
has sent %%NUM_MSG%% messages containing banned files in the last
%%DURATION%% hours. The two variables are replaced by the appropriate values.
Replacement messages are not as detailed or specific as MMS notifications, but they are also
not as complicated to configure. They are also useful when content has been removed from an
MMS message that was still delivered.
For more information on replacement messages, see MMS Replacement messages on
page 115.
SNMP
A simple SNMP trap will be generated to inform the operators alerting system that a virus has
been detected. This SNMP trap could contain the sending and receiving MSISDN, however the
initial solution would reflect the current behavior, i.e. only the fact that a virus has been detected
will be communicated.
Fortinet Technologies Inc. Page 715 FortiOS Handbook - Carrier for FortiOS 5.0
MMS content-based Antispam protection
Expand MMS Scanning and select Content Filter in an MMS protection profile to create content
filter black/white lists that block or allow MMS messages based on the content of the message.
Overview
A school computer lab may block age-inappropriate content. A place of business may block
unproductive content. A public access internet cafe may block offensive and graphic content.
Each installation has its own requirements for what content needs to be blocked, and in what
language.
FortiOS Carrier provides the ability to create custom local dictionaries, black lists, and white
lists in multiple languages enables you to protect your customers from malicious content
around the world.
Content-based protection includes:
Configurable dictionary
Black listing
White listing
Configurable dictionary
You can create a dictionary of configurable terms and phrases using the CLI. The text of MMS
messages will be searched for these terms and phrases. Add content filter lists that contain
content that you want to match in MMS messages. For every match found, a score is added. If
enough matches are found to set the total score above the configured threshold, the MMS
message is blocked.
You can add words, phrases, wild cards and Perl regular expressions to create content patterns
that match content in MMS messages. For more on wildcard and regular expressions, see
Using wildcards and Perl regular expressions in the UTM handbook chapter.
For each pattern you can select Block or Exempt.
Block adds an antispam black list pattern. A match with a block pattern blocks a message
depending on the score of the pattern and the content filter threshold.
Exempt adds an antispam white list pattern. A match with an exempt pattern allows the
message to proceed through the FortiOS Carrier unit, even if other content patterns in the
same content filter list would block it.
If a pattern contains a single word, the FortiOS Carrier unit searches for the word in MMS
messages. If the pattern contains a phrase, the FortiOS Carrier unit searches for all of the words
in the phrase. If the pattern contains a phrase in quotation marks, the FortiOS Carrier unit
searches for the whole phrase.
You can create patterns with Simplified Chinese, Traditional Chinese, Cyrillic, French, Japanese,
Korean, Spanish, Thai, or Western character sets.
Black listing
Black listing is the practice of banning entries on the list. For example if an IP address
continuously sends viruses, it may be added to the black list. That means any computers that
consult that list will not communicate with that IP address.
Sometimes computers or devices can be added to black lists for a temporary problem, such as
a virus that is removed when notified. However, as a rule short of contacting the administrator in
person to manually be removed form the black list, users have to wait and they generally will be
removed after a period without problem.
Fortinet Technologies Inc. Page 716 FortiOS Handbook - Carrier for FortiOS 5.0
White listing
White listing is the practice of adding all critical IP addresses to a list, such as company email
and web servers. Then if those servers become infected and start sending spam or viruses,
those servers are not blocked. This allows the critical traffic through, even if there might be
some malicious traffic as well. Blocking all traffic from your company servers would halt
company productivity.
MMS notifications
MMS notifications to senders are configured in Security Profiles > Carrier > MMS Profile, under
MMS Notifications.
Fortinet Technologies Inc. Page 717 FortiOS Handbook - Carrier for FortiOS 5.0
In this section you can configure up to four different notification recipients for any combination
of MM1/3/4/7 protocol MMS messages. Also for MM7 messages the message type can be
submit.REQ or deliver.REQ.
Useful settings include:
delay in message based on notification type
limit on notifications per second to prevent a flood
schedules for notifications
log in details for MM7 messages.
For more information on MMS notifications, see Notifying message flood senders and
receivers on page 725 and MMS Notifications on page 669.
Replacement messages
Replacement messages are features common to both FortiOS and FortiOS Carrier, however
FortiOS Carrier has additional messages for the MMS traffic.
While each MMS protocol has its own different rec placement messages, the one common to all
MMS protocols is the MMS blocked content replacement message. This is the message that the
receiver of the message sees when their content is blocked.
For more information on replacement messages, see MMS Replacement messages on
page 115.
You can use DLP archiving to collect and view historical logs that have been archived to a
FortiAnalyzer unit or the FortiGuard Analysis and Management service. DLP archiving is
available for FortiAnalyzer when you add a FortiAnalyzer unit to the FortiOS Carrier
configuration. The FortiGuard Analysis and Management server becomes available when you
subscribe to the FortiGuard Analysis and Management Service.
You can configure full DLP archiving and summary DLP archiving. Full DLP archiving includes all
content, for example, full email DLP archiving includes complete email messages and
attachments. Summary DLP archiving includes just the meta data about the content, for
example, email message summary records include only the email header.
You can archive MM1, MM3, MM4, and MM7 content:
Fortinet Technologies Inc. Page 718 FortiOS Handbook - Carrier for FortiOS 5.0
To configure MMS DLP archiving - web-based manager
1. Go to Security Profiles > Carrier > MMS Profile.
2. Select Create New or select the Edit icon beside an existing profile.
3. Expand MMS Bulk AntiSpam Detection > Content Archive.
4. Complete the fields as described in DLP Archive options on page 672.
5. Select OK.
Fortinet Technologies Inc. Page 719 FortiOS Handbook - Carrier for FortiOS 5.0
Message flood protection
The convenience offered by MM1 and MM4 messaging can be abused by users sending spam
or attempting to overload the network with an excess of messages. MMS flood prevention can
help prevent this type of abuse.
Flood protection for MM1 messages prevents your subscribers from sending too many
messages to your MMSC. Configuring flood protection for MM4 messages prevents another
service provider from sending too many messages from the same subscriber to your MMSC.
FortiOS Carrier
MM1 flood
MM1 flood protection
Subscriber
MM4 flood
protection
MM4 flood
FortiOS Carrier
rierr
Other
Operator
The FortiOS Carrier unit keeps track of the number of messages each subscriber sends for the
length of time you specify. If the number of messages a subscriber sends exceeds the
threshold, a configured action is taken. Possible actions are logging the flood, blocking or
intercepting messages in the flood, archiving the flood messages, and sending an alert
message to inform the administrator that the flood is occurring.
You can create three different thresholds to take different levels of action at different levels of
activity.
With this highly configurable system, you can prevent subscribers from sending more messages
than you determine is acceptable, or monitor anyone who exceeds the thresholds.
A message flood occurs when a single subscriber sends a volume of messages that exceeds
the flood threshold you set. The threshold defines the maximum number of messages allowed,
the period during which the subscriber sent messages are considered, and the length of time
the sender is restricted from sending messages after a flood is detected.
If a subscriber exceeds the message flood threshold and is blocked from sending more
messages, any further attempts to send messages will re-start the block period. You must also
Page 720
enable logging for MMS Scanning > Bulk Messages in the Logging section of the MMS
protection profile.
A subscriber is still able to receive messages while they are blocked from sending
messages.
Example
For example, for the first threshold you may determine that any subscriber who sends more
than 100 MM1 messages in an hour (60 minutes) will have all messages blocked for half an hour
(30 minutes).
Using this example, if the subscriber exceeds the flood threshold, they are blocked from
sending message for 30 minutes. If the subscriber tries to send any message after 15 minutes,
the message will be blocked and the block period will be reset again to 30 minutes. The block
period must expire with no attempts to send a message. Only then will the subscriber be
allowed to send more messages.
Enable Enable
Fortinet Technologies Inc. Page 721 FortiOS Handbook - Carrier for FortiOS 5.0
relatively high so that only an exceptional situation will exceed a flood threshold. Then you can
use log messages and archived MMS messages to determine what caused the flood.
If your subscribers are experiencing problems with viruses that send excessive amounts of
messages, you may want to set thresholds lower and enable blocking to catch problems as
quickly as possible and block access to keep the problem from spreading.
Flood actions
When the Carrier-enabled FortiGate unit detects a message flood, it can take any combination
of the five actions that you can configure for the flood threshold. For detailed options, see
Message Flood on page 678.
You can configure alert notifications for message floods by selecting the Alert Notification
message flood action.
The FortiOS Carrier unit sends alert notifications to administrators using the MM1, MM3, MM4,
or MM7 content interface. To send an alert notification you must configure addresses and other
settings required for the content interface.
For example, to send notifications using the MM1 content interface you must configure a
source MSISDN, hostname, URL, and port to which to send the notification. You can also
configure schedules for when to send the notifications.
Finally you can add multiple MSISDN numbers to the MMS protection profile and set which
flood thresholds to send to each MSISDN.
Example three flood threshold levels with different actions for each
threshold
You can set up to three threshold levels to take different actions at different levels of activity.
The first example threshold records log messages when a subscribers handset displays erratic
behavior by sending multiple messages using MM1 at a relatively low threshold. The erratic
behavior could indicate a problem with the subscribers handset. For example, you may have
determined for your network that if a subscriber sends more the 45 messages in 30 minutes that
you want to record log messages as a possible indication or erratic behavior.
From the web-based manager in an MMS profile set message Flood Threshold 1 to:
Enable Selected
Fortinet Technologies Inc. Page 722 FortiOS Handbook - Carrier for FortiOS 5.0
set status1 enable
set window1 30
set limit1 45
set action1 log
end
end
Set a second higher threshold to take additional actions when a subscriber sends more that 100
messages in 30 minutes. Set the actions for this threshold to log the flood, archive the message
that triggered the second threshold, and block the sender for 15 minutes.
From the web-based manager in an MMS profile set message Flood Threshold 2 to:
Enable Selected
Message Flood Action Log, DLP archive First message only, Block
Enable Selected
Because you have selected the Alert Notification action you must also configure alert
notification settings. For this example, the source MSISDN is 5551234telephone number
555-1234. When administrators receive MMS messages from this MSIDSN they can assume a
message flood has been detected.
Fortinet Technologies Inc. Page 723 FortiOS Handbook - Carrier for FortiOS 5.0
In this example, alert notifications are sent by the FortiOS Carrier unit to the MMSC using MM1.
The host name of the MMSC is mmscexample, the MMSC URL is /, and the port used by the
MMSC is 80. In this example, the alert notification window starts at 8:00am and extends for
eight hours on weekdays (Monday-Friday) and the minimum interval between message flood
notifications is two hours.
Hostname mmscexample
URL /
Port 80
Interval 2 hours
MSISDN 5554321
Fortinet Technologies Inc. Page 724 FortiOS Handbook - Carrier for FortiOS 5.0
From the CLI:
config firewall mms-profile
edit profile_name
config notif-msisdn
edit 5554321
set threshold flood-thresh-3
end
end
The FortiOS Carrier unit does not send notifications to the sender or receiver that cause a
message flood. If the sender or receiver is an attacker and is explicitly informed that they have
exceeded a message threshold, the attacker may try to determine the exact threshold value by
trial and error and then find a way around flood protection. For this reason, no notification is set
to the sender or receiver.
However, FortiOS Carrier does have replacement messages for sending reply confirmations to
MM1 senders and receivers and for MM4 senders for blocked messages identified as message
floods. For information about how FortiOS Carrier responds when message flood detection
blocks a message, see FortiOS Carrier and MMS duplicate messages and message floods on
page 642.
Fortinet Technologies Inc. Page 725 FortiOS Handbook - Carrier for FortiOS 5.0
For example, you could use the following command make the response more generic:
config system replacemsg mm1 mm1-retr-conf-flood
set subject Message blocked
set message Message temporarily blocked by carrier
end
If DLP Archive is a selected message flood action, the messages that exceed the threshold are
saved to the MMS DLP archive. The default behavior is to save all of the offending messages,
but you can configure the DLP archive setting to save only the first message that exceeds the
threshold. This still provides a sample of the offending messages without requiring as requiring
as much storage.
To select only the first message in a flood for DLP archiving - web-based manager
1. Go to Security Profiles > Carrier > MMS Profile.
2. Edit an existing MMS Profile.
3. Expand the MMS Bulk Email Filtering Detection section, the Message Flood subsection, and
the desired Flood Threshold subsection.
4. Next to DLP Archive, select First message only from the dropdown menu.
5. Select OK.
Although duplicate checking involves only examination and comparison of message contents
and not the sender or recipient, and flood checking involves only totalling the number of
Fortinet Technologies Inc. Page 726 FortiOS Handbook - Carrier for FortiOS 5.0
messages sent by each subscriber regardless of the message content, there are times when a
selection of messages exceed both flood and duplicate thresholds.
The Carrier-enabled FortiGate unit checks for message floods before checking for duplicate
messages. Flood checking is less resource-intensive and if the flood threshold invokes a Block
action, the blocked messages are stopped before duplicate checking occurs. This saves both
time and FortiOS Carrier system resources.
The duplicate scanner will only scan content. It will not scan headers. Content must be
exactly the same. If there is any difference at all in the content, it will not be considered a
duplicate.
You can use carrier endpoint filtering to exempt MMS sessions from message flood protection.
Carrier endpoint filtering matches carrier endpoints in MMS sessions with carrier endpoint
patterns.
If you add a carrier endpoint pattern to a filter list and set the action to exempt from mass MMS,
all messages from matching carrier endpoints bypass message flood protection. This allows
legitamite bulk messges, such as system outage notifications, to be delivered without triggering
message flood protection.
For more information on carrier endpoints, see the FortiOS Handbook User Authentication
chapter.
To have the Carrier-enabled FortiGate unit check for message floods, you must first configure
the flood threshold in an MMS profile, select the MMS profile in a security policy. All the traffic
examined by the security policy will be checked for message floods according to the threshold
values you set in the MMS profile.
Fortinet Technologies Inc. Page 727 FortiOS Handbook - Carrier for FortiOS 5.0
11.Select OK.
When message floods are detected, the Carrier-enabled FortiGate unit can be configured to
notify you immediately with an MMS message. Enable this feature by selecting Alert Notification
in the message flood action. Each message flood threshold can be configured separately.
This section includes:
Configuring how and when to send alert notifications
Configuring who to send alert notifications to
Fortinet Technologies Inc. Page 728 FortiOS Handbook - Carrier for FortiOS 5.0
For the MM7 content interface you require:
The message type
submit.REQ to send a notification message to the sender in the form of a submit request.
The message goes from a VAS application to the MMSC.
deliver.REQ to send a notification message to the sender in the form of a deliver request. The
message goes from the MMSC to a VAS application.
The hostname of the server
The URL of the server (usually /)
The server port (usually 80)
A user name and password to connect to the server
The value-added-service-provider (VASP) ID
The value-added-service (VAS) ID
For more information, see MMS notifications on page 714.
Fortinet Technologies Inc. Page 729 FortiOS Handbook - Carrier for FortiOS 5.0
11.In the Interval field, enter the maximum frequency that alert notification messages will be
sent, in minutes or hours.
All alerts occurring during the interval will be included in a single alert notification message
to reduce the number of alert messages that are sent.
For the flood threshold to be able to send an alert notification to the MSISDN, the alert
notification action must be enabled and configured within the flood threshold.
Fortinet Technologies Inc. Page 730 FortiOS Handbook - Carrier for FortiOS 5.0
Duplicate message protection
The convenience offered by MM1 and MM4 messaging can be abused by users sending spam
or other unwanted messages. Often, the same message will be sent by multiple subscribers.
The message can be spam, viral marketing, or worm-generated messages. MMS duplicate
prevention can help prevent this type of abuse by keeping track of the messages being sent.
Duplicate message protection for MM1 messages prevents multiple subscribers from sending
duplicate messages to your MMSC. Duplicate message protection for MM4 messages prevents
another service provider from sending duplicate messages from the same subscriber to your
MMSC. This can help prevent a potential flood that would otherwise become widespread
between carriers.
MM1 duplicate
message protection
MM4 duplicate
Multiple subscribers messate protection
sending the same message
MM4 duplicate
FortiOS Carrier
arr
rrie
ie
ier
er
messages
Other
Operator
Multiple subscribers
sending the same message
The FortiOS Carrier unit keeps track of the sent messages. If the same message appears more
often than the threshold value you configure, then action is taken. Possible actions are logging
the duplicates, blocking or intercepting duplicate messages, archiving the duplicate messages,
and sending an alert to inform an administrator that duplicates are occurring.
With this highly configurable system, you can prevent the transmission of duplicate messages
when there are more than you determine is acceptable.
For detailed configuration options, see Duplicate Message on page 680.
The Carrier-enabled FortiGate unit detects duplicates by keeping a record of all the messages
travelling on the network and comparing new messages to those that have already been sent.
Page 731
Rather than save the messages, the FortiOS carrier creates a checksum using the message
body and subject. This serves as a fingerprint to identify the message. If another message with
the same message body and subject appears, the fingerprint will also be the same and the
Carrier-enabled FortiGate unit will recognize it as a duplicate.
By creating and saving message fingerprints instead of saving the messages, the
Carrier-enabled FortiGate unit can save resources and time.
Duplicate message detection will detect duplicate messages regardless of the sender or
recipient. To do this, message fingerprints are generated using only the message body and
subject. The sender, recipient, and other header information is not included.
If multiple messages appear with the same subject and message body, the Carrier-enabled
FortiGate unit will recognize them as being the same.
The FortiOS Carrier recognizes all duplicate messages, but it will take action when it detects a
volume of duplicate messages that exceed the duplicate threshold you set. The threshold
defines the maximum number of duplicate messages allowed, the period during which the
messages are considered, and the length of time the duplicate message can not be sent by
anyone.
For example, you may determine that once a duplicate message is sent more than 300 times in
an hour, any attempt to send the same duplicate message will be blocked for 30 minutes.
If a particular duplicate message exceeds the duplicate message threshold and is blocked, any
further attempts to send the same message will re-start the block period.
Using the example above, if the duplicate message count exceeds the duplicate threshold, any
attempt to send a copy of the duplicate message will be blocked for 30 minutes. If a subscriber
tries to send a copy of the message after waiting 15 minutes, the message will be blocked and
the block period will be reset to 30 minutes. The block period must expire with no attempts to
send a duplicate message. Only then will a subscriber be allowed to send the message.
Non-duplicate messages will not reset the block period.
When the Carrier-enabled FortiGate unit detects that a duplicate message has exceeded
duplicate threshold, it can take any combination of the five actions you configure for the
duplicate threshold.
Action Description
Log Add a log entry indicating that a duplicate message event has
occurred. You must also enable logging for MMS Scanning >
Bulk Messages in the Logging section of the MMS protection
profile.
DLP Archive
Fortinet Technologies Inc. Page 732 FortiOS Handbook - Carrier for FortiOS 5.0
All messages Save all the messages that exceed the duplicate threshold in
the DLP archive.
First message only Save the first message to exceed the duplicate threshold in
the DLP archive. Subsequent messages that exceed the
duplicate threshold will not be saved.
The FortiOS Carrier unit does not send notifications to the sender or receiver of duplicate
messages. If the sender or receiver is an attacker and is explicitly informed that they have
exceeded a message threshold, the attacker may try to determine the exact threshold value by
trial and error and then find a way around duplicate message protection. For this reason, no
notification is set to the sender or receiver.
However, the FortiOS Carrier unit does have replacement messages for sending reply
confirmations to MM1 senders and receivers and for MM4 senders for blocked messages
identified as duplicate messages. For information about how FortiOS Carrier responds when
message flood detection blocks a message, see FortiOS Carrier and MMS duplicate messages
and message floods on page 642.
Fortinet Technologies Inc. Page 733 FortiOS Handbook - Carrier for FortiOS 5.0
set rsp-status ok
set rsp-text Message Sent OK
end
When the FortiOS Carrier unit identifies an MM1 message received by a receiver from an MMSC
as a duplicate message and blocks it, the FortiOS Carrier unit returns a message retrieval
confirmation (m-retrieve.conf) to the sender (otherwise the senders handset would keep
retrying). The m-retrieve.conf message is sent only when the MM1duplicate message action is
set to Block. For other message flood actions the message is actually received by the receiver,
so the MMSC sends the m-retrieve.conf message.
You can customize the m-retrive.conf message by editing the MM1 retrieve-conf duplicate
message MM1 replacement message (from the CLI the mm1-retr-conf-dupe replacement
message). You can customize the class, subject, and message text for this message.
For example, you could use the following command make the response more generic:
config system replacemsg mm1 mm1-retr-conf-dupe
set subject Message blocked
set message Message temporarily blocked by carrier
end
If DLP Archive is a selected duplicate message action, the messages that exceed the threshold
are saved to the MMS DLP archive. The default behavior is to save all of the offending
messages but you can configure the DLP archive setting to save only the first message that
exceeds the threshold. See Viewing DLP archived messages on page 726.
Fortinet Technologies Inc. Page 734 FortiOS Handbook - Carrier for FortiOS 5.0
Order of operations: flood checking before duplicate checking
Although duplicate checking involves only examination and comparison of message contents
and not the sender or recipient, and flood checking involves only totalling the number of
messages sent by each subscriber regardless of the message content, there are times when a
selection of messages exceed both flood and duplicate thresholds.
The Carrier-enabled FortiGate unit checks for message floods before checking for duplicate
messages. Flood checking is less resource-intensive and if the flood threshold invokes a Block
action, the blocked messages are stopped before duplicate checking occurs. This saves both
time and FortiOS Carrier system resources.
You can use carrier endpoint filtering to exempt MMS sessions from duplicate message
detection. Carrier endpoint filtering matches carrier endpoints in MMS sessions with carrier
endpoint patterns. If you add a carrier endpoint pattern to a filter list and set the action to
exempt from mass MMS, all messages from matching carrier endpoints bypass duplicate
message detection. For more information about endpoints, see FortiOS Handbook User
Authentication chapter.
To have the Carrier-enabled FortiGate unit check for duplicate messages, configure the
duplicate threshold in an MMS profile, and select the MMS profile in a security policy.
All traffic matching the security policy will be checked for duplicate messages according to the
settings in the MMS profile.
The duplicate scanner will only scan content. It will not scan headers. Content must be
exactly the same. If there is any difference at all in the content, it will not be considered a
duplicate.
The modular nature of the profiles allows you great flexibility in how you configure the scanning
options. MMS profiles can be used in any number of policies, with different GTP profiles.
In a complex configuration, there may be many security policies, each with a different MMS
profile. For a simpler network, you may have many security policies all using the same MMS
profile.
When duplicate messages are detected, the Carrier-enabled FortiGate unit can be configured to
notify you immediately with an MMS message. Enable this feature by selecting Alert Notification
in the duplicate message action. Each duplicate message threshold can be configured
separately.
This section includes:
Configuring how and when to send alert notifications
Configuring who to send alert notifications to
Fortinet Technologies Inc. Page 735 FortiOS Handbook - Carrier for FortiOS 5.0
Configuring how and when to send alert notifications
You can configure different alert notifications for MM1 and MM4 duplicate messages. You can
configure the FortiOS Carrier unit to send these alert notifications using the MM1, MM3, MM4,
or MM7 content interface. Each of these content interfaces requires alert notification settings
that the FortiOS Carrier unit uses to communicate with a server using the selected content
interface.
For the MM1 content interface you require:
The hostname of the server
The URL of the server (usually /)
The server port (usually 80)
For the MM3 and MM4 content interfaces you require:
The hostname of the server
The server port (usually 80)
The server user domain
For the MM7 content interface you require:
The message type
submit.REQ to send a notification message to the sender in the form of a submit request.
The message goes from a VAS application to the MMSC.
deliver.REQ to send a notification message to the sender in the form of a deliver request. The
message goes from the MMSC to a VAS application.
The hostname of the server
The URL of the server (usually /)
The server port (usually 80)
A user name and password to connect to the server
The value-added-service-provider (VASP) ID
The value-added-service (VAS) ID
Fortinet Technologies Inc. Page 736 FortiOS Handbook - Carrier for FortiOS 5.0
9. If required, change Window Start Time and Window Duration configure when the FortiOS
Carrier unit sends alert notifications.
By default, notifications are sent at any time of the day. You can change the Window Start
Time if you want to delay sending alert messages. You can also reduce the Window Duration
if you want to stop sending alert notifications earlier.
For example, you might not want FortiOS Carrier sending notifications except during
business hours. In this case the Window Start Time could be 9:00 and the Window Duration
could be 8:00 hours.
You can set different alert notifications for each message threshold. For example, you could
limit the message window for lower thresholds and set it to 24 hours for higher thresholds.
This way administrators will only receive alert notifications outside of business hours for
higher thresholds.
10.For Day of Week, select the days of the week to send notifications.
For example, you may only want to send alert notifications on weekends for higher
thresholds.
11.In the Interval field, enter the maximum frequency that alert notification messages will be
sent, in minutes or hours.
All alerts occurring during the interval will be included in a single alert notification message
to reduce the number of alert messages that are sent.
Select the duplicate thresholds at which to send alert notifications to the MSISDN.
For the duplicate threshold to be able to send an alert notification to the MSISDN, the
duplicate message threshold alert notification action must be enabled and configured.
Fortinet Technologies Inc. Page 737 FortiOS Handbook - Carrier for FortiOS 5.0
Configuring GTP on FortiOS Carrier
Configuring GTP support on FortiOS Carrier involves configuring a number of areas of features.
Some features require longer explanations, and have their own chapters. The other features are
addressed here.
This section includes:
GTP support on the Carrier-enabled FortiGate unit
Configuring General Settings on the Carrier-enabled FortiGate unit
Configuring Encapsulated Filtering in FortiOS Carrier
Configuring the Protocol Anomaly feature in FortiOS Carrier
Configuring Anti-overbilling in FortiOS Carrier
Logging events on the Carrier-enabled FortiGate unit
The FortiCarrier unit needs to have access to all traffic entering and exiting the carrier network
for scanning, filtering, and logging purposes. This promotes one of two configurations hub
and spoke, or bookend.
A hub and spoke configuration with the Carrier-enabled FortiGate unit at the hub and the other
GPRS devices on the spokes is possible for smaller networks where a lower bandwidth allows
you to divide one unit into multiple virtual domains to fill multiple roles on the carrier network. It
can be difficult with a single FortiOS Carrier as the hub to ensure all possible entry points to the
carrier network are properly protected from potential attacks such as Relayed network attacks
on page 741.
A bookend configuration uses two Carrier-enabled FortiGate units to protect the carrier network
between them with high bandwidth traffic. One unit handles traffic from mobile stations,
SGSNs, and foreign carriers. The other handles GGSN and data network traffic. Together they
ensure the network is secure.
The Carrier-enabled FortiGate unit can access all traffic on the network. It can also verify traffic
between devices, and verify that the proper GPRS interface is being used. For example there is
no reason for a Gn interface to be used to communicate with a mobile station the mobile
station will not know what to do with the data so that traffic is blocked.
When you are configuring your Carrier-enabled FortiGate units GTP profile, you must
first configure the APN. It is critical to GTP communications no traffic will flow without
the APN.
The Carrier-enabled FortiGate unit does more than just forward and route GTP packets over the
network. It also performs:
Packet sanity checking
GTP stateful inspection
Protocol anomaly detection and prevention
HA
Virtual domain support
Page 738
Packet sanity checking
The FortiOS Carrier firewall checks the following items to determine if a packet confirms to the
UDP and GTP standards:
GTP release version number must be 0, 1, or 2
Settings of predefined bits
Protocol type
UDP packet length
If the packet in question does not confirm to the standards, the FortiOS Carrier firewall drops
the packet, so that the malformed or forged traffic will not be processed.
HA
FortiOS Carrier active-passive HA provides failover protection for the GTP tunnels. This means
that an active-passive cluster can provide FortiOS Carrier firewall services even when one of the
cluster units encounters a problem that would result in complete loss of connectivity for a
stand-alone FortiOS Carrier firewall. This failover protection provides a backup mechanism that
can be used to reduce the risk of unexpected downtime, especially for mission-critical
environments.
FortiOS HA synchs TCP sessions by default, but UDP sessions are not synchronized by default.
However synchronizing a session is only part of the solution if the goal is to continue GTP
processing on a synchronized session after a HA switch. For that to be successful we also need
to synch the GTP tunnel state. So, once the master completes tunnel setup then the GTP tunnel
is synchronized to the slave.
Fortinet Technologies Inc. Page 739 FortiOS Handbook - Carrier for FortiOS 5.0
GTP traffic will only flow without interruption on a HA switch if bidirectional GTP policies have
been configured: an internal (GTP server) to external (all) UDP port GTP policy, and an external
(all) to internal (GTP server) UDP port GTP policy. If either policy is missing then traffic may be
interrupted until traffic flows in the opposite direction.
For more information on HA in FortiOS, see High Availability for FortiOS 5.0 on page 1116.
To configure the GTP General Settings, go to Security Profiles > Carrier > GTP Profile, and edit a
GTP profile. Expand General Settings to configure settings. See General settings options on
page 685.
Encapsulated traffic on the GPRS network can come in a number of forms as it includes traffic
that is wrapped up in another protocol. This detail is important for firewalls because it requires
unwrapping to properly scan the data inside. If encapsulated packets are treated as regular
packets, that inside layer will never be scanned and may allow malicious data into your network.
On Carrier-enabled FortiGate units, GTP related encapsulated filtering falls under encapsulated
IP traffic filtering, and encapsulated non-IP end user address filtering.
Fortinet Technologies Inc. Page 740 FortiOS Handbook - Carrier for FortiOS 5.0
IP packets originating from a mobile station will not contain source or destination addresses
that fall within the address range of GPRS infrastructures. In addition, traffic originating from the
users handset will not have destination/source IP addresses that fall within any Network
Management System (NMS) or Charging Gateway (CG) networks.
You cannot add an IE removal policy when you are creating a new profile.
Fortinet Technologies Inc. Page 741 FortiOS Handbook - Carrier for FortiOS 5.0
Configuring the Protocol Anomaly feature in FortiOS Carrier
When anomalies do happen, it is possible for the anomaly to interrupt network traffic or
consume network resources if precautions are not taken. Anomalies can be generated by
accident or maliciously, but both methods can have the same results degrading the
performance of the carrier network, or worse.
To configure GTP protocol anomalies, go to Security Profiles > Carrier > GTP Profile, and edit a
GTP profile. Expand the Protocol Anomaly option. SeeProtocol Anomaly prevention options
on page 696.
The following are some examples:
The GTP header specifies the length of the packet excluding the mandatory GTP header. In
GTP version 0 (GSM 09.60), the mandatory GTP header size is 20 bytes, whereas GTP
version 1 (GSM 29.060) specifies that the minimum length of the GTP header is 8 bytes. The
GTP packet is composed of the header, followed by Information Elements typically
presented in a Type-Length-Value format. It is possible for an attacker to create a GTP
packet with a GTP header field length that is incompatible with the length of the necessary
information elements.
The same concepts are true for GTP version 2 headers even though there are different fields
in them.
It is similarly possible for an attacker to create a packet with an invalid IE length. Invalid
lengths may cause protocol stacks to allocate incorrect amounts of memory, and thereby
cause crashes or buffer overflows.
By default the FortiOS Carrier firewall detects these problems, as well as other protocol
anomalies, and drops the packets. All protocol anomaly options are set to Deny by default.
However, you can change the policy to allow them.
Fortinet Technologies Inc. Page 742 FortiOS Handbook - Carrier for FortiOS 5.0
Anti-overbilling on the Carrier-enabled FortiGate unit involves:
the administrator configuring the overbilling settings in the GTP profile to notify the Gi firewall
when a GTP tunnel is deleted
the unit clearing the sessions when the Gi firewall receives a notification from the Gn/Gp
firewall about a GTP tunnel being deleted This way, the Gi firewall prevents overbilling by
blocking traffic initiated by other users.
The three locations to configure anti-overbilling options include:
System > Network > Interface > Gi Gatekeeper edit an interface, and enable to monitor Gi
anti-overbilling traffic on this interface
System > Admin > Settings > Gi Gatekeeper Settings set the context ID and port that
anti-overbilling will take place on.
Security Profiles > Carrier > GTP Profile > Anti-Overbilling the IP address, port, interface
and context ID to use for anti-overbilling measures.
For detailed options, see Anti-Overbilling options on page 697.
Logging on the Carrier-enabled FortiGate unit is just like logging on any other FortiOS unit. The
only difference with FortiOS Carrier is that there are a few additional events that you can log
beyond the regular ones. These additional events are covered here. For more information on
other logging issues, see the Logging and Reporting Guide and FortiOS CLI Reference.
To enable FortiOS Carrier logging, go to Log&Report > Event Log, and ensure GTP service
event is enabled. Once this option is selected, the logging options under Security Profiles >
Carrier > GTP Profile will be active.
To change FortiOS Carrier specific logging event settings, go to Security Profiles > Carrier >
GTP Profile and edit a GTP profile. Expand the Log section to change the settings. For detailed
options, see Log options on page 697.
The following information is contained in each log entry:
Timestamp The time and date when the log entry was recorded
Tunnel Identifier An identifier for the start and endpoints of a GTP tunnel. This
(TID) information uniquely defines all tunnels. It is important for billing
Tunnel Endpoint information based on the length of time the tunnel was active
Identifier (TEID) and how much data passed over the tunnel.
Message type For available message types, see Common message types on
carrier networks on page 745.
Packet status What action was performed on the packet. This field matches
the logging options while you are configuring GTP logging. See
Anti-overbilling with FortiOS Carrier on page 742.
The status can be one of forwarded, prohibited, state-invalid,
rate-limited, or tunnel-limited
Fortinet Technologies Inc. Page 743 FortiOS Handbook - Carrier for FortiOS 5.0
Virtual domain ID or A Carrier-enabled FortiGate unit can be divided into multiple
name virtual units, each being a complete and self-contained virtual
FortiCarrier unit. This field indicates which virtual domain
(VDOM) was responsible for the log entry. If VDOMs are not
enabled on your unit, this field will be root.
Reason to be denied If the packet that generated this log entry was denied or
if applicable blocked, this field will include what part of FortiOS denied or
blocked that packet. Such as firewall, antivirus, webfilter, or
spamfilter.
An example of the above log message format is for a Tunnel deleted log entry. When a tunnel is
deleted, the log entry contains the following information:
Timestamp
Interface name (if applicable)
SGSN IP address (source IP)
GGSN IP address (destination IP)
Tunnel ID
Tunnel duration time in seconds
Number of messages sent to the SGSN
Number of messages sent to the GGSN
Fortinet Technologies Inc. Page 744 FortiOS Handbook - Carrier for FortiOS 5.0
GTP message type filtering
Carrier networks include many types of messages some concern the network itself, others
are content moving across the network, and still others deal with handshaking, billing, or other
administration based issues.
GTP contains two major parts GTP for the control plane (GTP-C) and GTP for user data
tunnelling (GTP-U). Outside of those areas there are only unknown message types.
GTP-C messages
GTP-C contains the networking layer messages. These address routing, versioning, and other
similar low level issues.
When a subscriber requests a Packet Data Protocol (PDP) context, the SGSN will send a create
PDP context request GTP-C message to the GGSN giving details of the subscriber's request.
The GGSN will then respond with a create PDP context response GTP-C message which will
either give details of the PDP context actually activated or will indicate a failure and give a
reason for that failure. This is a UDP message on port 212.
GTP-C message types include Path Management Messages, Location Management Messages,
and Mobility Management Messages.
Page 745
GGSN. A GTP tunnel is identified in each GSN node by a TEID, an IP address, and a UDP port
number.
GTP-U messages
GTP-U is focused on user related issues including tunneling, and billing. GTP-U message types
include MBMS messages, and GTP-U and Charging Management Messages
MBMS messages
Multimedia Broadcast and Multicast Services (MBMS) have recently begun to be offered over
GSM and UMTS networks on UTRAN and GERAN radio access technologies. MBMS is mainly
used for mobile TV, using up to four GSM timeslots for one MBMS connection. One MBMS
packet flow is replicated by GGSN, SGSN and RNCs.
MBMS is split into the MBMS Bearer Service and the MBMS User Service. The MBMS User
Service is basically the MBMS Service Layer and offers a Streaming- and a Download Delivery
Method. The Streaming Delivery method can be used for continuous transmissions like Mobile
TV services. The Download Method is intended for "Download and Play" services.
Fortinet Technologies Inc. Page 746 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Unknown Action messages
If the system doesnt know what type of message it is, it falls into this category. This is an
important category of message because malformed messages may appear and need to be
handled with security in mind.
Fortinet best practices dictate that you set Unknown Action messages to deny for
security reasons.
GPRS Tunnelling Protocol (GTP) is a group of IP-based communications protocols used to carry
General Packet Radio Service (GPRS) traffic within Global System for Mobile Communications
(GSM) and Universal Mobile Telecommunications System (UMTS) networks. It allows carriers to
transport actual cellular packets over their network via tunneling.
In the CLI, there is a keyword for each type of GTP message for both message filtering, and for
message rate limiting.
GTP message rate limiting is only accessible from the CLI using the command
configure firewall gtp .
Fortinet best practices dictate that the unknown message action should be set to Deny
for security reasons as this will block malformed messages.
6. Optionally select and configure any other GTP features for this profile, such as logging.
7. Select OK to save the profile.
8. Apply the msg_type_filtering profile a security policy configured for GTP tunnel traffic.
To configure GTP message filtering and block Unknown Message Action messages- CLI
config firewall gtp
edit msg_type_filtering
config message-filter
set unknown-message-action deny
next
end
end
Fortinet Technologies Inc. Page 747 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Message Type Fields
Each of the following message types can be allowed or denied by your Carrier-enabled
FortiGate unit depending on your carrier network and GTP traffic.
The message types include:
Unknown Message Action
Path Management Messages
Tunnel Management Messages
Location Management Messages
Mobility Management Messages
MBMS messages
GTP-U and Charging Management Messages
Version not GTP-C, There are multiple versions of GTP. Both devices
Supported GTP-U, communicating must use the same version of GTP, or this
GTP message will be the response.
Support Extension Extensions are optional parts that a device can choose to
Headers support or not. If a device includes these extensions, it
Notification must include headers for the extensions to sure ensure
proper formatting.
Create PDP Context GTP-C Sent from an SGSN to a GGSN node as part of a
Request/ Response GPRS PDP Context Activation procedure or the
Network-Requested PDP Context Activation
procedure. A valid request initiates the creation of a
tunnel.
Update PDP Context GTP-C Used when PDP Context information changes, such as
Request/ Response when a mobile device changes location.
Delete PDP Context GTP-C Used to terminate a PDP Context, and confirm the
Request/ Response context has been deleted.
Fortinet Technologies Inc. Page 748 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Create AA PDP GTP-C Sent as part of the GPRS Anonymous Access PDP
Context Request/ Context Activation. It is used to create a tunnel
Response between a context in the SGSN and a context in the
GGSN.
Delete AA PDP GTP-C Sent as part of the GPRS PDP Anonymous Access
Context Request/ Context Deactivation procedure to deactivate an
Response activated PDP Context. It contains Cause and Private
Extension Information Elements
Error Indication GTP-U Sent to the GGSN when a tunnel PDU is received for
the following conditions:
No PDP context exists
PDP context is inactive
No MM context exists
GGSN deletes its PDP context when the message is
received.
PDU Notification GTP-C When receiving a Tunneled PDU (T-PDU), the GGSN
Request/ Response/ checks if a PDP context is established for the given
Reject Request/ PDP address. If no PDP context has been established,
Reject Response the GGSN may initiate the Network-requested PDP
Context Activation procedure by sending a PDU
Notification Request to the SGSN.
Reject Request - Sent when the PDP context
requested by the GGSN cannot be established.
Send Routing GTP-C Sent by the GGSN to obtain location information for
Information for GPRS the MS. This message type contains the IMSI of the
Request/ Response MS and Private Extension.
Failure Report GTP-C Sent by the GGSN to the HLR when a PDU reject
Request/ Response message is received.
The GGSN requests the HLR to set the flag and add
the GGSN to the list of nodes to report to when activity
from the subscriber that owns the PDP address is
detected.
The message contains the subscriber IMSI and Private
Extension
Note MS GPRS GTP-C When the HLR receives a message from a mobile with
Present Request/ MDFG
Response
set, it clears the MDFG and sends the Note MS
Present message to all GGSNs in the subscribers list.
This message type contains subscriber IMSI, GSN
Address and Private Extension
Fortinet Technologies Inc. Page 749 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Mobility Management Messages
Identification GTP-C Sent by the new SGSN to the old SGSN to request the
Request/Response IMSI for a MS when a GPRS Attach is done with a
P-TMSI and the MS has changed SGSNs since the
GPRS Detach was done.
SGSN context GTP-C Sent by the new SGSN to the old SGSN to request the
Request/ Response/ MM and PDP Contexts for the MS.
Acknowledge
Forward SRNS GTP-C This procedure may be used to trigger the transfer of
Context/ Context SRNS contexts from RNC to CN (PS domain) in case
Acknowledge of inter system forward handover.
RAN Information GTP-C Forward the Routing Area Network (RAN) information.
Relay
A Routing Area (RA) is a subset of a GSM Location
Area (LA). A RA is served by only one SGSN. Ensures
that regular radio contact is maintained by the mobile
MBMS messages
Fortinet Technologies Inc. Page 750 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Update MBMS GTP-C
Context Request/
Response
Delete MBMS GTP-C Request to deactivate the MBMS context. When the
Context Request/ response is received, the MBMS context will be
Response inactive.
Node Alive GTP-C, Used to inform rest of network when a node starts
Request/Response GTP-U service.
Redirection GTP-C, Used to divert the flow of CDRs from the CDFs to
Request/Response GTP-U another CGF when the sender is being removed, or
they are used when the CGF has lost its connection
to a downstream system.
Data Record Transfer GTP-C, Used to reliably transport CDRs from the point of
Request/Response GTP-U generation (SGSN/GGSN) to non-volatile storage in
the CGF
Fortinet Technologies Inc. Page 751 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
GTP identity filtering
FortiOS Carrier supports a number of filtering methods based on subscriber identity such as
APN filtering, IMSI filtering, and advanced filtering.
This section includes:
IMSI on carrier networks
Other identity and location based information elements
Configuring APN filtering in FortiOS Carrier
Configuring IMSI filtering in FortiOS Carrier
Configuring advanced filtering in FortiOS Carrier
The International Mobile Subscriber Identity (IMSI) number is central to identifying users on a
carrier network. It is a unique number that is assigned to a cell phone or mobile device to
identify it on the GMS or UTMS network.
Typical the IMSI number is stored on the SIM card of the mobile device and is sent to the
network as required.
An IMSI number is 15 digits long, and includes the Mobile Country Code (MCC), Mobile
Network Code (MNC), and Mobile Station Identification Number (MSIN).
012345678901234
The Home Network Identity (HNI) is made up of the MCC and MNC. The HNI is used to fully
identify a users home network. This is important because some large countries have more than
one country code for a single carrier. For example a customer with a mobile carrier on the East
Coast of the United States would have a different MCC than a customer on the West Coast with
the same carrier because even through the MNC would be the same the MCC would be
different the United States uses MCCs 310 to 316 due to its size.
If an IMSI number is not from the local carriers network, IMSI analysis is performed to resolve
the number into a Global Title which is used to access the users information remotely on their
home carriers network for things like billing and international roaming.
See Configuring IMSI filtering in FortiOS Carrier on page 756.
IMSI focuses on the user, their location, and carrier network. There are other numbers used to
identify different user related Information Elements (IE).
Page 752
These identity and location based elements include:
Access Point Number (APN)
Mobile Subscriber Integrated Services Digital Network (MSISDN)
Radio Access Technology (RAT) type
User Location Information (ULI)
Routing Area Identifier (RAI)
International Mobile Equipment Identity (IMEI)
Fortinet Technologies Inc. Page 753 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
User Location Information (ULI)
Gives Cell Global Identity/Service Area Identity (CGI/SAI) of where the mobile station is currently
located. The ULI and the RAI are commonly used together to identify the location of the mobile
device.
ULI is part of advanced filtering configuration. See Configuring advanced filtering in FortiOS
Carrier on page 757.
Fortinet Technologies Inc. Page 754 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Figure 153:Identity filtering comparison
Filtering type Filter on the following data: When to use this type of filtering
Advanced PDP context, APN, IMSI, When you want to filter based on:
MSISDN, RAT type, ULI, RAI,
user phone number (MSISDN)
IMEI
what wireless technology the user
employed to get on the network (RAT
type)
user location (ULI and RAI)
handset ID, such as for stolen phones
(IMEI)
APN filtering is very specific the only identifying information that is used to filter is the APN
itself. This will always be present in GTP tunnel traffic, so all GTP traffic can be filtered using this
value. See Configuring APN filtering in FortiOS Carrier on page 755.
IMSI filtering can use a combination of the APN and MCC-MNC numbers. The MCC and MNC
are part of the APN, however filtering on MCC-MNC separately allows you to filter based on
country and carrier instead of just the destination of the GTP Tunnel. See Configuring IMSI
filtering in FortiOS Carrier on page 756.
Advanced filtering can go into much deeper detail covering PDP contexts, MSISDN, IMEI, and
more not to mention APN, and IMSI as well. If you cant find the information in APN or IMSI that
you need to filter on, then use Advanced filtering. See Configuring advanced filtering in FortiOS
Carrier on page 757.
To configure APN filtering go to Security Profiles > Carrier > GTP Profile. Select a profile or
create a new one, and expand APN filtering.
When you are configuring your Carrier-enabled FortiGate units GTP profiles, you must
first configure the APN. It is critical to GTP communications and without it no traffic will
flow.
For more information on APN, see Access Point Number (APN) on page 753.
Default APN Action Select either Allow or Deny for all APNs that are not found in the
list. The default is Allow.
Value Displays the APN value for this entry. Partial matches are allowed
using wildcard. For example *.mcc333.mcn111.gprs would
match all APNs from country 333 and carrier 111 on the gprs
network.
Fortinet Technologies Inc. Page 755 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Mode Select one or more of the methods used to obtain APN values.
Mobile Station provided - The APN comes from the mobile station
where the mobile device connected. This is the point of entry into
the carrier network for the users connection.
Network provided - The APN comes from the carrier network.
Subscription Verified - The users subscription has been verified
for this APN. This is the most secure option.
Action One of allow or deny to allow or block traffic associated with this
APN.
Delete icon Select to remove this APN entry from the list.
Edit icon Select to change the information for this APN entry.
Add APN Select to add an APN to the list. Not active while creating GTP
profile, only when editing an existing GTP profile.
Save all changes before adding APNs. A warning to this effect will
be displayed when you select the Add APN button.
The Add APN button is not activated until you save the new GTP profile. When you edit that
GTP profile, you will be able to add new APNs.
In many ways the IMSI on a GPRS network is similar to an IP address on a TCP/IP network.
Different parts of the number provide different pieces of information. This concept is used in
IMSI filtering on FortiOS Carrier.
To configure IMSI filtering go to Security Profiles > Carrier > GTP Profile and expand IMSI
filtering.
While both the APN and MCC-MCN fields are optional, without using one of these fields the
IMSI entry will not be useful as there is no information for the filter to match.
Default IMSI Action Select Allow or Deny. This action will be applied to all IMSI
numbers except as indicated in the IMSI list that is displayed.
The default value is Allow.
MCC-MNC The Mobile Country Code (MCC) and Mobile Network Code
(MNC) to filter on. Together these numbers uniquely identify the
carrier and network of the GGSN being used.
This field is optional.
Fortinet Technologies Inc. Page 756 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Mode Select the source of the IMSI information as one or more of the
following:
Mobile Station provided - the IMSI number comes from the
mobile station the mobile device is connecting to.
Network provided - the IMSI number comes from the GPRS
network which could be a number of sources such as the SGSN,
or HLR.
Subscription Verified - the IMSI number comes from the users
home network which has verified the information.
While Subscription Verified is the most secure option, it may not
always be available. Selecting all three options will ensure the
most complete coverage.
Delete Icon Select the delete icon to remove this IMSI entry.
Edit Icon Select the edit icon to change information for this IMSI entry.
Add IMSI Select to add an IMSI to the list. Not active while creating GTP
profile, only when editing an existing GTP profile.
Save all changes before adding IMSIs. A warning to this effect will
be displayed when you select the Add IMSI button.
Compared to ADN or IMSI filtering, advanced filtering is well named. Advanced filtering can be
viewed as a catch-all filtering option if ADN or IMSI filtering doesnt do what you want, then
advanced filtering will. The advanced filtering can use more information elements to provide
considerably more granularity for your filtering.
Default Action Select Allow or Deny as the default action to take when traffic
does not match an entry in the advanced filter list .
Fortinet Technologies Inc. Page 757 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Messages Optionally select one or more types of messages this filter applies
to:
Create PDP Context Request, Create PDP Context Response,
Update PDP Context Request, or Update PDP Context Response.
Selecting Create PDP Context Response or Update PDP Context
Response limits RAT type to only GAN and HSPA, and disables
the APN, APN Mode, IMSI, MSISDN, ULI, RAI, and IMEI fields.
To select Update PDP Context Request, APN Restriction must be
set to all. Selecting Update PDP Context Request disables the
APN, MSISDN, and IMEI fields.
if all message types are selected, only the RAT Types of GAN and
HSPA are available to select.
APN Restriction APN Restriction either allows all APNs or restricts the APNs to one
of four categories Public-1, Public-2, Private-1, or Private-2.
This can also be combined with a specific APN or partial APN as
well as specifying the APN mode. See Access Point Number
(APN) on page 753.
RAT Type Select one or more of the Radio Access Technology Types listed.
These fields control how a user accesses the carriers network.
You can select one or more of UTRAN, GERAN, WLAN, GAN,
HSPA, or any. See Radio Access Technology (RAT) type on
page 753.
ULI The user location identifier. Often the ULI is used with the RAI to
locate a user geographically on the carriers network.
The ULI is disabled when Create PDP Context Response or
Update PDP Context Response messages are selected.
See User Location Information (ULI) on page 754.
RAI The router area identifier. There is only one SGSN per routing area
on a carrier network. This is often used with ULI to locate a user
geographically on a carrier network.
The RAI is disabled when Create PDP Context Response or
Update PDP Context Response messages are selected.
See Routing Area Identifier (RAI) on page 754.
Action Select Allow or Deny as the action when this filter matches traffic.
The default is Allow.
Fortinet Technologies Inc. Page 758 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Edit Icon Select to edit this entry.
Add Select to add an advanced filter to the list. Not active while
creating GTP profile, only when editing an existing GTP profile.
Save all changes before adding advanced filters. A warning to this
effect will be displayed when you select the Add button.
Fortinet Technologies Inc. Page 759 FortiOS Handbook - Carrier for FortiOS vX.0 MRX
Troubleshooting
This section includes diagnose commands specific to FortiOS Carrier features such as GTP.
apn list <gtp_profile> The APN list entries in the specified GTP profile
auth-ggsns show The authorized GGSNs entries for the specified GTP profile. Any
<gtp_profile> GGSNs not on this list will not be recognized.
auth-sgsns show The authorized SGSNs list entries for the specified GTP profile. Any
<gtp_profile> SGSNs not on this list will not be recognized.
handover-grp show The handover group showing the range of allowed handover group
<gtp_profile> IP addresses. The handover group acts like a whitelist of allowed
GTP addresses with a default deny at the end if the GTP address
is not on the list, it is denied.
ie-remove-policy list List of IE policies in the IE removal policy for this GTP profile. The
<gtp_profile> information displayed includes the message count for this policy, the
length of the SGSN, the list of IEs, and list of SGSN IP addresses.
imsi list <gtp_profile> IMSI filter entries for this GTP profile. The information displayed
includes the message count for this filter, length of the IMSI, the
length of the APN and IMSI, and of course the IMSI and APN values.
invalid-sgsns-to-long List of SGSNs that do not match the filter criteria. These SGSNs will
list <gtp_profile> be logged.
ip-policy list List the IP policies including message count for each policy, the
<gtp_profile> action to take, the source and destination IP addresses or ranges,
and masks.
noip-policy List the non-IP policies including the message count, which mode,
<gtp_profile> the action to take, and the start and end protocols to be used by
decimal number.
Page 760
path {list | flush} Select list or flush.
List the GTP related paths in FortiOS Carrier memory.
Flush the GTP related paths from memory.
policy list <gtp_policy> The GTP advanced filter policy information for this GTP profile. The
information displayed for each entry includes a count for messages
matching this filter, a hexidecimal mask of which message types to
match, the associated flags, action to take on a match, APN
selection mode, MSISDN, RAT types, RAI, ULI, and IMEI.
runtime-stat flush Select to flush the GTP runtime statistics from memory.
stat Display the GTP runtime statistics details on current GTP activity.
This information includes how many tunnels are active, how many
GTP profiles exist, how many IMSI filter entries, how many APN filter
entries, advanced policy filter entries, IE remove policy filter entries,
IP policy filter entries, clashes, and dropped packets.
GTP-U (GTP user data tunnelling) tunnels carry user data packets, signalling messages and
error information. GTP-U uses UDP port 2152. Carrier-enabled FortiGate units can apply IPS
intrusion protection and detection to GTP-U user data sessions.
To apply IPS to GTP-U user data sessions, add an IPS Sensor to a profile and add the profile to
a security policy that accepts GTP-U tunnels. The security policy Service field must be set to
GTP or ANY to accept GTP-U packets.
The Carrier-enabled FortiGate unit intercepts packets with destination port 2152, removes the
GTP header and handles the packets as regular IP packets. Applying an IPS sensor to the IP
packets, the Carrier-enabled FortiGate unit can log attacks and pass or drop packets
depending on the configuration of the sensor.
If the packet is GTP-in-GTP, or a nested tunnel, the packets are passed or blocked without
being inspected.
Fortinet Technologies Inc. Page 761 FortiOS Handbook - Carrier for FortiOS 5.0
5. Configure the security policy to accept GTP traffic.
In the security policy configure the source and destination settings to match the GTP traffic.
Service to GTP or ANY so that the security policy accepts GTP traffic.
6. Select the GTP profile within the security policy.
7. Configure any other required security policy settings.
8. Select OK to save the security policy.
When GTP packets are not getting to their destination, this could be caused by any one of a
number of issues. General troubleshooting principals apply here.
The following sections provide some suggestions on how to troubleshoot this issue:
Attempt to identify the section of your network with the problem
Ensure you have an APN configured
Check the logs and adjust their settings if required
Check the routing table
Perform a sniffer trace
Generate specific packets to test the network
Fortinet Technologies Inc. Page 762 FortiOS Handbook - Carrier for FortiOS 5.0
GTP related events in the event log will have message IDs in the range 41216 to 41222. For
more information on GTP log messages, see the Log Message Reference. For more information
on logging in general, see the Logging and Reporting handbook chapter.
Once there is a problem to troubleshoot, check the logs to trace the traffic patterns and narrow
down the possible sources of the problem. There may be enough detail for you to locate and fix
the problem without changing the log settings.
Remember to set any changes you made to the log settings back to their original values
when you are done troubleshooting. Otherwise, the amount of detail will overwhelm your
logging.
However, if more detail is required you can change settings such as:
Lower the Log Frequency number in GTP Profiles so fewer or no log messages are dropped.
This will allow a more accurate picture of everything happening on the network, where you
may have had only a partial picture before.
Ensure all the GTP log events are enabled to provide you with a complete picture.
Ensure that all relevant event types are enabled under Log & Report > Log Config > Event
Log.
For more information on GTP related logging, see Logging events on the Carrier-enabled
FortiGate unit on page 743. See the log and report chapters of Logging and Reporting Guide
and FortiOS CLI Reference.
General information to look for in the logs includes:
Are all packets having problems or just certain types?
Are all devices on the network having problem, or just certain devices?
Is it just GTP traffic that is having problems or are all types of traffic having the same
problem?
If VDOMs are enabled on your Carrier-enabled FortiGate unit, all routing related CLI
commands must be performed within a VDOM and not in the global context.
Fortinet Technologies Inc. Page 763 FortiOS Handbook - Carrier for FortiOS 5.0
S* 0.0.0.0/0 [10/0] via 192.168.183.254, port2
S 1.0.0.0/8 [10/0] via 192.168.183.254, port2
S 2.0.0.0/8 [10/0] via 192.168.183.254, port2
C 10.142.0.0/23 is directly connected, port3
B 10.160.0.0/23 [20/0] via 10.142.0.74, port3, 2d18h02m
C 192.168.182.0/23 is directly connected, port2
Examining an entry from the routing table above:
B 10.160.0.0/23 [20/0] via 10.142.0.74, port3, 2d18h02m
2d18h02m How old this route is, in this case almost three days old.
If your Carrier-enabled FortiGate unit has NP interfaces that are offloading traffic, this
will change the sniffer trace. Before performing a trace on any NP interfaces, disable
offloading on those interfaces.
Fortinet Technologies Inc. Page 764 FortiOS Handbook - Carrier for FortiOS 5.0
however this will disable stateful inspection on the Carrier-enabled FortiGate unit and
consequently cause many features to be turned off.
If you configure virtual IP addresses on your Carrier-enabled FortiGate unit, the unit will
use those addresses in preference to the physical IP addresses. If not configured
properly, secondary IP addresses can cause a broadcast storm. You will notice the
secondary address being preferred when you are sniffing packets because all the traffic
will be using the virtual IP addresses. This is due to the ARP update that is sent out
when the VIP address is configured.
<filter> What to look for in the information the sniffer reads. none
indicates no filtering, and all packets will be displayed as the
other arguments indicate.
The filter must be inside single quotes ().
<count> The number of packets the sniffer reads before stopping. If you
dont put a number here, the sniffer will run forever unit you stop
it with <CTRL C>.
For a simple sniffing example, enter the CLI command diag sniffer packet port1 none
1 3. This will display the next 3 packets on the port1 interface using no filtering, and using
verbose level 1. At this verbosity level you can see the source IP and port, the destination IP and
port, action (such as ack), and sequence numbers.
In the output below, port 443 indicates these are HTTPS packets, and 172.20.120.17 is both
sending and receiving traffic.
Head_Office_620b # diag sniffer packet port1 none 1 3
interfaces=[port1]
filters=[none]
0.545306 172.20.120.17.52989 -> 172.20.120.141.443: psh 3177924955
ack 1854307757
Fortinet Technologies Inc. Page 765 FortiOS Handbook - Carrier for FortiOS 5.0
Generate specific packets to test the network
If some packets are being delivered as expected while others are not, or after you believe you
have fixed the problem, it is a good idea to generate specific traffic to test your network.
For example if you discover through log messages and packet sniffing that Create PDP Context
Request messages are not being delivered between two SGSNs, you can generate those
specific messages on your network to confirm they are the problem, and later that you have
solved the problem and they are now being delivered as expected.
This step requires a third party traffic generation tool, either hardware or software. This is not be
supported by Fortinet.
Fortinet Technologies Inc. Page 766 FortiOS Handbook - Carrier for FortiOS 5.0
Chapter 5 Compliance
The primary source of information for your PCI DSS compliance program is the Payment Card
Industry (PCI) Data Security Standard itself. Version 3.0 of the standard was released in
November 2013 and is active from January 1, 2014 to December 31, 2017. The following is only
a brief summary of PCI DSS.
Regularly Monitor and 10) Track and monitor all access FortiDB auditing and
Test Networks to network resources and monitoring
cardholder data
FortiAnalyzer event reporting
See Monitoring the network
for vulnerabilities on
page 778.
This chapter describes how the FortiGate units features can help your organization to be
compliant with PCI DSS. Requirements that the FortiGate cannot enforce need to be met
through organization policies with some means determined for auditing compliance.
Be sure to read the section, Wireless guidelines, below. Even if your organization does not use
wireless networking, PCI DSS requires you to verify periodically that wireless networking has
not been introduced into the CDE.
Wireless guidelines
While wired networks usually connect fixed known workstations, wireless networks are more
dynamic, introducing a different set of security concerns.
Even if your organization does not use wireless networking, PCI DSS requires you to verify
periodically that unauthorized wireless networking has not been introduced into the CDE.
Wireless networking could be introduced quite casually by adding a wireless device to a PC on
the CDE network.
For all PCI DSS networks, whether they use wireless technology or not, the following
requirement applies:
Test for the presence of wireless access points (802.11), and detect and identify all
authorized and unauthorized wireless access points on a quarterly basis (11.1)
If your organization uses wireless networking outside the CDE network and the firewall prevents
communication with the CDE network, the wireless network is outside the PCI DSS scope, but
the firewall configuration must meet PCI DSS requirements.
If your organization uses wireless networking inside the CDE network, the wireless network is
within the PCI DSS scope. For information about wireless network requirements, see Wireless
network security on page 774.
The cardholder data environment must be protected against unauthorized access from the
Internet and from other networks in your organization. FortiGate unit firewall functionality
provides tight control over the traffic that can pass between the following network interfaces:
Internet
CDE wired LAN
CDE wireless LAN
Other internal networks
Figure 154 shows how the Customer Data Environment can be delineated in a typical network.
Point-of-sale terminals
VPN link(s) to
remote POS,
logging, etc.
Off-site
WAP
WAP
Database
Servers
Internet
The FortiGate unit has at least one network interface connected to the Internet. If your
organization uses more than one Internet service provider, there could be additional network
interfaces that function as a route to the Internet.
The FortiGate units firewall functionality is ideally suited to PCI DSS requirement 3.0, Restrict
inbound and outbound traffic to that which is necessary for the cardholder data environment.
Security policies control the source, destination, and type of traffic passing between networks.
The PCI DSS standard includes requirements to document your network topology and
configuration. As part of that requirement, and to assist the auditing of your network, make use
of the Comment field available in FortiGate security policies. Describe the purpose of each
policy.
The Interface settings depend on network topology. The Address settings define the IP
addresses to which the policy applies. These should be as narrow as possible, so that only the
appropriate hosts are included. For example, if the destination is a server with a single IP
address, the named Destination Address should be defined as that single address, not the
entire subnet on which the server resides.
You cannot delete this policy and you can edit the policy only to enable or disable logging of the
traffic that it handles.
Scanning for rogue access points is the minimum requirement for wireless security. Even if your
organization does not use wireless networking, PCI DSS requires you to verify periodically that
wireless networking has not been introduced into the CDE.
If you use wireless networking, the wireless network is only within the PCI DSS scope if it can
connect to the CDE.
The Fortinet FortiDB and FortiWeb products can provide security for your sensitive cardholder
data.
The Fortinet Database Security (FortiDB) device provides vulnerability assessment, database
activity monitoring, auditing and monitoring. For more information about this product, see the
Fortinet web site, www.fortinet.com.
The Fortinet FortiWeb Web Application Firewall deployed in front of public-facing web
applications protects Web applications, databases, and the information exchanged between
them. In particular, it addresses the PCI DSS requirements 6.5 and 6.6 regarding web
application vulnerabilities such as cross-site scripting, SQL injection, and information leakage.
For more information about this product, see the Fortinet web site, www.fortinet.com.
If cardholder data must be communicated over an untrusted network, such as the Internet, use
the FortiGate units IPsec VPN capability to exchange the data securely. If you support
customer on-line transactions, use HTTPS (SSL or TLS encryption) for security. The relevant
PCI DSS requirement is:
Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to
safeguard sensitive cardholder data during transmission over open, public networks. (4.1)
This does not prescribe particular cryptography, but it can be interpreted as a requirement to
follow industry best practices.
Encryption
Go to VPN > IPsec > Auto Key (IKE) to configure an IPsec VPN. In both Phase 1 and Phase 2
parts of the configuration, you select the encryption to use.
These are advanced settings, overriding defaults that are not necessarily the strongest
algorithms. VPNs negotiate over standards, so you can list multiple proposed algorithms. The
VPN will use the strongest encryption that both ends support.
Choose strong encryption. The available encryption algorithms in descending order of strength
are AES256, AES192, AES128, 3DES, DES. DES encryption is the weakest with only a 64-bit
key and does not meet the 80-bit key length minimum that PCI DSS requires. NULL means no
encryption and must not be used.
The message digest (authentication) algorithms in descending order of strength are SHA512,
SHA384, SHA256, SHA1 and MD5. MD5 is particularly weak and should be avoided. NULL
means no message digest and must not be used.
Authentication
VPN peers authenticate each other before establishing a tunnel. FortiGate units support two
different authentication methods: pre-shared key and RSA signature (certificate). Certificates
provide the best security. PCI DSS does not prohibit pre-shared keys, but you should limit
access to the keys to the personnel who are responsible for the FortiGate units or other
equipment at either end of the VPN.
PCI DSS requires the use of regularly updated antivirus protection. The antivirus functionality of
the FortiGate unit protects both the FortiGate unit and the networks it manages. Workstations
on these networks can be protected using FortiClient Endpoint Security. Both FortiGate and
FortiClient antivirus protection can receive updates from Fortinets FortiGuard service.
Workstations can also use third-party antivirus applications with update services.
The FortiGate unit can enforce the use of antivirus software, denying unprotected workstations
access to the network.
There are several tools that can assist you in monitoring your network for vulnerabilities and
provide evidence to the PCI DSS auditor of such monitoring.
FortiGate logs
FortiGate units can be configured to send logs to FortiAnalyzer unit. In a larger network, this
enables you to collect log information in a central location from several FortiGate units.
In addition to security policies and authentication governing access to the CDE, you can deploy
the Fortinet Database Security (FortiDB) device, which provides vulnerability assessment,
database activity monitoring, auditing and monitoring. For more information about this product,
see the Fortinet web site, www.fortinet.com.
PCI DSS requires each user to be uniquely identified and authenticated. On the FortiGate unit,
this applies to administrators and to users of SSL VPN and IPsec VPNs.
Minimum Length 8 or more. (Field does not accept a value less than 8.)
Note that the FortiGate password policy does not apply to user passwords. Both password
complexity and password expiry for users would need to addressed by making them a policy in
your organization.
Page 783
Introduction to wireless networking
This chapter introduces some concepts you should understand before working with wireless
networks, describes Fortinets wireless equipment, and then describes the factors you need to
consider in planning deployment of a wireless network.
The following topics are included in this section:
Wireless concepts
Security
Authentication
Wireless networking equipment
Deployment considerations
Automatic Radio Resource Provisioning
Wireless concepts
Wireless networking is radio technology, subject to the same characteristics and limitations as
the familiar audio and video radio communications. Various techniques are used to modulate
the radio signal with a data stream.
Power
Wireless LANs operate on frequencies that require no license but are limited by regulations to
low power. As with other unlicensed radio operations, the regulations provide no protection
against interference from other users who are in compliance with the regulations.
Page 784
Power is often quoted in dBm. This is the power level in decibels compared to one milliwatt.
0dBm is one milliwatt, 10dBm is 10 milliwatts, 27dBm, the maximum power on Fortinet FortiAP
equipment, is 500 milliwatts. The FortiGate unit limits the actual power available to the
maximum permitted in your region as selected by the WiFi controller country setting.
Received signal strength is almost always quoted in dBm because the received power is very
small. The numbers are negative because they are less than the one milliwatt reference. A
received signal strength of -60dBm is one millionth of a milliwatt or one nanowatt.
Antennas
Transmitted signal strength is a function of transmitter power and antenna gain. Directional
antennas concentrate the signal in one direction, providing a stronger signal in that direction
than would an omnidirectional antenna.
FortiWiFi units have detachable antennas. However, these units receive regulatory approvals
based on the supplied antenna. Changing the antenna might cause your unit to violate radio
regulations.
Security
There are several security issues to consider when setting up a wireless network.
Encryption
Wireless networking supports the following security modes for protecting wireless
communication, listed in order of increasing security.
None Open system. Any wireless user can connect to the wireless network.
WEP64 64-bit Web Equivalent Privacy (WEP). This encryption requires a key containing 10
hexadecimal digits.
WEP128 128-bit WEP. This encryption requires a key containing 26 hexadecimal digits.
WPA 256-bit Wi-Fi Protected Access (WPA) security. This encryption can use either the TKIP
or AES encryption algorithm and requires a key of either 64 hexadecimal digits or a text phrase
of 8 to 63 characters. It is also possible to use a RADIUS server to store a separate key for each
user.
WPA2 WPA with security improvements fully meeting the requirements of the IEEE 802.11i
standard. Configuration requirements are the same as for WPA.
For best security use the WPA2 with AES encryption and a RADIUS server to verify individual
credentials for each user. WEP, while better than no security at all, is an older algorithm that is
easily compromised. With either WEP or WAP, changing encryption passphrases on a regular
basis further enhances security.
Fortinet Technologies Inc. Page 785 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
Separate access for employees and guests
Wireless access for guests or customers should be separate from wireless access for your
employees. This does not require additional hardware. Both FortiWiFi units and FortiAP units
support multiple wireless LANs on the same access point. Each of the two networks can have
its own SSID, security settings, firewall policies, and user authentication.
A good practice is to broadcast the SSID for the guest network to make it easily visible to users,
but not to broadcast the SSID for the employee network.
Two separate wireless networks are possible because multiple virtual APs can be associated
with an AP profile. The same physical APs can provide two or more virtual WLANs.
Captive portal
As part of authenticating your users, you might want them to view a web page containing your
acceptable use policy or other information. This is called a captive portal. No matter what URL
the user initially requested, the portal page is returned. Only after authenticating and agreeing to
usage terms can the user access other web resources.
For information about setting up a captive portal, see Captive Portal security on page 803.
Power
Reducing power reduces unwanted coverage and potential interference to other WLANs. Areas
of unwanted coverage are a potential security risk. There are people who look for wireless
networks and attempt to access them. If your office WLAN is receivable out on the public street,
you have created an opportunity for this sort of activity.
Rogue suppression is available only when there is a radio dedicated to scanning. It will not
function during background scanning.
Fortinet Technologies Inc. Page 786 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
Wireless Intrusion Detection (WIDS)
You can create a WIDS profile to enable several types of intrusion detection:
Unauthorized Device Detection
Rogue/Interfering AP Detection
Ad-hoc Network Detection and Containment
Wireless Bridge Detection
Misconfigured AP Detection
Weak WEP Detection
Multi Tenancy Protection
MAC OUI Checking
Authentication
Wireless networks usually require authenticated access. FortiOS authentication methods apply
to wireless networks the same as they do to wired networks because authentication is applied
in the firewall policy.
The types of authentication that you might consider include:
user accounts stored on the FortiGate unit
user accounts managed and verified on an external RADIUS, LDAP or TACACS+ server
Windows Active Directory authentication, in which users logged on to a Windows network
are transparently authenticated to use the wireless network.
This Wireless chapter of the FortiOS Handbook will provide some information about each type
of authentication, but more detailed information is available in the Authentication chapter.
What all of these types of authentication have in common is the use of user groups to specify
who is authorized. For each wireless LAN, you will create a user group and add to it the users
who can use the WLAN. In the identity-based firewall policies that you create for your wireless
LAN, you will specify this user group.
Some access points, including FortiWiFi units, support MAC address filtering. You should not
rely on this alone for authentication. MAC addresses can be sniffed from wireless traffic and
used to impersonate legitimate clients.
FortiWiFi units
A FortiWiFi unit can:
Provide an access point for clients with wireless network cards. This is called Access Point
mode, which is the default mode.
Fortinet Technologies Inc. Page 787 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
or
Connect the FortiWiFi unit to another wireless network. This is called Client mode. A
FortiWiFi unit operating in client mode can only have one wireless interface.
or
Monitor access points within radio range. This is called Monitoring mode. You can designate
the detected access points as Accepted or Rogue for tracking purposes. No access point or
client operation is possible in this mode. But, you can enable monitoring as a background
activity while the unit is in Access Point mode.
FortiWiFi unit capabilities differ by model as follows:
FortiAP units
FortiAP series wireless access points are controlled by a FortiGate unit over Ethernet.
Capabilities differ by model as follows:
220A 802.11 b/g/n 2.4GHz 802.11 a/n 5GHz 14 for AP, 2 for monitoring
(indoor)
Fortinet Technologies Inc. Page 788 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
Table 41: FortiAP model capabilities
220B 802.11 b/g/n 2.4GHz 802.11 b/g/n 2.4GHz 14 for AP, 2 for monitoring
(indoor) 802.11 a/n 5GHz
222B 802.11 b/g/n 2.4GHz 802.11 a/n 5GHz 14 for AP, 2 for monitoring
(outdoor)
Deployment considerations
Deployment methodology
1. Evaluate the coverage area environment.
2. Position access point(s).
3. Select access point hardware.
4. Install and configure the equipment.
5. Test and tune the network.
Fortinet Technologies Inc. Page 789 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
The most important conclusion from these considerations is whether more than one WAP is
required.
Stairs Elevator
Washrooms
This sample office has washrooms, a stairwell and an elevator shaft in the center of the building,
making it impossible to use a single access point effectively. The elevator shaft and multiple
metal stalls in the washrooms can cause signal degradation. However, placing access points in
diagonally opposite areas of the office provides maximum coverage.
When using multiple access points, set each access point to a different channel to avoid
interference in areas where signals from both access points can be received.
Fortinet Technologies Inc. Page 790 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
For a multiple WAP deployment you need a FortiGate unit as a WiFi controller and multiple
FortiAP units. A FortiWiFi unit can be used as a managed WAP, but it is more expensive.
The FortiAP unit offers more flexible placement. FortiWiFi units either sit on a shelf or are rack
mounted. FortiAP units can be attached to any wall or ceiling, enabling you to locate them
where they will provide the best coverage.
Fast Roaming
Users in a multi-AP network, especially with mobile devices, can move from one AP coverage
area to another. But, the process of re-authentication can often take seconds to complete and
this can impair wireless voice traffic and time sensitive applications. The FortiAP fast roaming
feature solves this problem and is available only when moving between FortiAP units managed
by the same FortiGate unit.
Fast roaming uses two standards-based techniques:
Pairwise Master Key (PMK) Caching enables a RADIUS-authenticated user to roam away
from an AP and then roam back without having to re-authenticate. To accomplish this, the
FortiGate unit stores in a cache a master key negotiated with the first AP. This enables the
802.11i-specified method of fast roam-back.
Pre-authentication or fast-associate in advance enables an 802.11 AP associated to a
client to bridge to other APs over the wired network and pre-authenticate the client to the
next AP to which the client might roam. This enables the PMK to be derived in advance of
a roam and cached. When the client does roam, it will already have negotiated
authentication in advance and will use its cached PMK to quickly associate to the next AP.
This capability will ensure that wireless clients that support Pre-authentication to continue
the data transfer without noticeable connection issues.
Fortinet Technologies Inc. Page 791 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
Automatic Radio Resource Provisioning
To prevent interference between APs, the FortiOS WiFi Controller includes the Automatic Radio
Resource Provisioning (ARRP) feature. When enabled in an access point profile, Radio
Resource Provision measures utilization and interference on the available channels and selects
the clearest channel at each access point. The measurement can be repeated periodically to
respond to changing conditions.
Fortinet Technologies Inc. Page 792 FortiOS Handbook v5.0 MR0 Deploying Wireless Networks for
Configuring a WiFi LAN
When working with a FortiGate WiFi controller, you can configure your wireless network before
you install any access points. If you are working with a standalone FortiWiFi unit, the access
point hardware is already present but the configuration is quite similar. Both are covered in this
section.
The following topics are included in this section:
Overview of WiFi controller configuration
Setting your geographic location
Creating a custom AP Profile
Defining a wireless network interface (SSID)
Dynamic VLAN assignment
Configuring user authentication
Configuring firewall policies for the SSID
Customizing captive portal pages
Configuring the built-in access point on a FortiWiFi unit
On FortiGate model 30D, web-based manager configuration of the WiFi controller is disabled
by default. To enable it, enter the following CLI commands:
config system global
set gui-wireless-controller enable
end
The FortiGate WiFi controller configuration is composed of three types of object, the SSID, the
AP Profile and the physical Access Point.
An SSID defines a virtual wireless network interface, including security settings. One SSID is
sufficient for a wireless network, regardless how many physical access points are provided.
You might, however, want to create multiple SSIDs to provide different services or privileges
to different groups of users. Each SSID has separate firewall policies and authentication.
Each radio in an access point can support up to 8 SSIDs.
A more common use of the term SSID is for the identifier that clients must use to connect to
the wireless network. Each SSID (wireless interface) that you configure will have an SSID
field for this identifier. In Managed Access Point configurations you choose wireless
networks by SSID values. In firewall policies you choose wireless interfaces by their SSID
name.
An AP Profile defines the radio settings, such as band (802.11g for example) and channel
selection. The AP Profile names the SSIDs to which it applies. Managed APs can use
automatic profile settings or you can create custom AP profiles.
Managed Access Points represent local wireless APs on FortiWiFi units and FortiAP units
that the FortiGate unit has discovered. There is one managed access point definition for
each AP device. An access point definition can use automatic AP profile settings or select a
custom AP Profile. When automatic profile settings are used, the managed AP definition also
selects the SSIDs to be carried on the AP.
Page 793
Figure 156:Conceptual view of FortiGate WiFi controller configuration
Physical AP
AP 1 AP 2 AP 3 AP 4
units
You can select which SSIDs (wireless networks) will be available through the access point and
adjust the wireless power level of the AP. Also, you can configure the units LAN ports, if you are
using a FortiAP model that has them (see LAN port options on page 823).
Fortinet Technologies Inc. Page 794 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Process to create a wireless network
To set up your wireless network, you will need to perform the following steps.
Make sure the FortiGate wireless controller is configured for your geographic location. This
ensures that the available radio channels and radio power are in compliance with the
regulations in your region.
Optionally, if you dont want to use automatic AP profile settings, configure a custom Access
Point (AP) profile, specifying the radio settings and the SSIDs to which they apply.
Configure one or more SSIDs for your wireless network. The SSID configuration includes
DHCP and DNS settings.
Configure the user group and users for authentication on the WLAN.
Configure the firewall policy for the WLAN.
Optionally, customize the captive portal.
Configure access points.
Configuration of the built-in AP on FortiWiFi units is described in this chapter. Connection
and configuration of FortiAP units is described in the next chapter, Access point
deployment.
The maximum allowed transmitter power and permitted radio channels for Wi-Fi networks
depend on the region in which the network is located. By default, the WiFi controller is
configured for the United States. If you are located in any other region, you need to set your
location before you begin configuring wireless networks.
Before changing the country setting, you must remove all Custom AP profiles. To do this, go to
WiFi Controller > WiFi Network > Custom AP Profile.
Fortinet Technologies Inc. Page 795 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Creating a custom AP Profile
If the automatic AP profile settings dont meet your needs, you can define a custom AP Profile.
For information about the automatic profile settings, see About automatic AP profile settings
on page 794.
An AP Profile configures radio settings and selects the Virtual APs to which the settings apply.
FortiAP units contain two radio transceivers, making it possible, for example, to provide both
2.4GHz 802.11b/g/n and 5GHz 802.11a/n service from the same access point.
FortiAP units also provide a monitoring function for the Rogue AP feature.
Background Scan Select to enable a background scan, which monitors other APs. This
is needed for the Rogue AP feature. By default, background scan is
disabled. See Wireless network monitoring on page 846.
WIDS Profile Optionally, select a Wireless Intrusion Detection (WIDS) profile. See
Wireless IDS on page 843.
Radio Resource Select to enable the radio resource provision feature. This feature
Provision measures utilization and interference on the available channels and
selects the clearest channel at each access point. The measurement
can be repeated periodically to respond to changing conditions.
Fortinet Technologies Inc. Page 796 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Band Select the wireless protocols that you want to support. The available
choices depend on the radios capabilities. Where multiple protocols
are supported, the letter suffixes are combined: 802.11bg means
802.11b and 802.11g. For 802.11n, 802.11n_2.4G indicates 2.4GHz,
802.11n_5G indicates 5GHz.
Note that on two-radio units such as the FortiAP-220B it is not
possible to put both radios on the same band.
20/40 Mhz Channel Select to enable 20/40 MHz channel width for 802.11n-5G.
Width
Short Guard Select to enable the short guard interval for 802.11n_5G with 20/40
Interval MHz channel width.
SSID Choose the SSIDs (WiFi networks) that APs using this profile will
carry.
Select the required SSIDs in the Available list and use the -> arrow to
move them to the Selected list. To remove an SSID from the Selected
list, select the SSID and then use the <- arrow to move it back to the
Available list.
Radio 1 settings are the same as Radio 2 settings except for the options for Channel.
Radio 2 settings are available only for FortiAP models with dual radios.
5. Select OK.
Fortinet Technologies Inc. Page 797 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Defining a wireless network interface (SSID)
You begin configuring your wireless network by defining one or more SSIDs to which your users
will connect. When you create an SSID, a virtual network interface is also created with the Name
you specified in the SSID configuration. You can configure the settings of an existing SSID in
either WiFi Controller > WiFi Network > SSID or System > Network > Interface.
To create a new SSID
1. Go to WiFi Controller > WiFi Network > SSID and select Create New.
2. Fill in the SSID fields as described below.
SSID fields
IPv6 Address Enter the IPv6 address. This is available only when IPv6 has
been enabled on the unit.
IPv6 Administrative Access If you have IPv6 addresses, select the permitted IPv6
administrative access types for this SSID.
DHCP Server Select to enable a DHCP server and define IP address ranges
to assign to clients or to relay DHCP requests to another
server.
If the unit is in transparent mode, the DHCP server settings
will be unavailable.
For more information, see Configuring DHCP for WiFi
clients on page 801.
Fortinet Technologies Inc. Page 798 FortiOS Handbook - Deploying Wireless Networks for FortiOS
WiFi Settings
Security Mode Select the security mode for the wireless interface. Wireless
users must use the same security mode to be able to
connect to this wireless interface. Additional security mode
options are available in the CLI. For more information, see
Configuring security on page 801.
Customize Portal Messages Available only when Security Mode is Captive Portal. Select
to customize the endpoint replacement messages. When you
select Edit, the Edit Message window appears. Within the
window, you can modify each one of the endpoint
replacement messages.
User Groups Available only when Security Mode is Captive Portal. Select
the user groups that can authenticate.
To select a user group, select the group in Available and then
use the -> arrow to move that group to Selected. To remove a
user group from Selected, select the group and then use the
<- arrow to move the group back to Available.
Block Intra-SSID Traffic Select to enable the unit to block intra-SSID traffic.
Allow New WiFi Client This option is available for local bridge SSIDs with
Connections When Controller WPA-Personal security. See Continued FortiAP operation
Is Down when WiFi controller connection is down on page 841.
Fortinet Technologies Inc. Page 799 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Maximum Clients Select to limit the number of clients permitted to connect
simultaneously. Enter the limit value.
Device Management Select Detect and Identify Devices if you want to monitor the
device types using this interface or create device identity
policies involving this interface. See Managing bring your
own device on page 1996.
Optionally, enable Add New Devices to Vulnerability Scan
List.
Enable Explicit Web Proxy Select to enable explicit web proxy for the SSID.
Listen for RADIUS Accounting This is required to permit RADIUS SSO authentication on this
Messages WiFi inteface. See SSO using RADIUS accounting records
on page 602.
By default, the AP will broadcast its SSID. Optionally, you can disable SSID Broadcast in the
CLI:
config wireless controller vap
edit vap_name
set broadcast-ssid disable
end
For more information, see Whether to broadcast SSID on page 785.
Each Virtual AP that you create is a wireless interface that establishes a wireless LAN. Go to
System > Network > Interfaces to configure its IP address.
Fortinet Technologies Inc. Page 800 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuring DHCP for WiFi clients
Wireless clients need to have IP addresses. If you use RADIUS authentication, each users IP
address can be stored in the Framed-IP-Address attribute. Otherwise, you need to configure a
DHCP server on the WLAN interface to assign IP addresses to wireless clients.
You cannot delete an SSID (wireless interface) that has DHCP enabled on it.
Configuring security
Using the web-based manager, you can configure Open Portal security or Wi-Fi Protected
Access (WPA) security modes WPA-Personal and WPA-Enterprise. The WPA options support
both WPA and WPA2, which has additional security improvements. Using the CLI, you can also
choose WPA-only and WPA2-only modes.
Fortinet Technologies Inc. Page 801 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Using the CLI, you can also choose Wireless Equivalent Privacy (WEP) modes. WEP modes are
much less secure and are provided for legacy support only. Wherever possible, use WPA
security.
WPA security with a preshared key for authentication is called WPA-Personal. This can work
well for one person a small group of trusted people. But, as the number of users increases, it is
difficult to distribute new keys securely and there is increased risk that the key could fall into the
wrong hands.
A more secure form of WPA security is WPA-Enterprise. Users each have their own
authentication credentials, verified through an authentication server, usually RADIUS. FortiOS
can also authenticate WPA-Enterprise users through its built-in user group functionality.
FortiGate user groups can include RADIUS servers and can select users by RADIUS user group.
This makes possible Role-Based Access Control (RBAC).
WPA security can encrypt communication with either Temporal Key Integrity Protocol (TKIP) or
Advanced Encryption Standard (AES). AES is the preferred encryption, but some older wireless
clients do not support it. You can select the encryption during setup.
Captive Portal security connects users to an open web portal defined in replacement
messages. To navigate to any location beyond the web portal, the user must pass FortiGate
user authentication.
WPA-Personal security
WPA-Personal security setup requires only the preshared key that you will provide to your
clients.
WPA-Enterprise security
If you will use FortiOS user groups for authentication, go to User & Device > User > User Group
and create those groups first. The groups should be Firewall groups.
If you will use a RADIUS server to authenticate wireless clients, you must first configure the
FortiGate unit to access the RADIUS server.
Fortinet Technologies Inc. Page 802 FortiOS Handbook - Deploying Wireless Networks for FortiOS
4. In Primary Server Secret, enter the shared secret used to access the server.
5. Optionally, enter the information for a secondary or backup RADIUS server.
6. Select OK.
Fortinet Technologies Inc. Page 803 FortiOS Handbook - Deploying Wireless Networks for FortiOS
These pages are defined in replacement messages. Defaults are provided. In the web-based
manager, you can modify the default messages in the SSID configuration by selecting
Customize Portal Messages. Each SSID can have its own unique portal content.
Fortinet Technologies Inc. Page 804 FortiOS Handbook - Deploying Wireless Networks for FortiOS
2. Find the entry where interface is your WiFi interface. Edit that entry and configure the
MAC filter. In this example, the MAC address 11:11:11:11:11:11will be excluded. Unlisted
MAC addresses will be assigned an IP address automatically.
edit 3
config reserved-address
edit 1
set action block
set mac 11:11:11:11:11:11
end
set mac-acl-default-action assign
end
Multicast enhancement
FortiOS can translate multicast traffic into unicast traffic to send to clients, maintaining its own
multicast client through IGMP snooping. You can configure this in the CLI:
config wireless-controller vap
edit example_wlan
set multicast-enhance enable
set me-disable-thresh 32
end
If the number of clients on the SSID is larger than me-disable-thresh, multicast
enhancement is disabled.
You can assign each individual user to a VLAN based on information stored in the RADIUS
authentication server. If the users RADIUS record does not specify a VLAN ID, the user is
assigned to the default VLAN for the SSID.
TheRADIUSuserattributesusedfortheVLANIDassignmentare:
IETF64(TunnelType)SetthistoVLAN.
IETF65(TunnelMediumType)Setthisto802
IETF81(TunnelPrivateGroupID)Setthisto theVLANID.
To configure dynamic VLAN assignment, you need to:
1. Configure access to the RADIUS server.
2. Create the SSID and enable dynamic VLAN assignment.
3. Create a custom AP profile and add the local bridge mode SSID to it.
4. Create the VLAN interfaces and their DHCP servers.
5. Create security policies to allow communication from the VLAN interfaces to the Internet.
6. Authorize the FortiAP unit and assign the custom profile to it.
Fortinet Technologies Inc. Page 805 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To create the dynamic VLAN SSID
1. GotoWiFiController>WiFiNetwork>SSID,select Create New and enter:
Authentication RADIUS Server. Select the RADIUS server that you configured.
2. Select OK.
3. Enable dynamic VLAN in the CLI. Optionally, you can also assign a VLAN ID to set the
default VLAN for users without a VLAN assignment.
config wireless-controller vap
edit dynamic_vlan_ssid
set dynamic-vlan enable
set vlanid 10
end
Platform The FortiAP model you are using. If you use more than one model of
FortiAP, you will need a custom AP profile for each model.
SSID In the Available column, select the SSID you created (example
dynamic_vlan_ssid) and move it to the Selected column. There
should be no other SSIDs in the Selected column.
Addressing mode Select Manual and enter the IP address / Network Mask for the
virtual interface.
DHCP Server Enable and then select Create New to create an address range.
Fortinet Technologies Inc. Page 806 FortiOS Handbook - Deploying Wireless Networks for FortiOS
3. Select OK.
4. Repeat the preceding steps to create other VLANs as needed.
Security policies determine which VLANs can communicate with which other interfaces. These
are the simple Firewall Address policy without authentication. Users are assigned to the
appropriate VLAN when they authenticate.
You can perform user authentication when the wireless client joins the wireless network and
when the wireless user communicates with another network through a firewall policy. WEP and
WPA-Personal security rely on legitimate users knowing the correct key or passphrase for the
wireless network. The more users you have, the more likely it is that the key or passphrase will
become known to unauthorized people. WPA-Enterprise and captive portal security provide
separate credentials for each user. User accounts can be managed through FortiGate user
groups or an external RADIUS authentication server.
WPA-Enterprise authentication
If your WiFi network uses WPA-Enterprise authentication verified by a RADIUS server, you need
to configure the FortiGate unit to connect to that RADIUS server.
Fortinet Technologies Inc. Page 807 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To use the RADIUS server for authentication, you can create individual FortiGate user accounts
that specify the authentication server instead of a password, and you then add those accounts
to a user group. Or, you can add the authentication server to a FortiGate user group, making all
accounts on that server members of the user group.
MAC-based authentication
Wireless clients can also be supplementally authenticated by MAC address. A RADIUS server
stores the allowed MAC address for each client and the wireless controller checks the MAC
address independently of other authentication methods.
MAC-based authentication must be configured in the CLI. In the following example,
MAC-based authentication is added to an existing access point vap1 to use a RADIUS server
at 192.168.1.95:
config wireless-controller vap
edit vap1
set radius-mac-auth enable
set radius-mac-auth-server 192.168.1.95
end
Fortinet Technologies Inc. Page 808 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuring firewall policies for the SSID
For users on the WiFi LAN to communicate with other networks, firewall policies are required.
Before you create firewall policies, you need to define any firewall addresses you will need. This
section describes creating a WiFi network to Internet policy.
Fortinet Technologies Inc. Page 809 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To create a firewall policy - CLI
config firewall policy
edit 0
set srcintf "example_wifi"
set dstintf "port1"
set srcaddr "wifi_net"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
set nat enable
end
Fortinet Technologies Inc. Page 810 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Customizing captive portal pages
If you select Captive Portal authentication in the SSID, the wireless controller presents the user
pages defined in Captive Portal Default replacement pages.
The captive portal contains the following web pages:
Captive Portal Login pagerequests user credentials
Captive Portal Login Failed pagereports that the entered credentials were incorrect and
enables the user to try again.
Captive Portal Disclaimer pageis statement of the legal responsibilities of the user and
the host organization to which the user must agree before proceeding.
Captive Portal Rejected pageis displayed if the user does not agree to the statement on
the Disclaimer page. Access is denied until the user agrees to the disclaimer.
These pages are defined in replacement messages. Defaults are provided. In the web-based
manager, you can modify the default messages in the SSID configuration by selecting
Customize Portal Messages. Each SSID can have its own unique portal content.
Fortinet Technologies Inc. Page 811 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To specify the new logo in the replacement message
1. Go to WiFi Controller > WiFi Network > SSID and edit your SSID.
The SSID Security Mode must be Captive Portal.
2. Make sure that Customize Portal Messages is selected and then select the adjacent Edit
icon.
3. In the Edit Message window, select the Login page message.
4. In the Message HTML, find the %%IMAGE tag.
By default it specifies the Fortinet logo:%%IMAGE:logo_fw_auth%%
5. Change the image name to the one you provided for your logo.
The tag should now read, for example, %%IMAGE:mylogo%%
6. Select OK.
Modifying text
You can change any text that is not part of the HTML code nor a special tag enclosed in double
percent (%) characters. There are two exceptions to this rule:
The line Please enter your username and password to continue is provided by the
%%QUESTION%% tag. You can replace this tag with text of your choice.
The line SSID ... Authentication Required includes the name of the SSID, provided by the
%%CPAUTH_SSID%% tag. You can remove or change the position of this tag.
Except for these items, you should not remove any tags because they may carry information
that the FortiGate unit needs.
Fortinet Technologies Inc. Page 812 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Figure 158:Default login failed page
Both FortiGate and FortiWiFi units have the WiFi controller feature. If you configure a WiFi
network on a FortiWiFi unit, you can also use the built-in wireless capabilities in your WiFi
network as one of the access points.
If Virtual Domains are enabled, you must select the VDOM to which the built-in access point
belongs. You do this in the CLI. For example:
config wireless-controller global
set local-radio-vdom vdom1
end
Fortinet Technologies Inc. Page 813 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Access point deployment
This chapter describes how to configure access points for your wireless network. The following
topics are included in this section:
Overview
Network topology for managed APs
Discovering and authorizing APs
Advanced WiFi controller discovery
Wireless client load balancing for high-density deployments
LAN port options
Preventing IP fragmentation of packets in CAPWAP tunnels
Overview
FortiAP units discover WiFi controllers. The administrator of the WiFi controller authorizes the
FortiAP units that the controller will manage.
In most cases, FortiAP units can find WiFi controllers through the wired Ethernet without any
special configuration. Review the following section, Network topology for managed APs, to
make sure that your method of connecting the FortiAP unit to the WiFi controller is valid. Then,
you are ready to follow the procedures in Discovering and authorizing APs on page 815.
If your FortiAP units are unable to find the WiFi controller, refer to Advanced WiFi controller
discovery on page 820 for detailed information about the FortiAP units controller discovery
methods and how you can configure them.
The FortiAP unit can be connected to the FortiGate unit in any of the following ways:
Direct connection: The FortiAP unit is directly connected to the FortiGate unit with no switches
between them. This configuration is common for locations where the number of FortiAPs
matches up with the number of internal ports available on the FortiGate. In this configuration
the FortiAP unit requests an IP address from the FortiGate unit, enters discovery mode and
should quickly find the FortiGate WiFi controller. This is also known as a wirecloset deployment.
See Figure 159, below.
Switched Connection: The FortiAP unit is connected to the FortiGate WiFi controller by an
Ethernet switch operating in L2 switching mode or L3 routing mode. There must be a routable
path between the FortiAP unit and the FortiGate unit and ports 5246 and 5247 must be open.
This is also known as a gateway deployment. See Figure 159, below
Connection over WAN: The FortiGate WiFi controller is off-premises and connected by a VPN
tunnel to a local FortiGate. In this method of connectivity its best to configure each FortiAP with
the static IP address of the WiFi controller. Each FortiAP can be configured with three WiFi
controller IP addresses for redundant failover. This is also known as a datacenter remote
management deployment. See Figure 160, below.
Page 814
Figure 159:Wirecloset and Gateway deployments
After you prepare your FortiGate unit, you can connect your APs to discover them using the
discovery methods described earlier. To prepare the FortiGate unit, you need to
Configure the network interface to which the AP will connect.
Configure DHCP service on the interface to which the AP will connect.
Optionally, preauthorize FortiAP units. They will begin to function when connected.
Connect the AP units and let the FortiGate unit discover them.
Enable each discovered AP and configure it or assign it to an AP profile.
Fortinet Technologies Inc. Page 815 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuring the network interface for the AP unit
The interface to which you connect your wireless access point needs an IP address. No
administrative access, DNS Query service or authentication should be enabled.
Fortinet Technologies Inc. Page 816 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Enabling and configuring a discovered AP
Within two minutes of connecting the AP unit to the FortiGate unit, the discovered unit should
be listed on WiFi Controller > Managed Access Points > Managed FortiAP page.
Enable WiFi Radio This must be selected to enable operation of this AP.
Auto TX Power Control If you enable automatic transmitter power control, adjust
TX Power Low and TX Power High to set the power range.
6. If you want to use a custom AP profile, in AP Profile select Change, choose the AP Profile.
Select Apply.
7. Optionally, select Do not participate in Rogue AP scanning if scanning adversely affects
traffic.
8. Select OK.
The physical access point is now added to the system. If the rest of the configuration is
complete, it should be possible to connect to the wireless network through the AP.
Fortinet Technologies Inc. Page 817 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Add a discovered unit and associate it with AP-profile1, for example:
config wireless-controller wtp
edit FAP22A3U10600118
set admin enable
set wtp-profile AP-profile1
end
To use the automatic profile, leave the wtp-profile field unset.
Fortinet Technologies Inc. Page 818 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Checking and updating FortiAP unit firmware
You can view and update the FortiAP units firmware from the FortiGate unit that acts as its WiFi
controller.
Fortinet Technologies Inc. Page 819 FortiOS Handbook - Deploying Wireless Networks for FortiOS
6. Enter the following command.
For example, the FortiAP image file name is FAP_22A_v4.3.0_b0212_fortinet.out.
restore FAP_22A_v4.3.0_b0212_fortinet.out 192.168.1.3
A FortiAP unit can use any of four methods to locate a controller. By default, FortiAP units cycle
through all four of the discovery methods. In most cases there is no need to make configuration
changes on the FortiAP unit.
There are exceptions. The following section describes the WiFi controller discovery methods in
more detail and provides information about configuration changes you might need to make so
that discovery will work.
Static IP configuration
If FortiAP and the controller are not in the same subnet, broadcast and multicast packets
cannot reach the controller. The admin can specify the controllers static IP on the AP unit. The
AP unit sends a discovery request message in unicast to the controller. Routing must be
properly configured in both directions.
Broadcast request
The AP unit broadcasts a discovery request message to the network and the controller replies.
The AP and the controller must be in the same broadcast domain. No configuration adjustments
are required.
Multicast request
The AP unit sends a multicast discovery request and the controller replies with a unicast
discovery response message. The AP and the controller do not need to be in the same
broadcast domain if multicast routing is properly configured.
The default multicast destination address is 224.0.1.140. It can be changed through the CLI.
The address must be same on the controller and AP. For information about connecting to the
FortiAP CLI, see Connecting to the FortiAP CLI on page 821.
Fortinet Technologies Inc. Page 820 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To change the multicast address on the controller
config wireless-controller global
set discovery-mc-addr 224.0.1.250
end
DHCP
If you use DHCP to assign an IP address to your FortiAP unit, you can also provide the WiFi
controller IP address at the same time. This is useful if the AP is located remotely from the WiFi
controller and other discovery techniques will not work.
When you configure the DHCP server, configure Option 138 to specify the WiFi controller IP
address. You need to convert the address into hexadecimal. Convert each octet value
separately from left to right and concatenate them. For example, 192.168.0.1 converts to
C0A80001.
If Option 138 is used for some other purpose on your network, you can use a different option
number if you configure the AP units to match.
Fortinet Technologies Inc. Page 821 FortiOS Handbook - Deploying Wireless Networks for FortiOS
8. Unplug the FortiAP and then plug it back in, in order for the configuration to take effect.
When a WiFi controller has taken control of the FortiAP unit, Telnet access to the FortiAP units
CLI is no longer available.
Wireless load balancing allows your wireless network to distribute wireless traffic more
efficiently among wireless access points and available frequency bands. FortiGate wireless
controllers support the following types of client load balancing:
Access Point Hand-off - the wireless controller signals a client to switch to another access
point.
Frequency Hand-off - the wireless controller monitors the usage of 2.4GHz and 5GHz bands,
and signals clients to switch to the lesser-used frequency.
Load balancing is not applied to roaming clients.
Fortinet Technologies Inc. Page 822 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuration
From the web-based manager edit a custom AP profile and select Frequency Handoff and AP
Handoff as required for each radio on the AP.
From the CLI, you configure wireless client load balancing thresholds for each custom AP
profile. Enable access point hand-off and frequency hand-off separately for each radio in the
custom AP profile.
config wireless-controller wtp-profile
edit new-ap-profile
set handoff-rssi <rssi_int>
set handoff-sta-thresh <clients_int>
config radio-1
set frequency-handoff {disable | enable}
set ap-handoff {disable | enable}
end
config radio-2
set frequency-handoff {disable | enable}
set ap-handoff {disable | enable}
end
end
Where:
handoff-rssi is the RSSI threshold. Clients with a 5 GHz RSSI threshold over this value
are load balanced to the 5GHz frequency band. Default is 25. Range is 20 to 30.
handoff-sta-thresh is the access point handoff threshold. If the access point has more
clients than this threshold it is considered busy and clients are changed to another access
point. Default is 30, range is 5 to 25.
frequency-handoff enable or disable frequency handoff load balancing for this radio.
Disabled by default.
ap-handoff enable or disable access point handoff load balancing for this radio. Disabled
by default.
Frequency handoff must be enabled on the 5GHz radio to learn client capability.
Some FortiAP models have one or more ethernet interfaces marked LAN. These ports can
provide wired network access. LAN ports are bridged to either the wired WAN interface or to
one of the WiFi SSIDs that the FortiAP unit carries.
Fortinet Technologies Inc. Page 823 FortiOS Handbook - Deploying Wireless Networks for FortiOS
In this configuration
The IP addresses for LAN clients come from the DHCP server that serves the wireless
clients.
Traffic from LAN clients is bridged to the SSIDs VLAN. Dynamic VLAN assignment for hosts
on the LAN port is not supported.
Wireless and LAN clients are on the same network and can communicate locally, via the
FortiAP.
Any host connected to the LAN port will be taken as authenticated. RADIUS MAC
authentication for hosts on the LAN port is not supported.
For configuration instructions, aee Configuring FortiAP LAN ports, below.
Fortinet Technologies Inc. Page 824 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure a FortiAP units LAN ports - CLI
In this example, a FortiAP units configuration is modified to bridge the LAN port to the office
SSID.
config wireless-controller wtp
edit FAP11C3X13000412
config lan
set port-mode bridge-to-ssid
set port-ssid office
end
end
In this example, a FortiAP-28C units configuration is modified to bridge LAN port1 to the office
SSID and to bridge the other LAN ports to the WAN port.
config wireless-controller wtp
edit FAP28C3X13000412
config lan
set port1-mode bridge-to-ssid
set port1-ssid office
set port2-mode bridge-to-wan
set port3-mode bridge-to-wan
set port4-mode bridge-to-wan
set port5-mode bridge-to-wan
set port6-mode bridge-to-wan
set port7-mode bridge-to-wan
set port8-mode bridge-to-wan
end
end
Fortinet Technologies Inc. Page 825 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure FortiAP LAN ports in a custom AP profile - CLI
In this example, the default FortiAP-11C profile is configured to bridge the LAN port to the office
SSID.
config wireless-controller wtp-profile
edit FAP11C-default
config lan
set port-mode bridge-to-ssid
set port-ssid office
end
end
end
In this example, the default FortiAP-28C profile is configured to bridge LAN port1 to the office
SSID and to bridge the other LAN ports to the WAN port.
config wireless-controller wtp-profile
edit FAP28C-default
config lan
set port1-mode bridge-to-ssid
set port1-ssid office
set port2-mode bridge-to-wan
set port3-mode bridge-to-wan
set port4-mode bridge-to-wan
set port5-mode bridge-to-wan
set port6-mode bridge-to-wan
set port7-mode bridge-to-wan
set port8-mode bridge-to-wan
end
end
Fortinet Technologies Inc. Page 826 FortiOS Handbook - Deploying Wireless Networks for FortiOS
By default, tcp-mss-adjust is enabled, icmp-unreachable is disabled, and
tun-mtu-uplink and tun-mtu-downlink are set to 0.
To set tun-mtu-uplink and tun-mtu-downlink, use the default TCP MTU value of 1500.
This default configuration prevents packet fragmentation because the FortiAP unit limits the
size of TCP packets received from wireless clients so the packets dont have to be ed before
CAPWAP encapsulation.
The tcp-mss-adjust option causes the FortiAP unit to limit the maximum segment size
(MSS) of TCP packets sent by wireless clients. The FortiAP does this by adding a reduced MSS
value to the SYN packets sent by the FortiAP unit when negotiating with a wireless client to
establish a session. This results in the wireless client sending packets that are smaller than the
tun-mtu-uplink setting, so that when the CAPWAP headers are added, the CAPWAP
packets have an MTU that matches the tun-mtu-uplink size.
The icmp-unreachable option affects all traffic (UDP and TCP) between wireless clients and
the FortiAP unit. This option causes the FortiAP unit to drop packets that have the "Don't
Fragment" bit set in their IP header and that are large enough to cause fragmentation and then
send an ICMP packet -- type 3 "ICMP Destination unreachable" with code 4 "Fragmentation
Needed and Don't Fragment was Set" back to the wireless controller. This should cause the
wireless client to send smaller TCP and UDP packets.
Fortinet Technologies Inc. Page 827 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Wireless Mesh
The access points of a WiFi network are usually connected to the WiFi controller through
Ethernet wiring. A wireless mesh eliminates the need for Ethernet wiring by connecting WiFi
access points to the controller by radio. This is useful where installation of Ethernet wiring is
impractical.
The following topics are included in this section:
Overview of Wireless Mesh
Configuring a meshed WiFi network
Configuring a point-to-point bridge
f it
Lea P un
Mesh SSID r t iA
Fo
ch
ran nit
e a f/b AP u
L ort i
F
Mesh SSID
t
roo unit
sh
Me rtiAP
Fo
FortiGate
F tiG t UUnit
it
The AP that is connected to the network by Ethernet is called the Mesh Root node. It is
configured with an SSID (also called a virtual access point or VAP) dedicated to backhaul
communication with the remote FortiAP units. The backhaul SSID carries CAPWAP discovery,
configuration, and other communications that would usually be carried on an Ethernet
connection. Regular WiFi clients cannot connect to the backhaul SSID. They connect to the
regular SSIDs carried on the access points.
The root node can be a FortiAP unit or the built-in AP of a FortiWiFi unit. APs that serve only
regular WiFi clients are called Leaf nodes. Leaf APs that also carry the mesh SSID for more
distant Leaf nodes are called Leaf/branch nodes.
Page 828
All access points in a wireless mesh configuration must have at least one of their radios
configured to provide mesh backhaul communication. As with wired APs, when mesh APs start
up they can be discovered by a FortiGate or FortiWiFi unit WiFi controller and authorized to join
the network.
The backhaul SSID delivers the best performance when it is carried on a dedicated radio. On a
two-radio FortiAP unit, for example, the 5GHz radio could carry only the backhaul SSID while
the 2.4GHz radio carries one or more SSIDs that serve users. Background WiFi scanning is
possible in this mode.
The backhaul SSID can also share the same radio with SSIDs that serve users. Performance is
reduced because the backhaul and user traffic compete for the available bandwidth.
Background WiFi scanning is not available in this mode. One advantage of this mode is that a
two-radio AP can offer WiFi coverage on both bands.
The root mesh AP is the AP unit that has a wired Ethernet connection to the WiFi controller. The
AP units that are wirelessly linked to the controller over the backhaul SSID are called branch or
leaf APs.
Wireless bridging Two LAN segments are connected together over a wireless link
(the backhaul SSID). On the leaf AP, the Ethernet connection can
be used to provide a wired network. Both WiFi and wired users
on the leaf AP are connected to the LAN segment to which the
root AP is connected.
Firmware requirements
All FortiAP units that will be part of the wireless mesh network must be upgraded to FAP
firmware version 5.0 build 003. FortiAP-222B units must have their BIOS upgraded to version
400012. The FortiWiFi or FortiGate unit used as the WiFi controller must be running FortiOS 5.0.
Fortinet Technologies Inc. Page 829 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Figure 163:FortiAP units used as both mesh root AP and leaf AP
2.4Ghz
0
5
S
O
o 2.4Ghz 2.4Ghz
F
Figure 164:FortiWiFi unit as root mesh AP with FortiAP units as leaf APs
5Ghz bkg scan 2.4Ghz bkg scan
2.4Ghz
5
S
O
o 2.4Ghz
F 5Ghz
Note: only that clients and mesh can use the same
radio and can be on same band
An alternate use of the wireless mesh functionality is as a point-to-point relay. Both wired and
WiFi users on the leaf AP side are connected to the LAN segment on the root mesh side.
Fortinet Technologies Inc. Page 830 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Figure 165:Point-to-point wireless mesh
0
5 Switch
S Note: only one of the radios can be
O used for Mesh, user selectable
r External N type directional antennas
o supported
F
Wired PC
Each VDOM on the FortiGate unit contains a predefined WiFi mesh interface named wl.mesh
and a predefined SSID (which cannot be deleted) named fortinet.mesh.<vdom-name>. You can
create additional mesh SSIDs. Create the SSID with Traffic Mode set to Mesh Downlink.
You need to:
Create custom AP profiles, if you are not using the automatic AP profile.
Configure the mesh root AP, either a FortiWiFi units Local Radio or a FortiAP unit.
Configure mesh branch/leaf AP units.
Authorize the mesh branch/leaf units when they connect to the WiFi Controller.
Fortinet Technologies Inc. Page 831 FortiOS Handbook - Deploying Wireless Networks for FortiOS
5. Select Apply.
In a network with multiple wireless controllers, you need to change the mesh SSID so that each
mesh root has a unique SSID. Other controllers using the same mesh root SSID might be
detected as fake or rogue APs. Go to WiFi Controller > WiFI Network > SSID to change the
SSID.
Fortinet also recommends that you create a new preshared key instead of using the default.
AP Profile Automatic
or
In AP Profile, select Change and the select the custom AP profile you created for the
mesh root AP.
4. In State, select Authorize.
5. Select OK.
You need to create firewall policies to permit traffic to flow from the network interface where the
FortiAP unit is connected to the network interfaces for the Internet and other networks. Enable
NAT.
Fortinet Technologies Inc. Page 832 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuring the mesh branches or leaves
The FortiAP units that will serve as branch/leaf nodes must be preconfigured.
1. Connect to the FortiAP unit web-based manager on its default Ethernet interface IP address,
192.168.1.2.
2. In the Connectivity section enter:
Uplink Mesh
AP Profile Automatic
or
In AP Profile, select Change and the select the custom AP profile that you created for the
branch/leaf APs and then select [Apply].
3. Select Authorize.
4. Select OK.
Initially, the State of the FortiAP unit is Offline. Periodically select Refresh to update the
status. Within about two minutes, the state changes to Online.
Figure 166:FortiWiFi unit as root mesh with FortiAP unit as branch/leaf node
Fortinet Technologies Inc. Page 833 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Viewing the status of the mesh network
Go to WiFi Controller > Managed Access Points > Managed FortiAP to view the list of APs. The
Connected Via field shows Mesh for mesh-connected units and lists the IP address to which
they connect.
In the FortiAP CLI, you can check the main ip field in the output from the command
cw_diag -c mesh
You can create a point-to-point bridge to connect two wired network segments using a WiFi
link. The effect is the same as connecting the two network segments to the same wired switch.
You need to:
Configure a backhaul link and root mesh AP as described in Configuring a meshed WiFi
network on page 831. Note: The root mesh AP for a point-to-point bridge must be a
FortiAP unit, not the internal AP of a FortiWiFi unit.
Configure bridging on the leaf AP unit.
To configure the leaf AP unit for bridged operation - FortiAP web-based manager
1.With your browser, connect to the FortiAP unit web-based manager.
You can temporarily connect to the units Ethernet port and use its default address:
192.168.1.2.
2. Enter:
3. Select Apply.
4. Connect the local wired network to the Ethernet port on the FortiAP unit.
Users are assigned IP addresses from the DHCP server on the wired network connected to
the root mesh AP unit.
Fortinet Technologies Inc. Page 834 FortiOS Handbook - Deploying Wireless Networks for FortiOS
WiFi-Ethernet Bridge Operation
A WiFi network can be combined with a wired LAN so that WiFi and wired clients are on the
same subnet. This is a convenient configuration for users.
This configuration cannot be used in conjunction with Wireless Mesh features because it
enables the FortiAP Local Bridge option.
Page 835
To create the bridged WiFi and wired LAN configuration, you need to
Configure the SSID with the Local Bridge option so that traffic is sent directly over the
FortiAP units Ethernet interface to the FortiGate unit, instead of being tunneled to the WiFi
controller.
Configure a software switch interface on the FortiGate unit with the WiFi and Internal
network interfaces as members.
Configure Captive Portal security for the software switch interface.
Interface name A name for the new WiFi interface, homenet_if for example.
Security Mode Configure security as you would for a regular WiFi network.
Data Encryption
Preshared Key
3. Select OK.
4. Go to WiFi Controller > Managed Access Points > Managed FortiAP, select the FortiAP unit
for editing.
5. Authorize the FortiAP unit.
6. The FortiAP unit can carry regular SSIDs in addition to the Bridge SSID.
Fortinet Technologies Inc. Page 836 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure the SSID - CLI
This example creates a WiFi interface homenet_if with SSID homenet using WPA-Personal
security, passphrase Fortinet1.
config wireless-controller vap
edit "homenet_if"
set vdom "root"
set ssid "homenet"
set local-bridging enable
set security wpa-personal
set passphrase "Fortinet1"
end
config wireless-controller wtp
edit FAP22B3U11005354
set admin enable
set vaps "homenet_if"
end
Interface Members Move internal and homenet_if into the Selected Interfaces list.
Security Mode Select Captive Portal. Add the permitted User Groups.
3. Select OK.
Fortinet Technologies Inc. Page 837 FortiOS Handbook - Deploying Wireless Networks for FortiOS
VLAN configuration
If your environment uses VLAN tagging, you assign the SSID to a specific VLAN in the CLI. For
example, to assign the homenet_if interface to VLAN 100, enter:
config wireless-controller vap
edit "homenet_if"
set vlanid 100
end
Additional configuration
The configuration described above provides communication between WiFi and wired LAN users
only. To provide access to other networks, create appropriate firewall policies between the
software switch and other interfaces.
Fortinet Technologies Inc. Page 838 FortiOS Handbook - Deploying Wireless Networks for FortiOS
FortiAP local bridging (Private Cloud-Managed AP)
A FortiAP unit can provide WiFi access to a LAN, even when the wireless controller is located
remotely. This configuration is useful for the following situations:
Installations where the WiFI controller is remote and most of the traffic is local or uses the
local Internet gateway
Wireless-PCI compliance with remote WiFi controller
Telecommuting, where the FortiAP unit has the WiFi controller IP address pre-configured and
broadcasts the office SSID in the users home or hotel room. In this case, data is sent in the
wireless tunnel across the Internet to the office and you should enable encryption using
DTLS.
On the remote FortiGate wireless controller, the WiFi SSID is created with the Bridge with
FortiAP Interface option selected. In this mode, no IP addresses are configured. The FortiAP
units WiFi and Ethernet interfaces behave as a switch. WiFi client devices obtain IP addresses
from the same DHCP server as wired devices on the LAN.
Fortinet Technologies Inc. Page 839 FortiOS Handbook - Deploying Wireless Networks for FortiOS
There can be only one Bridge mode SSID per FortiAP unit.
The Local Bridge feature cannot be used in conjunction with Wireless Mesh features.
Block-Intra-SSID Traffic is not available in Bridge mode.
Security Mode Configure security as you would for a regular WiFi network.
Data Encryption
Preshared Key
3. Select OK.
4. Go to WiFi Controller > Managed Access Points > Managed FortiAP, select the FortiAP unit
for editing.
5. Authorize the FortiAP unit.
6. The FortiAP unit can carry regular SSIDs in addition to the Bridge SSID.
Fortinet Technologies Inc. Page 840 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure a FortiAP local bridge - CLI
This example creates a WiFi interface branchbridge with SSID LANbridge using
WPA-Personal security, passphrase Fortinet1.
config wireless-controller vap
edit "branchbridge"
set vdom "root"
set ssid "LANbridge"
set local-bridging enable
set security wpa-personal
set passphrase "Fortinet1"
end
config wireless-controller wtp
edit FAP22B3U11005354
set admin enable
set vaps "branchbridge"
end
Fortinet Technologies Inc. Page 841 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Using bridged FortiAPs to increase scalability
The FortiGate wireless controller can support more FortiAP units in local bridge mode than in
the normal mode. But this is only true if you configure some of your FortiAP units to operate in
remote mode, which supports only local bridge mode SSIDs.
The Managed FortAP page (WiFi Controller > Managed Devices > Managed FortiAP) shows at
the top right the current number of Managed FortiAPs and the maximum number that can be
managed, 5/64 for example. The maximum number, however, is true only if all FortiAP units
operate in remote mode. For more detailed information, consult the Maximum Values Table. For
each FortiGate model, there are two maximum values for managed FortiAP units: the total
number of FortiAPs and the number of FortiAPs that can operate in normal mode.
Fortinet Technologies Inc. Page 842 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Protecting the WiFi Network
The FortiGate unit provides WiFi-specific network protection. The following topics are included
in this section:
Wireless IDS
WiFi data channel encryption
Wireless IDS
The FortiGate Wireless Intrusion Detection System (WIDS) monitors wireless traffic for a wide
range of security threats by detecting and reporting on possible intrusion attempts. When an
attack is detected the FortiGate unit records a log message.
You can create a WIDS profile to enable the types of intrusion detection:
Asleap AttackASLEAP is a tool used to perform attacks against LEAP authentication.
Association Frame FloodingA Denial of Service attack using association requests. The
default detection threshold is 30 requests in 10 seconds.
Authentication Frame FloodingA Denial of Service attack using association requests. The
default detection threshold is 30 requests in 10 seconds.
Broadcasting De-authenticationThis is a type of Denial of Service attack. A flood of
spoofed de-authentication frames forces wireless clients to de-athenticate, then
re-authenticate with their AP.
EAPOL Packet FloodingExtensible Authentication Protocol over LAN (EAPOL) packets are
used in WPA and WPA2 authentication. Flooding the AP with these packets can be a denial
of service attack. Several types of EAPOL packets are detected: EAPOL-FAIL,
EAPOL-LOGOFF, EAPOL-Start, EAPOL-SUCC.
Invalid MAC OUISome attackers use randomly-generated MAC addresses. The first three
bytes of the MAC address are the Organizationally Unique Identifier (OUI), administered by
IEEE. Invalid OUIs are logged.
Long Duration AttackTo share radio bandwidth, WiFi devices reserve channels for brief
periods of time. Excessively long reservation periods can be used as a denial of service
attack. You can set a threshold between 1000 and 32 767 microseconds. The default is
8200.
Null SSID Probe ResponseWhen a wireless client sends out a probe request, the attacker
sends a response with a null SSID. This causes many wireless cards and devices to stop
responding.
Spoofed De-authenticationSpoofed de-authentication frames form the basis for most
denial of service attacks.
Weak WEP IV DetectionA primary means of cracking WEP keys is by capturing 802.11
frames over an extended period of time and searching for patterns of WEP initialization
vectors (IVs) that are known to be weak. WIDS detects known weak WEP IVs in on-air traffic.
Wireless BridgeWiFi frames with both the fromDS and ToDS fields set indicate a wireless
bridge. This will also detect a wireless bridge that you intentionally configured in your
network.
You can enable wireless IDS by going to WiFi Controller > WiFi Network > Custom AP Profile
and editing an access point profile. Inside the profile set WIDS Profile to the name of a wireless
IDS profile to apply wireless IDS protection to the access points that uses the profile.
Page 843
To create a WIDS Profile
1. Go to WiFi Controller > WiFi Network > WIDS Profile.
2. Select a profile to edit or select Create New.
3. Select the types of intrusion to protect against.
By default, all types are selected.
4. Select Apply.
You can also configure a WIDS profile in the CLI using the config wireless-controller
wids-profile command.
Fortinet Technologies Inc. Page 844 FortiOS Handbook - Deploying Wireless Networks for FortiOS
WiFi data channel encryption
Optionally, you can apply DTLS encryption to the data channel between the wireless controller
and FortiAP units. This enhances security.
There are data channel encryption settings on both the FortiGate unit and the FortiAP units. At
both ends, you can enable Clear Text, DTLS encryption, or both. The settings must agree or the
FortiAP unit will not be able to join the WiFi network. By default, both Clear Text and
DTLS-encrypted communication are enabled on the FortiAP unit, allowing the FortiGate setting
to determine whether data channel encryption is used. If the FortiGate unit also enables both
Clear Text and DTLS, Clear Text is used.
Data channel encryption settings are located in the Custom AP profile. If you use Automatic
profile, only Clear Text is supported.
Data channel encryption is software-based and can affect performance. Verify that the system
meets your performance requirements with encryption enabled.
Enabling encryption
In the CLI, the wireless wtp-profile command contains a new field, dtls-policy, with
options clear-text and dtls-enabled. To enable encryption in profile1 for example, enter:
config wireless-controller wtp-profile
edit profile1
set dtls-policy dtls-enabled
end
Fortinet Technologies Inc. Page 845 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Wireless network monitoring
You can monitor both your wireless clients and other wireless networks that are available in your
coverage area.
The following topics are included in this section:
Monitoring wireless clients
Monitoring rogue APs
Suppressing rogue APs
Monitoring wireless network health
FortiAP The serial number of the FortiAP unit to which the client
connected.
Device
Signal Strength / Noise The signal-to-noise ratio in deciBels calculated from signal
strength and noise level.
Signal Strength
Association Time How long the client has been connected to this access
point.
Results can be filtered. Select the filter icon on the column you want to filter. Enter the values to
include or select NOT if you want to exclude the specified values.
Page 846
Monitoring rogue APs
The access point radio equipment can scan for other available access points, either as a
dedicated monitor or as a background scan performed while the access point is idle.
Discovered access points are listed in the Rogue AP Monitor list. You can then mark them as
either Accepted or Rogue access points. This designation helps you to track access points. It
does not affect anyones ability to use these access points.
Rogue AP Settings (WiFi Controller > WiFi Network > Rogue AP Settings) control rogue AP
detection for APs that use the Automatic profile. For APs that use a custom AP profile, rogue AP
detection settings are contained in the custom AP profile (WiFi Controller > WiFi Network >
Custom AP Profile).
It is also possible to suppress rogue APs. See Suppressing rogue APs on page 851.
MAC adjacency
If an access point is also a router, it applies NAT to WiFi packets. This can make rogue detection
more difficult. However, an APs WiFi interface MAC address is usually in the same range as its
wired MAC address. So, the MAC adjacency rogue detection method matches LAN and WiFi
network MAC addresses that are within a defined numerical distance of each other. By default,
the MAC adjacency value is 7. If the AP for these matching MAC addresses is not authorized in
the FortiGate unit configuration, that AP is deemed an on-wire rogue.
Limitations
On-wire rogue detection has some limitations. There must be at least one WiFi client connected
to the suspect AP and continuously sending traffic. If the suspect AP is a router, its WiFi MAC
address must be very similar to its Ethernet port MAC address.
Logging
Information about detected rogue APs is logged and uploaded to your FortiAnalyzer unit, if you
have one. By default, rogue APs generate an alert level log, unknown APs generate a warning
level log. This log information can help you with PCI-DSS compliance requirements.
Fortinet Technologies Inc. Page 847 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Rogue AP scanning as a background activity
Each WiFi radio can perform monitoring of radio channels in its operating band while acting as
an AP. It does this by briefly switching from AP to monitoring mode. By default, a scan period
starts every 300 seconds. Each second a different channel is monitored for 20ms until all
channels have been checked.
During heavy AP traffic, it is possible for background scanning to cause lost packets when the
radio switches to monitoring. To reduce the probability of lost packets, you can set the CLI
ap-bgscan-idle field to delay the switch to monitoring until the AP has been idle for a
specified period. This means that heavy AP traffic may slow background scanning.
The following CLI example configures default background rogue scanning operation except that
it sets ap-bgscan-idle to require 100ms of AP inactivity before scanning the next channel.
config wireless-controller wtp-profile
edit ourprofile
config radio-1
set ap-bgscan enable
set rogue-scan enable
set ap-bgscan-period 300
set ap-bgscan-intv 1
set ap-bgscan-duration 20
set ap-bgscan-idle 100
end
end
To enable the rogue AP scanning feature for the automatic AP profile - CLI
config wireless-controller setting
set ap-scan enable
set on-wire-scan enable
end
Fortinet Technologies Inc. Page 848 FortiOS Handbook - Deploying Wireless Networks for FortiOS
6. If needed, modify other settings.
7. Select OK.
MAC adjacency
You can adjust the maximum WiFi to Ethernet MAC difference used when determining whether
an suspect AP is a rogue.
Fortinet Technologies Inc. Page 849 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Using the Rogue AP Monitor
Go to WiFi Controller > Monitor > Rogue AP Monitor to view the list of other wireless access
points that are receivable at your location.
Information Columns
Actual columns displayed depends on Column Settings.
State Rogue AP Use this status for unauthorized APs that On-wire
status indicates are attached to your wired networks.
Accepted AP Use this status for APs that are an authorized part
of your network or are neighboring APs that are not a security
threat. To see accepted APs in the list, select Show Accepted.
Unclassified This is the initial status of a discovered AP. You can
change an AP back to unclassified if you have mistakenly marked
it as Rogue or Accepted.
SSID The wireless service set identifier (SSID) or network name for the
wireless interface.
Channel The wireless radio channel that the access point uses.
Signal Strength The relative signal strength of the AP. Mouse over the symbol to view the
signal-to-noise ratio.
Detected By The name or serial number of the AP unit that detected the signal.
To change the Online Status of an AP, right-click it and select Mark Accepted or Mark Rogue.
Fortinet Technologies Inc. Page 850 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Suppressing rogue APs
In addition to monitoring rogue APs, you can actively prevent your users from connecting to
them. When suppression is activated against an AP, the FortiGate WiFi controller sends
deauthentication messages to the rogue APs clients, posing as the rogue AP, and also sends
deauthentication messages to the rogue AP, posing as its clients. This is done using the
monitoring radio.
To enable rogue AP suppression, you must enable monitoring of rogue APs with the on-wire
detection technique. See Monitoring rogue APs on page 847. The monitoring radio must be in
the Dedicated Monitor mode.
To deactivate AP suppression
1. Go to WiFi Controller > Monitor > Rogue AP Monitor.
2. Select the suppressed rogue AP and then select Suppress AP > Unsuppress AP.
The Wireless Health Dashboard provides a comprehensive view of the health of your networks
wireless infrastructure. The dashboard includes widgets to display
AP Status - Active, Down or missing, up for over 24 hours, rebooted in past 24 hours
Client Count Over TIme - viewable for past hour, day, or 30 days
Top Client Count Per-AP - separate widgets for 2.4GHz and 5GHz bands
Top Wireless Interference - separate widgets for 2.4GHz and 5GHz bands
Login Failures Information
To view the Wireless Health dashboard, go to WiFi Controller > Monitor > Wireless Health.
Fortinet Technologies Inc. Page 851 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuring wireless network clients
This chapter shows how to configure typical wireless network clients to connect to a wireless
network with WPA-Enterprise security. The following topics are included in this section:
Windows XP client
Windows 7 client
Mac OS client
Linux client
Troubleshooting
Windows XP client
If you are already connected to another wireless network, the Connection Status window
displays. Select View Wireless Networks on the General tab to view the list.
If the network broadcasts its SSID, it is listed. But do not try to connect until you have
completed the configuration step below. Because the network doesnt use the Windows XP
default security configuration, configure the clients network settings manually before trying
to connect.
2. You can configure the WPA-Enterprise network to be accessible from the View Wireless
Networks window even if it does not broadcast its SSID.
Page 852
3. Select Change Advanced Settings and then select the Wireless Networks tab.
Any existing networks that you have already configured are listed in the Preferred Networks
list.
4. Select Add and enter the following information:
5. If this wireless network does not broadcast its SSID, select Connect even if this network is
not broadcasting so that the network will appear in the View Wireless Networks list.
Fortinet Technologies Inc. Page 853 FortiOS Handbook - Deploying Wireless Networks for FortiOS
6. Select the Authentication tab.
Fortinet Technologies Inc. Page 854 FortiOS Handbook - Deploying Wireless Networks for FortiOS
14.Select Configure.
15.If your wireless network credentials are the same as your Windows logon credentials, select
Automatically use my Windows logon name and password. Otherwise, make sure that this
option is not selected.
16.Select OK. Repeat until you have closed all of the Wireless Network Connection Properties
windows.
4. In the Enter Credentials window, enter your wireless network User name, Password, and
Logon domain (if applicable). Then, select OK.
In future, Windows will automatically send your credentials when you log on to this network.
Fortinet Technologies Inc. Page 855 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Windows 7 client
1. In the Windows Start menu, go to Control Panel > Network and Internet > Network and
Sharing Center > Manage Wireless Networks or select the wireless network icon in the
Notification area of the Taskbar. A list of available networks is displayed.
The Wireless Network icon will display a popup requesting that you click to enter credentials
for the network. Click on the popup notification.
4. In the Enter Credentials window, enter your wireless network User name, Password, and
Logon domain (if applicable). Then, select OK.
Fortinet Technologies Inc. Page 856 FortiOS Handbook - Deploying Wireless Networks for FortiOS
5. Select Change connection settings.
6. On the Connection tab, select Connect automatically when this network is in range.
7. On the Security tab, select the Microsoft PEAP authentication method and then select
Settings.
8. Make sure that Validate server_certificate is selected.
9. Select the server certificate UTN-USERFirst-Hardware.
10.In Select Authentication Method, select Secured Password (EAP-MSCHAPv2).
11.Select Configure.
12.If your wireless network credentials are the same as your Windows logon credentials, select
Automatically use my Windows logon name and password. Otherwise, make sure that this
option is not selected.
13.Ensure that the remaining options are not selected.
14.Select OK. Repeat until you have closed all of the Wireless Network Properties windows.
Mac OS client
3. If there are no Login Window Profiles in the left column, select the + button and then select
Add Login Window Profile.
Fortinet Technologies Inc. Page 857 FortiOS Handbook - Deploying Wireless Networks for FortiOS
4. Select the Login Window Profile and then make sure that both TTLS and PEAP are selected
in Authentication.
Network name Enter the SSID of your wireless network. (Other network only)
802.1X Automatic
Mac OS supports only PEAP with MSCHAPv2 authentication and therefore can authenticate
only to a RADIUS server, not an LDAP or TACACS+ server.
Fortinet Technologies Inc. Page 858 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Linux client
Wireless networks that broadcast their SSID are listed in the Available section of the menu. If
the list is long, it is continued in the More Networks submenu.
2. Do one of the following:
Select the network from the list (also check More Networks).
Select Connect to Hidden Wireless Network.
One of the following windows opens, depending on your selection.
Fortinet Technologies Inc. Page 859 FortiOS Handbook - Deploying Wireless Networks for FortiOS
3. Enter the following information:
4. If you did not select a CA Certificate above, you are asked to do so. Select Ignore.
Fortinet Technologies Inc. Page 860 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Troubleshooting
Using tools provided in your operating system, you can find the source of common wireless
networking problems.
Checking that the client has received IP address and DNS server information
Windows XP
1. Double-click the network icon in the taskbar to display the Wireless Network Connection
Status window. Check that the correct network is listed in the Connection section.
2. Select the Support tab.
Check that the Address Type is Assigned by DHCP. Check that the IP Address,
Subnet Mask, and Default Gateway values are valid.
3. Select Details to view the DNS server addresses.
The listed address should be the DNS serves that were assigned to the WAP. Usually a
wireless network that provides access to the private LAN is assigned the same DNS servers
as the wired private LAN. A wireless network that provides guest or customer users access
to the Internet is usually assigned public DNS servers.
4. If any of the addresses are missing, select Repair.
If the repair procedure doesnt correct the problem, check your network settings.
Mac OS
1. From the Apple menu, open System Preferences > Network.
2. Select AirPort and then select Configure.
3. On the Network page, select the TCP/IP tab.
4. If there is no IP address or the IP address starts with 169, select Renew DHCP Lease.
5. To check DNS server addresses, open a terminal window and enter the following command:
cat /etc/resolv.conf
Check the listed nameserver addresses. A network for employees should us the wired
private LAN DNS server. A network for guests should specify a public DNS server.
Fortinet Technologies Inc. Page 861 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Linux
This example is based on the Ubuntu 10.04 Linux wireless client.
1. Right-click the Network Manager icon and select Connection Information.
2. Check the IP address, and DNS settings. If they are incorrect, check your network settings.
Fortinet Technologies Inc. Page 862 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Wireless network examples
This chapter provides an example wireless network configuration. The following topics are
included in this section:
Basic wireless network
A more complex example
Name wlan_users
Type Firewall
Page 863
Configuring the SSID
First, establish the SSID (network interface) for the network. This is independent of the number
of physical access points that will be deployed. The network assigns IP addresses using DHCP.
Name example_wifi
IP/Netmask 10.10.110.1/24
SSID example_wifi
Netmask 255.255.255.0
Fortinet Technologies Inc. Page 864 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure the SSID - CLI
config wireless-controller vap
edit example_wifi
set ssid "example_wifi"
set broadcast-ssid enable
set security wpa-enterprise
set auth usergroup
set usergroup wlan_users
end
config system interface
edit example_wifi
set ip 10.10.110.1 255.255.255.0
end
config system dhcp server
edit 0
set default-gateway 10.10.110.1
set dns-service default
set interface "example_wifi"
config ip-range
edit 1
set end-ip 10.10.110.199
set start-ip 10.10.110.2
end
set netmask 255.255.255.0
end
Interface example_wifi
Fortinet Technologies Inc. Page 865 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To create a firewall policy for WiFi users - web-based manager
1. Go to Firewall Objects > Policy and select Create New.
2. Enter the following information and select OK:
Schedule always
Service ALL
Action ACCEPT
Fortinet Technologies Inc. Page 866 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure the interface for the AP unit - CLI
config system interface
edit port3
set mode static
set ip 192.168.8.1 255.255.255.0
end
Fortinet Technologies Inc. Page 867 FortiOS Handbook - Deploying Wireless Networks for FortiOS
3. Wait 30 seconds, then enter get.
Retry the get command every 15 seconds or so until the unit is listed, like this:
== [ FAP22A3U10600118 ]
wtp-id: FAP22A3U10600118
4. Edit the discovered FortiAP unit like this:
edit FAP22A3U10600118
set admin enable
end
5. Repeat Steps 2 through 4 for each FortiAP unit.
Scenario
In this example, Example Co. provides two wireless networks, one for its employees and the
other for customers or other guests of its business. Guest users have access only to the
Internet, not to the companys private network. The equipment for these WiFi networks consists
of FortiAP-220A units controlled by a FortiGate unit.
The employee network operates in 802.11n mode on both the 2.4GHz and 5GHz bands. Client
IP addresses are in the 10.10.120.0/24 subnet, with 10.10.120.1 the IP address of the WAP. The
guest network also operates in 802.11n mode, but only on the 2.4GHz band. Client IP
addresses are on the 10.10.115.0/24 subnet, with 10.10.115.1 the IP address of the WAP.
On FortiAP-220A units, the 802.11n mode also supports 802.11g and 802.11b clients on the
2.4GHz band and 802.11a clients on the 5GHz band.
The guest network WAP broadcasts its SSID, the employee network WAP does not.
The employees network uses WPA-Enterprise authentication through a FortiGate user group.
The guest network features a captive portal. When a guest first tries to connect to the Internet, a
login page requests logon credentials. Guests use numbered guest accounts authenticated by
RADIUS. The captive portal for the guests includes a disclaimer page.
In this example, the FortiAP units connect to port 3 and are assigned addresses on the
192.168.8.0/24 subnet.
Configuration
To configure these wireless networks, you must:
Configure authentication for wireless users
Configure the SSIDs (network interfaces)
Configure the AP profile
Configure the WiFi LAN interface and a DHCP server
Configure firewall policies
Fortinet Technologies Inc. Page 868 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuring authentication for employee wireless users
Employees have user accounts on the FortiGate unit. This example shows creation of one user
account, but you can create multiple accounts and add them as members to the user group.
Name employee-group
Type Firewall
To configure the FortiGate unit to access the guest RADIUS server - web-based manager
1. Go to User & Device > Authentication > RADIUS Server and select Create New.
2. Enter the following information and select OK:
Name guestRADIUS
Fortinet Technologies Inc. Page 869 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure the FortiGate unit to access the guest RADIUS server - CLI
config user radius
edit guestRADIUS
set auth-type auto
set server 10.11.102.100
set secret grikfwpfdfg
end
Name guest-group
Type Firewall
Match one of these Select Add and fill in the following fields:
group names
3. Select Add.
4. Enter
Fortinet Technologies Inc. Page 870 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Configuring the SSIDs
First, establish the SSIDs (network interfaces) for the employee and guest networks. This is
independent of the number of physical access points that will be deployed. Both networks
assign IP addresses using DHCP.
IP/Netmask 10.10.120.1/24
SSID example_inc
Netmask 255.255.255.0
Fortinet Technologies Inc. Page 871 FortiOS Handbook - Deploying Wireless Networks for FortiOS
config ip-range
edit 1
set end-ip 10.10.120.199
set start-ip 10.10.120.2
end
set lease-time 7200
set netmask 255.255.255.0
end
Name example_guest
IP/Netmask 10.10.115.1/24
SSID example_guest
Netmask 255.255.255.0
Fortinet Technologies Inc. Page 872 FortiOS Handbook - Deploying Wireless Networks for FortiOS
set interface "example_guest"
config ip-range
edit 1
set end-ip 10.10.115.50
set start-ip 10.10.115.2
end
set lease-time 7200
set netmask 255.255.255.0
end
Name example_AP
Platform FAP220A
Radio 1
Band 802.11n
Tx Power 100%
Radio 2
Band 802.11n_5G
Fortinet Technologies Inc. Page 873 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Short Guard Interval Not enabled
Tx Power 100%
Interface example_inc
Fortinet Technologies Inc. Page 874 FortiOS Handbook - Deploying Wireless Networks for FortiOS
3. Select Create New, enter the following information and select OK.
Interface example_guest
Schedule always
Service ALL
Action ACCEPT
3. Optionally, select UTM and set up UTM features for wireless users.
4. Select OK.
5. Repeat steps 1 through 4 but select Internal as the Destination Interface/Zone to provides
access to the ExampleCo private network.
Fortinet Technologies Inc. Page 875 FortiOS Handbook - Deploying Wireless Networks for FortiOS
set srcaddr "employee-wifi-net"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
set nat enable
set schedule "always"
set service "ANY"
end
Schedule always
Service ALL
Action ACCEPT
3. Optionally, select UTM and set up UTM features for wireless users.
4. Select OK.
Fortinet Technologies Inc. Page 876 FortiOS Handbook - Deploying Wireless Networks for FortiOS
To configure the interface for the AP unit - web-based manager
1. Go to System > Network > Interfaces and edit the port3 interface.
2. Set the Addressing mode to Manual and set the IP/Netmask to 192.168.8.1.
3. Enable Connect FortiAP to this interface and set Reserve IP addresses for FortiAP to
192.168.8.2 - 192.168.8.9.
This step automatically configures a DHCP server for the AP units.
4. Select OK.
Fortinet Technologies Inc. Page 877 FortiOS Handbook - Deploying Wireless Networks for FortiOS
3. Wait 30 seconds, then enter get.
Retry the get command every 15 seconds or so until the unit is listed, like this:
== [ FAP22A3U10600118 ]
wtp-id: FAP22A3U10600118
4. Edit the discovered FortiAP unit like this:
edit FAP22A3U10600118
set admin enable
set wtp-profile example_AP
end
5. Repeat Steps 2 through 4 for each FortiAP unit.
Fortinet Technologies Inc. Page 878 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Using a FortiWiFi unit as a client
A FortiWiFi unit by default operates as a wireless access point. But a FortiWiFi unit can also
operate as a wireless client, connecting the FortiGate unit to another wireless network.
This section includes the following topics:
Use of client mode
Configuring client mode
In client mode, the FortiWiFi unit connects to a remote WiFi access point to access other
networks or the Internet. This is most useful when the FortiWiFi unit is in a location that does not
have a wired infrastructure.
For example, in a warehouse where shipping and receiving are on opposite sides of the
building, running cables might not be an option due to the warehouse environment. The
FortiWiFi unit can support wired users using its Ethernet ports and can connect to another
access point wirelessly as a client. This connects the wired users to the network using the
802.11 WiFi standard as a backbone.
Note that in client mode the FortiWiFi unit cannot operate as an AP. WiFi clients cannot see or
connect to the FortiWifi unit in Client mode.
Internal
Wireless Network Network
Internal
Network
Web Server
DMZ
Router
Internet
Page 879
Configuring client mode
To set up the FortiAP unit as a WiFi client, you must use the CLI. Before you do this, be sure to
remove any AP WiFi configurations such as SSIDs, DHCP servers, policies, and so on.
Schedule always
Service ALL
Action ACCEPT
Fortinet Technologies Inc. Page 880 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Support for location-based services
FortiOS supports location-based services by collecting information about WiFi devices near
FortiGate-managed access points, even if the devices dont associate with the network.
The following topics are included in this section:
Overview
Configuring location tracking
Viewing device location data on the FortiGate unit
Overview
WiFi devices broadcast packets as they search for available networks. The FortiGate WiFi
controller can collect information about the interval, duration, and signal strength of these
packets. The Euclid Analytics service uses this information to track the movements of the
device owner. A typical application of this technology is to analyze shopper behavior in a
shopping center. Which stores do people walk past? Which window displays do they stop to
look at? Which stores do they enter and how long do they spend there? The shoppers are not
personally identified, each is known only by the MAC address of their WiFi device.
After enabling location tracking on the FortiGate unit, you can confirm that the feature is
working by using a specialized diagnostic command to view the raw tracking data. The Euclid
Analytics service obtains the same data in its proprietary format using a JSON inquiry through
the FortiGate units web-based manager interface.
You can enable location tracking in any custom AP profile, using the CLI. For each radio, set the
station-locate field to enable. For example:
config wireless-controller wtp-profile
edit "FAP220B-locate"
set ap-country US
config platform
set type 220B
end
config radio-1
set station-locate enable
end
config radio-2
set station-locate enable
end
end
Page 881
Viewing device location data on the FortiGate unit
You can use the FortiGate CLI to list located devices. This is mainly useful to confirm that the
location data feature is working, You can also reset device location data.
Example output
The following output shows data for three WiFi devices.
FWF60C3G11004319 # diagnose wireless-controller wlac -c sta-locate
sta_mac vfid rid base_mac freq_lst frm_cnt
frm_fst frm_last intv_sum intv2_sum intv3_sum intv_min
intv_max signal_sum signal2_sum signal3_sum sig_min sig_max
sig_fst sig_last ap
00:0b:6b:22:82:61 0
FAP22B3U11005354 0 0 00:09:0f:f1:bb:e4 5745 257
708 56 651 1836 6441 0 12
-21832 1855438 -157758796 -88 -81 -84 -88
0
00:db:df:24:1a:67 0
FAP22B3U11005354 0 0 00:09:0f:f1:bb:e4 5745 42
1666 41 1625 97210 5831613 0 60
-3608 310072 -26658680 -90 -83 -85 -89
0
10:68:3f:50:22:29 0
FAP22B3U11005354 0 0 00:09:0f:f1:bb:e4 5745 102
1623 58 1565 94136 5664566 0 60
-8025 631703 -49751433 -84 -75 -78 -79
0
The output for each device appears on two lines. The first line contains only the device MAC
address and the VLAN ID. The second line begins with the ID (serial number) of the FortiWiFi or
FortiAP unit that detected the device, the APs MAC address, and then the fields that the Euclid
service uses. Because of its length, this line wraps around and displays as multiple lines.
Fortinet Technologies Inc. Page 882 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Reference
This chapter provides some reference information pertaining to wireless networks. The following
topics are included in this section:
Wireless radio channels
FortiAP CLI
34 5170
36 5180
38 5190
40 5200
42 5210
44 5220
46 5230
48 5240
149 5745
153 5765
157 5785
161 5805
165 5825
Page 883
IEEE 802.11b/g/n channel numbers
Table 44 lists IEEE 802.11b/g/n channels. All FortiWiFi units support 802.11b and 802.11g.
Newer models also support 802.11n.
Mexico is included in the Americas regulatory domain. Channels 1 through 8 are for indoor use
only. Channels 9 through 11 can be used indoors and outdoors. You must make sure that the
channel number complies with the regulatory standards of Mexico.
1 2412 ?
2 2417 ?
3 2422 ?
4 2427
5 2432
6 2437
7 2442
8 2447
9 2452
10 2457
11 2462 ?
12 2467 ?
13 2472 ?
14 2484 b only
Fortinet Technologies Inc. Page 884 FortiOS Handbook - Deploying Wireless Networks for FortiOS
FortiAP CLI
The FortiAP CLI now includes more configuration commands and a complete set of diagnose
commands.
Configuration commands include the following
Fortinet Technologies Inc. Page 885 FortiOS Handbook - Deploying Wireless Networks for FortiOS
cw_diag -c sta-scan Show scanned STAs.
cw_diag -c mesh-veth-acinfo Show mesh veth ac info, and mesh ether type.
You can access the FortiAP units built-in web-based manager. This is useful to adjust settings
that are not available through the FortiGate units WiFi Controller. Logging into the FortiAP
web-based manager is similar to logging into the FortiGate web-based manager.
The advanced settings are in the WTP Configuration section on the System Information tab.
AC Discovery DHCP Option Code When using DHCP discovery, you can configure the
DHCP server to provide the controller address. By
default the FortiAP unit expects this in option 138.
AC Data Channel Security Select whether the FortiAP unit requires Clear Text
data, DTLS encrypted data, or will accept either.
Fortinet Technologies Inc. Page 886 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Fortinet Technologies Inc. Page 887 FortiOS Handbook - Deploying Wireless Networks for FortiOS
Chapter 7 Firewall for FortiOS 5.0
Firewall concepts explains the ideas behind the components, techniques and processes that
are involved in setting up and running a firewall in general and the FortiGate firewall in particular.
The premise here is that regardless of how experienced someone is with firewalls as they go
through the process of configuring a firewall that is new to them they are likely to come across a
term or setting that they may not be familiar with even if it is only in the context of the setting
they are working in at the moment. FortiGate firewall are quite comprehensive and can be very
granular in the functions that they perform, so it makes sense to have a consistent frame of
reference for the ideas that we will be working with.
Some examples of the concepts that will be addressed here are:
What is a Firewall?
NAT
IPv6
Firewall objects describes the following firewall objects:
Addressing
Services
Firewall Policies
Network defense describes various methods of defending your Network using the abilities of
the FortiGate Firewall.
GUI & CLI - What You May Not Know helps you navigate and find the components in the
Web-based Manager that you will need to build the functions. This section is does not include
any in-depth explanations of what each object does as that is covered in the concepts section.
This section is for showing you where you need to input your information and let you know what
format the interface expects to get that information
Building firewall objects and policies is similar to a cookbook in that it will refer to a number of
common tasks that you will likely perform to get the full functionality out of your FortiGate
firewall. Because of the way that firewall are designed, performing many of the tasks requires
that firewall components be set up in a number of different sections of the interface and be
configured to work together to achieve the desired result. This section will bring those
components all together as a straight forward series of instructions.
Multicast forwarding is a reference guide including the concepts and examples that are involved
in the use of multicast addressing and policy forwarding as it is used in the FortiGate firewall.
The FortiGate firewall is made up of a number of different components that are used to build an
impressive list of features that have flexibility of scope and granularity of control that provide
protection that is beyond that provided by the basic firewalls of the past.
Page 888
Some of the components that FortiOS uses to build features are:
Interfaces
VLANs
Soft Switches
Zones
Predefined Addresses
IP address based
FQDN based
Geography based
Access Schedules
Authentication
Local User based
Authentication Server based (Active Directory, Radius, LDAP)
Device Based
Configureable Services
IPv4 and IPv6 protocol support
The features of FortiOS include but are not limited to:
Security profiles, sometimes referred to as Unified Threat Management (UTM) or Next
Generation Firewall (NGFW)
Predefined firewall addresses (this includes IPv4 and IPv6, IP pools,. wildcard addresses and
netmasks, and geography-based addresses)
Monitoring traffic
Traffic shaping and per-IP traffic shaping (advanced)
Firewall schedules
Services (such as AOL, DHCP and FTP)
Logging traffic
Quality of Service (QoS)
Identity-based policies
Endpoint security
The Firewall concepts expands on what each of the features does and how they relate to the
administration of the FortiGate firewall. The section will also try to explain some of the common
firewall concepts that will be touched on in the implementing of these features.
Building firewall objects and policies shows how to perform specific tasks with the FortiGate
firewall.
The FortiGate firewall protects your network by taking the various components and using them
together to build a kind of wall or access control point so that anyone that is not supposed to be
on your network is prevented from accessing your network in anyway other than those
approved by you. It also protects your network from itself by keeping things that shouldnt
happen from happening and optimizing the flow of traffic so that the network is protected from
traffic congestion that would otherwise impede traffic flow.
Most people have at one time or another played with the childrens toy system that is made up
of interlocking blocks. The blocks come in different shapes and sizes so that you can build
Fortinet Technologies Inc. Page 889 FortiOS Handbook - Firewall for FortiOS 5.0
structures to suit your needs and in your way. The components of the FortiGate firewall are
similar. You are not forced to use all of the blocks all of the time. You mix and match them to get
the results that you are looking for. You can build a very basic structure thats only function is to
direct traffic in and out to the correct subnets or you can build a fortress that only allows
specific traffic to specific hosts from specific hosts at specific times of day and that is only if
they provide the credentials that have been pre-approved and all of the traffic is encrypted so
that even when the traffic is out on the Internet it is private from the world. Just like the
interlocking blocks, what you build is up to you, but chances are if you put them together the
right way there isnt much that cant be built.
Here is one example of how the components could be put together to support the requirements
of a network infrastructure design.
Off the Internal interface you could have separate VLANs. One for each for the departments
of Sales, Marketing and Engineering so that the traffic from the users on one VLAN does not
intrude upon the hosts of the other VLANs and the department are isolated from one another
for security reasons.
To ease in the administration each of the VLAN sub-interfaces is made a member of a zone
so that security policies that apply to all of the hosts on all of the VLANs can be applied to all
of them at once.
Using the addresses component each of the IP address ranges could be assigned a user
friendly name so that they could be referred to individually and then for policies that would
refer to them all as a whole the individual ranges to be made members of an address group.
Firewall schedules could be created to address the differing needs of each of the groups so
that Sales and Marketing could be allowed access to the Internet during regular business
hours and the Engineering department could be allowed access during the lunch break.
By setting up the outgoing policies to use FortiGuard Web-filtering the employees could be
prevented from visiting inappropriate sites and thus enforcing the policies of the HR
department.
A couple of virtual IP addresses with port forwarding could be configured to allow users on
the Internet to access a web server on the DMZ subnet using the companys only Public IP
address without affecting the traffic that goes to the companys mail server that is hosted on
a complete different computer.
Even though the Web server on the same DMZ has an FTP service to allow for the uploading
of web pages to the web server from the Marketing and Engineer teams, by placing a DENY
policy on any FTP traffic from the Internet malicious users are prevented from abusing the
FTP service.
By monitoring the traffic as it goes through the policies you can verify that the policies are in
working order.
By using a combination of ALLOW and DENY policies and placing them in the correct order
you could arrange for an outside contractor to be allowed to update the web site as well
These set of configurations is not extensive but it does give an idea of how different
components can be mixed and matched to build a configuration that meets an organizations
needs but at the same time protect it from security risks.
Fortinet Technologies Inc. Page 890 FortiOS Handbook - Firewall for FortiOS 5.0
Firewall concepts
There are a number of concepts that are consistent throughout the firewall industry and having
a solid grasp of these ideas and terms can give you a better idea of what your FortiGate firewall
is capable of and how it will be able to fit within your networks architecture.
This chapter describes the following firewall concepts:
What is a Firewall?
IPv6
NAT
How Packets are handled by FortiOS
FortiGate Modes
Quality of Service
Interfaces and Zones
What is a Firewall?
The term firewall originally referred to a wall intended to confine a fire or potential fire within a
building. Later uses refer to similar structures, such as the metal sheet separating the engine
compartment of a vehicle or aircraft from the passenger compartment.
A firewall can either be software-based or hardware-based and is used to help keep a network
secure. Its primary objective is to control the incoming and outgoing network traffic by analyzing
the data packets and determining whether it should be allowed through or not, based on a
predetermined rule set. A network's firewall builds a bridge between an internal network that is
assumed to be secure and trusted, and another network, usually an external (inter)network,
such as the Internet, that is not assumed to be secure and trusted.
Stateless Firewalls
Stateless firewalls are the oldest form of these firewalls. They are faster and simple in design
requiring less memory because they process each packet individually and don't require the
resources necessary to hold onto packets like stateful firewalls. Stateful firewalls inspect each
packet individually and check to see if it matches a predetermined set of rules. According to the
matching rule the packet is either be allowed, dropped or rejected. In the case of a rejection an
error message is sent to the source of the traffic. Each packet is inspected in isolation and
information is only gathered from the packet itself. Simply put, if the packets were not
specifically allowed according to the list of rules held by the firewall they were not getting
through.
Stateful Firewalls
Stateful firewalls retain packets in memory so that they can maintain context about active
sessions and make judgements about the state of an incoming packet's connection. This
enables Stateful firewalls to determine if a packet is the start of a new connection, a part of an
existing connection, or not part of any connection. If a packet is part of an existing connection
based on comparison with the firewall's state table, it will be allowed to pass without further
processing. If a packet does not match an existing connection, it will be evaluated according to
Page 891
the rules set for new connections. Predetermined rules are used in the same way as a stateless
firewall but they can now work with the additional criteria of the state of the connection to the
firewall.
Proxy Servers
A proxy server is an appliance or application that acts as an intermediary for communicating
between computers. A computer has a request for information. The packets are sent to the
designated resource but before they can get there they are blocked by the proxy server saying
that it will take the request and pass it on. The Proxy Server processes the request and if it is
valid it passes onto the designated computer. The designated computer gets the packet and
processes the request, sending the answer back to the proxy server. The proxy server sends the
information back to the originating computer. Its all a little like a situation with two people who
refuse to talk directly with each other using someone else to take messages back and forth.
Fortinet Technologies Inc. Page 892 FortiOS Handbook - Firewall for FortiOS 5.0
From a security stand point a Proxy Server can serve a few purposes:
Protects the anonymity of the originating computer
The two computers never deal directly with each other
Packets that are not configured to be forwarded are dropped before reaching the destination
computer.
If malicious code is sent it will affect the Proxy server with out affecting the originating or
sending computer.
Proxies can perform a number of roles including:
Content Filtering
Caching
DNS proxy
Bypassing Filters and Censorship
Logging and eavesdropping
Gateways to private networks
Accessing service anonymously
Security Profiles
Unified Threat Management and Next Generation Firewall are terms originally coined by market
research firms and refer to the concept of a comprehensive security solution provided in a
single package. It is basically combining of what used to be accomplished by a number of
different security technologies all under a single umbrella or in this case, a single device. On the
FortiGate firewall this is achieved by the use of Security Profiles and optimized hardware.
In effect it is going from a previous style of firewall that included among its features:
Gateway Network Firewall
Routing
VPN
Fortinet Technologies Inc. Page 893 FortiOS Handbook - Firewall for FortiOS 5.0
To a more complete system that includes:
Gateway Network Firewall
Routing
VPN
Traffic Optimization
Proxy Services
Content Filtering
Application Control
Intrusion Protection
Denial of Service Attack Protection
Anti-virus
Anti-spam
Data Leak Prevention
Endpoint Control of Security Applications
Load Balancing
WiFi Access Management
Authentication Integration into Gateway Security
Logging
Reporting
IPv6
What is IPv6?
Internet Protocol version 6 (IPv6) will succeed IPv4 as the standard networking protocol of the
Internet. IPv6 provides a number of advances over IPv4 but the primary reason for its replacing
IPv4 is its limitation in addresses. IPv4 uses 32 bit addresses which means there is a theoretical
limit of 2 to the power of 32. The IPv6 address scheme is based on a 128 bit address or a
theoretical limit of 2 to the power of 128.
Fortinet Technologies Inc. Page 894 FortiOS Handbook - Firewall for FortiOS 5.0
Possible Addresses:
IPv4 = 4,294,967,296 (over 4 billion)
IPv6 = 340,282,366,920,938,463,463,374,607,431,768,211,456 (over 340 undecillion - We
had to look that term up. We didnt know what a number followed by 36 digits was either)
Assuming a world population of approximately 8 billion people, IPv6 would allow for each
individual to have approximately 42,535,295,865,117,200,000,000,000,000 devices with an IP
address. Thats 42 quintillion devices.
There is little likelihood that you will ever need to worry about these numbers as any kind of
serious limitation in addressing but they do give an idea of the scope of the difference in the
available addressing.
Aside from the difference of possible addresses there is also the different formatting of the
addresses that will need to be addressed.
A computer would view an IPv4 address as a 32 bit string of binary digits made up of 1s and 0s,
broken up into 4 octets of 8 digits separated by a period .
Example:
10101100.00010000.11111110.00000001
To make number more user friendly for humans we translate this into decimal, again 4 octets
separated by a period .which works out to:
172.16.254.1
A computer would view an IPv6 address as a 128 bit string of binary digits made up of 1s and
0s, broken up into 8 octets of 16 digits separated by a colon :
1000000000000001:0000110110111000:101011000001000:1111111000000001:00000000
00000000:0000000000000000:0000000000000000:0000000000000000
To make number a little more user friendly for humans we translate this into hexadecimal, again
8 octets separated by a colon : which works out to:
8001:0DB8:AC10:FE01:0000:0000:0000:0000:
Because any four-digit group of zeros within an IPv6 address may be reduced to a single zero or
altogether omitted, this address can be shortened further to:
8001:0DB8:AC10:FE01:0:0:0:0
or
8001:0DB8:AC10:FE01::
Some of the other benefits of IPv6 include:
More efficient routing
Reduced management requirement
Stateless auto-reconfiguration of hosts
Improved methods to change Internet Service Providers
Better mobility support
Multi-homing
Security
Scoped address: link-local, site-local and global address space
Fortinet Technologies Inc. Page 895 FortiOS Handbook - Firewall for FortiOS 5.0
IPv6 in FortiOS
From an administrative point of view IPv6 works almost the same as IPv4 in FortiOS. The
primary difference is the use IPv6 format for addresses. There is also no need for NAT if the
FortiGate firewall is the interface between IPv6 networks. If the subnets attached to the
FortiGate firewall are IPv6 and IPv4 NAT can be configured between the 2 different formats. This
will involve either configuring a dual stack routing or IPv4 tunnelling configuration. The reason
for this is simple. NAT was developed primarily for the purpose of extending the number of
usable IPv4 addresses. IPv6s addressing allows for enough available addresses so the NAT is
no longer necessary.
When configuring IPv6 in FortiOS, you can create a dual stack route or IPv4-IPv6 tunnel. A dual
stack routing configuration implements dual IP layers, supporting both IPv4 and IPv6, in both
hosts and routers. An IPv4-IPv6 tunnel is essentially similar, creating a tunnel that encapsulates
IPv6 packets within IPv4 headers that carry these IPv6 packets over IPv4 tunnels. The FortiGate
unit can also be easily integrated into an IPv6 network. Connecting the FortiGate unit to an IPv6
network is exactly the same as connecting it to an IPv4 network, the only difference is that you
are using IPv6 addresses.
By default the IPv6 settings are not displayed in the Web-based Manager. It is just a matter of
enabling the display of these feature to use them through the web interface. To enable them just
go to System > Admin > Settings and select IPv6 Support on GUI. Once enabled, you will be
able to use IPv6 addresses as well as the IPv4 addressing for the following FortiGate firewall
features:
Static routing
Policy Routing
Packet and network sniffing
Dynamic routing (RIPv6, BGP4+, and OSPFv3)
IPSec VPN
DNS
DHCP
SSL VPN
Network interface addressing
Security Profiles protection
Routing access lists and prefix lists
NAT/Route and Transparent mode
NAT 64 and NAT 66
IPv6 tunnel over IPv4 and IPv4 tunnel over IPv6
Logging and reporting
Security policies
SNMP
Authentication
Virtual IPs and groups
IPv6 over SCTP
IPv6-specific troubleshooting, such as ping6
Fortinet Technologies Inc. Page 896 FortiOS Handbook - Firewall for FortiOS 5.0
traffic as required to any device on the network. Administrators can update network
components and applications to IPv6 on their own schedule, and even maintain some IPv4
support indefinitely if that is necessary. Devices that are on this type of network, and connect to
the Internet, can query Internet DNS servers for both IPv4 and IPv6 addresses. If the Internet
site supports IPv6, the device can easily connect using the IPv6 address. If the Internet site
does not support IPv6, then the device can connect using the IPv4 addresses. In the FortiOS
dual stack architecture it is not just the basic addressing functions that operate in both versions
of IP. The other features of the appliance such as Security Profiles and routing can also use both
IP stacks.
If an organization with a mixed network uses an Internet service provider that does not support
IPv6, they can use an IPv6 tunnel broker to connect to IPv6 addresses that are on the Internet.
FortiOS supports IPv6 tunnelling over IPv4 networks to tunnel brokers. The tunnel broker
extracts the IPv6 packets from the tunnel and routes them to their destinations.
IPv6 Tunnelling
IPv6 Tunnelling is the act of tunnelling IPv6 packets from an IPv6 network through an IPv4
network to another IPv6 network. This is different than Network Address Translation (NAT)
because once the packet reaches its final destination the true originating address of the sender
will still be readable. The IPv6 packets are encapsulated within packets with IPv4 headers,
which carry their IPv6 payload through the IPv4 network. This type of configuration is more
appropriate for those who have completely transitional over to IPv6, but need an Internet
connection, which is still mostly IPv4 addresses.
The key to IPv6 tunnelling is the ability of the 2 devices, whether they are a host or a network
device, to be dual stack compatible. The have to be able to work with both IPv4 and IPv6 at the
same time. In the process the entry node of the tunnel portion of the path will create an
encapsulating IPv4 header and transmit the encapsulated packet. The exit node at the end of
the tunnel receives the encapsulated packet. The IPv4 header is removed. The IPv6 header is
updated and the IPv6 packet is processed.
There are two types of tunnels in IPv6:
Automatic tunnels Automatic tunnels are configured by using IPv4 address information
embedded in an IPv6 address the IPv6 address of the destination host
includes information about which IPv4 address the packet should be
tunnelled to.
Configured tunnels Configured tunnels must be configured manually. These tunnels are
used when using IPv6 addresses that do not have any embedded IPv4
information. The IPv6 and IPv4 addresses of the endpoints of the tunnel
must be specified.
Tunnel Configurations
There are a few ways in which the tunnelling can be performed depending on which segment of
the path between the end points of the session the encapsulation takes place.
Network Device to Dual Stack capable devices connected by an IPv4 infrastructure can
Network Device tunnel IPv6 packets between themselves. In this case, the tunnel spans
one segment of the path taken by the IPv6 packets.
Host to Network Dual Stack capable hosts can tunnel IPv6 packets to an intermediary
Device IPv6 or IPv4 network device that is reachable through an IPv4
infrastructure. This type of tunnel spans the first segment of the path
taken by the IPv6 packets.
Fortinet Technologies Inc. Page 897 FortiOS Handbook - Firewall for FortiOS 5.0
Host to Host Dual Stack capable hosts that are interconnected by an IPv4
infrastructure can tunnel IPv6 packets between themselves. In this case,
the tunnel spans the entire path taken by the IPv6 packets.
Network Device to Dual Stack capable network devices can tunnel IPv6 packets to their
Host final destination IPv6 or IPv4 host. This tunnel spans only the last
segment of the path taken by the IPv6 packets.
Regardless of whether the tunnel starts at a host or a network device, the node that does the
encapsulation needs to maintain soft state information, such as the maximum transmission unit
(MTU), about each tunnel in order to process the IPv6 packets.
NAT
What is NAT?
NAT or Network Address Translation is the process that enables a single device such as a router
or firewall to act as an agent between the Internet or Public Network and a local or private
network. This agent, in real time, translates the source IP address of a device on one network
interface, usually the Internal, to a different IP address as it leaves another interface, usually the
interface connected to the ISP and the Internet. This enables a single public address to
represent a significantly larger number of private addresses.
Fortinet Technologies Inc. Page 898 FortiOS Handbook - Firewall for FortiOS 5.0
as a solution until a new addressing methodology could be implemented across the Internet
infrastructure. For more information on this you can look up IP version 6.
RFC 1631 described a process that would allow networking devices to translate a single public
address to multiple private IP addresses and RFC 1918 laid out the use of the private
addresses. The addresses that were on the Internet (Public IP addresses) could not be
duplicated for them to work as unique addresses, but behind a firewall, which most large
institutions had, they could use their own Private IP addresses for internal use and the internal
computers could share the external or Public IP address.
To give an idea on a small scale how this works, image that a company has a need for 200
computer addresses. Before Private IP addresses and NAT the company would have purchased
a full Class C address range which would have been 254 usable IP addresses; wasting about 50
addresses. Now with NAT, that company only needs 1 IP address for its 200 computers and this
leaves the rest of the IP addresses in that range available for other companies to do the same
thing.
NAT gives better value than it would first appear because it is not 253 companies that can use
254 addresses but each of those 254 companies could set up their networking infrastructures
to use up to thousands of Private IP addresses, more if they dont all have to talk to the Internet
at the same time. This process enabled the Internet to keep growing even though we technically
have many more computers networked than we have addresses.
Static NAT
In Static NAT one internal IP address is always mapped to the same public IP address.
In FortiGate firewall configurations this is most commonly done with the use of Virtual IP
addressing.
An example would be if you had a small range of IP addresses assigned to you by your ISP and
you wished to use one of those IP address exclusively for a particular server such as an email
server.
Say the internal address of the Email server was 192.168.12.25 and the Public IP address from
your assigned addresses range from 256.16.32.65 to 256.16.32.127. Many readers will notice
that because one of the numbers is above 255 that this is not a real Public IP address. The
Address that you have assigned to the interface connected to your ISP is 256.16.32.66, with
256.16.32.65 being the remote gateway. You wish to use the address of 256.16.32.70
exclusively for your email server.
When using a Virtual IP address you set the external IP address of 256.16.32.70 to map to
192.168.12.25. This means that any traffic being sent to the public address of 256.16.32.70 will
be directed to the internal computer at the address of 192.168.12.25
When using a Virtual IP address, this will have the added function that when ever traffic goes
from 192.168.12.25 to the Internet it will appear to the recipient of that traffic at the other end as
coming from 256.16.32.70.
You should note that if you use Virtual IP addressing with the Port Forwarding enabled you do
not get this reciprocal effect and must use IP pools to make sure that the outbound traffic uses
the specified IP address.
Dynamic NAT
Dynamic NAT maps the private IP addresses to the first available Public Address from a pool of
possible Addresses. In the FortiGate firewall this can be done by using IP Pools.
Fortinet Technologies Inc. Page 899 FortiOS Handbook - Firewall for FortiOS 5.0
Overloading
This is a form of Dynamic NAT that maps multiple private IP address to a single Public IP
address but differentiates them by using a different port assignment. This is probably the most
widely used version of NAT. This is also referred to as PAT (Port Address Translation) or
Masquerading.
An example would be if you had a single IP address assigned to you by your ISP but had 50 or
60 computers on your local network.
Say the internal address of the interface connected to the ISP was 256.16.32.65 (again an
impossible address) with 256.16.32.64 being the remote gateway. If you are using this form of
NAT any time one of your computers accesses the Internet it will be seen from the Internet as
256.16.32.65. If you wish to test this go to 2 different computers and verify that they each have
a different private IP address then go to a site that tells you your IP address such as
www.ipchicken.com. You will see that the site gives the same result of 256.16.32.65, if it
existed, as the public address for both computers.
As mentioned before this is sometimes called Port Address Translation because network device
uses TCP ports to determine which internal IP address is associated with each session through
the network device. For example, if you have a network with internal addresses ranging from
192.168.1.1 to 192.168.1.255 and you have 5 computers all trying to connect to a web site
which is normally listening on port 80 all of them will appear to the remote web site to have the
IP address of 256.16.32.65 but they will each have a different sending TCP port, with the port
numbers being somewhere between 1 and 65 535, although the port numbers between 1 to
1024 are usually reserved or already in use. So it could be something like the following:
192.168.1.10 256.16.32.65: port 486
192.168.1.23 256.16.32.65: port 2409
192.168.1.56 256.16.32.65: port 53763
192.168.1.109 256.16.32.65: port 5548
192.168.1.201 256.16.32.65: port 4396
And the remote web server would send the responding traffic back based on those port
numbers so the network device would be able to sort through the incoming traffic and pass it on
to the correct computer.
Overlapping
Because everybody is using the relative same small selection of Private IP addresses it is
inevitable that there will be two networks that share the same network range that will need to
talk with each other. This happens most often over Virtual Private Networks or when one
organization ends up merging with another. This is a case where a private IP address may be
translated into a different private IP address so there are no issues with conflict of addresses or
confusion in terms of routing.
An example of this would be when you have a Main office that is using an IP range of 172.16.0.1
to 172.20.255.255 connecting through a VPN to a recently acquired branch office that is already
running with an IP range of 172.17.1.1 to 172.17.255.255. Both of these ranges are perfectly
valid but because the Branch office range is included in the Main Office range any time the
system from the Main office try to connect to an address in the Branch Office the routing the
system will not send the packet to the default gateway because according to the routing table
the address is in its own subnet.
The plan here would be to NAT in both directions so that traffic from neither side of the firewall
would be in conflict and they would be able to route the traffic. Everything coming from the
Branch Office could be assigned an address in the 192.168.1.1 to 192.168.1.255 range and
everything from the Main office going to the Branch Office could be assigned to an address in
the 192.168.10.1 to 192.168.10.255 range.
Fortinet Technologies Inc. Page 900 FortiOS Handbook - Firewall for FortiOS 5.0
Benefits of NAT
Financial Savings
Because an organization does not have to purchase IP addresses for every computer in use
there is a significant cost savings due to using the process of Network Address Translation.
Security Enhancements
One of the side benefits of the process of NAT is an improvement in security. Individual
computers are harder to target from the outside and if port forwarding is being used computers
on the inside of a firewall are less likely to have unmonitored open ports accessible from the
Internet.
Example:
You have a large organization that for security reasons has certain departments that do not
share network resources.
You can have the main section of the organization set up as follows;
You could then have the following groups broken off into separate subnets:
These addresses do not have to be assigned right away but can be used as planned ranges.
Fortinet Technologies Inc. Page 901 FortiOS Handbook - Firewall for FortiOS 5.0
NAT in Transparent Mode
Similar to operating in NAT mode, when operating a FortiGate unit in Transparent mode you can
add security policies and:
Enable NAT to translate the source addresses of packets as they pass through the FortiGate
unit.
Add virtual IPs to translate destination addresses of packets as they pass through the
FortiGate unit.
Add IP pools as required for source address translation
A FortiGate unit operating in Transparent mode normally has only one IP address - the
management IP. To support NAT in Transparent mode, you can add a second management IP.
These two management IPs must be on different subnets. When you add two management IP
addresses, all FortiGate unit network interfaces will respond to connections to both of these IP
addresses.
Use the following steps to configure NAT in Transparent mode
1. Add two management IPs
2. Add an IP pool to the WAN1 interface
3. Add an Internal to WAN1 security policy
You can add the security policy from the web-based manager and then use the CLI to enable
NAT and add the IP pool.
The usual practice of NATing in transparent mode makes use of two management IP addresses
that are on different subnets, but this is not an essential requirement in every case.
If there is a router between the client systems and the FortiGate unit you can use the routers
capabilities of tracking sessions to assign NATed addresses from an IP pool to the clients even
if the assigned address dont belong to a subnet on your network.
Example:
Client computer has an IP address of 1.1.1.33 on the subnet 1.1.1.0/24
Router A sits between the client computer and the FortiGate (in Transparent mode) with the IP
address of 1.1.1.1 on the clients side of the router and the IP address of 192.168.1.211 on the
FortiGates side of the router.
Use NAT to assign addresses from an address pool of 9.9.9.1 to 9.9.9.99 to traffic coming from
gateway of 192.168.1.211.
To enable the return traffic to get to the original computer, set up a static route than assigns any
traffic with a destination of 9.9.9.0/24 to go through the 192.168.1.211 gateway. As long as the
session for the outgoing traffic has been maintained, communication between the client
computer and the external system on the other side of the FortiGate will work.
Fortinet Technologies Inc. Page 902 FortiOS Handbook - Firewall for FortiOS 5.0
The FortiGate unit reads the NAT rules in a top-down methodology, until it hits a matching rule
for the incoming address. This enables you to create multiple NAT policies that dictate which IP
pool is used based on the source address. The NAT policies can be rearranged within the policy
list as well. NAT policies are applied to network traffic after a security policy.
NAT 66
NAT 66 is Network Address Translation between 2 IPv6 network. The basic idea behind NAT 66
is no different than the regular NAT between IPv4 networks that we are all used to. The
difference are in the mechanics of how it is performed, mainly because of the complexity and
size of the addresses that are being dealt with.
Fortinet Technologies Inc. Page 903 FortiOS Handbook - Firewall for FortiOS 5.0
In an IPv4 world, the reason for the use of NAT was usually one or a combination of the
following 3 reasons:
Improved security - actual addresses behind NAT are virtually hidden
Amplification of addresses - hundreds of computers can use as little as a single public IP
address
Internal address stability - there is control of internal addressing. The addresses can stay the
same even if Internet Service Providers change.
In these days of security awareness the protective properties of NAT are not something that are
not normally depended on by themselves to defend a network and with the vastly enlarged IPv6
address scope there is no longer a need to amplify the available addresses. However, the desire
to have internal address control still exists. The most common reason for using NAT66 is likely
to be the maintaining of the existing address scheme of the internal network despite changes
outside of it. Imagine that you have an internal network of 2000 IP addresses and one day the
company changes its ISP and thus the addresses assigned to it. Even if most of the addressing
is handled by DHCP, changing the address scheme is going to have an impact on operations.
Addressing stability can be achieved by:
Keeping the same provider - this would depend on the reason for the change. If the cost of
this provider has become too expensive this is unlikely. If the ISP is out of business it
becomes impossible.
Transfer the addresses from the old provider to the new one - There is little motivation for an
ISP to do you a favor for not doing business with them.
Get your own autonomous system number - this can be too expensive for smaller
organizations.
NAT - this is the only one on the list that is in the control of IT.
There are differences between NAT66 and IPv4 NAT. Because there is no shortage of addresses
most organizations will be given a /48 network that can be translated into another /48 network.
This allows for a one to one translation, no need for port forwarding. This is a good thing
because port forwarding is more complicated in IPv6. In fact, NAT66 will actually just be the
rewriting of the prefix on the address.
Example:
If your current IPv6 address is
2001:db8:cafe::/48
you could change it to
2001:db8:fea7::/48
There is an exception to the one to one translation. NAT66 cannot translate internal networks
that contain 0xffff in bits 49 through 63 - this is due to the way checksums are calculated in
TCP/IP: they use the one's-complement representation of numbers which assigns the value
zero to both 0x0000 and 0xffff.
To give you idea of what happens to a packet as it makes its way through the FortiGate unit here
is a brief overview. This particular trip of the packet is starting on the Internet side of the
FortiGate firewall and ends with the packet exiting to the Internal network. An outbound trip
would be similar. At any point in the path if the packet is going through what would be
considered a filtering process and if fails the filter check the packet is dropped and does not
continue any further down the path.
Fortinet Technologies Inc. Page 904 FortiOS Handbook - Firewall for FortiOS 5.0
This information is covered in more detail in other in the Troubleshooting chapter of the FortiOS
Handbook in the Life of a Packet section.
The incoming packet arrives at the external interface. This process of entering the device is
referred to as ingress.
Step #1 - Ingress
1. Denial of Service Sensor
2. IP integrity header checking
3. IPSec connection check
4. Destination NAT
5. Routing
Step #4 - Egress
1. IPSec
2. Source NAT
3. Routing
FortiGate Modes
The FortiGate unit has a choice of modes that it can be used in, either NAT/Route mode or
Transparent mode. The FortiGate unit is able to operate as a firewall in both modes, but some of
Fortinet Technologies Inc. Page 905 FortiOS Handbook - Firewall for FortiOS 5.0
its features are limited in Transparent mode. It is always best to choose which mode you are
going to be using at the beginning of the set up. Once you start configuring the device, if you
want to change the mode you are going to lose all configuration settings in the change process.
NAT/Route Mode
NAT/Route mode is the most commonly used mode by a significant margin and is thus the
default setting on the device. As the name implies the function of NAT is commonly used in this
mode and is easily configured but there is no requirement to use NAT. The FortiGate unit
performs network address translation before IP packets are sent to the destination network.
These are some of the characteristics of NAT/Route mode:
Typically used when the FortiGate unit is a gateway between private and public networks.
Can act as a router between multiple networks within a network infrastructure.
When used, the FortiGate unit is visible to the networks that is connected to.
Each logical interface is on a distinct subnet.
Each Interface needs to be assigned a valid IP address for the subnet that it is connected to
it.
Transparent Mode
Transparent mode is so named because the device is effectively transparent in that it does not
appear on the network in the way that other network devices show as a nodes in the path of
network traffic. Transparent mode is typically used to apply the FortiOS features such as
Security Profiles etc. on a private network where the FortiGate unit will be behind an existing
firewall or router.
These are some of the characteristics of Transparent mode:
The FortiGate unit is invisible to the network.
All of its interfaces are on the same subnet and share the same IP address.
The FortiGate unit uses a Management IP address for the purposes of Administration.
Still able to use NAT to a degree, but the configuration is less straightforward
In Transparent mode, you can also perform NAT by creating a security policy or policies that
translates the source addresses of packets passing through the FortiGate unit as well as virtual
IP addresses and/or IP pools.
Quality of Service
The Quality of Service (QoS) feature allows the management of the level of service and
preference given to the various types and sources of traffic going through the firewall so that the
traffic that is important to the services and functions connecting through the firewall gets the
treatment required to ensure the level of quality that is required. QoS can be helpful for
organizations that are trying to manage their voice and streaming multi-media traffic, which can
rapidly consume bandwidth. Both voice and streaming multi-media are sensitive to latency.
FortiGate units support QoS using traffic policing, traffic shaping, and queuing.
Traffic policing
Packets are dropped that do not conform to bandwidth limitations
Fortinet Technologies Inc. Page 906 FortiOS Handbook - Firewall for FortiOS 5.0
Traffic Shaping
Assigning minimum levels of bandwidth to be allocated to specific traffic flows to guarantee
levels of service or assigning maximum levels of bandwidth to be allocated to specific traffic
flows so that they do not impede other flows of traffic.
This helps to ensure that the traffic may consume bandwidth at least at the guaranteed rate by
assigning a greater priority queue if the guarantee is not being met. Traffic shaping also ensures
that the traffic cannot consume bandwidth greater than the maximum at any given instant in
time. Flows that are greater than the maximum rate are subject to traffic policing.
Queuing
Assigning differing levels of priority to different traffic flows so that traffic flows that are
adversely effected by latency are prevented from being effected by traffic flows that are not
subject to the effects of latency. All traffic in a higher priority traffic queue must be completely
transmitted before traffic in lower priority queues will be transmitted.
An example of where you would want to use something like this is if you had competing traffic
flows of Voice over IP traffic and email traffic. The VoIP traffic is highly susceptible to latency
issues. If you have a delay of a few seconds it is quickly noticeable when it is occurring. Email
on the other hand can have a time delay of much longer and it is highly unlikely that it will be
noticed at all.
By default, the priority given to any traffic is high, so if you want to give one type of traffic
priority over all other traffic you will need to lower the priority of all of the other traffic.
For additional information about QoS, see the Traffic Shaping chapter of the FortiOS Handbook.
A Firewall is a gateway device that may be the nexus point for more than 2 networks. The
interface that the traffic is coming in on and should be going out on is a fundamental concern
for the purposes of routing as well as security. Routing, policies and addresses are all
associated with interfaces. The interface is essentially the connection point of a subnet to the
FortiGate unit and once connected can be connected to other subnets.
Physical interfaces or not the only ones that need to be considered. There are also virtual
interfaces that can be applied to security policies. VLANs are one such virtual interface.
Interfaces if certain VPN tunnels are another.
Polices are the foundation of the traffic control in a firewall and the Interfaces and addressing is
the foundation that policies are based upon. Using the identity of the interface that the traffic
connects to the FortiGate unit tells the firewall the initial direction of the traffic. The direction of
the traffic is one of the determining factors in deciding how the traffic should be dealt with. You
can tell that interfaces are a fundamental part of the policies because, by default, this is the
criteria that the polices are sorted by.
Zones are a mechanism that was created to help in the administration of the firewalls. If you
have a FortiGate unit with a large number of ports and a large number of nodes in you network
the chances are high that there is going to be some duplication of policies. Zones provide the
option of logically grouping multiple virtual and physical FortiGate firewall interfaces. The zones
can then be used to apply security policies to control the incoming and outgoing traffic on those
interfaces. This helps to keep the administration of the firewall simple and maintain consistency.
Fortinet Technologies Inc. Page 907 FortiOS Handbook - Firewall for FortiOS 5.0
For example you may have several floors of people and each of the port interfaces could go to a
separate floor where it connects to a switch controlling a different subnet. The people may be
on different subnets but in terms of security they have the same requirements. If there were 4
floors and 4 interfaces a separate policy would have to be written for each floor to be allowed
out on to the Internet off the WAN1 interface. This is not too bad if that is all that is being done,
but now start adding the use of more complicated policy scenarios with Security Profiles, then
throw in a number of Identity based issues and then add the complication that people in that
organization tend to move around in that building between floors with their notebook
computers. Each time a policy is created for each of those floors there is a chance of an
inconsistency cropping up. Rather than make up an additional duplicate set of policies for each
floor, a zone can be created that combines multiple interfaces. And then a single policy can
created that uses that zone as one side of the traffic connection.
Fortinet Technologies Inc. Page 908 FortiOS Handbook - Firewall for FortiOS 5.0
Firewall objects
As was mentioned earlier, the components of the FortiGate firewall go together like interlocking
building blocks. The Firewall objects are a prime example of those building blocks. They are
something that can be configured once and then used over and over again to build what you
need. They can assist in making the administration of the FortiGate unit easier and more
intuitive as well as easier to change. By configuring these objects with their future use in mind
as well as building in accurate descriptions the firewall will become almost self documenting.
That way, months later when a situation changes, you can take a look at a policy that needs to
change and use a different firewall object to adapt to the new situation rather than build
everything new from the ground up to accommodate the change.
This chapter includes information about the following Firewall objects:
Addresses
Services and TCP ports
Firewall schedules
Security profiles
Addresses
Firewall addresses define sources and destinations of network traffic and are used when
creating policies. When properly set up these firewall objects can be used with great flexibility to
make the configuration of firewall policies simpler and more intuitive. The FortiGate unit
compares the IP addresses contained in packet headers with a security policys source and
destination addresses to determine if the security policy matches the traffic.
The addresses in the FortiGate unit can include:
IPv4 addresses
IPv6 addresses
IPv4 Address Groups
IPv6 Address Groups
IP Pools
Virtual IP Addresses
Geography based addresses
Wildcard addresses and netmasks
Fully Qualified Domain Name addresses
When setting up an address one of the parameters that is asked for is the interface. This means
that the system will expect to see that address only on the interface that you select. You can
only select one interface. If you expect that the address may be seen at more than one interface
you can choose the any interface option. Whenever, possible it is best to choose a more
specific interface than the any option because in the GUI configuration of firewall policies
there is a drop down field that will show the possible addresses that can be used. The drop
down will only show those addresses that can be on the interface assigned for that interface in
the policy.
Page 909
Example:
You have an address called XYZ
XYZ is set to the WAN1 interface because that is the only interface that will be able to
access that address.
When you are selecting a Source Address in the Web-based Manager for a policy that is
using the DMZ the address XYZ will not be in the drop-down menu.
When there are only 10 or 20 addresses this is not a concern, but if there are a few hundred
addresses configured it can make your life easier.
Addresses, address groups, and virtual IPs must have unique names to avoid confusion in
firewall policies. If an address is selected in a policy, the address cannot be deleted until it is
deselected from the policy.
Fortinet Technologies Inc. Page 910 FortiOS Handbook - Firewall for FortiOS 5.0
It is also possible to describe a range of IP addresses with a subnet. This would be a continuous
set of IP addresses within a subnet. It does not have to include the whole subnet. The formats
would be (the * being used as a wildcard character):
x.x.x.x-x.x.x.x, such as 192.168.110.100-192.168.110.120
x.x.x.[x-x], such as 192.168.110.[100-120]
x.x.x.*, such as 192.168.110.*
FQDN Addressing
By using Fully Qualified Domain Name (FQDN) addressing you can take advantage of the
dynamic ability of the service to keep up with address changes without having to manually
change the addresses on the FortiGate. FQDN addresses are most often used with external
web sites but they can be used for internal web sites as well if there is a trusted DNS server that
can be accessed. FQDN addressing also comes in handy for large web sites that may use
multiple addresses and load balancers for their web sites. The FortiGate firewall automatically
maintains a cached record of all the addresses resolved by the DNS for the FQDN addresses
used.
For example, if you were doing this manually and you wanted to have a security policy that
involved Google you could track down all of the IP addresses that they use across multiple
countries. Using the FQDN address is simpler and more convenient.
When representing hosts by an FQDN, the domain name can also be a subdomain, such as
mail.example.com.
Valid FQDN formats include:
<host_name>.<top_level_domain_name> such as example.com
<host_name>.<second_level_domain_name>.<top_level_domain_name>, such as
mail.example.com
When creating FQDN entries it is important to remember that:
Wildcards are not supported in FQDN address objects
While there is a level of convention that would imply it, www.example.com is not
necessarily the same address of example.com. they will each have their own records on
the DNS server.
The FortiGate firewall keeps track of the DNS TTLs so as the entries change on the DNS servers
the IP address will effectively be updated for the FortiGate. As long as the FQDN address is
used in a security policy, it stores the address in the DNS cache.
There is a possible security downside to using FQDN addresses. Using a fully qualified domain
name in a security policy means that your policies are relying on the DNS server to be accurate
and correct. DNS servers in the past were not seen as potential targets because the thinking
was that there was little of value on them and therefore are often not as well protected as some
other network resources. People are becoming more aware that the value of the DNS server is
that in many ways it controls where users and computers go on the Internet. Should the DNS
server be compromised, security policies requiring domain name resolution may no longer
function properly.
Fortinet Technologies Inc. Page 911 FortiOS Handbook - Firewall for FortiOS 5.0
from where in that country, you can filter out any connections coming in that are from outside
that country.
On the other side of the equation, if you find that you are constantly being attacked by malicious
intruders from a few countries that you have no dealings with you can block access to them
before any traffic comes through.
The matching of geographical country designations to an IP address is achieved by collecting
data from any IP addresses that connect to any of the FortiGuard Servers throughout the world.
As a secondary task, when a FortiGuard server connects to an IP it also does a search on the
Country of origin for the address and updates the database.
There is no single comprehensive list of IP addresses and their locations available because IP
addresses can be transferred between ISPs or countries and some organization may not keep
complete or up-to-date records regarding locations. FortiGuard Services are constantly
updating their database of addresses matched to locations, but the database is dynamic and
there may be addresses that have not been resolved to a location. While this means that there
can be gaps in the completeness of the database it is possible to fill them in manually by means
local to your FortiGate unit.
IPv6 does not support geography-based addressing. This feature is for IPv4 addresses only.
If you are trying to block addresses the principle works just the same. Your logs show that
someone from IP address x.x.x.x has been trying to connect inappropriately to your network.
You use a IP locator web site to determine that they have been attempting to connect from
Country X. Up until now they have not been successful, but you dont deal with the country
they are connecting from so dont mind blocking the whole country. Create an address group
that is designed for Blocking Access to any addresses in it, then add the geographical address
for Country X. Even if the policy does not block every single IP address from that country you
have greatly increased your odds of blocking potential intrusion attempts. As your logs show
other attempts you can look them up in an IP locator web site and if they are from the same
country you can add the IP address for the subnet that they are connecting from.
Address Groups
Address groups are designed for ease of use in the administration of the device. If you have a
number of addresses or address ranges that will commonly be treated the same or require the
same security policies, you can put them into address groups, rather than entering multiple
individual addresses in each policy refers to them.
The use of groups is not required. If you have a number of different addresses you could add
them individually to a policy and the FortiGate firewall will process them just as quickly and
efficiently as if they were in a group, but the chances are that if you have used a group once you
could need to use it again and depending on the number of addresses involved entering them
individually for each policy can become tedious and the likelihood of an address being missed
becomes greater. If you have a number of policies using that combination of addresses it is
much easier to add or subtract addresses from the group than to try and remember all of the
firewall policies that combination of addresses was used in. With the group, you only have to
make the one edit and it is used by any firewall policy using that address group.
Fortinet Technologies Inc. Page 912 FortiOS Handbook - Firewall for FortiOS 5.0
Because security policies require addresses with homogenous network interfaces, address
groups should contain only addresses bound to the same network interface, or to Any.
For example, if address 1.1.1.1 is associated with port1, and address 2.2.2.2 is associated with
port2, they cannot be in the same group. However, if 1.1.1.1 and 2.2.2.2 are configured with an
interface of Any, they can be grouped, even if the addresses involve different networks.
IPv4 address groups and IPv6 address groups are created and treated separately. You cannot
mix IPv4 firewall addresses and IPv6 firewall addresses in the same address group. Because
the Internet is currently based on IPv4 addresses IPv6 address groups cannot include FQDN or
Geography based addresses.
Wildcard Addressing
Wildcard addresses are addresses that identify ranges of IP addresses, reducing the amount of
firewall addresses and security policies required to match some of the traffic on your network.
Wildcard addresses are an advanced feature, usually required only for complex networks with
complex firewall filtering requirements. By using these wildcard addresses in the firewall
configuration, administrators can eliminate creating multiple, separate IP based address objects
and then grouping them to then apply to multiple security policies.
A wildcard address consists of an IP address and a wildcard netmask, for example,
192.168.0.56 255.255.0.255. In this example, the IP address is 192.168.0.56 and the wildcard
netmask is 255.255.0.255. The IP address defines the networks to match and the wildcard
netmask defines the specific addresses to match on these networks.
In a wildcard netmask, zero means ignore the value of the octet in the IP address, which means
the wildcard firewall address matches any number in this address octet. This also means that
the number included in this octet of IP address is ignored and can be any number. Usually, if the
octet in the wildcard netmask is zero, the corresponding octet in the IP address is also zero.
In a wildcard netmask, a number means match addresses according to how the numbers
translate into binary addresses. For example, the wildcard netmask is 255; the wildcard address
will only match addresses with the value for this octet that is in the IP address part of the
wildcard address. So, if the first octet of the IP address is 192 and the first octet of the wildcard
netmask is 255, the wildcard address will only match addresses with 192 in the first octet.
In the above example, the wildcard address 192.168.0.56 255.255.0.255 would match the
following IP addresses:
192.168.0.56, 192.168.1.56, 192.168.2.56,..., 192.168.255.56
The wildcard addresses 192.168.0.56 255.255.0.255 and 192.168.1.56 255.255.0.255 define
the same thing since the 0 in the wildcard mask means to match any address in the third octet.
If we use the wildcard address 172.0.20.10 255.0.255.255, it would match the following IP
addresses:
172.1.20.10, 172.2.20.10, 172.3.20.10,..., 172.255.20.10
In a wildcard netmask, a number other than 255 matches multiple addresses for this octet. You
can perform a binary conversion to calculate the addresses that would be matched by a given
Fortinet Technologies Inc. Page 913 FortiOS Handbook - Firewall for FortiOS 5.0
value. For example, to create the IP address and wildcard netmask to match the following
network addresses:
192.168.32.0/24
192.168.33.0/24
192.168.34.0/24
192.168.35.0/24
192.168.36.0/24
192.168.37.0/24
192.168.38.0/24
192.168.39.0/24
Table 45 shows how to write the third octet for these networks according to the octet bit
position and address value for each bit.
Table 45: Octet bit position and address value for each bit
Decimal 128 64 32 16 8 4 2 1
32 0 0 1 0 0 0 0 0
33 0 0 1 0 0 0 0 1
34 0 0 1 0 0 0 1 0
35 0 0 1 0 0 0 1 1
36 0 0 1 0 0 1 0 0
37 0 0 1 0 0 1 0 1
38 0 0 1 0 0 1 1 0
39 0 0 1 0 0 1 1 1
M M M M M D D D
Since the first five bits match, the networks can be summarized into one network
(192.168.32.0/21 or 192.168.32.0 255.255.248.0). All eight possible combinations of the three
low-order bits are relevant for the network ranges. The wildcard address that would match all of
these subnet addresses can be written as 192.168.32.0 255.255.248.0.
Wildcard addresses are similar to routing access list wildcard masks. You add routing access
lists containing wildcard masks using the config router access list command.
However, router access list wildcard masks use the inverse of the masking system used for
firewall wildcard addresses. For the router access list wildcard masks, zero (0)means match all
IP addresses and one (1)means ignore all IP addresses. So to match IP addresses
192.168.0.56, 192.268.1.56, 192.168.2.56,... 192.168.255.56 you would use the following router
access IP address prefix and wildcard mask: 192.168.0.56 0.0.255.0.
Wildcard firewall addresses are configured only in the CLI. The following is an example of how
to configure a wildcard firewall address.
config firewall address
edit example_wildcard_address
set type wildcard
set wildcard 192.168.0.56 255.255.0.255
end
Fortinet Technologies Inc. Page 914 FortiOS Handbook - Firewall for FortiOS 5.0
Virtual IP Addresses (VIPs)
The mapping of a specific IP address to another specific IP address is usually referred to as
Destination NAT. FortiOS has a component that is a bit more specialized along this line called a
Virtual IP Address, sometimes referred to as a VIP. FortiOS uses a Virtual IP address to map an
External IP address to an IP address. This address does not have to be an individual host, it can
also be an address range. This mapping can include all TCP/UDP ports or if Port Forwarding is
enabled it will only refer to the specific ports configured.
Virtual IP addresses are typically used to NAT external or Public IP addresses to internal or
Private IP addresses. Using a Virtual IP address between 2 internal Interfaces made up of
Private IP addresses is possible but there is rarely a reason to do so as the 2 networks can just
use the IP addresses of the networks without the need for any address translation. Using a
Virtual IP address for traffic going from the inside to the Internet is even less likely to be a
requirement, but it is supported.
Something that needs to be considered when there are multiple Public IP addresses on the
external interface(s) is that when a Virtual IP address is used without Port Forwarding enabled
there is a reciprocal effect as far as traffic flow is concerned. Normally, on a firewall policy where
NAT is enabled, for outgoing traffic the internal address is translated to the Public address that
is assigned to the FortiGate, but if there is a Virtual IP address with no port forwarding enabled,
then the Internal IP address in the Mapped field would be translated to the IP address
configured as the External Address in the VIP settings.
Best practice: Put any policies with a VIP right at the beginning of the policy list, with nothing
before them. VIP traffic is processed first, before the regular rules of order in policies are
applied. The sequence of the policies not containing VIPS will not effect those that do contain
VIPS, regardless of the order they are in. Put VIP policies before any others to remind yourself of
where they really are in the sequence.
For more on this topic, read the Exception to policy order (VIPs) on page 956.
Example:
The assigned External address (WAN1) of the FortiGate unit is 172.12.96.3 with a subnet
mask of 255.255.255.128
There is a Virtual IP address set up to map the external address 172.12.96.127 on WAN1 to
the internal IP address of 192.168.1.127
Port Forwarding is not enabled because you want all allowed traffic going to the external IP
address to go to this server.
In this case any outbound traffic from 192.168.1.127 will go out on WAN1 with the IP address of
172.12.96.127 as the source IP address.
In terms of actually using the Virtual IP address, they would be using in the security policies in
the same places that other addresses would be used, usually as a Destination Address.
There is another type of address that the term virtual IP address commonly refers to which is
used in load balancing and other similar configurations. In those cases, a number of devices
share a separately created virtual IP address that can be sent to multiple possible devices. In
FortiOS these are referred to as Virtual Servers and are configured in the Load Balance
section.
Virtual IP Groups
Just like other address, Virtual IP addresses can be organized into groups for ease of
administration. If you have multiple virtual IPs that are likely to be associated to common firewall
policies rather than add them individually to each of the policies you can add the instead. That
Fortinet Technologies Inc. Page 915 FortiOS Handbook - Firewall for FortiOS 5.0
way, if the members of the group change then any changes made to the group will propagate to
all of the polices using that group.
When using a Virtual IP address group the firewall policy will take into account all of the
configured parameters of the Virtual IPs: IP addresses, Ports and port types.
IP Pools
IP Pools are a mechanism that allow sessions leaving the FortiGate Firewall to use NAT. An IP
pool defines a single IP address or a range of IP addresses to be used as the source address for
the duration of the session. These assigned addresses will be used instead of the IP address
assigned to that FortiGate interface.
When using IP pools for NATing, there is a limitation that must be taken into account when
configuring the pool. If the IP address(es) within the pool are different from the IP address(es)
that are assigned to the interface communications based on those IP addresses will fail. For
example if the IP addresses assigned to an interface are 172.16.100.1 -172.16.100.14, you
cannot choose 10.11.12.50 - 10.11.12.59 for the IP pool.
There are 4 types of IP Pools that can be configured on the FortiGate firewall:
One-to-One - in this case the only internal address used by the external address is the
internal address that it is mapped to.
Overload - this is the default setting. Internal addresses other than the one designated in the
policy can use this address for the purposes of NAT.
Fixed Port Range - rather than a single address to be used, there is a range of addresses
that can be used as the NAT address. These addresses are randomly assigned as the
connections are made.
Port Block Allocation - this setting is used to allocate a block of port numbers for IP pool
users. Two variables will also have to be set. The block size can be set from 64 to 4096 and
as the name implies describes the number of ports in one block of port numbers. The
number of blocks per user determines how many of these blocks will be assigned. This
number can range from 1 to 128.
Be careful when calculating the values of the variables. The maximum number of ports that are
available on an address is 65,536. If you chose the maximum value for both variables you will
get a number far in excess of the available port numbers.
4096 x 128 = 524,288
One of the more common examples is when you have an email server behind your FortiGate
firewall and the range of IP addresses assigned to you by your ISP is more than one. If an
organization is assigned multiple IP addresses it is normally considered a best practice to
assign a specific address other than the one used for the Firewall to the mail server. However,
when normal NAT is used the address assigned to the firewall is also assigned to any outbound
sessions. Anti-spam services match the source IP address of mail traffic that they receive to the
MX record on DNS servers as an indicator for spam. If there is a mismatch the mail may not get
through so there is a need to make sure that the NATed address assigned matches the MX
record.
You can also use the Central NAT table as a way to configure IP pools.
Fortinet Technologies Inc. Page 916 FortiOS Handbook - Firewall for FortiOS 5.0
Scenario 1:
The number of source addresses equals that of IP pool addresses
In this case, the FortiGate unit always matches the IP addressed one to one.
If you enable fixed port in such a case, the FortiGate unit preserves the original source port. This
may cause conflicts if more than one security policy uses the same IP pool, or the same IP
addresses are used in more than one IP pool.
Scenario 2:
The number of source addresses is more than that of IP pool addresses
In this case, the FortiGate unit translates IP addresses using a wrap-around mechanism. If you
enable fixed port in such a case, the FortiGate unit preserves the original source port. But
conflicts may occur since users may have different sessions using the same TCP 5 tuples.
Scenario 3:
The number of source addresses is fewer than that of IP pool addresses
In this case, some of the IP pool addresses are used and the rest of them are not be used.
ARP Replies
If a FortiGate firewall interface IP address overlaps with one or more IP pool address ranges, the
interface responds to ARP requests for all of the IP addresses in the overlapping IP pools. For
example, consider a FortiGate unit with the following IP addresses for the port1 and port2
interfaces:
port1 IP address: 1.1.1.1/255.255.255.0 (range is 1.1.1.0-1.1.1.255)
port2 IP address: 2.2.2.2/255.255.255.0 (range is 2.2.2.0-2.2.2.255)
And the following IP pools:
IP_pool_1: 1.1.1.10-1.1.1.20
IP_pool_2: 2.2.2.10-2.2.2.20
IP_pool_3: 2.2.2.30-2.2.2.40
The port1 interface overlap IP range with IP_pool_1 is:
(1.1.1.0-1.1.1.255) and (1.1.1.10-1.1.1.20) = 1.1.1.10-1.1.1.20
The port2 interface overlap IP range with IP_pool_2 is:
(2.2.2.0-2.2.2.255) & (2.2.2.10-2.2.2.20) = 2.2.2.10-2.2.2.20
The port2 interface overlap IP range with IP_pool_3 is:
(2.2.2.0-2.2.2.255) & (2.2.2.30-2.2.2.40) = 2.2.2.30-2.2.2.40
And the result is:
The port1 interface answers ARP requests for 1.1.1.10-1.1.1.20
The port2 interface answers ARP requests for 2.2.2.10-2.2.2.20 and for 2.2.2.30-2.2.2.40
Select Enable NAT in a security policy and then select Dynamic IP Pool. Select an IP pool to
translate the source address of packets leaving the FortiGate unit to an address randomly
selected from the IP pool. Whether or not the external address of an IP Pool will respond to an
ARP request can be disabled. You might want to disable the ability to responded to ARP
requests so that these address cannot be used as a way into your network or show up on a port
scan.
Fortinet Technologies Inc. Page 917 FortiOS Handbook - Firewall for FortiOS 5.0
IP pools and zones
Because IP pools are associated with individual interfaces
IP pools cannot be set up for a zone. IP pools are connected to individual interfaces.
Fixed Port
Some network configurations do not operate correctly if a NAT policy translates the source port
of packets used by the connection. NAT translates source ports to keep track of connections for
a particular service.
However, enabling the use of a fixed port means that only one connection can be supported
through the firewall for this service. To be able to support multiple connections, add an IP pool,
and then select Dynamic IP pool in the policy. The firewall randomly selects an IP address from
the IP pool and assigns it to each connection. In this case, the number of connections that the
firewall can support is limited by the number of IP addresses in the IP pool.
Match-VIP
The match-vip feature allows the FortiGate unit to log virtual IP traffic that gets implicitly
dropped. This feature eliminates the need to create two policies for virtual IPs; one that allows
the virtual IP, and the other to get proper log entry for DROP rules.
For example, you have a virtual IP security policy and enabled the match-vip feature; the virtual
IP traffic that is not matched by the policy is now caught.
The match-vip feature is available only in the CLI. By default, the feature is disabled.
There are a number of different services and protocols in use on the Internet. The most
commonly known is HTTP which is used by web servers to transmit requests and responses for
unencrypted web pages. These services are set up to listen for requests on a numbered port.
These services and protocols can use any port from 1 to 65,535. To keep things simple for
everyone a large number of the more commonly used services started using a standardized list
of ports. For instance, though it is not required, by default, most web servers listen for HTTP
requests on port 80 and by default, web browsers will send HTTP traffic to port 80. If you wish
to use another port such as 8080 you would put :8080 at the end of the URL to indicate that
you want the browser to use 8080 instead of the default port.
Example:
Default URL for HTTP traffic when the web server is listening on the standard HTTP port:
http://fortinet.com
URL to the same address when the web server is listening for HTTP traffic on port 8080
http://fortinet.com:8080
Services represent typical traffic types and application packets that pass through the FortiGate
unit. Firewall services define one or more protocols and port numbers associated with each
service. Security policies use service definitions to match session types. You can organize
related services into service groups to simplify your security policy list.
Many well-known traffic types have been predefined on the FortiGate unit. If there is a service
that does not appear on the list you can create a service or edit an existing one. You need to
Fortinet Technologies Inc. Page 918 FortiOS Handbook - Firewall for FortiOS 5.0
know the ports, IP addresses or protocols of that particular service or application uses, to
create a service.
Best Practices
While you can edit a predefined service it is best to leave those ones alone and create a new
service and name it something similar such as the same service name with a descriptive
identifier appended.
Based on the previous example, instead of the name HTTP you could name the service
HTTP8080 or use the application that is using that port, HTTP-Application.
Categories
In order to make sorting through the services easier there is a field to categorize the services.
The services can be sorted into the following groups:
Uncategorized
General
Web Access
File Access
Email
Network Services
Authentication
Remote Access
Tunnelling
VoIP, Messaging and Other Applications
Protocol Types
One of the fundamental aspects of a service is the type of protocol that use used to define it.
When a service is defined one of the following categories of protocol needs to be determined:
TCP/UDP/SCTP
ICMP
ICMP6
IP
Depending on which of these protocol categories is choose another set of specifications will
can also be defined.
TCP/UDP/SCTP
This is the most commonly used service protocol category. Once this category has been
selected the other available options to choose are an address, either IP or FQDN, and the
protocol and port number.
The protocol will be TCP, UDP or SCTP.
ICMP or ICMP6
When ICMP or ICMP6 is chosen the available options are the ICMP Type and its code.
Fortinet Technologies Inc. Page 919 FortiOS Handbook - Firewall for FortiOS 5.0
IP
When IP is the chosen protocol type the addition option is the Protocol Number.
TCP
Transmission Control Protocol (TCP) is one of the core or fundamental protocols of the Internet.
It is part of the Transport Layer of the OSI Model. It is designed to provide reliable delivery of
data from a program on one device on the network or Internet to another program on another
device on the network or Internet. TCP achieves its reliability because it is a connection based
protocol. TCP is stream-oriented. It transports streams of data reliably and in order.
TCP establishes a prior connection link between the hosts before sending data. This is often
referred to as the handshake. Once the link is established the protocol uses checks to verify
that the data transmitted. If an error check fails the data is retransmitted. This makes sure that
the data is getting to the destination error free and in the correct order so that it can be put back
together into a form that is identical to the way they were sent.
TCP is configured more for reliability than for speed and because of this TCP will likely be
slower than a connectionless protocol such as UDP. This is why TCP is generally not used for
real time applications such as voice communication or online gaming.
Some of the applications that use TCP are:
World Wide Web (HTTP and HTTPS)
Email (SMTP, POP3, IMAP4)
Remote administration (RDP)
File transfer (FTP)
UDP
User Datagram Protocol (UDP) like TCP is one of the core protocols of the Internet and part of
the Transport Layer of the OSI Model. UDP is designed more for speed than reliability and is
generally used for different applications than TCP. UDP sends messages, referred to as
datagrams across the network or Internet to other hosts without establishing a prior
communication link. In other words, there is no handshake.
UDP is an unreliable service as the datagrams can arrive out of order, duplicated or go missing
without any mechanism to verify them. UDP works on the assumption that any error checking is
done by the application or is not necessary for the function of the application. This way it avoids
the overhead that is required to verify the integrity of the data.
This lack of overhead improves the speed of the data transfer and is why UDP is often used by
applications that are time sensitive in nature. UDP's stateless nature is also great for
applications that answer a large number of small queries from a large number of clients.
Common uses for UDP are:
Domain Name Resolution (DNS)
Time (NTP)
Streaming media (RTSP, RTP and RTCP)
Telephone of the Internet (VoIP)
File Transfer (TFTP)
Logging (SNMP)
Online games (GTP and OGP)
Fortinet Technologies Inc. Page 920 FortiOS Handbook - Firewall for FortiOS 5.0
SCTP
Stream Control Transmission Protocol (SCTP) is part of the Transport Layer of the OSI Model
just like TCP and UDP and provides some of the features of both of those protocols. It is
message or datagram orientated like UDP but it also ensures reliable sequential transport of
data with congestion control like TCP.
SCTP provides the following services:
Acknowledged error-free non-duplicated transfer of user data
Data fragmentation to conform to discovered path MTU size
Sequenced delivery of user messages within multiple streams, with an option for
order-of-arrival delivery of individual user messages
Optional bundling of multiple user messages into a single SCTP packet
Network-level fault tolerance through supporting of multi-homing at either or both ends of an
association
Congestion avoidance behavior and resistance to flooding and masquerade attacks
SCTP uses multi-streaming to transport its messages which means that there can be several
independent streams of messages traveling in parallel between the points of the transmission.
The data is sent out in larger chunks of data than is used by TCP just like UDP but the
messages include a sequence number within each message in the same way that TCP does so
that the data can be reassembled at the other end of the transmission in the correct sequence
without the data having to arrive in the correct sequence.
SCTP is effective as the transport protocol for applications that require monitoring and
session-loss detection. For such applications, the SCTP path and session failure detection
mechanisms actively monitor the connectivity of the session. SCTP differs from TCP in having
multi-homing capabilities at either or both ends and several streams within a connection,
typically referred to as an association. A TCP stream represents a sequence of bytes; an SCTP
stream represents a sequence of messages.
Some common applications of SCTP include supporting transmission of the following protocols
over IP networks:
SCTP is important in 3G and 4G/LTE networks (for example, HomeNodeB = FemtoCells)
SS7 over IP (for example, for 3G mobile networks)
SCTP is also defined and used for SIP over SCTP and H.248 over SCTP
Transport of Public Switched Telephone Network (PSTN) signaling messages over IP
networks.
SCTP is a much newer protocol. It was defined by the IETF Signaling Transport (SIGTRAN)
working group in 2000. It was introduced by RFC 3286 and more fully define by RFC 4960.
The FortiGate firewall can apply security policies to SCTP sessions in the same way as TCP and
UDP sessions. You can create security policies that accept or deny SCTP traffic by setting the
service to ALL. FortiOS does not include pre-defined SCTP services. To configure security
policies for traffic with specific SCTP source or destination ports you must create custom
firewall services for SCTP.
FortiGate units route SCTP traffic in the same way as TCP and UDP traffic. You can configure
policy routes specifically for routing SCTP traffic by setting the protocol number to 132. SCTP
policy routes can route SCTP traffic according to the destination port of the traffic if you add a
port range to the policy route.
You can configure a FortiGate unit to perform stateful inspection of different types of SCTP
traffic by creating custom SCTP services and defining the port numbers or port ranges used by
Fortinet Technologies Inc. Page 921 FortiOS Handbook - Firewall for FortiOS 5.0
those services. FortiGate units support SCTP over IPv4. The FortiGate unit performs the
following checks on SCTP packets:
Source and Destination Port and Verification Tag.
Chunk Type, Chunk Flags and Chunk Length
Verify that association exists
Sequence of Chunk Types (INIT, INIT ACK, etc)
Timer checking
Four way handshake checking
Heartbeat mechanism
Protection against INIT/ACK flood DoS attacks, and long-INIT flooding
Protection against association hijacking
FortiOS also supports SCTP sessions over IPSec VPN tunnels, as well as full traffic and event
logging for SCTP sessions.
ICMP
The Internet Control Message Protocol (ICMP) is a protocol layered onto the Internet Protocol
Suite to provide error reporting flow control and first-hop gateway redirection. It is normally
used by the operating systems of networked computers to send connectivity status query,
response and error messages. It is assigned protocol number 1. There is a version of the
protocol for both IPv4 and for IPv6. It is not designed to be absolutely reliable like TCP.
ICMP is not typically used for transporting data or for end-user network applications with the
exception of some diagnostic utilities such as ping and traceroute.
Fortinet Technologies Inc. Page 922 FortiOS Handbook - Firewall for FortiOS 5.0
ICMP messages are sent in several situations, for example:
when a datagram cannot reach its destination,
time exceeded messages
redirect messages
when the gateway does not have the buffering capacity to forward a datagram
when the gateway can direct the host to send traffic on a shorter route.
Some of the specific ICMP message types are:
ICMP_ECHO
ICMP_TIMESTAMP
ICMP_INFO_REQUEST
ICMP_ADDRESS
For ICMP error messages, only those reporting an error for an existing session can pass
through the firewall. The security policy will allow traffic to be routed, forwarded or denied. If
allowed, the ICMP packets will start a new session. Only ICMP error messages of a
corresponding security policy is available will be sent back to the source. Otherwise, the packet
is dropped. That is, only ICMP packets for a corresponding security policy can traverse the
FortiGate unit.
0 Echo Reply
1 Unassigned
2 Unassigned
Fortinet Technologies Inc. Page 923 FortiOS Handbook - Firewall for FortiOS 5.0
Table 46: ICMP Types and Codes (continued)
4 Source Quench
7 Unassigned
8 Echo
9 Router Advertisement
10 Router Selection
Fortinet Technologies Inc. Page 924 FortiOS Handbook - Firewall for FortiOS 5.0
Table 46: ICMP Types and Codes (continued)
13 Timestamp
14 Timestand Reply
15 Information Request
16 Information Reply
20 - 29 Reserved (for
Robustness
Experiment)
30 Traceroute
31 Datagram Conversion
Error
33 IPv6 Where-Are-You
34 IPv6 I-Am-Here
35 Mobile Registration
36 Mobile Registration
Reply
39 SKIP
40 Photuris
41 - 255 Reserved
ICMPv6
Internet Control Message Protocol version 6 (ICMPv6) is the new implementation of the Internet
Control Message Protocol (ICMP) that is part of Internet Protocol version 6 (IPv6). The ICMPv6
protocol is defined in RFC 4443.
Fortinet Technologies Inc. Page 925 FortiOS Handbook - Firewall for FortiOS 5.0
ICMPv6 is a multipurpose protocol. It performs such things as:
error reporting in packet processing
diagnostic functions
Neighbor Discovery process
IPv6 multicast membership reporting
It also designed as a framework to use extensions for use with future implementations and
changes.
Examples of extensions that have already been written for ICMPv6:
Neighbor Discovery Protocol (NDP) - a node discovery protocol in IPv6 which replaces and
enhances functions of ARP.
Secure Neighbor Discovery Protocol (SEND) - an extension of NDP with extra security.
Multicast Router Discovery (MRD) - allows discovery of multicast routers.
ICMPv6 messages use IPv6 packets for transportation and can include IPv6 extension headers.
ICMPv6 includes some of the functionality that in IPv4 was distributed among protocols such as
ICMPv4, ARP (Address Resolution Protocol), and IGMP (Internet Group Membership Protocol
version 3).
ICMPv6 has simplified the communication process by eliminating obsolete messages.
ICMPv6 messages are subdivided into two classes: error messages and information messages.
Error Messages are divided into four categories:
1. Destination Unreachable
2. Time Exceeded
3. Packet Too Big
4. Parameter Problems
Information messages are divided into three groups:
1. Diagnostic messages
2. Neighbor Discovery messages
3. Messages for the management of multicast groups.
Fortinet Technologies Inc. Page 926 FortiOS Handbook - Firewall for FortiOS 5.0
Type codes 0 127 are error messages and type codes 128 255 are for information
messages.
Table 47: ICMPv6 Types and Codes
1 Destination
Unreachable
Fortinet Technologies Inc. Page 927 FortiOS Handbook - Firewall for FortiOS 5.0
Table 47: ICMPv6 Types and Codes (continued)
139 ICMP Node Information 0 - The Data field contains an IPv6 address which is the
Query Subject of this Query.
1 - The Data field contains a name which is the Subject
of this Query, or is empty, as in the case of a NOOP.
2 - The Data field contains an IPv4 address which is the
Subject of this Query.
140
ICMP Node Information Response
0 - A successful reply. The Reply Data field may or may
not be empty.
1 - The Responder refuses to supply the answer. The
Reply Data field will be empty.
2 - The Qtype of the Query is unknown to the
Responder. The Reply Data field will be empty.
140 ICMP Node 0 - A successful reply. The Reply Data field may or may
not be empty.
Information Response
1 - The Responder refuses to supply the answer. The
Reply Data field will be empty.
2 - The Qtype of the Query is unknown to the
Responder. The Reply Data field will be empty.
Fortinet Technologies Inc. Page 928 FortiOS Handbook - Firewall for FortiOS 5.0
Table 47: ICMPv6 Types and Codes (continued)
Fortinet Technologies Inc. Page 929 FortiOS Handbook - Firewall for FortiOS 5.0
IP
Internet Protocol (IP) is the primary part of the Network Layer of the OSI Model that is
responsible for routing traffic across network boundaries. It is the protocol that is responsible
for addressing. IPv4 is probable the version that most people are familiar with and it has been
around since 1974. IPv6 is its current successor and due to a shortage of available IPv4
addresses compared to the explosive increase in the number of devices that use IP addresses,
IPv6 is rapidly increasing in use.
When IP is chosen as the protocol type the available option to further specify the protocol is the
protocol number. This is used to narrow down which protocol within the Internet Protocol Suite
and provide a more granular control.
Protocol Number
IP is responsible for more than the address that it is most commonly associated with and there
are a number of associated protocols that make up the Network Layer. While there are not 256
of them, the field that identifies them is a numeric value between 0 and 256.
In the Internet Protocol version 4 (IPv4) [RFC791] there is a field called Protocol to identify the
next level protocol. This is an 8 bit field. In Internet Protocol version 6 (IPv6) [RFC2460], this field
is called the Next Header field.
Table 48: Protocol Numbers
3 GGP Gateway-to-Gateway
5 ST Stream
7 CBT CBT
9 IGP Any private interior gateway (used by Cisco for their IGRP)
12 PUP PUP
13 ARGUS ARGUS
14 EMCON EMCON
16 CHAOS Chaos
Fortinet Technologies Inc. Page 930 FortiOS Handbook - Firewall for FortiOS 5.0
Table 48: Protocol Numbers
18 MUX Multiplexing
23 TRUNK-1 Trunk-1
24 TRUNK-2 Trunk-2
25 LEAF-1 Leaf-1
26 LEAF-2 Leaf-2
36 XTP XTP
40 IL IL Transport Protocol
Fortinet Technologies Inc. Page 931 FortiOS Handbook - Firewall for FortiOS 5.0
Table 48: Protocol Numbers
49 BNA BNA
51 AH Authentication Header
55 MOBILE IP Mobility
57 SKIP SKIP
62 CFTP CFTP
65 KRYPTOLAN Kryptolan
Fortinet Technologies Inc. Page 932 FortiOS Handbook - Firewall for FortiOS 5.0
Table 48: Protocol Numbers
81 VMTP VMTP
82 SECURE-VMTP SECURE-VMTP
83 VINES VINES
84 TTP TTP
85 NSFNET-IGP NSFNET-IGP
87 TCF TCF
88 EIGRP EIGRP
89 OSPFIGP OSPFIGP
Fortinet Technologies Inc. Page 933 FortiOS Handbook - Firewall for FortiOS 5.0
Table 48: Protocol Numbers
122 SM SM
125 FIRE
128 SSCOPMCE
129 IPLT
Fortinet Technologies Inc. Page 934 FortiOS Handbook - Firewall for FortiOS 5.0
Table 48: Protocol Numbers
134 RSVP-E2E-IGNORE
136 UDPLite
137 MPLS-in-IP
138 manet
139 HIP
140 Shim6
141 WESP
142 ROHC
255 Reserved
Service Groups
Just like some of the other firewall components, services can also be bundled into groups for
ease of administration.
Fortinet Technologies Inc. Page 935 FortiOS Handbook - Firewall for FortiOS 5.0
Example Scenario: Using FortiGate services to support Audio/Visual
Conferencing
The feature, and the transmitting of data for the purpose of, Tele-conferencing or Audio/Visual
Conferencing is covered by a number of standards:
The IETF standard known as the Binary Floor Control Protocol (BFCP).
RFC 4582, for SIP-based video devices
The ITU standard H.239 (for H.323-based video devices)
While these standards have been set up by various authoritative bodies and can take place on
different layers of the OSI model, they share common requirements that are addressed by the
FortiGate firewalls ability to manage the traffic and the protocols involved. This means that the
same ability that make the device RFC 4582 compliant makes it compliant with H.239 as well.
To demonstrate how services and service groups are used we show the setup of a firewall that
will need to support the connectivity of a video conferencing unit. The FortiGate does not
manipulate or change the content of the traffic but it does allow for the traffic to pass through
the device. In this case it allow for only the needed traffic to pass through the device so as to
allow the functionality of Audio Visual Conference call but not to allow other traffic through.
The theoretical location for this scenario is a hospital that hosts conferences and lectures from
doctors from all over the world, sometimes from multiple locations, using video conferencing
technology such as a Polycom Video Conference system. There is a special room set up with
dedicated Ethernet connectivity to the Internet. A hospital has a lot of sensitive information
going over its network so the setup has to be secure to prevent any chance of penetration.
The approach is fairly simple. The conference room has a dedicated port on the FortiGate (port
#7) and its own LAN. We will assume that the interface has already been configured properly.
Video conference traffic can come from the Internet to the Polycom in that room and traffic can
get out to the Internet, but traffic going to other areas of the hospital network have to go through
the FortiGate and traffic going from the Video Conference LAN is thoroughly filtered.
To give an idea of how extensive this can be, we will use an extreme case and include just about
all of the services that could be commonly used in one of these setups. The protocols listed
here may differ from other setups. It will depend on which features are being used and which
equipment is within the network. Always check the documentation that comes with the set up
before opening ports into your network.
VIP
In this particular case there is an IP address set aside for the conferencing system so a separate
VIP is not needed for every port. One Virtual IP will be created for the system and then only the
approved of protocols will be allows through the firewall.
Name Vid-Conf_Room216
Fortinet Technologies Inc. Page 936 FortiOS Handbook - Firewall for FortiOS 5.0
Creating an address for the subnet
In the same way that the VIP was created to identify and direct incoming traffic an address
should be created to identify the addresses of computer that will be in the Conference room.
This included computers on the LAN as well as the Teleconferencing equipment.
Go to Firewall Objects -> Address -> Addresses
Create New
Fill out the fields with the following information:
Category Address
Name Port7_subnet
Type Subnet
Interface port7
HTTP TCP 80
Fortinet Technologies Inc. Page 937 FortiOS Handbook - Firewall for FortiOS 5.0
UDP 5060
We need to add:
TCP 5060
Select OK to save
SIP
Select SIP
Select Edit
In the Protocol section add the additional protocol:
Protocol TCP/UDP/SCTP
Protocol TCP
Fortinet Technologies Inc. Page 938 FortiOS Handbook - Firewall for FortiOS 5.0
Destination Port - Low: 24
Select OK
Polycom Endpoints
Go to Firewall Objects -> Service -> Services
Create New
Fill in the fields of the new service with the following information:
Protocol TCP
Select OK
Other Services to add in the same way:
Table 49:
Fortinet Technologies Inc. Page 939 FortiOS Handbook - Firewall for FortiOS 5.0
Build the Service group by filing in the fields with the following information
Type Firewall
Members HTTP
(click in the drop SNMP
down menu to add
LDAP
the following
services) HTTPS
SYSLOG
Polycom API
Polycom Endpoints
LDAP secure communications
Win 2000 ILS Registration
Gatekeeper discovery
Audio Call Control
Polycom proprietary Global directory data
Polycom People+Content
HTTP Server Push
Name A-V_Conference-incoming
Select OK
In the newly created sensor, create a new IPS filter.
Severity Critical
High
Medium
Low
Target Server
OS Windows
Application IIS
other
Fortinet Technologies Inc. Page 940 FortiOS Handbook - Firewall for FortiOS 5.0
Protocol HTTP
Use the [Show LDAP
more...] option
SIP
SSL
H323
Based on these filters there should be somewhere in the neighborhood of 750 signatures that
the FortiGate will run traffic against in the IPS engine.
Policies
Incoming Policy
A policy has to be made to allow the traffic to come in from the Internet to connect to the
Tele-conferencing server equipment.
Go to Policy -> Policy -> Policy.
Create New
Fill out the fields with the following information:
Schedule always
Service A-V_Conference
Action ACCEPT
Logging Options Logging is a good idea but how much will depend on storage
capabilities.
Traffic Shaping, The use of these features will depend on your network environment and
Web cache, should be decided by the network architect, as the decision will largely
WAN Optimization, be based on network bandwidth, usage and importance of Video
Disclaimer: conferencing compared to other traffic.
Select OK.
Fortinet Technologies Inc. Page 941 FortiOS Handbook - Firewall for FortiOS 5.0
The policy will then need to be put in the correct position in the sequence of the policies.
Because it is a rather focused policy it should be acceptable to place it near the top of the
policy order sequence.
Outgoing Policy
A policy has to be made to allow the traffic to leave from the subnet in the conference room to
the Internet, not only for the traffic for the Tele-conferencing equipment but for normal traffic of
users on the Internet such as web research and email. The traffic is outgoing so there is less of
a need for an Intrusion Protection System filter, but check with the network architect in case
there is a need for using one of the other security profiles.
Go to Policy -> Policy -> Policy.
Create New
Fill out the fields with the following information:
Schedule always
Service any
Action ACCEPT
Logging Options Logging is a good idea but how much will depend on storage
capabilities.
Traffic Shaping, The use of these features will depend on your network environment and
Web cache, should be decided by the network architect, as the decision will largely
WAN Optimization, be based on network bandwidth, usage and importance of Video
Disclaimer: conferencing compared to other traffic.
Select OK.
The policy will then need to be put in the correct position in the sequence of the policies.
Firewall schedules
Firewall schedules control when policies are in effect. When you add a security policy on a
FortiGate unit you need to set a schedule to determine the time frame in which that the policy
Fortinet Technologies Inc. Page 942 FortiOS Handbook - Firewall for FortiOS 5.0
will be functioning. While it is not set by default, the normal schedule would be always. This
would mean that the policy that has been created is always function and always policing the
traffic going through the FortiGate.
The time component of the schedule is based on a 24 hour clock notation or military time as
some people would say.
There are two types of schedules: One-time schedules and recurring schedules.
One-Time schedules are in effect only once for the period of time specified in the schedule.
This can be useful for testing to limit how long a policy will be in effect in case it is not removed,
or it can be used for isolated events such as a conference where you will only need a temporary
infrastructure change for a few days.
The time frame for a One-time schedule is configured by using a start time which includes, Year
| Month | Day | Hour | Minute and a Stop time which includes the same variables. So while the
frequency of the schedule is only once it can last anywhere from 1 minute to multiple years.
Recurring schedules are in effect repeatedly at specified times of specified days of the week.
The Recurring schedule is based on a repeating cycle of the days of the week as opposed to
every x days or days of the month. This means that you can configure the schedule to be in
effect on Tuesday, Thursday, and Saturday but not every 2 days or on odd numbered days of
the month.
If a recurring schedule has a stop time that is earlier than the start time, the schedule will take
effect at the start time but end at the stop time on the next day. You can use this technique to
create recurring schedules that run from one day to the next.
Example
You want to schedule the use of Skype to only between noon (12:00) and 1 p.m. (13:00).
You could create a schedule that allows Skype traffic:
Starting at Hour:12 and Minute: 00
Stopping at Hour:13 and Minute: 00
Set for days of the week: Sunday | Monday |Tuesday |Wednesday | Thursday | Friday |
Saturday
Or you could have a schedule that blocks Skype traffic:
Starting at Hour:13 and Minute: 00 (and goes to the next day)
Stopping at Hour:12 and Minute: 00
Set for days of the week: Sunday | Monday |Tuesday |Wednesday | Thursday | Friday |
Saturday
Either way is effective for the task but other factors may make one method work better than
another in certain situations of it could be just a preference in approach.
Schedule Groups
You can organize multiple firewall schedules into a schedule group to simplify your security
policy list. The schedule parameter in the policy configuration does not allow for the entering of
multiple schedules into a single policy so if you have a combination of time frames that you
want to schedule the policy for then the best approach, rather than making multiple policies is
to use a schedule group.
Example
Your Internet policy allows employees to visit Social Media sites from company computers but
not during what is considered working hours. The offices are open a few hours before working
Fortinet Technologies Inc. Page 943 FortiOS Handbook - Firewall for FortiOS 5.0
hours and the doors are not locked until a few hours after official closing so work hours are from
9 to 5 with a lunch break from Noon to 1:00 p.m.
Your approach is to block the traffic between 9 and noon and between 1:00 p.m. and 5:00 p.m.
This means you will need two schedules for a single policy and the schedule group handles this
for you.
Schedule groups can contain both recurring and one-time schedules. Schedule groups cannot
contain other schedule groups.
Schedule Expiration
The schedule in a security policy enables certain aspects of network traffic to occur for a
specific length of time. What it does not do however, is police that time. That is, the policy is
active for a given time frame, and as long as the session is open, traffic can continue to flow.
For example, in an office environment, Skype use is allowed between noon and 1pm. During
that hour, any Skype traffic continues. As long as that session is open, after the 1pm end time,
the Skype conversations can continue, yet new sessions will be blocked. Ideally, the Skype
session should close at 1pm.
Using a CLI command you can set the schedule to terminate all sessions when the end time of
the schedule is reached. Within the config firewall command enter the command:
set schedule-timeout enable
By default, this is set to disable.
Security profiles
Where security policies provide the instructions to the FortiGate unit for controlling what traffic
is allowed through the device, the Security profiles provide the screening that filters the content
coming and going on the network. Security profiles enable you to instruct the FortiGate unit
about what to look for in the traffic that you dont want, or want to monitor, as it passes through
the device.
A security profile is a group of options and filters that you can apply to one or more firewall
policies. Security profiles can be used by more than one security policy. You can configure sets
of security profiles for the traffic types handled by a set of security policies that require identical
protection levels and types, rather than repeatedly configuring those same security profile
settings for each individual security policy.
For example, while traffic between trusted and untrusted networks might need strict antivirus
protection, traffic between trusted internal addresses might need moderate antivirus protection.
To provide the different levels of protection, you might configure two separate profiles: one for
traffic between trusted networks, and one for traffic between trusted and untrusted networks.
Security profiles are available for various unwanted traffic and network threats. Each are
configured separately and can be used in different groupings as needed. You configure security
profiles in the Security Profiles menu and applied when creating a security policy by selecting
the security profile type.
There is a separate handbook for the topic of the Security Profiles, but because the Security
Profiles are applied through the Firewall policies it makes sense to have at least a basic idea of
what the security profile do and how they integrate into the FortiGate's firewall policies. The
following is a listing and a brief description of what the security profiles offer by way of
functionality and how they can be configured into the firewall policies.
Fortinet Technologies Inc. Page 944 FortiOS Handbook - Firewall for FortiOS 5.0
AntiVirus
Antivirus is used as a catch all term to describe the technology for protection against the
transmission of malicious computer code sometimes referred to as malware. As anyone who
has listened to the media has heard that the Internet can be a dangerous place filled with
malware of various flavours. Currently, the malware that is most common in the Internet, in
descending order, is Trojan horses, viruses, worms, adware, back door exploits, spyware and
other variations. In recent years, not only has the volume of malicious software become greater
than would have been believed when it first appeared but the level of sophistication has risen as
well.
The Antivirus Filter works by inspecting the traffic that is about to be transmitted through the
FortiGate. To increase the efficiency of effort it only inspects the traffic being transmitted via the
protocols that it has been configured to check. Before the data moves across the FortiGate
firewall from one interface to another it is checked for attributes or signatures that have been
known to be associated with malware. If malware is detected, it is removed.
Web Filtering
Malicious code is not the only thing to be wary of on the Internet. There is also the actual
content. While the content will not damage or steal information from your computer there is still
a number of reasons that would require protection from it.
In a setting where there are children or other sensitive people using the access provided by a
connected computer there is a need to make sure that images or information that is not
appropriate is not inadvertently displayed to them. Even if there is supervision, in the time it
takes to recognize something that is inappropriate and then properly react can expose those we
wish to protect. It is more efficient to make sure that the content cannot reach the screen in the
first place.
In an organizational setting, there is still the expectation that organization will do what it can to
prevent inappropriate content from getting onto the computer screens and thus provoking an
Human Resources incident. There is also the potential loss of productivity that can take place if
people have unfiltered access to the Internet. Some organizations prefer to limit the amount of
distractions available to tempt their workers away from their duties.
The Web filter works primarily by looking at the destination location request for a HTTP(S)
request made by the sending computer. If the URL is on a list that you have configured to list
unwanted sites, the connection will be disallowed. If the site is part of a category of sites that
you have configured to deny connections to the session will also be denied. You can also
configure the content filter to check for specific key strings of data on the actual web site and if
any of those strings of data appear the connection will not be allowed.
Application Control
Application Control is designed to allow you to determine what applications are operating on
your network and to the also filter the use of these applications as required. Application control
is also for outgoing traffic to prevent the use of applications that are against an organizations
policy from crossing the network gateway to other networks. An example of this would be the
use of proxy servers to circumvent the restrictions put in place using the Web Filtering.
Fortinet Technologies Inc. Page 945 FortiOS Handbook - Firewall for FortiOS 5.0
When attack like behavior is detected it can either be dropped or just monitored depending on
the approach that you would like to take.
As new vulnerabilities are discovered they can be added to the IPS database so that the
protection is current.
Email Filtering
Spam or unsolicited bulk email is said to account for approximately 90% of the email traffic on
the Internet. Sorting through it is both time consuming and frustrating. By putting an email filter
on policies that handle email traffic, the amount of spam that users have to deal with can be
greatly reduced.
VoIP
Voice over IP is essentially the protocols for transmitting voice or other multimedia
communications over Internet Protocol networks such as the Internet. The Security Profiles
VoIP options apply the SIP Application Level Gateway (ALG) to support SIP through the
FortiGate unit. The SIP ALG can also be used to protect networks from SIP-based attacks.
ICAP
Internet Content Adaptation Protocol (ICAP) off loads HTTP traffic to another location for
specialized processing. The purpose of this module when triggered is to send the incoming
HTTP traffic over to a remote server to be processed thus taking some of the strain off of the
resources of the FortiGate unit. The reasons for the specialized process could be anything from
more sophisticated Antivirus to manipulation of the HTTP headers and URLs.
EndPoint Control
EndPoint Control makes sure that certain standards are kept. When a computer on the Internet
becomes connected to the FortiGate unit by VPN that computer is now part of the same
network and there for needs to be subject to the same levels of protection, not only to protect
the computer but the network. In the EndPoint Control section you can set the minimum
standards for thins like AntiVirus software and VPN software.
Fortinet Technologies Inc. Page 946 FortiOS Handbook - Firewall for FortiOS 5.0
Proxy Option Components
Any time a security profile that requires the use of a proxy is enabled the Proxy Options field will
be displayed. Certain inspections defined in security profiles require that the traffic be held in
proxy while the inspection is carried out and so the Proxy Options are there to define the
parameters of how the traffic will be processed and to what level the traffic will be processed. In
the same way that there can be multiple security profiles of a single type there can also be a
number of unique Proxy Option profiles so that as the requirements for a policy differ from one
policy to the next you can also configure a different Proxy Option profile for each individual
policy or you can use one profile repeatedly.
The Proxy Options refer to the handling of the following protocols:
HTTP
HTTPS
FTP
FTPS
IMAP
IMAPS
POP3
POP3S
SMTP
SMTPS
DNS
IM
NNTP
The configuration for each of these protocols is handled separately.
It should also be noted that these configuration apply to only the Security Profiles Proxy-based
processes and not the Flow-based processes.
Fortinet Technologies Inc. Page 947 FortiOS Handbook - Firewall for FortiOS 5.0
Invalid Certificate Log
This setting enables the logging of occurrences that have occurred in policies governed by the
proxy option profile that this setting is enabled in. As stated elsewhere in this document there
can be a number of reasons that a web site may have a certificate that registers as being invalid.
Because some administrators decide to allow users to access these sites it makes sense to
keep track of when it happens. This does not prevent the accessing of web sites with an invalid
certificate. It just allows for logging when it happens.
Port
While each of the protocols listed has a default TCP port that is commonly used, the level of
granularity of control on the FortiGate firewall allows that the port used by the protocols can be
individually modified in each separate Profile.
Comfort Clients
When proxy-based antivirus scanning is enabled, the FortiGate unit buffers files as they are
downloaded. Once the entire file is captured, the FortiGate unit begins scanning the file. During
the buffering and scanning procedure, the user must wait. After the scan is completed, if no
infection is found, the file is sent to the next step in the process flow. If the file is a large one this
part of the process can take some time. In some cases enough time that some users may get
impatient and cancel the download.
The comfort client feature to mitigates this potential issue by feeding a trickle of data while
waiting for the scan to complete so as to let the user know that processing is taking place and
that there hasnt been a failure in the transmission. This slow transfer rate continues until the
antivirus scan is complete. Once the file has been successfully scanned without any indication
of viruses the transfer will proceed at full speed.
If there is evidence of an infection the FortiGate unit caches the URL and drops the connection.
The client does not receive any notification of what happened because the download to the
client had already started. Instead, the download stops and the user is left with a partially
downloaded file. If the user tries to download the same file again within a short period of time,
the cached URL is matched and the download is blocked. The client receives the Infection
cache message replacement message as a notification that the download has been blocked.
The number of URLs in the cache is limited by the size of the cache.
Client comforting is available for HTTP and FTP traffic. If your FortiGate unit supports SSL
content scanning and inspection, you can also configure client comforting for HTTPS and FTPS
traffic.
Buffering the entire file allows the FortiGate unit to eliminate the danger of missing an infection
due to fragmentation because the file is reassembled before examination. Client comforting can
send unscanned and therefore potentially infected content to the client. You should only enable
client comforting if you are prepared to accept this risk. Keeping the client comforting interval
high and the amount low will reduce the amount of potentially infected data that is downloaded.
Fortinet Technologies Inc. Page 948 FortiOS Handbook - Firewall for FortiOS 5.0
processed by the Antivirus Security Profiles. Once a file is determined to be oversized it must be
then determined whether to allow it or to block it.
These settings are not a technical decision but a policy one that will depend on your comfort
level with letting files into your network. As there often is, there is a compromise between
convenience or ease of use and security. If you want to go for a high peace of mind level you
can configure the firewall to block oversized files and thus no files would be coming into the
network that have not been scanned. If you are looking for optimizing the memory of the
FortiGate unit and making sure that everybody is getting the files they want, you can lower the
threshold and allow files that are over the threshold.
It should be noted that in terms of probability that malware is more likely to be found in smaller
files than in larger files. A number of administrators take this into account when they lower the
default threshold so as to lessen the impact on memory if they see the FortiGate unit going into
conserve mode on a regular basis.
Chunked Bypass
The HTTP section allows the enabling of Chunked Bypass. This refers to the mechanism in
version 1.1 of HTTP that allows a web server to start sending chunks of dynamically generated
output in response to a request before actually knowing the actual size of the content. Where
dynamically generated content is concerned this means that there is a faster initial response to
HTTP requests. From a security stand point it means that the content will not be held in the
proxy as an entire file before proceeding.
Fortinet Technologies Inc. Page 949 FortiOS Handbook - Firewall for FortiOS 5.0
SSL/SSH Inspection
While the profile configuration for this is not found in the Security Profiles section but in the
Policy Section, it is set in the policy along with the security profiles. This sort of analysis is some
times referred to as deep scanning.
Deep Inspection works along the following lines. If your FortiGate unit has the correct chipset it
will be able to scan HTTPS traffic in the same way that HTTP traffic can be scanned. The
FortiGate firewall will essentially receive the traffic on behalf of the client and open up the
encrypted traffic. Once it is finished it re-encrypts the traffic and sends it on to its intended
recipient. It is very similar to a man-in-the-middle attack. By enabling this feature, it allows the
FortiGate firewall to filter on traffic that is using the HTTPS protocol.
Sometimes the regular web filter can be circumvented by using https:// instead of http:// in the
URL and this would prevent that circumvention. However, because when the encrypted traffic is
decrypted it has to be re-encrypted with the FortiGates certificate rather than the original
certificate it can cause errors because the name on the certificate does not match the name on
the web site.
At one point deep inspection was something that was either turned on or off. Now individual
deep inspection profiles can be created depending on the requirements of the policy.
Depending on the Inspection Profile, you can:
Configure which CA certificate will be used to decrypt the SSL encrypted traffic.
Configure which SSL protocols will be inspected.
Configure which ports will be associated with which SSL protocols for the purpose of
inspection.
Configure whether or not to allow invalid SSL certificates.
Configure whether or not SSH traffic will be inspected.
Fortinet Technologies Inc. Page 950 FortiOS Handbook - Firewall for FortiOS 5.0
SSL Inspection Options
4. Use the drop down menu for the CA Certificate field to choose the SSL Certificate to be
used by Policies that are associated with this profile.
5. Choose between
a. Inspecting all SSL protocol ports -- enable the check box
b. Enabling only specific SSL protocol ports -- enable which of the following protocol you
intend to inspect:
HTTPS
SMTPS
POP3S
IMAPS
FTPS
You can optionally edit the TCP/IP port numbers that you expect the traffic to be
travelling over.
SSH Inspection Options
6. Choose whether or not to enable SSH Deep Scan. If yes, enable the check box.
Once the check box is enabled a window will appear to be used in the configuring of:
SSH - across any port or only the specified one.
Exec - Block, Log or neither. Select using check boxes.
Port-Forward - Block, Log or neither. Select using check boxes.
SSH-Shell - Block, Log or neither. Select using check boxes.
X11-Filter - Block, Log or neither. Select using check boxes.
Common Options
7. Choose whether to Allow Invalid SSL Certificates. If yes, enable the check box.
8. Select OK.
The Enable SSH Deep Scan feature is enabled by default when creating a new SSL/SSH
Inspection profile. There are situations were this feature can cause issues so be sure that you
would like it enabled before applying it.
Fortinet Technologies Inc. Page 951 FortiOS Handbook - Firewall for FortiOS 5.0
Security policies
One of the foundations upon which a firewall works is the use of policies. These are what bring
the other firewall objects and components together into an elegant mechanism for the
governing of the traffic going through the network.
This Chapter includes information on the following topics:
Firewall policies
Identity Based Policies
Device Identity Policies
VPN Policies
Interface Policies
One-Arm IDS
Local-In Policies
Security Policy 0
Deny Policies
Accept Policies
IPv6 Policies
Fixed Port
Endpoint Security
Traffic Logging
Quality of Service
Policy Monitor
Firewall policies
The firewall policy is the axis around which most of the other features of the FortiGate firewall
revolve. A large portion of the settings in the firewall at some point will end up relating to or
being associated with the firewall policies and the traffic that they govern. Any traffic going
through a FortiGate unit has to be associated with a policy. These policies are essentially
discrete compartmentalized sets of instructions that control the traffic flow going through the
firewall. These instructions control where the traffic goes, how its processed, if its processed
and even whether or not its allowed to pass through the FortiGate.
When the firewall receives a connection packet, it analyzes the packets source address,
destination address, and service (by port number). It also registers the incoming interface, the
outgoing interface it will need to use and the time of day. Using this information the FortiGate
firewall attempts to locate a security policy that matches the packet. If it finds a policy that
matches the parameters it then looks at the action for that policy. If it is ACCEPT the traffic is
allowed to proceed to the next step. If the Action is DENY or a match cannot be found the traffic
is not allowed to proceed.
The 2 basic actions at the initial connection are either ACCEPT or DENY:
If the Action is ACCEPT, the policy action permits communication sessions. There may be
other packet processing instructions, such as requiring authentication to use the policy.
Page 952
While you may not see it in the configuration there is the implied subset of the ACCEPT
Action that include VPN policies, whether they be an IPSec VPN or SSL.
If the Action is DENY, the policy action blocks communication sessions, and you can
optionally log the denied traffic. If no security policy matches the traffic, the packets are
dropped. A DENY security policy is needed when it is required to log the denied traffic, also
called violation traffic.
The policy may contain a number of instructions for the FortiGate firewall in addition to the
ACCEPT or DENY actions, some of which are optional. Instructions on how to process the
traffic can also include such things as:
Logging Traffic
Authentication
Network Address Translation or Port Address Translation
Use Virtual IPs or IP Pools
Caching
Whether to use address or Identity based rules
Whether to treat as regular traffic or VPN traffic
What certificates to use
Security profiles to apply
Proxy Options
Traffic Shaping
As mentioned before, for traffic to flow through the FortiGate firewall there must be a policy that
matches its parameters:
Source Interface
Destination Interface
Source Address
Destination Address
Service or TCP/IP suite port number
Schedule and time of the sessions initiation
Without all five of these things matching the traffic will be declined. Each traffic flow requires a
policy and the direction is important as well. Just because packets can go from point A to point
B on port X does not mean that the traffic can flow from point B to point A on port X. A policy
must be configured for each direction.
When designing a policy there is often reference to the traffic flow, but most communication is a
two way connection so trying to determine the direction of the flow can be somewhat
confusing. If traffic is HTTP web traffic the user sends a request to the web site, but most of the
traffic flow will be coming from the web site to the user. Is the traffic flow considered to be from
the user to the web site, the web site to the user or in both directions? For the purposes of
determining the direction for a policy the important factor is the direction of the initiating
communication. The user is sending a request to the web site so this is the initial
communication and the web site is just responding to it so the traffic will be from the users
network to the Internet.
A case where either side can initiate the communication like between two internal interfaces on
the FortiGate unit would be a more likely situation to require a policy for each direction.
Fortinet Technologies Inc. Page 953 FortiOS Handbook - Firewall for FortiOS 5.0
strategy of protecting your network. Right out of the box, once you have your FortiGate device
connected into your network and hooked up with your ISP your network is protected. Nothing is
getting out or in so it is not very convenient, but you dont have to worry that between the time
you hooked it up and the point that you got all of the polices in place that someone could have
gotten in and done something to your resources. The reason that this needs to be kept in mind
when designing policies is because you cannot assume that any traffic will be allowed just
because it makes sense to do so. If you want any kind of traffic to make it past the FortiGate
firewall you need to create a policy that will allow that traffic. To maintain the protection of the
network should also make sure that the any policy you create allows only the traffic you intend
to go only to where you specifically want it to go and when you want it to go there.
Example
You have a web server on your network that is meant to provide a collaborative work
environment web site for your employees and a partner company for a project over the course
of the next 3 months.
It is theoretically possible to allow connections into your network to any device on that network
for any service and at any time. The problem with this is that we might not want just anybody
looking at those resources. Sadly, no matter how much it is wished otherwise, not everybody on
the Internet can be trusted. Which means we now have to be very specific in our instructions as
to what traffic to allow into the network. Each step that we take towards being more specific as
to what we allow means that there is that much more that is not allowed and the level of
protection of a resources is directly proportional to the amount of traffic that is not allowed. If
somebody cant get at it they cant damage or steal it.
Limiting where the traffic is allowed to go to means that other computers on your network
besides the web-server are protected.
Limiting where the traffic is allowed to come from means that, if feasible, you can limit the
systems that can access the web server to just employees or the partner company
computers.
Limiting the services to just web traffic means that a malicious person, even if they were
connection from a computer at the partner organization could only use the features of web
traffic to do anything malicious.
Limiting the policy to the time span of the project would mean that even if the IT department
forgot to remove the policy after the end of the project than no computer from the other
company could be used to do anything malicious through the policy that allowed the traffic.
This is just a very basic example but it shows the underlying principles of how the idea that
anything not expressly allowed is by default denied can be used to effectively protect your
network.
Policy order
Another important factor in how firewall policies work is the concept of precedence of order or if
you prefer a more recognizable term, first come, first served.
It is highly likely that even after only a relatively small number of policies have been created that
there will be some that overlap or are subsets of the parameters that the policies use to
determine which policy should be matched against the incoming traffic. When this happens
there has to be a method to determine which policy should be applied to the packet. The
method which is used by most firewalls it based on the order of the sequence of the policies.
If all of the policies were placed in a sequential list the process to match up the packet would
start at the top of the list and work its way down. It would compare information about the
packet, specifically these points of information:
1. The interface the packet connected to the FortiGate firewall
2. The source address of the packet
Fortinet Technologies Inc. Page 954 FortiOS Handbook - Firewall for FortiOS 5.0
3. The destination address of the packet
4. The interface the packet would need to use to get to the destination address based on the
routing table
5. The port the packet is destined for
6. The time that the packet connected to the FortiGate
As soon as the a policy is reached that matched all six (6) of these parameters, the instructions
of that policy are applied and the search for any other matching policies is stopped. All
subsequent policies are disregarded. Only 1 policy is applied to the packet.
If there is no matching policy among the policies that have been configured for traffic the packet
finally drops down to what is always the last policy. It is an implicit policy. One of a few that are
referred to by the term policy0. This policy denies everything.
The implicit policy is made up of the following settings:
Incoming Interface: any
Source Address: any
Outgoing Interface: any
Destination Address: any
Action: DENY
The only setting that is editable in the implicit policy is the logging of violation traffic.
A logical best practice that comes from the knowledge of how this process works is to make
sure that the more specific or specialized a policy is, the closer to the beginning of the
sequence it should be. The more general a policy is the higher the likelihood that it could include
in its range of parameters a more specifically targeted policy. The more specific a policy is, the
higher the probability that there is a requirement for treating that traffic in a specific way.
Example
For security reasons there is no FTP traffic allowed out of a specific subnet so there is a policy
that states that any traffic coming from that subnet is denied if the service is FTP, so the
following policy was created:
Policy #1
Service FTP
Schedule always
Action deny
Now as these things usually go it turns out that there has to be an exception to the rule. There is
one very secure computer on the subnet that is allowed to use FTP and once the content has
been checked it can them be distributed to the other computer on the subnet. So a second
firewall policy is created.
Fortinet Technologies Inc. Page 955 FortiOS Handbook - Firewall for FortiOS 5.0
Policy #2
Service FTP
Schedule always
Action Allow
By default, a policy that has just been created will be placed last in the sequence so that it is
less likely to interfere with existing policies before it can be moved to its intended position. If
you look at Policy #2 you will notice that it is essentially the same as Policy #1 exempt for the
Source Address and the Action. You will also notice that the Source Address of the Policy #2 is
a subset of the Source address in policy #1. This means that if nothing further is done, Policy #2
will never see any traffic because the traffic will always be matched by Policy #1 and processed
before it has a chance to reach the second policy in the sequence. For both policies to work as
intended Policy #2 needs to be moved to before Policy #1 in the sequence.
As proof of the behavior, look at the following traffic analysis of a packet sent to a VIP. You will
see that the packet is translated even before it is allowed to pass through the firewall by a
policy.
2015-06-10 06:33:21 id=20085 trace_id=1 func=print_pkt_detail line=4373
msg="vd-root received a packet(proto=6,
Fortinet Technologies Inc. Page 956 FortiOS Handbook - Firewall for FortiOS 5.0
24.114.222.34:51434->24.212.230.77:3389) from wan1. flag [S], seq
1579917634, ack 0, win 8192"
2015-06-10 06:33:21 id=20085 trace_id=1 func=init_ip_session_common
line=4522 msg="allocate a new session-01480894"
2015-06-10 06:33:21 id=20085 trace_id=1 func=fw_pre_route_handler
line=174 msg="VIP-10.10.66.2:3389, outdev-wan1"
2015-06-10 06:33:21 id=20085 trace_id=1 func=__ip_session_run_tuple
line=2534 msg="DNAT 24.212.230.77:3389->10.10.66.2:3389"
2015-06-10 06:33:21 id=20085 trace_id=1 func=vf_ip4_route_input
line=1596 msg="find a route: flags=00000000 gw-10.10.66.2 via
internal5"
2015-06-10 06:33:21 id=20085 trace_id=1 func=fw_forward_handler
line=670 msg="Allowed by Policy-15:"
Fortinet Technologies Inc. Page 957 FortiOS Handbook - Firewall for FortiOS 5.0
The default column headings are:
[Check box icon]
Seq.#
Source
Destination
Authentication
Schedule
Service
Action
Log
The column that are shown are configurable. All but the first 2 can be removed or their position
changed. There are also a number of other columns that display information about the policies
that can be added. One of the more useful ones that can be added is the ID column. The reason
for adding this one is that policies are referenced by their ID number for simplicity and ease of
administration. If you are looking in the CLI you will see that the only designation for a policy is
its number and if you wish to change the order of a policy you will be asked to move it before or
after another policy by referencing its number.
Fortinet Technologies Inc. Page 958 FortiOS Handbook - Firewall for FortiOS 5.0
Once either the Firewall or the VPN type has been chosen there is then a choice between one of
subtypes for each of the Policy types. For the Firewall type of policy the subtypes are:
Address
User Identity
Device Identity
The Address subtype refers to policies where access through the FortiGate firewall is
dependant on the source location of the addresses of the devices involved in the traffic
matched to the policy.
The User Identity subtype refers to polices where access through the FortiGate firewall is
dependant on the users credentials or Identity.
The Device Identity subtype refers to policy where access through the FortiGate firewall is
dependant on the specific device being used based on the MAC address of the device or
belonging to a group of devices that are based on device types or belonging to custom made
groups.
For the VPN type the subtypes are:
IPSec
SSL-VPN
As expected the two subtypes are the two different types of VPN tunnels that the FortiGate
firewall supports in a policy based configuration.
Identity-based security policies, also known as authentication policies, match traffic that
requires a supported authentication protocol to trigger the firewall authentication challenge and
successfully authenticate network users. Network users authentication can occur using HTTP,
HTTPS, FTP, and Telnet protocols as well as through automatic login using NTLM and FSSO, to
bypass user intervention.
Identity-based security policies are usually configured for IPSec or SSL VPN traffic since this
type of traffic usually requires authentication from network users.
When configuring identity-based policies, you can use schedules to limit network users
authentication sessions. For example, example.com has a schedule policy to use P2P
applications between noon and 1:00 pm, and a user authentication timeout of 30
minutes. When a user logs in at 12:15 pm, their authentication time logs them off at 12:45 (30
minutes later). You can configure this type of authentication by using the scheduletimeout field
in the config firewall policy command in the CLI.
Fortinet Technologies Inc. Page 959 FortiOS Handbook - Firewall for FortiOS 5.0
never process the rest of your rule base. For this reason, unique security policies should be
placed before an identity-based policy.
For example, consider the following policies:
DNS traffic goes through successfully as does any HTTP traffic after being authenticated.
However, if there was FTP traffic, it would not get through. As the FortiGate unit processes FTP
traffic, it skips rule one since its matching the source, destination and service. When it moves to
rule two it matches the source and destination, it determines there is a match and, sees there
are also processes the group/service rules, which requires authentication and acts on those
rules. Once satisfied, the FortiGate unit will never go to rule three.
In this situation, where you would want FTP traffic to traverse the FortiGate unit, create a
security policy specific to the services you require and place it above the authentication policy.
Identity-based sub-policies
When adding authentication to a security policy, you can add multiple authentication rules, or
sub-policies. Within these policies you can include additional security profiles, traffic shaping
and so on, to take affect on the selected services.
These sub-policies work on the same principle as normal security policies, that is, top down
until the criteria has been met. As such, if there is no matching policy within the list, the packet
can still be dropped even after authentication is successful.
Device identity policies are designed to assist in accommodating the BYOD trends.
Fortinet Technologies Inc. Page 960 FortiOS Handbook - Firewall for FortiOS 5.0
These policies will share many of the same characteristics and field values as the other firewall
policies. The point at which a Device Policy defers from other policies on the FortiGate firewall is
that when creating one of these policies the criteria that the authentication will be based on is
the MAC address of the device making the connection. With the MAC addresses being unique
to a specific networkable device there is a great deal of control that can be exercised with these
policies.
In cooperation with the MAC scanning capabilities of the FortiGate it is relatively simple to
create a profile that will allow access to the wireless network to personal devices such as smart
phones, tablets and personal laptops that are brought into work by employees or even
contractors and other guests.
The process of authentication is similar to the processes taking place in the Identity based
policies. The FortiGate firewall checks the incoming traffic for parameters such as interfaces,
addresses, times and services and then matches them with the values associated with the
traffic that is associated with the MAC addresses listed in the policy. If everything matches up
correctly traffic is allowed to proceed.
The device addresses can be listed my individual MAC addresses, predefined groups based on
device type or custom made groupings of the MAC addresses.
VPN Policies
At one point, if you wanted to have secure digital communications between 2 points a private
network would be created. This network would only allow the people that were intended to get
the communications on it. This is very straightforward if the 2 points are in the same room or
even in the same building. It can all be done physically. If you are supposed to be on the secure
network
VPNs are an answer to one of todays biggest concerns, how to make digital communications
secure between to points that must communicate over the Internet which anybody can have
access to
IPSec Policies
IPSec policies allow IPSec VPN traffic access to the internal network from a remote location.
These policies include authentication information that authenticates users and user group or
groups. These policies specify the following:
the FortiGate firewall interface that provides the physical connection to the remote VPN
gateway, usually an interface connected to the Internet
the FortiGate firewall interface that connects to the private network
IP addresses associated with data that has to be encrypted and decrypted
optional: a schedule that restricts when the VPN can operate, and services (or types of data)
that can be sent.
For a route-based (interface mode) VPN, you do not configure an IPSec security policy. Instead,
you configure two regular ACCEPT security policies, one for each direction of communication,
with the IPSec virtual interface as the source or destination interface, as appropriate.
Fortinet Technologies Inc. Page 961 FortiOS Handbook - Firewall for FortiOS 5.0
Interface Policies
Interface policies are implemented before the security policies and are only flow based.
This feature allows you to attach a set of IPS policies with the interface instead of the forwarding
path, so packets can be delivered to IPS before entering firewall. This feature is used for
following IPS deployments:
One-Arm: by defining interface policies with IPS and DoS anomaly checks and enabling
sniff-mode on the interface, the interface can be used for one-arm IDS;
IPv6 IPS: IPS inspection can be enabled through interface IPv6 policy. Only IPS signature
scan is supported in FortiOS 4.0. IPv6 DoS protection is not supported;
Scan traffics that destined to FortiGate;
Scan and log traffics that are silently dropped or flooded by Firewall or Multicast traffic.
IPS sensors can be assigned to an interface policy. Both incoming and outgoing packets are
inspected by IPS sensor (signature).
Here is an example of an interface policy,
config firewall interface-policy
edit 1
set status enable
set interface "port14"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
set application-list-status disable
set ips-sensor-status enable
set ips-sensor "default"
set av-profile-status disable
set webfilter-profile-status disable
set spamfilter-profile-status disable
set dlp-sensor-status disable
set label "Port 14 Interface Policy"
next
end
DoS Protection
Denial of Service (DoS) policies are primarily used to apply DoS anomaly checks to network
traffic based on the FortiGate interface it is entering as well as the source and destination
addresses. DoS checks are a traffic anomaly detection feature to identify network traffic that
does not fit known or common traffic patterns and behavior. A common example of anomalous
traffic is the denial of service attack. A denial of service occurs when an attacking system starts
an abnormally large number of sessions with a target system. The large number of sessions
slows down or disables the target system, so that legitimate users can no longer use it.
DoS policies are similar to firewall policies except that instead of defining the way traffic is
allowed to flow, they keep track of certain traffic patterns and attributes and will stop traffic
displaying those attributes. Further, DoS policies affect only incoming traffic on a single
interface. You can further limit a DoS policy by source address, destination address, and
service.
DoS configurations have been changed a couple of times in the past. In FortiOS 4.0, DoS
protection is moved to the interface policy, so when it is enabled, it is the first thing checked
Fortinet Technologies Inc. Page 962 FortiOS Handbook - Firewall for FortiOS 5.0
when a packet enters FortiGate. Because of this early detection, DoS policies are a very
efficient defence that uses few resources. Denial of service attacks, for example, are detected
and its packets dropped before requiring security policy look-ups, antivirus scans, and other
protective but resource-intensive operations.
A DoS policy examines network traffic arriving at an interface for anomalous patterns usually
indicating an attack. This does not mean that all anomalies experience by the firewall are the
result of an intentional attack.
Because an improperly configured DoS anomaly check can interfere with network traffic, no
DoS checks are preconfigured on a factory default FortiGate unit. You must create your own
before they will take effect. Thresholds for newly created sensors are preset with recommended
values that you can adjust to meet the needs of your network.
To create a Denial of Service policy determine if it needs to be an IPv4 or IPv6 policy, then go to:
Policy > Policy > DoS Policy for IPv4.
Policy > Policy > IPv6 DoS Policy for IPv6.
It is important to know normal and expected network traffic before changing the default
anomaly thresholds. Setting the thresholds too low could cause false positives, and setting the
thresholds too high could allow otherwise avoidable attacks.
Fortinet Technologies Inc. Page 963 FortiOS Handbook - Firewall for FortiOS 5.0
Anomaly Name Description Recommended
Threshold
tcp_syn_flood If the SYN packet rate of new TCP connections, 2000 packets
including retransmission, to one destination IP address per second.
exceeds the configured threshold value, the action is
executed.
tcp_port_scan If the SYN packet rate of new TCP connections, 1000 packets
including retransmission, from one source IP address per second.
exceeds the configured threshold value, the action is
executed.
tcp_src_session If the number of concurrent TCP connections from one 5000 concurrent
source IP address exceeds the configured threshold sessions.
value, the action is executed.
udp_flood If the UDP traffic to one destination IP address exceeds 2000 packets
the configured threshold value, the action is executed. per second.
udp_scan If the number of UDP sessions originating from one 2000 packets
source IP address exceeds the configured threshold per second.
value, the action is executed.
udp_src_session If the number of concurrent UDP connections from one 5000 concurrent
source IP address exceeds the configured threshold sessions.
value, the action is executed.
icmp_flood If the number of ICMP packets sent to one destination IP 250 packets per
address exceeds the configured threshold value, the second.
action is executed.
icmp_sweep If the number of ICMP packets originating from one 100 packets per
source IP address exceeds the configured threshold second.
value, the action is executed.
icmp_src_session If the number of concurrent ICMP connections from one 300 concurrent
source IP address exceeds the configured threshold sessions
value, the action is executed.
Fortinet Technologies Inc. Page 964 FortiOS Handbook - Firewall for FortiOS 5.0
Anomaly Name Description Recommended
Threshold
sctp_flood If the number of SCTP packets sent to one destination IP 2000 packets
address exceeds the configured threshold value, the per second
action is executed.
sctp_scan If the number of SCTP sessions originating from one 1000 packets
source IP address exceeds the configured threshold per second
value, the action is executed.
Status
The status field is enabled to enable the sensor for the associated anomaly. In terms of actions
performed there is no difference between disabling a sensor and having the action as Pass
but by disabling sensors that are not being used for blocking or logging you can save some
resources of the firewall that can be better used elsewhere.
Logging
Regardless of whether the traffic is blocked or passed through the anomalous traffic will be
logged.
Pass
Allows the anomalous traffic to pass through unimpeded.
Block
For Thresholds based on the number of concurrent sessions blocking the anomaly will not allow
more than the number of concurrent sessions set as the threshold.
For rate based thresholds where the threshold is measured in packets per second, the Action
setting Block prevents the overwhelming of the firewall by anomalous traffic in one of 2 ways.
Setting which of those 2 ways will be issued is determined in the CLI.
continuous - blocks any packets that match the anomaly criteria once the threshold has
been reached
periodical - allows matching anomalous traffic up to the rate set by the threshold.
To set the type of block action for the rate based anomaly sensors:
config ips global
set anomaly-mode continuous
set anomaly-mode periodical
end
Threshold
Fortinet Technologies Inc. Page 965 FortiOS Handbook - Firewall for FortiOS 5.0
The threshold can be either in terms of concurrent session or in packets per second depending
on which sensor is being referred to.
One-Arm IDS
Interface-based policy only defines what and how IPS functions are applied to the packets
transmitted by the interface. It works no matter if the port is used in a forwarding path or used
as an One-Arm device.
To enable One-Arm IDS, the user should first enable sniff-mode on the interface,
config system interface
edit port2
set ips-sniffer-mode enable
next
end
Once sniff-mode is turned on, both incoming and outgoing packets will be dropped after IPS
inspections. The port can be connected to a hub or a switch's SPAN port. Any packet picked up
by the interface will still follow the interface policy so different IPS and DoS anomaly checks can
be applied.
IPv6 IPS
IPv6 IPS signature scan can be enabled by interface policy. The user can create an normal IPS
sensor and assign it to the IPv6 interface policy.
config firewall interface-policy6
edit 1
set interface "port1"
set srcaddr6 "all"
set dstaddr6 "all"
set service6 "ANY"
set ips-sensor-status enable
set ips-sensor "all_default"
next
end
Fortinet Technologies Inc. Page 966 FortiOS Handbook - Firewall for FortiOS 5.0
Potentially, L2 packets can also be sent to IPS for inspection through interface-policy, but it is
not enabled.
Local-In Policies
On the FortiGate unit, there are a number of protocols and traffic that is specific to the internal
workings of FortiOS. For many of these traffic sources, you can identify a specific port/IP
address for this self-originating traffic. The following traffic can be configured to a specific
port/IP address:
SNMP
Syslog
alert email
FortiManager connection IP
FortiGuard services
FortiAnalyzer logging
NTP
DNS
Authorization requests such as RADIUS
FSSO
Security policies control the flow of traffic through the FortiGate unit. The FortiGate unit also
includes the option of controlling internal traffic, that is, management traffic.
Each interface includes an allow access configuration to allow management access for specific
protocols. Local policies are set up automatically to allow all users all access. Local-in policies
takes this a step further, to enable or restrict the user with that access. This also extends
beyond the allow access selection.
Local-in policies are configured in the CLI with the commands:
config firewall local-in-policy
edit <policy_number>
set intf <source_interface>
set srcaddr <source_address>
set dstaddr <destination_address>
set action {accept | deny}
set service <service name>
set schedule <schedule_name>
end
For example, you can configure a local-in policy so that only administrators can access the
FortiGate unit on weekends from a specific management computer at 192.168.21.12,
represented by the address object mgmt-comp1, using SSH on port 3 (192.168.21.77
Fortinet Technologies Inc. Page 967 FortiOS Handbook - Firewall for FortiOS 5.0
represented by the address object FG-port3) using the Weekend schedule which defines the
time the of access.
config firewall local-in-policy
edit <1>
set intf port3
set srcaddr mgmt-comp1
set dstaddr FG-port3
set action accept
set service SSH
set schedule Weekend
end
You can also disable a policy should there be a requirement to turn off a policy for
troubleshooting or other purpose. To disable a policy enter the commands:
config firewall local-in-policy
edit <policy_number>
set status disable
end
Use the same commands with a status of enable to use the policy again.
Local-in policies are also supported for IPv6 by entering the command
config firewall local-in-policy6.
Security Policy 0
Any security policy that is automatically added by the FortiGate unit has a policy ID number of
zero (0). The most common reasons the FortiGate unit creates this policy is:
The IPSec policy for FortiAnalyzer (and FortiManager version 3.0) is automatically added
when an IPSec connection to the FortiAnalyzer unit or FortiManager is enabled.
The policy to allow FortiGuard servers to be automatically added has a policy ID number of
zero.
The (default) drop rule that is the last rule in the policy and that is automatically added has a
policy ID number of zero.
When a network zone is defined within a VDOM, the intra-zone traffic set to allow or block is
managed by policy 0 if it is not processed by a configured security policy.
This policy can appear in logs but will never appear in the security policy list, and therefore, can
never be repositioned in the list.
When viewing the FortiGate firewall logs, you may find a log field entry indicating policyid=0.
The following log message example indicates the log field policyid=0 in bold.
2008-10-06 00:13:49 log_id=0022013001 type=traffic subtype=violation
pri=warning vd=root SN=179089 duration=0 user=N/A group=N/A rule=0
policyid=0 proto=17 service=137/udp app_type=N/A status=deny
src=10.181.77.73 srcname=10.181.77.73 dst=10.128.1.161
dstname=10.128.1.161 src_int=N/A dst_int="Internal" sent=0 rcvd=0
src_port=137 dst_port=137 vpn=N/A tran_ip=0.0.0.0 tran_port=0
Fortinet Technologies Inc. Page 968 FortiOS Handbook - Firewall for FortiOS 5.0
Deny Policies
Deny security policies deny traffic that is coming into the network. The FortiGate unit
automatically blocks traffic that is associated with a deny security policy.
Deny security policies are usually configured when you need to restrict specific traffic, for
example, SSH traffic. Deny security policies can also help when you want to block a service,
such as DNS, but allow a specific DNS server.
There is a disparity in the effectiveness of deny policies. Only deny policies that contain VIPs
will block traffic directed at those VIPs. Policies with VIPs are processed before other polices,
so using a deny policy earlier in the list will not work. For more on this topic, see Exception to
policy order (VIPs) on page 956.
Accept Policies
Accept security policies accept traffic that is coming into the network. These policies allow
traffic through the FortiGate unit, where the packets are scanned, translated if NAT is enabled,
and then sent out to its destination.
Accept security policies are the most common security policies that are created in FortiOS.
These security policies are basic policies, such as allowing Internet access, as well as complex
policies, such as IPSec VPN.
IPv6 Policies
IPv6 security policies are created both for an IPv6 network, and a transitional network. A
transitional network is a network that is transitioning over to IPv6, but must still have access to
the Internet or must connect over an IPv4 network.
These policies allow for this specific type of traffic to travel between the IPv6 and IPv4
networks. The IPv6 options for creating these policies is hidden by default. You must enable this
feature in System > Config > Settings.
Fixed Port
Some network configurations do not operate correctly if a NAT policy translates the source port
of packets used by the connection. NAT translates source ports to keep track of connections for
a particular service.
From the CLI you can enable fixedport when configuring a security policy for NAT policies to
prevent source port translation.
config firewall policy
edit <policy-id>
...
set fixedport enable
...
end
However, enabling fixedport means that only one connection can be supported through the
firewall for this service. To be able to support multiple connections, add an IP pool, and then
select Dynamic IP pool in the policy. The firewall randomly selects an IP address from the IP
Fortinet Technologies Inc. Page 969 FortiOS Handbook - Firewall for FortiOS 5.0
pool and assigns it to each connection. In this case, the number of connections that the firewall
can support is limited by the number of IP addresses in the IP pool.
Endpoint Security
Endpoint security enforces the use of the FortiClient End Point Security (FortiClient and
FortiClient Lite) application on your network. It can also allow or deny endpoints access to the
network based on the application installed on them.
By applying endpoint security to a security policy, you can enforce this type of security on your
network. FortiClient enforcement can check that the endpoint is running the most recent version
of the FortiClient application, that the antivirus signatures are up-to-date, and that the firewall is
enabled. An endpoint is usually often a single PC with a single IP address being used to access
network services through a FortiGate unit.
With endpoint security enabled on a policy, traffic that attempts to pass through, the FortiGate
unit runs compliance checks on the originating host on the source interface. Non-compliant
endpoints are blocked. If someone is browsing the web, the endpoints are redirected to a web
portal which explains the non-compliance and provides a link to download the FortiClient
application installer. The web portal is already installed on the FortiGate unit, as a replacement
message, which you can modify if required.
Endpoint Security requires that all hosts using the security policy have the FortiClient Endpoint
Security agent installed.
For more information about endpoint security, see the Security Profiles chapter in the FortiOS
Handbook.
Traffic Logging
When you enable logging on a security policy, the FortiGate unit records the scanning process
activity that occurs, as well as whether the FortiGate unit allowed or denied the traffic according
to the rules stated in the security policy. This information can provide insight into whether a
security policy is working properly, as well as if there needs to be any modifications to the
security policy, such as adding traffic shaping for better traffic performance.
Depending on what the FortiGate unit has in the way of resources, there may be advantages in
optimizing the amount of logging taking places. This is why in each policy you are given 3
options for the logging:
No Log - Does not record any log messages about traffic accepted by this policy.
Log Security Events - records only log messages relating to security events caused by traffic
accepted by this policy.
Log all Sessions - records all log messages relating to all of the traffic accepted by this
policy.
Depending on the model, if the Log all Sessions option is selected there may be 2 additional
options. These options are normally available in the GUI on the higher end models such as
the FortiGate 600C or larger.
Generate Logs when Session Starts
Capture Packets
Fortinet Technologies Inc. Page 970 FortiOS Handbook - Firewall for FortiOS 5.0
You can also use the CLI to enter the following command to write a log message when a
session starts:
config firewall policy
edit <policy-index>
set logtraffic-start
end
Traffic is logged in the traffic log file and provides detailed information that you may not think
you need, but do. For example, the traffic log can have information about an application used
(web: HTTP.Image), and whether or not the packet was SNAT or DNAT translated. The following
is an example of a traffic log message.
2011-04-13
05:23:47
log_id=4
type=traffic
subtype=other
pri=notice
vd=root
status="start"
src="10.41.101.20"
srcname="10.41.101.20"
src_port=58115
dst="172.20.120.100"
dstname="172.20.120.100"
dst_country="N/A"
dst_port=137
tran_ip="N/A"
tran_port=0
tran_sip="10.31.101.41"
tran_sport=58115
service="137/udp"
proto=17
app_type="N/A"
duration=0
rule=1
policyid=1
sent=0
rcvd=0
shaper_drop_sent=0
shaper_drop_rcvd=0
perip_drop=0
Fortinet Technologies Inc. Page 971 FortiOS Handbook - Firewall for FortiOS 5.0
src_int="internal"
dst_int="wan1"
SN=97404 app="N/A"
app_cat="N/A"
carrier_ep="N/A"
If you want to know more about logging, see the Logging and Reporting chapter in the FortiOS
Handbook. If you want to know more about traffic log messages, see the FortiGate Log
Message Reference.
Quality of Service
The Quality of Service (QoS) feature allows the management of the level of service and
preference given to the various types and sources of traffic going through the firewall so that the
traffic that is important to the services and functions connecting through the firewall gets the
treatment required to ensure the level of quality that is required.
QoS uses the following techniques:
Traffic policing Packets are dropped that do not conform to bandwidth limitations
This helps to ensure that the traffic may consume bandwidth at least at the guaranteed rate by
assigning a greater priority queue if the guarantee is not being met. Traffic shaping also ensures
that the traffic cannot consume bandwidth greater than the maximum at any given instant in
time. Flows that are greater than the maximum rate are subject to traffic policing.
Queuing
Assigning differing levels priority to different traffic flows so that traffic flows that are adversely
effected by latency are prevented from being effected by traffic flows that are not subject to the
effects of latency. All traffic in a higher priority traffic queue must be completely transmitted
before traffic in lower priority queues will be transmitted.
An example of where you would want to use something like this is if you had competing traffic
flows of Voice over IP traffic and email traffic. The VoIP traffic is highly susceptible to latency
issues.If you have a delay of a few seconds it is quickly noticeable when it is occurring. Email on
the other hand can have a time delay of much longer and it is highly unlikely that it will be
noticed at all.
By default, the priority given to any traffic is high, so if you want to give one type of traffic
priority over all other traffic you will need to lower the priority of all of the other traffic.
Fortinet Technologies Inc. Page 972 FortiOS Handbook - Firewall for FortiOS 5.0
Policy Monitor
Once policies have been configured and enabled it is useful to be able to monitor them. To get
an overview about what sort of traffic the policies are processing go to Policy > Monitor > Policy
Monitor.
The window is separated into two panes.
Upper Pane
The upper pane displays a horizontal bar graph comparing the Top Policy Usage based on one
of the following criteria:
Active Sessions
Bytes
Packets
The criteria that the displayed graph is based on can be selected from the drop down menu in
the upper right corner of the pane. The field name is Report By:.
The bars of the graph are interactive to an extent and can be used to drill down for more
specific information. If you hover the cursor over the bar of the graph a small popup box will
appear displaying more detailed information. If the bar of the graph is selected an entirely new
window will be displayed using a vertical bar graph to divide the data that made up the first
graph by IP address.
For example if the first graph was reporting usage by active sessions it would include a bar for
each of the top polices with a number at the end showing how many sessions were currently
going through that policy. If one of the bars of the graph was then selected the new bar graph
would show the traffic of that policy separated by either Source Address, Destination Address
or Destination Port. As in the other window, the selection for the reported criteria is in the upper
right corner of the pane. If the parameter was by source address there would be a bar for each
of the IP addresses sending a session through the policy and the end of the bar would show
how many sessions.
To go back to the previous window of information in the graphs select the Return link in the
upper left of the pane.
Lower Pane
The lower pane contains a spreadsheet of the information that the bar graph will derive their
information from. The column headings will include:
Policy ID
Source Interface/Zone
Destination Interface/Zone
Action
Active Sessions
Bytes
Packets
Fortinet Technologies Inc. Page 973 FortiOS Handbook - Firewall for FortiOS 5.0
Network defense
This section describes in general terms the means by which attackers can attempt to
compromise your network and steps you can take to protect it. The goal of an attack can be as
complex as gaining access to your network and the privileged information it contains, or as
simple as preventing customers from accessing your web server. Even allowing a virus onto
your network can cause damage, so you need to protect against viruses and malware even if
they are not specifically targeted at your network.
The following topics are included in this section:
Monitoring
Blocking external probes
Defending against DoS attacks
Monitoring
Monitoring, in the form of logging, alert email, and SNMP, does not directly protect your
network. But monitoring allows you to review the progress of an attack, whether afterwards or
while in progress. How the attack unfolds may reveal weaknesses in your preparations. The
packet archive and sniffer policy logs can reveal more details about the attack. Depending on
the detail in your logs, you may be able to determine the attackers location and identity.
While log information is valuable, you must balance the log information with the resources
required to collect and store it.
Protection against attacks is important, but attackers often use vulnerabilities and network tools
to gather information about your network to plan an attack. It is often easier to prevent an
attacker from learning important details about your network than to defend against an attack
designed to exploit your particular network.
Attacks are often tailored to the hardware or operating system of the target, so reconnaissance
is often the first step. The IP addresses of the hosts, the open ports, and the operating systems
the hosts are running is invaluable information to an attacker. Probing your network can be as
simple as an attacker performing an address sweep or port scan to a more involved operation
like sending TCP packets with invalid combinations of flags to see how your firewall reacts.
Address sweeps
An address sweep is a basic network scanning technique to determine which addresses in an
address range have active hosts. A typical address sweep involves sending an ICMP ECHO
request (a ping) to each address in an address range to attempt to get a response. A response
signifies that there is a host at this address that responded to the ping. It then becomes a target
for more detailed and potentially invasive attacks.
Address sweeps do not always reveal all the hosts in an address range because some systems
may be configured to ignore ECHO requests and not respond, and some firewalls and gateways
may be configured to prevent ECHO requests from being transmitted to the destination
Page 974
network. Despite this shortcoming, Address sweeps are still used because they are simple to
perform with software tools that automate the process.
Use the icmp_sweep anomaly in a DoS policy to protect against address sweeps.
There are a number of IPS signatures to detect the use of ICMP probes that can gather
information about your network. These signatures include AddressMask, Traceroute,
ICMP.Invalid.Packet.Size, and ICMP.Oversized.Packet. Include ICMP protocol
signatures in your IPS sensors to protect against these probes/attacks.
Port scans
Potential attackers may run a port scan on one or more of your hosts. This involves trying to
establish a communication session to each port on a host. If the connection is successful, a
service may be available that the attacker can exploit.
Use the DoS anomaly check for tcp_port_scan to limit the number of sessions (complete and
incomplete) from a single source IP address to the configured threshold. If the number of
sessions exceed the threshold, the configured action is taken.
Use the DoS anomaly check for udp_scan to limit UDP sessions in the same way.
Fortinet Technologies Inc. Page 975 FortiOS Handbook - Firewall for FortiOS 5.0
You can set anti-replay protection to the following settings:
disable No anti-replay protection.
loose Perform packet sequence checking and ICMP anti-replay checking with the
following criteria:
The SYN, FIN, and RST bit can not appear in the same packet.
The FortiGate unit does not allow more than one ICMP error packet through before it
receives a normal TCP or UDP packet.
If the FortiGate unit receives an RST packet, and check-reset-range is set to strict, the
FortiGate unit checks to determine if its sequence number in the RST is within the un-ACKed
data and drops the packet if the sequence number is incorrect.
strict Performs all of the loose checking but for each new session also checks to
determine of the TCP sequence number in a SYN packet has been calculated correctly and
started from the correct value for each new session. Strict anti-replay checking can also help
prevent SYN flooding.
If any packet fails a check it is dropped.
Evasion techniques
Attackers employ a wide range of tactics to try to disguise their techniques. If an attacker
disguises a known attack in such a way that it is not recognized, the attack will evade your
Fortinet Technologies Inc. Page 976 FortiOS Handbook - Firewall for FortiOS 5.0
security and possibly succeed. FortiGate security recognizes a wide variety of evasion
techniques and normalizes data traffic before inspecting it.
Packet fragmentation
Information sent across local networks and the Internet is encapsulated in packets. There is a
maximum allowable size for packets and this maximum size varies depending on network
configuration and equipment limitations. If a packet arrives at a switch or gateway and it is too
large, the data it carries is divided among two or more smaller packets before being forwarded.
This is called fragmentation.
When fragmented packets arrive at their destination, they are reassembled and read. If the
fragments do not arrive together, they must be held until all of the fragments arrive. Reassembly
of a packet requires all of the fragments.
The FortiGate unit automatically reassembles fragmented packets before processing them
because fragmented packets can evade security measures. Both IP packets and TCP packets
are reassembled by the IPS engine before examination.
For example, you have configured the FortiGate unit to block access to the example.org web
site. Any checks for example.com will fail if a fragmented packet arrives and one fragment
contains http://www.exa while the other contains mple.com/. Viruses and malware can be
fragmented and avoid detection in the same way. The FortiGate unit will reassemble fragmented
packets before examining network data to ensure that inadvertent or deliberate packet
fragmentation does not hide threats in network traffic.
Non-standard ports
Most traffic is sent on a standard port based on the traffic type. The FortiGate unit recognizes
most traffic by packet content rather than the TCP/UDP port and uses the proper IPS signatures
to examine it. Protocols recognized regardless of port include DHCP, DNP3, FTP, HTTP, IMAP,
MS RPC, NNTP, POP3, RSTP, SIP, SMTP, and SSL, as well as the supported IM/P2P application
protocols.
In this way, the FortiGate unit will recognize HTTP traffic being sent on port 25 as HTTP rather
than SMTP, for example. Because the protocol is correctly identified, the FortiGate unit will
examine the traffic for any enabled HTTP signatures.
Negotiation codes
Telnet and FTP servers and clients support the use of negotiation information to allow the server
to report what features it supports. This information has been used to exploit vulnerable servers.
To avoid this problem, the FortiGate unit removes negotiation codes before IPS inspection.
Fortinet Technologies Inc. Page 977 FortiOS Handbook - Firewall for FortiOS 5.0
Table 50: HTTP URL obfuscation types
Encoding Example
type
No encoding http://www.example.com/cgi.bin/
Decimal http://www.example.com/cgi.bin/
encoding
URL http://www.example.com/%43%47%49%2E%42%49%4E%2F
encoding
ANSI http://www.example.com/%u0063%u0067%u0069%u002E%u0062%u0069
encoding %u006E/
Directory http://www.example.com/cgi.bin/test/../
traversal
Fortinet Technologies Inc. Page 978 FortiOS Handbook - Firewall for FortiOS 5.0
Defending against DoS attacks
A denial of service is the result of an attacker sending an abnormally large amount of network
traffic to a target system. Having to deal with the traffic flood slows down or disables the target
system so that legitimate users can not use it for the duration of the attack.
Any network traffic the target system receives has to be examined, and then accepted or
rejected. TCP, UDP, and ICMP traffic is most commonly used, but a particular type of TCP traffic
is the most effective. TCP packets with the SYN flag are the most efficient DoS attack tool
because of how communication sessions are started between systems.
Server Client
Connection initiated: ACK
The three-way handshake is a simple way for the server and client to each agree to establish a
connection and acknowledge the other party expressing its intent. Unfortunately, the three-way
handshake can be used to interfere with communication rather than facilitate it.
SYN flood
When a client sends a SYN packet to a server, the server creates an entry in its session table to
keep track of the connection. The server then sends a SYN+ACK packet expecting an ACK
reply and the establishment of a connection.
An attacker intending to disrupt a server with a denial of service (DoS) attack can send a flood
of SYN packets and not respond to the SYN+ACK packets the server sends in response.
Networks can be slow and packets can get lost so the server will continue to send SYN+ACK
packets until it gives up, and removes the failed session from the session table. If an attacker
sends enough SYN packets to the server, the session table will fill completely, and further
connection attempts will be denied until the incomplete sessions time out. Until this happens,
the server is unavailable to service legitimate connection requests.
Fortinet Technologies Inc. Page 979 FortiOS Handbook - Firewall for FortiOS 5.0
Figure 173:A single client launches a SYN flood attack
SYN floods are seldom launched from a single address so limiting the number of connection
attempts from a single IP address is not usually effective.
SYN spoofing
With a flood of SYN packets coming from a single attacker, you can limit the number of
connection attempts from the source IP address or block the attacker entirely. To prevent this
simple defense from working, or to disguise the source of the attack, the attacker may spoof the
source address and use a number of IP addresses to give the appearance of a distributed
denial of service (DDoS) attack. When the server receives the spoofed SYN packets, the
SYN+ACK replies will go to the spoofed source IP addresses which will either be invalid, or the
system receiving the reply will not know what to do with it.
Client
Server
Connection initiation request: SYN
Fortinet Technologies Inc. Page 980 FortiOS Handbook - Firewall for FortiOS 5.0
Figure 175:Multiple attackers launch a distributed SYN flood
The distributed SYN flood is more difficult to defend against because multiple clients are
capable of creating a larger volume of SYN packets than a single client. Even if the server can
cope, the volume of traffic may overwhelm a point in the network upstream of the targeted
server. The only defence against this is more bandwidth to prevent any choke-points.
SYN proxy
FortiGate units with network acceleration hardware, whether built-in or installed in the form of
an add-on module, offer a third action for the tcp_syn_flood threshold. Instead of Block and
Pass, you can choose to Proxy the incomplete connections that exceed the threshold value.
When the tcp_syn_flood threshold action is set to f, incomplete TCP connections are
allowed as normal as long as the configured threshold is not exceeded. If the threshold is
exceeded, the FortiGate unit will intercept incoming SYN packets from clients and respond with
a SYN+ACK packet. If the FortiGate unit receives an ACK response as expected, it will replay
this exchange to the server to establish a communication session between the client and the
server, and allow the communication to proceed.
Fortinet Technologies Inc. Page 981 FortiOS Handbook - Firewall for FortiOS 5.0
DoS policies
DDoS attacks vary in nature and intensity. Attacks aimed at saturating the available bandwidth
upstream of your service can only be countered by adding more bandwidth. DoS policies can
help protect against DDoS attacks that aim to overwhelm your server resources.
Fortinet Technologies Inc. Page 982 FortiOS Handbook - Firewall for FortiOS 5.0
GUI & CLI - What You May Not Know
The Graphic User Interface (GUI) is designed to be as intuitive as possible but there are always
a few things that are left out because to put all of that information on the interface would clutter
it up to the point where it wouldnt be graphical and intuitive anymore.
This section is made up of knowledge that will make working with the both of the management
interfaces easier because you wont have to find out about things like field limitations through
trial and error. Some of it has to do with changing in how navigation in the GUI has changed.
The section includes the topics:
Mouse Tricks
Changing the default column setting on the policy page
Naming Rules and Restrictions
Character Restrictions
Length of Fields Restrictions
Object Tagging and Coloring
Numeric Values
Selecting options from a list
Enabling or disabling options
To Enable or Disable Optionally Displayed Features
Mouse Tricks
In previous version of the firmware much of the navigation, editing or choosing of options in the
Web-based Manager was carried out by using the mouse in combination with a number of icons
visible on the interface. This version of the firmware makes more extensive use of the right or
secondary mouse button as well as the drag and drop feature. If you are used to the old
Web-based Manager interface you will notice that a number of the options at the top of the
display window are not there anymore or there are fewer of them.
To get a feel for the new approach the Policy > Policy > Policy window is a noticeable place to
see some of these changes in action.
The different view modes are still in the upper right-hand corner as they were before but now
there is no column settings link to move or configure the columns of the window. Now if you
wish to reposition a column just use the mouse to click on the column heading and drag it to its
new position. If you wish to add a new column just right-click on one of the column headings
and a drop down menu will appear with the option Column Settings. Use the right pointing
triangle to expand the Column Settings option to see a choice of possible columns for the
window you are in. Those already selected will be at the top with a checked box and the
available new ones will be at the bottom ready to be selected.
By right or secondary clicking the mouse curser in the cells of the Policy window you will get a
drop down menu that is contextual to the column and policy row where you made the clck.For
example if you right click in the Schedule column for the row that is for policy #5 you will get
the option to select a schedule for policy #5 along with a number of other configuration options
relating to that policy or its position in the sequence of policies.
Page 983
You will find this approach used much more frequently through out the Web-based Manager,
giving it a more modern and intuitive feel once you learn to use the right mouse button rather
than finding a link displayed on the page.
The Policy > Policy > Policy window is one of the more important ones in the Web based
interface and has the capacity to display a lot of information, but displaying all of that
information at the same time makes for a very busy screen. If all of the columns are displayed,
depending on the screen size you may have to constantly use the scroll bars to see what you
need to look at. The default installation shows some of the more commonly used columns but
these list may not consist of the columns that you wish to look at or the order that you wish to
view them in. For this reason it is possible, through the CLI to override these settings to
establish a new default.
The syntax of the command starts with:
config system settings
set gui-default-policy-columns
The rest of the command is a space delimited list that depends on the columns you wish to view
and the order you wish to view them in. The possible selection is in the following table.
Table 51: Variables for the gui-default-policy-columns command
# Sequence Number
policyid Policy ID
Fortinet Technologies Inc. Page 984 FortiOS Handbook - Firewall for FortiOS 5.0
Example:
If you wanted these columns in this order, Policy ID, Source Addresses, Destination Addresses,
Security Profiles, Policy Comment. You would enter the command:
config system settings
set gui-default-policy-columns policyid srcaddr dstaddr profile
comments
The following are the specific rules that are obeyed by the FortiGate.
Duplicate Name Issues:
A VLAN cannot have the same name as a physical interface.
An Address must not have the same name as an Address Group.
An Address or Address Group must not have the same name as a Virtual IP Address.
A Service cannot have the same name as a Service Group.
A VLAN must not have the same name as a VDOM.
A VLAN or VDOM must not have the same name as a Zone.
Try to make each firewall object name as unique as possible so that it cannot be confused with
another object.
Character Restrictions
A name can contain numbers (0-9), uppercase and lowercase letters (A-Z, a-z), spaces, and the
special characters - and _. Other characters are not allowed
The special characters < > ( ) # " ' are allowed only in the following fields:
Passwords
Replacement message
Firewall policy description
IPS customized signature
Antivirus blocked file pattern
Web Filter banned word
Spam filter banned word
interface PPPoE client user name
modem dialup account user name
modem dialup telephone number
Where you would normally be tempted to use spaces in a name try using the "-" or "_". There
are a few name fields were it is not an issue but most of them will trigger serious and
unpredictable issues if there is a space in the name field of the object.
Fortinet Technologies Inc. Page 985 FortiOS Handbook - Firewall for FortiOS 5.0
Length of Fields Restrictions
VDOM names 12
VLAN name 15
Schedule names 32
Web Filter banned word, URL, URL exempt, Pattern fields 127
Spam Filter RBL server name, email address, MIME header body 127
For ease of administration and searching the features of object tagging and coloring are
available. These features can make it easier to find similar objects in an administrative screen or
to search based on common assigned criteria.
Fortinet Technologies Inc. Page 986 FortiOS Handbook - Firewall for FortiOS 5.0
Tags
The Tag Management menu provides a central location to view, search and manage tags that
you created. Tags are keywords or a term that is assigned to a specific configuration that can be
used for searching or filtering purposes. With the Tag Management feature you can:
Search to find a specific tag
View where a tag is referenced, for example, a single tag could be referenced in a security
policy, predefined signature and application
Go to where the tag is located, for example, a security policy
View how many tags are currently unused
Remove tags.
The Tag Management page also provides a way to easily locate a specific object, such as a
security policy, because of how tags work. For example, an SSL VPN security policy is tagged
with the keywords SSL VPN, remote, and SSL branch office;
1. From the Tag Management page, enter SSL and the tags for that security policy appear;
2. Select one of the tags and within the Object Usage window, select to go to the SSL VPN
security policy.
3. You can view detailed information about what object is using a tag by selecting one of the
tags in the rectangular area that contains a grey background. The Object Usage window
appears, which displays similar information as when you select a number in the Ref. column.
In the Add Tags window, you can select to add existing tags to the security policy or address
list; however, these tags belong to predefined signatures and applications as well as to other
security policies and address lists so the tags may not be applicable. You should make sure
that the tag is valid for its use when applied to a security policy or other object otherwise it
becomes redundant.
Coloring
You will sometimes be given the option of changing the color of the icon that will represent the
firewall object you are configuring. You can do this by clicking on the [Change] link. You will be
given the option of picking one of 32 colors.
Numeric Values
Numeric values are used to configure various sizes, rates, numeric addresses, or other numeric
values. For example, a static routing priority of 10, a port number of 8080, or an IP address of
10.10.10.1. Numeric values can be entered as a series of digits without spaces or commas (for
example, 10 or 64400), in dotted decimal format (for example the IP address 10.10.10.1) or as in
the case of MAC or IPv6 addresses separated by colons (for example, the MAC address
00:09:0F:B7:37:00). Most numeric values are standard base-10 numbers, but some fields (again
such as MAC addresses) require hexadecimal numbers.
Most web-based manager numeric value fields make it easy to add the acceptable number of
digits within the allowed range. CLI help includes information about allowed numeric value
ranges. Both the web-based manager and the CLI prevent you from entering invalid numbers.
Fortinet Technologies Inc. Page 987 FortiOS Handbook - Firewall for FortiOS 5.0
Selecting options from a list
If a configuration field can only contain one of a number of selected options, the web-based
manager and CLI present you a list of acceptable options and you can select one from the list.
No other input is allowed. From the CLI you must spell the selection name correctly.
If a configuration field can only be on or off (enabled or disabled) the web-based manager
presents a check box or other control that can only be enabled or disabled. From the CLI you
can set the option to enable or disable.
There are a number of features in the web-based manager that can be configured to either be
displayed if you are likely to use them or disabled if you have no need to see them. The ones
that may be relevant to the function of the Firewall are:
Central NAT Table
Dynamic Profile
Explicit Proxy
Implicit Firewall Policies
IPv6
Load Balance
Local In Policy
Object Tagging and Coloring
You can enable or disable these features by going to System > Admin > Settings or by using the
following CLI options:
config system global
set gui-ap-profile {disable | enable}
set gui-central-nat-table {disable | enable}
set gui-dns-database {disable | enable}
set gui-dynamic-profile-display {disable | enable}
set gui-icap {disable | enable}
set gui-implicit-id-based-policy {disable | enable}
set gui-implicit-policy {disable | enable}
set gui-ipsec-manual-key {enable | disable}
set gui-ipv6 {enable | disable}
set gui-lines-per-page <gui_lines>
set gui-load-balance {disable | enable}
set gui-object-tags {disable | enable}
set gui-policy-interface-pairs-view {enable | disable}
set gui-voip-profile {disable | enable}
end
Fortinet Technologies Inc. Page 988 FortiOS Handbook - Firewall for FortiOS 5.0
Building firewall objects and policies
The other chapters in the Firewall book have so far been concerned primarily with concepts and
abstract ideas that are designed you help you understand what is going on with the firewall and
what it can do. Now that we have a good grounding in the what it is time to get into the how.
This section will provide the instructions for the web-based manager (when available) and the
CLI for adding and or editing FortiGate firewall objects and then how to put them together when
building a policy to govern the traffic flowing through your network. To give some context,
scenarios have been included. The instructions here are concerned with the creation of the
objects. The inclusion of these objects into firewall policies is not shown in these instructions.
This chapter includes the instructions for building the following:
IPv4 Firewall Addresses
IPv6 Firewall Addresses
FQDN address
Changing the TTL of a FQDN address
New Geography-based Address
Wildcard Address
IPv4 Address Group
IPv6 Address Group
Multicast Address
Service Category
TCP/UDP/SCTP Service
ICMP Service
ICMPv6 Service
Service Group
Virtual IP address
IP Pool
Central NAT Table
Firewall Schedule - Recurring
Firewall Schedule - One-time
Schedule Group
Proxy Option
Firewall Address Policy
Firewall User Identity Policy
Firewall Device Identity Policy
DoS Policy
Page 989
IPv4 Firewall Addresses
Interface port1
Select OK.
Enter the following CLI command:
config firewall address
edit Mail_Server
set type ipmask
set subnet 192.168.1.27 255.255.255.255
set associated-interface port1
set tags Server
end
Fortinet Technologies Inc. Page 990 FortiOS Handbook - Firewall for FortiOS 5.0
Color <Changing this value is optional>
Interface port1
Select OK.
Enter the following CLI command:
config firewall address
edit Internal_Subnet_1
Set comment Network for 1st Floor
set type ipmask
set subnet 192.168.1.0/24
set associated-interface port1
end
Interface port1
Select OK.
Fortinet Technologies Inc. Page 991 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall address
edit Internal_Subnet_1
set type iprange
set start-ip 192.168.1.100
set end-ip 192.168.1.115
set associated-interface port1
end
Verification
To verify that the addresses were added correctly:
Go to Firewall Objects > Address > Addresses. Check that the addresses have been added to
the address list and that they are correct.
Enter the following CLI command:
config firewall address
edit <the name of the address to verify>
show full-configuration
Select OK.
Fortinet Technologies Inc. Page 992 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall address6
edit Mail_Server
set type ipmask
set subnet 2001:db8:0:2::20/64
set associated-interface port1
set tags Server
end
Interface port1
Select OK.
Enter the following CLI command:
config firewall address6
edit Internal_Subnet_1
Set comment Network for 1st Floor
set subnet 2001:db8:0:2::/64
end
Verification
To verify that the addresses were added correctly:
Go to Firewall Objects > Address > Addresses. Check that the addresses have been added to
the address list and that they are correct.
Fortinet Technologies Inc. Page 993 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall address6
edit <the name of the address that you wish to verify>
Show full-configuration
FQDN address
You have to create a policy that will govern traffic that goes to a site that has a number of
servers on the Internet. Depending on the traffic or the possibility that one of the servers is
down network traffic can go to any one of those sites. The consistent factor is that they all use
the same Fully Qualified Domain Name.
The FQDN of the web site: example.com
The number of ISP connections off of the FortiGate firewall: 2
Go to Firewall Objects > Address > Addresses and select Create New > Address/FQDN.
Fill out the fields with the following information
Type FQDN
FQDN bigwebsite.com
Interface any
Select OK.
Enter the following CLI command:
config firewall address
edit BigWebsite.com
set type fqdn
set associated-interface any
set fqdn bigwebsite.com
end
Verification
To verify that the addresses were added correctly:
Go to Firewall Objects > Address > Addresses. Check that the addresses have been added to
the address list and that they are correct.
Fortinet Technologies Inc. Page 994 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall address
edit <the name of the address that you wish to verify>
Show full-configuration
To make sure that the FQDN resolves to the most recent active server you have been asked to
make sure that the FortiGate has not cached the address for any longer than 10 minutes.
There is no field for the cached time-to-live in the web-based manager. It is only configurable in
the CLI. Enter the following commands:
config firewall address
edit BigWebsite.com
set cache-ttl 600
end
Your company is US based and has information on its web site that may be considered
information that is not allowed to be sent to embargoed countries. In an effort to help reduce the
possibility of sensitive information going to those countries you have be asked to set up
addresses for those countries so that they can be block in the firewall policies.
One of the countries you have been asked to block is Cuba
You have been asked to Tag the addresses so that other administrators will know why they
have been created
Go to Firewall Objects > Address > Addresses and select Create New > Address/FQDN.
Fill out the fields with the following information
Type Geography
Country Cuba
Interface any
Select OK.
Fortinet Technologies Inc. Page 995 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall address
edit Cuba
set type geography
set country CN
set interface wan1
end
Wildcard Address
The company has a large network with multiple subnets. Each team has its own subnet in the
172.12.x.x range. To help keep things organized the IT department uses the same host address
on each subnet for the servers. For instance the gateways are always.1 or .2. mail servers are
always .5 and print servers are always .10.
In this case an address needs to be created for the mail servers for the entire company.
The addresses will be 172.12.0.5, 172.12.1.5, 172.12.2.5, etc.
Go to Firewall Objects > Address > Addresses and select Create New > Address/FQDN.
Fill out the fields with the following information
Interface any
Select OK.
There will be a pop up window explaining that the address will automatically be converted to a
wildcard address and ask if you would like to continue. When you see the address in the editing
window you will notice that the type field shows wildcard even though that was not an option
before.
Fortinet Technologies Inc. Page 996 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall address
edit <the name of the address that you wish to verify>
Show full-configuration
Your company has a small division that is in Denmark that has a number of remote users that
need to connect to a resource from either home, office or customer sites. The thing that they
have in common is that there are all in Denmark. An address group needs to be created that will
allow for this.
The preconfigured addresses to use will consist of:
Denmark - a geography based address
Denmark_ISP1 - a IP range of address of an ISP that services Denmark
Denmark_ISP2 - a IP range of address of another ISP that services Denmark
Denmark_Division - the FQDN of the Denmark office that uses Dynamic DNS
Go to Firewall Objects > Address > Groups and select Create New > Address Group.
Fill out the fields with the following information
Members Denmark
Denmark_ISP1
Denmark_ISP2
Denmark_Division
Select OK.
Enter the following CLI command:
config firewall addrgrp
edit Denmark_Users
set member Denmark Denmark_ISP1 Denmark_ISP2 Denmark_Division
end
If you need to edit out a member of an address group in the CLI you need to
Fortinet Technologies Inc. Page 997 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall addgrp
edit <the name of the address that you wish to verify>
Show full-configuration
Members Web_Server-1
Web_Server-2
Web_Server-3
Select OK.
Enter the following CLI command:
config firewall addrgrp6
edit Web_Server_Cluster
set member Web_Server-1 Web_Server-2 Web_Server-3
end
To verify that the addresses were added correctly:
Go to Firewall Objects > Address > Groups. Check that the addresses have been added to the
address list and that they are correct.
Enter the following CLI command:
config firewall addgrp6
edit <the name of the address that you wish to verify>
Show full-configuration
Multicast Address
The company has a large high tech campus that has monitors in many of its meeting rooms. It is
common practice for company wide notifications of importance to be done in a streaming video
Fortinet Technologies Inc. Page 998 FortiOS Handbook - Firewall for FortiOS 5.0
format with the CEO of the company addressing everyone at once. The video is High Definition
quality so takes up a lot of bandwidth. To minimize the impact on the network the network
administrators have set things up to allow the use of multicasting to the monitors for these
notifications. Now it has to be set up on the FortiGate firewall to allow the traffic.
The range being used for the multicast is 239.5.0.0 to 239.5.255.255
The interface on this FortiGate firewall will be on port 4
Go to Firewall Objects > Address > Addresses and select Create New > Address/FQDN.
Fill out the fields with the following information:
Field Value
Name Meeting_Room_Displays
Color <optional>
Interface port4
Comments <optional>
Select OK.
Enter the following CLI command:
config firewall multicast-address
edit "meeting_room_display"
set associated-interface "port9"
set start-ip 239.5.0.0
set end-ip 239.5.255.255
set visibility enable
next
end
To verify that the address range was added correctly:
Go to Firewall Objects > Address > Groups. Check that the addresses have been added to the
address list and that they are correct.
Enter the following CLI command:
config firewall multicast-address
edit <the name of the address that you wish to verify>
Show full-configuration
Service Category
Fortinet Technologies Inc. Page 999 FortiOS Handbook - Firewall for FortiOS 5.0
Go to Firewall Objects > Service > Services and select Create New > Category.
Fill out the fields with the following information
Name Surveillance
Select OK.
Enter the following CLI command:
config firewall service category
Edit Surveillance
Set comment For DataCenter Surveillance Devices
end
To verify that the category was added correctly:
Go to Firewall Objects > Service > Services. Select Create New > Custom Service. Go to the
Category Field and use the drop down menu arrow to open the drop down menu. The new
category should be displayed.
Enter the following CLI command:
config firewall service category
show
This should bring up all of the categories. Check to see that the new one is displayed.
TCP/UDP/SCTP Service
Fortinet Technologies Inc. Page 1000 FortiOS Handbook - Firewall for FortiOS 5.0
Fill out the fields with the following information
Name WebCam_Connection-incoming
Category Surveillance
The source port range can be left black as the default is 1 to 65635.
Select OK.
Enter the following CLI command:
config firewall service custom
edit WebCam_Connection-incoming
Set protocol TCP/UDP/SCTP
Set tcp-portrange 8000
Set sctp-portrange 16000
Set visibility enable
end
Name WebCam_Connection-outgoing
Fortinet Technologies Inc. Page 1001 FortiOS Handbook - Firewall for FortiOS 5.0
Show in Service List Check in check box
Category Surveillance
IP/FQDN 256.25.56.12
Select OK.
Enter the following CLI command:
config firewall service custom
edit WebCam_Connection-incoming
Set protocol TCP/UDP/SCTP
Set category Surveillance
Set udp-portrange 4000
Set iprange 256.25.56.12
Set visibility enable
end
To verify that the category was added correctly:
Go to Firewall Objects > Service > Services. Check that the services have been added to the
service list and that they are correct.
Enter the following CLI command:
config firewall service custom
edit <the name of the service that you wish to verify>
Show full-configuration
This should bring up all of the details of the service.
ICMP Service
The Security Officer would like to block the use of the traceroute utility through the network. The
IT manager insists that ping and other ICMP utility must be allows for the task of diagnosing
connectivity, so it is agreed that only traceroute functionality will be blocked.
The ICMP type for traceroute is 30. There is no codes with the type.
Web-based Manager Instructions
Go to Firewall Objects > Service > Services and select Create New > Custom Service.
Fill out the fields with the following information
Name traceroute
Fortinet Technologies Inc. Page 1002 FortiOS Handbook - Firewall for FortiOS 5.0
Comments <Input into this field is optional>
Category Uncategorized
Type 30
Select OK.
Enter the following CLI command:
config firewall service custom
edit traceroute
set protocol ICMP
set icmptype 30
set visibility enable
end
To verify that the category was added correctly:
Go to Firewall Objects > Service > Services. Check that the services have been added to the
services list and that they are correct.
Enter the following CLI command:
config firewall service custom
edit <the name of the service that you wish to verify>
show full-configuration
ICMPv6 Service
The IT Manager is doing some diagnostics and would like to temporarily block the successful
replies of ICMP Node information Responses between 2 IPv6 networks.
The ICMP type for ICMP Node informations responses is 140. The codes for a successful
response is 0.
Web-based Manager Instructions
Go to Firewall Objects > Service > Services and select Create New > Custom Service.
Fill out the fields with the following information
Name diagnostic-test1
Fortinet Technologies Inc. Page 1003 FortiOS Handbook - Firewall for FortiOS 5.0
Color <Changing this value is optional>
Category Uncategorized
Type 140
Code 0
Select OK.
Enter the following CLI command:
config firewall service custom
edit diagnostic-test1
set protocol ICMP6
set icmptype 140
set icmpcode 0
set visibility enable
end
To verify that the category was added correctly:
Go to Firewall Objects > Service > Services. Check that the services have been added to the
services list and that they are correct.
Enter the following CLI command:
config firewall service custom
edit <the name of the service that you wish to verify>
show full-configuration
Service Group
The company provide email services for a number of different companies. They have a
standard list of services that they like to keep open to their customer's email servers,
including webmail services. The company prides itself on getting a customer up and
going the same day so they use standard templates for everything to make sure nothing
is forgotten including the services that are available.
The services include:
IMAP
IMAPS
POP3
POP3S
SMTP
SMTPS
HTTP
HTTPS
Email_Admin - a custom service for administration of the servers
Fortinet Technologies Inc. Page 1004 FortiOS Handbook - Firewall for FortiOS 5.0
Go to Firewall Objects > Service > Groups and select Create New.
Fill out the fields with the following information:
Field Value
Comments (Optional)
Color (Optional)
Type Firewall
Select OK.
Enter the following CLI command:
config firewall service group
edit Cust_Email_Serv_Template
set member IMAP IMAPS POP3 POP3S SMTP SMTPS HTTP
HTTPS Email_Admin
next
end
To verify that the category was added correctly:
Go to Firewall Objects > Service > Groups. Check that the service group has been added to the
services list and that it is correct.
Enter the following CLI command:
config firewall service group
edit <the name of the service that you wish to verify>
show full-configuration
Fortinet Technologies Inc. Page 1005 FortiOS Handbook - Firewall for FortiOS 5.0
Virtual IP address
The company has an web server on the internal network that needs to be accessed from the
Internet.
The internal IP address is 192.168.50.37
The external IP address is 256.85.94.60 (for example use only. Not a valid IP address)
The external IP address is assigned by ISP "A" on WAN1
The port that needs to be mapped is 80
Go to Firewall Objects > Virtual IP> Virtual IP and select Create New.
Fill out the fields with the following information.
Field Value
Name Web1-VIP
Color <optional>
Protocol TCP
Map to Port 80
Select OK.
Enter the following CLI command:
config firewall vip
edit Web1-VIP
set comment Virtual IP for the Forum Webserver
set extintf wan1
set extip 256.85.94.60
set mappedip 192.168.50.37
set portforward enable
set protocol tcp
set extport 80
set mapped port 80
end
end
Fortinet Technologies Inc. Page 1006 FortiOS Handbook - Firewall for FortiOS 5.0
To verify that the category was added correctly:
Go to Firewall Objects > Virtual IP> Virtual IP. Check that the virtual IP address has been added
to the list and that it is correct.
Enter the following CLI command:
config firewall vip
edit <the name of the vip that you wish to verify>
show full-configuration
VIP Group
The company has only a single external IP address but multiple servers with different functions
running on its internal LAN that need to be accessed from the Internet.
The external IP address of the company on wan1 is 256.34.56.149 (for example use only.
Not a valid IP address)
The webserver is on the internal LAN on 192.168.100.86
The webserver needs to answer on ports 80 443
The administration of the FortiGate firewall connects on port 4443 instead of 443
There is are also a separate email server, FTP server, and Terminal Server for specialised
applications.
2 Virtual IPs have been created to map 256.34.56.149 to 192.168.100.86 on ports 80 and
443. The names are webserver_80 and webserver_443 respectively.
Go to Firewall Objects > Virtual IP> Virtual IP and select Create New.
Fill out the fields with the following information.
Field Value
Comments (Optional)
Color (Optional)
Interface wan1
Fortinet Technologies Inc. Page 1007 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall vipgrp
edit <the name of the vip that you wish to verify>
show full-configuration
IP Pool
Your company has an application server on the internal network that sends out regular data
updates to an offsite service. In order to make the service site more secure, they only accept
connections from predefined IP address. If the external IP address of the FortiGate firewall
interface were used that would mean that the service would be accepting sessions from just
about any user in the network so a separate IP address need so be assigned for the Network
Address Translation.
The external address that will be used is one that has been assigned to the company by the
ISP on WAN2
The address is 256.100.42.129 (for example use only. Not a valid IP address)
Note: the ARP interface cannot be set in the Web-based Manager but as this is the only path
that the traffic will be coming from the outside this should not be an issue. The setting has been
included in the CLI instructions so that you will now how to set it in a situation where you want
the ARP replies to be answered only on a specific interface.
Go to Firewall Objects > Virtual IP > IP Pools
Fill out the fields with the following information:
Field Value
Name App_Server1
Type One-to-One
External IP Range/Subnet2 256.100.42.129
Select OK
Enter the following CLI command:
config firewall ippool
edit App_Server1
set comments ''Addresses assignment for this server only."
set type one-to-one
set arp-reply enable
set arp-intf wan2
set startip 256.100.42.129
set endip 256.100.42.129
end
To verify that the category was added correctly:
Go to Firewall Objects > Virtual IP > IP Pools
Fortinet Technologies Inc. Page 1008 FortiOS Handbook - Firewall for FortiOS 5.0
Check that the IP Pool has been added to the list of IP Pools and that the listed settings are
correct.
Enter the following CLI command:
config firewall ippool
edit <the name of the IP Pool you wish to verify>
show full-configuration
The company has a server on the Development LAN that needs to communicate with a server at
a remote site over the Internet. One of the restrictions on the communications between these
systems is that the IP address and source port must be specific.
Field Value
Select OK
Fortinet Technologies Inc. Page 1009 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall central-nat
edit 0
set orig-addr app-server
set nat-ippool app-server-ext
set orig-port 2000
set nat-port 12000-13000
next
end
To verify that the table was added correctly:
Go to Policy > Policy> Central NAT Table
Check that the table has been added to the list of Central NAT Tables and that the listed settings
are correct.
Enter the following CLI command:
config firewall central-nat
show full-configuration
Verify that the listing of tables includes the one that you have just configured, with the correct
settings.
When configuring the Central NAT in the GUI you may notice that only those addresses which
have been configured to be associated with any interface are displayed in the drop down menu
for choosing a Source Address and yet the CLI will allow any address to be used, not just those
associated with any interface. This is because by default the policies in the GUI use a function
of cross referencing which addresses are allowed based on which interface is involved in the
policy.When combined with the aspect of Central NAT that doesnt restrict to a specific
interface. This means the only addresses will be allowed are those associated with the any
interface. The CLI does not have this cross referencing function which is why the CLI seems
less restrictive. However, more care must be taken when using the CLI to make sure that
appropriate addresses are used.
The Company wants to allow the use of Facebook by employees, but only during none
business hours and the lunch break.
The business hours are 9:00 p.m. to 6:00 p.m.
The Lunch break is 12:00 p.m. to 1:00 p.m.
The plan is to create a schedule to cover the morning business hours and the afternoon
business hours and block access to the Facebook web site during that time.
Go to Firewall Objects > Schedule > IP Recurring.
Create a new schedule
Fill out the fields with the following information:
Fortinet Technologies Inc. Page 1010 FortiOS Handbook - Firewall for FortiOS 5.0
Field Value
Name Morning_Business_Hours
Sunday disabled
Monday enabled
Tuesday enabled
Wednesday enabled
Thursday enabled
Friday enabled
Saturday disabled
Select OK
Enter the following CLI command:
config firewall schedule recurring
edit Morning_Business_Hours
set day monday tuesday wednesday thursday friday
set start 09:00
set end 12:00
end
Create a second new schedule.
Field Value
Name Afternoon_Business_Hours
Sunday disabled
Monday enabled
Tuesday enabled
Wednesday enabled
Thursday enabled
Fortinet Technologies Inc. Page 1011 FortiOS Handbook - Firewall for FortiOS 5.0
Field Value
Friday enabled
Saturday disabled
Select OK
Enter the following CLI command:
config firewall schedule recurring
edit Afternoon_Business_Hours
set day monday tuesday wednesday thursday friday
set start 13:00
set end 18:00
end
To verify that the schedule was added correctly:
Go to Firewall Objects > Schedule > Recurring
Check that the schedule with the name you used has been added to the list of recurring
schedules and that the listed settings are correct.
Enter the following CLI command:
config firewall schedule recurring
edit <the name of the schedule you wish to verify>
show full-configuration
The company wants to change over their web site image to reference the new year. They have
decided to take this opportunity to do some hardware upgrades as well. Their web site is
business oriented so they have determined that over New Years Eve there will be very limited
traffic.
They are going to need a maintenance window of 2 hours bracketing midnight on New Years
Eve.
Go to Firewall Objects > Schedule > One-time.
Create a new schedule
Fill out the fields with the following information:
Start 2012 12 31 23 00
Stop 2013 1 1 1 00
Select OK
Fortinet Technologies Inc. Page 1012 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall schedule onetime
edit maintenance_window
set start 23:00 2012/12/31
set end 01:00 2013/01/01
next
end
To verify that the schedule was added correctly:
Go to Firewall Objects > Schedule > One-time
Check that the schedule with the name you used has been added to the list of recurring
schedules and that the listed settings are correct.
Enter the following CLI command:
config firewall schedule onetime
edit <the name of the schedule you wish to verify>
show full-configuration
Schedule Group
In order to make the administration of the policies easier a group needs to be created.
Go to Firewall Objects > Schedule > Groups.
Create a new group
Fill out the fields with the following information:
Field Value
Use arrows to move schedules from the Members field to the Available Schedules: field
Select OK
Enter the following CLI command:
config firewall service group
edit Business_Hours
set member Morning_Business_Hours Afternoon_Business _ours
end
To verify that the schedule was added correctly:
Go to Firewall Objects > Schedule > Groups
Check that the schedule group with the name you used has been added to the list of schedule
groups.
Fortinet Technologies Inc. Page 1013 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall service group
edit <the name of the schedule group you wish to verify>
show full-configuration
Proxy Option
The company will be using a number of the Security Profiles features on various policies but
wants to use as few profiles as possible to make administration simpler. The decision has been
made to have two profiles, the default one and a single customized one that will be a
combination of the settings required to cover the situations that will not be covered by the
default profile.
The company profile will have the following parameters:
There are no FTP servers running on the site so there is no need for FTP.
The company will use the Fortinet supplied default certificate called
Fortinet_CA_SSLProxy
The company will only be doing inspecting of SSL over HTTP, SMTP and IMAP.
The company has a non-standard IMAP implementation the uses ports 1143 and 1993 for
IMAP and IMAPS respectively.
Deep Scanning is to be enabled on any SSL traffic regardless of port and the traffic logged
but nothing is blocked.
The Comfort Clients is to be used with a ratio of 1 byte for every 15 seconds.
There is a lot of varied email traffic so there is to be no blocking of emails due to size beyond
the settings on the mail servers.
The Security Officer insists that invalid SSL certificates not be allowed.
Go to Policy > Policy > Proxy Options
Create a new profile
Fill out the fields with the following information:
Field Value
Name example_standard
Comments <optional>
Fortinet Technologies Inc. Page 1014 FortiOS Handbook - Firewall for FortiOS 5.0
Enable Protocol Inspection Ports
FTPS
SSH Any
Common Options
Field Value
Interval (Seconds) 15
Amount(bytes) 1
Fortinet Technologies Inc. Page 1015 FortiOS Handbook - Firewall for FortiOS 5.0
Web Options
Field Value
Email Options
Field Value
Fortinet Technologies Inc. Page 1016 FortiOS Handbook - Firewall for FortiOS 5.0
Select OK
Enter the following CLI command:
config firewall profile-protocol-options
edit example_standard
config http
set options clientcomfort no-content-summary
set comfort-interval 15
next
config https
set status enable
set options clientcomfort no-content-summary
set comfort-interval 15
next
config ftp
set status disable
set options clientcomfort no-content-summary splice
set comfort-interval 15
next
config ftps
set options clientcomfort no-content-summary splice
set comfort-interval 15
next
config imap
set ports "1143"
set options fragmail no-content-summary
next
config imaps
set ports "1993"
set status enable
set options fragmail no-content-summary
next
config mapi
set options fragmail no-content-summary
next
config pop3
set options fragmail no-content-summary
next
config pop3s
set status enable
set options fragmail no-content-summary
next
config smtp
set options fragmail no-content-summary splice
next
config smtps
set status enable
set options fragmail no-content-summary splice
next
Fortinet Technologies Inc. Page 1017 FortiOS Handbook - Firewall for FortiOS 5.0
config nntp
set options no-content-summary splice
next
config ssh
set inspect-all enable
set log x11-filter ssh-shell exec port-forward
next
end
Oversized Files
A couple of variations on the example could have to do with the processing of oversized files at
a level other than the default setting. The ways that it can be approached are:
1. Set a non default threshold size and block the files
2. Set a non default threshold size and not scan the files over the threshold but allow them to
pass through the FortiGate firewall.
In the following instructions:
We will just use 2 MB as the new threshold.
In the CLI instructions we will limit the configuration to just the HTTP settings for the
purposes of brevity and simplicity.
Option 1
Option 1 can be done in the GUI.
Go to Policy > Policy > Proxy Options
Create a new profile
Fill out the fields with the following information:
Common Options
Field Value
Interval (Seconds) 15
Amount(bytes) 1
Threshold(MB) 2
Select OK
Enter the following CLI command:
Fortinet Technologies Inc. Page 1018 FortiOS Handbook - Firewall for FortiOS 5.0
config firewall profile-protocol-options
edit example_standard
config http
set options clientcomfort no-content-summary oversize
set oversize-limit 2
set comfort-interval 15
next
end
Option 2
Option 2 can only be done in the CLI.
Enter the following CLI command:
config firewall profile-protocol-options
edit example_standard
config http
set options clientcomfort no-content-summary
set oversize-limit 2
set comfort-interval 15
next
end
A policy must be created to all traffic from one of the subnets off of the FortiGate out to the
Internet.
The traffic needs to be NATed
The Internal subnet that needs to be connected is connected to port 1
The subnet is from 192.168.1.1 to 192.168.1.255
There is a user defined address for this subnet named lan_192.168.1.x
The policy is for general Internet access over wan1.
The IT manager would like to keep an eye on the kinds of sites that users are going to so for
the time being even allowed traffic will be logged.
To prevent the spread of malware even the outgoing traffic will be screened for viruses using
the basic_outgoing_av profile that has already been defined by the IT Manager.
There is no schedule restriction on access to the Internet so the schedule is the predefined
always.
There is no restrictions yet on what protocols are allowed so the predefines services should
be used.
In order to prevent any HR issues a webfilter has been defined by the IT manager that blocks
access to inappropriate sites. The profile is called basic_web_filter
Go to Policy > Policy > Policy.
Create a new policy
Fortinet Technologies Inc. Page 1019 FortiOS Handbook - Firewall for FortiOS 5.0
Fill out the fields with the following information:
Field Value
Schedule always
Service ALL
Action Accept
Security Profiles
AntiVirus ON basic_outgoing_av
Select OK
Fortinet Technologies Inc. Page 1020 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall policy
edit 0
set srcintf port1
set dstintf wan1
set srcaddr lan_192.168.1.x
set dstaddr "all
set action accept
set schedule always
set service ALL
set logtraffic enable
set nat enable
set natip 0.0.0.0 0.0.0.0
set utm-status enable
set av-profile basic_outgoing_av
set webfilter-profile basic_web_filter
next
end
There is a Server on the Internal LAN that is used as a resource by sales people that are out on
the road and at home. The sales people and their administrator are the only ones that are
allowed access to the server SalesServer. Because of the importance of the data on the
server it needs to be backed up on a regular bases and to make sure that all of the files are
available for backup no one is allowed access during the scheduled backup time.
Firewall User Group has been created: sales. This is a group defined for more than one
purpose.
Firewall User has been created: jsmith, who is the administrator. jsmith is not a member
of the sales group and cant be placed in it because of other resources that the group has
access to.
A Virtual IP has been defined for the server SalesServer mapped from an external address
to an internal address on port9. Port forwarding is enabled on TCP port 443 for the
application that the sales people use.
The schedule Non-Maintenance_Window has been created (between 2 a.m. and 3 a.m.) by
starting the window at 3:00 and stopping at 2:00 (If the stop time is set earlier than the start
time, the stop time will be during the next day).
Because there is access from the Internet to the internal network the companys HTTPS
Server IPS profile, called Protect_HTTPS_Server will be enabled.
Go to Policy > Policy > Policy.
Create a new policy
Fill out the fields with the following information:
Field Value
Fortinet Technologies Inc. Page 1021 FortiOS Handbook - Firewall for FortiOS 5.0
Field Value
Certificate No Certificate
Firewall enabled
Comments (optional)
In the Configure Authentication Rules section, create a new Authentication rule by filling out the
fields with the following information.
Field Value
Group(s) sales
User(s) jsmith
Schedule Non-Maintenance_Window
Service HTTPS
Fortinet Technologies Inc. Page 1022 FortiOS Handbook - Firewall for FortiOS 5.0
Enable and select the security profiles as follows:
IPS ON Protect_HTTPS_Server
Select OK
Enter the following CLI command:
config firewall policy
edit 0
set srcintf "wan1"
set dstintf "port9"
set srcaddr "all"
set action accept
set identity-based enable
config identity-based-policy
edit 1
set schedule "Non-Maintenance_Window"
set utm-status enable
set profile-type single
set groups "sales"
set users "jsmith"
set dstaddr "SalesServer"
set service "HTTPS"
set ips-sensor "Protect_HTTPS_Server"
next
end
Fortinet Technologies Inc. Page 1023 FortiOS Handbook - Firewall for FortiOS 5.0
Firewall Device Identity Policy
The company is instituting a BYOD pilot project. They are going to be letting employees
personal devices connect through a wireless network. Most will only be allowed only to the
Internet but some will have access to the Internal LAN.
The wireless interface the users will be connecting on is WiFi.
The source address has been defined as the DCHP scope assigned to the wireless network,
Internal_wireless.
The Internal Network is on the interface designated as LAN
There is no need to NAT the traffic.
The AntiVirus Profile to be used is Internal-AV, already defined.
The Application Profile to be used is Internal-AC, already defined.
The IPS Profile to be used is Internal-IPS, already defined.
The Device group for this policy is IT_Personnel_phones.
The IT team is a trusted group that will be accessing practically everything so the schedule
will be the predefined always and the Service will be the predefined ALL.
While the IT team is trusted the company would like to verify that they are compliant with the
Endpoint profile so the check for this must be enabled on the policy.
Go to Policy > Policy > Policy.
Create a new policy
Fill out the fields with the following information:
Field Value
Comments (optional)
Fortinet Technologies Inc. Page 1024 FortiOS Handbook - Firewall for FortiOS 5.0
In the Configure Authentication Rules section, create a new Authentication rule by filling out the
fields with the following information.
Field Value
Device IT_Personnel_Phones
Schedule always
Service ALL
AntiVirus ON Internal-AV
Application ON Internal-AC
Control
IPS ON Internal-IPS
Fortinet Technologies Inc. Page 1025 FortiOS Handbook - Firewall for FortiOS 5.0
Select OK
Enter the following CLI command:
config firewall policy
edit 0
set srcintf "wifi"
set dstintf "LAN"
set srcaddr "Internal_wireless"
set action accept
set identity-based enable
set identity-from device
config identity-based-policy
edit 1
set schedule always
set utm-status enable
set dstaddr Internal_Network
set service ALL
set devices IT_Personnel_phones
set endpoint-compliance enable
set av-profile Internal-AV
set ips-sensor Internal-IPS
set application-list Internal-AC
next
end
DoS Policy
The company wishes to protect against Denial of Service attach. They have chosen some where
they wish to block the attacks of the incidence goes above a certain threshold and for some
others they are just trying to get a baseline of activity for those types of attacks so they are
letting the traffic pass through without action.
The interface to the Internet is on WAN1
There is no requirement to specify which addresses are being protected or protected from.
The protection is to extend to all services.
The TCP attacks are to be blocked
The UDP, ICMP, and IP attacks are to be recorded but not blocked.
The tcp_syn_flood attachs threshold is to be changed from the default to 1000
Go to Policy > Policy > DoS Policy.
Create a new policy
Fill out the fields with the following information:
Field Value
Incoming wan1
Interface
Fortinet Technologies Inc. Page 1026 FortiOS Handbook - Firewall for FortiOS 5.0
Field Value
Destination all
Addresses
Service ALL
Anomalies
Select OK
Fortinet Technologies Inc. Page 1027 FortiOS Handbook - Firewall for FortiOS 5.0
Enter the following CLI command:
config firewall DoS-policy
edit 0
set status enable
set interface ''
config anomaly
edit "tcp_syn_flood"
set status enable
set log enable
set action block
set threshold 1000
next
edit "tcp_port_scan"
set status enable
set log enable
set action block
next
edit "tcp_src_session"
set status enable
set log enable
set action block
next
edit "tcp_dst_session"
set status enable
set log enable
set action block
next
edit "udp_flood"
set status enable
set log enable
next
edit "udp_scan"
set status disable
set status enable
set log enable
next
edit "udp_src_session"
set status enable
set log enable
next
edit "udp_dst_session"
set status enable
set log enable
next
edit "icmp_flood"
set status enable
set log enable
next
Fortinet Technologies Inc. Page 1028 FortiOS Handbook - Firewall for FortiOS 5.0
edit "icmp_sweep"
set status enable
set log enable
next
edit "icmp_src_session"
set status enable
set log enable
next
edit "icmp_dst_session"
set status enable
set log enable
next
edit "ip_src_session"
set status enable
set log enable
next
edit "ip_dst_session"
set status enable
set log enable
next
end
next
end
Fortinet Technologies Inc. Page 1029 FortiOS Handbook - Firewall for FortiOS 5.0
Multicast forwarding
Multicasting (also called IP multicasting) consists of using a single multicast source to send
data to many receivers. Multicasting can be used to send data to many receivers
simultaneously while conserving bandwidth and reducing network traffic. Multicasting can be
used for one-way delivery of media streams to multiple receivers and for one-way data
transmission for news feeds, financial information, and so on.
Also RIPv2 uses multicasting to share routing table information, OSPF uses multicasting to
send hello packets and routing updates, Enhanced Interior Gateway Routing Protocol (EIGRP)
uses multicasting to send routing information to all EIGRP routers on a network segment and
the Bonjour network service uses multicasting for DNS.
A FortiGate unit can operate as a Protocol Independent Multicast (PIM) version 2 router.
FortiGate units support PIM sparse mode (RFC 4601) and PIM dense mode (RFC 3973) and can
service multicast servers or receivers on the network segment to which a FortiGate unit
interface is connected. Multicast routing is not supported in transparent mode (TP mode).
To support PIM communications, the sending/receiving applications and all connecting PIM
routers in between must be enabled with PIM version 2. PIM can use static routes, RIP, OSPF,
or BGP to forward multicast packets to their destinations. To enable source-to-destination
packet delivery, either sparse mode or dense mode must be enabled on the PIM-router
interfaces. Sparse mode routers cannot send multicast messages to dense mode routers. In
addition, if a FortiGate unit is located between a source and a PIM router, two PIM routers, or is
connected directly to a receiver, you must create a security policy manually to pass
encapsulated (multicast) packets or decapsulated data (IP traffic) between the source and
destination.
A PIM domain is a logical area comprising a number of contiguous networks. The domain
contains at least one Boot Strap Router (BSR), and if sparse mode is enabled, a number of
Rendezvous Points (RPs) and Designated Routers (DRs). When PIM is enabled on a FortiGate
unit, the FortiGate unit can perform any of these functions at any time as configured.
Sparse mode
Initially, all candidate BSRs in a PIM domain exchange bootstrap messages to select one BSR
to which each RP sends the multicast address or addresses of the multicast group(s) that it can
service. The selected BSR chooses one RP per multicast group and makes this information
available to all of the PIM routers in the domain through bootstrap messages. PIM routers use
the information to build packet distribution trees, which map each multicast group to a specific
RP. Packet distribution trees may also contain information about the sources and receivers
associated with particular multicast groups.
When a FortiGate unit interface is configured as a multicast interface, sparse mode is enabled
on it by default to ensure that distribution trees are not built unless at least one downstream
receiver requests multicast traffic from a specific source. If the sources of multicast traffic and
their receivers are close to each other and the PIM domain contains a dense population of
active receivers, you may choose to enable dense mode throughout the PIM domain instead.
Page 1030
packets (for example, a video feed) originating from the source can be forwarded to a certain
RP to reach a multicast destination.
Each PIM router maintains a Multicast Routing Information Base (MRIB) that determines to
which neighboring PIM router join and prune messages are sent. An MRIB contains
reverse-path information that reveals the path of a multicast packet from its source to the PIM
router that maintains the MRIB.
To send multicast traffic, a server application sends IP traffic to a multicast group address. The
locally elected DR registers the sender with the RP that is associated with the target multicast
group. The RP uses its MRIB to forward a single stream of IP packets from the source to the
members of the multicast group. The IP packets are replicated only when necessary to
distribute the data to branches of the RPs distribution tree.
To receive multicast traffic, a client application can use Internet Group Management Protocol
(IGMP) version 1 (RFC 1112), 2 (RFC 2236), or 3 (RFC 3376) control messages to request the
traffic for a particular multicast group. The locally elected DR receives the request and adds the
host to the multicast group that is associated with the connected network segment by sending
a join message towards the RP for the group. Afterward, the DR queries the hosts on the
connected network segment continually to determine whether the hosts are active. When the
DR no longer receives confirmation that at least one member of the multicast group is still
active, the DR sends a prune message towards the RP for the group.
FortiOS supports PIM sparse mode multicast routing for IPv6 multicast (multicast6) traffic and is
compliant with RFC 4601: Protocol Independent Multicast - Sparse Mode (PIM-SM). You can
use the following command to configure IPv6 PIM sparse multicast routing.
config router multicast6
set multicast-routing {enable | disable}
config interface
edit <interface-name>
set hello-interval <1-65535 seconds>
set hello-holdtime <1-65535 seconds>
end
config pim-sm-global
config rp-address
edit <index>
set ipv6-address <ipv6-address>
end
The following diagnose commands for IPv6 PIM sparse mode are also available:
diagnose ipv6 multicast status
diagnose ipv6 multicast vif
diagnose ipv6 multicast mroute
Dense mode
The packet organization used in sparse mode is also used in dense mode. When a multicast
source begins to send IP traffic and dense mode is enabled, the closest PIM router registers the
IP traffic from the multicast source (S) and forwards multicast packets to the multicast group
address (G). All PIM routers initially broadcast the multicast packets throughout the PIM domain
to ensure that all receivers that have requested traffic for multicast group address G can access
the information if needed.
To forward multicast packets to specific destinations afterward, the PIM routers build
distribution trees based on the information in multicast packets. Upstream PIM routers depend
Fortinet Technologies Inc. Page 1031 FortiOS Handbook - Firewall for FortiOS 5.0
on prune/graft messages from downstream PIM routers to determine if receivers are actually
present on directly connected network segments. The PIM routers exchange state refresh
messages to update their distribution trees. FortiGate units store this state information in a Tree
Information Base (TIB), which is used to build a multicast forwarding table. The information in
the multicast forwarding table determines whether packets are forwarded downstream. The
forwarding table is updated whenever the TIB is modified.
PIM routers receive data streams every few minutes and update their forwarding tables using
the source (S) and multicast group (G) information in the data stream. Superfluous multicast
traffic is stopped by PIM routers that do not have downstream receiversPIM routers that do
not manage multicast groups send prune messages to the upstream PIM routers. When a
receiver requests traffic for multicast address G, the closest PIM router sends a graft message
upstream to begin receiving multicast packets.
FortiGate units operating in NAT mode can also be configured as multicast routers. You can
configure a FortiGate unit to be a Protocol Independent Multicast (PIM) router operating in
Sparse Mode (SM) or Dense Mode (DM).
Multicast IP addresses
Multicast uses the Class D address space. The 224.0.0.0 to 239.255.255.255 IP address range
is reserved for multicast groups. The multicast address range applies to multicast groups, not to
the originators of multicast packets. Table 53 lists reserved multicast address ranges and
describes what they are reserved for:
Reserved
Use Notes
Address Range
224.0.0.0 to Used for network protocols on In this range, packets are not
224.0.0.255 local networks. For more forwarded by the router but remain on
information, see RFC 1700. the local network. They have a Time to
Live (TTL) of 1. These addresses are
used for communicating routing
information.
239.0.0.0 to Limited scope addresses used for Routers are configured with filters to
239.255.255.255 local groups and organizations. For prevent multicasts to these addresses
more information, see RFC 2365. from leaving the local system.
Creating multicast security policies requires multicast firewall addresses. You can add multicast
firewall addresses by going to Firewall Objects > Address > Addresses and selecting Create
New > Multicast Address. The factory default configuration includes multicast addresses for
Bonjour(224.0.0.251-224.0.0.251, EIGRP (224.0.0.10-224.0.0.100), OSPF
(224.0.0.5-224.0.0.60), all_hosts (224.0.0.1-224.0.0.1), and all_routers (224.0.0.2-224.0.0.2).
Fortinet Technologies Inc. Page 1032 FortiOS Handbook - Firewall for FortiOS 5.0
PIM Support
A FortiGate unit can be configured to support PIM by going to Router > Dynamic > Multicast
and enabling multicast routing. You can also enable multicast routing using the config
router multicast CLI command. When PIM is enabled, the FortiGate unit allocates memory
to manage mapping information. The FortiGate unit communicates with neighboring PIM
routers to acquire mapping information and if required, processes the multicast traffic
associated with specific multicast groups.
The end-user multicast client-server applications must be installed and configured to initiate
Internet connections and handle broadband content such as audio/video information.
Client applications send multicast data by registering IP traffic with a PIM-enabled router. An
end-user could type in a class D multicast group address, an alias for the multicast group
address, or a call-conference number to initiate the session.
Rather than sending multiple copies of generated IP traffic to more than one specific IP
destination address, PIM-enabled routers encapsulate the data and use the one multicast group
address to forward multicast packets to multiple destinations. Because one destination address
is used, a single stream of data can be sent. Client applications receive multicast data by
requesting that the traffic destined for a certain multicast group address be delivered to them
end-users may use phone books, a menu of ongoing or future sessions, or some other method
through a user interface to select the address of interest.
A class D address in the 224.0.0.0 to 239.255.255.255 range may be used as a multicast group
address, subject to the rules assigned by the Internet Assigned Numbers Authority (IANA). All
class D addresses must be assigned in advance. Because there is no way to determine in
advance if a certain multicast group address is in use, collisions may occur (to resolve this
problem, end-users may switch to a different multicast address).
In both transparent mode and NAT mode you can configure FortiGate units to forward multicast
traffic.
For a FortiGate unit to forward multicast traffic you must add FortiGate multicast security
policies. Basic multicast security policies accept any multicast packets at one FortiGate
Fortinet Technologies Inc. Page 1033 FortiOS Handbook - Firewall for FortiOS 5.0
interface and forward the packets out another FortiGate interface. You can also use multicast
security policies to be selective about the multicast traffic that is accepted based on source and
destination address, and to perform NAT on multicast packets.
In the example shown in Figure 176, a multicast source on the Marketing network with IP
address 192.168.5.18 sends multicast packets to the members of network 239.168.4.0. At the
FortiGate unit, the source IP address for multicast packets originating from workstation
192.168.5.18 is translated to 192.168.18.10. In this example, the FortiGate unit is not acting as
a multicast router.
RIPv1 uses broadcasting to share routing table information. To allow RIPv1 packets through a
FortiGate unit you can add standard security policies. Security policies to accept RIPv1 packets
can use the ANY predefined firewall service or the RIP predefined firewall service.
Fortinet Technologies Inc. Page 1034 FortiOS Handbook - Firewall for FortiOS 5.0
Figure 176:Example multicast network including a FortiGate unit that forwards multicast
packets
of
e rs up
mb ro
Me ast G4.0
lti c 8. 4
Mu39.16 er_
r_3 ce
iv
2 e ive Re
c
Re
r_2
e ive
c
Re
e r_1
c eiv
Re
Fo
r
int tiGat
ern e-
ex al 800
te I
DM rnal P: 19
Z I IP: 2.1
Multicast Forwarding Enabled P: 17 68
Source address: 192.168.5.18 19 2.2 .5.1
2.1 0.
Source interface: internal 68 20.
.6. 10
1
Destination address: 239.168.4.0
Destination interface: external
NAT IP: 192.168.18.10
D 2.1
ev 6
19
el 8.6
op .
m 0/2
ss ing
en 4
M 16
19
ar 8.
re et
t
2.
dd rk
ke 5.
9. dr sts .18 a a
tin 0/2
23 ad ica 8.5 t IP e M
g 4
IP ult 16 a th
m 2. or on
19 tw er
d
8. ss o
ne en
16 e t
S
0
4.
You configure FortiGate multicast forwarding from the Command Line Interface (CLI). Two steps
are required:
Adding multicast security policies
Enabling multicast forwarding
This second step is only required if your FortiGate unit is operating in NAT mode. If your
FortiGate unit is operating in transparent mode, adding a multicast policy enables multicast
forwarding.
There is sometimes a confusion between the terms forwarding and routing. These two
functions should not be taking place at the same time.
It is mentioned that multicast-forward should be enabled when the FortiGate unit is in NAT
mode and that this will forward any multicast packet to all interfaces. However, this parameter
should NOT be enabled when the FortiGate unit operates as a multicast router (i.e. with a
routing protocol enabled. It should only be enabled when there is no routing protocols
activated.
Fortinet Technologies Inc. Page 1035 FortiOS Handbook - Firewall for FortiOS 5.0
Adding multicast security policies
You need to add security policies to allow packets to pass from one interface to another.
Multicast packets require multicast security policies. You add multicast security policies from
the CLI using the config firewall multicast-policy command. As with unicast
security policies, you specify the source and destination interfaces and optionally the allowed
address ranges for the source and destination addresses of the packets.
You can also use multicast security policies to configure source NAT and destination NAT for
multicast packets.
Keep the following in mind when configuring multicast security policies:
The matched forwarded (outgoing) IP multicast source IP address is changed to the
configured IP address.
Source and Destination interfaces are optional. If left blank, then the multicast will be
forwarded to ALL interfaces.
Source and Destination addresses are optional. If left un set, then it will mean ALL
addresses.
The nat keyword is optional. Use it when source address translation is needed.
Enabling multicast forwarding is only required if your FortiGate unit is operating in NAT mode. If
your FortiGate unit is operating in transparent mode, adding a multicast policy enables
multicast forwarding.
Fortinet Technologies Inc. Page 1036 FortiOS Handbook - Firewall for FortiOS 5.0
avoid any issues during transmission, you can set up multicast security policies. These types of
security policies can only be enabled using the CLI.
The CLI parameter multicast-skip-policy must be disabled when using multicast security
policies. To disable enter the command
config system settings
set multicast-skip-policy disable
end
Fortinet Technologies Inc. Page 1037 FortiOS Handbook - Firewall for FortiOS 5.0
interface. When the packets leave the external interface their source address is translated to
192.168.18.10.
config firewall multicast-policy
edit 5
set srcaddr example-addr_X
set srcintf internal
set destaddr example-addr_Y
set dstintf external
set nat 192.168.18.10
end
This example shows how to configure a multicast security policy so that the FortiGate unit
forwards multicast packets from a multicast Server with an IP 10.10.10.10, represented by
address object "example-addr_C", is broadcasting to address 225.1.1.1, represented by
address object "example-addr_D". This Server is on the network connected to the FortiGate
DMZ interface.
config firewall multicast-policy
edit 1
set srcintf DMZ
set srcaddr example-addr_C
set dstintf Internal
set dstaddr example-addr_D
set action accept
edit 2
set action deny
end
This section contains the following multicast routing configuration examples and information:
Example FortiGate PIM-SM configuration using a static RP
FortiGate PIM-SM debugging examples
Example multicast destination NAT (DNAT) configuration
Example PIM configuration that uses BSR to find the RP
Fortinet Technologies Inc. Page 1038 FortiOS Handbook - Firewall for FortiOS 5.0
Figure 177:Example FortiGate PIM-SM topology
.x
ter 00
ou 4.2
_ 1 r 3.23 ck0)
0 23 ba
75 op
_3 p
i s co grou 0.1 lo
C for .10
RP 9.254
)
250
(16
(.
23
0/
E
F
16
9.2
54
.82
.0/
24
10
.31
M . 25
Cis VL .138.
ul 25 4.
16 3.
tic 4 20
co AN 0/2
9
23
as .8 0.
_3
t S 2.1 1
75 13 4
ou
rc 0_ 8
e 2r
ou
1)
ter
(.
10
24
.31
0/
E VL .130.
F Fo
rtiG AN 0/2
0)
13 4
25
ate
(.
-80 8
23
0
0/
3)
E
F
25
(.
al
rn
Cis 10
te
co .31
ex
_3 .12
1)
75
(.
0_ 8.1
al
28
rn
3r /30
te
ou
in
0)
ter
25
(.
24
0/
E
F
0)
13
(.
23
0/
E
F
1
4. 9)
0.
25 12
20
3. r (.
23 ve
i
up ce
ro e
G R
The configuration uses a statically configured rendezvous point (RP) which resides on the
Cisco_3750_1. Using a bootstrap router (BSR) was not tested in this example. See Example
PIM configuration that uses BSR to find the RP on page 1055 for an example that uses a BSR.
Configuration steps
The following procedures show how to configure the multicast configuration settings for the
devices in the example configuration.
Cisco_3750_1 router configuration
Cisco_3750_2 router configuration
To configure the FortiGate-800 unit
Cisco_3750_3 router configuration
Fortinet Technologies Inc. Page 1039 FortiOS Handbook - Firewall for FortiOS 5.0
Cisco_3750_1 router configuration
version 12.2
!
hostname Cisco-3750-1
!
switch 1 provision ws-c3750-24ts
ip subnet-zero
ip routing
!
ip multicast-routing distributed
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
interface Loopback0
ip address 169.254.100.1 255.255.255.255
!
interface FastEthernet1/0/23
switchport access vlan 182
switchport mode access
!
interface FastEthernet1/0/24
switchport access vlan 172
switchport mode access
!
interface Vlan172
ip address 10.31.138.1 255.255.255.0
ip pim sparse-mode
ip igmp query-interval 125
ip mroute-cache distributed
!
interface Vlan182
ip address 169.254.82.250 255.255.255.0
ip pim sparse-mode
ip mroute-cache distributed
!
ip classless
ip route 0.0.0.0 0.0.0.0 169.254.82.1
ip http server
ip pim rp-address 169.254.100.1 Source-RP
!
ip access-list standard Source-RP
permit 233.254.200.0 0.0.0.255
Fortinet Technologies Inc. Page 1040 FortiOS Handbook - Firewall for FortiOS 5.0
Cisco_3750_2 router configuration
version 12.2
!
hostname Cisco-3750-2
!
switch 1 provision ws-c3750-24ts
ip subnet-zero
ip routing
!
ip multicast-routing distributed
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
interface FastEthernet1/0/23
switchport access vlan 138
switchport mode access
!
interface FastEthernet1/0/24
switchport access vlan 182
witchport mode access
!
interface Vlan138
ip address 10.31.138.250 255.255.255.0
ip pim sparse-mode
ip mroute-cache distributed
!
interface Vlan182
ip address 169.254.82.1 255.255.255.0
ip pim sparse-mode
ip mroute-cache distributed
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.31.138.253
ip route 169.254.100.1 255.255.255.255 169.254.82.250
ip http server
ip pim rp-address 169.254.100.1 Source-RP
!
!
ip access-list standard Source-RP
permit 233.254.200.0 0.0.0.255
Fortinet Technologies Inc. Page 1041 FortiOS Handbook - Firewall for FortiOS 5.0
To configure the FortiGate-800 unit
1. Configure the internal and external interfaces.
Internal
Go to System > Network > Interfaces.
Select the internal interface
Verify the following settings:
Select OK
External
Go to System > Network > Interfaces.
Select the external interface
Verify the following settings:
Select OK.
Fortinet Technologies Inc. Page 1042 FortiOS Handbook - Firewall for FortiOS 5.0
2. Add a firewall addresses.
Go to Firewall Objects > Address > Addresses.
RP
Select Create New.
Use the following settings:
Category: Address
Name: RP
Type: Subnet
Interface: Any
Select OK.
Multicast source subnet
Select Create New.
Use the following settings:
Category: Address
Name: multicast_source_subnet
Type: Subnet
Subnet/IP 169.254.82.0/24
Range:
Interface: Any
Select OK.
3. Add destination multicast address
Go to Firewall Objects > Address > Addresses.
Select Create New.
Use the following settings:
Name: Multicast_stream
Interface: Any
Select OK.
Fortinet Technologies Inc. Page 1043 FortiOS Handbook - Firewall for FortiOS 5.0
4. Add standard security policies to allow traffic to reach the RP.
Go to Policy > Policy > Policy
1st policy
Select Create New
Use the following settings:
Destination Address: RP
Schedule: always
Service: ALL
Action: ACCEPT
Select OK.
2nd policy
Select Create New
Use the following settings:
Source Address: RP
Schedule: always
Service: ALL
Action: ACCEPT
Select OK.
Fortinet Technologies Inc. Page 1044 FortiOS Handbook - Firewall for FortiOS 5.0
5. Add the multicast security policy.
Go to Policy > Policy > Multicast Policy
Select Create New
Use the following settings:
Protocol: Any
Action: ACCEPT
Select OK.
6. Add an access list. (CLI only)
config router access-list
edit Source-RP
config rule
edit 1
set prefix 233.254.200.0 255.255.255.0
set exact-match disable
next
end
7. Add some static routes.
Go to Router > Static > Static Routes.
Route 1
Select Create New.
Use the following settings:
Device: internal
Gateway: 10.31.130.250
Select OK.
Route 2
Select Create New.
Use the following settings:
Device: external
Gateway: 10.31.138.250
Select OK.
Fortinet Technologies Inc. Page 1045 FortiOS Handbook - Firewall for FortiOS 5.0
8. Configure multicast routing.
Go to Router > Dynamic > Multicast.
Add the following Static Rendezvous Point(s):
169.254.100.1
Route 1
Select Create New.
Use the following settings:
Interface: internal
Select OK.
Route 2
Select Create New.
Use the following settings:
Interface: external
DR Priority:
RP Candidate:
RP Candidate
Priority:
Select OK.
Fortinet Technologies Inc. Page 1046 FortiOS Handbook - Firewall for FortiOS 5.0
Cisco_3750_3 router configuration
version 12.2
!
hostname Cisco-3750-3
!
switch 1 provision ws-c3750-24ts
ip subnet-zero
ip routing
!
ip multicast-routing distributed
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
interface FastEthernet1/0/23
switchport access vlan 128
switchport mode access
!
interface FastEthernet1/0/24
switchport access vlan 130
switchport mode access
!
interface Vlan128
ip address 10.31.128.130 255.255.255.252
ip pim sparse-mode
ip mroute-cache distributed
!
interface Vlan130
ip address 10.31.130.250 255.255.255.0
ip pim sparse-mode
ip mroute-cache distributed
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.31.130.1
ip http server
ip pim rp-address 169.254.100.1 Source-RP
!
!
ip access-list standard Source-RP
permit 233.254.200.0 0.0.0.255
Fortinet Technologies Inc. Page 1047 FortiOS Handbook - Firewall for FortiOS 5.0
Figure 178:PIM-SM debugging topology
10
.16
6.0
.0/
24
M 9.
ul 25
23
tic 5
10
as .2
.13
t S 55
0.0
ou .1
.0/
rc
e
24
(.
11
)
al
rn
te
In
10
7)
.13
l
na
23
2.0
er
(.
xt
1
.0/
T-
E
24
G
F
al
rn
te
In
10
.16
l
7.0
32
na
1/
er
.0/
ck 68 )
ba .1 56
) .1.
xt
24
op 92 (.1
E
( l o P 1 -2
R T
G
F
2
rt
po
6)
3
22
rt
po
(.
3
T-
G
F
)
62
(.
r
ve
ei
ec
R
Checking that the receiver has joined the required group
From the last hop router, FGT-3, you can use the following command to check that the receiver
has correctly joined the required group.
FGT-3 # get router info multicast igmp groups
IGMP Connected Group Membership
Group Address Interface Uptime Expires Last Reporter
239.255.255.1 port3 00:31:15 00:04:02 10.167.0.62
Only 1 receiver is displayed for a particular group, this is the device that responded to the IGMP
query request from the FGT-3. If a receiver is active the expire time should drop to
approximately 2 minutes before being refreshed.
Fortinet Technologies Inc. Page 1048 FortiOS Handbook - Firewall for FortiOS 5.0
Checking that the PIM router can reach the RP
The rendezvous point (RP) must be reachable for the PIM router (FGT-3) to be able to send the
*,G join to request the stream. This can be checked for FGT-3 using the following command:
FGT-3 # get router info multicast pim sparse-mode rp-mapping
PIM Group-to-RP Mappings
Group(s): 224.0.0.0/4, Static
RP: 192.168.1.1
Uptime: 07:23:00
(*,*,RP) Entries: 0
(*,G) Entries: 1
(S,G) Entries: 1
(S,G,rpt) Entries: 1
FCR Entries: 0
(*,*,RP) This state may be reached by general joins for all groups served by a
Entries specified RP.
(*,G) Entries State that maintains the RP tree for a given group.
(S,G) Entries State that maintains a source-specific tree for source S and group G.
FCR The FCR state entries are for tracking the sources in the <*, G> when <S,
G> is not available for any reason, the stream would typically be flowing
when this state exists.
Fortinet Technologies Inc. Page 1049 FortiOS Handbook - Firewall for FortiOS 5.0
In this case FGT-3 is the last hop router so the IGMP join is received locally on port3. There is no
PIM outgoing interface listed for this entry as it is used for the upstream PIM join.
(10.166.0.11, 239.255.255.1)
RPF nbr: 10.132.0.156
RPF idx: port2
SPT bit: 1
Upstream State: JOINED
Local:
Joined:
Asserted:
Outgoing:
port3
This is the entry for the SPT, no RP IS listed. The S,G stream will be forwarded out of the stated
outgoing interface.
(10.166.0.11, 239.255.255.1, rpt)
RP: 192.168.1.1
RPF nbr: 10.132.0.156
RPF idx: port2
Upstream State: NOT PRUNED
Local:
Pruned:
Outgoing:
The above S,G,RPT state is created for all streams that have both a S,G and a *,G entry on the
router. This is not pruned in this case because of the topology, the RP and source are reachable
over the same interface.
Although not seen in this scenario, assert states may be seen when multiple PIM routers exist
on the same LAN which can lead to more than one upstream router having a valid forwarding
state. Assert messages are used to elect a single forwarder from the upstream devices.
Fortinet Technologies Inc. Page 1050 FortiOS Handbook - Firewall for FortiOS 5.0
Viewing the PIM multicast forwarding table
Also you can check the multicast forwarding table showing the ingress and egress ports of the
multicast stream.
FGT-3 # get router info multicast table
(*,*,RP) Entries: 0
(*,G) Entries: 1
(S,G) Entries: 1
(S,G,rpt) Entries: 1
FCR Entries: 0
(*, 239.255.255.1)
RP: 192.168.1.1
RPF nbr: 0.0.0.0
RPF idx: None
Upstream State: JOINED
Local:
Joined:
external
Asserted:
FCR:
Fortinet Technologies Inc. Page 1051 FortiOS Handbook - Firewall for FortiOS 5.0
The *,G entry now has a joined interface rather than local because it has received a PIM join
from FGT-3 rather than a local IGMP join.
(10.166.0.11, 239.255.255.1)
RPF nbr: 10.130.0.237
RPF idx: internal
SPT bit: 1
Upstream State: JOINED
Local:
Joined:
external
Asserted:
Outgoing:
external
The S,G entry shows that we have received a join on the external interface and the stream is
being forwarded out of this interface.
(10.166.0.11, 239.255.255.1, rpt)
RP: 192.168.1.1
RPF nbr: 0.0.0.0
RPF idx: None
Upstream State: PRUNED
Local:
Pruned:
Outgoing:
External
The S,G,RPT is different from FGT-3 because FGT-2 is the RP, it has pruned back the SPT for
the RP to the first hop router.
(*,*,RP) Entries: 0
(*,G) Entries: 0
(S,G) Entries: 1
(S,G,rpt) Entries: 1
FCR Entries: 0
Below the S,G is the SPT termination because this FortiGate unit is the first hop router, the RPF
neighbor always shows as 0.0.0.0 because the source is local to this device. Both the joined
and outgoing fields show as external because the PIM join and the stream is egressing on this
interface.
(10.166.0.11, 239.255.255.1)
RPF nbr: 0.0.0.0
RPF idx: None
SPT bit: 1
Upstream State: JOINED
Fortinet Technologies Inc. Page 1052 FortiOS Handbook - Firewall for FortiOS 5.0
Local:
Joined:
external
Asserted:
Outgoing:
external
The stream has been pruned back from the RP because the end-to-end SPT is flowing, there is
no requirement for the stream to be sent to the RP in this case.
(10.166.0.11, 239.255.255.1, rpt)
RP: 0.0.0.0
RPF nbr: 10.130.0.156
RPF idx: external
Upstream State: RPT NOT JOINED
Local:
Pruned:
Outgoing:
Fortinet Technologies Inc. Page 1053 FortiOS Handbook - Firewall for FortiOS 5.0
Figure 179:Example multicast DNAT topology
10
.16
6.0
.0/
24
.3 11
.1
33 .0.
.3
:2 6
IP 16
n 0.
M 10 p 233
io 1
ul .1 23 .3
IP ou p
at P:
tic 6 3 .
10
tin e I
G rou
T
as 6. .2. 3.1
.12
A
r
54 10
e s rc
G
t S 0.1 2. 1
.1
D ou
5.0
.2 0.
.3
ou 1/
39 8.2
S
.0/
rc 24
:2 6
e
24
IP .1
n 92
1
io 1
at P:
tin e I
es rc
D ou
S
10
.12
8 s
0/ p
6.0
0. ou
.0/
23 P f -1
0. gr
R T
24
3. or
G
8
6
rt
po
10
.12
7.0
7
23 n 4 e
.0/
rt
p co /2 fac
po
2. ed
24
ou in 0.1 er
fo tat 16 ck )
S 2. ba (FW
2. ur
gr jo 2 t
r ic 8. in
3. fig
1
1 9 o p -2
Lo T
G
F
.2 11
.1
33 .0.
.2
:2 6
IP 16
p
n 0.
ou
io 1
gr
at P:
T
tin e I
16 r
A
0/ fo
.1
54 1
e s rc
.2 0.
0. P
.1
D ou
4. R
39 8.2
S
2 3 S R -3
25 nd
:2 6
B T
IP .1
9. a
G
n 92
F
io 1
at P:
tin e I
9. 25 /2 er
es rc
23 9. .62 iv
D ou
25 4. 4
e
up 2 .0 c
4. 1.1
S
ro p 27 Re
1
3.
G rou .1 st
G 10 ica
IP ult
3
M
To configure FGT-2 for DNAT multicast
1. Add a loopback interface. In the example, the loopback interface is named loopback.
config system interface
edit loopback
set vdom root
set ip 192.168.20.1 255.255.255.0
set type loopback
next
end
2. Add PIM and add a unicast routing protocol to the loopback interface as if it was a normal
routed interface. Also add static joins to the loopback interface for any groups to be
translated.
config router multicast
config interface
edit loopback
set pim-mode sparse-mode
config join-group
edit 233.2.2.1
next
edit 233.3.3.1
next
end
next
Fortinet Technologies Inc. Page 1054 FortiOS Handbook - Firewall for FortiOS 5.0
3. In this example, to add firewall multicast policies, different source IP addresses are required
so you must first add an IP pool:
config firewall ippool
edit Multicast_source
set endip 192.168.20.20
set interface port6
set startip 192.168.20.10
next
end
4. Add the translation security policies.
Policy 2, which is the source NAT policy, uses the actual IP address of port6. Policy 1, the
DNAT policy, uses an address from the IP pool.
config firewall multicast-policy
edit 1
set dnat 239.254.3.1
set dstaddr example-addr_P
set dstintf loopback
set nat 192.168.20.10
set srcaddr example-addr_Q
set srcintf port6
next
edit 2
set dnat 239.254.1.1
set dstaddr example-addr_R
set dstintf loopback
set nat 192.168.20.1
set srcaddr example-addr_Q
set srcintf port6
next
end
5. Add a firewall multicast policy to forward the stream from the loopback interface to the
physical outbound interface.
This example is an any/any policy that makes sure traffic accepted by the other multicast
policies can exit the FortiGate unit.
config firewall multicast-policy
edit 3
set dstintf port7
set srcintf loopback
next
end
Fortinet Technologies Inc. Page 1055 FortiOS Handbook - Firewall for FortiOS 5.0
The configuration uses a Boot Start Router (BSR) to find the Rendezvous Points (RPs) instead
of using static RPs. Under interface configuration, the loopback interface lo0 must join the
236.1.1.1 group (source).
This example describes:
Commands used in this example
Configuration steps
Example debug commands
0
55
c o3
Cis witch
s
1
r
ve
ei
ec
R
Fo
rtiG
F P 23 .1
or fo 7. .1
ate
tiG r 1. .1
R
-50
at 237 1.1
e- .1
0A
50 .1
_
23
2
0A .1
8
_1
F RP rio
or
tiG fo ity
a t o 25
er 40
e- th 6
P
ut 6
50 er
r
ro o 3
0A s
r
c
_3
is
C
F RP Pr
or
tiG fo rit
at o y 1
S
e- th
en
50 er
r
de
io
0A s
r
_4
2
r
ve
ei
ec
R
Commands used in this example
This example uses CLI commands for the following configuration settings:
Adding a loopback interface (lo0)
Defining the multicast routing
Adding the NAT multicast policy
Fortinet Technologies Inc. Page 1056 FortiOS Handbook - Firewall for FortiOS 5.0
Adding a loopback interface (lo0)
Where required, the following command is used to define a loopback interface named lo0.
config system interface
edit lo0
set vdom root
set ip 1.4.50.4 255.255.255.255
set allowaccess ping https ssh snmp http telnet
set type loopback
next
end
Fortinet Technologies Inc. Page 1057 FortiOS Handbook - Firewall for FortiOS 5.0
Adding the NAT multicast policy
In this example, the incoming multicast policy does the address translation. The NAT
address should be the same as the IP address of the of loopback interface. The DNAT
address is the translated address, which should be a new group.
config firewall multicast-policy
edit 1
set dstintf port6
set srcintf lo0
next
edit 2
set dnat 238.1.1.1
set dstintf lo0
set nat 1.4.50.4
set srcintf port1
next
Configuration steps
In this sample, FortiGate-500A_1 is the RP for the group 228.1.1.1, 237.1.1.1, 238.1.1.1, and
FortiGate-500A_4 is the RP for the other group which has a priority of1. OSPF is used in this
example to distribute routes including the loopback interface. All firewalls have full mesh
security policies to allow any to any.
In the FortiGate-500A_1 configuration, the NAT policy translates source address 236.1.1.1 to
237.1.1.1
In the FortiGate-500A_4, configuration, the NAT policy translates source 236.1.1.1 to
238.1.1.1
Source 236.1.1.1 is injected into network as well.
The following procedures include the CLI commands for configuring each of the FortiGate units
in the example configuration.
To configure FortiGate-500A_1
1. Configure multicast routing.
config router multicast
config interface
edit port5
set pim-mode sparse-mode
next
edit port4
set pim-mode sparse-mode
next
edit lan
set pim-mode sparse-mode
next
edit port1
set pim-mode sparse-mode
next
edit lo999
set pim-mode sparse-mode
next
Fortinet Technologies Inc. Page 1058 FortiOS Handbook - Firewall for FortiOS 5.0
edit lo0
set pim-mode sparse-mode
set rp-candidate enable
set rp-candidate-group 1
next
end
set multicast-routing enable
config pim-sm-global
set bsr-candidate enable
set bsr-interface lo0
end
end
2. Add multicast security policies.
config firewall multicast-policy
edit 1
set dstintf port5
set srcintf port4
next
edit 2
set dstintf port4
set srcintf port5
next
edit 3
next
end
3. Add router access lists.
config router access-list
edit 1
config rule
edit 1
set prefix 228.1.1.1 255.255.255.255
set exact-match enable
next
edit 2
set prefix 237.1.1.1 255.255.255.255
set exact-match enable
next
edit 3
set prefix 238.1.1.1 255.255.255.255
set exact-match enable
next
end
next
end
Fortinet Technologies Inc. Page 1059 FortiOS Handbook - Firewall for FortiOS 5.0
To configure FortiGate-500A_2
1. Configure multicast routing.
config router multicast
config interface
edit "lan"
set pim-mode sparse-mode
next
edit "port5"
set pim-mode sparse-mode
next
edit "port2"
set pim-mode sparse-mode
next
edit "port4"
set pim-mode sparse-mode
next
edit "lo_5"
set pim-mode sparse-mode
config join-group
edit 236.1.1.1
next
end
next
end
set multicast-routing enable
end
2. Add multicast security policies.
config firewall multicast-policy
edit 1
set dstintf lan
set srcintf port5
next
edit 2
set dstintf port5
set srcintf lan
next
edit 4
set dstintf lan
set srcintf port2
next
edit 5
set dstintf port2
set srcintf lan
next
edit 7
set dstintf port1
set srcintf port2
next
edit 8
Fortinet Technologies Inc. Page 1060 FortiOS Handbook - Firewall for FortiOS 5.0
set dstintf port2
set srcintf port1
next
edit 9
set dstintf port5
set srcintf port2
next
edit 10
set dstintf port2
set srcintf port5
next
edit 11
set dnat 237.1.1.1
set dstintf lo_5
set nat 5.5.5.5
set srcintf port2
next
edit 12
set dstintf lan
set srcintf lo_5
next
edit 13
set dstintf port1
set srcintf lo_5
next
edit 14
set dstintf port5
set srcintf lo_5
next
edit 15
set dstintf port2
set srcintf lo_5
next
edit 16
next
end
To configure FortiGate-500A_3
1. Configure multicast routing.
config router multicast
config interface
edit port5
set pim-mode sparse-mode
next
edit port6
set pim-mode sparse-mode
next
edit lo0
set pim-mode sparse-mode
Fortinet Technologies Inc. Page 1061 FortiOS Handbook - Firewall for FortiOS 5.0
set rp-candidate enable
set rp-candidate-priority 255
next
edit lan
set pim-mode sparse-mode
next
end
set multicast-routing enable
config pim-sm-global
set bsr-candidate enable
set bsr-interface lo0
end
end
2. Add multicast security policies.
config firewall multicast-policy
edit 1
set dstintf port5
set srcintf port6
next
edit 2
set dstintf port6
set srcintf port5
next
edit 3
set dstintf port6
set srcintf lan
next
edit 4
set dstintf lan
set srcintf port6
next
edit 5
set dstintf port5
set srcintf lan
next
edit 6
set dstintf lan
set srcintf port5
next
end
Fortinet Technologies Inc. Page 1062 FortiOS Handbook - Firewall for FortiOS 5.0
To configure FortiGate-500A_4
1. Configure multicast routing.
config router multicast
config interface
edit port6
set pim-mode sparse-mode
next
edit lan
set pim-mode sparse-mode
next
edit port1
set pim-mode sparse-mode
next
edit lo0
set pim-mode sparse-mode
set rp-candidate enable
config join-group
edit 236.1.1.1
next
end
set rp-candidate-priority 1
next
end
set multicast-routing enable
config pim-sm-global
set bsr-allow-quick-refresh enable
set bsr-candidate enable
set bsr-interface lo0
set bsr-priority 1
end
end
2. Add multicast security policies.
config firewall policy
edit 1
set srcintf lan
set dstintf port6
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 2
set srcintf port6
set dstintf lan
set srcaddr all
set dstaddr all
set action accept
set schedule always
Fortinet Technologies Inc. Page 1063 FortiOS Handbook - Firewall for FortiOS 5.0
set service ANY
next
edit 3
set srcintf port1
set dstintf port6
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 4
set srcintf port6
set dstintf port1
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 5
set srcintf port1
set dstintf lan
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 6
set srcintf lan
set dstintf port1
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 7
set srcintf port1
set dstintf port1
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 8
set srcintf port6
Fortinet Technologies Inc. Page 1064 FortiOS Handbook - Firewall for FortiOS 5.0
set dstintf lo0
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 9
set srcintf port1
set dstintf lo0
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
edit 10
set srcintf lan
set dstintf lo0
set srcaddr all
set dstaddr all
set action accept
set schedule always
set service ANY
next
end
Fortinet Technologies Inc. Page 1065 FortiOS Handbook - Firewall for FortiOS 5.0
index(ttl)=[7(1),]
Fortinet Technologies Inc. Page 1066 FortiOS Handbook - Firewall for FortiOS 5.0
Chapter 8 Hardware Acceleration
Page 1067
Hardware acceleration overview
All FortiGate models have specialized acceleration hardware that can offload resource intensive
processing from main processing (CPU) resources. All FortiGate units include specialized
content processors (CPs) that accelerate a wide range of important security processes such as
virus scanning, attack detection, encryption and decryption. Many FortiGate models also
contain security processors (SPs) that accelerate processing for specific security features such
as IPS and network processors (NPs) that offload processing of high volume network traffic.
This chapter contains the following topics:
Content processors (CP4, CP5, CP6 and CP8)
Security processors (SPs)
Network processors (NP1, NP2, NP3, NP4 and NP6)
Checking that traffic is offloaded by NP processors
Controlling IPS NPx and CPx acceleration
All FortiGate units contain FortiASIC Content Processors (CPs) that accelerate many common
resource intensive security related processes. CPs work at the system level with tasks being
offloaded to them as determined by the main CPU. Capabilities of the CPs vary by model.
Newer FortiGate units include CP8 processors. Older CP versions still in use in currently
operating FortiGate models include the CP4, CP5, and CP6.
CP8 capabilities
The CP8 content processor provides the following services:
IPS signature matching acceleration
High performance VPN bulk data engine
IPSEC and SSL/TLS protocol processor
DES/3DES/AES in accordance with FIPS46-3/FIPS81/FIPS197
ARC4 in compliance with RC4
MD5/SHA-1/SHA256 with RFC1321 and FIPS180
HMAC in accordance with RFC2104/2403/2404 and FIPS198
Key Exchange Processor support high performance IKE and RSA computation
Public key exponentiation engine with hardware CRT support
Primarily checking for RSA key generation
Handshake accelerator with automatic key material generation
Random Number generator compliance with ANSI X9.31
Sub public key engine (PKCE) to support up to 4094 bit operation directly
Message authentication module offers high performance cryptographic engine for
calculating SHA256/SHA1/MD5 of data up to 4G bytes (used by many applications)
PCI express Gen 2 four lanes interface
Cascade Interface for chip expansion
Page 1068
CP6 capabilities
Dual content processors
FIPS-compliant DES/3DES/AES encryption and decryption
SHA-1 and MD5 HMAC with RFC1321 and FIPS180
HMAC in accordance with RFC2104/2403/2404 and FIPS198
IPsec protocol processor
High performance IPsec engine
Random Number generator compliance with ANSI X9.31
Key exchange processor for high performance IKE and RSA computation
Script Processor
SSL/TLS protocol processor for SSL content scanning and SSL acceleration
CP5 capabilities
FIPS-compliant DES/3DES/AES encryption and decryption
SHA-1 and MD5 HMAC with RFC1321/2104/2403/2404 and FIPS180/FIPS198
IPsec protocol processor
High performance IPSEC Engine
Random Number generator compliant with ANSI X9.31
Public Key Crypto Engine supports high performance IKE and RSA computation
Script Processor
CP4 capabilities
FIPS-compliant DES/3DES/AES encryption and decryption
SHA-1 and MD5 HMAC
IPSEC protocol processor
Random Number generator
Public Key Crypto Engine
Content processing engine
ANSI X9.31 and PKCS#1 certificate support
Fortinet Technologies Inc. Page 1069 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Determining the content processor in your FortiGate unit
Use the get hardware status CLI command to determine which content processor your
FortiGate unit contains. The output looks like this:
get hardware status
Model name: FortiGate-100D
ASIC version: CP8
ASIC SRAM: 64M
CPU: Intel(R) Atom(TM) CPU D525 @ 1.80GHz
Number of CPUs: 4
RAM: 1977 MB
Compact Flash: 15331 MB /dev/sda
Hard disk: 15272 MB /dev/sda
USB Flash: not available
Network Card chipset: Intel(R) PRO/1000 Network Connection (rev.0000)
Network Card chipset: bcm-sw Ethernet driver 1.0 (rev.)
The ASIC version line lists the content processor model number.
Disabling CP offloading
If you want to completely disable offloading to CP processors for test purposes or other
reasons, you can do so in security policies. Here are some examples:
For IPv4 security policies.
config firewall policy
edit 1
set auto-asic-offload disable
end
For IPv6 security policies.
config firewall policy6
edit 1
set auto-asic-offload disable
end
For multicast security policies.
config firewall multicast-policy
edit 1
set auto-asic-offload disable
end
Fortinet Technologies Inc. Page 1070 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Security processors (SPs)
FortiGate Security Processing (SP) modules, such as the SP3 but also including the XG2, XE2,
FE8, and CE4, work at both the interface and system level to increase overall system
performance by accelerating specialized security processing. You can configure the SP to favor
IPS over firewall processing in hostile high-traffic environments. The following security
processors are available:
The SP3 is built into the FortiGate-5101B and provides IPS acceleration. No special
configuration is required. All IPS traffic is accelerated by the built-in SP3 processors.
The FMC-XG2 is an FMC module with two 10Gb/s SPF+ interfaces that can be used on
FortiGate-3950B and FortiGate-3951B units.
The FortiGate-3140B also contains a built-in XG2 using ports 19 and 20.
The ADM-XE2 is a dual-width AMC module with two 10Gb/s interfaces that can be used on
FortiGate-3810A and FortiGate-5001A-DW systems.
The ADM-FE8 is a dual-width AMC module with eight 1Gb/s interfaces that can be used with
the FortiGate-3810A.
The ASM-CE4 is a single-width AMC module with four 10/100/1000 Mb/s interfaces that can
be used on FortiGate-3016B and FortiGate-3810A units.
SP Processing Flow
SP processors provide an integrated high performance fast path multilayer solution for both
intrusion protection and firewall functions. The multilayered protection starts from anomaly
checking at packet level to ensure each packet is sound and reasonable. Immediately after that,
a sophisticated set of interface based packet anomaly protection, DDoS protection, policy
based intrusion protection, firewall fast path, and behavior based methods are employed to
prevent DDoS attacks from the rest of system.
Then the packets enter an interface/policy based intrusion protection system,
where each packet is evaluated against a set of signatures. The end result is streams of user
packets that are free of anomaly and attacks, entering the fast path system for unicast or
multicast fast path forwarding.
Fortinet Technologies Inc. Page 1071 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Figure 181:SP processing flow
Fortinet Technologies Inc. Page 1072 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
This is a partial output of the command:
Number of proxied TCP connections : 0
Number of working proxied TCP connections : 0
Number of retired TCP connections : 0
Number of valid TCP connections : 0
Number of attacks, no ACK from client : 0
Number of no SYN-ACK from server : 0
Number of reset by server (service not supportted): 0
Number of establised session timeout : 0
Client timeout setting : 3 Seconds
Server timeout setting : 3 Seconds
FortiASIC network processors work at the interface level to accelerate traffic by offloading
traffic from the main CPU. Current models contain NP4 and NP6 network processors. Older
FortiGate models include NP1 network processors (also known as FortiAccel, or FA2) and NP2
network processors.
The traffic that can be offloaded, maximum throughput, and number of network interfaces
supported by each varies by processor model:
NP6 supports offloading of most IPv4 and IPv6 traffic, IPsec VPN encryption, CAPWAP
traffic, and multicast traffic. The NP6 has a capacity of 40 Gbps through 4 x 10 Gbps
interfaces or 3 x 10 Gbps and 16 x 1 Gbps interfaces. For details about the NP6 processor,
see NP6 Acceleration on page 1082 and for information about FortiGate models with NP6
processors, see FortiGate NP6 architectures on page 1089.
NP4 supports offloading of most IPv4 firewall traffic and IPsec VPN encryption. The NP4 has
a capacity of 20 Gbps through 2 x 10 Gbps interfaces. For details about NP4 processors,
see NP4 Acceleration on page 1093 and for information about FortiGate models with NP4
processors, see FortiGate NP4 architectures on page 1105.
NP2 supports IPv4 firewall and IPsec VPN acceleration. The NP2 has a capacity of 2 Gbps
through 2 x 10 Gbps interfaces or 4 x 1 Gbps interfaces.
NP1 supports IPv4 firewall and IPsec VPN acceleration with 2 Gbps capacity. The NP1 has a
capacity of 2 Gbps through 2 x 1 Gbps interfaces.
The NP1does not support frames greater than 1500 bytes. If your network uses jumbo
frames, you may need to adjust the MTU (Maximum Transmission Unit) of devices
connected to NP1ports.Maximum frame size for NP2, NP4, and NP6 processors is 9000
bytes.
For both NP1 and NP2 network processors, ports attached to a network processor
cannot be used for firmware installation by TFTP.
Session that require proxy-based and flow based security features (for example, virus scanning,
IPS, application control and so on) are not fast pathed and must be processed by the CPU.
Fortinet Technologies Inc. Page 1073 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Determining the network processors installed on your FortiGate unit
Use the following command to list the NP6 processors in your FortiGate unit:
diagnose npu np6 port-list
To list other network processors on your FortiGate unit, use the following CLI command.
get hardware npu <model> list
<model> can be legacy, np1, np2 or np4.
The output lists the interfaces that have the specified processor. For example, for a
FortiGate-5001B:
get hardware npu np4 list
ID Model Slot Interface
0 On-board port1 port2 port3 port4
fabric1 base1 npu0-vlink0 npu0-vlink1
1 On-board port5 port6 port7 port8
fabric2 base2 npu1-vlink0 npu1-vlink1
The npu0-vlink0, npu1-vlink1 etc interfaces are used for accelerating inter-VDOM links.
Fortinet Technologies Inc. Page 1074 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Figure 182:NP network processor packet flow
Start
A packet arrives at
the NP interface
Does this
Does the Is this packet
packet contain session Packet follows
match a known
known anomalies? fast-path fast path
No Yes session key or Yes
compatible? IPsec SA?
No No
Yes
End
If a matching session key or SA is not found, or if the packet does not meet packet
requirements, the packet cannot be offloaded. The network processor sends the data to
the FortiGate units CPU, which processes the packet.
Encryption and decryption IPsec traffic originating from the FortiGate can utilize network
processor encryption capabilities. See Configuring NP accelerated VPN encryption/decryption
offloading on page 1078.
Packet forwarding rates vary by the percentage of offloadable processing and the type of
network processing required by your configuration, but are independent of frame size. For
optimal traffic types, network throughput can equal wire speed.
Fortinet Technologies Inc. Page 1075 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
traffic to other cluster members, reducing traffic redirection load on the primary units main
processing resources.
As subordinate units receive redirected traffic, each network processor in the cluster assesses
and processes session offloading independently from the primary unit. Session key states of
each network processor are not part of synchronization traffic between HA members.
Anomaly Description
Fortinet Technologies Inc. Page 1076 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Anomaly Description
Example
You might configure an NP4 to drop packets with TCP WinNuke or unknown IP protocol
anomalies, but to pass packets with an IP time stamp, using hardware acceleration provided by
the network processor.
config system interface
edit port1
set fp-anomaly drop_winnuke drop_ipunknown_prot pass_iptimestamp
end
Fortinet Technologies Inc. Page 1077 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
The software switch is a bridge group of several interfaces, and the FortiGate CPU maintains
the mac-port table for this bridge. As a result of this CPU involvement, traffic processed by a
software switch interface is not offloaded to network processors.
Example
You could configure the offloading of encryption and decryption for an IPsec SA that was sent
to the network processor.
config system npu
set enc-offload-antireplay enable
set dec-offload-antireplay enable
set offload-ipsec-host enable
end
A number of diagnose commands can be used to verify that traffic is being offloaded.
Fortinet Technologies Inc. Page 1078 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Using the packet sniffer
Use the packet sniffer to verify that traffic is offloaded. Offloaded traffic is not picked up by the
packet sniffer so if you are sending traffic through the FortiGate unit and it is not showing up on
the packet sniffer you can conclude that it is offloaded.
diag sniffer packet port1 <option>
Fortinet Technologies Inc. Page 1079 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Verifying IPsec VPN traffic offloading
The following commands can be used to verify IPsec VPN traffic offloading to NP processors.
diagnose vpn ipsec status
NPl/NP2/NP4_0/sp_0_0:
null: 0 0
des: 0 0
3des: 4075 4074
aes: 0 0
aria: 0 0
seed: 0 0
null: 0 0
md5: 4075 4074
sha1: 0 0
sha256: 0 0
sha384: 0 0
sha512: 0 0
Fortinet Technologies Inc. Page 1080 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
diagnose sys session list
session info: proto=6 proto_state=01 duration=34 expire=3565
timeout=3600 flags=00000000 sockflag=00000000 sockport=0
av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
ha_id=0 policy_dir=0 tunnel=/p1-vdom2
state=re may_dirty npu
statistic(bytes/packets/allow_err): org=112/2/1 reply=112/2/1
tuples=2
orgin->sink: org pre->post, reply pre->post dev=57->7/7->57
gwy=10.1.100.11/11.11.11.1
hook=pre dir=org act=noop
172.16.200.55:35254->10.1.100.11:80(0.0.0.0:0)
hook=post dir=reply act=noop
10.1.100.11:80->172.16.200.55:35254(0.0.0.0:0)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=1 id_policy_id=0 auth_info=0 chk_client_info=0 vd=4
serial=00002d29 tos=ff/ff ips_view=0 app_list=0 app=0
dd_type=0 dd_mode=0
per_ip_bandwidth meter: addr=172.16.200.55, bps=260
npu_state=00000000
npu info: flag=0x81/0x82, offload=7/7, ips_offload=0/0, epid=1/3,
ipid=3/1, vlan=32779/0
You can use the following commands to enale or disable acceleration of IPS processing by NPx
and CPx processors:
config ips global
set np-accel-mode {none | basic}
set cp-accel-mode {none | basic | advanced}
end
The network processor (NP) acceleration modes are:
none: Network Processor acceleration disabled
basic: Basic Network Processor acceleration enabled
The content processor (CP) acceleration modes are:
none: Content Processor acceleration disabled
basic: Basic Content Processor acceleration enabled
advanced: Advanced Content Processor acceleration enabled
Fortinet Technologies Inc. Page 1081 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
NP6 Acceleration
Page 1082
NP6 session fast path requirements
If you disable anomaly checks by Intrusion Prevention (IPS), you can still enable hardware
accelerated anomaly checks using the fp-anomaly field of the
config system interface CLI command. See Offloading NP pre-IPS anomaly
detection on page 1076.
If a session or is not fast path ready, the FortiGate unit will not send the session key or IPsec SA
key to the NP6 processor. Without the session key, all session key lookup by a network
processor for incoming packets of that session fails, causing all session packets to be sent to
the FortiGate units main processing resources, and processed at normal speeds.
If a session is fast path ready, the FortiGate unit will send the session key or IPsec SA key to the
network processor. Session key or IPsec SA key lookups then succeed for subsequent packets
from the known session or IPsec SA.
Fortinet Technologies Inc. Page 1083 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Packet fast path requirements
Packets within the session must then also meet packet requirements.
Incoming packets must not be fragmented.
Outgoing packets must not require fragmentation to a size less than 385 bytes. Because of
this requirement, the configured MTU (Maximum Transmission Unit) for network processors
network interfaces must also meet or exceed the network processors supported minimum
MTU of 385 bytes.
Use the following command to view the NP6 processor configuration of your FortiGate unit:
diagnose npu np6 port-list
For example output of this command for different FortiGate models, see FortiGate NP6
architectures on page 1089.
NP6 processors can offload sessions received by interfaces in link aggregation (LAG) groups.
You can use link aggregation groups to offload more traffic that would exceed the capacity of a
single FortiGate interface. For example, if you want to offload sessions on a 30 GB link you can
add three 10-GB interfaces to a LAG group and send 30 GB of traffic to the LAG group.
Just like with normal interfaces, traffic accepted by a LAG group is offloaded by the NP6
processor connected to the interfaces in the LAG group that receive the traffic to be offloaded.
If all interfaces in a LAG group are connected to the same NP6 processor, traffic received by the
LAG group is offloaded by that NP6 processor. The amount of traffic that can be offloaded is
limited by the capacity of the NP6 processor.
LAG groups can include interfaces connected to more than one NP6 processor. For example, a
adding a second NP6 processor to a LAG group effectively doubles the offloading capacity of
the LAG group. Adding a third further increases capacity. Using LAG groups allows you to
increase offloading capacity for incoming traffic by sharing the traffic load across multiple NP6
processors. This increase in capacity is supported by the integrated switch fabric that allows
the NP6 processors to share session information.
The increase in offloading capacity may not actually be doubled by adding a second NP6
processor to a LAG group. Traffic and load conditions and other factors may limit the actual
achieved offloading result.
Fortinet Technologies Inc. Page 1084 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Configuring Inter-VDOM link acceleration with NP6 processors
FortiGate units with NP6 processors include inter-VDOM links that can be used to accelerate
inter-VDOM link traffic.
For a FortiGate unit with two NP6 processors there are two accelerated inter-VDOM links,
each with two interfaces:
npu0_vlink
npu0_vlink0
npu0_vlink1
npu1_vlink
npu1_vlink0
npu1_vlink1
These interfaces are visible from the GUI and CLI. For a FortiGate unit with NP6 interfaces, enter
the following CLI command to display the NP6-accelerated inter-VDOM links:
get system interface
...
== [ npu0_vlink0 ]
name: npu0_vlink0 mode: static ip: 0.0.0.0 0.0.0.0 status: down
netbios-forward: disable type: physical sflow-sampler: disable
explicit-web-proxy: disable explicit-ftp-proxy: disable
mtu-override: disable wccp: disable drop-overlapped-fragment:
disable drop-fragment: disable
== [ npu0_vlink1 ]
name: npu0_vlink1 mode: static ip: 0.0.0.0 0.0.0.0 status: down
netbios-forward: disable type: physical sflow-sampler: disable
explicit-web-proxy: disable explicit-ftp-proxy: disable
mtu-override: disable wccp: disable drop-overlapped-fragment:
disable drop-fragment: disable
== [ npu1_vlink0 ]
name: npu1_vlink0 mode: static ip: 0.0.0.0 0.0.0.0 status: down
netbios-forward: disable type: physical sflow-sampler: disable
explicit-web-proxy: disable explicit-ftp-proxy: disable
mtu-override: disable wccp: disable drop-overlapped-fragment:
disable drop-fragment: disable
== [ npu1_vlink1 ]
name: npu1_vlink1 mode: static ip: 0.0.0.0 0.0.0.0 status: down
netbios-forward: disable type: physical sflow-sampler: disable
explicit-web-proxy: disable explicit-ftp-proxy: disable
mtu-override: disable wccp: disable drop-overlapped-fragment:
disable drop-fragment: disable
...
By default the interfaces in each inter-VDOM link are assigned to the root VDOM. To use these
interfaces to accelerate inter-VDOM link traffic, assign each interface in the pair to the VDOMs
that you want to offload traffic between. For example, if you have added a VDOM named
New-VDOM to a FortiGate unit with NP4 processors, you can go to System > Network >
Interfaces and edit the npu0-vlink1 interface and set the Virtual Domain to New-VDOM. This
results in an accelerated inter-VDOM link between root and New-VDOM. You can also do this
from the CLI:
Fortinet Technologies Inc. Page 1085 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
config system interface
edit npu0-vlink1
set vdom New-VDOM
end
Name Marketing-link
Type VLAN
Interface npu0_vlink0
VLAN ID 100
Name Engineering-link
Type VLAN
Interface npu0_vlink1
VLAN ID 100
Fortinet Technologies Inc. Page 1086 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Confirm that the traffic is accelerated
Use the following CLI commands to obtain the interface index and then correlate them with the
session entries. In the following example traffic was flowing between new accelerated
inter-VDOM links and physical ports port1 and port 2 also attached to the NP6 processor.
diagnose ip address list
IP=172.31.17.76->172.31.17.76/255.255.252.0 index=5 devname=port1
IP=10.74.1.76->10.74.1.76/255.255.252.0 index=6 devname=port2
IP=172.20.120.12->172.20.120.12/255.255.255.0 index=55
devname=IVL-VLAN1_ROOT
IP=172.20.120.22->172.20.120.22/255.255.255.0 index=56
devname=IVL-VLAN1_VDOM1
Fortinet Technologies Inc. Page 1087 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
hook=pre dir=org act=noop 10.74.2.87:768->10.2.2.2:8(0.0.0.0:0)
hook=post dir=reply act=noop 10.2.2.2:768->10.74.2.87:0(0.0.0.0:0)
misc=0 policy_id=3 id_policy_id=0 auth_info=0 chk_client_info=0 vd=1
serial=0000004d tos=ff/ff ips_view=0 app_list=0 app=0
dd_type=0 dd_mode=0
per_ip_bandwidth meter: addr=10.74.2.87, bps=880
npu_state=00000000
npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0,
epid=219/161, ipid=161/219, vlan=0/32769
total session 2
Fortinet Technologies Inc. Page 1088 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate NP6 architectures
Many FortiGate models can offload some types of network traffic processing from main
processing resources to specialized network processors. If your network has a significant
volume of traffic that is suitable for offloading, this hardware acceleration can significantly
improve your network throughput.
This chapter shows the fastpath architecture for the following FortiGate units:
FortiGate-1500D fast path architecture
FortiGate-3700D fast path architecture
FortiGate 1500D
10G SFP+
MGMT 1 1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39
CONSOLE
STATUS
ALARM
HA
POWER
FortiASIC FortiASIC
NP6 NP6
System Bus
Sy
CP8 CPU
Page 1089
You can use the following command to display the FortiGate-1500D NP6 configuration. The
command output shows two NP6s named NP6_0 and NP6_1. The output also shows the
interfaces (ports) connected to each NP6.
diagnose npu np6 port-list
Chip XAUI Ports Max Cross-chip
Speed offloading
------ ---- ------- ----- ----------
np6_0 0 port1 10G Yes
0 port5 10G Yes
0 port17 10G Yes
0 port21 10G Yes
0 port33 10G Yes
1 port2 10G Yes
1 port6 10G Yes
1 port18 10G Yes
1 port22 10G Yes
1 port34 10G Yes
2 port3 10G Yes
2 port7 10G Yes
2 port19 10G Yes
2 port23 10G Yes
2 port35 10G Yes
3 port4 10G Yes
3 port8 10G Yes
3 port20 10G Yes
3 port24 10G Yes
3 port36 10G Yes
------ ---- ------- ----- ----------
np6_1 0 port9 10G Yes
0 port13 10G Yes
0 port25 10G Yes
0 port29 10G Yes
0 port37 10G Yes
1 port10 10G Yes
1 port14 10G Yes
1 port26 10G Yes
1 port30 10G Yes
1 port38 10G Yes
2 port11 10G Yes
2 port15 10G Yes
2 port27 10G Yes
2 port31 10G Yes
2 port39 10G Yes
3 port12 10G Yes
3 port16 10G Yes
3 port28 10G Yes
3 port32 10G Yes
3 port40 10G Yes
------ ---- ------- ----- ----------
Fortinet Technologies Inc. Page 1090 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-3700D fast path architecture
SFP+
FortiGate 3700D MGMT 1 5 7 9 11 13 15 17 19 21 23 25 27 29 31
CONSOLE
STATUS
QSFP+
ALARM
HA
POWER
System Bus
CP8 CPU
Ports 25 to 32 can be used for low latency offloading. As long as traffic enters and exits the
FortiGate-3700D through ports connected to the same NP6 processor and using these low
latency ports the traffic will be offloaded and have lower latency that other NP6 offloaded traffic.
Latency is reduced by bypassing the integrated switch fabric. Specifically:
Port25 through port28, share connections to the first NP6 processor so sessions entering
one of these ports and exiting through another will experience low latency
Port29 through port32, share connections to the second NP6 processor so sessions
entering one of these ports and exiting through another will experience low latency
Fortinet Technologies Inc. Page 1091 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
You can use the following command to display the FortiGate-3700D NP6 configuration. The
command output shows four NP6s named NP6_0, NP6_1, NP6_2, and NP6_3. The output also
shows the interfaces (ports) connected to each NP6.
diag npu np6 port-list
Chip XAUI Ports Max Cross-chip
Speed offloading
------ ---- ------- ----- ----------
np6_0 0 port25 10G Yes
1 port26 10G Yes
2 port27 10G Yes
3 port28 10G Yes
------ ---- ------- ----- ----------
np6_1 0 port29 10G Yes
1 port30 10G Yes
2 port31 10G Yes
3 port32 10G Yes
------ ---- ------- ----- ----------
np6_2 0 port5 10G Yes
0 port9 10G Yes
0 port13 10G Yes
1 port6 10G Yes
1 port10 10G Yes
1 port14 10G Yes
2 port7 10G Yes
2 port11 10G Yes
3 port8 10G Yes
3 port12 10G Yes
0-3 port1 40G Yes
0-3 port2 40G Yes
------ ---- ------- ----- ----------
np6_3 0 port15 10G Yes
0 port19 10G Yes
0 port23 10G Yes
1 port16 10G Yes
1 port20 10G Yes
1 port24 10G Yes
2 port17 10G Yes
2 port21 10G Yes
3 port18 10G Yes
3 port22 10G Yes
0-3 port3 40G Yes
0-3 port4 40G Yes
------ ---- ------- ----- ----------
Fortinet Technologies Inc. Page 1092 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
NP4 Acceleration
Page 1093
Viewing your FortiGates NP4 configuration
To list the NP4 network processors on your FortiGate unit, use the following CLI command.
get hardware npu np4 list
The output lists the interfaces that have NP4 processors. For example, for a FortiGate-5001C:
get hardware npu np4 list
ID Model Slot Interface
0 On-board port1 port2 port3 port4
fabric1 base1 npu0-vlink0 npu0-vlink1
1 On-board port5 port6 port7 port8
fabric2 base2 npu1-vlink0 npu1-vlink1
Depending on the product, NP4 network processors may or may not be directly connected to
each other on the circuit board through an EEI (Enhanced Extension Interface).
Directly connected network processors have an EEI, and can pass traffic between them without
involving the FortiGate units main processing resources.
Indirectly connected network processors have no EEI, and cannot pass traffic between them
without involving the FortiGate units main processing resources.
Sessions can only be offloaded if both the source and destination port are connected to the
same network processor or directly (EEI) connected network processor pair.
For information about the network processors in specific FortiGate models, see FortiGate NP4
architectures on page 1105.
Offloading traffic to a network processor requires that the FortiGate unit configuration and the
traffic itself is suited to hardware acceleration. There are requirements for path the sessions and
the individual packets.
Fortinet Technologies Inc. Page 1094 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Layer 4 protocol must be UDP, TCP or ICMP
Layer 3 / Layer 4 header or content modification must not require a session helper (for
example, SNAT, DNAT, and TTL reduction are supported, but application layer content
modification is not supported)
Firewall policies must not include proxy-based or flow-based security features (antivirus,
web filtering, email filtering, IPS, application control, or DLP)
Origin must not be local host (the FortiGate unit)
If you disable anomaly checks by Intrusion Prevention (IPS), you can still enable hardware
accelerated anomaly checks using the fp-anomaly field of the
config system interface CLI command. See Offloading NP pre-IPS anomaly detection
on page 1076.
If a session is not fast path ready, the FortiGate unit will not send the session key to the network
processor(s). Without the session key, all session key lookup by a network processor for
incoming packets of that session fails, causing all session packets to be sent to the FortiGate
units main processing resources, and processed at normal speeds.
If a session is fast path ready, the FortiGate unit will send the session key to the network
processor(s). Session key lookup then succeeds for subsequent packets from the known
session.
Fortinet Technologies Inc. Page 1095 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
NP4 traffic shaping offloading
NP4 processors improve IPsec tunnel performance by offloading IPsec encryption and
decryption.
Requirements for hardware accelerated IPsec encryption or decryption are a modification of
general offloading requirements. Differing characteristics are:
Origin can be local host (the FortiGate unit)
In Phase 1 configuration, Local Gateway IP must be specified as an IP address of a network
interface for a port attached to a network processor
SA must have been received by the network processor
in Phase 2 configuration:
encryption algorithm must be DES, 3DES, AES-128, AES-192, AES-256, or null
authentication must be MD5, SHA1, or null
if encryption is null, authentication must not also be null
if replay detection is enabled, enc-offload-antireplay must also be enable in the
CLI
If replay detection is enabled in the Phase 2 configuration, you can enable or disable IPsec
encryption and decryption offloading from the CLI. Performance varies by those CLI options
and the percentage of packets requiring encryption or decryption. For details, see Configuring
NP accelerated VPN encryption/decryption offloading on page 1078.
To apply hardware accelerated encryption and decryption, the FortiGate units main processing
resources must first perform Phase 1 negotiations to establish the security association (SA). The
SA includes cryptographic processing instructions required by the network processor, such as
which encryption algorithms must be applied to the tunnel. After ISAKMP negotiations, the
FortiGate units main processing resources send the SA to the network processor, enabling the
network processor to apply the negotiated hardware accelerated encryption or decryption to
tunnel traffic.
Possible accelerated cryptographic paths are:
IPsec decryption offload
Ingress ESP packet > Offloaded decryption > Decrypted packet egress (fast path)
Ingress ESP packet > Offloaded decryption > Decrypted packet to FortiGate units main
processing resources
Fortinet Technologies Inc. Page 1096 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
IPsec encryption offload
Ingress packet > Offloaded encryption > Encrypted (ESP) packet egress (fast path)
Packet from FortiGate units main processing resources > Offloaded encryption >
Encrypted (ESP) packet egress
Hardware accelerated IPsec processing, involving either partial or full offloading, can be
achieved in either tunnel or interface mode IPsec configurations.
To achieve offloading for both encryption and decryption:
In Phase 1 configurations Advanced section, Local Gateway IP must be specified as an IP
address of a network interface associated with a port attached to a network processor. (In
other words, if Phase 1s Local Gateway IP is Main Interface IP, or is specified as an IP
address that is not associated with a network interface associated with a port attached to a
network processor, IPsec network processing is not offloaded.)
In Phase 2 configurations P2 Proposal section, if the checkbox Enable replay detection is
enabled, enc-offload-antireplay and dec-offload-antireplay must be set to
enable in the CLI.
offload-ipsec-host must be set to enable in the CLI.
This section contains example IPsec configurations whose IPsec encryption and decryption
processing is hardware accelerated by an NP4 unit contained in a FortiGate-5001B at both
ends of the VPN tunnel.
Hardware accelerated IPsec VPN does not require both tunnel endpoints to have the same
network processor model. However, if hardware is not symmetrical, the packet forwarding rate
is limited by the slower side.
Fortinet Technologies Inc. Page 1097 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Figure 183:Example network topology for offloaded IPsec processing
FortiGate_1
1.1
.1. Port 1
0/2
4
P
(I ort
3.3 PSec 2
.3. )
Protected Network 1/2
4
Protected Network
P
3.3 (IPS ort 2
.3. ec
2/2 )
4
P
2.2 ort 1
.2.
0/2
4
FortiGate_2
Table 54: Example ports and IP addresses for offloaded IPsec processing
FortiGate_1 FortiGate_2
Port IP Port IP
Fortinet Technologies Inc. Page 1098 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
6. Go to Policy > Policy > Policy.
7. Configure a policy to apply the Phase 1 IPsec tunnel you configured in step 2 to traffic
between FortiGate-5001B ports 1 and 2.
8. Go to Router > Static > Static Route.
9. Configure a static route to route traffic destined for FortiGate_2s protected network to VPN
IP address of FortiGate_2s VPN gateway, 3.3.3.2, through the FortiGate-5001B port2.
You can also configure the static route using the following CLI command:
config router static
edit 2
set device "AMC-SW1/2"
set dst 2.2.2.0 255.255.255.0
set gateway 3.3.3.2
end
10.On FortiGate_2, go to VPN > IPsec > Auto Key (IKE).
11.Configure Phase 1.
For tunnel mode IPsec and for hardware acceleration, specifying the Local Gateway IP is
required.
Select Advanced. In the Local Gateway IP section, select Specify and type the VPN IP
address 3.3.3.1, which is the IP address of FortiGate_1s port2.
12.Configure Phase 2.
13.Select Enable replay detection.
14.Use the following command to enable offloading antireplay packets:
config system npu
set enc-offload-antireplay enable
end
For details on encryption and decryption offloading options available in the CLI, see
Configuring NP accelerated VPN encryption/decryption offloading on page 1078.
15.Go to Policy > Policy > Policy.
16.Configure a policy to apply the Phase 1 IPsec tunnel you configured in step 9 to traffic
between FortiGate-5001B ports 1 and 2.
17.Go to Router > Static > Static Route.
18.Configure a static route to route traffic destined for FortiGate_1s protected network to VPN
IP address of FortiGate_1s VPN gateway, 3.3.3.1, through the FortiGate-5001B port2.
You can also configure the static route using the following CLI commands:
config router static
edit 2
set device "AMC-SW1/2"
set dst 1.1.1.0 255.255.255.0
set gateway 3.3.3.1
end
19.Activate the IPsec tunnel by sending traffic between the two protected networks.
To verify tunnel activation, go to VPN > Monitor > IPsec Monitor.
Fortinet Technologies Inc. Page 1099 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
To configure hardware accelerated interface mode IPsec
1. On FortiGate_1, go to VPN > IPsec > Auto Key (IKE).
2. Configure Phase 1.
For interface mode IPsec and for hardware acceleration, the following settings are required.
Select Advanced.
Enable the checkbox Enable IPsec Interface Mode.
In the Local Gateway IP section, select Specify and type the VPN IP address 3.3.3.2,
which is the IP address of FortiGate_2s port 2.
3. Configure Phase 2.
4. Select Enable replay detection.
5. Use the following command to enable offloading antireplay packets:
config system npu
set enc-offload-antireplay enable
end
For details on encryption and decryption offloading options available in the CLI, see
Configuring NP accelerated VPN encryption/decryption offloading on page 1078.
6. Go to Policy > Policy > Policy.
7. Configure two policies (one for each direction) to apply the Phase 1 IPsec configuration you
configured in step 2 to traffic leaving from or arriving on FortiGate-ASM-FB4 module port 1.
8. Go to Router > Static > Static Route.
9. Configure a static route to route traffic destined for FortiGate_2s protected network to the
Phase 1 IPsec device, FGT_1_IPsec.
You can also configure the static route using the following CLI commands:
config router static
edit 2
set device "FGT_1_IPsec"
set dst 2.2.2.0 255.255.255.0
end
10.On FortiGate_2, go to VPN > IPsec > Auto Key (IKE).
11.Configure Phase 1.
For interface mode IPsec and for hardware acceleration, the following settings are required.
Enable the checkbox Enable IPsec Interface Mode.
In the Local Gateway IP section, select Specify and type the VPN IP address 3.3.3.1,
which is the IP address of FortiGate_1s FortiGate-5001B port 2.
12.Configure Phase 2.
13.Select Enable replay detection.
14.Use the following command to enable offloading antireplay packets:
config system npu
set enc-offload-antireplay enable
end
For details on encryption and decryption offloading options available in the CLI, see
Configuring NP accelerated VPN encryption/decryption offloading on page 1078.
15.Go to Policy > Policy > Policy.
16.Configure two policies (one for each direction) to apply the Phase 1 IPsec configuration you
configured in step 9 to traffic leaving from or arriving on FortiGate-5001B port 1.
17.Go to Router > Static > Static Route.
Fortinet Technologies Inc. Page 1100 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
18.Configure a static route to route traffic destined for FortiGate_1s protected network to the
Phase 1 IPsec device, FGT_2_IPsec.
You can also configure the static route using the following CLI commands:
config router static
edit 2
set device "FGT_2_IPsec"
set dst 1.1.1.0 255.255.255.0
next
end
19.Activate the IPsec tunnel by sending traffic between the two protected networks.
To verify tunnel activation, go to VPN > Monitor > IPsec Monitor.
FortiGate units with NP4 processors include inter-VDOM links that can be used to accelerate
inter-VDOM link traffic.
For a FortiGate unit with two NP4 processors there are also two inter-VDOM links, each with
two interfaces:
npu0-vlink
npu0-vlink0
npu0-vlink1
npu1-vlink
npu1-vlink0
npu1-vlink1
These interfaces are visible from the GUI and CLI. For a FortiGate unit with NP4 interfaces, enter
the following CLI command (output shown for a FortiGate-5001B):
get hardware npu np4 list
ID Model Slot Interface
0 On-board port1 port2 port3 port4
fabric1 base1 npu0-vlink0 npu0-vlink1
1 On-board port5 port6 port7 port8
fabric2 base2 npu1-vlink0 npu1-vlink1
By default the interfaces in each inter-VDOM link are assigned to the root VDOM. To use these
interfaces to accelerate inter-VDOM link traffic, assign each interface in a pair to the VDOMs
that you want to offload traffic between. For example, if you have added a VDOM named
New-VDOM to a FortiGate unit with NP4 processors, you can go to System > Network >
Interfaces and edit the npu0-vlink1 interface and set the Virtual Domain to New-VDOM. This
results in an inter-VDOM link between root and New-VDOM. You can also do this from the CLI:
config system interface
edit npu0-vlink1
set vdom New-VDOM
end
Fortinet Technologies Inc. Page 1101 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
For example, to accelerate inter-VDOM link traffic between VDOMs named Marketing and
Engineering using VLANs with VLAN ID 100 go to System > Network > Interfaces and select
Create New to create the VLAN interface associated with the Marketing VDOM:
Name Marketing-link
Type VLAN
Interface npu0-vlink0
VLAN ID 100
Name Engineering-link
Type VLAN
Interface npu0-vlink1
VLAN ID 100
Fortinet Technologies Inc. Page 1102 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
IP=172.20.120.22->172.20.120.22/255.255.255.0 index=56
devname=IVL-VLAN1_VDOM1
Fortinet Technologies Inc. Page 1103 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
total session 2
Fortinet Technologies Inc. Page 1104 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate NP4 architectures
This chapter shows the NP4 architecture for the following FortiGate units:
FortiGate-600C
FortiGate-800C
FortiGate-1000C
FortiGate-1240B
FortiGate-3040B
FortiGate-3140B
FortiGate-3140B load balance mode
FortiGate-3240C
FortiGate-3600C
FortiGate-3950B and FortiGate-3951B
FortiGate-5001C
FortiGate-5001B
And includes the following reference information:
Setting switch-mode mapping on the ADM-XD4
FortiGate-600C
The FortiGate-600C features one NP4 processor. All the ports are connected to this NP4 over
the Integrated Switch Fabric. Port1 and port2 are dual failopen redundant RJ-45 ports.
Port3-port22 are RJ-45 ethernet ports, and there are four 1Gb SFP interface ports duplicating
the port19-port22 connections.
STATUS
ALARM
HA
POWER
USB USB MGMT CONSOLE MGMT 1 / MGMT 2 WAN 1 / 1 WAN 2 / 2 3/4 5/6 7/8 9 / 10 11 / 12 13 / 14 15 / 16 17 / 18 19 / 20 21 / 22 19 / 20 21 / 22
FAIL OPEN FAIL OPEN
SHARED INTERFACES
FortiASIC
NP4
System Bus
CP8 CPU
Page 1105
FortiGate-800C
The FortiGate-800C features one NP4 processor. All the ports are connected to this NP4. Port1
and port2 are dual failopen redundant RJ-45 ports. Port3-port22 are RJ-45 ethernet ports, and
there are eight 1Gb SFP interface ports duplicating the port15-18 and port19-port22
connections. There are also two 10Gb SFP+ ports, port23 and port24.
STATUS
ALARM
HA
POWER
USB MGMT 2 1 2 4 6 8 10 12 14 16 18 16 18 20 22 20 22 24
USB MGMT CONSOLE
FAIL OPEN FAIL OPEN SFP+
CP8 CPU
FortiGate-1000C
The FortiGate-1000C features one NP4 processor. All the ports are connected to this NP4.
Port1 and port2 are dual failopen redundant RJ-45 ports. Port3-port22 are RJ-45 ethernet
ports, and there are eight 1Gb SFP interface ports duplicating the port15-18 and port19-port22
connections. There are also two 10Gb SFP+ ports, port23 and port24.
STATUS
CONSOLE
USB MGMT ALARM
USB
HA
POWER
MGMT 2 1 2 4 6 8 10 12 14 16 18 16 18 20 22 20 22 24
FAIL OPEN FAIL OPEN
FortiASIC
NP4
System Bus
CP8 CPU
Fortinet Technologies Inc. Page 1106 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-1240B
FSM6
FSM2 FSM4 CONSOLE
1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39
STATUS
ALARM
HA
POWER
2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 ASM USB
FortiASIC FortiASIC
NP4 NP4
System Bus
CP6 CPU
FortiGate-3040B
FortiGate 3040B
CONSOLE
10G SFP+
MGMT 1
1 3 5 7 9 11 13 15 17 FSM1 FSM3
STATUS
ALARM
FSM2 FSM4
HA
POWER
2 4 6 8 10 12 14 16 18 SHUT DOWN
NP4-1 NP4-2
FortiASIC FortiASIC
NP4 NP4
System Bus
CP7 CPU
Fortinet Technologies Inc. Page 1107 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-3140B
The FortiGate-3140B features two NP4 processors and one SP2 processor:
The 10Gb interfaces, port1, port2, port3, port4, and the 1Gb interfaces, port9, port10,
port11, port12, port13, share connections to one NP4 processor.
The 10Gb interfaces, port5, port6, port7, port8, and the 1Gb interfaces, port14, port15,
port16, port17, port18, share connections to the other NP4 processor.
The 10Gb interfaces, port19 and port20, share connections to the SP2 processor.
FSM1 FSM3
FortiGate 3140B
FSM2 FSM4
SHUT DOWN
CONSOLE
10G SFP+
MGMT 1
1 3 5 7 9 11 13 15 17
STATUS
10G SFP+
ALARM 19 20
HA
POWER
USB MGMT 2 2 4 6 8 10 12 14 16 18
NP4-1 NP4-2
CP7 CPU
Fortinet Technologies Inc. Page 1108 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-3140B load balance mode
The FortiGate-3140B load balance mode allows you increased flexibility in how you use the
interfaces on the FortiGate unit. When enabled, traffic between any two interfaces (excluding
management and console) is accelerated. Traffic is not limited to entering and leaving the
FortiGate unit in specific interface groupings to benefit from NP4 and SP2 acceleration. You can
use any pair of interfaces.
Security acceleration in this mode is limited, however. Only IPS scanning is accelerated in load
balance mode.
FSM1 FSM3
FortiGate 3140B
FSM2 FSM4
SHUT DOWN
CONSOLE
10G SFP+
MGMT 1
1 3 5 7 9 11 13 15 17
STATUS
10G SFP+
ALARM 19 20
HA
POWER
USB MGMT 2 2 4 6 8 10 12 14 16 18
NP4-1 NP4-2
FortiASIC
NP4 FortiASIC
SP2
System Bus
CP7 CPU
Fortinet Technologies Inc. Page 1109 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-3240C
10G SFP+
MGMT 1 3 5 7 9 11 13 15 17 19 21 23 25 27
STATUS
ALARM
HA
POWER
AUX 2 4 6 8 10 12 14 16 18 20 22 24 26 28
FortiASIC FortiASIC 20 Gb
NP4 NP4
System Bus
CP8 CPU
Fortinet Technologies Inc. Page 1110 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-3600C
FortiGate 3600C
USB MGMT HA
CONSOLE
10G-SFP+
1 3 5 7 9 11 13 15 17 19 21 23 25 27
STATUS
ALARM
HA USB MGMT
FAN
POWER
2 4 6 8 10 12 14 16 18 20 22 24 26 28
System Bus
CP8 CPU
XAUI interfaces
Each NP4 processor connects to the integrated switch fabric through two XAUI interfaces:
XAUI0 and XAUI1. On each NP4 processor all of the odd numbered interfaces use XAU0 and all
of the even numbered interfaces use XAUI1:
NPU1
XAUI0 = port1,port3,port13, port15, port17
XAUI1 = port2, port4, port14, port16
NPU2
XAUI0 = port5, port7, port18, port20, port22
XAUI1 = port6, port8, port19, port21
Fortinet Technologies Inc. Page 1111 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
NPU3
XAUI0 = port9, port11, port23, port25, port27
XAUI1 = port10, port12, port24, port26, port28
Usually you do not have to be concerned about the XAUI interface mapping. However, if an NP4
interface is processing a very high amount of traffic you should distribute that traffic among
both of the XAUI interfaces connected to it. So if you have a very high volume of traffic flowing
between two networks you should connect both networks to the same NP4 processor but to
different XAUI links. So between even and an add numbered FortiGate-3600C ports. For
example, you could connect one network to port5 and the other network to port6. In this
configuration, the second NP4 processor would handle traffic acceleration and both XAUI
interfaces would be processing traffic.
The FortiGate-3950B features one NP4 processor. The 1Gb SPF interfaces, port1, port2, port3,
port4, and the 10Gb SPF+ interfaces, port5, port6, share connections to one NP4 processor.
The FortiGate-3951B is similar to the FortiGate-3950B, except it trades one FMC slot for four
FSM slots. The network interfaces available on each model are identical.
You can add additional FMC interface modules. The diagram below shows a FortiGate-3950B
with three modules installed: an FMC-XG2, an FMC-F20, and an FMC-C20.
The FMC-XG2 has one SP2 processor. The 10Gb SPF+ interfaces, port1 and port2, share
connections to the processor.
The FMC-F20 has one NP4 processor and the twenty 1Gb SPF interfaces, port1 through
port20, share connections to the NP4 processor.
The FMC-C20 has one NP4 processor and the twenty 10/100/1000 interfaces, port1 through
port20, share connections to the NP4 processor.
FMC FMC
FMC-F20
FMC3
FMC1 ACTIVE
SERVICE
1/2 3/4 5/6 7/8 9 / 10 11 / 12 13 / 14 15 / 16 17 / 18 19 / 20
FMC
FMC-XG2 FMC
FMC-C20
FMC4
ACTIVE
FMC2 1 (SFP +) 2 (SFP +)
ACTIVE
SERVICE SERVICE 1/2 3/4 5/6 7/8 9 / 10 11 / 12 13 / 14 15 / 16 17 / 18 19 / 20
MGMT 1 1 3 5 (SFP+)
FMC
FortiGate 3950B CONSOLE
SWITCH
FMC5
STATUS 1 5 9 13 17 21
USB MGMT
I/O ALARM 2 6 10 14 18 22
3 7 11 15 19 23
HA
4 8 12 16 20 24
POWER
USB MGMT 2 2 4 6 (SFP+)
System Bus
CP7 CPU
Fortinet Technologies Inc. Page 1112 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-3950B and FortiGate-3951B load balance mode
Adding one or more FMC-XG2 modules to your FortiGate-3950B allows you to enable load
balance mode. This feature allows you increased flexibility in how you use the interfaces on the
FortiGate unit. The FortiGate-3951B is similar to the FortiGate-3950B, except it trades one FMC
slot for four FSM slots. The network interfaces available on each model are identical.
When enabled, traffic between any two interfaces (excluding management and console) is
accelerated whether they are the six interfaces on the FortiGate-3950B itself, or on any installed
FMC modules. Traffic is not limited to entering and leaving the FortiGate unit in specific
interface groupings to benefit from NP4 and SP2 acceleration. You can use any pair of
interfaces.
Security acceleration in this mode is limited, however. Only IPS scanning is accelerated in load
balance mode.
FMC FMC
FMC-F20
FMC3
FMC1 ACTIVE
SERVICE
1/2 3/4 5/6 7/8 9 / 10 11 / 12 13 / 14 15 / 16 17 / 18 19 / 20
FMC
FMC-XG2 FMC
FMC-C20
FMC4
ACTIVE
FMC2 1 (SFP +) 2 (SFP +)
ACTIVE
SERVICE SERVICE 1/2 3/4 5/6 7/8 9 / 10 11 / 12 13 / 14 15 / 16 17 / 18 19 / 20
MGMT 1 1 3 5 (SFP+)
FMC
FortiGate 3950B CONSOLE
SWITCH
FMC5
STATUS 1 5 9 13 17 21
USB MGMT
I/O ALARM 2 6 10 14 18 22
3 7 11 15 19 23
HA
4 8 12 16 20 24
POWER
USB MGMT 2 2 4 6 (SFP+)
FortiASIC
FortiASIC NP4
SP2
System Bus
CP7 CPU
Fortinet Technologies Inc. Page 1113 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
FortiGate-5001C
The FortiGate-5001C board includes two NP4 processors connected to an integrated switch
fabric:
The port1, fabric1, and base1 interfaces are connected to one NP4 processor.
The port2, fabric2, and base2 interfaces are connected to the other NP4 processor.
fabric1 fabric2
base1 base2
FortiASIC FortiASIC
NP4 NP4
System Bus
CP7 CPU
FortiGate-5001B
The FortiGate-5001B board includes two NP4 connected to an Ethernet switch. Traffic between
interfaces that use the same NP4 processor experiences the highest acceleration since the
FortiGate-5001B does not include an integrated switch fabric.
The port1, port2, port3, port4, fabric1 and base1 interfaces are connected to one NP4
processor.
The port5, port6, port7, port8, fabric2 and base2 interfaces are connected to the other NP4
processor.
fabric1 fabric2
base1 base2
Ethernet Switch
FortiASIC FortiASIC
NP4 NP4
System Bus
CP7 CPU
For example, for maximum NP4 acceleration of traffic received on port1 the traffic must exit the
FortiGate-5001B board on port2, port3, port4, or fabric1. Also, for maximum acceleration of
traffic received on port5 the traffic must exit the FortiGate-5001B board on port6, port7, port8,
or fabric2.
Fortinet Technologies Inc. Page 1114 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Setting switch-mode mapping on the ADM-XD4
The ADM-XD4 SP has four 10Gb/s ports, but the NP4 processor it contains has only two
10Gb/s ports. The external ports you use are important to optimize the SP for your application.
Ports 1 and 3 share one NP4 processor and ports 2 and 4 share the other. Performance ports
sharing the same NP4 processor is far better than when forcing network data to move between
NP4 processors by using one port from each, for example ports 1 and 2 or ports 3 and 4.
Fortinet Technologies Inc. Page 1115 FortiOS Handbook - Hardware Acceleration for FortiOS 5.0
Chapter 9 High Availability for FortiOS
5.0
Page 1116
Solving the High Availability problem
The basic high availability (HA) problem for TCP/IP networks and security gateways is keeping
network traffic flowing. Uninterrupted traffic flow is a critical component for online systems and
media because critical business processes quickly come to a halt when the network is down.
The security gateway is a crucial component of most networks since all traffic passes through it.
A standalone network security gateway is a single point of failure that is vulnerable to any
number of software or hardware problems that could compromise the device and bring all traffic
on the network to a halt.
A common solution to the high availability problem is to eliminate the security gateway as single
point of failure by introducing redundancy. With two or more redundant security gateways, if
one fails, the remaining one or more gateways keep the traffic flowing. FortiOS provides four
redundancy solutions: industry standard VRRP as well as three proprietary solutions: FortiGate
Cluster Protocol (FGCP) high availability, FortiGate Session Life Support Protocol (FGSP) high
availability, and the Fortinet Redundant UTM protocol (FRUP) high availability.
You can combine more than one high availability solution into a single configuration. A common
reason for doing this could be to add VRRP to an FGCP or FGSP configuration.
A strong and flexible High availability solution is required for many mission-critical firewall and
UTM applications. Each FortiOS high availability solution can be fine tuned to fit into many
different network scenarios.
h
In
te al
ou rn
r
E
Page 1117
The FGCP is compatible with most network environments and most networking equipment.
While initial configuration is relatively quick and easy, a large number of tools and configuration
options are available to fine tune the cluster for most situations.
In previous versions of FortiOS the FGSP was called TCP session synchronization or
standalone session synchronization. However, the FGSP has been expanded to include
configuration synchronization and session synchronization of connectionless sessions,
expectation sessions, and NAT sessions.
Fortinet Technologies Inc. Page 1118 FortiOS Handbook - High Availability for FortiOS 5.0
VRRP
An extension to the FGCP combines switching HA and firewall HA into a single unified design.
This feature is available on the FortiGate-100D and will be expanded to other models in future
releases.
A FRUP setup consists of 2 (and only 2) identical FortiGate-100D units. The setup supports dual
redundant HA links between the units for sharing session and configuration data.
FRUP requires redundant external routers where:
One FortiGate unit has a primary connection to one of the routers and a backup connection
to the other.
The other FortiGate unit has the opposite configuration.
Fortinet Technologies Inc. Page 1119 FortiOS Handbook - High Availability for FortiOS 5.0
See Configuring FRUP on page 1380 for an example configuration.
B
T-
G
F
Internal
Network
nk ve
Li cti
A
r
ve
ks
p
er
-2
nk ku
lin
S
er
Li ac
A
ut
lH
o
R
ua
D
p
nk ku
Li ca
B
nk ve
A
T-
Li cti
G
A
F
-1
er
ut
o
R
Fortinet Technologies Inc. Page 1120 FortiOS Handbook - High Availability for FortiOS 5.0
An introduction to the FGCP
A FortiGate HA cluster consists of two to four FortiGate units configured for HA operation. Each
FortiGate unit in a cluster is called a cluster unit. All cluster units must be the same FortiGate
model with the same FortiOS firmware build installed. All cluster units must also have the same
hardware configuration (for example, the same AMC modules installed in the same slots, the
same number of hard disks and so on) and be running in the same operating mode (NAT/Route
mode or Transparent mode).
In addition the cluster units must be able to communicate with each other through their
heartbeat interfaces. This heartbeat communication is required for the cluster to be created and
to continue operating. Without it, the cluster acts like a collection of standalone FortiGate units.
On startup, after configuring the cluster units with the same HA configuration and connecting
their heartbeat interfaces, the cluster units use the FortiGate Clustering Protocol (FGCP) to find
other FortiGate units configured for HA operation and to negotiate to create a cluster. During
cluster operation, the FGCP shares communication and synchronization information among the
cluster units over the heartbeat interface link. This communication and synchronization is called
the FGCP heartbeat or the HA heartbeat. Often, this is shortened to just heartbeat.
The cluster uses the FGCP to select the primary unit, and to provide device, link and session
failover. The FGCP also manages the two HA modes; active-passive (failover HA) and
active-active (load balancing HA).
This chapter describes.
About the FGCP
Synchronizing the configuration (and settings that are not synchronized)
Configuring FortiGate units for FGCP HA operation
Active-passive and active-active HA
Identifying the cluster and cluster units
Device failover, link failover, and session failover
Primary unit selection
HA override
FortiGate HA compatibility with PPPoE and DHCP
HA and distributed clustering
Hard disk configuration and HA
FGCP high availability best practices
FGCP HA terminology
HA web-based manager options
Page 1121
About the FGCP
Figure 186:HA cluster installed between an internal network and the Internet
i tc a l
w n
S ter
h
In
Internal
Network
h l
itc a
w rn
S xte
E
te al
ou rn
R xte
r
E
FortiGate
High Availability
Cluster
Inside the cluster the individual FortiGate units are called cluster units. These cluster units share
state and configuration information. If one cluster unit fails, the other units in the cluster
automatically replace that unit, taking over the work that the failed unit was doing. After the
failure, the cluster continues to process network traffic and provide normal FortiGate services
with virtually no interruption.
Every FortiGate cluster contains one primary unit (also called the master unit) and one or more
subordinate units (also called slave or backup units). The primary unit controls how the cluster
operates. The role that the subordinate units play depends on the mode in which the cluster
operates: (Active-Passive (AP) or Active-Active (AA) (see Active-passive HA (failover
protection) on page 1128 and Active-active HA (load balancing and failover protection) on
page 1129).
The ability of an HA cluster to continue providing firewall services after a failure is called failover.
FGCP failover means that your network does not have to rely on one FortiGate unit to continue
functioning. You can install additional units and form an HA cluster.
A second HA feature, called load balancing, can be used to increase performance. A cluster of
FortiGate units can increase overall network performance by sharing the load of processing
network traffic and providing security services. The cluster appears to your network to be a
single device, adding increased performance without changing your network configuration.
Virtual clustering extends HA features to provide failover protection and load balancing for
Virtual Domains (VDOMs). See Virtual clusters on page 1217.
FortiGate models that support redundant interfaces can be configured to support full mesh HA.
Full mesh HA is a method of reducing the number of single points of failure on a network that
includes an HA cluster. For details about full mesh HA, see Full mesh HA on page 1239.
Fortinet Technologies Inc. Page 1122 FortiOS Handbook - High Availability for FortiOS 5.0
FGCP failover protection
The FGCP provides IP/MAC takeover for failover protection by assigning virtual MAC addresses
to the primary cluster unit and then sending gratuitous ARP packets from the primary unit
interfaces to reprogram the network.
Failover times can be less than a second under optimal conditions. You can fine tune failover
performance for your network by adjusting cluster status checking timers, routing table update
timers, and wait timers.
An HA cluster fails over if the primary unit fails (a device failure) or experiences a link failure. The
cluster can detect link failures for connections to the primary unit using port monitoring and for
connections between downstream network components using remote IP monitoring. To
compensate for a link failover, the cluster maintains active links to keep traffic flowing between
high-priority networks. Port and remote IP monitoring can be fine tuned without disrupting
cluster operation.
Session Failover
FGCP session failover maintains TCP, SIP and IPsec VPN sessions after a failure. You can also
configure session failover to maintain UDP and ICMP sessions. Session failover does not
failover multicast, or SSL VPN sessions. Session failover may not be required for all networks
because many TCP/IP, UDP, and ICMP protocols can resume sessions on their own. Supporting
session failover adds extra overhead to cluster operations and can be disabled to improve
cluster performance if it is not required.
Load Balancing
Active-active HA load balances resource-intensive virus scanning, web filtering, intrusion
protection, Application Control, email filtering and Data Leak Prevention operations among all
cluster units to provide better performance than a standalone FortiGate unit. If network traffic
consists of mainly TCP sessions, the FGCP can also load balance all TCP sessions to improve
TCP performance in some network configurations. You can also load balance UDP sessions.
You can use accelerated FortiGate interfaces to also accelerate HA load balancing and HA load
balancing schedules can be adjusted to optimize performance for the traffic mix on your
network. Weighted load balancing can be used to control the relative amount of sessions
processed by each cluster unit.
Virtual Clustering
Virtual clustering is an extension of the FGCP for a cluster of 2 FortiGate units operating with
multiple VDOMS enabled. Not only does virtual clustering provide failover protection for a
multiple VDOM configuration, but a virtual cluster can load balance traffic between the cluster
units. Load balancing with virtual clustering is quite efficient and load balances all traffic (not
just UTM and TCP traffic). Its possible to fine tune virtual clustering load balancing in real time to
actively optimize load sharing between the cluster units without affecting the smooth operation
of the cluster.
Fortinet Technologies Inc. Page 1123 FortiOS Handbook - High Availability for FortiOS 5.0
Full Mesh HA
High availability improves the reliability of a network by replacing a single point of failure (a singe
FortiGate unit) with a cluster that can maintain network traffic if one of the cluster units fails.
However, in a normal cluster configuration, single points of failure remain. Full mesh HA
removes these single points of failure by allowing you to connect redundant switches to each
cluster interface. Full mesh HA is achieved by configuring 802.3ad aggregate or redundant
interfaces on the FortiGate unit and connecting redundant switches to these interfaces.
Configuration is a relatively simple extension of the normal aggregate/redundant interface and
HA configurations.
Cluster Management
FortiOS HA provides a wide range of cluster management features:
Automatic continuous configuration synchronization. You can get a cluster up and running
almost as quickly as a standalone FortiGate unit by performing a few basic steps to
configure HA settings and minimal network settings on each cluster unit. When the cluster is
operating you can configure FortiGate features such as firewalling, content inspection, and
VPN in the same way as for a standalone FortiGate unit. All configuration changes (even
complex changes such as switching to multiple VDOM mode or from NAT/Route to
Transparent mode) are synchronized among all cluster units.
Firmware upgrades/downgrades. Upgrading or downgrading cluster firmware is similar to
upgrading or downgrading standalone FortiGate firmware. The Firmware is uploaded once
to the primary unit and the cluster automatically upgrades or downgrades all cluster units in
one operation with minimal or no service interruption.
Individual cluster unit management. In some cases you may want to manage individual
cluster units. You can do so from cluster CLI by navigating to each cluster unit. You can also
use the reserved management interface feature to give each cluster unit its own IP address
and default route. You can use the reserved management interfaces and IP addresses to
connect to the GUI and CLI of each cluster unit and configure an SNMP server to poll each
cluster unit.
Removing and adding cluster units. In one simple step any unit (even the primary unit) can
be removed from a cluster and given a new IP address. The cluster keeps operating as it
was; the transition happening without interrupting cluster operation. A new unit can also be
added to an operating cluster without disrupting network traffic. All you have to do is
connect the new unit and change its HA configuration to match the clusters. The cluster
automatically finds and adds the unit and synchronizes its configuration with the cluster.
Debug and diagnose commands. An extensive range of debug and diagnose commands
can be used to report on HA operation and find and fix problems.
Logging and reporting. All cluster units can be configured to record all log messages. These
message can be stored on the individual cluster units or sent to a FortiAnalyzer unit. You can
view all cluster unit log messages by logging into any cluster unit.
FortiManager support. FortiManager understands FortiOS HA and automatically recognizes
when you add a FortiOS cluster to the FortiManager configuration.
The FGCP uses a combination of incremental and periodic synchronization to make sure that
the configuration of all cluster units is synchronized to that of the primary unit. This means that
in most cases you only have to make a configuration change once to have it synchronized to all
cluster units.
Fortinet Technologies Inc. Page 1124 FortiOS Handbook - High Availability for FortiOS 5.0
Some configuration settings are not synchronized to support some aspects of FortiGate
operation. The following settings are not synchronized among cluster units:
The FortiGate unit host name. Allows you to identify cluster units.
HA override (HA override on page 1138).
HA device priority (Primary unit selection and device priority on page 1136).
Virtual cluster 1 and Virtual cluster 2 device priorities (Virtual clustering and load balancing
or VDOM partitioning on page 1218)
The HA priority (ha-priority) setting for a ping server or dead gateway detection
configuration (Remote link failover on page 1325).
The system interface settings of the FortiGate interface that becomes the HA reserved
management interface (Managing individual cluster units using a reserved management
interface on page 1254).
The default route for the reserved management interface, set using the
ha-mgt-interface-gateway option of the config system ha command (Managing
individual cluster units using a reserved management interface on page 1254).
The dynamic weighted load balancing thresholds and high and low watermarks
(Dynamically optimizing weighted load balancing according to how busy cluster units are
on page 1350).
Each FortiGate unit in the cluster must have the same HA configuration. Once the cluster is
connected, you can configure it in the same way as you would configure a standalone FortiGate
unit. The following procedures set the HA mode to active-passive and set the HA password to
HA_pass.
Make sure your FortiGate interfaces are configured with static IP addresses. If any interface
gets its address using DHCP you will not be able to configure HA.
Fortinet Technologies Inc. Page 1125 FortiOS Handbook - High Availability for FortiOS 5.0
5. Go to System > Config > HA and change the following settings:
Mode Active-Passive
Password HA_pass
The password must be the same for all FortiGate units in
the cluster.
You can accept the default configuration for the remaining HA options and change them
later, once the cluster is operating.
6. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
addresses on page 1300). To be able to reconnect sooner, you can update the ARP table of
your management PC by deleting the ARP table entry for the FortiGate unit (or just deleting
all ARP table entries). You may be able to delete the ARP table of your management PC from
a command prompt using a command similar to arp -d.
7. Power off the FortiGate unit.
8. Repeat this procedure for all of the FortiGate units in the cluster.
Once all of the units are configured, continue with Connecting a FortiGate HA cluster on
page 1127.
Fortinet Technologies Inc. Page 1126 FortiOS Handbook - High Availability for FortiOS 5.0
6. Repeat this procedure for all of the FortiGate units in the cluster.
Once all of the units are configured, continue with Connecting a FortiGate HA cluster.
1
N
1
A
A
W
H
Internal
A
H
Network
h
1
itc
A
w
H
S
2
er l
ut a
A
o rn
1
H
rt
R xte
o
P
E
1
N
A
W
FortiG
FortiGate-100D
Cluster
Fortinet Technologies Inc. Page 1127 FortiOS Handbook - High Availability for FortiOS 5.0
5. Power on both of the FortiGate units.
As the cluster units start, they negotiate to choose the primary unit and the subordinate unit.
This negotiation occurs with no user intervention and normally just takes a few seconds.
At least one heartbeat interface should be connected together for the cluster to operate.
Do not use a switch port for the HA heartbeat traffic. This configuration is not supported.
You could use one switch to connect all four heartbeat interfaces. However, this is not
recommended because if the switch fails both heartbeat interfaces will become
disconnected.
For more information about heartbeat interfaces, see HA heartbeat and communication
between cluster units on page 1293.
6. You can now configure the cluster as if it is a single FortiGate unit.
The first decision to make when configuring FortiGate HA is whether to choose active-passive
or active-active HA mode. To configure the HA mode, go to System > Config > HA and set
Mode to Active-Passive or Active-Active.
From the CLI enter the following command to set the HA mode to active-passive:
config system ha
set mode a-p
end
To form a cluster, all cluster units must be set to the same mode. You can also change the mode
after the cluster is up and running. Changing the mode of a functioning cluster causes a slight
delay while the cluster renegotiates to operate in the new mode and possibly select a new
primary unit.
Fortinet Technologies Inc. Page 1128 FortiOS Handbook - High Availability for FortiOS 5.0
The following example shows how to configure a FortiGate unit for active-passive HA operation.
You would enter the exact same commands on every FortiGate unit in the cluster.
config system ha
set mode a-p
set group-name myname
set password HApass
end
You can use the cluster group name, group id, and password to identify a cluster and
distinguish one cluster from another. If you have more than one cluster on the same network,
each cluster must have a different group name, group id, and password.
Group name
Use the group name to identify the cluster. The maximum length of the group name is 32
characters. The group name must be the same for all cluster units before the cluster units can
form a cluster. After a cluster is operating, you can change the group name. The group name
change is synchronized to all cluster units.
The default group name is FGT-HA. The group name appears on the FortiGate dashboard of a
functioning cluster as the Cluster Name.
Fortinet Technologies Inc. Page 1129 FortiOS Handbook - High Availability for FortiOS 5.0
To change the group name from the web-based manager go to Config > System > HA and
change the Group Name.
Enter the following CLI command to change the group name to Cluster_name:
config system ha
set group-name Cluster_name
end
Password
Use the password to identify the cluster. You should always change the password when
configuring a cluster. The password must be the same for all FortiGate units before they can
form a cluster. When the cluster is operating you can change the password, if required. Two
clusters on the same network cannot have the same password.
To change the password from the web-based manager go to Config > System > HA and change
the Password.
Enter the following CLI command to change the password to ha_pwd:
config system ha
set password ha_pwd
end
Group ID
Similar to the group name, the group ID is also identifies the cluster. In most cases you do not
have to change the group ID. However, you should change the group ID if you have more than
one cluster on the same network. All members of the HA cluster must have the same group ID.
The group ID is a number from 0 to 255.
Changing the group ID changes the cluster virtual MAC address. See Cluster virtual MAC
addresses on page 1300.
Enter the following CLI command to change the group ID to 10:
config system ha
set group-id 10
end
The FGCP provides transparent device and link failover. You can also enable session pickup to
provide session failover. A failover can be caused by a hardware failure, a software failure, or
something as simple as a network cable being disconnected causing a link failover. When a
failover occurs, the cluster detects and recognizes the failure and takes steps to respond so
that the network can continue to operate without interruption. The internal operation of the
cluster changes, but network components outside of the cluster notice little or no change.
If a failover occurs, the cluster also records log messages about the event and can be
configured to send log messages to a syslog server and to a FortiAnalyzer unit. The cluster can
also send SNMP traps and alert email messages. These alerts can notify network administrators
of the failover and may contain information that the network administrators can use to find and
fix the problem that caused the failure.
For a complete description of device failover, link failover, and session failover, how clusters
support these types of failover, and how FortiGate HA clusters compensate for a failure to
maintain network traffic flow see HA and failover protection on page 1290.
Fortinet Technologies Inc. Page 1130 FortiOS Handbook - High Availability for FortiOS 5.0
Primary unit selection
Once FortiGate units recognize that they can form a cluster, the cluster units negotiate to select
a primary unit. Primary unit selection occurs automatically based on the criteria shown in
Figure 188. After the cluster selects the primary unit, all of the remaining cluster units become
subordinate units.
Negotiation and primary unit selection also takes place if a primary unit fails (device failover) or
if a monitored interface fails or is disconnected (link failover). During a device or link failover, the
cluster renegotiates to select a new primary unit also using the criteria shown in Figure 188.
Equal
Greater Less
Age
Equal
Greater Less
Device Priority
Equal
Greater Less
Serial Number
Primary
Pri
i m ary Unit Subordinate
Sub
b o r d i nate Unit
U
For many basic HA configurations primary unit selection simply selects the cluster unit with the
highest serial number to become the primary unit. A basic HA configuration involves setting the
HA mode to active-passive or active-active and configuring the cluster group name and
password. Using this configuration, the cluster unit with the highest serial number becomes the
primary unit because primary unit selection disregards connected monitored interfaces
(because interface monitoring is not configured), the age of the cluster units would usually
always be the same, and all units would have the same device priority.
Using the serial number is a convenient way to differentiate cluster units; so basing primary unit
selection on the serial number is predictable and easy to understand and interpret. Also the
cluster unit with the highest serial number would usually be the newest FortiGate unit with the
most recent hardware version. In many cases you may not need active control over primary unit
selection, so basic primary unit selection based on serial number is sufficient.
Fortinet Technologies Inc. Page 1131 FortiOS Handbook - High Availability for FortiOS 5.0
In some situations you may want have control over which cluster unit becomes the primary unit.
You can control primary unit selection by setting the device priority of one cluster unit to be
higher than the device priority of all other cluster units. If you change one or more device
priorities, during negotiation, the cluster unit with the highest device priority becomes the
primary unit. As shown in Figure 188 the FGCP selects the primary unit based on device priority
before serial number. For more information about how to use device priorities, see Primary unit
selection and device priority on page 1136.
The only other way that you can influence primary unit selection is by configuring interface
monitoring (also called port monitoring). Using interface monitoring you can make sure that
cluster units with failed or disconnected monitored interfaces cannot become the primary unit.
See Primary unit selection and monitored interfaces on page 1132.
Finally, the age of a cluster unit is determined by a number of operating factors. Normally the
age of all cluster units is the same so normally age has no effect on primary unit selection. Age
does affect primary unit selection after a monitored interface failure. For more information about
age, see Primary unit selection and age on page 1133.
This section describes:
Primary unit selection and monitored interfaces
Primary unit selection and age
Primary unit selection and device priority
Primary unit selection and the FortiGate unit serial number
Points to remember about primary unit selection
Fortinet Technologies Inc. Page 1132 FortiOS Handbook - High Availability for FortiOS 5.0
Primary unit selection and age
The cluster unit with the highest age value becomes the primary unit. The age of a cluster unit is
the amount of time since a monitored interface failed or is disconnected. Age is also reset when
a cluster unit starts (boots up). So, when all cluster units start up at about the same time, they all
have the same age. Age does not affect primary unit selection when all cluster units start up at
the same time. Age also takes precedence over priority for primary unit selection.
If a link failure of a monitored interface occurs, the age value for the cluster unit that experiences
the link failure is reset. So, the cluster unit that experienced the link failure also has a lower age
value than the other cluster units. This reduced age does not effect primary unit selection
because the number of link failures takes precedence over the age.
If the failed monitored interface is restored the cluster unit that had the failed monitored
interface cannot become the primary unit because its age is still lower than the age of the other
cluster units.
In most cases, the way that age is handled by the cluster reduces the number of times the
cluster selects a new primary unit, which results in a more stable cluster since selecting a new
primary unit has the potential to disrupt traffic.
Fortinet Technologies Inc. Page 1133 FortiOS Handbook - High Availability for FortiOS 5.0
You may want to increase the age margin if cluster unit startup time differences are larger than 5
minutes.
Fortinet Technologies Inc. Page 1134 FortiOS Handbook - High Availability for FortiOS 5.0
If port1 (the monitored interface) of the primary unit is disconnected, the cluster renegotiates
and the former subordinate unit becomes the primary unit. When you log into the new primary
unit CLI and enter diagnose sys ha dump-by all-vcluster you could get results similar
to the following:
diagnose sys ha dump-by all-vcluster
HA information.
vcluster id=1, nventry=2, state=work, digest=3.f8.d1.63.4d.d2...
ventry idx=0,id=1,FG-5KC3E13800046,prio=128,0,claimed=0,
override=0,flag=1,time=0,mon=0
mondev=port1,50
ventry idx=1,id=1,FG-5KC3E13800084,prio=128,-50,claimed=0,
override=0,flag=0,time=1362,mon=0
The command results show that the age of the new primary unit is 136.2 seconds higher than
the age of the new subordinate unit.
If port1 of the former primary unit is reconnected the cluster will once again make this the
primary unit because the age difference will still be less than 300 seconds. When you log into
the primary unit CLI and enter diagnose sys ha dump-by all-vcluster you get results
similar to the following:
diagnose sys ha dump-by all-vcluster
HA information.
vcluster id=1, nventry=2, state=work, digest=4.a5.60.11.cf.d4...
ventry idx=0,id=1,FG-5KC3E13800084,prio=128,0,claimed=0,
override=0,flag=1,time=0,mon=0
mondev=port1,50
ventry idx=1,id=1,FG-5KC3E13800046,prio=128,0,claimed=0,
override=0,flag=0,time=-1362,mon=0
Fortinet Technologies Inc. Page 1135 FortiOS Handbook - High Availability for FortiOS 5.0
This command resets the age of a unit back to zero so that if no other unit in the cluster was
reset at the same time, it will now have the lowest age. You would use this command to reset
the age of the cluster unit that is currently the primary unit. Since it will have the lowest age, the
other unit in the cluster will have the highest age and can then become the primary unit.
Enabling the override HA CLI keyword makes changes in device priority more effective by
causing the cluster to negotiate more often to make sure that the primary unit is always the unit
with the highest device priority. For more information about override, see HA override on
page 1138.
Fortinet Technologies Inc. Page 1136 FortiOS Handbook - High Availability for FortiOS 5.0
The following example shows how to change the device priority of a subordinate unit to 255 so
that this subordinate unit becomes the primary unit. You can change the device priority of a
subordinate unit by going to Config > System > HA and selecting the Edit icon for the
subordinate unit. Or from the CLI you can use the execute ha manage 0 command to
connect to the highest priority subordinate unit. After you enter the following commands the
cluster renegotiates and selects a new primary unit.
execute ha manage 1
config system ha
set priority 255
end
If you have three units in a cluster you can set the device priorities as shown in Table 55. When
the cluster starts up, cluster unit A becomes the primary unit because it has the highest device
priority. If unit A fails, unit B becomes the primary unit because unit B has a higher device
priority than unit C.
Table 55: Example device priorities for a cluster of three FortiGate units
A 200
B 100
C 50
When configuring HA you do not have to change the device priority of any of the cluster units. If
all cluster units have the same device priority, when the cluster first starts up the FGCP
negotiates to select the cluster unit with the highest serial number to be the primary unit.
Clusters also function normally if all units have the same device priority.
You can change the device priority if you want to control the roles that individual units play in
the cluster. For example, if you want the same unit to always become the primary unit, set this
unit device priority higher than the device priority of other cluster units. Also, if you want a
cluster unit to always become a subordinate unit, set this cluster unit device priority lower than
the device priority of other cluster units.
If you have a cluster of three units you can set a different priority for each unit to control which
unit becomes the primary unit when all three cluster units and functioning and which will be the
primary unit when two cluster units are functioning.
The device priority range is 0 to 255. The default device priority is 128.
If you are configuring a virtual cluster, if you have added virtual domains to both virtual clusters,
you can set the device priority that the cluster unit has in virtual cluster 1 and virtual cluster 2.
If a FortiGate unit has different device priorities in virtual cluster 1 and virtual cluster 2, the
FortiGate unit may be the primary unit in one virtual cluster and the subordinate unit in the other.
For more information, see Virtual clustering and load balancing or VDOM partitioning on
page 1218.
Fortinet Technologies Inc. Page 1137 FortiOS Handbook - High Availability for FortiOS 5.0
Age does take precedence over serial number, so if a cluster unit takes longer to join a cluster
for some reason (for example if one cluster unit is powered on after the others), that cluster unit
will not become the primary unit because the other units have been in the cluster longer.
Device priority and failed monitored interfaces also take precedence over serial number. A
higher device priority means a higher priority. So if you set the device priority of one unit higher
or if a monitored interface fails, the cluster will not use the FortiGate serial number to select the
primary unit.
HA override
The HA override CLI keyword is disabled by default. When override is disabled a cluster
may not always renegotiate when an event occurs that affects primary unit selection. For
example, when override is disabled a cluster will not renegotiate when you change a cluster
unit device priority or when you add a new cluster unit to a cluster. This is true even if the unit
added to the cluster has a higher device priority than any other unit in the cluster. Also, when
override is disabled a cluster does not negotiate if the new unit added to the cluster has a
failed or disconnected monitored interface.
For a virtual cluster configuration, override is enabled by default for both virtual clusters
when you enable virtual cluster 2. For more information, see Virtual clustering and HA
override on page 1218.
In most cases you should keep override disabled to reduce how often the cluster negotiates.
Frequent negotiations may cause frequent traffic interruptions.
However, if you want to make sure that the same cluster unit always operates as the primary
unit and if you are less concerned about frequent cluster negotiation you can set its device
priority higher than other cluster units and enable override.
To enable override, connect to each cluster unit CLI (using the execute ha manage
command) and use the config system ha CLI command to enable override.
For override to be effective, you must also set the device priority highest on the cluster unit
that you want to always be the primary unit. To increase the device priority, from the CLI use the
config system ha command and increase the value of the priority keyword to a number
higher than the default priority of 128.
Fortinet Technologies Inc. Page 1138 FortiOS Handbook - High Availability for FortiOS 5.0
You can also increase the device priority from the web-based manager by going to System >
Config > HA. To increase the device priority of the primary unit select edit for the primary or
subordinate unit and set the Device Priority to a number higher than 128.
The override setting and device priority value are not synchronized to all cluster units. You
must enable override and adjust device priority manually and separately for each cluster unit.
With override enabled, the primary unit with the highest device priority will always become
the primary unit. Whenever an event occurs that may affect primary unit selection, the cluster
negotiates. For example, when override is enabled a cluster renegotiates when you change
the device priority of any cluster unit or when you add a new unit to a cluster.
This section also describes:
Override and primary unit selection
Controlling primary unit selection using device priority and override
Points to remember about primary unit selection when override is enabled
Configuration changes can be lost if override is enabled
Override and disconnecting a unit from a cluster
Fortinet Technologies Inc. Page 1139 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 189:Selecting the primary unit with override enabled
Begin Negotiation
Equal
Greater Less
Device Priority
Equal
Greater Less
Age
Equal
Greater Less
Serial Number
Primary
Prim
m a r Unit S
Subordinate
bo
o rd
d inate Un
Unit
Fortinet Technologies Inc. Page 1140 FortiOS Handbook - High Availability for FortiOS 5.0
Points to remember about primary unit selection when override is enabled
Some points to remember about primary unit selection when override is enabled:
The FGCP compares primary unit selection criteria in the following order: Failed Monitored
Interfaces > Device Priority > Age > Serial number. The selection process stops at the first
criteria that selects one cluster unit.
Negotiation and primary unit selection is triggered whenever an event occurs which may
affect primary unit selection. For example negotiation occurs, when you change the device
priority, when you add a new unit to a cluster, if a cluster unit fails, or if a monitored interface
fails.
Device priority is considered before age. Otherwise age is handled the same when
override is enabled.
The solution
When override is enabled, you can prevent configuration changes from being lost by doing
the following:
Verify that all cluster units are operating before making configuration changes (from the
web-based manager go to System > Config > HA to view the cluster members list or from
the FortiOS CLI enter get system ha status).
Make sure the device priority of the primary unit is set higher than the device priorities of all
other cluster units before making configuration changes.
Disable override either permanently or until all configuration changes have been made
and synchronized to all cluster units.
Fortinet Technologies Inc. Page 1141 FortiOS Handbook - High Availability for FortiOS 5.0
Override and disconnecting a unit from a cluster
A similar scenario to that described in Configuration changes can be lost if override is enabled
may occur when override is enabled and you use the Disconnect from Cluster option from
the web-based manager or the execute ha disconnect command from the CLI to
disconnect a cluster unit from a cluster.
Configuration changes made to the cluster can be lost when you reconnect the disconnected
unit to the cluster. You should make sure that the device priority of the disconnected unit is
lower than the device priority of the current primary unit. Otherwise, when the disconnected unit
joins the cluster, if override is enabled, the cluster renegotiates and the disconnected unit
may become the primary unit. If this happens, the configuration of the disconnected unit is
synchronized to all other cluster units and any configuration changes made between when the
unit was disconnected and reconnected are lost.
FortiGate HA is not compatible with PPP protocols such as PPPoE. FortiGate HA is also not
compatible with DHCP. If one or more FortiGate unit interfaces is dynamically configured using
DHCP or PPPoE you cannot switch to operate in HA mode. Also, you cannot switch to operate
in HA mode if one or more FortiGate unit interfaces is configured as a PPTP or L2TP client.
Configuring an interface for DHCP or PPPoE is only supported in NAT/Route mode. So, usually
when configuring HA in Transparent mode an interface being configured for DHCP or PPPoE
should not affect HA operation. However, in some cases you may not be able to enable HA if
you had configured an interface for DHCP or PPPoE before switching to Transparent mode. So,
if you are blocked from operating a Transparent mode FortiGate unit in HA and cannot find
another reason for the problem, try switching the FortiGate unit back to NAT/Route mode and
setting all interface modes to static before switching to Transparent mode and enabling HA. You
could also enable HA before switching to Transparent mode.
You can configure a cluster to act as a DHCP server or a DHCP relay agent. In both
active-passive and active-active clusters DHCP relay sessions are always handled by the
primary unit. It is possible that a DHCP relay session could be interrupted by a failover. If this
occurs the DHCP relay session is not resumed after the failover and the DHCP client may have
to repeat the DHCP request.
When a cluster is operating as a DHCP server the primary unit responds to all DHCP requests
and maintains the DHCP server address lease database. The cluster also dynamically
synchronizes the DHCP server address lease database to the subordinate units. If a failover
occurs, the new primary unit will have an up-to-date DHCP server address lease database.
Synchronizing the DHCP address lease database prevents the new primary unit from
responding incorrectly to new DHCP requests after a failover.
Also, it is possible that when FortiGate units first negotiate to form a cluster that a unit that ends
up as a subordinate unit in the cluster will have information in its DHCP address lease database
that the cluster unit operating as the primary unit does note have. This can happen if a FortiGate
unit responds to DHCP requests while operating as a standalone unit and then when the cluster
is formed this unit becomes a subordinate unit. Because of this possibility, after a cluster is
formed the DHCP address lease databases of all of the cluster units are merged into one
database which is then synchronized to all cluster units.
Fortinet Technologies Inc. Page 1142 FortiOS Handbook - High Availability for FortiOS 5.0
HA and distributed clustering
The FGCP supports widely separated cluster units installed in different physical locations.
Distributed clusters can have cluster units in different rooms in the same building, different
buildings in the same location, or even different geographical sites such as different cities,
countries or continents.
Just like any cluster, distributed clusters require heartbeat communication between cluster
units. In a distributed cluster this heartbeat communication can take place over the Internet or
over other transmission methods including satellite linkups.
Because of the possible distance it may take a relatively long time for heartbeat packets to be
transmitted between cluster units. To support a distributed cluster you may need to increase the
heartbeat interval so that the cluster expects extra time between heartbeat packets. For
information about changing the heartbeat interval and other heartbeat related settings, see
Modifying heartbeat timing on page 1298.
If your cluster units include hard disks, all cluster units must have identical hard disk
configurations. This means each cluster unit must have same number of hard disks (including
AMC and FortiGate Storage Module (FSM) hard disks) and also means that matching hard disks
in each cluster unit must be the same size, have the same hard disk format, and have the same
number of partitions.
In most cases the default hard disk configuration of the cluster units will be compatible.
However, a hard disk formatted by an older FortiGate firmware version may not be compatible
with a hard disk formatted by a more recent firmware version. Problems may also arise if you
have used the execute scsi-dev command to add or change hard disk protections.
If a cluster unit CLI displays hard disk compatibility messages, you may need to use the
execute scsi-dev delete command to delete partitions. You can also use the execute
formatlogdisk command to reformat hard disks. In some cases after deleting all partitions
and reformatting the hard disks, you may still see hard disk incompatibility messages. If this
happens, contact Fortinet Customer Support for assistance.
Fortinet Technologies Inc. Page 1143 FortiOS Handbook - High Availability for FortiOS 5.0
be synchronized. Session pickup should be configured only when required and is not
recommended for use with SOHO FortiGate models. Session pickup should only be used if
the primary heartbeat link is dedicated (otherwise the additional HA heartbeat traffic could
affect network performance). See Session failover (session pick-up) on page 1330.
If session pickup is not selected, after a device or link failover all sessions are briefly
interrupted and must be re-established at the application level after the cluster renegotiates.
For example, after a failover, users browsing the web can just refresh their browsers to
resume browsing. Users downloading large files may have to restart their download after a
failover. Other protocols may experience data loss and some protocols may require sessions
to be manually restarted. For example, a user downloading files with FTP may have to either
restart downloads or restart their FTP client.
If you need to enable session pickup, consider enabling session pickup delay to improve
performance by reducing the number of sessions that are synchronized. If possible, also
consider enabling session synchronization or multiple FortiGate Interfaces. See Improving
session synchronization performance on page 1331 for more information.
To avoid unpredictable results, when you connect a switch to multiple redundant or
aggregate interfaces in an active-passive cluster you should configure separate redundant
or aggregate interfaces on the switch; one for each cluster unit. See HA MAC addresses
and 802.3ad aggregation on page 1188.
Use SNMP, syslog, or email alerts to monitor a cluster for failover messages. Alert messages
about cluster failovers may help find and diagnose network problems quickly and efficiently.
See Operating a cluster on page 1252.
Heartbeat interfaces
Fortinet suggests the following practices related to heartbeat interfaces:
Do not use a FortiGate switch port for the HA heartbeat traffic. This configuration is not
supported.
Isolate heartbeat interfaces from user networks. Heartbeat packets contain sensitive cluster
configuration information and can consume a considerable amount of network bandwidth. If
the cluster consists of two FortiGate units, connect the heartbeat interfaces directly using a
crossover cable or a regular Ethernet cable. For clusters with more than two units, connect
heartbeat interfaces to a separate switch that is not connected to any network.
If heartbeat traffic cannot be isolated from user networks, enable heartbeat message
encryption and authentication to protect cluster information. See Enabling or disabling HA
heartbeat encryption and authentication on page 1299.
Configure and connect redundant heartbeat interfaces so that if one heartbeat interface fails
or becomes disconnected, HA heartbeat traffic can continue to be transmitted using the
backup heartbeat interface. If heartbeat communication fails, all cluster members will think
they are the primary unit resulting in multiple devices on the network with the same IP
addresses and MAC addresses (condition referred to as Split Brain) and communication will
be disrupted until heartbeat communication can be reestablished.
Do not monitor dedicated heartbeat interfaces; monitor those interfaces whose failure
should trigger a device failover.
Fortinet Technologies Inc. Page 1144 FortiOS Handbook - High Availability for FortiOS 5.0
Interface monitoring (port monitoring)
Fortinet suggests the following practices related to interface monitoring (also called port
monitoring):
Wait until a cluster is up and running and all interfaces are connected before enabling
interface monitoring. A monitored interface can easily become disconnected during initial
setup and cause failovers to occur before the cluster is fully configured and tested.
Monitor interfaces connected to networks that process high priority traffic so that the cluster
maintains connections to these networks if a failure occurs.
Avoid configuring interface monitoring for all interfaces.
Supplement interface monitoring with remote link failover. Configure remote link failover to
maintain packet flow if a link not directly connected to a cluster unit (for example, between a
switch connected to a cluster interface and the network) fails. See Remote link failover on
page 1325.
Troubleshooting
The following sections in this document contain troubleshooting information:
Troubleshooting HA clusters on page 1212
Troubleshooting virtual clustering on page 1238
Troubleshooting full mesh HA on page 1251
Troubleshooting layer-2 switches on page 1361
FGCP HA terminology
Cluster
A group of FortiGate units that act as a single virtual FortiGate unit to maintain connectivity even
if one of the FortiGate units in the cluster fails.
Cluster unit
A FortiGate unit operating in a FortiGate HA cluster.
Device failover
Device failover is a basic requirement of any highly available system. Device failover means that
if a device fails, a replacement device automatically takes the place of the failed device and
continues operating in the same manner as the failed device. See also Device failover, link
failover, and session failover on page 1130.
Failover
A FortiGate unit taking over processing network traffic in place of another unit in the cluster that
suffered a device failure or a link failure.
Failure
A hardware or software problem that causes a FortiGate unit or a monitored interface to stop
processing network traffic.
Fortinet Technologies Inc. Page 1145 FortiOS Handbook - High Availability for FortiOS 5.0
FGCP
The FortiGate clustering protocol (FGCP) that specifies how the FortiGate units in a cluster
communicate to keep the cluster operating.
Full mesh HA
Full mesh HA is a method of removing single points of failure on a network that includes an HA
cluster. FortiGate models that support redundant interfaces can be used to create a cluster
configuration called full mesh HA. Full mesh HA includes redundant connections between all
network components. If any single component or any single connection fails, traffic switches to
the redundant component or connection.
Heartbeat
Also called FGCP heartbeat or HA heartbeat. The heartbeat constantly communicates HA
status and synchronization information to make sure that the cluster is operating properly.
Heartbeat device
An ethernet network interface in a cluster that is used by the FGCP for heartbeat
communications among cluster units.
Heartbeat failover
If an interface functioning as the heartbeat device fails, the heartbeat is transferred to another
interface also configured as an HA heartbeat device.
Hello state
In the hello state a cluster unit has powered on in HA mode, is using HA heartbeat interfaces to
send hello packets, and is listening on its heartbeat interfaces for hello packets from other
FortiGate units. Hello state may appear in HA log messages.
High availability
The ability that a cluster has to maintain a connection when there is a device or link failure by
having another unit in the cluster take over the connection, without any loss of connectivity. To
achieve high availability, all FortiGate units in the cluster share session and configuration
information.
Interface monitoring
You can configure interface monitoring (also called port monitoring) to monitor FortiGate
interfaces to verify that the monitored interfaces are functioning properly and connected to their
networks. If a monitored interface fails or is disconnected from its network the interface leaves
the cluster and a link failover occurs. For more information about interface monitoring, see Link
failover (port monitoring or interface monitoring) on page 1319.
Fortinet Technologies Inc. Page 1146 FortiOS Handbook - High Availability for FortiOS 5.0
Link failover
Link failover means that if a monitored interface fails, the cluster reorganizes to re-establish a
link to the network that the monitored interface was connected to and to continue operating
with minimal or no disruption of network traffic. See also Device failover, link failover, and
session failover on page 1130.
Load balancing
Also known as active-active HA. All units in the cluster process network traffic. The FGCP
employs a technique similar to unicast load balancing. The primary unit interfaces are assigned
virtual MAC addresses which are associated on the network with the cluster IP addresses. The
primary unit is the only cluster unit to receive packets sent to the cluster. The primary unit can
process packets itself, or propagate them to subordinate units according to a load balancing
schedule. Communication between the cluster units uses the actual cluster unit MAC
addresses.
Monitored interface
An interface that is monitored by a cluster to make sure that it is connected and operating
correctly. The cluster monitors the connectivity of this interface for all cluster units. If a
monitored interface fails or becomes disconnected from its network, the cluster will
compensate.
Primary unit
Also called the primary cluster unit, this cluster unit controls how the cluster operates. The
primary unit sends hello packets to all cluster units to synchronize session information,
synchronize the cluster configuration, and to synchronize the cluster routing table. The hello
packets also confirm for the subordinate units that the primary unit is still functioning.
The primary unit also tracks the status of all subordinate units. When you start a management
connection to a cluster, you connect to the primary unit.
In an active-passive cluster, the primary unit processes all network traffic. If a subordinate unit
fails, the primary unit updates the cluster configuration database.
In an active-active cluster, the primary unit receives all network traffic and re-directs this traffic
to subordinate units. If a subordinate unit fails, the primary unit updates the cluster status and
redistributes load balanced traffic to other subordinate units in the cluster.
The FortiGate firmware uses the term master to refer to the primary unit.
Session failover
Session failover means that a cluster maintains active network sessions after a device or link
failover. FortiGate HA does not support session failover by default. To enable session failover
you must change the HA configuration to select Enable Session Pick-up. See also Device
failover, link failover, and session failover on page 1130.
Session pickup
If you enable session pickup for a cluster, if the primary unit fails or a subordinate unit in an
active-active cluster fails, all communication sessions with the cluster are maintained or picked
up by the cluster after the cluster negotiates to select a new primary unit.
Fortinet Technologies Inc. Page 1147 FortiOS Handbook - High Availability for FortiOS 5.0
If session pickup is not a requirement of your HA installation, you can disable this option to save
processing resources and reduce the network bandwidth used by HA session synchronization.
In many cases interrupted sessions will resume on their own after a failover even if session
pickup is not enabled. You can also enable session pickup delay to reduce the number of
sessions that are synchronized by session pickup.
Standby state
A subordinate unit in an active-passive HA cluster operates in the standby state. In a virtual
cluster, a subordinate virtual domain also operates in the standby state. The standby state is
actually a hot-standby state because the subordinate unit or subordinate virtual domain is not
processing traffic but is monitoring the primary unit session table to take the place of the
primary unit or primary virtual domain if a failure occurs.
In an active-active cluster all cluster units operate in a work state.
When standby state appears in HA log messages this usually means that a cluster unit has
become a subordinate unit in an active-passive cluster or that a virtual domain has become a
subordinate virtual domain.
State synchronization
The part of the FGCP that maintains connections after failover.
Subordinate unit
Also called the subordinate cluster unit, each cluster contains one or more cluster units that are
not functioning as the primary unit. Subordinate units are always waiting to become the primary
unit. If a subordinate unit does not receive hello packets from the primary unit, it attempts to
become the primary unit.
In an active-active cluster, subordinate units keep track of cluster connections, keep their
configurations and routing tables synchronized with the primary unit, and process network
traffic assigned to them by the primary unit. In an active-passive cluster, subordinate units do
not process network traffic. However, active-passive subordinate units do keep track of cluster
connections and do keep their configurations and routing tables synchronized with the primary
unit.
The FortiGate firmware uses the terms slave and subsidiary unit to refer to a subordinate unit.
Virtual clustering
Virtual clustering is an extension of the FGCP for FortiGate units operating with multiple VDOMS
enabled. Virtual clustering operates in active-passive mode to provide failover protection
between two instances of a VDOM operating on two different cluster units. You can also operate
virtual clustering in active-active mode to use HA load balancing to load balance sessions
between cluster units. Alternatively, by distributing VDOM processing between the two cluster
units you can also configure virtual clustering to provide load balancing by distributing sessions
for different VDOMs to each cluster unit.
Work state
The primary unit in an active-passive HA cluster, a primary virtual domain in a virtual cluster, and
all cluster units in an active-active cluster operate in the work state. A cluster unit operating in
the work state processes traffic, monitors the status of the other cluster units, and tracks the
session table of the cluster.
When work state appears in HA log messages this usually means that a cluster unit has become
the primary unit or that a virtual domain has become a primary virtual domain.
Fortinet Technologies Inc. Page 1148 FortiOS Handbook - High Availability for FortiOS 5.0
HA web-based manager options
Go to System > Config > HA to change HA options. You can set the following options to put a
FortiGate unit into HA mode. You can also change any of these options while the cluster is
operating.
You can configure HA options for a FortiGate unit with virtual domains (VDOMs) enabled by
logging into the web-based manager as the global admin administrator and going to System >
Config > HA.
If already operating in HA mode, go to System > Config > HA to display the cluster members list
(see Cluster members list on page 1268).
Go to System > Config > HA and select View HA Statistics to view statistics about cluster
operation. See Viewing HA statistics on page 1271.
If your cluster uses virtual domains, you are configuring HA virtual clustering. Most virtual
cluster HA options are the same as normal HA options. However, virtual clusters include VDOM
partitioning options. Other differences between configuration options for regular HA and for
virtual clustering HA are described below and see Virtual clusters on page 1217.
HA is not compatible with PPP protocols such as PPPoE. HA is also not compatible with DHCP.
If one or more FortiGate interfaces is dynamically configured using DHCP or PPPoE, you
cannot switch to operate in HA mode. You also cannot switch to operate in HA mode if one or
more FortiGate interfaces is configured as a PPTP or L2TP client or if the FortiGate unit is
configured for standalone session synchronization.
Mode Select an HA mode for the cluster or return the FortiGate unit in the cluster to
standalone mode. When configuring a cluster, you must set all members of the
HA cluster to the same HA mode. You can select Standalone (to disable HA),
Active-Passive, or Active-Active.
If virtual domains are enabled you can select Active-Passive or Standalone.
Device Optionally set the device priority of the cluster FortiGate unit. Each FortiGate
Priority unit in a cluster can have a different device priority. During HA negotiation, the
FortiGate unit with the highest device priority usually becomes the primary
unit. See Primary unit selection on page 1131.
In a virtual cluster configuration, each cluster FortiGate unit can have two
different device priorities, one for each virtual cluster. During HA negotiation,
the FortiGate unit with the highest device priority in a virtual cluster becomes
the primary FortiGate unit for that virtual cluster.
Changes to the device priority are not synchronized. You can accept the
default device priority when first configuring a cluster.
Reserve You can provide direct management access to individual cluster units by
Management reserving a management interface as part of the HA configuration. Once this
Port for management interface is reserved, you can configure a different IP address,
Cluster administrative access and other interface settings for this interface for each
Member cluster unit. Then by connecting this interface of each cluster unit to your
network you can manage each cluster unit separately from a different IP
address. See Managing individual cluster units using a reserved management
interface on page 1254.
Fortinet Technologies Inc. Page 1149 FortiOS Handbook - High Availability for FortiOS 5.0
Group Name Enter a name to identify the cluster. The maximum length of the group name is
32 characters. The group name must be the same for all cluster units before
the cluster units can form a cluster. After a cluster is operating, you can
change the group name. The group name change is synchronized to all cluster
units.
Password Enter a password to identify the cluster. The password must be the same for
all cluster FortiGate units before the cluster FortiGate units can form a cluster.
Two clusters on the same network must have different passwords.
The password is synchronized to all cluster units in an operating cluster. If you
change the password of one cluster unit the change is synchronized to all
cluster units.
Enable Select to enable session pickup so that if the primary unit fails, sessions are
Session picked up by the cluster unit that becomes the new primary unit.
pickup
You must enable session pickup for session failover protection. If you do not
require session failover protection, leaving session pickup disabled may
reduce HA CPU usage and reduce HA heartbeat network bandwidth usage.
See Session failover (session pick-up) on page 1330.
Port Monitor Select to enable or disable monitoring FortiGate interfaces to verify the
monitored interfaces are functioning properly and are connected to their
networks. See Link failover (port monitoring or interface monitoring) on
page 1319.
If a monitored interface fails or is disconnected from its network, the interface
leaves the cluster and a link failover occurs. The link failover causes the cluster
to reroute the traffic being processed by that interface to the same interface of
another cluster FortiGate unit that still has a connection to the network. This
other cluster FortiGate unit becomes the new primary unit.
Port monitoring (also called interface monitoring) is disabled by default. Leave
port monitoring disabled until the cluster is operating and then only enable
port monitoring for connected interfaces.
You can monitor up to 64 interfaces.
Fortinet Technologies Inc. Page 1150 FortiOS Handbook - High Availability for FortiOS 5.0
Heartbeat Select to enable or disable HA heartbeat communication for each interface in
Interface the cluster and set the heartbeat interface priority. The heartbeat interface with
the highest priority processes all heartbeat traffic. If two or more heartbeat
interfaces have the same priority, the heartbeat interface with the lowest hash
map order value processes all heartbeat traffic. The web-based manager lists
interfaces in alphanumeric order:
port1
port2 through 9
port10
Hash map order sorts interfaces in the following order:
port1
port10
port2 through port9
The default heartbeat interface configuration is different for each FortiGate
model. This default configuration usually sets the priority of two heartbeat
interfaces to 50. You can accept the default heartbeat interface configuration
or change it as required.
The heartbeat interface priority range is 0 to 512. The default priority when you
select a new heartbeat interface is 0.
You must select at least one heartbeat interface. If heartbeat communication is
interrupted, the cluster stops processing traffic. See HA heartbeat and
communication between cluster units on page 1293.
You can select up to 8 heartbeat interfaces. This limit only applies to units with
more than 8 physical interfaces.
VDOM If you are configuring virtual clustering, you can set the virtual domains to be in
partitioning virtual cluster 1 and the virtual domains to be in virtual cluster 2. The root
virtual domain must always be in virtual cluster 1. See Virtual clusters on
page 1217.
Fortinet Technologies Inc. Page 1151 FortiOS Handbook - High Availability for FortiOS 5.0
Configuring and connecting HA clusters
This chapter contains general procedures and descriptions as well as detailed configuration
examples that describe how to configure FortiGate HA clusters.
The examples in this chapter include example values only. In most cases you will substitute
your own values. The examples in this chapter also do not contain detailed descriptions of
configuration parameters.
This chapter contains the following sections:
About the procedures in this chapter
Example: NAT/Route mode active-passive HA configuration
Example: Transparent mode active-active HA configuration
Example: advanced Transparent mode active-active HA configuration
Example: converting a standalone FortiGate unit to a cluster
Example: adding a new unit to an operating cluster
Example: replacing a failed cluster unit
Example: HA and 802.3ad aggregated interfaces
Example: HA and redundant interfaces
Troubleshooting HA clusters
The procedures in this chapter describe some of many possible sequences of steps for
configuring HA clustering. As you become more experienced with FortiOS HA you may choose
to use a different sequence of configuration steps.
For simplicity, many of these procedures assume that you are starting with new FortiGate units
set to the factory default configuration. However, starting from the default configuration is not a
requirement for a successful HA deployment. FortiGate HA is flexible enough to support a
successful configuration from many different starting points.
This section describes a simple HA network topology that includes an HA cluster of two
FortiGate-620B units in NAT/Route mode installed between an internal network and the
Internet.
Example NAT/Route mode HA network topology
General configuration steps
Configuring a NAT/Route mode active-passive cluster of two FortiGate-620B units -
web-based manager
Configuring a NAT/Route mode active-passive cluster of two FortiGate-620B units - CLI
Page 1152
Example NAT/Route mode HA network topology
Figure 190 shows a typical FortiGate-620B HA cluster consisting of two FortiGate-620B units
(620_ha_1 and 620_ha_2) connected to the same internal (port2) and external (port1) networks.
_2
10
ha
1.
10
0_
.1 2
10 or t
1.
62
P
h
1
itc
14
w
0.
S
2
.1
2. 1
20
1 7 or t
Internal
t3
or
P
P
Network
t4
or
10.11.101.0
h
t3
itc
or
w
P
.2
S
20
t4
10 2
2. ter
.1
or
1. ort
0
20
17 ou
P
10 P
R
1.
.1
10
.1 rt1
_1
20 o
41
.1 P
ha
0_
62
20
2.
17
Port3 and port4 are the default FortiGate-620B heartbeat interfaces. Because the cluster
consists of two FortiGate units, you can make the connections between the heartbeat
interfaces using crossover cables. You could also use switches and regular ethernet cables.
Fortinet Technologies Inc. Page 1153 FortiOS Handbook - High Availability for FortiOS 5.0
Configuring a NAT/Route mode active-passive cluster of two FortiGate-620B
units - web-based manager
Use the following procedures to configure two FortiGate-620B units for NAT/Route HA
operation using the FortiGate web-based manager. These procedures assume you are starting
with two FortiGate-620B units with factory default settings.
Give each cluster unit a unique host name to make the individual units easier to identify when
they are part of a functioning cluster. The default FortiGate unit host name is the FortiGate serial
number. You may want to change this host name to something more meaningful for your
network.
Make sure your FortiGate interfaces are configured with static IP addresses. If any interface
gets its address using DHCP you will not be able to configure HA.
7. Select OK.
8. Go to System > Config > HA and change the following settings:
Mode Active-Passive
Password HA_pass_1
This is the minimum recommended configuration for an active-active HA cluster. You can also
configure other HA options, but if you wait until after the cluster is operating you will only have
to configure these options once for the cluster instead of separately for each unit in the cluster.
9. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
Fortinet Technologies Inc. Page 1154 FortiOS Handbook - High Availability for FortiOS 5.0
addresses on page 1300). The MAC addresses of the FortiGate-620B interfaces change to
the following virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
To confirm these MAC address changes, you can use the get hardware nic (or
diagnose hardware deviceinfo nic) CLI command to view the virtual MAC address
of any FortiGate unit interface. For example, use the following command to view the port1
interface virtual MAC address (MAC) and the port1 permanent MAC address
(Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
10.Power off the first FortiGate unit (620_ha_1).
Fortinet Technologies Inc. Page 1155 FortiOS Handbook - High Availability for FortiOS 5.0
3. Type admin in the Name field and select Login.
The FortiGate dashboard is displayed.
4. On the System Information dashboard widget, beside Host Name select Change.
5. Enter a new Host Name for this FortiGate unit.
6. Select OK.
7. Go to System > Config > HA and change the following settings:
Mode Active-Passive
Password HA_pass_1
8. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and
because the FGCP changes the MAC address of the FortiGate unit interfaces.
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
9. Power off the second FortiGate unit.
Once the cluster is operating, because configuration changes are synchronized to all cluster
units, configuring the cluster is the same as configuring an individual FortiGate unit. You could
have performed the following configuration steps separately on each FortiGate unit before you
connected them to form a cluster.
Fortinet Technologies Inc. Page 1156 FortiOS Handbook - High Availability for FortiOS 5.0
1. Start Internet Explorer and browse to the address https://192.168.1.99 (remember to include
the s in https://).
The FortiGate Login is displayed.
2. Type admin in the Name field and select Login.
The FortiGate dashboard is displayed.
The System Information dashboard widget shows the Cluster Name (example1.com) and the
host names and serial numbers of the Cluster Members. The Unit Operation widget shows
multiple cluster units.
Fortinet Technologies Inc. Page 1157 FortiOS Handbook - High Availability for FortiOS 5.0
5. Select OK.
6. Go to System > Network > Interfaces.
7. Edit the port2 interface and change IP/Netmask to 10.11.101.100/24.
8. Select OK.
After changing the IP address of the port1 interface you may have to change the IP address of
your management computer and then reconnect to the port1 interface using the
172.20.120.141 IP address.
Gateway 172.20.120.2
Device port1
Distance 10
13.Select OK.
Make sure your FortiGate interfaces are configured with static IP addresses. If any interface
gets its address using DHCP you will not be able to configure HA.
Data bits 8
Fortinet Technologies Inc. Page 1158 FortiOS Handbook - High Availability for FortiOS 5.0
Parity None
Stop bits 1
Fortinet Technologies Inc. Page 1159 FortiOS Handbook - High Availability for FortiOS 5.0
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
To confirm these MAC address changes, you can use the get hardware nic (or
diagnose hardware deviceinfo nic) CLI command to view the virtual MAC address
of any FortiGate unit interface. For example, use the following command to view the port1
interface virtual MAC address (MAC) and the port1 permanent MAC address
(Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
10.Display the HA configuration (optional).
get system ha
group-id : 0
group-name : example1.com
mode : a-p
password : *
hbdev : "port3" 50 "port4" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 6
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
Fortinet Technologies Inc. Page 1160 FortiOS Handbook - High Availability for FortiOS 5.0
priority : 128
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
11.Power off the FortiGate unit.
Data bits 8
Parity None
Stop bits 1
Fortinet Technologies Inc. Page 1161 FortiOS Handbook - High Availability for FortiOS 5.0
10.Display the HA configuration (optional).
get system ha
group-id : 0
group-name : example1.com
mode : a-p
password : *
hbdev : "port3" 50 "port4" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 6
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
priority : 128
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
11.Power off the FortiGate unit.
Fortinet Technologies Inc. Page 1162 FortiOS Handbook - High Availability for FortiOS 5.0
5. Power on the cluster units.
The units start and negotiate to choose the primary unit and the subordinate unit. This
negotiation occurs with no user intervention and normally takes less than a minute.
When negotiation is complete the cluster is ready to be configured for your network.
If the command output includes Current HA mode: standalone, the cluster unit is not
operating in HA mode and you should review your HA configuration.
Fortinet Technologies Inc. Page 1163 FortiOS Handbook - High Availability for FortiOS 5.0
1. Log into the primary unit CLI.
2. Add a password for the admin administrative account.
config system admin
edit admin
set password <password_str>
end
3. Configure the port1 and port2 interfaces.
config system interface
edit port1
set ip 172.20.120.141/24
next
edit port2
set ip 10.11.101.100/24
end
4. Add a default route.
config router static
edit 1
set dst 0.0.0.0 0.0.0.0
set gateway 172.20.120.2
set device port1
end
This section describes a simple HA network topology that includes an HA cluster of two
FortiGate-620B units installed between an internal network and the Internet and running in
Transparent mode.
Example Transparent mode HA network topology
General configuration steps
Fortinet Technologies Inc. Page 1164 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 193:Transparent mode HA network topology
_2
ha
0_
62
2
t
or
P
h
itc
w
S
t1
Internal
t3
or
or
P
P
Network
t4
or
10.11.101.0
h
t3
itc
or
w
P
2
1.
t4
10
or
r
1.
t2
te
.1
or
ou
10
.2
P
20
.1
20
2.
Cluster
17
t1
or
_1
M
Management IP
P
ha
0_
10.11.101.100
62
Port3 and port4 are the default FortiGate-620B heartbeat interfaces. Because the cluster
consists of two FortiGate units, you can make the connections between the heartbeat
interfaces using crossover cables. You could also use switches and regular ethernet cables.
Fortinet Technologies Inc. Page 1165 FortiOS Handbook - High Availability for FortiOS 5.0
Configuring a Transparent mode active-active cluster of two FortiGate-620B units
- web-based manager
Use the following procedures to configure the FortiGate-620B units for HA operation using the
FortiGate web-based manager. These procedures assume you are starting with two
FortiGate-620B units with factory default settings.
Waiting until you have established the cluster to switch to Transparent mode means fewer
configuration steps because you can switch the mode of the cluster in one step.
7. Select OK.
8. Go to System > Config > HA and change the following settings:
Mode Active-Active
Password HA_pass_2
This is the minimum recommended configuration for an active-active HA cluster. You can
configure other HA options at this point, but if you wait until the cluster is operating you will only
have to configure these options once for the cluster instead of separately for each cluster unit.
9. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
addresses on page 1300). The MAC addresses of the FortiGate-620B interfaces change to
the following virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
Fortinet Technologies Inc. Page 1166 FortiOS Handbook - High Availability for FortiOS 5.0
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
To confirm these MAC address changes, you can use the get hardware nic (or
diagnose hardware deviceinfo nic) CLI command to view the virtual MAC address
of any FortiGate unit interface. For example, use the following command to view the port1
interface virtual MAC address (MAC) and the port1 permanent MAC address
(Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
10.Power off the first FortiGate unit.
Fortinet Technologies Inc. Page 1167 FortiOS Handbook - High Availability for FortiOS 5.0
5. Enter a new Host Name for this FortiGate unit.
6. Select OK.
7. Go to System > Config > HA and change the following settings:
Mode Active-Active
Password HA_pass_2
8. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and
because the FGCP changes the MAC address of the FortiGate unit interfaces.
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
9. Power off the second FortiGate unit.
Since configuration changes are synchronized to all cluster units, switching the cluster to
operate in Transparent mode once the cluster is operating is the same as switching an
individual FortiGate unit to Transparent mode. You could have performed the following
configuration steps separately on each FortiGate unit before you connected them to form a
cluster.
Fortinet Technologies Inc. Page 1168 FortiOS Handbook - High Availability for FortiOS 5.0
3. Under System Information, beside Operation Mode select Change.
4. Set Operation Mode to Transparent.
5. Configure basic Transparent mode settings.
6. Select Apply.
The cluster switches to operating in Transparent mode. The virtual MAC addresses assigned
to the cluster interfaces do not change.
Once the cluster is operating, because configuration changes are synchronized to all cluster
units, configuring the cluster is the same as configuring an individual FortiGate unit. You could
have performed the following configuration steps separately on each FortiGate unit before you
connected them to form a cluster.
Fortinet Technologies Inc. Page 1169 FortiOS Handbook - High Availability for FortiOS 5.0
5. Select OK.
You added a default gateway when you switched to Transparent mode so you dont need to
add a default route as part of the basic configuration of the cluster at this point.
Data bits 8
Parity None
Stop bits 1
Fortinet Technologies Inc. Page 1170 FortiOS Handbook - High Availability for FortiOS 5.0
9. Configure HA settings.
config system ha
set mode a-a
set group-name example2.com
set password HA_pass_2
end
This is the minimum recommended configuration for an active-active HA cluster. You can also
configure other HA options, but if you wait until after the cluster is operating you will only have
to configure these options once for the cluster instead of separately for each cluster unit.
The FortiGate unit negotiates to establish an HA cluster. You may temporarily lose network
connectivity with the FortiGate unit as the HA cluster negotiates and the FGCP changes the
MAC address of the FortiGate unit interfaces (see Cluster virtual MAC addresses on
page 1300). The MAC addresses of the FortiGate-620B interfaces change to the following
virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
To confirm these MAC address changes, you can use the get hardware nic (or
diagnose hardware deviceinfo nic) CLI command to view the virtual MAC address
of any FortiGate unit interface. For example, use the following command to view the port1
Fortinet Technologies Inc. Page 1171 FortiOS Handbook - High Availability for FortiOS 5.0
interface virtual MAC address (MAC) and the port1 permanent MAC address
(Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
10.Display the HA configuration (optional).
get system ha
group-id : 0
group-name : example2.com
mode : a-a
password : *
hbdev : "port3" 50 "port4" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 6
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
priority : 128
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
11.Power off the FortiGate unit.
Fortinet Technologies Inc. Page 1172 FortiOS Handbook - High Availability for FortiOS 5.0
To configure the second FortiGate-620B unit (host name 620_ha_2)
1. Power on the FortiGate unit.
2. Connect a null modem cable to the communications port of the management computer and
to the FortiGate Console port.
3. Start HyperTerminal, enter a name for the connection, and select OK.
4. Configure HyperTerminal to connect directly to the communications port on the computer to
which you have connected the null modem cable and select OK.
5. Select the following port settings and select OK.
Data bits 8
Parity None
Stop bits 1
Fortinet Technologies Inc. Page 1173 FortiOS Handbook - High Availability for FortiOS 5.0
10.Display the HA configuration (optional).
get system ha
group-id : 0
group-name : example2.com
mode : a-a
password : *
hbdev : "port3" 50 "port4" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 6
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
priority : 128
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
11.Power off the FortiGate unit.
Fortinet Technologies Inc. Page 1174 FortiOS Handbook - High Availability for FortiOS 5.0
5. Power on the cluster units.
The units start and negotiate to choose the primary unit and the subordinate unit. This
negotiation occurs with no user intervention and normally takes less than a minute.
When negotiation is complete the cluster is ready to be configured for your network.
To connect to the cluster CLI and switch the cluster to Transparent mode
1. Determine which cluster unit is the primary unit.
Use the null-modem cable and serial connection to re-connect to the CLI of one of the
cluster units.
Enter the command get system status.
If the command output includes Current HA mode: a-a, master, the cluster units
are operating as a cluster and you have connected to the primary unit. Continue with
Step 2.
If the command output includes Current HA mode: a-a, backup, you have
connected to a subordinate unit. Connect to the other cluster unit, which should be the
primary unit and continue with Step 2.
If the command output includes Current HA mode: standalone, the cluster unit is not
operating in HA mode. See Troubleshooting the initial cluster configuration on page 1213.
Fortinet Technologies Inc. Page 1175 FortiOS Handbook - High Availability for FortiOS 5.0
If the command output includes Current HA mode: a-a, backup, you have
connected to a subordinate unit. Connect the null-modem cable to the other cluster unit,
which should be the primary unit and continue with Step 2.
If the command output includes Current HA mode: standalone, the cluster unit is not
operating in HA mode and you should review your HA configuration.
This section describes a more complex HA network topology that includes an HA cluster of
three FortiGate-5002FA2 units running in Transparent mode and installed between an internal
network and an engineering network.
Example Transparent mode HA network topology
General configuration steps
Fortinet Technologies Inc. Page 1176 FortiOS Handbook - High Availability for FortiOS 5.0
Example Transparent mode HA network topology
Figure 194 shows a Transparent mode FortiGate-5005FA2 HA cluster consisting of three
FortiGate-5005FA2 units (5005_ha_1, 5005_ha_2, and 5005_ha_3) installed in a FortiGate-5000
series chassis with one FortiSwitch-5003A board. The cluster applies virus scanning to traffic
passing between an engineering network and an internal network. The topology includes a
router that performs NAT between the internal network and the engineering network. The cluster
is connected to the engineering network with an management IP address of 10.22.101.20. This
IP address is on the engineering network subnet.
FABRIC
1 2 3 4 5 6
BASE
ACT
LINK CONSOLE
OOS ACC STATUS IPM
port4 base1
FABRIC
1 2 3 4 5 6
BASE
ACT
LINK CONSOLE
port
p
poort1
port1 OOS ACC STATUS IPM
fabric1
Router
10.22.101.1
port4 base1
ACT USB USB 7 8
LINK
FABRIC
1 2 3 4 5 6
BASE
Internal port1
ACT
LINK CONSOLE
OOS ACC STATUS IPM
fabric1
Network 5005_ha_3
10.21.101.0
Engineering
Network
10.22.101.0
By default fabric1 and fabric2 are the FortiGate-5005FA2 heartbeat interfaces. This example
changes the heartbeat configuration to use the base1 and port4 interfaces for the heartbeat.
The base1 connection is handled using the base backplane channel switched by the
FortiSwitch-5003A board. The port4 connection is handled by connecting the port4 interfaces
together using a switch.
The cluster connects to the engineering network using fabric1. The FortiSwitch-5003A board
provides switching for the fabric1 interfaces and the fabric1 connection to the engineering
network.
5. Select OK.
6. Go to System > Network > Interfaces and select Show backplane interfaces.
Fortinet Technologies Inc. Page 1177 FortiOS Handbook - High Availability for FortiOS 5.0
7. Make sure the administrative status and link status is for base1 and fabric1.
You can edit the interface to set the administrative status to up. The link status will be up if
the administrative status is up and the FortiGate-5005FA2 board can connect to the
FortiSwitch-5003A board.
8. Go to System > Config > HA and change the following settings:
Mode Active-Active
Password HA_pass_3
Heartbeat Interface
Enable Priority
base1 Select 50
port4 Select 50
9. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
addresses on page 1300). The MAC addresses of the FortiGate-5005FA2 interfaces change
to the following virtual MAC addresses:
base1 interface virtual MAC: 00-09-0f-09-00-00
base2 interface virtual MAC: 00-09-0f-09-00-01
fabric1 interface virtual MAC: 00-09-0f-09-00-02
fabric2 interface virtual MAC: 00-09-0f-09-00-03
port1 interface virtual MAC: 00-09-0f-09-00-04
port2 interface virtual MAC: 00-09-0f-09-00-05
port3 interface virtual MAC: 00-09-0f-09-00-06
port4 interface virtual MAC: 00-09-0f-09-00-07
port5 interface virtual MAC: 00-09-0f-09-00-08
port6 interface virtual MAC: 00-09-0f-09-00-09
port7 interface virtual MAC: 00-09-0f-09-00-0a
port8 interface virtual MAC: 00-09-0f-09-00-0b
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
Fortinet Technologies Inc. Page 1178 FortiOS Handbook - High Availability for FortiOS 5.0
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
Current_HWaddr 00:09:0f:09:00:04
Permanent_HWaddr 00:09:0f:71:0a:dc
.
.
.
10.Power off the first FortiGate unit.
11.Repeat these steps for the second and third FortiGate units, with the following difference.
Set the second FortiGate unit host name to:
As you insert and configure each FortiGate unit, they will negotiate and join the cluster using
the base1 interface for HA heartbeat communication.
5. Select Apply.
The cluster switches to operating in Transparent mode. The virtual MAC addresses assigned
to the cluster interfaces do not change. You must login again using the new TP address.
Fortinet Technologies Inc. Page 1179 FortiOS Handbook - High Availability for FortiOS 5.0
To view cluster status
Use the following steps to view the cluster dashboard and cluster members list to confirm that
the cluster units are operating as a cluster.
1. View the system dashboard.
The System Information dashboard widget shows the Cluster Name (example3.com) and the
host names and serial numbers of the Cluster Members. The Unit Operation widget shows
multiple cluster units.
2. Go to System > Config > HA to view the cluster members list.
The list shows three cluster units, their host names, their roles in the cluster, and their
priorities. You can use this list to confirm that the cluster is operating normally.
Fortinet Technologies Inc. Page 1180 FortiOS Handbook - High Availability for FortiOS 5.0
5. Make sure the administrative status and link status is up for base1 and fabric1.
Enter get system interface to view the status of these interfaces.
You can use the following commands to set the administrative status to up for these
interfaces.
config system interface
edit base1
set status up
next
edit fabricq
set status up
end
6. Configure HA settings.
config system ha
set mode a-a
set group-name example3.com
set password HA_pass_3
set hbdev base1 50 port4 50
end
This is the minimum recommended configuration for an active-active HA cluster. You can also
configure other HA options, but if you wait until after the cluster is operating you will only have
to configure these options once for the cluster instead of separately for each cluster unit.
The FortiGate unit negotiates to establish an HA cluster. You may temporarily lose
connectivity with the FortiGate unit as the HA cluster negotiates and the FGCP changes the
MAC address of the FortiGate unit interfaces (see Cluster virtual MAC addresses on
page 1300). The MAC addresses of the FortiGate-620B interfaces change to the following
virtual MAC addresses:
base1 interface virtual MAC: 00-09-0f-09-00-00
base2 interface virtual MAC: 00-09-0f-09-00-01
fabric1 interface virtual MAC: 00-09-0f-09-00-02
fabric2 interface virtual MAC: 00-09-0f-09-00-03
port1 interface virtual MAC: 00-09-0f-09-00-04
port2 interface virtual MAC: 00-09-0f-09-00-05
port3 interface virtual MAC: 00-09-0f-09-00-06
port4 interface virtual MAC: 00-09-0f-09-00-07
port5 interface virtual MAC: 00-09-0f-09-00-08
port6 interface virtual MAC: 00-09-0f-09-00-09
port7 interface virtual MAC: 00-09-0f-09-00-0a
port8 interface virtual MAC: 00-09-0f-09-00-0b
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
Fortinet Technologies Inc. Page 1181 FortiOS Handbook - High Availability for FortiOS 5.0
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
Current_HWaddr 00:09:0f:09:00:04
Permanent_HWaddr 00:09:0f:71:0a:dc
.
.
.
7. Display the HA configuration (optional).
get system ha
group-id : 0
group-name : example3.com
mode : a-a
password : *
hbdev : "base1" 50 "port4" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 20
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
priority : 128
schedule : round-robin
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
load-balance-all : disable
Fortinet Technologies Inc. Page 1182 FortiOS Handbook - High Availability for FortiOS 5.0
8. Repeat these steps for the second and third FortiGate units.
Set the second FortiGate unit host name to:
config system global
set hostname 5005_ha_2
end
Set the third FortiGate unit host name to:
config system global
set hostname 5005_ha_3
end
As you insert and configure each FortiGate unit they will negotiate and join the cluster using
the base1 interface for HA heartbeat communication.
Current HA mode: a-a, master The cluster units are operating as a cluster and
you have connected to the primary unit.
Current HA mode: a-a, backup The cluster units are operating as a cluster and
you have connected to a subordinate unit.
Fortinet Technologies Inc. Page 1183 FortiOS Handbook - High Availability for FortiOS 5.0
3. Enter the following command to confirm the HA configuration of the cluster:
get system ha status
Model: 5005
Mode: a-a
Group: 0
Debug: 0
ses_pickup: disable
load_balance: disable
schedule: round robin
Master:128 5005_ha_1 FG5A253E07600124 0
Slave :128 5005_ha_2 FG5A253E06500088 1
Slave :128 5005_ha_3 FG5A253E06500099 2
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master:0 FG5A253E07600124
Slave :1 FG5A253E06500088
Slave :2 FG5A253E06500099
The command output shows both cluster units, their host names, their roles in the cluster,
and their priorities. You can use this command to confirm that the cluster is operating
normally. For example, if the command shows only one cluster unit then the other unit has
left the cluster for some reason.
You can convert an already configured and installed FortiGate unit into a cluster by configuring
this FortiGate unit to be a primary unit and then adding subordinate units.
General configuration steps:
Configure the original FortiGate unit for HA operation.
Set the HA Device Priority of the original FortiGate unit to 255 to make sure that this
FortiGate unit becomes the primary unit after cluster negotiation and synchronization.
Back up the configuration of the original FortiGate unit.
Configure one or more new FortiGate units with the same HA configuration as the original
FortiGate unit with one exception. Keep the Unit Priority at the default setting, which is 128.
Connect the FortiGate units to form a cluster and connect the cluster to your network.
When you power on all of the FortiGate units in the cluster, the original FortiGate unit becomes
the primary unit. Its configuration is synchronized to all of the subordinate units. The entire
Fortinet Technologies Inc. Page 1184 FortiOS Handbook - High Availability for FortiOS 5.0
cluster now operates with the original FortiGate unit configuration. No further configuration
changes are required.
The new FortiGate units must:
Have the same hardware configuration as the original FortiGate unit. Including the same
hard disk configuration and the same AMC cards installed in the same slots.
Have the same firmware build as the original FortiGate unit.
Be set to the same operating mode (NAT or Transparent) as the original FortiGate unit.
Be operating in single VDOM mode.
In addition to one or more new FortiGate units, you need sufficient switches to connect all of the
FortiGate interfaces in the cluster. Generally you will need one switch per interface, as it will
have to connect that same interface on all cluster units. That is, all port1 interfaces use the
port1 switch, port2 interfaces use the port2 switch, and so on. Intelligent switches that can be
partitioned can reduce your switch requirements.
Converting a FortiGate unit to a primary unit and adding in the subordinate unit or units results
in a brief service interruption as you disconnect and reconnect FortiGate interfaces and as the
cluster negotiates. Therefore, conversion should only be done during off peak hours.
Make sure your FortiGate interfaces are configured with static IP addresses. If any interface
gets its address using DHCP you will not be able to configure HA.
Mode Active-Active
Password HA_pass_4
You can make other HA configuration changes after the cluster is operating.
4. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and
because the FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster
virtual MAC addresses on page 1300).
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
Fortinet Technologies Inc. Page 1185 FortiOS Handbook - High Availability for FortiOS 5.0
5. Configure the new FortiGate units with the same HA configuration as the original FortiGate
unit. The one exception is to keep the device priorities of the new FortiGate units at 128 to
ensure the original FortiGate unit will become the primary unit in the new cluster.
Mode Active-Active
Password HA_pass_4
6. Configure the other FortiGate units to the same operation mode as the original FortiGate
unit.
There is no need to make any other configuration changes (including network configuration
changes) to the other FortiGate units.
7. Optionally power off all of the cluster units.
If you dont power off all of the units they may not negotiate to form a cluster when they are
connected together.
8. Connect the cluster to your network.
For example, for a configuration similar to the FortiGate-620B cluster configuration
described in this chapter, see To connect the cluster to the network on page 1156.
9. Power on all of the cluster units.
As the units start they change their MAC addresses and then negotiate to choose the
primary unit and the subordinate units. This negotiation occurs with no user intervention and
normally takes less than a minute.
The original the FortiGate unit becomes the primary unit because the device priority of the
original FortiGate unit is higher than the device priority of the other FortiGate units. The
configuration of the original FortiGate unit is synchronized to all the cluster units. As a result,
the cluster is quickly up and running and configured for your network. No further
configuration changes are required.
This procedure describes how to add a new FortiGate unit to a functioning cluster. Adding a
new unit to a cluster does not interrupt the operation of the cluster unless you have to change
how the cluster is connected to the network to accommodate the new cluster unit.
You can use this procedure to add as many units as required to the cluster.
Fortinet Technologies Inc. Page 1186 FortiOS Handbook - High Availability for FortiOS 5.0
6. Power on the new cluster unit.
When the unit starts it negotiates to join the cluster. After it joins the cluster, the cluster
synchronizes the new unit configuration with the configuration of the primary unit.
You can add a new unit to a functioning cluster at any time. The new cluster unit must:
Have the same hardware configuration as the cluster units. Including the same hard disk
configuration and the same AMC cards installed in the same slots.
Have the same firmware build as the cluster.
Be set to the same operating mode (NAT or Transparent) as the cluster.
Be operating in single VDOM mode.
This procedure describes how to remove a failed cluster unit from a cluster and add a new one
to replace it. You can also use this procedure to remove a failed unit from a cluster, repair it and
add it back to the cluster. Replacing a failed does not interrupt the operation of the cluster
unless you have to change how the cluster is connected to the network to accommodate the
replacement unit.
You can use this procedure to replace more than one cluster unit.
Fortinet Technologies Inc. Page 1187 FortiOS Handbook - High Availability for FortiOS 5.0
Example: HA and 802.3ad aggregated interfaces
On FortiGate models that support it you can use 802.3ad link aggregation to combine two or
more interfaces into a single aggregated interface. 802.3ad Link Aggregation and it's
management protocol, Link Aggregation Control Protocol (LACP) are a method for combining
multiple physical links into a single logical link.This increases both potential throughput and
network resiliency. Using LACP, traffic is distributed among the physical interfaces in the link,
potentially resulting in increased performance.
This example describes how to configure an HA cluster consisting of two FortiGate-620B units
with two aggregated 1000 Mb connections to the Internet using port1 and port2 and two
aggregated 1000 Mb connections to the internal network using port3 and port4. The
aggregated interfaces are also configured as HA monitored interfaces.
Each of the aggregate links connects to a different switch. Each switch is configured for link
aggregation (2x1000Mb).
.1 3 a ate b
10 ort eg 0 M
0 4
10 d of
10 rt
1. Po
P g 00
A x1
_2
1. n
ha
r
2
g
0_
62
h
itc
2. 1 a ate b
17 ort eg 0 M
w
.1 rt2
.1 d P f
20 n o
S
20 o
41
P gg 00
A x1
Internal
t5
or
r
2
P
Network
t6
or
10.11.101.0
P
h
t5
itc
or
1. d te b
w
.1 an ga M
.2
S
1. ort f
10 P o
20
10 t3 re 00
t6
10 4
2. ter
.1
g 0
or
or g 1
20
17 ou
0
P
P A x
R
2
.1 d P te b
_1
20 n a M
ha
20 o of
2. 1 a reg 0
17 t g 00
0_
.1 rt2
or g 1
62
41
P A x
2
Fortinet Technologies Inc. Page 1188 FortiOS Handbook - High Availability for FortiOS 5.0
Link aggregation, HA failover performance, and HA mode
To operate an active-active or active-passive cluster with aggregated interfaces and for best
performance of a cluster with aggregated interfaces, the switches used to connect the cluster
unit aggregated interfaces together should support configuring multiple Link Aggregation (LAG)
groups.
For example, the cluster shown in Figure 195 should be configured into two LAG groups on the
external switch: one for the port1 and port2 aggregated interface of 620_ha_1 and a second
one for the port1 and port2 aggregate interface of 620_ha_2. You should also be able to do the
same on the internal switch for the port3 and port4 aggregated interfaces of each cluster unit.
As a result, the subordinate unit aggregated interfaces would participate in LACP negotiation
while the cluster is operating. In an active-active mode cluster, packets could be redirected to
the subordinate unit interfaces. As well, in active-active or active-passive mode, after a failover
the subordinate unit can become a primary unit without having to perform LACP negotiation
before it can process traffic. Performing LACP negotiation causes a minor failover delay.
However if you cannot configure multiple LAG groups on the switches, due to the primary and
subordinate unit interfaces having the same MAC address, the switch will put all of the
interfaces into the same LAG group which would disrupt the functioning of the cluster. To
prevent this from happening, you must change the FortiGate aggregated interface configuration
to prevent subordinate units from participating in LACP negotiation.
For example, use the following command to prevent subordinate units from participating in
LACP negotiation with an aggregate interface named Port1_Port2:
config system interface
edit Port1_Port2
set lacp-ha-slave disable
end
As a result of this setting, subordinate unit aggregated interfaces cannot accept packets. This
means that you cannot operate the cluster in active-active mode because in active-active mode
the subordinate units must be able to receive and process packets. Also, failover may take
longer because after a failover the subordinate unit has to perform LACP negotiation before
being able to process network traffic.
Also, it may also be necessary to configure the switch to use Passive or even Static mode for
LACP to prevent the switch from sending packets to the subordinate unit interfaces, which
wont be able to process them.
Finally, in some cases depending on the LACP configuration of the switches, you may
experience delayed failover if the FortiGate LACP configuration is not compatible with the
switch LACP configuration. For example, in some cases setting the FortiGate LACP mode to
static reduces the failover delay because the FortiGate unit does not perform LACP negotiation.
However there is a potential problem with this configuration because static LACP does not send
periodic LAC Protocol Data Unit (LACPDU) packets to test the connections. So a non-physical
failure (for example, if a device is not responding because its too busy) may not be detected and
packets could be lost or delayed.
Fortinet Technologies Inc. Page 1189 FortiOS Handbook - High Availability for FortiOS 5.0
Change each units host name.
Configure HA.
2. Connect the cluster to the network.
3. View cluster status.
4. Add basic configuration settings and configure the aggregated interfaces.
Add a password for the admin administrative account.
Add the aggregated interfaces.
Disable lacp-ha-slave so that the subordinate unit does not send LACP packets.
Add a default route.
You could also configure aggregated interfaces in each FortiGate unit before the units form a
cluster.
5. Configure HA port monitoring for the aggregated interfaces.
4. Select OK.
5. Go to System > Config > HA and change the following settings.
Mode Active-Passive
Password HA_pass_5
Heartbeat Interface
Enable Priority
port5 Select 50
port6 Select 50
Since port3 and port4 will be used for a aggregated interface, you must change the HA
heartbeat configuration to not use those interfaces.
6. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
addresses on page 1300). The MAC addresses of the FortiGate-620B interfaces change to
the following virtual MAC addresses:
Fortinet Technologies Inc. Page 1190 FortiOS Handbook - High Availability for FortiOS 5.0
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
7. Power off the first FortiGate unit.
8. Repeat these steps for the second FortiGate unit.
Set the second FortiGate unit host name to:
Fortinet Technologies Inc. Page 1191 FortiOS Handbook - High Availability for FortiOS 5.0
To connect the cluster to the network
1. Connect the port1 and port2 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to
the Internet.
Configure the switch so that the port1 and port2 of 620_ha_1 make up an aggregated
interface and port1 and port2 of 620_ha_2 make up a second aggregated interface.
2. Connect the port3 and port4 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to
the internal network.
Configure the switch so that the port3 and port4 of 620_ha_1 make up an aggregated
interface and port3 and port4 of 620_ha_2 make up another aggregated interface.
3. Connect the port5 interfaces of 620_ha_1 and 620_ha_2 together. You can use a crossover
Ethernet cable or regular Ethernet cables and a switch.
4. Connect the port5 interfaces of the cluster units together. You can use a crossover Ethernet
cable or regular Ethernet cables and a switch.
5. Power on the cluster units.
The units negotiate to choose the primary unit and the subordinate unit. This negotiation
occurs with no user intervention and normally takes less than a minute.
When negotiation is complete, the cluster is ready to be configured for your network.
Fortinet Technologies Inc. Page 1192 FortiOS Handbook - High Availability for FortiOS 5.0
8. Set Type to 802.3ad Aggregate and configure the aggregate interface to be connected to the
Internet:
Name Port1_Port2
IP/Netmask 172.20.120.141/24
9. Select OK.
10.Select Create New to add the aggregate interface to connect to the internal network.
11.Set Type to 802.3ad Aggregate and configure the aggregate interface to be connected to the
Internet:
Name Port3_Port4
IP/Netmask 10.11.101.100/24
12.Select OK.
The virtual MAC addresses of the FortiGate-620B interfaces change to the following. Note
that port1 and port2 both have the port1 virtual MAC address and port3 and port4 both have
the port3 virtual MAC address:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-00 (same as port1)
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0d (same as port3)
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
Fortinet Technologies Inc. Page 1193 FortiOS Handbook - High Availability for FortiOS 5.0
port9 interface virtual MAC: 00-09-0f-09-00-13
13.Connect to the CLI and enter the following command to disable sending LACP packets from
the subordinate unit:
config system interface
edit Port1_Port2
set lacp-ha-slave disable
next
edit Port3_Port4
set lacp-ha-slave disable
end
14.Go to Router > Static > Static Routes.
15.Add the default route.
Gateway 172.20.120.2
Device Port1_Port2
Distance 10
16.Select OK.
Port Monitor
Port1_Port2 Select
Port3_Port4 Select
4. Select OK.
Fortinet Technologies Inc. Page 1194 FortiOS Handbook - High Availability for FortiOS 5.0
3. Configure HA settings.
config system ha
set mode a-p
set group-name example5.com
set password HA_pass_5
set hbdev port5 50 port6 50
end
Since port3 and port4 will be used for an aggregated interface, you must change the HA
heartbeat configuration.
The FortiGate unit negotiates to establish an HA cluster. You may temporarily lose
connectivity with the FortiGate unit as the HA cluster negotiates and the FGCP changes the
MAC address of the FortiGate unit interfaces (see Cluster virtual MAC addresses on
page 1300). The MAC addresses of the FortiGate-620B interfaces change to the following
virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
Fortinet Technologies Inc. Page 1195 FortiOS Handbook - High Availability for FortiOS 5.0
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
4. Display the HA configuration (optional).
get system ha
group-id : 0
group-name : example5.com
mode : a-p
password : *
hbdev : "port5" 50 "port6" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 20
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
priority : 128
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
Fortinet Technologies Inc. Page 1196 FortiOS Handbook - High Availability for FortiOS 5.0
5. Repeat these steps for the other FortiGate unit.
Set the other FortiGate unit host name to:
config system global
set hostname 620_ha_2
end
Current HA mode: a-a, master The cluster units are operating as a cluster and
you have connected to the primary unit.
Current HA mode: a-a, backup The cluster units are operating as a cluster and
you have connected to a subordinate unit.
Fortinet Technologies Inc. Page 1197 FortiOS Handbook - High Availability for FortiOS 5.0
3. Enter the following command to confirm the HA configuration of the cluster:
get system ha status
Model: 620
Mode: a-a
Group: 0
Debug: 0
ses_pickup: disable
Master:128 620_ha_2 FG600B3908600825 0
Slave :128 620_ha_1 FG600B3908600705 1
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master:0 FG600B3908600825
Slave :1 FG600B3908600705
The command output shows both cluster units, their host names, their roles in the cluster,
and their priorities. You can use this command to confirm that the cluster is operating
normally. For example, if the command shows only one cluster unit then the other unit has
left the cluster for some reason.
Fortinet Technologies Inc. Page 1198 FortiOS Handbook - High Availability for FortiOS 5.0
3. Add the aggregate interfaces:
config system interface
edit Port1_Port2
set type aggregate
set lacp-ha-slave disable
set member port1 port2
set ip 172.20.120.141/24
set vdom root
next
edit Port3_Port4
set type aggregate
set lacp-ha-slave disable
set member port3 port4
set ip 10.11.101.100/24
set vdom root
end
The virtual MAC addresses of the FortiGate-620B interfaces change to the following. Note
that port1 and port2 both have the port1 virtual MAC address and port3 and port4 both have
the port3 virtual MAC address:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-00 (same as port1)
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0d (same as port3)
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
4. Add the default route.
config router static
edit 1
set dst 0.0.0.0 0.0.0.0
set gateway 172.20.120.2
set device Port1_Port2
end
Fortinet Technologies Inc. Page 1199 FortiOS Handbook - High Availability for FortiOS 5.0
To configure HA port monitoring for the aggregate interfaces
1. Configure HA port monitoring for the aggregate interfaces.
config system ha
set monitor Port1_Port2 Port3_Port4
end
On FortiGate models that support it you can combine two or more interfaces into a single
redundant interface. A redundant interface consists of two or more physical interfaces. Traffic is
processed by the first physical interface in the redundant interface. If that physical interface
fails, traffic fails over to the next physical interface. Redundant interfaces dont have the benefit
of improved performance that aggregate interfaces can have, but they do provide failover if a
physical interface fails or is disconnected.
0 4 c e
10 rt fa
1. Po ter
10 d in
1. n t
.1 3 a an
10 ort und
_2
ha
P ed
0_
R
62
e
.1 rt2 fac
20 o er
.1 d P int
h
itc
20 n t
2. 1 a an
41
w
17 ort und
S
P ed
Internal
t5
R
or
P
Network t6
or
10.11.101.0
P
t5
h
itc
or
P
.2
S
1. ort e
20
10 P c
t6
1 . d rfa
10 4
2. ter
.1
or
.1 an te
20
17 ou
0
P
10 t3 t in
R
or n
P da
un
ed
R
20 o e
.1 d P fac
_1
.1 rt2
ha
20 n er
41
2. 1 a int
0_
62
17 rt nt
P da
un
o
ed
R
This example describes how to configure an HA cluster consisting of two FortiGate-620B units
with a a redundant interface connection to the Internet and to an internal network. The
connection to the Internet uses port1 and port2. The connection to the internal network uses
port3 and port4. The HA heartbeat uses port5 and port6.
The redundant interfaces are also configured as HA monitored interfaces.
Fortinet Technologies Inc. Page 1200 FortiOS Handbook - High Availability for FortiOS 5.0
HA MAC addresses and redundant interfaces
For a standalone FortiGate unit a redundant interface has the MAC address of the first physical
interface added to the redundant interface configuration. A redundant interface consisting of
port1 and port2 would have the MAC address of port1.
In an HA cluster, HA changes the MAC addresses of the cluster interfaces to virtual MAC
addresses. A redundant interface in a cluster acquires the virtual MAC address that would have
been acquired by the first physical interface added to the redundant interface configuration.
Fortinet Technologies Inc. Page 1201 FortiOS Handbook - High Availability for FortiOS 5.0
Add a default route.
You could also configure redundant interfaces in each FortiGate unit before they form a
cluster.
5. Configure HA port monitoring for the redundant interfaces.
4. Select OK.
5. Go to System > Config > HA and change the following settings.
Mode Active-Passive
Password HA_pass_6
Heartbeat Interface
Enable Priority
port5 Select 50
port6 Select 50
Since port3 and port4 will be used for a redundant interface, you must change the HA
heartbeat configuration.
6. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
addresses on page 1300). The MAC addresses of the FortiGate-620B interfaces change to
the following virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
Fortinet Technologies Inc. Page 1202 FortiOS Handbook - High Availability for FortiOS 5.0
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
7. Power off the first FortiGate unit.
8. Repeat these steps for the second FortiGate unit.
Set the second FortiGate unit host name to:
Fortinet Technologies Inc. Page 1203 FortiOS Handbook - High Availability for FortiOS 5.0
4. Connect the port5 interfaces of the cluster units together. You can use a crossover Ethernet
cable or regular Ethernet cables and a switch.
5. Power on the cluster units.
The units start and negotiate to choose the primary unit and the subordinate unit. This
negotiation occurs with no user intervention and normally takes less than a minute.
When negotiation is complete the cluster is ready to be configured for your network.
Name Port1_Port2
IP/Netmask 172.20.120.141/24
9. Select OK.
10.Select Create New to add the redundant interface to connect to the internal network.
Fortinet Technologies Inc. Page 1204 FortiOS Handbook - High Availability for FortiOS 5.0
11.Set Type to Redundant Interface and configure the redundant interface to be connected to
the Internet:
Name Port3_Port4
IP/Netmask 10.11.101.100/24
12.Select OK.
The virtual MAC addresses of the FortiGate-620B interfaces change to the following. Note
that port1 and port2 both have the port1 virtual MAC address and port3 and port4 both have
the port3 virtual MAC address:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-00 (same as port1)
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0d (same as port3)
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
13.Go to Router > Static > Static Routes.
14.Add the default route.
Gateway 172.20.120.2
Device Port1_Port2
Distance 10
15.Select OK.
Fortinet Technologies Inc. Page 1205 FortiOS Handbook - High Availability for FortiOS 5.0
To configure HA port monitoring for the redundant interfaces
1. Go to System > Config > HA.
2. In the cluster members list, edit the primary unit.
3. Configure the following port monitoring for the redundant interfaces:
Port Monitor
Port1_Port2 Select
Port3_Port4 Select
4. Select OK.
Fortinet Technologies Inc. Page 1206 FortiOS Handbook - High Availability for FortiOS 5.0
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To reconnect sooner, you can update the ARP table of your management PC by deleting the
ARP table entry for the FortiGate unit (or just deleting all arp table entries). You may be able
to delete the arp table of your management PC from a command prompt using a command
similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
Fortinet Technologies Inc. Page 1207 FortiOS Handbook - High Availability for FortiOS 5.0
4. Display the HA configuration (optional).
get system ha
group-id : 0
group-name : example6.com
mode : a-p
password : *
hbdev : "port5" 50 "port6" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 20
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
priority : 128
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
5. Repeat these steps for the other FortiGate unit.
Set the other FortiGate unit host name to:
config system global
set hostname 620_ha_2
end
Fortinet Technologies Inc. Page 1208 FortiOS Handbook - High Availability for FortiOS 5.0
2. Connect the port3 and port4 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to
the internal network.
Configure the switch so that the port3 and port4 of 620_ha_1 make up a redundant interface
and port3 and port4 of 620_ha_2 make up another redundant interface.
3. Connect the port5 interfaces of 620_ha_1 and 620_ha_2 together. You can use a crossover
Ethernet cable or regular Ethernet cables and a switch.
4. Connect the port5 interfaces of the cluster units together. You can use a crossover Ethernet
cable or regular Ethernet cables and a switch.
5. Power on the cluster units.
The units start and negotiate to choose the primary unit and the subordinate unit. This
negotiation occurs with no user intervention and normally takes less than a minute.
When negotiation is complete the cluster is ready to be configured for your network.
Current HA mode: a-a, master The cluster units are operating as a cluster and
you have connected to the primary unit.
Current HA mode: a-a, backup The cluster units are operating as a cluster and
you have connected to a subordinate unit.
Fortinet Technologies Inc. Page 1209 FortiOS Handbook - High Availability for FortiOS 5.0
To add basic configuration settings and the redundant interfaces
Use the following steps to add a few basic configuration settings and the redundant interfaces.
1. Add a password for the admin administrative account.
config system admin
edit admin
set password <psswrd>
end
2. Temporarily delete the default route.
You cannot add an interface to a redundant interface if any settings (such as the default
route) are configured for it. In this example the index of the default route is 1.
config router static
delete 1
end
Fortinet Technologies Inc. Page 1210 FortiOS Handbook - High Availability for FortiOS 5.0
3. Add the redundant interfaces:
config system interface
edit Port1_Port2
set type redundant
set member port1 port2
set ip 172.20.120.141/24
set vdom root
next
edit Port3_Port4
set type redundant
set member port3 port4
set ip 10.11.101.100/24
set vdom root
end
The virtual MAC addresses of the FortiGate-620B interfaces change to the following. Note
that port1 and port2 both have the port1 virtual MAC address and port3 and port4 both have
the port3 virtual MAC address:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-00 (same as port1)
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0d (same as port3)
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
4. Add the default route.
config router static
edit 1
set dst 0.0.0.0 0.0.0.0
set gateway 172.20.120.2
set device Port1_Port2
end
Fortinet Technologies Inc. Page 1211 FortiOS Handbook - High Availability for FortiOS 5.0
To configure HA port monitoring for the redundant interfaces
1. Configure HA port monitoring for the redundant interfaces.
config system ha
set monitor Port1_Port2 Port3_Port4
end
Troubleshooting HA clusters
In some cases you may be able to form a cluster if different FortiGate units have different
firmware builds, different VDOM configurations, and are in different operating modes. However,
if you encounter problems they may be resolved by installing the same firmware build on each
unit, and give them the same VDOM configuration and operating mode.
Fortinet Technologies Inc. Page 1212 FortiOS Handbook - High Availability for FortiOS 5.0
Troubleshooting the initial cluster configuration
This section describes how to check a cluster when it first starts up to make sure that it is
configured and operating correctly. This section assumes you have already configured your HA
cluster.
Fortinet Technologies Inc. Page 1213 FortiOS Handbook - High Availability for FortiOS 5.0
To verify the cluster configuration - CLI
1. Log into each cluster unit CLI.
You can use the console connection if you need to avoid the problem of units having the
same IP address.
2. Enter the command get system status.
Look for the following information in the command output.
Current HA mode: a-a, master The cluster units are operating as a cluster and
you have connected to the primary unit.
Current HA mode: a-a, backup The cluster units are operating as a cluster and
you have connected to a subordinate unit.
3. Verify that the get system ha status command displays all of the cluster units.
4. Enter the get system ha command to verify that the HA configuration is correct and the
same for each cluster unit.
Fortinet Technologies Inc. Page 1214 FortiOS Handbook - High Availability for FortiOS 5.0
More troubleshooting information
Much of the information in this HA guide can be useful for troubleshooting HA clusters. Here are
some links to sections with more information.
If sessions are lost after a failover you may need to change route-ttl to keep synchronized
routes active longer. See Change how long routes stay in a cluster unit routing table on
page 1317.
To control which cluster unit becomes the primary unit, you can change the device priority
and enable override. See Controlling primary unit selection using device priority and
override on page 1140.
Changes made to a cluster can be lost if override is enabled. See Configuration changes
can be lost if override is enabled on page 1141.
In some cases, age differences among cluster units result in the wrong cluster unit becoming
the primary unit. For example, if a cluster unit set to a high priority reboots, that unit will have
a lower age than other cluster units. You can resolve this problem by resetting the age of one
or more cluster units. See Resetting the age of all cluster units on page 1135. You can also
adjust how sensitive the cluster is to age differences. This can be useful if large age
differences cause problems. See Cluster age difference margin (grace period) on
page 1133 and Changing the cluster age difference margin on page 1133
If one of the cluster units needs to be serviced or removed from the cluster for other reasons,
you can do so without affecting the operation of the cluster. See Disconnecting a cluster
unit from a cluster on page 1285.
The web-based manager and CLI will not allow you to configure HA if:
You have configured a FortiGate interface to get its IP address using DHCP or PPPoE. See
FortiGate HA compatibility with PPPoE and DHCP on page 1142.
You have enabled VRRP. See VRRP on page 1364.
You have enabled TCP session synchronization. See FortiGate Session Life Support
Protocol (FGSP) on page 1370.
Some third-party network equipment may prevent HA heartbeat communication, resulting in
a failure of the cluster or the creation of a split brain scenario. For example, some switches
use packets with the same Ethertype as HA heartbeat packets use for internal functions and
when used for HA heartbeat communication the switch generates CRC errors and the
packets are not forwarded. See Heartbeat packet Ethertypes on page 1297.
Very busy clusters may not be able to send HA heartbeat packets quickly enough, also
resulting in a split brain scenario. You may be able to resolve this problem by modifying HA
heartbeat timing. See Modifying heartbeat timing on page 1298.
Very busy clusters may suffer performance reductions if session pickup is enabled. If
possible you can disable this feature to improve performance. If you require session pickup
for your cluster, several options are available for improving session pickup performance. See
Improving session synchronization performance on page 1331.
If it takes longer than expected for a cluster to failover you can try changing how the primary
unit sends gratuitous ARP packets. See Changing how the primary unit sends gratuitous
ARP packets after a failover on page 1301.
You can also improve failover times by configuring the cluster for subsecond failover. See
Subsecond failover on page 1324 and Failover performance on page 1340.
When you first put a FortiGate unit in HA mode you may loose connectivity to the unit. This
occurs because HA changes the MAC addresses of all FortiGate unit interfaces, including
the one that you are connecting to. The cluster MAC addresses also change if you change
the some HA settings such as the cluster group ID. The connection will be restored in a short
time as your network and PC updates to the new MAC address. To reconnect sooner, you
can update the ARP table of your management PC by deleting the ARP table entry for the
Fortinet Technologies Inc. Page 1215 FortiOS Handbook - High Availability for FortiOS 5.0
FortiGate unit (or just deleting all arp table entries). You may be able to delete the arp table of
your management PC from a command prompt using a command similar to arp -d.
Since HA changes all cluster unit MAC addresses, if your network uses MAC address
filtering you may have to make configuration changes to account for the HA MAC addresses.
A network may experience packet loss when two FortiGate HA clusters have been deployed
in the same broadcast domain. Deploying two HA clusters in the same broadcast domain
can result in packet loss because of MAC address conflicts. The packet loss can be
diagnosed by pinging from one cluster to the other or by pinging both of the clusters from a
device within the broadcast domain. You can resolve the MAC address conflict by changing
the HA Group ID configuration of the two clusters. The HA Group ID is sometimes also called
the Cluster ID. See Diagnosing packet loss with two FortiGate HA clusters in the same
broadcast domain on page 1305.
The cluster CLI displays slave is not in sync messages if there is a synchronization
problem between the primary unit and one or more subordinate units. See How to diagnose
HA out of sync messages on page 1313.
If you have configured dynamic routing and the new primary unit takes too long to update its
routing table after a failover you can configure graceful restart and also optimize how routing
updates are synchronized. See Configuring graceful restart for dynamic routing failover on
page 1315 and Controlling how the FGCP synchronizes kernel routing table updates on
page 1316.
Some switches may not be able to detect that the primary unit has become a subordinate
unit and will keep sending packets to the former primary unit. This can occur after a link
failover if the switch does not detect the failure and does not clear its MAC forwarding table.
See Updating MAC forwarding tables when a link failover occurs on page 1323.
If a link not directly connected to a cluster unit (for example, between a switch connected to
a cluster interface and the network) fails you can enable remote link failover to maintain
communication. See Remote link failover on page 1325.
If you find that some cluster units are not running the same firmware build you can reinstall
the correct firmware build on the cluster to upgrade all cluster units to the same firmware
build. See Synchronizing the firmware build running on a new cluster unit on page 1275.
Fortinet Technologies Inc. Page 1216 FortiOS Handbook - High Availability for FortiOS 5.0
Virtual clusters
This chapter provides an introduction to virtual clustering and also contains general procedures
and configuration examples that describe how to configure FortiGate HA virtual clustering.
This chapter contains the following sections:
Virtual clustering overview
Configuring HA for virtual clustering
Example: virtual clustering with two VDOMs and VDOM partitioning
Example: inter-VDOM links in a virtual clustering configuration
Troubleshooting virtual clustering
Virtual clustering is an extension of the FGCP for a cluster of 2 FortiGate units operating with
multiple VDOMS enabled. Virtual clustering operates in active-passive mode to provide failover
protection between two instances of a VDOM operating on two different cluster units. You can
also operate virtual clustering in active-active mode to use HA load balancing to load balance
sessions between cluster units. Alternatively, by distributing VDOM processing between the two
cluster units you can also configure virtual clustering to provide load balancing by distributing
sessions for different VDOMs to each cluster unit.
Figure shows an example virtual cluster configuration consisting of two FortiGate-620B units.
The virtual cluster has two virtual domains, root and Eng_vdm.
The root virtual domain includes the port1 and port2 interfaces. The Eng_vdm virtual domain
includes the port5 and port6 interfaces. The port3 and port4 interfaces (not shown in the
diagram) are the HA heartbeat interfaces.
FortiGate virtual clustering is limited to a cluster of 2 FortiGate units with multiple VDOMs
enabled. If you want to create a cluster of more than 2 FortiGate units operating with multiple
VDOMS you could consider other solutions that either do not include multiple VDOMs in one
cluster or employ a feature such as standalone session synchronization. See FortiGate
Session Life Support Protocol (FGSP) on page 1370.
Page 1217
Figure 197:Example virtual cluster of two FortiGate-620B units
Engineering
_2
ha
Network
0_
62
t2
or
P
h
itc
w
S
t1
t5
or
or
P
P
h
itc
t6
w
or
S
h
itc
w
t5
S
or
P
t2
or
t6
Internal
or
P
r
te
Network
ou
h
itc
R
w
S
t1
_1
or
ha
P
0_
62
root Traffic
Eng_vdm Traffic
If override is enabled the cluster may renegotiate too often.You can choose to disable override
at any time. If you decide to disable override, for best results, you should disable it for both
cluster units.
Fortinet Technologies Inc. Page 1218 FortiOS Handbook - High Availability for FortiOS 5.0
domains and you set the other cluster unit as the primary unit for other virtual domains. All
traffic for a virtual domain is processed by the primary unit for that virtual domain. You can
control the distribution of traffic between the cluster units by adjusting which cluster unit is the
primary unit for each virtual domain.
For example, you could have 4 VDOMs, two of which have a high traffic volume and two of
which have a low traffic volume. You can configure each cluster unit to be the primary unit for
one of the high volume VDOMs and one of the low volume VDOMs. As a result each cluster unit
will be processing traffic for a high volume VDOM and a low volume VDOM, resulting in an even
distribution of traffic between the cluster units. You can adjust the distribution at any time. For
example, if a low volume VDOM becomes a high volume VDOM you can move it from one
cluster unit to another until the best balance is achieved.
From the web-based manager you configure VDOM partitioning by setting the HA mode to
active-passive and distributing virtual domains between Virtual Cluster 1 and Virtual Cluster 2.
You can also configure different device priorities, port monitoring, and remote link failover, for
Virtual Cluster 1 and Virtual Cluster 2.
The device priorities for virtual cluster 1 and virtual cluster 2 are not synchronized between the
FortiGate units in the virtual cluster. You must configure these device priorities separately for
each cluster unit.
From the CLI you configure VDOM partitioning by setting the HA mode to a-p. Then you
configure device priority, port monitoring, and remote link failover and specify the VDOMs to
include in virtual cluster 1. You do the same for virtual cluster 2 by entering the
config secondary-vcluster command.
Failover protection does not change. If one cluster unit fails, all sessions are processed by the
remaining cluster unit. No traffic interruption occurs for the virtual domains for which the still
functioning cluster unit was the primary unit. Traffic may be interrupted temporarily for virtual
domains for which the failed unit was the primary unit while processing fails over to the still
functioning cluster unit.
If the failed cluster unit restarts and rejoins the virtual cluster, VDOM partitioning load balancing
is restored.
If your cluster uses VDOMs, you are configuring virtual clustering. Most virtual cluster HA
options are the same as normal HA options. However, virtual clusters include VDOM partitioning
options. Other differences between configuration options for regular HA and for virtual
clustering HA are described below.
To configure HA options for a cluster with VDOMs enabled:
Log into the global web-based manager and go to System > Config > HA.
From the CLI, log into the Global Configuration:
Fortinet Technologies Inc. Page 1219 FortiOS Handbook - High Availability for FortiOS 5.0
The following example shows how to configure active-active virtual clustering:
config global
config system ha
set mode a-a
set group-name vexample1.com
set password vHA_pass_1
end
end
The following example shows how to configure active-passive virtual clustering:
config global
config system ha
set mode a-p
set group-name vexample1.com
set password vHA_pass_1
end
end
The following example shows how to configure VDOM partitioning for virtual clustering. In the
example, the FortiGate unit is configured with three VDOMs (domain_1, domain_2, and
domain_3) in addition to the root VDOM. The example shows how to set up a basic HA
configuration that sets the device priority of virtual cluster 1 to 200. The example also shows
how to enable vcluster2, how to set the device priority of virtual cluster 2 to 100 and how to
add the virtual domains domain_2 and domain_3 to virtual cluster 2.
When you enable multiple VDOMs, vcluster2 is enabled by default. Even so the command to
enable vcluster2 is included in this example in case for some reason it has been disabled.
When vcluster2 is enabled, override is also enabled.
The result of this configuration would be that the cluster unit that you are logged into becomes
the primary unit for virtual cluster 1. This cluster unit processes all traffic for the root and
domain_1 virtual domains.
config global
config system ha
set mode a-p
set group-name vexample1.com
set password vHA_pass_1
set priority 200
set vcluster2 enable
config secondary-vcluster
set vdom domain_2 domain_3
set priority 100
end
end
end
The following example shows how to use the execute ha manage command to change the
device priorities for virtual cluster 1 and virtual cluster 2 for the other unit in the cluster. The
commands set the device priority of virtual cluster 1 to 100 and virtual cluster 2 to 200.
Fortinet Technologies Inc. Page 1220 FortiOS Handbook - High Availability for FortiOS 5.0
The result of this configuration would be that the other cluster unit becomes the primary unit for
virtual cluster 2. This other cluster unit would process all traffic for the domain_2 and domain_3
virtual domains.
config global
execute ha manage 1
config system ha
set priority 100
set vcluster2 enable
config secondary-vcluster
set priority 200
end
end
end
end
This section describes how to configure the example virtual clustering configuration shown in
Figure 198. This configuration includes two virtual domains, root and Eng_vdm and includes
VDOM partitioning that sends all root VDOM traffic to 620_ha_1 and all Eng_vdom VDOM traffic
to 620_ha_2. The traffic from the internal network and the engineering network is distributed
between the two FortiGate units in the virtual cluster. If one of the cluster units fails, the
remaining unit will process traffic for both VDOMs.
The procedures in this example describe some of many possible sequences of steps for
configuring virtual clustering. For simplicity many of these procedures assume that you are
starting with new FortiGate units set to the factory default configuration. However, this is not a
requirement for a successful HA deployment. FortiGate HA is flexible enough to support a
successful configuration from many different starting points.
Fortinet Technologies Inc. Page 1221 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 198:Example virtual cluster of two FortiGate-620B units showing VDOM partitioning
Engineering
_2
ha
Network
0_
62
2
10.12.101.0
t
or
P
1t
or
5t
P
or
P
t6
or
P
5t
or
P
2t
or
t6
P
.2
Internal
or
20
P
2. ter
.1
Network
20
17 ou
R
10.11.101.0
1
t
_1
or
P
ha
0_
62
root Traffic
Eng_vdm Traffic
Port1: 172.20.120.141
Port2: 10.11.101.100
Port5: 172.20.120.143
Port6: 10.12.101.100
Fortinet Technologies Inc. Page 1222 FortiOS Handbook - High Availability for FortiOS 5.0
Configuring virtual clustering with two VDOMs and VDOM partitioning -
web-based manager
These procedures assume you are starting with two FortiGate-620B units with factory default
settings.
4. Select OK.
5. Go to System > Config > HA and change the following settings.
Mode Active-Passive
Password vHA_pass_2
6. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
Fortinet Technologies Inc. Page 1223 FortiOS Handbook - High Availability for FortiOS 5.0
addresses on page 1300). The MAC addresses of the FortiGate-620B interfaces change to
the following virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To be able to reconnect sooner, you can update the ARP table of your management PC by
deleting the ARP table entry for the FortiGate unit (or just deleting all arp table entries). You
may be able to delete the arp table of your management PC from a command prompt using
a command similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
7. Power off the first FortiGate unit.
8. Repeat these steps for the second FortiGate unit.
Set the second FortiGate unit host name to:
Fortinet Technologies Inc. Page 1224 FortiOS Handbook - High Availability for FortiOS 5.0
To connect the cluster to the network
1. Connect the port1 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to the
Internet.
2. Connect the port5 interfaces of 620_ha_1 and 620_ha_2 to switch connected to the Internet.
You could use the same switch for the port1 and port5 interfaces.
3. Connect the port2 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to the
internal network.
4. Connect the port6 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to the
engineering network.
5. Connect the port3 interfaces of the cluster units together. You can use a crossover Ethernet
cable or regular Ethernet cables and a switch.
6. Connect the port4 interfaces of the cluster units together. You can use a crossover Ethernet
cable or regular Ethernet cables and a switch.
7. Power on the cluster units.
The units start and negotiate to choose the primary unit and the subordinate unit. This
negotiation occurs with no user intervention.
When negotiation is complete you can continue.
Name Eng_vdm
Alias Engineering_external
IP/Netmask 172.20.120.143/24
7. Select OK.
8. Edit the port6 interface, add it to the Eng_vdm VDOM and configure other interface settings:
Alias Engineering_internal
IP/Netmask 10.120.101.100/24
9. Select OK.
Fortinet Technologies Inc. Page 1225 FortiOS Handbook - High Availability for FortiOS 5.0
2. Go to Router > Static > Static Routes.
3. Change the default route.
Gateway 172.20.120.2
Device port1
Distance 10
4. Select Global.
5. Go to System > VDOM and Enter the Eng_vdm VDOM.
6. Go to Router > Static > Static Routes.
7. Change the default route.
Gateway 172.20.120.2
Device port5
Distance 10
Device Priority
You can do this by editing the HA configurations of each cluster unit in the cluster members
list and changing device priorities.
Since the device priority of Virtual Cluster 1 is highest for 620_ha_1 and since the root VDOM
is in Virtual Cluster 1, all traffic for the root VDOM is processed by 620_ha_1.
Since the device priority of Virtual Cluster 2 is highest for 620_ha_2 and since the Eng_vdm
VDOM is in Virtual Cluster 2, all traffic for the Eng_vdm VDOM is processed by 620_ha_2.
Fortinet Technologies Inc. Page 1226 FortiOS Handbook - High Availability for FortiOS 5.0
2. Go to System > Config > HA.
The cluster members list should show the following:
Virtual Cluster 1 contains the root VDOM.
620_ha_1 is the primary unit (master) for Virtual Cluster 1.
Virtual Cluster 2 contains the Eng_vdm VDOM.
620_ha_2 is the primary unit (master) for Virtual Cluster 2.
Fortinet Technologies Inc. Page 1227 FortiOS Handbook - High Availability for FortiOS 5.0
6. Log into the web-based manager and go to Config > System > HA and select View HA
Statistics.
The statistics display shows more active sessions, total packets, network utilization, and
total bytes for the 620_ha_2 unit.
Configuring virtual clustering with two VDOMs and VDOM partitioning - CLI
These procedures assume you are starting with two FortiGate-620B units with factory default
settings.
Fortinet Technologies Inc. Page 1228 FortiOS Handbook - High Availability for FortiOS 5.0
page 1300). The MAC addresses of the FortiGate-620B interfaces change to the following
virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To be able to reconnect sooner, you can update the ARP table of your management PC by
deleting the ARP table entry for the FortiGate unit (or just deleting all arp table entries). You
may be able to delete the arp table of your management PC from a command prompt using
a command similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
Fortinet Technologies Inc. Page 1229 FortiOS Handbook - High Availability for FortiOS 5.0
4. Display the HA configuration (optional).
get system ha
group-id : 0
group-name : vexample2.com
mode : a-p
password : *
hbdev : "port3" 50 "port4" 50
session-sync-dev :
route-ttl : 10
route-wait : 0
route-hold : 10
sync-config : enable
encryption : disable
authentication : disable
hb-interval : 2
hb-lost-threshold : 20
helo-holddown : 20
arps : 5
arps-interval : 8
session-pickup : disable
link-failed-signal : disable
uninterruptible-upgrade: enable
ha-mgmt-status : disable
ha-eth-type : 8890
hc-eth-type : 8891
l2ep-eth-type : 8893
subsecond : disable
vcluster2 : disable
vcluster-id : 1
override : disable
priority : 128
monitor :
pingserver-monitor-interface:
pingserver-failover-threshold: 0
pingserver-flip-timeout: 60
vdom : "root"
5. Power off the first FortiGate unit.
6. Repeat these steps for the second FortiGate unit.
Set the other FortiGate unit host name to:
config system global
set hostname 620_ha_2
end
Fortinet Technologies Inc. Page 1230 FortiOS Handbook - High Availability for FortiOS 5.0
3. Connect the port2 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to the
internal network.
4. Connect the port6 interfaces of 620_ha_1 and 620_ha_2 to a switch connected to the
engineering network.
5. Connect the port3 interfaces of the cluster units together. You can use a crossover Ethernet
cable or regular Ethernet cables and a switch.
6. Connect the port4 interfaces of the cluster units together. You can use a crossover Ethernet
cable or regular Ethernet cables and a switch.
7. Power on the cluster units.
The units start and negotiate to choose the primary unit and the subordinate unit. This
negotiation occurs with no user intervention.
When negotiation is complete you can continue.
Fortinet Technologies Inc. Page 1231 FortiOS Handbook - High Availability for FortiOS 5.0
To add a default route to each VDOM
1. Enter the following command to add default routes to the root and Eng_vdm VDOMs.
config vdom
edit root
config router static
edit 1
set dst 0.0.0.0/0.0.0.0
set gateway 172.20.120.2
set device port1
end
next
edit Eng_vdm
config router static
edit 1
set dst 0.0.0.0/0.0.0.0
set gateway 172.20.120.2
set device port5
end
end
Fortinet Technologies Inc. Page 1232 FortiOS Handbook - High Availability for FortiOS 5.0
3. Enter the get system ha status command to view cluster unit status:
For example, from the 620_ha_2 cluster unit CLI:
config global
get system ha status
Model: 620
Mode: a-p
Group: 0
Debug: 0
ses_pickup: disable
Master:128 620_ha_2 FG600B3908600825 0
Slave :128 620_ha_1 FG600B3908600705 1
number of vcluster: 2
vcluster 1: work 169.254.0.1
Master:0 FG600B3908600825
Slave :1 FG600B3908600705
vcluster 2: work 169.254.0.1
Master:0 FG600B3908600825
Slave :1 FG600B3908600705
This command output shows VDOM partitioning has been configured because both virtual
cluster 1 and virtual cluster 2 are visible. However the configuration is not complete because
620_ha_2 is the primary unit for both virtual clusters. The command output shows this
because under both vcluster entries the Master entry shows FG600B3908600825, which is
the serial number of 620_ha_2. As a result of this configuration, 620_ha_2 processes traffic
for both VDOMs and 620_ha_1 does not process any traffic.
4. Change the Virtual Cluster 1 and Virtual Cluster 2 device priorities for each cluster unit so
that 620_ha_1 processes virtual cluster 1 traffic and 620_ha_2 processes virtual cluster 2
traffic.
Since the root VDOM is in virtual cluster 1 and the Eng_vdm VDOM is in virtual cluster 2 the
result of this configuration will be that 620_ha_1 will process all root VDOM traffic and
Fortinet Technologies Inc. Page 1233 FortiOS Handbook - High Availability for FortiOS 5.0
620_ha_2 will process all Eng_vdm traffic. You make this happen by changing the cluster
unit device priorities for each virtual cluster. You could use the following settings:
Device Priority
Since the device priority is not synchronized you can edit the device priorities of each virtual
cluster on each FortiGate unit separately. To do this:
Log into the CLI and note the FortiGate unit you have actually logged into (for example,
by checking the host name displayed in the CLI prompt).
Change the virtual cluster 1 and 2 device priorities for this cluster unit.
Then use the execute ha manage command to log into the other cluster unit CLI and
set its virtual cluster 1 and 2 device priorities.
Enter the following commands from the 620_ha_1 cluster unit CLI:
config global
config system ha
set priority 200
config secondary-vcluster
set priority 100
end
end
end
Enter the following commands from the 620_ha_2 cluster unit CLI:
config global
config system ha
set priority 100
config secondary-vcluster
set priority 200
end
end
end
The cluster may renegotiate during this step resulting in a temporary loss of connection to the
CLI and a temporary service interruption.
Since the device priority of Virtual Cluster 1 is highest for 620_ha_1 and since the root VDOM
is in Virtual Cluster 1, all traffic for the root VDOM is processed by 620_ha_1.
Since the device priority of Virtual Cluster 2 is highest for 620_ha_2 and since the Eng_vdm
VDOM is in Virtual Cluster 2, all traffic for the Eng_vdm VDOM is processed by 620_ha_2.
Fortinet Technologies Inc. Page 1234 FortiOS Handbook - High Availability for FortiOS 5.0
To verify the VDOM partitioning configuration
1. Log into the 620_ha_2 cluster unit CLI and enter the following command:
config global
get system ha status
Model: 620
Mode: a-p
Group: 0
Debug: 0
ses_pickup: disable
Slave :100 620_ha_2 FG600B3908600825 0
Master:200 620_ha_1 FG600B3908600705 1
number of vcluster: 2
vcluster 1: standby 169.254.0.2
Slave :1 FG600B3908600825
Master:0 FG600B3908600705
vcluster 2: work 169.254.0.1
Master:0 FG600B3908600825
Slave :1 FG600B3908600705
The command output shows that 620_ha_1 is the primary unit for virtual cluster 1 (because
the command output show the Master of virtual cluster 1 is the serial number of 620_ha_1)
and that 620_ha_2 is the primary unit for virtual cluster 2.
If you enter the same command from the 620_ha_1 CLI the same information is displayed
but in a different order. The command always displays the status of the cluster unit that you
are logged into first.
config global
get system ha status
Model: 620
Mode: a-p
Group: 0
Debug: 0
ses_pickup: disable
Master:200 620_ha_1 FG600B3908600705 1
Slave :100 620_ha_2 FG600B3908600825 0
number of vcluster: 2
vcluster 1: work 169.254.0.2
Master:0 FG600B3908600705
Slave :1 FG600B3908600825
vcluster 2: standby 169.254.0.1
Slave :1 FG600B3908600705
Master:0 FG600B3908600825
Fortinet Technologies Inc. Page 1235 FortiOS Handbook - High Availability for FortiOS 5.0
the host name in the CLI prompt. Also the get system status command displays the
status of the 610_ha_1 cluster unit.
2. Log into the web-based manager or CLI by connecting to port6 using IP address
10.12.101.100.
You will log into 610_ha_2 because port6 is in the Eng_vdm VDOM and all traffic for this
VDOM is processed by 610_ha_2.
3. Add security policies to the root virtual domain that allow communication from the internal
network to the Internet and connect to the Internet from the internal network.
4. Log into the web-based manager and go to Config > System > HA and select View HA
Statistics.
The statistics display shows more active sessions, total packets, network utilization, and
total bytes for the 620_ha_1 unit.
5. Add security policies to the Eng_vdm virtual domain that allow communication from the
engineering network to the Internet and connect to the Internet from the engineering
network.
6. Log into the web-based manager and go to Config > System > HA and select View HA
Statistics.
The statistics display shows more active sessions, total packets, network utilization, and
total bytes for the 620_ha_2 unit.
In a virtual domain configuration you can use inter-VDOM links to route traffic between two
virtual domains operating in a single FortiGate unit without using physical interfaces. Adding an
inter-VDOM link has the affect of adding two interfaces to the FortiGate unit and routing traffic
between the virtual domains using the inter-VDOM link interfaces.
In a virtual clustering configuration inter-VDOM links can only be made between virtual domains
that are in the same virtual cluster. So, if you are planning on configuring inter-VDOM links in a
virtual clustering configuration, you should make sure the virtual domains that you want to link
are in the same virtual cluster.
For example, the following tables show an example virtual clustering configuration where each
virtual cluster contains three virtual domains. In this configuration you can configure inter-VDOM
links between root and vdom_1 and between vdom_2 and vdom_3. But, you cannot configure
inter-VDOM links between root and vdom_2 or between vdom_1 and vdom_3 (and so on).
FortiGate_A FortiGate_B
Role Role
Primary Subordinate
Fortinet Technologies Inc. Page 1236 FortiOS Handbook - High Availability for FortiOS 5.0
Virtual Domains Hostname
FortiGate_A FortiGate_B
Role Role
Subordinate Primary
Fortinet Technologies Inc. Page 1237 FortiOS Handbook - High Availability for FortiOS 5.0
1 Add an inter-VDOM link called vc2link.
config global
config system vdom-link
edit vc2link
set vcluster vcluster2
end
Adding the inter-VDOM link also adds two interfaces. In this example, these
interfaces are called vc2link0 and vc2link1. These interfaces appear in all CLI and
web-based manager interface lists. These interfaces can only be added to virtual domains in
virtual cluster 2.
2. Bind the vc2link0 interface to the vdom_2 virtual domain and bind the vc2link1 interface
to the vdom_3 virtual domain.
config system interface
edit vc2link0
set vdom vdom_2
next
edit vc2link1
set vdom vdom_3
end
Fortinet Technologies Inc. Page 1238 FortiOS Handbook - High Availability for FortiOS 5.0
Full mesh HA
This chapter provides an introduction to full mesh HA and also contains general procedures and
configuration examples that describe how to configure FortiGate full mesh HA.
The examples in this chapter include example values only. In most cases you will substitute
your own values. The examples in this chapter also do not contain detailed descriptions of
configuration parameters.
This chapter contains the following sections:
Full mesh HA overview
Example: full mesh HA configuration
Troubleshooting full mesh HA
When two or more FortiGate units are connected to a network in an HA cluster the reliability of
the network is improved because the HA cluster replaces a single FortiGate unit as a single
point of failure. With a cluster, a single FortiGate unit is replaced by a cluster of two or more
FortiGate units.
However, even with a cluster, potential single points of failure remain. The interfaces of each
cluster unit connect to a single switch and that switch provides a single connection to the
network. If the switch fails or if the connection between the switch and the network fails service
is interrupted to that network.
The HA cluster does improve the reliability of the network because switches are not as complex
components as FortiGate units, so are less likely to fail. However, for even greater reliability, a
configuration is required that includes redundant connections between the cluster the networks
that it is connected to.
FortiGate models that support 802.3ad Aggregate or Redundant interfaces can be used to
create a cluster configuration called full mesh HA. Full mesh HA is a method of reducing the
number of single points of failure on a network that includes an HA cluster.
This redundant configuration can be achieved using FortiGate 802.3ad Aggregate or Redundant
interfaces and a full mesh HA configuration. In a full mesh HA configuration, you connect an HA
cluster consisting of two or more FortiGate units to the network using 802.3ad Aggregate or
Redundant interfaces and redundant switches. Each 802.3ad Aggregate or Redundant interface
is connected to two switches and both of these switches are connected to the network.
The resulting full mesh configuration, an example is shown in Figure 200, includes redundant
connections between all network components. If any single component or any single
connection fails, traffic automatically switches to the redundant component and connection and
traffic flow resumes.
Page 1239
Figure 200:SIngle points of failure in a standalone and HA network configuration
r
te
ou
R
FortiGate cluster
single points of failure
_2
ha
0_
62
t2
or
P
h
itc
w
S
t1
t3
Internal
or
or
P
P
Network
t4
or
10.11.101.0
P
h
t3
itc
or
w
P
S
t4
or
t2
P
or
r
te
P
ou
R
t1
or
_1
P
ha
0_
62
Fortinet Technologies Inc. Page 1240 FortiOS Handbook - High Availability for FortiOS 5.0
of the physical interfaces in the aggregate interface can send and receive packets. As a result,
using aggregate interfaces may increase the bandwidth capacity of the cluster.
Usually redundant and aggregate interfaces consist of two physical interfaces. However, you
can add more than two physical interfaces to a redundant or aggregate interface. Adding more
interfaces can increase redundancy protection. Adding more interfaces can also increase
bandwidth capacity if you are using 802.3ad aggregate interfaces.
Figure 200 shows a full mesh HA configuration with a cluster of two FortiGate-620b units. This
section describes the FortiGate configuration settings and network components required for a
full mesh HA configuration. This section also contains example steps for setting up this full
mesh HA configuration. The procedures in this section describe one of many possible
sequences of steps for configuring full mesh HA. As you become more experienced with
FortiOS, HA, and full mesh HA you may choose to use a different sequence of configuration
steps.
0 4 ce
10 rt rfa
1. Po te
10 d In
1. n t
.1 3 a an
_2
10 rt und
4
ha
w
S
0_
P ed
62
R
o
ce
.1 rt2 fa
20 o er
Internal
.1 P Int
20 n t
2. 1 a an
41
Network
17 rt und
L
d
IS
P ed
t5
10.11.101.0
or
R
P
o
t6
or
3
P
w
S
A
H
t5
2
w
or
S
P
1. ort e
10 P c
1. d rfa
10 4
t6
or
.1 an te
P
10 t3 t In
or n
P da
un
2
0.
ed
2
2. ter
IS
.1
R
20
17 ou
20 o e
.1 d P fac
R
.1 rt2
_1
20 n er
41
ha
2. 1 a Int
0_
17 t t
or n
62
P da
1
un
w
S
ed
R
For simplicity these procedures assume that you are starting with two new FortiGate units set to
the factory default configuration. However, starting from the default configuration is not a
requirement for a successful HA deployment. FortiGate HA is flexible enough to support a
successful configuration from many different starting points.
These procedures describe how to configure a cluster operating in NAT/Route mode because
NAT/Route is the default FortiGate operating mode. However, the steps are the same if the
cluster operates in Transparent mode. You can either switch the cluster units to operate in
Transparent mode before beginning these procedures, or you can switch the cluster to operate
in Transparent mode after HA is configured and the cluster is connected and operating.
Fortinet Technologies Inc. Page 1241 FortiOS Handbook - High Availability for FortiOS 5.0
FortiGate-620B full mesh HA configuration
The two FortiGate-620B units (620_ha_1 and 620_ha_2) can be operating in NAT/Route or
Transparent mode. Aside from the standard HA settings, the FortiGate-620B configuration
includes the following:
The port5 and port6 interfaces configured as heartbeat interfaces. A full mesh HA
configuration also includes redundant HA heartbeat interfaces.
The port1 and port2 interfaces added to a redundant interface. Port1 is the active physical
interface in this redundant interface. To make the port1 interface the active physical interface
it should appear above the port2 interface in the redundant interface configuration.
The port3 and port4 interfaces added to a redundant interface. Port3 is the active physical
interface in this redundant interface. To make the port3 interface the active physical interface
it should appear above the port4 interface in the redundant interface configuration.
How packets travel from the internal network through the full mesh cluster and to
the Internet
If the cluster is operating in active-passive mode and 620_ha_2 is the primary unit, all packets
take the following path from the internal network to the internet:
1. From the internal network to Sw4. Sw4 is the active connection to 620_ha_2; which is the
primary unit. The primary unit receives all packets.
2. From Sw4 to the 620_ha_2 port3 interface. Active connection between Sw4 and 620_ha_2.
Port3 is the active member of the redundant interface.
3. From 620_ha_2 port3 to 620_ha_2 port1. Active connection between 620_ha_2 and Sw2.
Port1 is the active member of the redundant interface.
4. From Sw2 to the external router and the Internet.
Fortinet Technologies Inc. Page 1242 FortiOS Handbook - High Availability for FortiOS 5.0
Configuring FortiGate-620B units for HA operation - web-based manager
Each FortiGate-620B unit in the cluster must have the same HA configuration.
Mode Active-Active
Password RHA_pass_1
Heartbeat Interface
Enable Priority
port5 Select 50
port6 Select 50
5. Select OK.
The FortiGate unit negotiates to establish an HA cluster. When you select OK you may
temporarily lose connectivity with the FortiGate unit as the HA cluster negotiates and the
FGCP changes the MAC address of the FortiGate unit interfaces (see Cluster virtual MAC
addresses on page 1300). The MAC addresses of the FortiGate-620B interfaces change to
the following virtual MAC addresses:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-0b
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0e
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
Fortinet Technologies Inc. Page 1243 FortiOS Handbook - High Availability for FortiOS 5.0
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To be able to reconnect sooner, you can update the ARP table of your management PC by
deleting the ARP table entry for the FortiGate unit (or just deleting all arp table entries). You
may be able to delete the arp table of your management PC from a command prompt using
a command similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
6. Power off the first FortiGate unit.
7. Repeat these steps for the second FortiGate unit.
Set the second FortiGate unit host name to:
Fortinet Technologies Inc. Page 1244 FortiOS Handbook - High Availability for FortiOS 5.0
To view cluster status
Use the following steps to view the cluster dashboard and cluster members list to confirm that
the cluster units are operating as a cluster.
1. View the system dashboard.
The System Information dashboard widget shows the Cluster Name (Rexample1.com) and
the host names and serial numbers of the Cluster Members. The Unit Operation widget
shows multiple cluster units.
2. Go to System > Config > HA to view the cluster members list.
The list shows two cluster units, their host names, their roles in the cluster, and their
priorities. You can use this list to confirm that the cluster is operating normally.
Name Port1_Port2
Type Redundant
IP/Netmask 172.20.120.141/24
8. Select OK.
9. Select Create New and configure the redundant interface to connect to the internal network.
Name Port3_Port4
Type Redundant
Fortinet Technologies Inc. Page 1245 FortiOS Handbook - High Availability for FortiOS 5.0
IP/Netmask 10.11.101.100/24
10.Select OK.
The virtual MAC addresses of the FortiGate-620B interfaces change to the following. Notice
that port1 and port2 both have the port1 virtual MAC address and port3 and port4 both have
the port3 virtual MAC address:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-00 (same as port1)
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0d (same as port3)
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
11.Go to Router > Static > Static Routes.
12.Add the default route.
Gateway 172.20.120.2
Device Port1_Port2
Distance 10
13.Select OK.
Fortinet Technologies Inc. Page 1246 FortiOS Handbook - High Availability for FortiOS 5.0
3. Configure the following port monitoring for the redundant interfaces:
Port Monitor
Port1_Port2 Select
Port3_Port4 Select
4. Select OK.
Fortinet Technologies Inc. Page 1247 FortiOS Handbook - High Availability for FortiOS 5.0
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
To be able to reconnect sooner, you can update the ARP table of your management PC by
deleting the ARP table entry for the FortiGate unit (or just deleting all arp table entries). You
may be able to delete the arp table of your management PC from a command prompt using
a command similar to arp -d.
You can use the get hardware nic (or diagnose hardware deviceinfo nic) CLI
command to view the virtual MAC address of any FortiGate unit interface. For example, use
the following command to view the port1 interface virtual MAC address (Current_HWaddr)
and the port1 permanent MAC address (Permanent_HWaddr):
get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:00
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
4. Power off the first FortiGate unit.
5. Repeat these steps for the second FortiGate unit.
Set the other FortiGate unit host name to:
config system global
set hostname 620_ha_2
end
Fortinet Technologies Inc. Page 1248 FortiOS Handbook - High Availability for FortiOS 5.0
To view cluster status
Use the following steps to view cluster status from the CLI.
1. Log into the CLI.
2. Enter get system status to verify the HA status of the cluster unit that you logged into.
If the command output includes Current HA mode: a-a, master, the cluster units are
operating as a cluster and you have connected to the primary unit.
If the command output includes Current HA mode: a-a, backup, you have connected
to a subordinate unit.
If the command output includes Current HA mode: standalone the cluster unit is not
operating in HA mode.
3. Enter the following command to confirm the HA configuration of the cluster:
get system ha status
Model: 620
Mode: a-a
Group: 0
Debug: 0
ses_pickup: disable
Master:128 620_ha_2 FG600B3908600825 0
Slave :128 620_ha_1 FG600B3908600705 1
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master:0 FG600B3908600825
Slave :1 FG600B3908600705
The command output shows both cluster units, their host names, their roles in the cluster,
and their priorities. You can use this command to confirm that the cluster is operating
normally. For example, if the command shows only one cluster unit then the other unit has
left the cluster for some reason.
4. Use the execute ha manage command to connect to the other cluster units CLI and use
these commands to verify cluster status.
Fortinet Technologies Inc. Page 1249 FortiOS Handbook - High Availability for FortiOS 5.0
3. Temporarily delete the default route.
You cannot add an interface to a redundant interface if any settings (such as the default
route) are configured for it.
config router static
delete 1
end
4. Go to System > Network > Interface and select Create New to add the redundant interface to
connect to the Internet.
5. Add the redundant interface to connect to the Internet.
config sysetem interface
edit Port1_Port2
set type redundant
set member port1 port2
end
6. Add the redundant interface to connect to the internal network.
config sysetem interface
edit Port3_Port4
set type redundant
set member port3 port4
end
The virtual MAC addresses of the FortiGate-620B interfaces change to the following. Note
that port1 and port2 both have the port1 virtual MAC address and port3 and port4 both have
the port3 virtual MAC address:
port1 interface virtual MAC: 00-09-0f-09-00-00
port10 interface virtual MAC: 00-09-0f-09-00-01
port11 interface virtual MAC: 00-09-0f-09-00-02
port12 interface virtual MAC: 00-09-0f-09-00-03
port13 interface virtual MAC: 00-09-0f-09-00-04
port14 interface virtual MAC: 00-09-0f-09-00-05
port15 interface virtual MAC: 00-09-0f-09-00-06
port16 interface virtual MAC: 00-09-0f-09-00-07
port17 interface virtual MAC: 00-09-0f-09-00-08
port18 interface virtual MAC: 00-09-0f-09-00-09
port19 interface virtual MAC: 00-09-0f-09-00-0a
port2 interface virtual MAC: 00-09-0f-09-00-00 (same as port1)
port20 interface virtual MAC: 00-09-0f-09-00-0c
port3 interface virtual MAC: 00-09-0f-09-00-0d
port4 interface virtual MAC: 00-09-0f-09-00-0d (same as port3)
port5 interface virtual MAC: 00-09-0f-09-00-0f
port6 interface virtual MAC: 00-09-0f-09-00-10
port7 interface virtual MAC: 00-09-0f-09-00-11
port8 interface virtual MAC: 00-09-0f-09-00-12
port9 interface virtual MAC: 00-09-0f-09-00-13
7. Go to Router > Static.
Fortinet Technologies Inc. Page 1250 FortiOS Handbook - High Availability for FortiOS 5.0
8. Add the default route.
config router static
edit 1
set dst 0.0.0.0 0.0.0.0
set gateway 172.20.120.2
set device Port1_Port2
end
Fortinet Technologies Inc. Page 1251 FortiOS Handbook - High Availability for FortiOS 5.0
Operating a cluster
With some exceptions, you can operate a cluster in much the same way as you operate a
standalone FortiGate unit. This chapter describes those exceptions and also the similarities
involved in operating a cluster instead of a standalone FortiGate unit.
This chapter contains the following sections:
Operating a cluster
Operating a virtual cluster
Managing individual cluster units using a reserved management interface
The primary unit acts as a router for subordinate unit management traffic
Clusters and FortiGuard services
Clusters and logging
Clusters and SNMP
Clusters and file quarantine
Cluster members list
Virtual cluster members list
Viewing HA statistics
Changing the HA configuration of an operating cluster
Changing the HA configuration of an operating virtual cluster
Changing the subordinate unit host name and device priority
Upgrading cluster firmware
Downgrading cluster firmware
Backing up and restoring the cluster configuration
Monitoring cluster units for failover
Viewing cluster status from the CLI
Disconnecting a cluster unit from a cluster
Adding a disconnected FortiGate unit back to its cluster
Operating a cluster
The configurations of all of the FortiGate units in a cluster are synchronized so that the cluster
units can simulate a single FortiGate unit. Because of this synchronization, you manage the HA
cluster instead of managing the individual cluster units. You manage the cluster by connecting
to the web-based manager using any cluster interface configured for HTTPS or HTTP
administrative access. You can also manage the cluster by connecting to the CLI using any
cluster interface configured for SSH or telnet administrative access.
The cluster web-based manager dashboard displays the cluster name, the host name and serial
number of each cluster member, and also shows the role of each unit in the cluster. The roles
can be master (primary unit) and slave (subordinate units). The dashboard also displays a
cluster unit front panel illustration.
Page 1252
Figure 202:Example cluster web-based manager dashboard
You can also go to System > Config > HA to view the cluster members list. This includes status
information for each cluster unit. You can also use the cluster members list for a number of
cluster management functions including changing the HA configuration of an operating cluster,
changing the host name and device priority of a subordinate unit, and disconnecting a cluster
unit from a cluster. See Cluster members list on page 1268.
You can use log messages to view information about the status of the cluster. See Viewing and
managing log messages for individual cluster units on page 1261. You can use SNMP to
manage the cluster by configuring a cluster interface for SNMP administrative access. Using an
SNMP manager you can get cluster configuration information and receive traps.
You can configure a reserved management interface to manage individual cluster units. You can
use this interface to access the web-based manager or CLI and to configure SNMP
management for individual cluster units. See Managing individual cluster units using a reserved
management interface on page 1254.
You can manage individual cluster units by using SSH, telnet, or the CLI console on the
web-based manager dashboard to connect to the CLI of the cluster. From the CLI you can use
the execute ha manage command to connect to the CLI of any unit in the cluster.
You can also manage individual cluster units by using a null-modem cable to connect to any
cluster unit CLI. From there you can use the execute ha manage command to connect to the
CLI of each unit in the cluster.
Managing a virtual cluster is very similar to managing a cluster that does not contain multiple
virtual domains. Most of the information in this chapter applies to managing both kinds of
clusters. This section describes what is different when managing a virtual cluster.
If virtual domains are enabled, the cluster web-based manager dashboard displays the cluster
name and the role of each cluster unit in virtual cluster 1 and virtual cluster 2.
Fortinet Technologies Inc. Page 1253 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 203:Example virtual clustering web-based manager dashboard
The configuration and maintenance options that you have when you connect to a virtual cluster
web-based manager or CLI depend on the virtual domain that you connect to and the
administrator account that you use to connect.
If you connect to a cluster as the administrator of a virtual domain, you connect directly to the
virtual domain. Since HA virtual clustering is a global configuration, virtual domain
administrators cannot see HA configuration options. However, virtual domain administrators
see the host name of the cluster unit that they are connecting to on the web browser title bar or
CLI prompt. This host name is the host name of the primary unit for the virtual domain. Also,
when viewing log messages by going to Log & Report > Log Access virtual domain
administrator can select to view log messages for either of the cluster units.
If you connect to a virtual cluster as the admin administrator you connect to the global
web-based manager or CLI. Even so, you are connecting to an interface and to the virtual
domain that the interface has been added to. The virtual domain that you connect to does not
make a difference for most configuration and maintenance operations. However, there are a few
exceptions. You connect to the FortiGate unit that functions as the primary unit for the virtual
domain. So the host name displayed on the web browser title bar and on the CLI is the host
name of this primary unit.
You can provide direct management access to all cluster units by reserving a management
interface as part of the HA configuration. Once this management interface is reserved, you can
configure a different IP address, administrative access and other interface settings for this
interface for each cluster unit. Then by connecting this interface of each cluster unit to your
network you can manage each cluster unit separately from a different IP address. Configuration
changes to the reserved management interface are not synchronized to other cluster units.
The reserved management interface provides direct management access to each cluster unit
and gives each cluster unit a different identity on your network. This simplifies using external
services, such as SNMP, to separately monitor and manage each cluster unit.
The reserved management interface is not assigned an HA virtual MAC address like other
cluster interfaces. Instead the reserved management interface retains the permanent hardware
address of the physical interface unless you change it using the config system interface
command.
The reserved management interface and IP address should not be used for managing a cluster
using FortiManager. To correctly manage a FortiGate HA cluster with FortiManager use the IP
address of one of the cluster unit interfaces.
Fortinet Technologies Inc. Page 1254 FortiOS Handbook - High Availability for FortiOS 5.0
If you enable SNMP administrative access for the reserved management interface you can use
SNMP to monitor each cluster unit using the reserved management interface IP address. To
monitor each cluster unit using SNMP, just add the IP address of each cluster units reserved
management interface to the SNMP server configuration. You must also enable direct
management of cluster members in the cluster SNMP configuration.
If you enable HTTPS or HTTP administrative access for the reserved management interfaces
you can connect to the web-based manager of each cluster unit. Any configuration changes
made to any of the cluster units is automatically synchronized to all cluster units. From the
subordinate units the web-based manager has the same features as the primary unit except
that unit-specific information is displayed for the subordinate unit, for example:
The Dashboard System Information widget displays the subordinate unit serial number but
also displays the same information about the cluster as the primary unit
On the Cluster members list (go to System > Config > HA) you can change the HA
configuration of the subordinate unit that you are logged into. For the primary unit and other
subordinate units you can change only the host name and device priority.
Log Access displays the logs of the subordinate that you are logged into fist, You use the HA
Cluster list to view the log messages of other cluster units including the primary unit.
If you enable SSH or TELNET administrative access for the reserved management interfaces
you can connect to the CLI of each cluster unit. The CLI prompt contains the host name of the
cluster unit that you have connected to. Any configuration changes made to any of the cluster
units is automatically synchronized to all cluster units. You can also use the execute ha
manage command to connect to other cluster unit CLIs.
The reserved management interface is available in NAT/Route and in Transparent mode. It is
also available if the cluster is operating with multiple VDOMs. In Transparent mode you cannot
normally add an IP address to an interface. However, you can add an IP address to the reserved
management interface.
Fortinet Technologies Inc. Page 1255 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 204:SNMP remote management of individual cluster units
r
S eve
MP .20
t) 2
SN 1.101
ni 0
U .1
e 01
.1
at .1
10
in 1
0
d .1
10
or 10
1.
10
.1 2
ub 8:
10 ort
(S ort
1.
P
41
Internal
.1
20
h
itc
Network
.1
2. 1
w
17 ort
20
S
P
10 2
1. ort
0
10 P
h
itc
w
S
1.
.1
er
10
t
ou
R
.1 rt1
U 1
y 10
41
20 o
t)
.1 P
ar 01.
ni
rim .1
(P 11
20
0.
:1
2.
17
t8
or
P
Fortinet Technologies Inc. Page 1256 FortiOS Handbook - High Availability for FortiOS 5.0
2. Go to System > Network > Interfaces and edit the port8 interface as follows:
Alias primary_reserved
IP/Netmask 10.11.101.101/24
3. Select OK.
You can now log into the primary unit web-based manager by browsing to
https://10.11.101.101. You can also log into this primary unit CLI by using an SSH client to
connect to 10.11.101.101.
To configure the cluster for SNMP management using the reserved management
interfaces - CLI
This procedure describes how to configure the cluster to allow the SNMP server to get status
information from the primary unit and the subordinate unit. The SNMP configuration is
synchronized to all cluster units. To support using the reserved management interfaces, you
must add at least one HA direct management host to an SNMP community. If your SNMP
configuration includes SNMP users with user names and passwords you must also enable HA
direct management for SNMP users.
Fortinet Technologies Inc. Page 1257 FortiOS Handbook - High Availability for FortiOS 5.0
1. Enter the following command to add an SNMP community called Community and add a
host to the community for the reserved management interface of each cluster unit. The host
includes the IP address of the SNMP server (10.11.101.20).
config system snmp community
edit 1
set name Community
config hosts
edit 1
set ha-direct enable
set ip 10.11.101.20
end
end
2. Enter the following command to add an SNMP user for the reserved management interface.
config system snmp user
edit 1
set ha-direct enable
set notify-hosts 10.11.101.20
end
Configure other settings as required.
To get CPU, memory, and network usage of each cluster unit using the reserved
management IP addresses
From the command line of an SNMP manager, you can use the following SNMP commands to
get CPU, memory and network usage information for each cluster unit. In the examples, the
community name is Community. The commands use the MIB field names and OIDs listed in
Table 57 on page 1265.
Enter the following commands to get CPU, memory and network usage information for the
primary unit with reserved management IP address 10.11.101.101 using the MIB fields:
snmpget -v2c -c Community 10.11.101.101 fgHaStatsCpuUsage
snmpget -v2c -c Community 10.11.101.101 fgHaStatsMemUsage
snmpget -v2c -c Community 10.11.101.101 fgHaStatsNetUsage
Enter the following commands to get CPU, memory and network usage information for the
primary unit with reserved management IP address 10.11.101.101 using the OIDs:
snmpget -v2c -c Community 10.11.101.101
1.3.6.1.4.1.12356.101.13.2.1.1.3.1
snmpget -v2c -c Community 10.11.101.101
1.3.6.1.4.1.12356.101.13.2.1.1.4.1
snmpget -v2c -c Community 10.11.101.101
1.3.6.1.4.1.12356.101.13.2.1.1.5.1
Enter the following commands to get CPU, memory and network usage information for the
subordinate unit with reserved management IP address 10.11.101.102 using the MIB fields:
snmpget -v2c -c Community 10.11.101.102 fgHaStatsCpuUsage
snmpget -v2c -c Community 10.11.101.102 fgHaStatsMemUsage
snmpget -v2c -c Community 10.11.101.102 fgHaStatsNetUsage
Fortinet Technologies Inc. Page 1258 FortiOS Handbook - High Availability for FortiOS 5.0
Enter the following commands to get CPU, memory and network usage information for the
subordinate unit with reserved management IP address 10.11.101.102 using the OIDs:
snmpget -v2c -c Community 10.11.101.102
1.3.6.1.4.1.12356.101.13.2.1.1.3.1
snmpget -v2c -c Community 10.11.101.102
1.3.6.1.4.1.12356.101.13.2.1.1.4.1
snmpget -v2c -c Community 10.11.101.102
1.3.6.1.4.1.12356.101.13.2.1.1.5.1
HA uses routing and inter-VDOM links to route subordinate unit management traffic through the
primary unit to the network. Similar to a standalone FortiGate unit, subordinate units may
generate their own management traffic, including:
DNS queries.
FortiGuard Web Filtering rating requests.
Log messages to be sent to a FortiAnalyzer unit, to a syslog server, or to the FortiGuard
Analysis and Management Service.
Log file uploads to a FortiAnalyzer unit.
Quarantine file uploads to a FortiAnalyzer unit.
SNMP traps.
Communication with remote authentication servers (RADIUS, LDAP, TACACS+ and so on)
Subordinate units send this management traffic over the HA heartbeat link to the primary unit.
The primary unit forwards the management traffic to its destination. The primary unit also routes
replies back to the subordinate unit in the same way.
HA uses a hidden VDOM called vsys_ha for HA operations. The vsys_ha VDOM includes the HA
heartbeat interfaces, and all communication over the HA heartbeat link goes through the
vsys_ha VDOM. To provide communication from a subordinate unit to the network, HA adds
hidden inter-VDOM links between the primary unit management VDOM and the primary unit
vsys_ha VDOM. By default, root is the management VDOM.
Management traffic from the subordinate unit originates in the subordinate unit vsys_ha VDOM.
The vsys_ha VDOM routes the management traffic over the HA heartbeat link to the primary unit
vsys_ha VDOM. This management traffic is then routed to the primary unit management VDOM
and from there out onto the network.
DNS queries and FortiGuard Web Filtering and Email Filter requests are still handled by the HA
proxy so the primary unit and subordinate units share the same DNS query cache and the same
FortiGuard Web Filtering and Email Filter cache. In a virtual clustering configuration, the cluster
unit that is the primary unit for the management virtual domain maintains the FortiGuard Web
Filtering, Email Filtering, and DNS query cache.
Fortinet Technologies Inc. Page 1259 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 205:Subordinate unit management traffic path
Network
Primary unit Subordinate unit
This section describes how various FortiGate HA clustering configurations communicate with
the FDN.
In an operating cluster, the primary unit communicates directly with the FortiGuard Distribution
Network (FDN). Subordinate units also communicate directly with the FDN but as described in
The primary unit acts as a router for subordinate unit management traffic on page 1259, all
communication between subordinate units and the FDN is routed through the primary unit.
You must register and licence all of the units in a cluster for all required FortiGuard services,
both because all cluster units communicate with the FDN and because any cluster unit could
potentially become the primary unit.
Fortinet Technologies Inc. Page 1260 FortiOS Handbook - High Availability for FortiOS 5.0
Because the subordinate units process traffic, they may also be making FortiGuard Web
Filtering and Email Filter requests. The primary unit receives all such requests from the
subordinate units and relays them to the FDN and then relays the FDN responses back to the
subordinate units. The FortiGuard Web Filtering and Email Filtering URL caches are maintained
on the primary unit. The primary unit caches are used for primary and subordinate unit requests.
This section describes the log messages that provide information about how HA is functioning,
how to view and manage logs for each unit in a cluster, and provides some example log
messages that are recorded during specific cluster events.
You configure logging for a cluster in the same way as you configuring logging for a standalone
FortiGate unit. Log configuration changes made to the cluster are synchronized to all cluster
units.
All cluster units record log messages separately to the individual cluster units log disk, to the
cluster units system memory, or both. You can view and manage log messages for each cluster
unit from the cluster web-based manager Log Access page.
When remote logging is configured, all cluster units send log messages to remote FortiAnalyzer
units or other remote servers as configured. HA uses routing and inter-VDOM links to route
subordinate unit log traffic through the primary unit to the network. See The primary unit acts
as a router for subordinate unit management traffic on page 1259.
When you configure a FortiAnalyzer unit to receive log messages from a FortiGate cluster, you
should add a cluster to the FortiAnalyzer unit configuration so that the FortiAnalyzer unit can
receive log messages from all cluster units.
Fortinet Technologies Inc. Page 1261 FortiOS Handbook - High Availability for FortiOS 5.0
indicate when a cluster unit switches (or moves) from one HA state to another. Cluster units can
operate in the HA states listed in Table 56:
Table 56: HA states
Hello A FortiGate unit configured for HA operation has started up and is looking for
other FortiGate units with which to form a cluster.
HA log Event log messages also indicate the virtual cluster that the cluster unit is operating in as
well as the member number of the unit in the cluster. If virtual domains are not enabled, all
clusters unit are always operating in virtual cluster 1. If virtual domains are enabled, a cluster
unit may be operating in virtual cluster 1 or virtual cluster 2. The member number indicates the
position of the cluster unit in the cluster members list. Member 0 is the primary unit. Member 1
is the first subordinate unit, member 2 is the second subordinate unit, and so on.
HA log messages
See the FortiGate Log Message Reference for a listing of and descriptions of the HA log
messages.
Fortinet Technologies Inc. Page 1262 FortiOS Handbook - High Availability for FortiOS 5.0
3. If the log message only appears during peak traffic times, increase the tolerance for missed
HA heartbeat packets by using the following commands to increase the lost heartbeat
threshold and heartbeat interval:
config system ha
set hb-lost-threshold 12
set hb-interval 4
end
These settings multiply by 4 the loss detection interval. You can use higher values as well.
This condition can also occur if the cluster units are located in different buildings or even
different geographical locations. Called a distributed cluster, as a result of the separation it
may take a relatively long time for heartbeat packets to be transmitted between cluster units.
You can support a distributed cluster by increasing the heartbeat interval so that the cluster
expects extra time between heartbeat packets.
4. Optionally disable session-pickup to reduce the processing load on the heartbeat interfaces.
5. Instead of disabling session-pickup you can enable session-pickup-delay to reduce
the number of sessions that are synchronized. With this option enabled only sessions that
are active for more than 30 seconds are synchronized.
It may be useful to monitor CPU and memory usage to check for low memory and high CPU
usage. You can configure event logging to monitor CPU and memory usage. You can also
enable the CPU over usage and memory low SNMP events.
Once this monitoring is in place, try and determine if there have been any changes in the
network or an increase of traffic recently that could be the cause. Check to see if the problem
happens frequently and if so what the pattern is.
To monitor the CPU of the cluster units and troubleshoot further, use the following procedure
and commands:
get system performance status
get sys performance top 2
diagnose sys top 2
These commands repeated at frequent intervals will show the activity of the CPU and the
number of sessions.
Search the Fortinet Knowledge Base for articles about monitoring CPU and Memory usage.
If the problem persists, gather the following information (a console connection might be
necessary if connectivity is lost) and provide it to Technical Support when opening a ticket:
Debug log from the web-based manager: System > Config > Advanced > Download Debug
Log
CLI command output:
diag sys top 2 (keep it running for 20 seconds)
get sys perf status (repeat this command multiple times to get good samples)
get sys ha status
diagnose sys ha status
diagnose sys ha dump-by {all options}
diagnose netlink device list
diagnose hardware deviceinfo nic <heartbeat-interface-name>
execute log filter category 1
execute log display
Fortinet Technologies Inc. Page 1263 FortiOS Handbook - High Availability for FortiOS 5.0
Formatting cluster unit hard disks (log disks)
If you need to format the hard disk (also called log disk or disk storage) of one or more cluster
units you should disconnect the unit from the cluster and use the execute formatlogdisk
command to format the cluster unit hard disk then add the unit back to the cluster.
For information about how to remove a unit from a cluster and add it back, see Disconnecting
a cluster unit from a cluster on page 1285 and Adding a disconnected FortiGate unit back to
its cluster on page 1286.
Once you add the cluster unit with the formatted log disk back to the cluster you should make it
the primary unit before removing other units from the cluster to format their log disks and then
add them back to the cluster.
You can use SNMP to manage a cluster by configuring a cluster interface for SNMP
administrative access. Using an SNMP manager you can get cluster configuration and status
information and receive traps.
You configure SNMP for a cluster in the same way as configuring SNMP for a standalone
FortiGate unit. SNMP configuration changes made to the cluster are shared by all cluster units.
Each cluster unit sends its own traps and SNMP manager systems can use SNMP get
commands to query each cluster unit separately. To set SNMP get queries to each cluster unit
you must create a special get command that includes the serial number of the cluster unit.
Alternatively you can use the HA reserved management interface feature to give each cluster
unit a different management IP address. Then you can create an SNMP get command for each
cluster unit that just includes the management IP address and does not have to include the
serial number. See Managing individual cluster units using a reserved management interface
on page 1254.
For a list of HA MIB fields and OIDs, see Fortinet MIBs on page 1520.
Fortinet Technologies Inc. Page 1264 FortiOS Handbook - High Availability for FortiOS 5.0
Table 57: SNMP field names and OIDs
Fortinet Technologies Inc. Page 1265 FortiOS Handbook - High Availability for FortiOS 5.0
Table 57: SNMP field names and OIDs
Fortinet Technologies Inc. Page 1266 FortiOS Handbook - High Availability for FortiOS 5.0
To get the CPU usage for a subordinate unit
The following SNMP get command gets the CPU usage for a subordinate unit in a
FortiGate-5001SX cluster. The subordinate unit has serial number FG50012205400050. The
community name is public. The IP address of the FortiGate interface is 10.10.10.1. The HA
status table MIB field is fgHaStatsCpuUsage and the OID for this MIB field is
1.3.6.1.4.1.12356.101.13.2.1.1.3.1. The first command uses the MIB field name and the second
uses the OID for this table:
snmpget -v2c -c public-FG50012205400050 10.10.10.1 fgHaStatsCpuUsage
snmpget -v2c -c public-FG50012205400050 10.10.10.1
1.3.6.1.4.1.12356.101.13.2.1.1.3.1
FortiGate SNMP recognizes the community name with syntax
<community_name>-<fgt_serial>. When the primary unit receives an SNMP get request
that includes the community name followed by serial number, the FGCP extracts the serial
number from the request. Then the primary unit redirects the SNMP get request to the cluster
unit with that serial number. If the serial number matches the serial number of the primary unit,
the SNMP get is processed by the primary unit.
Fortinet Technologies Inc. Page 1267 FortiOS Handbook - High Availability for FortiOS 5.0
See To get CPU, memory, and network usage of each cluster unit using the reserved
management IP addresses on page 1258.
You can configure file quarantine for a cluster in the same way as configuring file quarantine for
a standalone FortiGate unit. Quarantine configuration changes made to the cluster are shared
by all cluster units.
In an active-active cluster, both the primary unit and the subordinate units accept antivirus
sessions and may quarantine files. In an active-passive cluster, only the primary unit
quarantines files. Multiple cluster units in an active-passive cluster may have quarantined files if
different cluster units have been the primary unit.
All cluster units quarantine files separately to their own hard disk. You can go to Log&Report >
Archive Access > Quarantine to view and manage the quarantine file list for each cluster unit.
All cluster units can also quarantine files to a FortiAnalyzer unit. When you configure a
FortiAnalyzer unit to receive quarantine files from a cluster, you should add each cluster unit to
the FortiAnalyzer device configuration so that the FortiAnalyzer unit can receive quarantine files
from all cluster units.
Display the cluster members list to view the status of the FortiGate units in an operating cluster.
To display the cluster members list, go to System > Config > HA.
From the cluster members list you can also:
View HA statistics (see Viewing HA statistics on page 1271).
View and optionally change the HA configuration of the operating cluster (see Changing the
HA configuration of an operating cluster on page 1273).
View and optionally change the host name and device priority of a subordinate unit (see
Changing the subordinate unit host name and device priority on page 1273).
Disconnect a cluster unit from a cluster (see Disconnecting a cluster unit from a cluster on
page 1285).
Download the Debug log for any cluster unit. You can send this debug log file to Fortinet
Technical Support to help diagnose problems with the cluster or with individual cluster units.
Fortinet Technologies Inc. Page 1268 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 206:Example cluster members list
Download Debug Log
Up and Down
Arrows Edit
Disconnect from Cluster
View HA Statistics Display the serial number, status, and monitor information for each
cluster unit. See Viewing HA statistics on page 1271.
Up and down arrows Change the order in which cluster members are listed. The operation of
the cluster or of the units in the cluster are not affected. All that changes
is the order in which cluster units are displayed on the cluster members
list.
Cluster member Illustrations of the front panels of the cluster units. If the network jack
for an interface is shaded green, the interface is connected. Pause the
mouse pointer over each illustration to view the cluster unit host name,
serial number, and how long the unit has been operating (up time). The
list of monitored interfaces is also displayed.
Hostname The host name of the FortiGate unit. The default host name of the
FortiGate unit is the FortiGate unit serial number.
To change the primary unit host name, go to the system dashboard
and select Change beside the current host name int System
Information widget.
To change a subordinate unit host name, from the cluster members
list select the edit icon for a subordinate unit.
Priority The device priority of the cluster unit. Each cluster unit can have a
different device priority. During HA negotiation, the unit with the highest
device priority becomes the primary unit.
The device priority range is 0 to 255. The default device priority is 128.
Disconnect from Disconnect the cluster unit from the cluster. See Disconnecting a
cluster cluster unit from a cluster on page 1285.
Fortinet Technologies Inc. Page 1269 FortiOS Handbook - High Availability for FortiOS 5.0
Edit Select Edit to change a cluster unit HA configuration.
For a primary unit, select Edit to change the cluster HA
configuration. You can also change the device priority of the primary
unit.
For a primary unit in a virtual cluster, select Edit to change the virtual
cluster HA configuration. You can also change the virtual cluster 1
and virtual cluster 2 device priority of this cluster unit.
For a subordinate unit, select Edit to change the subordinate unit
host name and device priority. See Changing the subordinate unit
host name and device priority on page 1273.
For a subordinate unit in a virtual cluster, select Edit to change the
subordinate unit host name. In addition you can change the device
priority for the subordinate unit for the selected virtual cluster.
Download debug log Download an encrypted debug log to a file. You can send this debug
log file to Fortinet Technical Support to help diagnose problems with the
cluster or with individual cluster units.
If virtual domains are enabled, you can display the cluster members list to view the status of the
operating virtual clusters. The virtual cluster members list shows the status of both virtual
clusters including the virtual domains added to each virtual cluster.
To display the virtual cluster members list for an operating cluster log in as the admin
administrator, select Global Configuration and go to System > Config > HA.
Fortinet Technologies Inc. Page 1270 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 207:Example FortiGate-5001SX virtual cluster members list
Download Debug Log
Up and Down Edit
Arrows
Disconnect from Cluster
The fields and functions of the virtual cluster members list are the same as the fields and
functions described in Cluster members list on page 1268 with the following exceptions.
When you select the edit icon for a primary unit in a virtual cluster, you can change the virtual
cluster 1 and virtual cluster 2 device priority of this cluster unit and you can edit the VDOM
partitioning configuration of the cluster.
When you select the edit icon for a subordinate unit in a virtual cluster, you can change the
device priority for the subordinate unit for the selected virtual cluster.
Also, the HA cluster members list changes depending on the cluster unit. For the virtual cluster
described in the Example: virtual clustering with two VDOMs and VDOM partitioning on
page 1221 if you connect to port5 using you are connecting to 620b_ha_2 (620b_ha_2 is
displayed on the web browser title bar or in the CLI prompt).
If you connect to port1 you are connecting to 620b_ha_1 (620b_ha_2 is displayed on the web
browser title bar or in the CLI prompt).
Viewing HA statistics
From the cluster members list you can select View HA statistics to display the serial number,
status, and monitor information for each cluster unit. To view HA statistics, go to System >
Config > HA and select View HA Statistics.
Fortinet Technologies Inc. Page 1271 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 208:Example HA statistics (active-passive cluster)
Refresh every Select to control how often the web-based manager updates the HA
statistics display.
Back to HA Close the HA statistics list and return to the cluster members list.
monitor
Serial No. Use the serial number ID to identify each FortiGate unit in the cluster. The
cluster ID matches the FortiGate unit serial number.
Status Indicates the status of each cluster unit. A green check mark indicates
that the cluster unit is operating normally. A red X indicates that the
cluster unit cannot communicate with the primary unit.
Up Time The time in days, hours, minutes, and seconds since the cluster unit was
last started.
CPU Usage The current CPU status of each cluster unit. The web-based manager
displays CPU usage for core processes only. CPU usage for management
processes (for example, for HTTPS connections to the web-based
manager) is excluded.
Memory Usage The current memory status of each cluster unit. The web-based manager
displays memory usage for core processes only. Memory usage for
management processes (for example, for HTTPS connections to the
web-based manager) is excluded.
Active Sessions The number of communications sessions being processed by the cluster
unit.
Total Packets The number of packets that have been processed by the cluster unit since
it last started up.
Network The total network bandwidth being used by all of the cluster unit
Utilization interfaces.
Fortinet Technologies Inc. Page 1272 FortiOS Handbook - High Availability for FortiOS 5.0
Total Bytes The number of bytes that have been processed by the cluster unit since it
last started up.
To change the configuration settings of an operating cluster, go to System > Config > HA to
display the cluster members list. Select Edit for the master (or primary) unit in the cluster
members list to display the HA configuration page for the cluster.
You can use the HA configuration page to check and fine tune the configuration of the cluster
after the cluster is up and running. For example, if you connect or disconnect cluster interfaces
you may want to change the Port Monitor configuration.
Any changes you make on this page, with the exception of changes to the device priority, are
first made to the primary unit configuration and then synchronized to the subordinate units.
Changing the device priority only affects the primary unit.
To change the configuration settings of the primary unit in a functioning cluster with virtual
domains enabled, log in as the admin administrator, select Global Configuration and go to
System > Config > HA to display the cluster members list. Select Edit for the master (or primary)
unit in virtual cluster 1 or virtual cluster 2 to display the HA configuration page for the virtual
cluster.
You can use the virtual cluster HA configuration page to check and fine tune the configuration of
both virtual clusters after the cluster is up and running. For example, you may want to change
the Port Monitor configuration for virtual cluster 1 and virtual cluster 2 so that each virtual
cluster monitors its own interfaces.
You can also use this configuration page to move virtual domains between virtual cluster 1 and
virtual cluster 2. Usually you would distribute virtual domains between the two virtual clusters to
balance the amount of traffic being processed by each virtual cluster.
Any changes you make on this page, with the exception of changes to the device priorities, are
first made to the primary unit configuration and then synchronized to the subordinate unit.
You can also adjust device priorities to configure the role of this cluster unit in the virtual cluster.
For example, to distribute traffic to both cluster units in the virtual cluster configuration, you
would want one cluster unit to be the primary unit for virtual cluster 1 and the other cluster unit
to be the primary unit for virtual cluster 2. You can create this configuration by setting the device
priorities. The cluster unit with the highest device priority in virtual cluster 1 becomes the
primary unit for virtual cluster 1. The cluster unit with the highest device priority in virtual cluster
2 becomes the primary unit in virtual cluster 2.
To change the host name and device priority of a subordinate unit in an operating cluster, go to
System > Config > HA to display the cluster members list. Select Edit for any slave (subordinate)
unit in the cluster members list.
Fortinet Technologies Inc. Page 1273 FortiOS Handbook - High Availability for FortiOS 5.0
To change the host name and device priority of a subordinate unit in an operating cluster with
virtual domains enabled, log in as the admin administrator, select Global Configuration and go
to System > Config > HA to display the cluster members list. Select Edit for any slave
(subordinate) unit in the cluster members list.
You can change the host name (Peer) and device priority (Priority) of this subordinate unit.
These changes only affect the configuration of the subordinate unit.
The device priority is not synchronized among cluster members. In a functioning cluster you can
change device priority to change the priority of any unit in the cluster. The next time the cluster
negotiates, the cluster unit with the highest device priority becomes the primary unit.
The device priority range is 0 to 255. The default device priority is 128.
You can upgrade the FortiOS firmware running on an HA cluster in the same manner as
upgrading the firmware running on a standalone FortiGate unit. During a normal firmware
upgrade, the cluster upgrades the primary unit and all subordinate units to run the new firmware
image. The firmware upgrade takes place without interrupting communication through the
cluster.
Upgrading cluster firmware to a new major release (for example upgrading from 3.0 MRx to 4.0
MRx) is supported for clusters. Make sure you are taking an upgrade path described in the
release notes. Even so you should back up your configuration and only perform such a firmware
upgrade during a maintenance window.
To upgrade the firmware without interrupting communication through the cluster, the cluster
goes through a series of steps that involve first upgrading the firmware running on the
subordinate units, then making one of the subordinate units the primary unit, and finally
upgrading the firmware on the former primary unit. These steps are transparent to the user and
the network, but depending upon your HA configuration may result in the cluster selecting a
new primary unit.
The following sequence describes in detail the steps the cluster goes through during a firmware
upgrade and how different HA configuration settings may affect the outcome.
1. The administrator uploads a new firmware image from the web-based manager or CLI.
2. If the cluster is operating in active-active mode load balancing is turned off.
3. The cluster upgrades the firmware running on all of the subordinate units.
4. Once the subordinate units have been upgraded, a new primary unit is selected.
This primary unit will be running the new upgraded firmware.
5. The cluster now upgrades the firmware of the former primary unit.
If the age of the new primary unit is more than 300 seconds (5 minutes) greater than the age
of all other cluster units, the new primary unit continues to operate as the primary unit.
This is the intended behavior but does not usually occur because the age difference of the
cluster units is usually less than the cluster age difference margin of 300 seconds. So
instead, the cluster negotiates again to select a primary unit as described in Primary unit
selection on page 1131.
You can keep the cluster from negotiating again by reducing the cluster age difference
margin using the ha-uptime-diff-margin option. However, you should be cautious
when reducing the age or other problems may occur. For information about the cluster age
difference margin, see Cluster age difference margin (grace period) on page 1133). For
Fortinet Technologies Inc. Page 1274 FortiOS Handbook - High Availability for FortiOS 5.0
more information about changing the cluster age margin, see Changing the cluster age
difference margin on page 1133.
6. If the cluster is operating in active-active mode, load balancing is turned back on.
For various reasons you may need to downgrade the firmware that a cluster is running. You can
use the information in this section to downgrade the firmware version running on a cluster.
In most cases you can downgrade the firmware on an operating cluster using the same steps as
for a firmware upgrade. A warning message appears during the downgrade but the downgrade
usually works and after the downgrade the cluster continues operating normally with the older
firmware image.
Fortinet Technologies Inc. Page 1275 FortiOS Handbook - High Availability for FortiOS 5.0
Downgrading between some firmware versions, especially if features have changed between
the two versions, may not always work without the requirement to fix configuration issues after
the downgrade.
Only perform firmware downgrades during maintenance windows and make sure you back up
your cluster configuration before the downgrade.
If the firmware downgrade that you are planning may not work without configuration loss or
other problems, you can use the following downgrade procedure to make sure your
configuration is not lost after the downgrade.
You can backup the configuration of the primary unit by logging into the web-based manager or
CLI and following normal configuration backup procedures.
Fortinet Technologies Inc. Page 1276 FortiOS Handbook - High Availability for FortiOS 5.0
The following configuration settings are not synchronized to all cluster units:
HA override and priority
The interface configuration of the HA reserved management interface (config system
interface)
The HA reserved management interface default route (ha-mgmt-interface-gateway)
The FortiGate unit host name.
To backup these configuration settings for each cluster unit you must log into each cluster unit
and backup its configuration.
If you need to restore the configuration of the cluster including the configuration settings that
are not synchronized you should first restore the configuration of the primary unit and then
restore the configuration of each cluster unit. Alternatively you could log into each cluster unit
and manually add the configuration settings that were not restored.
If the primary unit in the cluster fails, the units in the cluster renegotiate to select a new primary
unit. Failure of the primary unit results in the following:
If SNMP is enabled, the new primary unit sends HA trap messages. The messages indicate a
cluster status change, HA heartbeat failure, and HA member down. For more info about HA
and SNMP, see Clusters and SNMP on page 1264.
If event logging is enabled and HA activity event is selected, the new primary unit records log
messages that show that the unit has become the primary unit.
If alert email is configured to send email for HA activity events, the new primary unit sends an
alert email containing the log message recorded by the event log.
The cluster contains fewer FortiGate units. The failed primary unit no longer appears on the
Cluster Members list.
The host name and serial number of the primary unit changes. You can see these changes
when you log into the web-based manager or CLI.
The cluster info displayed on the dashboard, cluster members list or from the get system
ha status command changes.
If a subordinate unit fails, the cluster continues to function normally. Failure of a subordinate unit
results in the following:
If event logging is enabled and HA activity event is selected, the primary unit records log
messages that show that a subordinate has been removed from the cluster.
If alert email is configured to send email for HA activity events, the new primary unit sends an
alert email containing the log message recorded by the event log.
The cluster contains fewer FortiGate units. The failed unit no longer appears on the Cluster
Members list.
Use the get system ha status command to display information about an HA cluster. The
command displays general HA configuration settings. The command also displays information
about how the cluster unit that you have logged into is operating in the cluster.
Usually you would log into the primary unit CLI using SSH or telnet. In this case the get
system ha status command displays information about the primary unit first, and also
displays the HA state of the primary unit (the primary unit operates in the work state). However,
Fortinet Technologies Inc. Page 1277 FortiOS Handbook - High Availability for FortiOS 5.0
if you log into the primary unit and then use the execute ha manage command to log into a
subordinate unit, (or if you use a console connection to log into a subordinate unit) the get
system status command displays information about this subordinate unit first, and also
displays the HA state of this subordinate unit. The state of a subordinate unit is work for an
active-active cluster and standby for an active-passive cluster.
For a virtual cluster configuration, the get system ha status command displays
information about how the cluster unit that you have logged into is operating in virtual cluster 1
and virtual cluster 2. For example, if you connect to the cluster unit that is the primary unit for
virtual cluster 1 and the subordinate unit for virtual cluster 2, the output of the get system ha
status command shows virtual cluster 1 in the work state and virtual cluster 2 in the standby
state. The get system ha status command also displays additional information about
virtual cluster 1 and virtual cluster 2.
The command display includes the following fields.
Fields Description
Model The FortiGate model number.
Mode The HA mode of the cluster: a-a or a-p.
Group The group ID of the cluster.
Debug The debug status of the cluster.
ses_pickup The status of session pickup: enable or disable.
load balance The status of the load-balance-all keyword: enable or disable.
Relevant to active-active clusters only.
schedule The active-active load balancing schedule. Relevant to active-active
clusters only.
Master Master displays the device priority, host name, serial number, and
Slave cluster index of the primary (or master) unit.
Slave displays the device priority, host name, serial number, and
cluster index of the subordinate (or slave, or backup) unit or units.
The list of cluster units changes depending on how you log into the
CLI. Usually you would use SSH or telnet to log into the primary unit
CLI. In this case the primary unit would be at the top the list
followed by the other cluster units.
If you use execute ha manage or a console connection to log into
a subordinate unit CLI, and then enter get system ha status
the subordinate unit that you have logged into appears at the top of
the list of cluster units.
number of vcluster The number of virtual clusters. If virtual domains are not enabled,
the cluster has one virtual cluster. If virtual domains are enabled the
cluster has two virtual clusters.
Fortinet Technologies Inc. Page 1278 FortiOS Handbook - High Availability for FortiOS 5.0
Fields Description
vcluster 1 The HA state (hello, work, or standby) and HA heartbeat IP address
Master of the cluster unit that you have logged into in virtual cluster 1. If
Slave virtual domains are not enabled, vcluster 1 displays information
for the cluster. If virtual domains are enabled, vcluster 1 displays
information for virtual cluster 1.
The HA heartbeat IP address is 169.254.0.2 if you are logged into
the primary unit of virtual cluster 1 and 169.254.0.1 if you are logged
into a subordinate unit of virtual cluster 1.
vcluster 1 also lists the primary unit (master) and subordinate
units (slave) in virtual cluster 1. The list includes the cluster index
and serial number of each cluster unit in virtual cluster 1. The cluster
unit that you have logged into is at the top of the list.
If virtual domains are not enabled and you connect to the primary
unit CLI, the HA state of the cluster unit in virtual cluster 1 is work.
The display lists the cluster units starting with the primary unit.
If virtual domains are not enabled and you connect to a subordinate
unit CLI, the HA state of the cluster unit in virtual cluster 1 is
standby. The display lists the cluster units starting with the
subordinate unit that you have logged into.
If virtual domains are enabled and you connect to the virtual cluster
1 primary unit CLI, the HA state of the cluster unit in virtual cluster 1
is work. The display lists the cluster units starting with the virtual
cluster 1 primary unit.
If virtual domains are enabled and you connect to the virtual cluster
1 subordinate unit CLI, the HA state of the cluster unit in virtual
cluster 1 is standby. The display lists the cluster units starting with
the subordinate unit that you are logged into.
vcluster 2 vcluster 2 only appears if virtual domains are enabled.
Master vcluster 2 displays the HA state (hello, work, or standby) and HA
Slave heartbeat IP address of the cluster unit that you have logged into in
virtual cluster 2. The HA heartbeat IP address is 169.254.0.2 if you
are logged into the primary unit of virtual cluster 2 and 169.254.0.1 if
you are logged into a subordinate unit of virtual cluster 2.
vcluster 2 also lists the primary unit (master) and subordinate
units (slave) in virtual cluster 2. The list includes the cluster index
and serial number of each cluster unit in virtual cluster 2. The cluster
unit that you have logged into is at the top of the list.
If you connect to the virtual cluster 2 primary unit CLI, the HA state
of the cluster unit in virtual cluster 2 is work. The display lists the
cluster units starting with the virtual cluster 2 primary unit.
If you connect to the virtual cluster 2 subordinate unit CLI, the HA
state of the cluster unit in virtual cluster 2 is standby. The display
lists the cluster units starting with the subordinate unit that you are
logged into.
Examples
The following example shows get system ha status output for a cluster of two
FortiGate-5001SX units operating in active-active mode. The cluster group ID, session pickup,
load balance all, and the load balancing schedule are all set to the default values. The device
Fortinet Technologies Inc. Page 1279 FortiOS Handbook - High Availability for FortiOS 5.0
priority of the primary unit is also set to the default value. The device priority of the subordinate
unit has been reduced to 100. The host name of the primary unit is 5001_Slot_4. The host
name of the subordinate unit in is 5001_Slot_3.
The command output was produced by connecting to the primary unit CLI (host name
5001_Slot_4).
Model: 5000
Mode: a-a
Group: 0
Debug: 0
ses_pickup: disable
load_balance: disable
schedule: round robin
Master:128 5001_Slot_4 FG50012204400045 1
Slave :100 5001_Slot_3 FG50012205400050 0
number of vcluster: 1
vcluster 1: work 169.254.0.2
Master:0 FG50012204400045
Slave :1 FG50012205400050
The following command output was produced by using execute HA manage 0 to log into the
subordinate unit CLI of the cluster shown in the previous example. The host name of the
subordinate unit is 5001_Slot_3.
Model: 5000
Mode: a-a
Group: 0
Debug: 0
ses_pickup: disable
load_balance: disable
schedule: round robin
Slave :100 5001_Slot_3 FG50012205400050 0
Master:128 5001_Slot_4 FG50012204400045 1
number of vcluster: 1
vcluster 1: work 169.254.0.2
Slave :1 FG50012205400050
Master:0 FG50012204400045
The following example shows get system ha status output for a cluster of three
FortiGate-5001 units operating in active-passive mode. The cluster group ID is set to 20 and
session pickup is enabled. Load balance all and the load balancing schedule are set to the
default value. The device priority of the primary unit is set to 200. The device priorities of the
subordinate units are set to 128 and 100. The host name of the primary unit is 5001_Slot_5.
The host names of the subordinate units are 5001_Slot_3 and 5001_Slot_4.
Model: 5000
Mode: a-p
Group: 20
Debug: 0
ses_pickup: enable
load_balance: disable
schedule: round robin
Master:200 5001_Slot_5 FG50012206400112 0
Slave :100 5001_Slot_3 FG50012205400050 1
Slave :128 5001_Slot_4 FG50012204400045 2
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master:0 FG50012206400112
Slave :1 FG50012204400045
Fortinet Technologies Inc. Page 1280 FortiOS Handbook - High Availability for FortiOS 5.0
Slave :2 FG50012205400050
The following example shows get system ha status output for a cluster of two
FortiGate-5001 units with virtual clustering enabled. This command output was produced by
logging into the primary unit for virtual cluster 1 (hostname: 5001_Slot_4, serial number
FG50012204400045).
The virtual clustering output shows that the cluster unit with host name 5001_Slot_4 and serial
number FG50012204400045 is operating as the primary unit for virtual cluster 1 and the
subordinate unit for virtual cluster 2.
For virtual cluster 1 the cluster unit that you have logged into is operating in the work state and
the serial number of the primary unit for virtual cluster 1 is FG50012204400045. For virtual
cluster 2 the cluster unit that you have logged into is operating in the standby state and the
serial number of the primary unit for virtual cluster 2 is FG50012205400050.
Model: 5000
Mode: a-p
Group: 20
Debug: 0
ses_pickup: enable
load_balance: disable
schedule: round robin
Master:128 5001_Slot_4 FG50012204400045 1
Slave :100 5001_Slot_3 FG50012205400050 0
number of vcluster: 2
vcluster 1: work 169.254.0.2
Master:0 FG50012204400045
Slave :1 FG50012205400050
vcluster 2: standby 169.254.0.1
Slave :1 FG50012204400045
Master:0 FG50012205400050
The following example shows get system ha status output for the same cluster as shown
in the previous example after using execute ha manage 0 to log into the primary unit for
virtual cluster 2 (hostname: 5001_Slot_3, serial number FG50012205400050).
Model: 5000
Mode: a-p
Group: 20
Debug: 0
ses_pickup: enable
load_balance: disable
schedule: round robin
Slave :100 5001_Slot_3 FG50012205400050 0
Master:128 5001_Slot_4 FG50012204400045 1
number of vcluster: 2
vcluster 1: standby 169.254.0.2
Slave :1 FG50012205400050
Master:0 FG50012204400045
vcluster 2: work 169.254.0.1
Master:0 FG50012205400050
Slave :1 FG50012204400045
The following example shows get system ha status output for a virtual cluster
configuration where the cluster unit with hostname: 5001_Slot_4 and serial number
FG50012204400045 is the primary unit for both virtual clusters. This command output is
produced by logging into cluster unit with host name 5001_Slot_4 and serial number
FG50012204400045.
Model: 5000
Fortinet Technologies Inc. Page 1281 FortiOS Handbook - High Availability for FortiOS 5.0
Mode: a-p
Group: 20
Debug: 0
ses_pickup: enable
load_balance: disable
schedule: round robin
Master:128 5001_Slot_4 FG50012204400045 1
Slave :100 5001_Slot_3 FG50012205400050 0
number of vcluster: 2
vcluster 1: work 169.254.0.2
Master:0 FG50012204400045
Slave :1 FG50012205400050
vcluster 2: work 169.254.0.2
Master:0 FG50012204400045
Slave :1 FG50012205400050
Even though there are two cluster indexes there is only one HA heartbeat IP address and the
HA heartbeat address is not affected by a change in the operating cluster index.
Fortinet Technologies Inc. Page 1282 FortiOS Handbook - High Availability for FortiOS 5.0
Using the execute ha manage command
When you use the CLI command execute ha manage <index_integer> to connect to the
CLI of another cluster unit, the <index_integer> that you enter is the cluster index of the unit
that you want to connect to.
Fortinet Technologies Inc. Page 1283 FortiOS Handbook - High Availability for FortiOS 5.0
Example: actual and operating cluster indexes do not match
This example shows get system ha status command output for same cluster of two
FortiGate-5001SX units. However, in this example the device priority of the cluster unit with the
serial number FG50012204400045 is increased to 200. As a result the cluster unit with the
lowest serial number becomes the primary unit. This means the actual and operating cluster
indexes of the cluster units do not match.
get system ha status
Model: 5000
Mode: a-p
Group: 0
Debug: 0
ses_pickup: disable
Master:128 5001_slot_7 FG50012205400050 0
Slave :200 5001_slot_11 FG50012204400045 1
number of vcluster: 1
vcluster 1: work 169.254.0.2
Master:1 FG50012205400050
Slave :0 FG50012204400045
The actual cluster indexes have not changed but the operating cluster indexes have. Also, the
HA heartbeat IP address displayed for vcluster 1 has changed to 169.254.0.2.
Fortinet Technologies Inc. Page 1284 FortiOS Handbook - High Availability for FortiOS 5.0
cluster. The procedure is very similar if you use telnet, or the web-based manager dashboard
CLI console.
You can use the execute ha manage command from the CLI of any cluster unit to log into the
CLI of another the cluster unit. Usually you would use this command from the CLI of the primary
unit to log into the CLI of a subordinate unit. However, if you have logged into a subordinate unit
CLI, you can use this command to log into the primary unit CLI, or the CLI of another
subordinate unit.
Using SSH or telnet or the web-based manager dashboard CLI console you can only log into
the primary unit CLI. Using a direct console connection you can log into any cluster unit. In both
cases you can use execute ha manage to connect to the CLI of other cluster units.
You log into the subordinate unit using the FGT_ha_admin administrator account. This built-in
administrator account gives you read and write permission on the subordinate unit. Normally
this built-in administrative account is not visible, however FGT_ha_admin does appear in event
log messages.
1. Use SSH to connect to the cluster and log into the primary unit CLI.
Connect to any cluster interface configured for SSH administrative access to log into the
cluster.
2. Enter the following command followed by a space and type a question mark (?):
execute ha manage
The CLI displays a list of all the subordinate units in the cluster. Each cluster unit is
numbered, starting at 1. The information displayed for each cluster unit includes the unit
serial number and the host name of the unit.
3. Complete the command with the number of the subordinate unit to log into. For example, to
log into subordinate unit 1, enter the following command:
execute ha manage 1
Press Enter to connect to and log into the CLI of the selected subordinate unit. If this
subordinate unit has a different host name, the CLI prompt changes to this host name.
You can use CLI commands to manage this subordinate unit. If you make changes to the
configuration of any cluster unit (primary or subordinate unit) these changes are
synchronized to all cluster units.
4. You can now use the execute ha manage command to connect to any other cluster unit
(including the primary unit). You can also use the exit command to return to the primary
unit CLI.
Use the following procedures to disconnect a cluster unit from a functioning cluster without
disrupting the operation of the cluster. You can disconnect a cluster unit if you need to use the
disconnected FortiGate unit for another purpose, such as to act as a standalone firewall.
You can use the following procedures for a standard cluster and for a virtual clustering
configuration. To use the following procedures from a virtual cluster you must be logged in as
the admin administrator and you must have selected Global Configuration.
When you disconnect a cluster unit you must assign an IP address and netmask to one of the
interfaces of the disconnected unit. You can disconnect any unit from the cluster even the
primary unit. After the unit is disconnected, the cluster responds as if the disconnected unit has
failed. The cluster may renegotiate and may select a new primary unit.
Fortinet Technologies Inc. Page 1285 FortiOS Handbook - High Availability for FortiOS 5.0
When the cluster unit is disconnected the HA mode is changed to standalone. In addition, all
interface IP addresses of the disconnected unit are set to 0.0.0.0 except for the interface that
you configure.
Otherwise the configuration of the disconnected unit is not changed. The HA configuration of
the disconnected unit is not changed either (except to change the HA mode to Standalone).
If you disconnect a FortiGate unit from a cluster, you can re-connect the disconnected FortiGate
unit to the cluster by setting the HA mode of the disconnected unit to match the HA mode of the
cluster. Usually the disconnected unit rejoins the cluster as a subordinate unit and the cluster
automatically synchronizes its configuration.
You do not have to change the HA password on the disconnected unit unless the HA password
has been changed after the unit was disconnected. Disconnecting a unit from a cluster does
not change the HA password.
You should make sure that the device priority of the disconnected unit is lower than the device
priority of the current primary unit. You should also make sure that the HA override CLI option
is not enabled on the disconnected unit. Otherwise, when the disconnected unit joins the
cluster, the cluster will renegotiate and the disconnected unit may become the primary unit. If
this happens, the configuration of the disconnected unit is synchronized to all other cluster
units. This configuration change might disrupt the operation of the cluster.
The following procedure assumes that the disconnected FortiGate unit is correctly physically
connected to your network and to the cluster but is not running in HA mode and not part of the
cluster.
Before you start this procedure you should note the device priority of the primary unit.
Fortinet Technologies Inc. Page 1286 FortiOS Handbook - High Availability for FortiOS 5.0
To add a disconnected FortiGate unit back to its cluster - web-based manager
1. Log into the disconnected FortiGate unit.
If virtual domains are enabled, log in as the admin administrator and select Global
Configuration.
2. Go to System > Config > HA.
3. Change Mode to match the mode of the cluster.
4. If required, change the group name and password to match the cluster.
5. Set the Device Priority lower than the device priority of the primary unit.
6. Select OK.
The disconnected FortiGate unit joins the cluster.
HA diagnose commands
You can use the following diagnose command to display a data about a cluster:
diagnose sys ha dump-by {all-xdb | all-vcluster| rcache | all-group |
memory | debug-zone | vdom | kernel | device | stat| sesync}
The example out put below is from a cluster of two FortiGate-5001Cs. In this cluster the base1
and base2 interfaces communicate the HA heartbeat and port monitoring has been added to
poort1.
Fortinet Technologies Inc. Page 1287 FortiOS Handbook - High Availability for FortiOS 5.0
all-xdb
This command displays information about the current configuration of the cluster and how its
operating. You can use the out to determine the primary unit, the state of port monitoring as well
as most cluster configuration details and status.
diagnose sys ha dump-by all-xdb
HA information.
idx=1,nxentry=2,linkfails=7,flags=0,digest=7.72.e3.2e.8e.d1...
xentry FG-5KC3E13800046 nhbdev=2,nventry=0, hops=0.
base1, 50, mac=0.9.f,bc.e.6c, neighbor=1.
id=FG-5KC3E13800084, mac=0.9.f,bc.11.18.
base2, 50, mac=0.9.f,bc.e.71, neighbor=1.
id=FG-5KC3E13800084, mac=0.9.f,bc.11.1d.
idx=0,nxentry=2,linkfails=7,flags=3,digest=7.95.b.9.a8.5d...
xentry FG-5KC3E13800084 nhbdev=2,nventry=1, hops=0.
base1, 50, mac=0.9.f,bc.11.18, neighbor=1.
id=FG-5KC3E13800046, mac=0.9.f,bc.e.6c.
base2, 50, mac=0.9.f,bc.11.1d, neighbor=1.
id=FG-5KC3E13800046, mac=0.9.f,bc.e.71.
ventry
idx=0,id=1,FG-5KC3E13800084,prio=128,0,claimed=0,override=0,fla
g=0,time=12974,mon=0
mondev=port1,50
Fortinet Technologies Inc. Page 1288 FortiOS Handbook - High Availability for FortiOS 5.0
all-vcluster
This command displays the status and configuration of the individual cluster units. You can use
the output of this command to determine the primary unit and the status of each cluster unit.
diagnose sys ha dump-by all-vcluster
HA information.
vcluster id=1, nventry=2, state=work, digest=5.f8.d1.63.4d.d2...
ventry
idx=0,id=1,FG-5KC3E13800046,prio=128,0,claimed=0,override=0,fla
g=1,time=0,mon=0
mondev=port1,50
ventry
idx=1,id=1,FG-5KC3E13800084,prio=128,0,claimed=0,override=0,fla
g=0,time=12974,mon=0
stat
This command displays some statistics about how well the cluster is functioning. Information
includes packet counts, memory use, failed links and ping failures.
diagnose sys ha dump-by stat
HA information.
packet count = 1, memory = 220.
check_linkfails = 0, linkfails = 0, check_pingsvrfails = 2822
bufcnt = -5, bufmem = 0
Fortinet Technologies Inc. Page 1289 FortiOS Handbook - High Availability for FortiOS 5.0
HA and failover protection
In FortiGate active-passive HA, the FortiGate Clustering Protocol (FGCP) provides failover
protection. This means that an active-passive cluster can provide FortiGate services even when
one of the cluster units encounters a problem that would result in complete loss of connectivity
for a stand-aloneFortiGate unit. This failover protection provides a backup mechanism that can
be used to reduce the risk of unexpected downtime, especially in a mission-critical
environment.
The FGCP supports three kinds of failover protection. Device failover automatically replaces a
failed device and restarts traffic flow with minimal impact on the network. Link failover maintains
traffic flow if a link fails. Session failover resumes communication sessions with minimal loss of
data if a device or link failover occurs.
This chapter describes how FGCP failover protection works and provides detailed NAT/Route
and Transparent mode packet flow descriptions.
This chapter contains the following sections:
About active-passive failover
About active-active failover
Device failover
HA heartbeat and communication between cluster units
Cluster virtual MAC addresses
Synchronizing the configuration
Synchronizing kernel routing tables
Synchronizing IPsec VPN SAs
Link failover (port monitoring or interface monitoring)
Subsecond failover
Remote link failover
Session failover (session pick-up)
WAN optimization and HA
Failover and attached network equipment
Monitoring cluster units for failover
NAT/Route mode active-passive cluster packet flow
Transparent mode active-passive cluster packet flow
Failover performance
To achieve failover protection in an active-passive cluster, one of the cluster units functions as
the primary unit, while the rest of the cluster units are subordinate units, operating in an active
stand-by mode. The cluster IP addresses and HA virtual MAC addresses are associated with
the cluster interfaces of the primary unit. All traffic directed at the cluster is actually sent to and
processed by the primary unit.
While the cluster is functioning, the primary unit functions as the FortiGate network security
device for the networks that it is connected to. In addition, the primary unit and subordinate
Page 1290
units use the HA heartbeat to keep in constant communication. The subordinate units report
their status to the cluster unit and receive and store connection and state table updates.
Device failure
If the primary unit encounters a problem that is severe enough to cause it to fail, the remaining
cluster units negotiate to select a new primary unit. This occurs because all of the subordinate
units are constantly waiting to negotiate to become primary units. Only the heartbeat packets
sent by the primary unit keep the subordinate units from becoming primary units. Each received
heartbeat packet resets negotiation timers in the subordinate units. If this timer is allowed to run
out because the subordinate units do not receive heartbeat packets from the primary unit, the
subordinate units assume that the primary unit has failed, and negotiate to become primary
units themselves.
Using the same FGCP negotiation process that occurs when the cluster starts up, after they
determine that the primary unit has failed, the subordinate units negotiate amongst themselves
to select a new primary unit. The subordinate unit that wins the negotiation becomes the new
primary unit with the same MAC and IP addresses as the former primary unit. The new primary
unit then sends gratuitous ARP packets out all of its interfaces to inform attached switches to
send traffic to the new primary unit. Sessions then resume with the new primary unit.
Link failure
If a primary unit interface fails or is disconnected while a cluster is operation, a link failure
occurs. When a link failure occurs the cluster units negotiate to select a new primary unit. Since
the primary unit has not stopped operating, it participates in the negotiation. The link failure
means that a new primary unit must be selected and the cluster unit with the link failure joins the
cluster as a subordinate unit.
Just as for a device failover, the new primary unit sends gratuitous arp packets out all of its
interfaces to inform attached switches to send traffic to it. Sessions then resume with the new
primary unit.
If a subordinate unit experiences a device failure its status in the cluster does not change.
However, in future negotiations a cluster unit with a link failure is unlikely to become the primary
unit.
Session failover
If you enable session failover (also called session pickup) for the cluster, during cluster
operation the primary unit informs the subordinate units of changes to the primary unit
connection and state tables, keeping the subordinate units up-to-date with the traffic currently
being processed by the cluster.
After a failover the new primary unit recognizes open sessions that were being handled by the
cluster. The sessions continue to be processed by the new primary unit and are handled
according to their last known state.
If you leave session pickup disabled, the cluster does not keep track of sessions and after a
failover, active sessions have to be restarted or resumed.
Fortinet Technologies Inc. Page 1291 FortiOS Handbook - High Availability for FortiOS 5.0
About active-active failover
Device failover
The FGCP provides transparent device failover. Device failover is a basic requirement of any
highly available system. Device failover means that if a device fails, a replacement device
automatically takes the place of the failed device and continues operating in the same manner
as the failed device.
In the case of FortiOS HA, the device is the primary unit. If the primary unit fails, device failover
ensures that one of the subordinate units in the cluster automatically takes the place of the
primary unit and can continue processing network traffic in the same way as the failed primary
unit.
Device failover does not maintain communication sessions. After a device failover,
communication sessions have to be restarted. To maintain communication sessions, you must
enable session failover. See Session failover (session pick-up) on page 1330.
Fortinet Technologies Inc. Page 1292 FortiOS Handbook - High Availability for FortiOS 5.0
that the switches send packets to the new primary unit, the new primary unit interfaces send
gratuitous ARP packets to the connected switches. These gratuitous ARP packets notify the
switches that the primary unit MAC and IP addresses are on different switch ports and cause
the switches to send packets to the ports connected to the new primary unit. In this way, the
new primary unit continues to receive packets that would otherwise have been sent to the failed
primary unit.
Configuration synchronization means that the new primary unit always has the same
configuration as the failed primary unit. As a result the new primary unit operates in exactly the
same way as the failed primary unit. If configuration synchronization were not available the new
primary unit may not process network traffic in the same way as the failed primary unit.
Route synchronization synchronizes the primary unit routing table to all subordinate units so
that after a failover the new primary unit does not have to form a completely new routing table.
IPsec VPN SA synchronization synchronizes IPsec VPN security associations (SAs) and other
IPsec session data so that after a failover the new primary unit can resume IPsec tunnels
without having to establish new SAs.
The HA heartbeat keeps cluster units communicating with each other. The heartbeat consists of
hello packets that are sent at regular intervals by the heartbeat interface of all cluster units.
These hello packets describe the state of the cluster unit and are used by other cluster units to
keep all cluster units synchronized.
HA heartbeat packets are non-TCP packets that use Ethertype values 0x8890, 0x8891, and
0x8890. The default time interval between HA heartbeats is 200 ms. The FGCP uses link-local
IP4 addresses in the 169.254.0.x range for HA heartbeat interface IP addresses.
For best results, isolate the heartbeat devices from your user networks by connecting the
heartbeat devices to a separate switch that is not connected to any network. If the cluster
consists of two FortiGate units you can connect the heartbeat device interfaces directly using a
crossover cable. Heartbeat packets contain sensitive information about the cluster
configuration. Heartbeat packets may also use a considerable amount of network bandwidth.
For these reasons, it is preferable to isolate heartbeat packets from your user networks.
On startup, a FortiGate unit configured for HA operation broadcasts HA heartbeat hello packets
from its HA heartbeat interface to find other FortiGate units configured to operate in HA mode. If
two or more FortiGate units operating in HA mode connect with each other, they compare HA
configurations (HA mode, HA password, and HA group ID). If the HA configurations match, the
units negotiate to form a cluster.
While the cluster is operating, the HA heartbeat confirms that all cluster units are functioning
normally. The heartbeat also reports the state of all cluster units, including the communication
sessions that they are processing.
Heartbeat interfaces
A heartbeat interface is an Ethernet network interface in a cluster that is used by the FGCP for
HA heartbeat communications between cluster units.
Fortinet Technologies Inc. Page 1293 FortiOS Handbook - High Availability for FortiOS 5.0
To change the HA heartbeat configuration go to System > Config > HA and select the FortiGate
interfaces to use as HA heartbeat interfaces.
Do not use a switch port for the HA heartbeat traffic. This configuration is not supported.
From the CLI enter the following command to make port4 and port5 HA heartbeat interfaces
and give both interfaces a heartbeat priority of 150:
config system ha
set hbdev port4 150 port5 150
end
The following example shows how to change the default heartbeat interface configuration so
that the port4 and port1 interfaces can be used for HA heartbeat communication and to give the
port4 interface the highest heartbeat priority so that port4 is the preferred HA heartbeat
interface.
config system ha
set hbdev port4 100 port1 50
end
By default, for most FortiGate models two interfaces are configured to be heartbeat interfaces.
You can change the heartbeat interface configuration as required. For example you can select
additional or different heartbeat interfaces. You can also select only one heartbeat interface.
In addition to selecting the heartbeat interfaces, you also set the Priority for each heartbeat
interface. In all cases, the heartbeat interface with the highest priority is used for all HA
heartbeat communication. If the interface fails or becomes disconnected, the selected
heartbeat interface that has the next highest priority handles all heartbeat communication.
If more than one heartbeat interface has the same priority, the heartbeat interface with the
highest priority that is also highest in the heartbeat interface list is used for all HA heartbeat
communication. If this interface fails or becomes disconnected, the selected heartbeat interface
with the highest priority that is next highest in the list handles all heartbeat communication.
The default heartbeat interface configuration sets the priority of two heartbeat interfaces to 50.
You can accept the default heartbeat interface configuration if one or both of the default
heartbeat interfaces are connected. You can select different heartbeat interfaces, select more
heartbeat interfaces and change heartbeat priorities according to your requirements.
For the HA cluster to function correctly, you must select at least one heartbeat interface and this
interface of all of the cluster units must be connected together. If heartbeat communication is
interrupted and cannot failover to a second heartbeat interface, the cluster units will not be able
to communicate with each other and more than one cluster unit may become a primary unit. As
a result the cluster stops functioning normally because multiple devices on the network may be
operating as primary units with the same IP and MAC addresses creating a kind if split brain
scenario.
The heartbeat interface priority range is 0 to 512. The default priority when you select a new
heartbeat interface is 0. The higher the number the higher the priority.
In most cases you can maintain the default heartbeat interface configuration as long as you can
connect the heartbeat interfaces together. Configuring HA heartbeat interfaces is the same for
virtual clustering and for standard HA clustering.
You can enable heartbeat communications for physical interfaces, but not for VLAN
subinterfaces, IPsec VPN interfaces, redundant interfaces, or for 802.3ad aggregate interfaces.
You cannot select these types of interfaces in the heartbeat interface list.
Fortinet Technologies Inc. Page 1294 FortiOS Handbook - High Availability for FortiOS 5.0
Selecting more heartbeat interfaces increases reliability. If a heartbeat interface fails or is
disconnected, the HA heartbeat fails over to the next heartbeat interface.
You can select up to 8 heartbeat interfaces. This limit only applies to FortiGate units with more
than 8 physical interfaces.
HA heartbeat traffic can use a considerable amount of network bandwidth. If possible, enable
HA heartbeat traffic on interfaces used only for HA heartbeat traffic or on interfaces connected
to less busy networks.
Fortinet Technologies Inc. Page 1295 FortiOS Handbook - High Availability for FortiOS 5.0
Interface index and display order
The web-based manager and CLI display interface names in alphanumeric order. For example,
the sort order for a FortiGate unit with 10 interfaces (named port1 through port10) places port10
at the bottom of the list:
port1
port2 through 9
port10
However, interfaces are indexed in hash map order, rather than purely by alphabetic order or
purely by interface number value comparisons. As a result, the list is sorted primarily
alphabetical by interface name (for example, base1 is before port1), then secondarily by index
numbers:
port1
port10
port2 through port9
You can also use the execute traceroute command from the subordinate unit CLI to
display HA heartbeat IP addresses and the HA inter-VDOM link IP addresses. For example, use
execute ha manage 1 to connect to the subordinate unit CLI and then enter the following
command to trace the route to an IP address on your network:
execute traceroute 172.20.20.10
traceroute to 172.20.20.10 (172.20.20.10), 32 hops max, 72 byte packets
1 169.254.0.1 0 ms 0 ms 0 ms
2 169.254.0.66 0 ms 0 ms 0 ms
3 172.20.20.10 0 ms 0 ms 0 ms
Fortinet Technologies Inc. Page 1296 FortiOS Handbook - High Availability for FortiOS 5.0
Both HA heartbeat and data traffic are supported on the same FortiGate interface. All heartbeat
communication takes place on a separate VDOM called vsys_ha. Heartbeat traffic uses a virtual
interface called port_ha in the vsys_ha VDOM. Data and heartbeat traffic use the same physical
interface, but theyre logically separated into separate VDOMs.
Fortinet Technologies Inc. Page 1297 FortiOS Handbook - High Availability for FortiOS 5.0
For example, use the following command to change the Ethertype of the HA heartbeat packets
from 0x8890 to 0x8895 and to change the Ethertype of HA Telnet session packets from 0x8891
to 0x889f:
config system ha
set ha-eth-type 8895
set l2ep-eth-type 889f
end
Fortinet Technologies Inc. Page 1298 FortiOS Handbook - High Availability for FortiOS 5.0
The HA heartbeat packets consume more bandwidth if the heartbeat interval is short. But if the
heartbeat interval is very long, the cluster is not as sensitive to topology and other network
changes.
Use the following CLI command to increase the heartbeat interval to 10:
config system ha
set hb-interval 10
end
The heartbeat interval combines with the lost heartbeat threshold to set how long a cluster unit
waits before assuming that another cluster unit has failed and is no longer sending heartbeat
packets. By default, if a cluster unit does not receive a heartbeat packet from a cluster unit for 6
* 200 = 1200 milliseconds or 1.2 seconds the cluster unit assumes that the other cluster unit has
failed.
You can increase both the heartbeat interval and the lost heartbeat threshold to reduce false
positives. For example, increasing the heartbeat interval to 20 and the lost heartbeat threshold
to 30 means a failure will be assumed if no heartbeat packets are received after 30 * 2000
milliseconds = 60,000 milliseconds, or 60 seconds.
Use the following CLI command to increase the heartbeat interval to 20 and the lost heartbeat
threshold to 30:
config system ha
set hb-lost-threshold 20
set hb-interval 30
end
Fortinet Technologies Inc. Page 1299 FortiOS Handbook - High Availability for FortiOS 5.0
If HA heartbeat packets are not encrypted the cluster password and changes to the cluster
configuration could be exposed and an attacker may be able to sniff HA packets to get cluster
information. Enabling HA heartbeat message authentication prevents an attacker from creating
false HA heartbeat messages. False HA heartbeat messages could affect the stability of the
cluster.
HA heartbeat encryption and authentication are disabled by default. Enabling HA encryption
and authentication could reduce cluster performance. Use the following CLI command to
enable HA heartbeat encryption and authentication.
config system ha
set authentication enable
set encryption enable
end
HA authentication and encryption uses AES-128 for encryption and SHA1 for authentication.
When a cluster is operating, the FGCP assigns virtual MAC addresses to each primary unit
interface. HA uses virtual MAC addresses so that if a failover occurs, the new primary unit
interfaces will have the same virtual MAC addresses and IP addresses as the failed primary unit.
As a result, most network equipment would identify the new primary unit as the exact same
device as the failed primary unit.
If the MAC addresses changed after a failover, the network would take longer to recover
because all attached network devices would have to learn the new MAC addresses before they
could communicate with the cluster.
If a cluster is operating in NAT/Route mode, the FGCP assigns a different virtual MAC address
to each primary unit interface. VLAN subinterfaces are assigned the same virtual MAC address
as the physical interface that the VLAN subinterface is added to. Redundant interfaces or
802.3ad aggregate interfaces are assigned the virtual MAC address of the first interface in the
redundant or aggregate list.
If a cluster is operating in Transparent mode, the FGCP assigns a virtual MAC address for the
primary unit management IP address. Since you can connect to the management IP address
from any interface, all of the FortiGate interfaces appear to have the same virtual MAC address.
A MAC address conflict can occur if two clusters are operating on the same network. See
Diagnosing packet loss with two FortiGate HA clusters in the same broadcast domain on
page 1305 for more information.
Subordinate unit MAC addresses do not change. You can verify this by connecting to the
subordinate unit CLI and using the get hardware interface nic command to display the
MAC addresses of each FortiGate interface.
When the new primary unit is selected after a failover, the primary unit sends gratuitous ARP
packets to update the devices connected to the cluster interfaces (usually layer-2 switches) with
the virtual MAC address. Gratuitous ARP packets configure connected network devices to
associate the cluster virtual MAC addresses and cluster IP address with primary unit physical
interfaces and with the layer-2 switch physical interfaces. This is sometimes called using
gratuitous ARP packets (sometimes called GARP packets) to train the network. The gratuitous
Fortinet Technologies Inc. Page 1300 FortiOS Handbook - High Availability for FortiOS 5.0
ARP packets sent from the primary unit are intended to make sure that the layer-2 switch
forwarding databases (FDBs) are updated as quickly as possible.
Sending gratuitous ARP packets is not required for routers and hosts on the network because
the new primary unit will have the same MAC and IP addresses as the failed primary unit.
However, since the new primary unit interfaces are connected to different switch interfaces than
the failed primary unit, many network switches will update their FDBs more quickly after a
failover if the new primary unit sends gratuitous ARP packets.
Changing how the primary unit sends gratuitous ARP packets after a failover
When a failover occurs it is important that the devices connected to the primary unit update
their FDBs as quickly as possible to reestablish traffic forwarding.
Depending on your network configuration, you may be able to change the number of gratuitous
ARP packets and the time interval between ARP packets to reduce the cluster failover time.
You cannot disable sending gratuitous ARP packets, but you can use the following command to
change the number of packets that are sent. For example, enter the following command to send
20 gratuitous ARP packets:
config system ha
set arps 20
end
You can use this command to configure the primary unit to send from 1 to 60 ARP packets.
Usually you would not change the default setting of 5. In some cases, however, you might want
to reduce the number of gratuitous ARP packets. For example, if your cluster has a large
number of VLAN interfaces and virtual domains and because gratuitous ARP packets are
broadcast, sending a higher number gratuitous ARP packets may generate a lot of network
traffic. As long as the cluster still fails over successfully, you could reduce the number of
gratuitous ARP packets that are sent to reduce the amount of traffic produced after a failover.
If failover is taking longer that expected, you may be able to reduce the failover time by
increasing the number gratuitous ARP packets sent.
You can also use the following command to change the time interval in seconds between
gratuitous ARP packets. For example, enter the following command to change the time
between ARP packets to 3 seconds:
config system ha
set arps-interval 3
end
The time interval can be in the range of 1 to 20 seconds. The default is 8 seconds between
gratuitous ARP packets. Normally you would not need to change the time interval. However,
you could decrease the time to be able send more packets in less time if your cluster takes a
long time to failover.
There may also be a number of reasons to set the interval higher. For example, if your cluster
has a large number of VLAN interfaces and virtual domains and because gratuitous ARP
packets are broadcast, sending gratuitous ARP packets may generate a lot of network traffic.
As long as the cluster still fails over successfully you could increase the interval to reduce the
amount of traffic produced after a failover.
For more information about gratuitous ARP packets see RFC 826 and RFC 3927.
Fortinet Technologies Inc. Page 1301 FortiOS Handbook - High Availability for FortiOS 5.0
Disabling gratuitous ARP packets after a failover
You can use the following command to turn off sending gratuitous ARP packets after a failover:
config system ha
set gratuitous-arps disable
end
Sending gratuitous ARP packets is turned on by default.
In most cases you would want to send gratuitous ARP packets because its a reliable way for the
cluster to notify the network to send traffic to the new primary unit. However, in some cases,
sending gratuitous ARP packets may be less optimal. For example, if you have a cluster of
FortiGate units in Transparent mode, after a failover the new primary unit will send gratuitous
ARP packets to all of the addresses in its Forwarding Database (FDB). If the FDB has a large
number of addresses it may take extra time to send all the packets and the sudden burst of
traffic could disrupt the network.
If you choose to disable sending gratuitous ARP packets you must first enable the
link-failed-signal setting. The cluster must have some way of informing attached
network devices that a failover has occurred.
For more information about the link-failed-signal setting, see Updating MAC forwarding
tables when a link failover occurs on page 1323.
0 00
1 01
2 02
3 03
4 04
... ...
10 0a
11 0b
... ...
63 3f
Fortinet Technologies Inc. Page 1302 FortiOS Handbook - High Availability for FortiOS 5.0
Table 58: HA group ID in integer and hexadecimal format
... ...
255 ff
<vcluster_integer> is 0 for virtual cluster 1 and 2 for virtual cluster 2. If virtual domains are
not enabled, HA sets the virtual cluster to 1 and by default all interfaces are in the root virtual
domain. Including virtual cluster and virtual domain factors in the virtual MAC address formula
means that the same formula can be used whether or not virtual domains and virtual clustering
is enabled.
<idx> is the index number of the interface. Interfaces are numbered from 0 to x (where x is the
number of interfaces). Interfaces are numbered according to their has map order. See Interface
index and display order on page 1296. The first interface has an index of 0. The second
interface in the list has an index of 1 and so on.
Only the <idx> part of the virtual MAC address is different for each interface. The
<vcluster_integer> would be different for different interfaces if multiple VDOMs have been
added.
Between FortiOS releases interface indexing may change so the virtual MAC addresses
assigned to individual FortiGate interfaces may also change.
Fortinet Technologies Inc. Page 1303 FortiOS Handbook - High Availability for FortiOS 5.0
If the group ID is changed to 34 these virtual MAC addresses change to:
port1 virtual MAC: 00-09-0f-09-22-00
port10 virtual MAC: 00-09-0f-09-22-01
port2 virtual MAC: 00-09-0f-09-22-02
port3 virtual MAC: 00-09-0f-09-22-03
port4 virtual MAC: 00-09-0f-09-22-04
port5 virtual MAC: 00-09-0f-09-22-05
port6 virtual MAC: 00-09-0f-09-22-06
port7 virtual MAC: 00-09-0f-09-22-07
port8 virtual MAC: 00-09-0f-09-22-08
port9 virtual MAC: 00-09-0f-09-22-09
port11 virtual MAC: 00-09-0f-09-22-0a
port12 virtual MAC: 00-09-0f-09-22-0b
A cluster with virtual domains enabled where the HA group ID has been changed to 23, port5
and port 6 are in the root virtual domain (which is in virtual cluster1), and port7 and port8 are in
the vdom_1 virtual domain (which is in virtual cluster 2) would have the following virtual MAC
addresses:
port5 interface virtual MAC: 00-09-0f-09-23-05
port6 interface virtual MAC: 00-09-0f-09-23-06
port7 interface virtual MAC: 00-09-0f-09-23-27
port8 interface virtual MAC: 00-09-0f-09-23-28
Fortinet Technologies Inc. Page 1304 FortiOS Handbook - High Availability for FortiOS 5.0
The command displays a great deal of information about the interface so you may have to scroll
the output to find the hardware addresses.
You can also use the diagnose hardware deviceinfo nic <interface_str>
command to display both MAC addresses for any FortiGate interface.
Before HA configuration the current and permanent hardware addresses are the same. For
example for one of the units in Cluster_1:
FGT60B3907503171 # get hardware nic internal
.
.
.
MAC: 02:09:0f:78:18:c9
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
During HA operation the current hardware address becomes the HA virtual MAC address, for
example for the units in Cluster_1:
FGT60B3907503171 # get hardware nic internal
.
.
.
MAC: 00:09:0f:09:00:02
Permanent_HWaddr: 02:09:0f:78:18:c9
.
.
.
The following command output for Cluster_2 shows the same current hardware address for
port1 as for the internal interface of Cluster_2, indicating a MAC address conflict.
FG300A2904500238 # get hardware nic port1
.
.
.
MAC: 00:09:0f:09:00:02
Permanent_HWaddr: 00:09:0F:85:40:FD
.
.
.
Diagnosing packet loss with two FortiGate HA clusters in the same broadcast
domain
A network may experience packet loss when two FortiGate HA clusters have been deployed in
the same broadcast domain. Deploying two HA clusters in the same broadcast domain can
result in packet loss because of MAC address conflicts. The packet loss can be diagnosed by
pinging from one cluster to the other or by pinging both of the clusters from a device within the
Fortinet Technologies Inc. Page 1305 FortiOS Handbook - High Availability for FortiOS 5.0
broadcast domain. You can resolve the MAC address conflict by changing the HA Group ID
configuration of the two clusters. The HA Group ID is sometimes also called the Cluster ID.
This section describes a topology that can result in packet loss, how to determine if packets are
being lost, and how to correct the problem by changing the HA Group ID.
Packet loss on a network can also be caused by IP address conflicts. Finding and fixing IP
address conflicts can be difficult. However, if you are experiencing packet loss and your
network contains two FortiGate HA clusters you can use the information in this article to
eliminate one possible source of packet loss.
Example topology
The topology below shows two clusters. The Cluster_1 internal interfaces and the Cluster_2
port 1 interfaces are both connected to the same broadcast domain. In this topology the
broadcast domain could be an internal network. Both clusters could also be connected to the
Internet or to different networks.
t1
3
or
t
3 por
P
rt
2
po
t2
er
al
or
st
rn
P
te
Clu
In
h
t1
itc
or
1
w
an
P
w
L2
2 an
an w
1
er
w
al
st
rn
te
Clu
In
1
an
w
Fortinet Technologies Inc. Page 1306 FortiOS Handbook - High Availability for FortiOS 5.0
To test for packet loss you can set up two constant ping sessions, one to each cluster. If packet
loss is occurring the two ping sessions should show alternating replies and timeouts from each
cluster.
Cluster_1 Cluster_2
reply timeout
reply timeout
reply timeout
timeout reply
timeout reply
reply timeout
reply timeout
timeout reply
timeout reply
timeout reply
timeout reply
The FGCP uses a combination of incremental and periodic synchronization to make sure that
the configuration of all cluster units is synchronized to that of the primary unit.
Fortinet Technologies Inc. Page 1307 FortiOS Handbook - High Availability for FortiOS 5.0
The primary unit synchronizes all other configuration settings, including the other HA
configuration settings.
Incremental synchronization
When you log into the cluster web-based manager or CLI to make configuration changes, you
are actually logging into the primary unit. All of your configuration changes are first made to the
primary unit. Incremental synchronization then immediately synchronizes these changes to all of
the subordinate units.
When you log into a subordinate unit CLI (for example using execute ha manage) all of the
configuration changes that you make to the subordinate unit are also immediately synchronized
to all cluster units, including the primary unit, using the same process.
Incremental synchronization also synchronizes other dynamic configuration information such as
the DHCP server address lease database, routing table updates, IPsec SAs, MAC address
tables, and so on. See FortiGate HA compatibility with PPPoE and DHCP on page 1142 for
more information about DHCP server address lease synchronization and Synchronizing kernel
routing tables on page 1315 for information about routing table updates.
Whenever a change is made to a cluster unit configuration, incremental synchronization sends
the same configuration change to all other cluster units over the HA heartbeat link. An HA
Fortinet Technologies Inc. Page 1308 FortiOS Handbook - High Availability for FortiOS 5.0
synchronization process running on the each cluster unit receives the configuration change and
applies it to the cluster unit. The HA synchronization process makes the configuration change
by entering a CLI command that appears to be entered by the administrator who made the
configuration change in the first place.
Synchronization takes place silently, and no log messages are recorded about the
synchronization activity. However, log messages can be recorded by the cluster units when the
synchronization process enters CLI commands. You can see these log messages on the
subordinate units if you enable event logging and set the minimum severity level to Information
and then check the event log messages written by the cluster units when you make a
configuration change.
You can also see these log messages on the primary unit if you make configuration changes
from a subordinate unit.
Periodic synchronization
Incremental synchronization makes sure that as an administrator makes configuration changes,
the configurations of all cluster units remain the same. However, a number of factors could
cause one or more cluster units to go out of sync with the primary unit. For example, if you add
a new unit to a functioning cluster, the configuration of this new unit will not match the
configuration of the other cluster units. Its not practical to use incremental synchronization to
change the configuration of the new unit.
Periodic synchronization is a mechanism that looks for synchronization problems and fixes
them. Every minute the cluster compares the configuration file checksum of the primary unit
with the configuration file checksums of each of the subordinate units. If all subordinate unit
checksums are the same as the primary unit checksum, all cluster units are considered
synchronized.
If one or more of the subordinate unit checksums is not the same as the primary unit checksum,
the subordinate unit configuration is considered out of sync with the primary unit. The
checksum of the out of sync subordinate unit is checked again every 15 seconds. This
re-checking occurs in case the configurations are out of sync because an incremental
configuration sequence has not completed. If the checksums do not match after 5 checks the
subordinate unit that is out of sync retrieves the configuration from the primary unit. The
subordinate unit then reloads its configuration and resumes operating as a subordinate unit with
the same configuration as the primary unit.
The configuration of the subordinate unit is reset in this way because when a subordinate unit
configuration gets out of sync with the primary unit configuration there is no efficient way to
determine what the configuration differences are and to correct them. Resetting the subordinate
unit configuration becomes the most efficient way to resynchronize the subordinate unit.
Synchronization requires that all cluster units run the same FortiOS firmware build. If some
cluster units are running different firmware builds, then unstable cluster operation may occur
and the cluster units may not be able to synchronize correctly.
Re-installing the firmware build running on the primary unit forces the primary unit to upgrade
all cluster units to the same firmware build.
Fortinet Technologies Inc. Page 1309 FortiOS Handbook - High Availability for FortiOS 5.0
Console messages when configuration synchronization succeeds
When a cluster first forms, or when a new unit is added to a cluster as a subordinate unit, the
following messages appear on the CLI console to indicate that the unit joined the cluster and
had its configuring synchronized with the primary unit.
slave's configuration is not in sync with master's, sequence:0
slave's configuration is not in sync with master's, sequence:1
slave's configuration is not in sync with master's, sequence:2
slave's configuration is not in sync with master's, sequence:3
slave's configuration is not in sync with master's, sequence:4
slave starts to sync with master
logout all admin users
slave succeeded to sync with master
HA_SYNC_SETTING_CONFIGURATION = /data/config
0x03
HA_SYNC_SETTING_AV = 0x10
HA_SYNC_SETTING_SHARED_LIB = /data/lib/libav.so
0x12
Fortinet Technologies Inc. Page 1310 FortiOS Handbook - High Availability for FortiOS 5.0
Table 59: HA out of sync object messages and the configuration objects that they reference
HA_SYNC_SETTING_IDSUSER_RULES = /etc/idsuser.rules
0x21
HA_SYNC_SETTING_IDSCUSTOM = 0x22
HA_SYNC_SETTING_IDS_MONITOR = /bin/ipsmonitor
0x23
HA_SYNC_SETTING_IDS_SENSOR = /bin/ipsengine
0x24
HA_SYNC_SETTING_WEBLISTS = 0x30
HA_SYNC_SETTING_CONTENTFILTER = /data/cmdb/webfilter.bword
0x31
HA_SYNC_SETTING_FTGD_LRATING = /data/cmdb/webfilter.fgtd-ovrd
0x34
HA_SYNC_SETTING_EMAILLISTS =
0x40
HA_SYNC_SETTING_EMAILCONTENT = /data/cmdb/spamfilter.bword
0x41
HA_SYNC_SETTING_EMAILBWLIST = /data/cmdb/spamfilter.emailbwl
0x42
HA_SYNC_SETTING_CERT_LOCAL = /etc/cert/local
0x52
Fortinet Technologies Inc. Page 1311 FortiOS Handbook - High Availability for FortiOS 5.0
Table 59: HA out of sync object messages and the configuration objects that they reference
HA_SYNC_SETTING_DB_VER = 0x55
HA_GET_DETAIL_CSUM = 0x71
checksum
global: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77
root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57
all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5
The following command output is for a subordinate unit of the same cluster:
diagnose sys ha showcsum
is_manage_master()=0, is_root_master()=0
debugzone
global: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77
root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57
all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5
checksum
global: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77
root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57
all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5
Fortinet Technologies Inc. Page 1312 FortiOS Handbook - High Availability for FortiOS 5.0
The following example shows using this command for the primary unit of a cluster with multiple
VDOMs. Two VDOMs have been added named test and Eng_vdm.
From the primary unit:
config global
sys ha showcsum
is_manage_master()=1, is_root_master()=1
debugzone
global: 65 75 88 97 2d 58 1b bf 38 d3 3d 52 5b 0e 30 a9
test: a5 16 34 8c 7a 46 d6 a4 1e 1f c8 64 ec 1b 53 fe
root: 3c 12 45 98 69 f2 d8 08 24 cf 02 ea 71 57 a7 01
Eng_vdm: 64 51 7c 58 97 79 b1 b3 b3 ed 5c ec cd 07 74 09
all: 30 68 77 82 a1 5d 13 99 d1 42 a3 2f 9f b9 15 53
checksum
global: 65 75 88 97 2d 58 1b bf 38 d3 3d 52 5b 0e 30 a9
test: a5 16 34 8c 7a 46 d6 a4 1e 1f c8 64 ec 1b 53 fe
root: 3c 12 45 98 69 f2 d8 08 24 cf 02 ea 71 57 a7 01
Eng_vdm: 64 51 7c 58 97 79 b1 b3 b3 ed 5c ec cd 07 74 09
all: 30 68 77 82 a1 5d 13 99 d1 42 a3 2f 9f b9 15 53
From the subordinate unit:
config global
diagnose sys ha showcsum
is_manage_master()=0, is_root_master()=0
debugzone
global: 65 75 88 97 2d 58 1b bf 38 d3 3d 52 5b 0e 30 a9
test: a5 16 34 8c 7a 46 d6 a4 1e 1f c8 64 ec 1b 53 fe
root: 3c 12 45 98 69 f2 d8 08 24 cf 02 ea 71 57 a7 01
Eng_vdm: 64 51 7c 58 97 79 b1 b3 b3 ed 5c ec cd 07 74 09
all: 30 68 77 82 a1 5d 13 99 d1 42 a3 2f 9f b9 15 53
checksum
global: 65 75 88 97 2d 58 1b bf 38 d3 3d 52 5b 0e 30 a9
test: a5 16 34 8c 7a 46 d6 a4 1e 1f c8 64 ec 1b 53 fe
root: 3c 12 45 98 69 f2 d8 08 24 cf 02 ea 71 57 a7 01
Eng_vdm: 64 51 7c 58 97 79 b1 b3 b3 ed 5c ec cd 07 74 09
all: 30 68 77 82 a1 5d 13 99 d1 42 a3 2f 9f b9 15 53
Fortinet Technologies Inc. Page 1313 FortiOS Handbook - High Availability for FortiOS 5.0
2. Enter the following commands to enable debugging and display HA out of sync messages.
diagnose debug enable
diagnose debug console timestamp enable
diagnose debug application hatalk -1
diagnose debug application hasync -1
Collect the console output and compare the out of sync messages with the information in
Table 59 on page 1310.
3. Enter the following commands to turn off debugging.
diagnose debug disable
diagnose debug reset
Fortinet Technologies Inc. Page 1314 FortiOS Handbook - High Availability for FortiOS 5.0
11.Enter the following commands to start HA configuration and stop debugging:
execute ha sync start
diagnose debug disable
diagnose debug reset
In a functioning cluster, the primary unit keeps all subordinate unit kernel routing tables (also
called the forwarding information base FIB) up to date and synchronized with the primary unit.
After a failover, because of these routing table updates the new primary unit does not have to
populate its kernel routing table before being able to route traffic. This gives the new primary
unit time to rebuild its regular routing table after a failover.
Use the following command to view the regular routing table. This table contains all of the
configured routes and routes acquired from dynamic routing protocols and so on. This routing
table is not synchronized. On subordinate units this command will not produce the same output
as on the primary unit.
get router info routing-table
Use the following command to view the kernel routing table (FIB). This is the list of resolved
routes actually being used by the FortiOS kernel. The output of this command should be the
same on the primary unit and the subordinate units.
get router info kernel
This section describes how clusters handle dynamic routing failover and also describes how to
use CLI commands to control the timing of routing table updates of the subordinate unit routing
tables from the primary unit.
Fortinet Technologies Inc. Page 1315 FortiOS Handbook - High Availability for FortiOS 5.0
restart is enabled on neighbor routers, they will keep sending packets to the cluster following
the HA failover instead of removing it from the network. The neighboring routers assume that
the cluster is experiencing a graceful restart.
After the failover, the new primary unit can continue to process communication sessions using
the synchronized routing data received from the failed primary unit before the failover. This gives
the new primary unit time to update its routing table after the failover.
You can use the following commands to enable graceful restart or NSF on Cisco routers:
router ospf 1
log-adjacency-changes
nsf ietf helper strict-lsa-checking
If the cluster is running BGP, use the following command to enable graceful restart for BGP:
config router bgp
set graceful-restart enable
end
You can also add BGP neighbors and configure the cluster unit to notify these neighbors that it
supports graceful restart.
config router bgp
config neighbor
edit <neighbor_address_Ipv4>
set capability-graceful-restart enable
end
end
If the cluster is running OSPF, use the following command to enable graceful restart for OSFP:
config router ospf
set restart-mode graceful-restart
end
To make sure the new primary unit keeps its synchronized routing data long enough to acquire
new routing data, you should also increase the HA route time to live, route wait, and route hold
values to 60 using the following CLI command:
config system ha
set route-ttl 60
set route-wait 60
set route-hold 60
end
Fortinet Technologies Inc. Page 1316 FortiOS Handbook - High Availability for FortiOS 5.0
Change how long routes stay in a cluster unit routing table
Change the route-ttl time to control how long routes remain in a cluster unit routing table.
The time to live range is 0 to 3600 seconds. The default time to live is 10 seconds.
The time to live controls how long routes remain active in a cluster unit routing table after the
cluster unit becomes a primary unit. To maintain communication sessions after a cluster unit
becomes a primary unit, routes remain active in the routing table for the route time to live while
the new primary unit acquires new routes.
If route-ttl is set to 0 the primary unit must acquire all new routes before it can continue
processing traffic. By default, route-ttl is set to 10 which may mean that only a few routes
will remain in the routing table after a failover. Normally keeping route-ttl to 10 or reducing
the value to 0 is acceptable because acquiring new routes usually occurs very quickly,
especially if graceful restart is enabled, so only a minor delay is caused by acquiring new routes.
If the primary unit needs to acquire a very large number of routes, or if for other reasons, there is
a delay in acquiring all routes, the primary unit may not be able to maintain all communication
sessions.
You can increase the route time to live if you find that communication sessions are lost after a
failover so that the primary unit can use synchronized routes that are already in the routing
table, instead of waiting to acquire new routes.
Change the time the primary unit waits after receiving a routing update
Change the route-wait time to change how long the primary unit waits after receiving routing
updates before sending the updates to the subordinate units. For quick routing table updates to
occur, set route-wait to a relatively short time so that the primary unit does not hold routing
table changes for too long before updating the subordinate units.
The route-wait range is 0 to 3600 seconds. The default route-wait is 0 seconds.
Normally, because the route-wait time is 0 seconds the primary unit sends routing table
updates to the subordinate units every time its routing table changes.
Once a routing table update is sent, the primary unit waits the route-hold time before
sending the next update.
Usually routing table updates are periodic and sporadic. Subordinate units should receive these
changes as soon as possible so route-wait is set to 0 seconds. route-hold can be set to a
relatively long time because normally the next route update would not occur for a while.
In some cases, routing table updates can occur in bursts. A large burst of routing table updates
can occur if a router or a link on a network fails or changes. When a burst of routing table
updates occurs, there is a potential that the primary unit could flood the subordinate units with
routing table updates. Flooding routing table updates can affect cluster performance if a great
deal of routing information is synchronized between cluster units. Setting route-wait to a
Fortinet Technologies Inc. Page 1317 FortiOS Handbook - High Availability for FortiOS 5.0
longer time reduces the frequency of additional updates are and prevents flooding of routing
table updates from occurring.
The FGCP synchronizes IPsec security associations (SAs) between cluster members so that if a
failover occurs, the cluster can resume IPsec sessions without having to establish new SAs. The
result is improved failover performance because IPsec sessions are not interrupted to establish
new SAs. Also, establishing a large number of SAs can reduce cluster performance.
The FGCP implements slightly different synchronization mechanisms for IKEv1 and IKEv2.
Fortinet Technologies Inc. Page 1318 FortiOS Handbook - High Availability for FortiOS 5.0
Normally for IKEv2 the new primary unit could just negotiate a CHILD_SA using the
synchronized SA. However, because the sequence numbers are not up-to-date, as noted
above, the synchronized SA cannot be used and the primary unit must instead negotiate a
whole new SA.
Link failover means that if a monitored interface fails, the cluster reorganizes to reestablish a link
to the network that the monitored interface was connected to and to continue operating with
minimal or no disruption of network traffic.
You configure monitored interfaces (also called interface monitoring or port monitoring) by
selecting the interfaces to monitor as part of the cluster HA configuration.
You can monitor up to 64 interfaces.
The interfaces that you can monitor appear on the port monitor list. You can monitor all
FortiGate interfaces including redundant interfaces and 802.3ad aggregate interfaces.
You cannot monitor the following types of interfaces (you cannot select the interfaces on the
port monitor list):
FortiGate interfaces that contain an internal switch.
VLAN subinterfaces.
IPsec VPN interfaces.
Individual physical interfaces that have been added to a redundant or 802.3ad aggregate
interface.
FortiGate-5000 series backplane interfaces that have not been configured as network
interfaces.
If you are configuring a virtual cluster you can create a different port monitor configuration for
each virtual cluster. Usually for each virtual cluster you would monitor the interfaces that have
been added to the virtual domains in each virtual cluster.
Wait until after the cluster is up and running to enable interface monitoring. You do not need to
configure interface monitoring to get a cluster up and running and interface monitoring will
cause failovers if for some reason during initial setup a monitored interface has become
disconnected. You can always enable interface monitoring once you have verified that the
cluster is connected and operating properly.
You should only monitor interfaces that are connected to networks, because a failover may
occur if you monitor an unconnected interface.
Fortinet Technologies Inc. Page 1319 FortiOS Handbook - High Availability for FortiOS 5.0
To enable interface monitoring - CLI
Use the following steps to monitor the port1 and port2 interfaces of a cluster.
1. Connect to the cluster CLI.
2. Enter the following command to enable interface monitoring for port1 and port2.
configure system ha
set monitor port1 port2
end
The following example shows how to enable monitoring for the external, internal, and DMZ
interfaces.
config system ha
set monitor external internal dmz
end
With interface monitoring enabled, during cluster operation, the cluster monitors each cluster
unit to determine if the monitored interfaces are operating and connected. Each cluster unit can
detect a failure of its network interface hardware. Cluster units can also detect if its network
interfaces are disconnected from the switch they should be connected to.
Cluster units cannot determine if the switch that its interfaces are connected to is still
connected to the network. However, you can use remote IP monitoring to make sure that the
cluster unit can connect to downstream network devices. See Remote link failover on
page 1325.
Because the primary unit receives all traffic processed by the cluster, a cluster can only process
traffic from a network if the primary unit can connect to it. So, if the link between a network and
the primary unit fails, to maintain communication with this network, the cluster must select a
different primary unit; one that is still connected to the network. Unless another link failure has
occurred, the new primary unit will have an active link to the network and will be able to
maintain communication with it.
To support link failover, each cluster unit stores link state information for all monitored cluster
units in a link state database. All cluster units keep this link state database up to date by sharing
link state information with the other cluster units. If one of the monitored interfaces on one of
the cluster units becomes disconnected or fails, this information is immediately shared with all
cluster units.
Fortinet Technologies Inc. Page 1320 FortiOS Handbook - High Availability for FortiOS 5.0
In an active-active cluster after a subordinate unit link failure:
The subordinate unit with the failed monitored interface can continue processing
connections between functioning interfaces. However, the primary unit stops sending
sessions to a subordinate unit that use any failed monitored interfaces on the subordinate
unit.
If session pickup is enabled, all sessions being processed by the subordinate unit failed
interface that can be are failed over to other cluster units. Sessions that cannot be failed over
are lost and have to be restarted.
If session pickup is not enabled all sessions being processed by the subordinate unit failed
interface are lost.
Figure 210:A link failure causes a cluster to select a new primary unit
Primary Unit
Packets from
Internal network
Link Failure
Occurs
Primary Unit
Link
Failure
Packets from
Internal network
Cluster Selects
New Primary Unit
Link
Failure
Packets from
Internal network
Primary
Pi Unit
U it
If a monitored interface on the primary unit fails, the cluster renegotiates and selects the cluster
unit with the highest monitor priority to become the new primary unit. The cluster unit with the
highest monitor priority is the cluster unit with the most monitored interfaces connected to
networks.
After a link failover, the primary unit processes all traffic and all subordinate units, even the
cluster unit with the link failure, share session and link status. In addition all configuration
changes, routes, and IPsec SAs are synchronized to the cluster unit with the link failure.
Fortinet Technologies Inc. Page 1321 FortiOS Handbook - High Availability for FortiOS 5.0
In an active-active cluster, the primary unit load balances traffic to all the units in the cluster. The
cluster unit with the link failure can process connections between its functioning interfaces (for,
example if the cluster has connections to an internal, external, and DMZ network, the cluster
unit with the link failure can still process connections between the external and DMZ networks).
If a monitored interface on a subordinate unit fails, the subordinate unit shares this information
with all cluster units. The cluster does not renegotiate. The subordinate unit with the failed
monitored interface continues to function in the cluster. In an active-active cluster, the
subordinate unit can continue processing connections between functioning interfaces. The
primary unit re-distributes traffic that was being processed by the failed interface of the
subordinate unit to other cluster units. If session pickup is enabled, similar to a failover, some of
these sessions continue while others must restart. See Session failover (session pick-up) on
page 1330.
Recovery after a link failover and controlling primary unit selection (controlling
falling back to the prior primary unit)
If you find and correct the problem that caused a link failure (for example, re-connect a
disconnected network cable) the cluster updates its link state database and re-negotiates to
select a primary unit.
What happens next depends on how the cluster configuration affects primary unit selection:
The former primary unit will once again become the primary unit (falling back to becoming
the primary unit)
The primary unit will not change.
As described in Displaying cluster unit age differences on page 1134, when the link is
restored, if no options are configured to control primary unit selection and the cluster age
difference is less than 300 seconds the former primary unit will once again become the primary
unit. If the age differences are greater than 300 seconds then a new primary unit is not selected.
Since you have no control on the age difference the outcome can be unpredictable. This is not a
problem in cases where its not important which unit becomes the primary unit.
Fortinet Technologies Inc. Page 1322 FortiOS Handbook - High Availability for FortiOS 5.0
traffic received by the disconnected interface continues to be processed by the cluster after the
failover.
If you disconnect a cable from a subordinate unit interface the cluster will not renegotiate.
Fortinet Technologies Inc. Page 1323 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 211:Sample link failover scenario topology
g
rin
ito
on
ed M
b l ce
DMZ
E ter 2
In ort
n a fa
P
Network
g
rin
h
itc
ito
w
on
S
ed M
b l ce
E ter 1
In ort
n a fa
P
g
rin
h
itc
to
w
ni
S
d o
le e M
D ter 3
ab c
In ort
i s fa
h
itc
P
w
S
Internal
na ri 2
E ito ort
r
b l ng
te
Network
on P
ou
ed
R
g
rin
M
ito
ce
on
a
rf
ed M
te
b l ce
In
E er 1
In ort
n a fa
P
Example: the port1 link on FGT_1 fails t
If the port1 link on FGT_1 fails, FGT_2 becomes primary unit because it has fewer interfaces
with a link failure. If the cluster is operating in active-active mode, the cluster load balances
traffic between the internal network (port2) and the DMZ network (port3). Traffic between the
Internet (port1) and the internal network (port2) and between the Internet (port1) and the DMZ
network (port3) is processed by the primary unit only.
Subsecond failover
HA link failover supports subsecond failover (that is a failover time of less than one second).
Subsecond failover is available for interfaces that can issue a link failure system call when the
interface goes down. When an interface experiences a link failure and sends the link failure
system call, the FGCP receives the system call and initiates a link failover.
For interfaces that do not support subsecond failover, port monitoring regularly polls the
connection status of monitored interfaces. When a check finds that an interface has gone down,
port monitoring causes a link failover. Subsecond failover results in a link failure being detected
sooner because the system doesnt have to wait for the next poll to find out about the failure.
Fortinet Technologies Inc. Page 1324 FortiOS Handbook - High Availability for FortiOS 5.0
Subsecond failover requires interfaces that support sending the link failure system call. This
functionality is available for:
Interfaces with network processors (NPx)
Interfaces with content processors (CP4, CP5, CP6, etc.)
Interfaces in Fortinet Mezzanine Cards that include network and content processors
(FMC-XD2, FMC-XG2, etc.)
Accelerated interface modules (FortiGate-ASM-FB4, ADM-FB8, ADM-XB2, ADM-XD4,
RTM-XD2 etc).
Interfaces in security processor modules (FortiGate-ASM-CE4, ASM-XE2, etc)
Subsecond failover can accelerate HA failover to reduce the link failover time to less than one
second under ideal conditions. Actual failover performance may be vary depending on traffic
patterns and network configuration. For example, some network devices may respond slowly to
an HA failover.
No configuration changes are required to support subsecond failover. However, for best
subsecond failover results, the recommended heartbeat interval is 100ms and the
recommended lost heartbeat threshold is 5. (See Changing the heartbeat interval on
page 1298)
config system ha
set hb-lost-threshold 5
set hb-interval 1
end
For information about how to reduce failover times, see Failover performance on page 1340.
Remote link failover (also called remote IP monitoring) is similar to HA port monitoring and
interface dead gateway detection. Port monitoring causes a cluster to failover if a monitored
primary unit interface fails or is disconnected. Remote IP monitoring uses ping servers
configured for FortiGate interfaces on the primary unit to test connectivity with IP addresses of
network devices. Usually these would be IP addresses of network devices not directly
connected to the cluster. For example, a downstream router. Remote IP monitoring causes a
failover if one or more of these remote IP addresses does not respond to a ping server.
By being able to detect failures in network equipment not directly connected to the cluster,
remote IP monitoring can be useful in a number of ways depending on your network
configuration. For example, in a full mesh HA configuration, with remote IP monitoring, the
cluster can detect failures in network equipment that is not directly connected to the cluster but
that would interrupt traffic processed by the cluster if the equipment failed.
Fortinet Technologies Inc. Page 1325 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 212:Example HA remote IP monitoring topology
te
na
t di
n i or
U ub
S
t1
or
P
Internal
h
itc
w
Network
t2
S
or
P
nk
h
Li
itc
A
h
w
H
itc
S
w
S
itch
r
te
Link
t1
ou
Sw
or
R
P
Failure
t2
U ry
or
a
t
rim
ni
P
P
Physical
Ping Server from
Link
Primary unit
Operating
cannot Reach Monitored
Monitored IP, Remote IP
Causing HA 192.168.20.20
Failover
In the simplified example topology shown in Figure 212, the switch connected directly to the
primary unit is operating normally but the link on the other side of the switches fails. As a result
traffic can no longer flow between the primary unit and the Internet.
To detect this failure you can create a remote IP monitoring configuration consisting of a ping
server dead gateway detection configuration for port2 of the cluster. The primary unit tests
connectivity to 192.168.20.20. If the ping server cannot connect to 192.268.20.20 the cluster to
fails over and the subordinate unit becomes the new primary unit. The remote HA monitoring
ping server on the new primary unit can connect to 192.168.20.20 so the failover maintains
connectivity between the internal network and the Internet through the cluster.
Fortinet Technologies Inc. Page 1326 FortiOS Handbook - High Availability for FortiOS 5.0
2. Enter the following commands to add the ping server for the port2 interface and to set the
HA remote IP monitoring priority for this ping server.
Enter the detectserver keyword to add the ping server and set the ping server IP
address to 192.168.20.20.
Leave the ha-priority keyword set to the default value of 1. You only need to change
this priority if you change the HA ping server failover threshold.
The ha-priority setting is not synchronized among cluster units. So if you want to change
the ha-priority setting you must change it separately on each cluster unit. Otherwise it will
remain set to the default value of 1.
Use the interval keyword to set the time between ping server pings and use the
failtime keyword to set the number of times that the ping can fail before a failure is
detected (the failover threshold). The following example reduces the failover threshold to
2 but keeps the ping interval at the default value of 5.
config router gwdetect
edit port2
set server 192.168.20.20
set ha-priority 1
set interval 5
set failtime 2
end
You can also do this from the web-based manager by going to Router > Static > Settings,
selecting Create New to add a new dead gateway detection configuration, setting Ping Server
to 192.168.20.20, HA Priority to 1, Ping Interval to 5, and Failover Threshold to 2.
Fortinet Technologies Inc. Page 1327 FortiOS Handbook - High Availability for FortiOS 5.0
Then configure ping servers for each of these interfaces. In the following example, default
values are accepted for all settings other than the server IP address.
config router gwdetect
edit port2
set server 192.168.20.20
next
edit port20
set server 192.168.20.30
next
edit vlan_234
set server 172.20.12.10
end
The HA Priority (ha-priority) setting is not synchronized among cluster units. In the
following example, you must set the HA priority to 5 by logging into each cluster unit.
Fortinet Technologies Inc. Page 1328 FortiOS Handbook - High Availability for FortiOS 5.0
config router gwdetect
edit port2
set server 192.168.20.20
set ha-priority 5
next
edit port20
set server 192.168.20.30
set ha-priority 5
next
edit vlan_234
set server 172.20.12.10
set ha-priority 5
end
If only one of the ping servers fails, the total ping server HA priority will be 5, which is lower than
the failover threshold so a failover will not occur. If a second ping server fails, the total ping
server HA priority of 10 will equal the failover threshold, causing a failover.
By adding multiple ping servers to the remote HA monitoring configuration and setting the HA
priorities for each, you can fine tune remote IP monitoring. For example, if it is more important to
maintain connections to some networks you can set the HA priorities higher for these ping
servers. And if it is less important to maintain connections to other networks you can set the HA
priorities lower for these ping servers. You can also adjust the failover threshold so that if the
cluster cannot connect to one or two high priority IP addresses a failover occurs. But a failover
will not occur if the cluster cannot connect to one or two low priority IP addresses.
Flip timeout
The HA remote IP monitoring configuration also involves setting a flip timeout. The flip timeout
is required to reduce the frequency of failovers if, after a failover, HA remote IP monitoring on
the new primary unit also causes a failover. This can happen if the new primary unit cannot
connect to one or more of the monitored remote IP addresses. The result could be that until you
fix the network problem that blocks connections to the remote IP addresses, the cluster will
experience repeated failovers. You can control how often the failovers occur by setting the flip
timeout. The flip timeout stops HA remote IP monitoring from causing a failover until the primary
unit has been operating for the duration of the flip timeout.
If you set the flip timeout to a relatively high number of minutes you can find and repair the
network problem that prevented the cluster from connecting to the remote IP address without
the cluster experiencing very many failovers. Even if it takes a while to detect the problem,
repeated failovers at relatively long time intervals do not usually disrupt network traffic.
Fortinet Technologies Inc. Page 1329 FortiOS Handbook - High Availability for FortiOS 5.0
Detecting HA remote IP monitoring failovers
Just as with any HA failover, you can detect HA remote IP monitoring failovers by using SNMP
to monitor for HA traps. You can also use alert email to receive notifications of HA status
changes and monitor log messages for HA failover log messages. In addition, FortiGate units
send the critical log message Ping Server is down when a ping server fails. The log
message includes the name of the interface that the ping server has been added to.
Session failover means that a cluster maintains active network TCP and IPsec VPN sessions
(including NAT sessions) after a device or link failover. You can also configure session failover to
maintain UDP and ICMP sessions. Session failover does not failover multicast, or SSL VPN
sessions.
FortiGate HA does not support session failover by default. To enable session failover go to
System > Config > HA and select Enable Session Pick-up.
From the CLI enter:
config system ha
set session-pickup enable
end
To support session failover, when Enable Session Pick-up is selected, the FGCP maintains an
HA session table for most TCP communication sessions being processed by the cluster and
synchronizes this session table with all cluster units. If a cluster unit fails, the HA session table
information is available to the remaining cluster units and these cluster units use this session
table to resume most of the TCP sessions that were being processed by the failed cluster unit
without interruption.
If session pickup is enabled, you can use the following command to also enable UDP and ICMP
session failover:
config system ha
set session-pickup-connectionless enable
end
You must enable session pickup for session failover protection. If you do not require session
failover protection, leaving session pickup disabled may reduce CPU usage and reduce HA
heartbeat network bandwidth usage.
Fortinet Technologies Inc. Page 1330 FortiOS Handbook - High Availability for FortiOS 5.0
Some sessions may resume after a failover whether or not enable session pick-up is selected:
UDP, ICMP, multicast and broadcast packet session failover on page 1334
FortiOS Carrier GTP session failover on page 1334
Active-active HA subordinate units sessions can resume after a failover on page 1335.
Fortinet Technologies Inc. Page 1331 FortiOS Handbook - High Availability for FortiOS 5.0
Since large amounts of session synchronization traffic can increase network congestion, it is
recommended that you keep this traffic off of your network by using dedicated connections for
it.
Active-active clusters can resume some of these sessions after a failover. See Active-active
HA subordinate units sessions can resume after a failover on page 1335 for details.
If you use these features to protect most of the sessions that your cluster processes, enabling
session failover may not actually provide significant session failover protection.
TCP sessions that are not being processed by these UTM features resume after a failover even
if these sessions are accepted by security policies with UTM options configured. Only TCP
sessions that are actually being processed by these UTM features do not resume after a
failover. For example:
TCP sessions that are not virus scanned, web filtered, spam filtered, content archived, or are
not SIP, SIMPLE, or SCCP signal traffic resume after a failover, even if they are accepted by
a security policy with UTM options enabled. For example, SNMP TCP sessions resume after
a failover because FortiOS does not apply any UTM options to SNMP sessions.
TCP sessions for a protocol for which UTM features have not been enabled resume after a
failover even if they are accepted by a security policy with UTM features enabled. For
example, if you have not enabled any antivirus or content archiving settings for FTP, FTP
sessions resume after a failover.
The following UTM features do not affect TCP session failover:
IPS does not affect session failover. Sessions being scanned by IPS resume after a failover.
After a failover; however, IPS can only perform packet-based inspection of resumed
sessions; reducing the number of vulnerabilities that IPS can detect. This limitation only
applies to in-progress resumed sessions.
Application control does not affect session failover. Sessions that are being monitored by
application control resume after a failover.
Logging enabled form UTM features does not affect session failover. UTM logging writes
event log messages for UTM events; such as when a virus is found by antivirus scanning,
when Web Filtering blocks a URL, and so on. Logging does not enable features that would
prevent sessions from being failed over, logging just reports on the activities of enabled
features.
Fortinet Technologies Inc. Page 1332 FortiOS Handbook - High Availability for FortiOS 5.0
If more than one UTM feature is applied to a TCP session, that session will not resume after a
failover as long as one of the UTM features prevents session failover. For example:
Sessions being scanned by IPS and also being virus scanned do not resume after a failover.
Sessions that are being monitored by application control and that are being DLP archived or
virus scanned will not resume after a failover.
Fortinet Technologies Inc. Page 1333 FortiOS Handbook - High Availability for FortiOS 5.0
However, all sessions inside the SSL VPN tunnel that were running before the failover are
stopped and have to be restarted. For example, file transfers that were in progress would have
to be restarted. As well, any communication sessions with resources behind the FortiGate unit
that are started by an SSL VPN session have to be restarted.
To support SSL VPN cookie failover, when an SSL VPN session starts, the FGCP distributes the
cookie created to identify the SSL VPN session to all cluster units.
Fortinet Technologies Inc. Page 1334 FortiOS Handbook - High Availability for FortiOS 5.0
The limitation on packets continuing to flow is that there has to be a security policy to accept
the packets. For example, if the FortiOS Carrier unit has an internal to external security policy,
GTP UDP sessions using an established tunnel that are received by the internal interface are
accepted by the security policy and can continue to flow. However, GTP UDP packets for an
established tunnel that are received at the external interface cannot flow until packets from the
same tunnel are received at the internal interface.
If you have bi-directional policies that accept GTP UDP sessions then traffic in either direction
that uses an established tunnel can continue to flow after a failover without interruption.
It normally takes a cluster approximately 6 seconds to complete a failover. However, the actual
failover time experienced by your network users may depend on how quickly the switches
Fortinet Technologies Inc. Page 1335 FortiOS Handbook - High Availability for FortiOS 5.0
connected to the cluster interfaces accept the cluster MAC address update from the primary
unit. If the switches do not recognize and accept the gratuitous ARP packets and update their
MAC forwarding table, the failover time will increase.
Also, individual session failover depends on whether the cluster is operating in active-active or
active-passive mode, and whether the content of the traffic is to be virus scanned. Depending
on application behavior, it may take a TCP session a longer period of time (up to 30 seconds) to
recover completely.
You can use logging and SNMP to monitor cluster units for failover. Both the primary and
subordinate units can be configured to write log messages and send SNMP traps if a failover
occurs. You can also log into the cluster web-based manager and CLI to determine if a failover
has occurred. See Monitoring cluster units for failover on page 1277.
This section describes how packets are processed and how failover occurs in an active-passive
HA cluster running in NAT/Route mode. In the example, the NAT/Route mode cluster acts as the
internet firewall for a client computers internal network. The client computers default route
points at the IP address of the cluster internal interface. The client connects to a web server on
the Internet. Internet routing routes packets from the cluster external interface to the web server,
and from the web server to the cluster external interface.
In an active-passive cluster operating in NAT/Route mode, four MAC addresses are involved in
communication between the client and the web server when the primary unit processes the
connection:
Internal virtual MAC address (MAC_V_int) assigned to the primary unit internal interface,
External virtual MAC address (MAC_V_ext) assigned to the primary unit external interface,
Client MAC address (MAC_Client),
Server MAC address (MAC_Server),
In NAT/Route mode, the HA cluster works as a gateway when it responds to ARP requests.
Therefore, the client and server only know the gateway MAC addresses. The client only knows
the cluster internal virtual MAC address (MAC_V_int) and the server only know the cluster
external virtual MAC address (MAC_V_int). Cluster virtual MAC addresses are described in
Cluster virtual MAC addresses on page 1300.
Fortinet Technologies Inc. Page 1336 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 213:NAT/Route mode active-passive packet flow
Switch 1 Switch 2
HA cluster
Cluster Cluster
Internal External
Interface Interface
Client
Subordinate Unit Web
IP: 10.11.101.10
Server
MAC: MAC_Client
IP: 172.20.120.130
MAC: MAC_Server
8. The primary unit continues to process packets in this way unless a failover occurs.
Fortinet Technologies Inc. Page 1337 FortiOS Handbook - High Availability for FortiOS 5.0
4. The web server then sends response packets to the primary unit external interface.
7. The primary unit continues to process packets in this way unless a failover occurs.
This section describes how packets are processed and how failover occurs in an active-passive
HA cluster running in Transparent mode. The cluster is installed on an internal network in front
of a mail server and the client connects to the mail server through the Transparent mode cluster.
In an active-passive cluster operating in Transparent mode, two MAC addresses are involved in
the communication between a client and a server when the primary unit processes a
connection:
Client MAC address (MAC_Client)
Server MAC address (MAC_Server)
The HA virtual MAC addresses are not directly involved in communication between the client
and the server. The client computer sends packets to the mail server and the mail server sends
responses. In both cases the packets are intercepted and processed by the cluster.
Fortinet Technologies Inc. Page 1338 FortiOS Handbook - High Availability for FortiOS 5.0
The clusters presence on the network is transparent to the client and server computers. The
primary unit sends gratuitous ARP packets to Switch 1 that associate all MAC addresses on the
network segment connected to the cluster external interface with the HA virtual MAC address.
The primary unit also sends gratuitous ARP packets to Switch 2 that associate all MAC
addresses on the network segment connected to the cluster internal interface with the HA
virtual MAC address. In both cases, this results in the switches sending packets to the primary
unit interfaces.
Primary Unit
Cluster Cluster
Internal External
Interface Interface
Client Mail
Subordinate Unit Server
IP: 10.11.101.10 IP: 10.11.101.200
MAC: MAC_Client MAC: MAC_Server
8. The primary unit continues to process packets in this way unless a failover occurs.
Fortinet Technologies Inc. Page 1339 FortiOS Handbook - High Availability for FortiOS 5.0
3. The client computer responds with its MAC address (MAC_Client) which corresponds to its
IP address of 10.11.101.10. The primary unit returns the ARP response to the mail server.
4. The mail servers response packet reaches the primary unit external interface.
7. The primary unit continues to process packets in this way unless a failover occurs.
Failover performance
This section describes the designed device and link failover times for a FortiGate cluster and
also shows results of a failover performance test.
Fortinet Technologies Inc. Page 1340 FortiOS Handbook - High Availability for FortiOS 5.0
It may take another few seconds for the cluster to negotiate and re-distribute communication
sessions. Typically if subsecond failover is not enabled you can expect a failover time of 9 to 15
seconds depending on the cluster and network configuration. The failover time can also be
increased by more complex configurations and or configurations with network equipment that is
slow to respond.
You can change the hb-lost-threshold to increase or decrease the device failover time. See
Modifying heartbeat timing on page 1298 for information about using hb-lost-threshold,
and other heartbeat timing settings.
Fortinet Technologies Inc. Page 1341 FortiOS Handbook - High Availability for FortiOS 5.0
Reducing failover times
You can do the following to help reduce failover times:
Keep the network configuration as simple as possible with as few as possible network
connections to the cluster.
If possible operate the cluster in Transparent mode.
Use high-performance switches to that the switches failover to interfaces connected to the
new primary unit as quickly as possible.
Use accelerated FortiGate interfaces. In some cases accelerated interfaces will reduce
failover times.
Make sure the FortiGate unit sends multiple gratuitous arp packets after a failover. In some
cases, sending more gratuitous arp packets will cause connected network equipment to
recognize the failover sooner. To send 10 gratuitous arp packets:
config system ha
set arps 10
end
Reduce the time between gratuitous arp packets. This may also caused connected network
equipment to recognize the failover sooner. To send 50 gratuitous arp packets with 1 second
between each packet:
config system ha
set arp 50
set arps-interval 1
end
Reduce the number of lost heartbeat packets and reduce the heartbeat interval timers to be
able to more quickly detect a device failure. To set the lost heartbeat threshold to 3 packets
and the heartbeat interval to 100 milliseconds:
config system ha
set hb-interval 3
set hb-lost-threshold 1
end
Reduce the hello state hold down time to reduce the amount of the time the cluster waits
before transitioning from the hello to the work state. To set the hello state hold down time to
5 seconds:
config system ha
set helo-holddown 5
end
Enable sending a link failed signal after a link failover to make sure that attached network
equipment responds a quickly as possible to a link failure. To enable the link failed signal:
config system ha
set link-failed-signal enable
end
Fortinet Technologies Inc. Page 1342 FortiOS Handbook - High Availability for FortiOS 5.0
HA and load balancing
FGCP active-active load balancing distributes network traffic among all of the units in a cluster.
Load balancing can improve cluster performance because the processing load is shared among
multiple cluster units.
This chapter describes how active-active load balancing works and provides detailed
NAT/Route and Transparent mode packet flow descriptions.
This chapter contains the following sections:
Load balancing overview
Configuring load balancing settings
NAT/Route mode active-active cluster packet flow
Transparent mode active-active cluster packet flow
In active-active HA, the FGCP uses a technique similar to unicast load balancing in which the
primary unit is associated with the cluster HA virtual MAC addresses and cluster IP addresses.
The primary unit is the only cluster unit to receive packets sent to the cluster.
An active-active HA cluster consists of a primary unit that processes communication sessions
and one or more subordinate units that also process communication sessions. The primary unit
receives all sessions and load balances sessions for security policies with UTM enabled to all
cluster units. Communication between the cluster units uses the actual cluster unit MAC
addresses.
Processing UTM sessions can be CPU and memory-intensive, load balancing UTM traffic may
result in an active-active cluster having higher throughout than an active-passive cluster or a
standalone FortiGate unit because resource-intensive UTM processing is distributed among all
cluster units.
You can also enable the load-balance-all CLI keyword to have the primary unit load
balance all TCP sessions. Load balancing TCP sessions is less likely to improve throughput
because of extra overhead required for load balancing. So load-balance-all is disabled by
default.
You can also enable the load-balance-udp CLI keyword to have the primary unit load
balance all UDP sessions. Load balancing UDP sessions will also increase overhead so it is
disabled by default.
During active-active HA load balancing operation, when the primary unit receives the first
packet of a UTM session (or a TCP session if load-balance-all is enabled or a UDP session
of load-balance-udp is enabled) the primary unit uses the configured load balancing
schedule to determine the cluster unit that will process the session. The primary unit stores the
load balancing information for each active load balanced session in the cluster load balancing
session table. Using the information in this table, the primary unit can then forward all of the
remaining packets in each session to the appropriate cluster unit. The load balancing session
table is synchronized among all cluster units.
ICMP, multicast, and broadcast sessions are never load balanced and are always processed by
the primary unit. VoIP, IM, P2P, IPsec VPN, HTTPS, SSL VPN, HTTP multiplexing, SSL
offloading, WAN optimization, explicit web proxy, and WCCP sessions are also always
processed only by the primary unit.
Page 1343
In addition to load balancing, active-active HA also provides device and link failover protection
similar to active-passive HA. If the primary unit fails, a subordinate unit becomes the primary
unit and resumes operating the cluster. See Device failover on page 1292 and Link failover
(port monitoring or interface monitoring) on page 1319 for more information.
Active-active HA provides the same session failover protection as active-passive HA See
Session failover (session pick-up) on page 1330 more information about FortiGate session
failover and its limitations.
Active-active HA also maintains as many UTM sessions as possible after a failover by
continuing to process the UTM sessions that were being processed by the cluster units that are
still operating. See Active-active HA subordinate units sessions can resume after a failover on
page 1335 for more information. Active-passive HA does not support maintaining UTM
sessions after a failover.
None No load balancing. Select None when the cluster interfaces are
connected to load balancing switches. If you select None, the Primary
unit does not load balance traffic and the subordinate units process
incoming traffic that does not come from the Primary unit. For all other
load balancing schedules, all traffic is received first by the Primary unit,
and then forwarded to the subordinate units. The subordinate units only
receive and process packets sent from the primary unit.
Hub Load balancing if the cluster interfaces are connected to a hub. Traffic is
distributed to cluster units based on the source IP and destination IP of
the packet.
Least-Connection If the cluster units are connected using switches, select Least
Connection to distribute network traffic to the cluster unit currently
processing the fewest connections.
Round-Robin If the cluster units are connected using switches, select Round-Robin to
distribute network traffic to the next available cluster unit.
Weighted Similar to round robin, but weighted values are assigned to each of the
Round-Robin units in a cluster based on their capacity and on how many connections
they are currently processing. For example, the primary unit should have
a lower weighted value because it handles scheduling and forwards
traffic. Weighted round robin distributes traffic more evenly because
units that are not processing traffic will be more likely to receive new
connections than units that are very busy.
Random If the cluster units are connected using switches, select Random to
randomly distribute traffic to cluster units.
IP Port Load balancing according to IP address and port. If the cluster units are
connected using switches, select IP Port to distribute traffic to units in a
cluster based on the source IP, source port, destination IP, and
destination port of the packet.
Fortinet Technologies Inc. Page 1344 FortiOS Handbook - High Availability for FortiOS 5.0
Once a packet has been propagated to a subordinate unit, all packets are part of that same
communication session are also propagated to that same subordinate unit. Traffic is distributed
according to communication session, not just according to individual packet.
Any subordinate unit that receives a forwarded packet processes it, without applying load
balancing. Note that subordinate units are still considered to be active, because they perform
routing, virus scanning, and other FortiGate unit tasks on their share of the traffic. Active
subordinate units also share their session and link status information with all cluster units. The
only things that active members do not do is make load balancing decisions.
Even though the primary unit is responsible for the load balancing process, the primary unit still
acts like a FortiGate unit in that it processes packets, performing, routing, firewall, virus
scanning, and other FortiGate unit tasks on its share of the traffic. Depending on the load
balancing schedule used, the primary unit may assign itself a smaller share of the total load.
Fortinet Technologies Inc. Page 1345 FortiOS Handbook - High Availability for FortiOS 5.0
Normally you would not change the HTTPS port. However, if your network uses a proxy server
for HTTPS traffic you may have to use the config antivirus service command to
configure your cluster to use a custom HTTPS port. If your network uses a proxy server you
might also use the same port for both HTTP and HTTPS traffic. In this case you would use
config antivirus service to configure the FortiGate unit to use custom ports for both
HTTP and HTTPS traffic.
Using the same port for HTTP and HTTPS traffic can cause problems with active-active clusters
because active-active clusters always load balance HTTP traffic. If both HTTP and HTTPS use
the same port, the active-active cluster cannot tell the difference between HTTP and HTTPS
traffic and will load balance both HTTP and HTTPS traffic.
As mentioned above, load balancing HTTPS traffic may cause problems with HTTPS web
filtering. To avoid this problem, you should configure your proxy server to use different ports for
HTTP and HTTPS traffic. Then use the config antivirus service command to configure
your cluster to also use different ports for HTTP and HTTPS.
Fortinet Technologies Inc. Page 1346 FortiOS Handbook - High Availability for FortiOS 5.0
Configuring load balancing settings
This section describes how to configure the following load balancing settings:
Selecting a load balancing schedule
Load balancing UTM sessions, TCP sessions, and UDP sessions
Configuring weighted-round-robin weights
Dynamically optimizing weighted load balancing according to how busy cluster units are
Fortinet Technologies Inc. Page 1347 FortiOS Handbook - High Availability for FortiOS 5.0
Using the CLI, you can also configure the cluster to load balance UDP sessions among all
cluster units in addition to UTM sessions (and optionally TCP sessions).
Use the following command to enable load balancing UTM and UDP sessions.
config system ha
set load-balance-udp enable
end
Enabling load-balance-udp to load balance UDP sessions may not improve throughput
because the cluster requires additional overhead to load balance sessions. The primary unit
receives all sessions and load balances some UDP sessions to the subordinate units. Load
balancing UTM sessions can improve performance because UTM session performance is
limited by CPU performance. However, load balancing a non-UTM session usually requires
about as much overhead as just processing it.
If your active-active cluster is processing UDP sessions and not performing UTM, you can
enable load-balance-udp and monitor network performance to see if it improves. If
performance is not improved, you should change the HA mode to active-passive since
active-active HA is not providing any benefit.
Fortinet Technologies Inc. Page 1348 FortiOS Handbook - High Availability for FortiOS 5.0
You can use the following command to display the priority order of units in a cluster. The
following example displays the priority order for a cluster of 5 FortiGate-620B units:
get system ha status
Model: 620
Mode: a-p
Group: 0
Debug: 0
ses_pickup: disable
Master:150 head_office_cla FG600B3908600825 0
Slave :150 head_office_clb FG600B3908600705 1
Slave :150 head_office_clc FG600B3908600702 2
Slave :150 head_office_cld FG600B3908600605 3
Slave :150 head_office_cle FG600B3908600309 4
number of vcluster: 1
vcluster 1: work 169.254.0.1
Master:0 FG600B3908600825
Slave :1 FG600B3908600705
Slave :2 FG600B3908600702
Slave :3 FG600B3908600605
Slave :4 FG600B3908600309
The cluster units are listed in priority order starting at the 6th output line. The primary unit
always has the highest priority and is listed first followed by the subordinate units in priority
order. The last 5 output lines list the cluster units in vcluster 1 and are not always in priority
order. For more information about the get system ha status command, see Viewing cluster
status from the CLI on page 1277.
The default static weight for each cluster unit is 40. This means that sessions are distributed
evenly among all cluster units. You can use the weight option to change the static weights of
cluster units to distribute sessions depending on each units priority in the cluster. The weight
can be between 0 and 255. Increase the weight to increase the number of connections
processed by the cluster unit with that priority.
You set the weight for each unit separately. For the example cluster of 5 FortiGate-620B units
you can set the weight for each unit as follows:
config system ha
set mode a-a
set schedule weight-round-robin
set weight 0 5
set weight 1 10
set weight 2 15
set weight 3 20
set weight 4 30
end
If you enter the get command to view the HA configuration the output for weight would be:
weight 5 10 15 20 30 40 40 40 40 40 40 40 40 40 40 40
Fortinet Technologies Inc. Page 1349 FortiOS Handbook - High Availability for FortiOS 5.0
This configuration has the following results if the output of the get system ha status
command is that shown above:
The first five connections are processed by the primary unit (host name head_office_cla,
priority 0, weight 5). From the output of the
The next 10 connections are processed by the first subordinate unit (host name
head_office_clb, priority 1, weight 10)
The next 15 connections are processed by the second subordinate unit (host name
head_office_clc, priority 2, weight 15)
The next 20 connections are processed by the third subordinate unit (host name
head_office_cld, priority 3, weight 20)
The next 30 connections are processed by the fourth subordinate unit (host name
head_office_cle, priority 4, weight 30)
Fortinet Technologies Inc. Page 1350 FortiOS Handbook - High Availability for FortiOS 5.0
Use the following command to set thresholds and weights for CPU and memory usage and
HTTP, FTP, IMAP, POP3, SMTP, or NNTP proxy sessions:
config system ha
set mode a-a
set schedule weight-round-robin
set cpu-threshold <weight> <low> <high>
set memory-threshold <weight> <low> <high>
set http-proxy-threshold <weight> <low> <high>
set ftp-proxy-threshold <weight> <low> <high>
set imap-proxy-threshold <weight> <low> <high>
set nntp-proxy-threshold <weight> <low> <high>
set pop3-proxy-threshold <weight> <low> <high>
set smtp-proxy-threshold <weight> <low> <high>
end
For each option, the weight range is 0 to 255 and the default weight is 5. The low and high
watermarks are a percent (0 to 100). The default low and high watermarks are 0 which means
they are disabled. The default configuration when weighted load balancing is enabled looks like
the following:
config system ha
set mode a-a
set schedule weight-round-robin
set cpu-threshold 5 0 0
set memory-threshold 5 0 0
set http-proxy-threshold 5 0 0
set ftp-proxy-threshold 5 0 0
set imap-proxy-threshold 5 0 0
set nntp-proxy-threshold 5 0 0
set pop3-proxy-threshold 5 0 0
set smtp-proxy-threshold 5 0 0
end
When you first enable HA weighted load balancing, the weighted load balancing configuration
is synchronized to all cluster units and each cluster unit has the default configuration shown
above. Changes to the CPU, memory, HTTP, FTP, IMAP, NNTP, POP3, and SMTP thresholds
and low and high watermarks must be made for each cluster unit and are not synchronized to
the other cluster units.
When you configure them, the high watermarks must be greater than their corresponding low
watermarks.
For CPU and memory usage the low and high watermarks are compared with the percentage
CPU and memory use of the cluster unit. For each of the UTM proxies the high and low
watermarks are compared to a number that represents percent of the max number of proxy
sessions being used by a proxy. This number is calculated using the formula:
proxy usage = (current sessions * 100) / max sessions
where:
current sessions is the number of active sessions for the proxy type.
max sessions is the session limit for the proxy type. The session limit depends on the
FortiGate unit and its configuration.
Fortinet Technologies Inc. Page 1351 FortiOS Handbook - High Availability for FortiOS 5.0
You can use the following command to display the maximum and current number of sessions
for a UTM proxy:
get test { ftpd | http | imap | nntp | pop3 | smtp} 4
You can use the following command to display the maximum number of sessions and the and
current number of sessions for all of the proxies:
get test proxyworker 4
The command output includes lines similar to the following:
get test http 4
HTTP Common
Current Connections 5000/8032
In the example, 5000 is the current number of proxy connections being used by HTTP and 8032
is the maximum number of proxy sessions allowed. For this example the proxy usage would be:
proxy usage = (5000 * 100) / 8032
proxy usage = 62%
_3
ha
0_
62
_2
ha
0_
62
_1
ha
0_
62
Connect to the cluster CLI and use the following command to set the CPU usage threshold
weight to 30, low watermark to 60, and high watermark to 80. This command also sets the
memory usage threshold weight to 10, low watermark to 60, and high watermark to 90.
config system ha
set mode a-a
set schedule weight-round-robin
set cpu-threshold 30 60 80
set memory-threshold 10 60 90
end
Fortinet Technologies Inc. Page 1352 FortiOS Handbook - High Availability for FortiOS 5.0
The static weights for the cluster units remain at the default values of 40. Since this command
changes the mode to a-a and the schedule to weight-round-robin for the first time, the
weight settings are synchronized to all cluster units.
As a result of this configuration, if the CPU usage of any cluster unit (for example, 620_ha_1)
reaches 80% the static weight for that cluster unit is reduced from 40 to 10 and only 10 of every
120 new sessions are load balanced to this cluster unit. If the memory usage of 620_ha_1 also
reaches 90% the static weight further reduces to 0 and no new sessions are load balanced to
620_ha_1. Also, if the memory usage of 620_ha_2 reaches 90% the static weight of 620_ha_2
reduces to 30 and 30 of every 120 new sessions are load balanced to 620_ha_2.
Now that you have established the weight load balancing configuration for the entire cluster you
can monitor the cluster to verify that processing gets distributed evenly to all cluster units. From
the web-based manager you can go do System > Config > HA > View HA Statistics and see the
CPU usage, active sessions, memory usage and other statistics for all of the cluster units. If you
notice that one cluster unit is more or less busy than others you can adjust the dynamic weights
separately for each cluster unit.
For example, in some active-active clusters the primary unit may tend to be busier than other
cluster units because in addition to processing sessions the primary unit also receives all
packets sent to the cluster and performs load balancing to distribute the sessions to other
cluster units. To reduce the load on the primary unit you could reduce the CPU and memory
usage high watermark thresholds for the primary unit so that fewer sessions are distributed to
the primary unit. You could also reduce the primary units high watermark setting for the proxies
to distribute more proxy sessions to other cluster units.
Note that this would only be useful if you are using device priorities and override settings to
make sure the same unit always becomes the primary unit. See Controlling primary unit
selection using device priority and override on page 1140.
If the example cluster is configured for 620_ha_2 to be the primary unit, connect to the
620_ha_2s CLI and enter the following command to set CPU usage, memory usage, and proxy
usage high watermark thresholds lower.
config system ha
set cpu-threshold 30 60 70
set memory-threshold 30 60 70
set http-proxy-threshold 30 60 70
set ftp-proxy-threshold 30 60 70
set imap-proxy-threshold 30 60 70
set nntp-proxy-threshold 30 60 70
set pop3-proxy-threshold 30 60 70
set smtp-proxy-threshold 30 60 70
end
As a result, when any of these factors reaches 70% on the primary unit, fewer sessions will be
processed by the primary unit, preventing the number of sessions being processed from rising.
Fortinet Technologies Inc. Page 1353 FortiOS Handbook - High Availability for FortiOS 5.0
NAT/Route mode active-active cluster packet flow
This section describes an example of how packets are load balanced and how failover occurs in
an active-active HA cluster running in NAT/Route mode. In the example, the NAT/Route mode
cluster acts as the internet firewall for a client computers internal network. The client
computers default route points at the IP address of the cluster internal interface. The client
connects to a web server on the Internet. Internet routing routes packets from the cluster
external interface to the web server, and from the web server to the cluster external interface.
In NAT/Route mode, eight MAC addresses are involved in active-active communication
between the client and the web server when the primary unit load balances packets to the
subordinate unit:
Internal virtual MAC address (MAC_V_int) assigned to the primary unit internal interface,
External virtual MAC address (MAC_V_ext) assigned to the primary unit external interface,
Client MAC address (MAC_Client),
Server MAC address (MAC_Server),
Primary unit original internal MAC address (MAC_P_int),
Primary unit original external MAC address (MAC_P_ext),
Subordinate unit internal MAC address (MAC_S_int),
Subordinate unit external MAC address (MAC_S_ext).
In NAT/Route mode, the HA cluster works as a gateway when it responds to ARP requests.
Therefore, the client and server only know the gateway MAC addresses. The client only knows
the cluster internal virtual MAC address (MAC_V_int) and the server only knows the cluster
external virtual MAC address (MAC_V_ext). The cluster virtual MAC address is described in
Cluster virtual MAC addresses on page 1300.
IP: 10.11.101.100
MAC: MAC_V_int Primary Unit
IP: 172.20.120.141
MAC: MAC_V_ext
MAC: MAC_P_int MAC: MAC_P_ext
Cluster Cluster
Internal External
Interface Interface
Client
Subordinate Unit Web
IP: 10.11.101.10 Server
MAC: MAC_Client IP: 172.20.120.130
MAC: MAC_S_int MAC: MAC_S_ext MAC: MAC_Server
Fortinet Technologies Inc. Page 1354 FortiOS Handbook - High Availability for FortiOS 5.0
5. The clients request packet reaches the primary unit internal interface.
6. The primary unit decides that the subordinate unit should handle this packet, and forwards it
to the subordinate unit internal interface. The source MAC address of the forwarded packet
is changed to the actual MAC address of the primary unit internal interface.
7. The subordinate unit recognizes that the packet has been forwarded from the primary unit
and processes it.
8. The subordinate unit forwards the packet from its external interface to the web server.
9. The primary unit forwards further packets in the same session to the subordinate unit.
10.Packets for other sessions are load balanced by the primary unit and either sent to the
subordinate unit or processed by the primary unit.
Fortinet Technologies Inc. Page 1355 FortiOS Handbook - High Availability for FortiOS 5.0
5. The primary unit decides that the subordinate unit should handle this packet, and forwards it
to the subordinate unit external interface. The source MAC address of the forwarded packet
is changed to the actual MAC address of the primary unit external interface.
6. The subordinate unit recognizes that packet has been forwarded from the primary unit and
processes it.
7. The subordinate unit forwards the packet from its internal interface to the client.
8. The primary unit forwards further packets in the same session to the subordinate unit.
9. Packets for other sessions are load balanced by the primary unit and either sent to the
subordinate unit or processed by the primary unit.
This section describes an example of how packets are load balanced and how failover occurs in
an active-active HA cluster running in Transparent mode. The cluster is installed on an internal
network in front of a mail server and the client connects to the mail server through the
Transparent mode cluster.
Fortinet Technologies Inc. Page 1356 FortiOS Handbook - High Availability for FortiOS 5.0
In Transparent mode, six MAC addresses are involved in active-active communication between
a client and a server when the primary unit load balances packets to the subordinate unit:
Client MAC address (MAC_Client),
Server MAC address (MAC_Server),
Primary unit original internal MAC address (MAC_P_int),
Primary unit original external MAC address (MAC_P_ext),
Subordinate unit internal MAC address (MAC_S_int),
Subordinate unit external MAC address (MAC_S_ext).
The HA virtual MAC addresses are not directly involved in communicate between the client and
the server. The client computer sends packets to the mail server and the mail server sends
responses. In both cases the packets are intercepted and load balanced among cluster
members.
The clusters presence on the network and its load balancing are transparent to the client and
server computers. The primary unit sends gratuitous ARP packets to Switch 1 that associate all
MAC addresses on the network segment connected to the cluster external interface with the
external virtual MAC address. The primary unit also sends gratuitous ARP packets to Switch 2
that associate all MAC addresses on the network segment connected to the cluster internal
interface with the internal virtual MAC address. In both cases, this results in the switches
sending packets to the primary unit interfaces.
Primary Unit
Client
Subordinate Unit Mail
IP: 10.11.101.10
Server
MAC: MAC_Client
IP: 10.11.101.200
MAC: MAC_S_int MAC: MAC_S_ext MAC: MAC_Server
Fortinet Technologies Inc. Page 1357 FortiOS Handbook - High Availability for FortiOS 5.0
6. The primary unit decides that the subordinate unit should handle this packet, and forwards it
to the subordinate unit internal interface. The source MAC address of the forwarded packet
is changed to the actual MAC address of the primary unit internal interface.
7. The subordinate unit recognizes that packet has been forwarded from the primary unit and
processes it.
8. The subordinate unit forwards the packet from its external interface to the mail server.
9. The primary unit forwards further packets in the same session to the subordinate unit.
10.Packets for other sessions are load balanced by the primary unit and either sent to the
subordinate unit or processed by the primary unit.
5. The primary unit decides that the subordinate unit should handle this packet, and forwards it
to the subordinate unit external interface. The source MAC address of the forwarded packet
is changed to the actual MAC address of the primary unit external interface.
6. The subordinate unit recognizes that packet has been forwarded from the primary unit and
processes it.
Fortinet Technologies Inc. Page 1358 FortiOS Handbook - High Availability for FortiOS 5.0
7. The subordinate unit forwards the packet from its internal interface to the client.
8. The primary unit forwards further packets in the same session to the subordinate unit.
9. Packets for other sessions are load balanced by the primary unit and either sent to the
subordinate unit or processed by the primary unit.
Fortinet Technologies Inc. Page 1359 FortiOS Handbook - High Availability for FortiOS 5.0
HA with FortiGate-VM and third-party
products
This chapter provides information about operating FortiOS VM cluster and operating FortiGate
clusters with third party products such as layer-2 and layer-3 switches. This chapter describes:
FortiGate-VM for VMware HA configuration
FortiGate VM for Hyper-V HA configuration
Failover issues with layer-3 switches
Changing spanning tree protocol settings for some switches
Failover and attached network equipment
Ethertype conflicts with third-party switches
LACP, 802.3ad aggregation and third-party switches
If you want to combine two or more FortiGate-VM instances into a FortiGate Clustering Protocol
(FGSP) High Availability (HA) cluster the VMware servers virtual switches used to connect the
heartbeat interfaces must operate in promiscuous mode. This permits HA heartbeat
communication between the heartbeat interfaces. HA heartbeat packets are non-TCP packets
that use Ethertype values 0x8890, 0x8891, and 0x8890. The FGCP uses link-local IP4
addresses in the 169.254.0.x range for HA heartbeat interface IP addresses.
To enable promiscuous mode in VMware:
1. In the vSphere client, select your VMware server in the left pane and then select the
Configuration tab in the right pane.
2. In Hardware, select Networking.
3. Select Properties of a virtual switch used to connect heartbeat interfaces.
4. In the Properties window left pane, select vSwitch and then select Edit.
5. Select the Security tab, set Promiscuous Mode to Accept, then select OK.
6. Select Close.
You must also set the virtual switches connected to other FortiGate interfaces to allow MAC
address changes and to accept forged transmits. This is required because the FGCP sets virtual
MAC addresses for all FortiGate interfaces and the same interfaces on the different
VMinstances in the cluster will have the same virtual MAC addresses.
To make the required changes in VMware:
1. In the vSphere client, select your VMware server in the left pane and then select the
Configuration tab in the right pane.
2. In Hardware, select Networking.
3. Select Properties of a virtual switch used to connect FortiGate VM interfaces.
4. Set MAC Address ChangestoAccept.
5. Set Forged Transmits to Accept.
Page 1360
FortiGate VM for Hyper-V HA configuration
Promiscuous mode and support for MAC address spoofing is required for FortiGate-VM for
Hyper-V to support FortiGate Clustering Protocol (FGCP) high availability (HA). By default the
FortiGate-VM for Hyper-V has promiscuous mode enabled in the XML configuration file in the
FortiGate-VM Hyper-V image. If you have problems with HA mode, confirm that this is still
enabled.
In addition, because the FGCP applies virtual MAC addresses to FortiGate data interfaces and
because these virtual MAC addresses mean that matching interfaces of different FortiGate-VM
instances will have the same virtual MAC addresses you have to configure Hyper-V to allow
MAC spoofing. But you should only enable MAC spoofing for FortiGate-VMdata interfaces. You
should not enable MAC spoofing for FortiGate HA heartbeat interfaces.
With promiscuous mode enabled and the correct MAC spoofing settings you should be able to
configure HA between two or more FortiGate-VMfor Hyper-V instances.
Issues may occur because of the way an HA cluster assigns MAC addresses to the primary unit.
Two clusters with the same group ID cannot connect to the same switch and cannot be installed
on the same network unless they are separated by a router.
After a failover, the new primary unit sends gratuitous ARP packets to refresh the MAC
forwarding tables of the switches connected to the cluster. If the cluster is connected using
layer-2 switches, the MAC forwarding tables (also called arp tables) are refreshed by the
gratuitous ARP packets and the switches start directing packets to the new primary unit.
In some configurations that use layer-3 switches, after a failover, the layer-3 switches may not
successfully re-direct traffic to the new primary unit. The possible reason for this is that the
layer-3 switch might keep a table of IP addresses and interfaces and may not update this table
for a relatively long time after the failover (the table is not updated by the gratuitous ARP
packets). Until the table is updated, the layer-3 switch keeps forwarding packets to the now
failed cluster unit. As a result, traffic stops and the cluster does not function.
As of the release date of this document, Fortinet has not developed a workaround for this
problem. One possible solution would be to clear the forwarding table on the layer-3 switch.
The config system ha link-failed-signal command described in Updating MAC
forwarding tables when a link failover occurs on page 1323 can be used to resolve link failover
issues similar to those described here.
Fortinet Technologies Inc. Page 1361 FortiOS Handbook - High Availability for FortiOS 5.0
Changing spanning tree protocol settings for some switches
Configuration changes may be required when you are running an active-active HA cluster that is
connected to a switch that operates using the spanning tree protocol. For example, the
following spanning tree parameters may need to be changed:
Maximum The time that a bridge stores the spanning tree bridge control data unit
Age (BPDU) before discarding it. A maximum age of 20 seconds means it
may take 20 seconds before the switch changes a port to the listening
state.
Forward The time that a connected port stays in listening and learning state. A
Delay forward delay of 15 seconds assumes a maximum network size of
seven bridge hops, a maximum of three lost BPDUs and a hello-interval
of 2 seconds.
For an active-active HA cluster to be compatible with the spanning tree algorithm, the FGCP
requires that the sum of maximum age and forward delay should be less than 20 seconds. The
maximum age and forward delay settings are designed to prevent layer 2 loops. If there is no
possibility of layer 2 loops in the network, you could reduce the forward delay to the minimum
value.
For some Dell 3348 switches the default maximum age is 20 seconds and the default forward
delay is 15 seconds. In this configuration the switch cannot work with a FortiGate HA cluster.
However, the switch and cluster are compatible if the maximum age is reduced to 10 seconds
and the forward delay is reduced to 5 seconds.
It normally takes a cluster approximately 6 seconds to complete a failover. However, the actual
failover time may depend on how quickly the switches connected to the cluster interfaces
accept the cluster MAC address update from the primary unit. If the switches do not recognize
Fortinet Technologies Inc. Page 1362 FortiOS Handbook - High Availability for FortiOS 5.0
and accept the gratuitous ARP packets and update their MAC forwarding table, the failover time
will increase.
Also, individual session failover depends on whether the cluster is operating in active-active or
active-passive mode, and whether the content of the traffic is to be virus scanned. Depending
on application behavior, it may take a TCP session a longer period of time (up to 30 seconds) to
recover completely.
Some third-party network equipment may use packets with Ethertypes that are the same as the
ethertypes used for HA heartbeat packets. For example, Cisco N5K/Nexus switches use
Ethertype 0x8890 for some functions. When one of these switches receives Ethertype 0x8890
heartbeat packets from an attached cluster unit, the switch generates CRC errors and the
packets are not forwarded. As a result, FortiGate units connected with these switches cannot
form a cluster.
In some cases, if the heartbeat interfaces are connected and configured so regular traffic flows
but heartbeat traffic is not forwarded, you can change the configuration of the switch that
connects the HA heartbeat interfaces to allow level2 frames with Ethertypes 0x8890, 0x8893,
and 0x8891 to pass.
You can also use the following CLI commands to change the Ethertypes of the HA heartbeat
packets:
config system ha
set ha-eth-type <ha_ethertype_4-digit_hex>
set hc-eth-type <hc_ethertype_4-digit_hex>
set l2ep-eth-type <l2ep_ethertype_4-digit_hex>
end
For more information, see Heartbeat packet Ethertypes on page 1297.
If a cluster contains 802.3ad aggregated interfaces you should connect the cluster to switches
that support configuring multiple Link Aggregation (LAG) groups.
The primary and subordinate unit interfaces have the same MAC address, so if you cannot
configure multiple LAG groups a switch may place all interfaces with the same MAC address
into the same LAG group; disrupting the operation of the cluster.
You can change the FortiGate configuration to prevent subordinate units from participating in
LACP negotiation. For example, use the following command to do this for an aggregate
interface named Port1_Port2:
config system interface
edit Port1_Port2
set lacp-ha-slave disable
end
This configuration prevents the subordinate unit interfaces from sending or receiving packets.
Resulting in the cluster not being able to operate in active-active mode. As well, failover may be
slower because after a failover the new primary unit has to perform LACP negotiation before
being able to process network traffic.
For more information, see Example: HA and 802.3ad aggregated interfaces on page 1188.
Fortinet Technologies Inc. Page 1363 FortiOS Handbook - High Availability for FortiOS 5.0
VRRP
A Virtual Router Redundancy Protocol (VRRP) configuration can be used as a high availability
solution to make sure that a network maintains connectivity with the Internet (or with other
networks) even if the default router for the network fails. Using VRRP, if a router or a FortiGate
unit fails all traffic to this router transparently fails over to another router or FortiGate unit that
takes over the role of the router or FortiGate unit that failed. If the failed router or FortiGate unit
is restored, it will once again take over processing traffic for the network. VRRP is described by
RFC 3768.
FortiGate unit
and VRRP compatible
Router in a
VRRP group
LAN
Internal
Network
To configure VRRP you create a VRRP group that contains two or more routers. Some or all of
these routers can be FortiGate units. You can include different FortiGate models in the same
VRRP group. The group members are configured to be the master router and one or more
backup routers of the VRRP group. The network directs all traffic to the masters IP address and
MAC address. If the master fails, VRRP dynamically shifts packet forwarding to a backup router.
VRRP provides this redundancy without user intervention or additional configuration to any of
the devices on the network.
The VRRP redundancy scheme means that devices on the network keep a single IP address for
the default gateway and this IP address maps to a well-known virtual MAC address. If the VRRP
master fails, one of the backup units becomes the new master and acquires virtual IP and MAC
addresses that match the addresses of the master. The network then automatically directs all
traffic to the backup unit. VRRP uses the broadcast capabilities of Ethernet networks. A long as
one of the routers in a VRRP group is running, ARP requests for the default gateway IP address
always receive replies. Additionally, hosts can send packets outside their subnet without
interruption.
FortiGate units support VRRP and can be quickly and easily integrated into a network that has
already deployed a group of routers using VRRP. You can also create a new VRRP configuration
consisting of a FortiGate unit acting as a VRRP master with one or more VRRP-compatible
routers acting as backup routers. Some or all of those backup routers can be FortiGate units.
During normal operation the VRRP master unit sends VRRP advertisement messages to the
backup units. A backup unit will not attempt to become a master unit while it is receiving these
messages. When a FortiGate unit operating as a VRRP master fails, a backup unit takes its
place and continues processing network traffic. The backup unit assumes the master unit has
Page 1364
failed if it stops receiving the advertisement messages from the master unit. The backup unit
with the highest priority becomes the new master unit after a short delay. During this delay the
new master unit sends gratuitous ARPs to the network to map the virtual router IP address it its
MAC address. As a result, all packets sent to the default route IP address are sent the new
master unit. If the backup unit is a FortiGate unit, the network continues to benefit from FortiOS
security features. If the backup unit is a router, after a failure traffic will continue to flow, but
FortiOS security features will be unavailable until the FortiGate unit is back on line.
During a VRRP failover, as the backup unit starts to forward traffic it will not have session
information for all of the failed over in-progress sessions. If the backup unit is operating as a
normal FortiGate unit it will not be able to forward this traffic because of the lack of session
information. To resolve this problem, immediately after a failover and for a short time as its
taking over traffic processing, the backup unit operates with asymmetric routing enabled. This
allows the backup unit to re-create all of the in-progress sessions and add them to the session
table. While operating with asymmetric routing enabled, the backup unit cannot apply security
functions. When the start-time ends the backup unit disables asymmetric routing and returns to
normal operation including applying security functions.
Fortinet Technologies Inc. Page 1365 FortiOS Handbook - High Availability for FortiOS 5.0
Use the following command to enable the VRRP virtual MAC address on the port2 interface:
config system interface
edit port2
set vrrp-virtual-mac enable
end
end
The port2 interface will now accept packets sent to the MAC addresses of the VRRP virtual
routers added to this interface.
Using the VRRP virtual MAC address can improve network efficiency especially on large and
complex LANs because when a failover occurs devices on the LAN do not have to learn a new
MAC address for the new VRRP router.
If the VRRP virtual MAC address feature is disabled, the VRRP group uses the MAC address of
the master. In the case of a FortiGate VRRP virtual router this is the MAC address of the
FortiGate interface that the VRRP virtual routers are added to. If a master fails, when the new
master takes over it sends gratuitous ARPs to associate the VRRP virtual router IP address with
the MAC address of the new master (or the interface of the FortiGate unit that has become the
new master). If the VRRP virtual MAC address is enabled the new master uses the same MAC
address as the old master.
Configuring VRRP
To configure VRRP you must configure two or more FortiGate interfaces or routers with the
same virtual router ID and IP address. Then these FortiGate units or routers can automatically
join the same VRRP group. You must also assign priorities to each of the FortiGate units or
routers in the VRRP group. One of the FortiGate units or routers must have the highest priority
to become the master. The other FortiGate units or routers in the group are assigned lower
priorities and become backup units. All of the units in the VRRP group should have different
priorities. If the master unit fails, VRRP automatically fails over to the remaining unit in the group
with the highest priority.
You configure VRRP from the FortiGate CLI by adding a VRRP virtual router to a FortiGate
interface. You can add VRRP virtual routers to multiple FortiGate interfaces and you can add
more than one virtual router to the same interface.
Fortinet Technologies Inc. Page 1366 FortiOS Handbook - High Availability for FortiOS 5.0
Figure 219:Example VRRP configuration with two FortiGate units
0
p
12
pr id = 1 2 cku
1.
vr ip ort Ba
10
1.
vr p P
rit 5 3
on RR
io = 0.
V
De
50
10 fault
=
y
.31 Ro
Internal .10 ute
Network 1.1
20
0
12
FortiGate
Forti
r
pr id = 1 2 ste
1.
vr ip ort Ma
10
Unit
U
1.
vr p P
rit 5 3
on RR
io = 0.
5
V
25
=
y
FortiGate
Fort
tiGate
Unit
Example VRRP configuration: VRRP load balancing two FortiGate units and two
VRRP groups
In this configuration two VRRP groups are involved. Each FortiGate unit participates in both of
them. One FortiGate unit is the master of one group and the other FortiGate unit is the master of
the other group. The network distributes traffic between two different default routes
(10.31.101.120 and 10.31.101.130). One VRRP group is configured with one of the default route
IP addresses and the other VRRP group get the other default route IP address. So during
Fortinet Technologies Inc. Page 1367 FortiOS Handbook - High Availability for FortiOS 5.0
normal operation both FortiGate units are processing traffic and the VRRP groups are used to
load balance the traffic between the two FortiGate units.
If one of the FortiGate units fails, the remaining FortiGate unit becomes the master of both
VRRP groups. The network sends all traffic for both default routes to this FortiGate unit. The
result is a configuration that under normal operation load balances traffic between two
FortiGate units, but if one of the FortiGate units fails, all traffic fails over to the unit that is still
operating.
This example also includes enabling the VRRP virtual MAC address on both FortiGate unit port2
interfaces so that the VRRP groups use their VRRP virtual MAC addresses.
Figure 220:Example VRRP configuration with two FortiGate units and two VRRP groups
up B
V rio = 5 ack nit
20
p ip = B U
.1
vr id P te
01
vr R Ga
pr ip = 1 Ma 50 .1
i
V rt
vr id P y = .31
o
F
vr R rit 10
13 e
R
1. ut
30
0
10 o
er
1. t R
.1
io = 0 st
5 01
.3 ul
10 efa
25 .1
= 1
D
y .3
Internal
rit 10
R
Network 12 e
1. ut
0
10 o
1. t R
.3 ul
10 efa
D
er A
st it
p ip = 5 Ma Un
0
12
vr id P te
0 k 5 1.
vr R Ga
pr ip = 1 Ba 25 .10
i
V rt
= 1
o
3
F
vr RR rity 0.
R
30
V rio = 1
up
.1
01
c
50 .1
= 1
P
y .3
rit 10
vr d
=
i
io
Fortinet Technologies Inc. Page 1368 FortiOS Handbook - High Availability for FortiOS 5.0
4. Enter the following command to enable the VRRP virtual MAC address feature and add the
VRRP groups to the port2 interface of FortiGate unit B:
config system interface
edit port2
set vrrp-virtual-mac enable
config vrrp
edit 50
set vrip 10.31.101.120
set priority 50
next
edit 100
set vrip 10.31.101.130
set priority 255
end
end
Fortinet Technologies Inc. Page 1369 FortiOS Handbook - High Availability for FortiOS 5.0
FortiGate Session Life Support Protocol
(FGSP)
You can use the config system session-sync command to configure the FortiGate
Session Life Support Protocol (FGSP) (previously called TCP session synchronization or
standalone session synchronization) between two FortiGate units. The two FortiGate units must
be the same model. The FGSP synchronizes both IPv4 and IPv6 TCP, UDP, ICMP, expectation,
and NAT sessions. You can use this feature with external routers or load balancers configured to
distribute or load balance sessions between two peer FortiGate units. If one of the peers fails,
session failover occurs and active sessions fail over to the peer that is still operating. This
failover occurs without any loss of data. As well, the external routers or load balancers will
detect the failover and re-distribute all sessions to the peer that is still operating.
In previous versions of FortiOS the FGSP was called TCP session synchronization or
standalone session synchronization. However, the FGSP has been expanded to include
configuration synchronization and session synchronization of connectionless sessions,
expectation sessions, and NAT sessions.
You cannot configure FGSP HA when FGCP HA is enabled. However FCSP HA is compatible
with VRRP.
FCSP or standalone session synchronization is not supported if the FortiGate units are running
different firmware versions.
The FGSP can be used instead of FGCP HA to provide session synchronization between two
peer FortiGate units. If the external load balancers direct all sessions to one peer the affect is
similar to active-passive FGCP HA. If external load balancers or routers load balance traffic to
both peers, the effect is similar to active-active FGCP HA. The load balancers should be
configured so that all of the packets for any given session are processed by the same peer. This
includes return packets.
Page 1370
Figure 221:FGSP HA
LAN
Router or
FortiGate unit
Fo
n
tio
Internal Load Balancer iza
Network h ro n i n k
c L
Sy
FortiGate unit
Router or
Load Balancer
By default, FCSP synchronizes all IPv4 and IPv6 TCP sessions and also synchronizes the
configuration of the FortiGate units.
You can optionally enable session pickup to synchronize connectionless (UDP and ICMP)
sessions, expectation sessions, and NAT sessions. If you do not enable session pickup, the
FGSP does not share session tables for the particular session type and sessions do not resume
after a failover. All sessions that are interrupted by the failover and must be re-established at the
application level. Many protocols can successfully restart sessions with little, or no, loss of data.
Others may not recover easily. Enable session pickup for sessions that may be difficult to
reestablish. Since session pickup requires FortiGate resources, only enable this feature for
sessions that you need to have synchronized.
You can also optionally add filters to control which sessions are synchronized. You can add
filters to only synchronize packets from specified source and destination addresses, specified
source and destination interfaces, and specified services.
Load balancing and session failover is done by external routers or load balancers instead of by
the FGSP. The FortiGate units just perform session synchronization to support session failover.
The FGSP also includes configuration synchronization, allowing you to make configuration
changes once for both FortiGate units instead of requiring you to make duplicate configuration
changes on each FortiGate unit. Settings that identify the FortiGate unit to the network, for
example, interface IP addresses and BGP neighbor settings, are not synchronized so each
FortiGate unit maintains its identity on the network.
By default configuration synchronization is disabled. You can use the following command to
enable it.
config system ha
set standalone-config-sync enable
end
Fortinet Technologies Inc. Page 1371 FortiOS Handbook - High Availability for FortiOS 5.0
Synchronizing UDP and ICMP (connectionless) sessions
In many configurations, due to their non-stateful nature, UDP and ICMP sessions don't need to
be synchronized to naturally failover. However, if its required you can configure the FGSP to
synchronize UDP and ICMP sessions by entering the following command:
config system ha
set session-pickup enable
set session-pickup-connectionless enable
end
By default, NAT session are not synchronized. However, the FGSP can synchronize NAT session
if you enter the following command:
config system ha
set session-pickup enable
set session-pickup-nat enable
end
However, if you want NAT sessions to resume after a failover you should not configure NAT to
use the destination interface IP address since the FGSP FortiGate units have different IP
addresses. With this configuration, after a failover all sessions that include the IP addresses of
interfaces on the failed FortiGate unit will have nowhere to go since the IP addresses of the
failed FortiGate unit will no longer be on the network.
Instead, in an FGSP configuration, if you want NAT sessions to failover you should use IP pools
with the type set to overload (which is the default IP pool type). For example:
config firewall ippool
edit FGSP-pool
set type overload
set startip 172.20.120.10
set endip 172.20.120.20
end
Then when you configure NAT firewall policies, turn on NAT and select to use dynamic IP pool
and select the IP Pool that you added. Add the same IP pools and firewall policies to both
FortiGate units.
By default, expectation sessions (or asymmetric sessions) are not synchronized. Normally,
session synchronization cannot be asymmetric because it is stateful. So all of the packets of a
given session must be processed on the same peer. This includes return packets.
However, if you have an asymmetric routing configuration, you can enter the following
command to synchronize asymmetric sessions by dynamically detecting asymmetric sessions
and disabling anti-reply for these sessions.
config system ha
set session-pickup enable
set session-pickup-expectation enable
end
Fortinet Technologies Inc. Page 1372 FortiOS Handbook - High Availability for FortiOS 5.0
The FGSP enforces firewall policies for asymmetric traffic, including cases where the TCP
3-way handshake is split between two FortiGates. For example, FGT-A receives the TCP-SYN,
FGT-B receives the TCP-SYN-ACK, and FGT-A receives the TCP-ACK. Under normal conditions
a firewall will drop this connection since the 3-way handshake was not seen by the same
firewall. However two FortiGates with FGSP configured will be able to properly pass this traffic
since the firewall sessions are synchronized.
If traffic will be highly asymmetric, as described above, the following command must be
enabled on both FortiGates.
config system ha
set session-pickup enable
set session-pickup-expectation enable
end
This asymmetric function can also work with connectionless UDP and ICMP traffic. The
following command needs to enabled on both FortiGates.
config system ha
set session-pickup enable
set session-pickup-connectionless enable
end
Synchronizing asymmetric traffic can be very useful in situations where multiple Internet
connections from different ISPs are spread across two FortiGates. Since it is typically not
possible to guarantee Internet bound traffic leaving via an ISP will return using the exact same
ISP, the FGSP provides critical firewall functions in this situation.
The FGSP also has applications in virtualized computing environments where virtualized hosts
move between data centers. The firewall session synchronization features of FGSP allow for
more flexibility than in traditional firewalling functions.
UTM inspection (flow or proxy based) for a session is not expected to work properly if the traffic
in the session is balanced across more than one FortiGate in either direction. Flow-based UTM
should be used in FGSP deployments.
For an environment where traffic is symmetric, UTM can be used with the following limitations:
No session synchronization for the sessions inspected using proxy-based UTM. Sessions
will drop and need to be reestablished after data path failover.
Sessions with flow-based UTM will failover; however, inspection of failed over sessions after
the failover may not work.
A single FortiGate must see both the request and reply traffic for UTM inspection to function
correctly. For environments where asymmetric traffic is expected, UTM inspection should not
be used.
Fortinet Technologies Inc. Page 1373 FortiOS Handbook - High Availability for FortiOS 5.0
You can only add one filter configuration to a given FGSP configuration. However, you can
add multiple filters by adding multiple identical FGSP configurations, each one with a
different filter configuration.
Sessions accepted by security policies with UTM options configured are not synchronized.
FGSP HA is configured from the CLI.
FGSP HA is available for FortiGate units or virtual domains operating in NAT/Route or
Transparent mode. NAT sessions are not synchronized in either mode (unless NAT
synchronization is enabled as described in Synchronizing NAT sessions on page 1372). In
NAT/Route mode, only sessions for route mode security policies are synchronized. In
Transparent mode, only sessions for normal Transparent mode policies are synchronized.
FGSP HA is supported for traffic on physical interfaces, VLAN interfaces, zones, aggregate
interfaces, and NPx (NP4, NP6 etc.) accelerated interfaces. The FGSP has not been tested
for inter-vdom links, between HA clusters, and for redundant interfaces.
The names of the matching interfaces, including VLAN interfaces, aggregate interfaces and
so on, must be the same on both peers.
Configuring FGSP HA
You configure FGSP HA separately for each virtual domain to be synchronized. If virtual domain
configuration is not enabled, you configure FGSP HA for the root virtual domain. When virtual
domain configuration is enabled and you have added virtual domains you configure FGSP HA
for each virtual domain to be synchronized. You dont have to synchronize all virtual domains.
You must configure FGSP HA and network settings on both peers. Once you establish the initial
configuration, the configurations of both FortiGate units are synchronized so when you change
the configuration of one, the changes are synchronized to the other.
On each FortiGate unit, configuring FGSP HA consists of selecting the virtual domains to be
synchronized using the syncvd field, selecting the virtual domain on the other peer that
receives the synchronization packets using the peervd field, and setting the IP address of the
interface in the peer unit that receives the synchronization packets using the peerip field. The
interface with the peerip must be in the peervd virtual domain.
The syncvd and peervd settings must be the same on both peers. However, the peerip
settings will be different because the peerip setting on the first peer includes the IP address of
an interface on the second peer. And the peerip setting on the second peer includes the IP
address of an interface on the first peer.
For FGSP HA to work properly all synchronized virtual domains must be added to both peers.
The names of the matching interfaces in each virtual domain must also be the same; this
includes the names of matching VLAN interfaces. Note that the index numbers of the matching
interfaces and VLAN interfaces can be different. Also the VLAN IDs of the matching VLAN
interfaces can be different.
For a configuration example, see Basic example configuration on page 1375.
When FGSP HA is operating, the peers share session information over an Ethernet link between
the peers similar to an HA heartbeat link. Usually you would use the same interface on each
peer for session synchronization. You should connect the session synchronization interfaces
directly without using a switch or other networking equipment. For FortiGate-5000 systems you
can use a backplane interface as the session synchronization link.
Fortinet Technologies Inc. Page 1374 FortiOS Handbook - High Availability for FortiOS 5.0
You can use different interfaces on each peer for session synchronization links. Also, if you have
multiple sessions synchronization configurations, you can have multiple links between the
peers. In fact if you are synchronizing a lot of sessions, you may want to configure and connect
multiple session synchronization links to distribute session synchronization traffic to these
multiple links.
You cannot configure backup session synchronization links. Each configuration only includes
one session synchronization link.
The session synchronization link should always be maintained. If session synchronization
communication is interrupted and a failure occurs, sessions will not failover and data could be
lost.
Session synchronization traffic can use a considerable amount of network bandwidth. If
possible, session synchronization link interfaces should only be used for session
synchronization traffic and not for data traffic.
The following configuration example shows how to configure basic FGSP HA for the two peer
FortiGate units shown in Figure 222 on page 1375. The host names of peers are peer_1 and
peer_2. Both peers are configured with two virtual domains: root and vdom_1. All sessions
processed by vdom_1 are synchronized. The synchronization link interface is port3 which is in
the root virtual domain. The IP address of port3 on peer_1 is 10.10.10.1. The IP address of port3
on peer_2 is 10.10.10.2.
Also on both peers, port1 and port2 are added to vdom_1. On peer_1 the IP address of port1 is
set to 192.168.20.1 and the IP address of port2 is set to 172.110.20.1. On peer_2 the IP address
of port1 is set to 192.168.20.2 and the IP address of port2 is set to 172.110.20.2.
_1
m
2
o
rt
r
d
o
ce
V
P
B or
an
ad ter
1
al
rt
Lo ou
o
P
R
t
o
ro
Internal
.1
10
.1 3
10 ort
Network
0.
P
Li ni tio d
ro ura n
nk za n
ch fig n a
n
tio
yn n o
S o ssi
C e
S
er
10 t3
c
B or
an
0. or
.2
ad ter
al
.1 P
Lo ou
R
10
t
o
ro
_1 t2
m or
P
1
rt
o
P
o
d
V
To configure FGSP HA
1. Configure the load balancer or router to send all sessions to peer_1.
2. Configure the load balancer or router to send all traffic to peer_2 if peer_1 fails.
Fortinet Technologies Inc. Page 1375 FortiOS Handbook - High Availability for FortiOS 5.0
3. Use normal FortiGate configuration steps on peer_1:
Enable virtual domain configuration.
Add the vdom_1 virtual domain.
Add port1 and port2 to the vdom_1 virtual domain and configure these interfaces.
Set the IP address of port1 to 192.168.20.1.
Set the IP address of port2 to 172.110.20.1.
Set the IP address of port3 to 10.10.10.1.
Add route mode security policies between port1 and port2 to vdom_1.
4. Enter the following commands to configure session synchronization for peer_1
config system session-sync
edit 1
set peerip 10.10.10.2
set peervd root
set syncvd vdom_1
end
5 Use normal FortiGate configuration steps on peer_2:
Enable virtual domain configuration.
Add the vdom_1 virtual domain.
Add port1 and port2 to the vdom_1 virtual domain and configure these interfaces.
Set the IP address of port1 to 192.168.20.2.
Set the IP address of port2 to 172.110.20.2.
Set the IP address of port3 to 10.10.10.1.
Add route mode security policies between port1 and port2 to vdom_1.
6. Enter the following command to configure session synchronization for peer_1
config system session-sync
edit 1
set peerip 10.10.10.1
set peervd root
set syncvd vdom_1
end
Now that the FortiGate units are connected and configured their configurations are
synchronized, so when you make a configuration change on one FortiGate unit it is
synchronized to the other one.
To add filters
You can add a filter to this basic configuration if you only want to synchronize some TCP
sessions. For example you can enter the following command to add a filter so that only HTTP
sessions are synchronized:
config system session-sync
edit 1
config filter
set service HTTP
end
end
Fortinet Technologies Inc. Page 1376 FortiOS Handbook - High Availability for FortiOS 5.0
You can also add a filter to control the source and destination addresses of the IPv4 packets
that are synchronized. For example you can enter the following command to add a filter so that
only sessions with source addresses in the range 10.10.10.100 to 10.10.10.200 are
synchronized.
config system session-sync
edit 1
config filter
set srcaddr 10.10.10.100 10.10.10.200
end
end
You can also add a filter to control the source and destination addresses of the IPv6 packets
that are synchronized. For example you can enter the following command to add a filter so that
only sessions with destination addresses in the range 2001:db8:0:2::/64 are synchronized.
config system session-sync
edit 1
config filter
set dstaddr6 2001:db8:0:2::/64
end
end
You can use the following diagnose commands to verify that the FGSP and its synchronization
functions are operating correctly.
Fortinet Technologies Inc. Page 1377 FortiOS Handbook - High Availability for FortiOS 5.0
FGSP configuration summary and status
Enter the following command to display a summary of the FGSP configuration and
synchronization status:
diagnose sys session sync
sync_ctx: sync_started=1, sync_tcp=1, sync_others=1,
sync_expectation=1, sync_redir=0, sync_nat=1.
sync: create=12:0, update=0, delete=0:0, query=14
recv: create=14:0, update=0, delete=0:0, query=12
ses pkts: send=0, alloc_fail=0, recv=0, recv_err=0 sz_err=0
nCfg_sess_sync_num=5, mtu=16000
sync_filter:
1: vd=0, szone=0, dzone=0, saddr=0.0.0.0:0.0.0.0,
daddr=0.0.0.0:0.0.0.0,
sync_started=1 shows that synchronization is working. If this is set to 0 then something is
not correct with session synchronization and synchronization has not been able to start
because of it.
sync_tcp=1, sync_others=1, sync_expectation=1, and sync_nat=1 show that the
FGSP has been configured to synchronize TCP, connectionless, asymmetric, and NAT sessions.
sync: create=12:0 and recv: create=14:0 show that this FortiGate has synchronized
12 sessions to its peer and has received 14 sessions from its peer.
sync_filter shows the configured FGSP filter. In this case no filter has been created so all
sessions are synchronized.
vd=0 indicates that root VDOM sessions are synchronized.
Fortinet Technologies Inc. Page 1378 FortiOS Handbook - High Availability for FortiOS 5.0
Verifying that sessions are synchronized
Enter the command diagnose sys session list to display information about the sessions being
processed by the FortiGate. In the command output look for sessions that should be
synchronized and make sure they contain output lines that include synced (for example,
state=log may_dirty ndr synced) to confirm that they are being synchronized by the
FGSP.
diagnose sys session list
session info: proto=6 proto_state=05 duration=469 expire=0 timeout=3600
flags=00000000 sockflag=00000000 sockport=21 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
ha_id=0 policy_dir=0 tunnel=/
state=log may_dirty ndr synced
statistic(bytes/packets/allow_err): org=544/9/1 reply=621/7/0 tuples=2
orgin->sink: org pre->post, reply pre->post
dev=46->45/45->46
gwy=10.2.2.1/10.1.1.1
hook=pre dir=org act=noop
192.168.1.50:45327->172.16.1.100:21(0.0.0.0:0)
hook=post dir=reply act=noop
172.16.1.100:21->192.168.1.50:45327(0.0.0.0:0)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=1 id_policy_id=0 auth_info=0 chk_client_info=0 vd=0
serial=00002deb tos=ff/ff ips_view=1 app_list=2000 app=16427
dd_type=0 dd_mode=0
per_ip_bandwidth meter: addr=192.168.1.50, bps=633
Fortinet Technologies Inc. Page 1379 FortiOS Handbook - High Availability for FortiOS 5.0
Configuring FRUP
The FortiGate Redundant UTM Protocol (FRUP) provides similar redundancy to FGCP full mesh
HA in a single unified design that includes redundant switching and routing. FRUP is available
on the FortiGate-100D and will be expanded to other models in future releases.
A FRUP cluster consists of 2 (and only 2) identical FortiGate-100D units that have dual
redundant links to all connected devices and networks and can include redundant FortiAP units.
Connections to the Internet normally use the wan1 and wan2 interfaces for redundant
connections. Connections to internal networks and servers use redundant connections to
FortiGate-100D switch ports. FRUP uses the FortiGate-100D switch ports for full mesh HA
instead of external redundant switches.
Each device or network has a default active connection to one of the FortiGate units and a
default backup connection to the other. Ideally, the default active and backup connections
should balance traffic between the FortiGate units in the cluster so that both FortiGate units are
processing the same amount of traffic.
FRUP uses virtual IPs and virtual MACs so that when a failover occurs, network devices do not
have to learn new IP or MAC addresses. FRUP also synchronizes the configuration between the
units in the cluster.
Use the following CLI command on both FortiGate-100D units to configure FRUP.
config system ha
set hbdev "ha1" 50 "ha2" 100
set override disable
set priority 128
set frup enable
config frup-settings
set active-interface "wan2"
set active-switch-port 14
set backup-interface "wan1"
end
end
Both units must have the same heartbeat device configuration and have FRUP enabled to form
a FRUP cluster. Active interface and switch ports must be complementary according to your
configuration (see the following example).
Page 1380
FRUP configuration example
(a rt ch
iv 4
p wit
ct 1
B
e)
T-
h
S
itc
G
F
w
S
(b rt ch
ku 6
p wit
)
ac 1
p
S
Internal
o
Network ct 2
(a AN
e)
iv
W
192.168.1.114
0
8. er
20
26 rv
(a rt ch
1.
2. e
-2
ks
ac 1
p wit
)
ct 16
19 S
p
(b AN
er
ku
lin
e)
S
ut
W
iv
o
o
lH
R
ac t h
ua
(b po itc
D
ku 14
w
)
S
p
r
ac 2
)
p
(b AN
ku
W
ct 1
(a AN
A
e)
T-
iv
W
G
F
-1
er
ut
o
R
Configuring FGT-A
Change the host name to FGT-A. Set up FGT-A with dual redundant internet links using WAN1
and WAN2. Set WAN1 and WAN2 interfaces to use static addressing and set both static routes
to same priority and distance.
Fortinet Technologies Inc. Page 1381 FortiOS Handbook - High Availability for FortiOS 5.0
From CLI enter the following command:
config system ha
set hbdev "ha1" 50 "ha2" 100
set override disable
set priority 255
set frup enable
config frup-settings
set active-interface "wan1"
set active-switch-port 16
set backup-interface "wan2"
end
end
Configuring FGT-B
Use the same firmware version as FGT-A and set the FortiGate unit to factory defaults. Change
the host name to FGT-B.
From CLI enter the following command:
config system ha
set hbdev "ha1" 50 "ha2" 100
set override disable
set priority 128
set frup enable
config frup-settings
set active-interface "wan2"
set active-switch-port 14
set backup-interface "wan1"
end
end
Fortinet Technologies Inc. Page 1382 FortiOS Handbook - High Availability for FortiOS 5.0
Traffic initiating from a host on the internal network (for example, IP: 192.168.1.114) connected
to port14 should flow through FGT-B (since port14 is the active-switch-port in FGT-B) to the
Internet using WAN2 (since WAN2 is FGT-Bs active interface).
Run the same sniffer on both FortiGate units and then run a ping to 74.125.226.1 from the
internal network. The sniffer should show results similar to the following:
Fortinet Technologies Inc. Page 1383 FortiOS Handbook - High Availability for FortiOS 5.0
Shutdown FGT-A.
Traffic from the internal network should be handled by FGT-B using WAN1 and WAN2
interfaces:
To re-establish the cluster after a failover you need to restart both FortiGate-100D units. Just
re-starting FGT-A may not bring the cluster back online.
Fortinet Technologies Inc. Page 1384 FortiOS Handbook - High Availability for FortiOS 5.0
Chapter 10 Install and System
Administration for FortiOS 5.0
Page 1385
Differences between Models and Firmware
This section examines some of the key differences that exist between different FortiGate
models and different versions of the FortiOS 5.0 firmware. It is important to keep these
differences in mind when reading the FortiOS 5.0 Handbook, in order to understand how the
documentation relates to your specific FortiGate unit.
There are certain features that are not available on all models. For example, the Switch
Controller, which allows a FortiGate unit to manage a FortiSwitch unit, is only available on
FortiGate models 100D, 140D, 200D, 240D, 600C, 800C, and 1000C.
Other features may be available only through the CLI on models, while other models have
options in the web-based manager. For example, SSL content inspection is a CLI-only
feature on FortiGate models 20C, 30C, and 40C, while models 60C+ have options in the
web-based manager.
For more information about some of the features that vary by model, please see the
Feature/Platform Matrix.
Naming conventions may vary between FortiGate models. For example, on some models the
interface used for the local area network is called lan, while on other units it is called internal.
Menus may vary by model. For example, on some FortiGate units, the menu option Router is
not available. Instead, routing is configured by going to System > Network > Routing.
Many changes are introduced in new patches to the FortiOS 5.0 firmware. For more
information about these changes, please see Whats New for FortiOS 5.0 and the FortiOS
Release Notes.
In FortiOS 5.0 Patch 3, Feature Select was added, which controls which menus are visible in
the web-based manager. If a feature you wish to use does not appear in the web-based
manager, go to System > Config > Features to ensure that the feature has not been turned
off.
Menu names may change between firmware versions. For example, In FortiOS 5.0 Patch 3,
the features formerly known UTM Security Profiles was renamed Security Profiles.
Menus may move between firmware versions. For example, in FortiOS Patch 5, Endpoint
Control moved from being part of the User menu to having a menu option of its own, found
at User & Device > Endpoint Protection.
Options may also be removed in a firmware patch. For example, in FortiOS Patch 5, the
Client Reputation Monitor was removed. Client Reputation results can now be found in the
Threat History widget.
Page 1386
Using the web-based manager
This section describes the features of the web-based manager administrative interface
(sometimes referred to as a graphical user interface, or GUI) of your unit. This section also
explains common web-based manager tasks that an administrator does on a regular basis.
The following topics are included in this section:
Web-based manager overview
Web-based manager menus and pages
Entering text strings
Dashboard
Basic configurations
The web-based manager is a user-friendly interface for configuring settings and managing the
FortiGate unit. Accessing the web-based manager is easy and can be done by using either
HTTP or a secure HTTPS connection from any management computer, using a web browser.
The recommended minimum screen resolution for properly displaying the web-based manager
is 1280 by 1024. Some web browsers do not correctly display the windows within the
web-based manager interface. Verify that you have a supported web browser by reviewing the
Knowledge Base articles: Microsoft Windows web browsers supported by Fortinet products
web-based manager (GUI) web browsers and Mac OS browsers for use with Fortinet hardware
web-based manager (GUI).
The web-based manager also provides the CLI Console widget, which enables you to connect
to the command line interface (CLI) without exiting out of the web-based manager.
The web-based manager provides access to configuration options for most of the FortiOS
features from the main menus. The web-based manager contains the following main menus:
Router Configure static, dynamic and multicast routing and view the router
monitor.
Policy Configure firewall policies, protocol options and Central NAT Table.
Firewall Objects Configure supporting content for firewall policies including scheduling,
services, traffic shapers, addresses, virtual IP and load balancing.
Security Profiles Configure antivirus and email filtering, web filtering, intrusion protection,
data leak prevention, application control, VOIP, ICAP and Client
Reputation.
Page 1387
VPN Configure IPsec and SSL virtual private networking.
User & Device Configure user accounts and user authentication including external
authentication servers.This menu also includes endpoint security features,
such as FortiClient configuration and application detection patterns.
WAN Opt. & Cache Configure WAN optimization and web caching to improve performance
and security of traffic passing between locations on your wide area
network (WAN) or from the Internet to your web servers.
WiFi & Switch Configure the unit to act as a wireless network controller, managing the
Controller wireless Access Point (AP) functionality of FortiWiFi and FortiAP units.
Log & Report Configure logging and alert email as well as reports. View log messages
and reports.
Current VDOM Appears only when VDOMs are enabled on the unit to switch between
VDOMs.
Last page
Current Page Next page
(enter a page number
to display that page)
Using the web-based manager Page 1388 Install and System Administration for FortiOS 5.0
Note that the filtering ignores characters following a < unless the followed by a space. For
example, the filtering ignores <string but not < string. Filtering also ignores matched
opening and closing (< and >) characters and any characters between them. For example,
filtering will ignore <string>.
For columns that contain only specific content, such as log message severity, a list of terms is
provided from which options can be selected.
The configuration of a FortiGate unit is stored in the FortiOS configuration database. To change
the configuration, you can use the web-based manager or CLI to add, delete, or change
configuration settings. These changes are stored in the database as you make them.
Individual settings in the configuration database can be text strings, numeric values, selections
from a list of allowed options, or on/off (enable/disable) settings.
There is a different character limitation for VDOM names and hostnames. For both, the only
legal characters are are numbers (0-9), letters (a-z, A-Z), and special characters - and _.
From the CLI, you can also use the tree command to view the number of characters that are
allowed in a name field. For example, firewall address names can contain up to 64 characters.
When you add a firewall address to the web-based manager, you are limited to entering 64
Using the web-based manager Page 1389 Install and System Administration for FortiOS 5.0
characters in the firewall address name field. From the CLI you can enter the following tree
command to confirm that the firewall address name field allows 64 characters.
config firewall address
tree
-- [address] --*name (64)
|- subnet
|- type
|- start-ip
|- end-ip
|- fqdn (256)
|- cache-ttl (0,86400)
|- wildcard
|- comment (64 xss)
|- associated-interface (16)
+- color (0,32)
The tree command output also shows the number of characters allowed for other firewall
address name settings. For example, the fully-qualified domain name (fqdn) field can contain
up to 256 characters.
Dashboard
The various dashboard menus provides a way to access information about network activity and
events, as well as configure basic system settings. You can easily add more dashboards and
edit existing ones to easily view the content you need.
Each information chunk is found within a widget. Widgets provide an easy and quick way to
view a variety of information, such as statistical information or network activity. There are a
selection of widgets to choose from by selecting the Widgets option.
Administrators must have read and write privileges for adding and configuring dashboards and
widgets.
Using the web-based manager Page 1390 Install and System Administration for FortiOS 5.0
Adding dashboards and widgets
Dashboards that you create are automatically added under the default status and usage
dashboards. You can add, remove, or rename a dashboard, regardless of whether it is default.
You can also reset the Dashboard menu to its default settings by selecting Reset Dashboards.
If VDOMs are enabled, only the dashboards within Global are available for configuration.
To add a dashboard
1. Go to System > Dashboard > Status.
2. Select Dashboard, located at the top left of the page.
3. Select Add Dashboard.
To add a widget to a dashboard, select Widget located at the top left of the dashboard page.
Host Name The name of the FortiGate unit. For details on changing the name, see
Changing the FortiGate units host name.
If the FortiGate unit is in HA mode, this information is not displayed.
Serial Number The serial number of the FortiGate unit. The serial number is specific to
that FortiGate unit and does not change with firmware upgrades.
Operation Mode The current operating mode of the FortiGate unit. A FortiGate unit can
operate in NAT mode or Transparent mode. Select Change to switch
between NAT and transparent mode. For more information, see
Changing the operation mode.
If virtual domains are enabled, this field shows the operating mode of
the current virtual domain. The Global System Status dashboard does
not include this information.
HA Status The status of High Availability (HA) within the cluster. Standalone
indicates the FortiGate unit is not operating in HA mode. Active-Passive
or Active-Active indicate the FortiGate unit is operating in HA mode.
Select Configure, to change the HA configuration.
Cluster Name The name of the HA cluster for this FortiGate unit. The FortiGate unit
must be operating in HA mode to display this field.
Cluster Members The FortiGate units in the HA cluster. Information displayed about each
member includes host name, serial number, and whether the FortiGate
unit is a primary (master) or subordinate (slave) FortiGate unit in the
cluster.
The FortiGate unit must be operating in HA mode with virtual domains
disabled to display this information.
Virtual Cluster 1 The role of each FortiGate unit in virtual cluster 1 and virtual cluster 2.
Virtual Cluster 2
The FortiGate unit must be operating in HA mode with virtual domains
enabled to display this information.
Using the web-based manager Page 1391 Install and System Administration for FortiOS 5.0
System Time The current date and time. Select Change, to configure the system time.
For more information, see Configuring system time.
Firmware Version The version of the current firmware installed on the FortiGate unit.
Select Update to upload a different firmware version. For more
information, see Changing the firmware.
System The time period of when the configuration file was backed up. Select
Configuration Backup to back up the current configuration. For more information, see
Backing up the configuration.
To restore a configuration file, select Restore. For more information, see
Restoring your firmware configuration.
Current The number of administrators currently logged into the FortiGate unit.
Administrator
Select Details to view more information about each administrator that is
currently logged in
If you want to changed the current administrators password, see
Changing the currently logged in administrators password.
Uptime The time in days, hours, and minutes since the FortiGate unit was
started or rebooted.
Virtual Domain Status of virtual domains on your FortiGate unit. Select Enable or
Disable to change the status of virtual domains feature.
If you enable or disable virtual domains, your session will be terminated
and you will need to log in again.
Explicit Proxy The status of each feature. Select Enable or Disable to change the
Load Balance status of the feature. When enabled, the menu option appears.
NAT mode
In NAT mode, the FortiGate unit is visible to the network that it is connected to and all of its
interfaces are on different subnets. Each interface that is connected to a network must be
configured with an IP address that is valid for that subnet.
You would typically use NAT mode when the FortiGate unit is deployed as a gateway between
private and public networks (or between any networks). In its default NAT mode configuration,
Using the web-based manager Page 1392 Install and System Administration for FortiOS 5.0
the FortiGate unit functions as a router, routing traffic between its interfaces. Security policies
control communications through the FortiGate unit to both the Internet and between internal
networks. In NAT mode, the FortiGate unit performs network address translation before IP
packets are sent to the destination network.
For example, a company has a FortiGate unit as their interface to the Internet. The FortiGate
unit also acts as a router to multiple subnets within the company. In this situation, the FortiGate
unit is set to NAT mode and has a designated port for the Internet, wan1, with an address of
172.20.120.129, which is the public IP address. The internal network segments are behind the
FortiGate unit and invisible to the public access, for example port 2 has an address of
10.10.10.1. The FortiGate unit translates IP addresses passing through it to route the traffic to
the correct subnet or to the Internet.
Transparent Mode
In transparent mode, the FortiGate unit is invisible to the network. All of its interfaces are on the
same subnet and share the same IP address. To connect the FortiGate unit to your network, all
you have to do is configure a management IP address and a default route.
You would typically use the FortiGate unit in transparent mode on a private network behind an
existing firewall or behind a router. In transparent mode, the FortiGate unit also functions as a
firewall. Security policies control communications through the FortiGate unit to the Internet and
internal network. No traffic can pass through the FortiGate unit until you add security policies.
For example, the company has a router or other firewall in place. The network is simple enough
that all users are on the same internal network. They need the FortiGate unit to perform
application control, antivirus, intrusion protection, and similar traffic scanning. In this situation,
the FortiGate unit is set to transparent mode. The traffic passing through the FortiGate unit does
not change the addressing from the router to the internal network. Security policies and security
profiles define the type of scanning the FortiGate unit performs on traffic entering the network.
Using the web-based manager Page 1393 Install and System Administration for FortiOS 5.0
6. After the FortiGate unit switches to NAT mode, you may need to go Router > Static Route
and edit this default route.
For low-end FortiGate units, go to System > Network > Routing.
7. Select OK.
System Time The current system date and time on the FortiGate unit.
Refresh Update the display of the FortiGate units current system date and time.
Time Zone Select the current system time zone for the FortiGate unit.
Set Time Select to set the system date and time to the values.
Synchronize with Select to use a Network Time Protocol (NTP) server to automatically set
NTP Server the system date and time. You must specify the server and
synchronization interval.
FortiGate units use NTP Version 4. For more information about NTP see
http://www.ntp.org.
Server Enter the IP address or domain name of an NTP server. To find an NTP
server that you can use, see http://www.ntp.org.
Sync Interval Specify how often the FortiGate unit should synchronize its time with
the NTP server.
Enable NTP Server Select to make the FortiGate unit an NTP server that client computers
can ping for time synchronization. When selected, the Listen on
Interfaces option appears. Add the interfaces the FortiGate unit will
listen for time requests.
Daylight savings time is enabled by default. You can disable daylight savings time using the CLI
commands:
config system global
set dst disable
end
To avoid losing configuration settings you should always back up your configuration before
changing the firmware image.
Also, when updating firmware, you should first refer to Supported Upgrade Paths for FortiOS
Firmware to help ensure a successful upgrade.
Administrators whose admin profiles permit maintenance read and write access can change the
FortiGate units firmware. Firmware images can be installed from a number of sources including
a local hard disk, a local USB disk, or the FortiGuard Network.
Using the web-based manager Page 1394 Install and System Administration for FortiOS 5.0
To change the firmware, go to System > Dashboard > Status > System Information widget and
select the Update link on the Firmware Version row.
Upgrade From Select the firmware source from the drop down list of available sources.
Firmware Version This appears only when selecting FortiGuard Network is selected from
the Upgrade From drop-down list. Select a firmware version from the
drop-down list.
If downgrading the firmware on the FortiGate unit, select the check box
beside Allow Firmware Downgrade.
Upgrade File Browse to the location of the firmware image on your local hard disk.
This field is available for local hard disk and USB only.
Boot the New By default, this is enabled. Select to disable the FortiGate units reboot
Firmware process when installing a firmware image to a partition.
This option enables you to install a firmware image to a partition without
the FortiGate unit rebooting itself and making the firmware image the
default firmware that is currently running.
You need to register your FortiGate unit with Customer Support to access firmware updates for
your model. For more information, go to http://support.fortinet.com or contact Customer
Support.
Using the web-based manager Page 1395 Install and System Administration for FortiOS 5.0
USB Disk Select to back up the configuration file to a USB key that is connected
to the FortiGate unit.
Full Config Select to backup the full VDOM configuration. This appears only when
the FortiGate unit has VDOM configuration enabled.
VDOM Config Select to backup the only the VDOM configuration file. This option
backs up only the configuration file within that VDOM. Select the VDOM
from the drop-down list, and select Backup.
Encrypt Select to enable a password to the configuration file for added security.
configuration file
Password Enter the password that will be used to restore the configuration file.
Formatting USB
The FortiGate unit enables you to back up the configuration of the device to a USB flash drive.
The USB flash drive must be formatted as a FAT16 disk.
To formate the USB flash drive, either use the CLI command exe usb-disk format. or within
Windows at a command prompt, enter the command
format <drive_letter>: /FS:FAT /V:<drive_label>
where <drive_letter> is the letter of the connected USB flash drive and <drive_label> is
the name to give the USB drive.
Using the web-based manager Page 1396 Install and System Administration for FortiOS 5.0
When restoring the configuration from a remote location, a list of revisions is displayed so that
you can choose the configuration file to restore.
The FortiGuard-FortiManager protocol is used when connecting to the FortiGuard Analysis and
Management Service. This protocol runs over SSL using IPv4/TCP port 541 and includes the
following functions:
detects FortiGate unit dead or alive status
detects management service dead or alive status
notifies the FortiGate units about configuration changes, AV/IPS database update and
firewall changes.
USB Disk Select to back up the configuration file to a USB key that is connected
to the FortiGate unit.
Password If a password was set when saving the configuration file, enter the
password.
Using the web-based manager Page 1397 Install and System Administration for FortiOS 5.0
When a new FortiGate unit is powered on, it automatically searches for FortiGuard services. If
the FortiGate unit is configured for central management, it will look for FortiGuard services on
the configured FortiManager system. The FortiGate unit sends its serial number to the
FortiGuard service provider, which then determines whether the FortiGate unit is registered and
has valid contracts for FortiGuard subscriptions and FortiCare support services. If the FortiGate
unit is registered and has a valid contract, the License Information is updated.
If the FortiGate unit is not registered, any administrator with the super_admin profile sees a
reminder message that provides access to a registration form.
When a contract is due to expire within 30 days, any administrator with the super_admin profile
sees a notification message that provides access to an Add Contract form. Simply enter the
new contract number and select Add. Fortinet Support also sends contract expiry reminders.
You can optionally disable notification for registration or contract inquiry using the config
system global command in the CLI. Selecting any of the Configure options will take you to
the Maintenance page.
Support Contract Displays details about your current Fortinet Support contract.
If Not Registered appears, select Register to register the FortiGate
unit.
If Expired appears, select Renew for information on renewing your
technical support contract. Contact your local reseller.
If Registered appears, the name of the support that registered this
FortiGate unit is also displayed. The various types of contracts that
you currently have and the expiry date for each type.
You can select Login Now to log into the Fortinet Support account
that registered this FortiGate unit.
FortiGuard Services Displays your current licenses for services from FortiGuard. Select
Renew to update any of the licenses.
FortiCloud Displays details about your current FortiCloud subscription. If the green
Activate button appears, select it to either create a new account or add
the FortiGate unit to an existing account.
If you have already activated FortiCloud, the name of the Account will
be listed. Select Launch Portal to view your FortiCloud account in a web
browser.
Information on the current Type and Storage is also listed. You can
select Upgrade to change the type of your FortiCloud account.
FortiClient Software Displays FortiClient license details and the number of Register and
Allowed FortiClient users. You can select Details for more information
about the current FortiClient users.
SMS Displays the number of Sent and Allowed SMS messages. You can
select Add Messages to configure a new SMS message.
Virtual Domain Displays the maximum number of virtual domains the FortiGate unit
supports with the current license.
For high-end models, you can select the Purchase More link to
purchase a license key through Fortinet technical support to increase
the maximum number of VDOMs.
Using the web-based manager Page 1398 Install and System Administration for FortiOS 5.0
FortiGate unit Operation widget
The Unit Operation widget is an illustrated version of the FortiGate units front panel that shows
the status of the FortiGate units network interfaces. Interfaces appears green when connected.
Hover the mouse pointer over an interface to view further details.
Icons around the front panel indicate when the FortiGate unit is connected to a FortiAnalyzer or
FortiManager device, or FortiClient installations. Select the icon in the widget to jump to the
configuration page for each device. When connected to one of these devices, a green check
mark icon appears next to the icon. If the device communication is configured but the device is
unreachable, a red X appears.
The options to reboot or shutdown the FortiGate unit are not available for an admin using the
prof_admin profile.
Use the Refresh icon when you want to view current system resource information, regardless of
whether you are viewing real-time or historical type format.
To change the resource view from real-time to historical, or change the CPU view (for multiple
CPU FortiGate units), select the Edit icon (visible when you hover the mouse over the widget).
When viewing CPU and memory usage in the web-based manager, only the information for core
processes displays. CPU for management processes, is excluded. For example, HTTPS
connections to the web-based manager.
Using the web-based manager Page 1399 Install and System Administration for FortiOS 5.0
The two controls located on the CLI Console widget title bar are Customize, and Detach.
Detach moves the CLI Console widget into a pop-up window that you can resize and
reposition. Select Attach. to move the widget back to the dashboards page.
Customize enables you to change the appearance of the console by selecting fonts and
colors for the text and background.
Features widget
The Features widget displays a number of Basic Features and Security Features and whether or
not each feature is currently enabled or disabled. Options for features that are disabled will not
appear in the web-based manager.
For Security Features, several Preset options are available, which can be selected from the
dropdown menu in the widget:
UTM enabled all security features and should be chosen for networks that require full
protection from FortiOS. UTM is the default setting.
WF enables web filtering features.
ATP enables protection against viruses and other external threats.
NGFW enables application control and protection from external attacks.
NGFW + ATP enables features that protect against external threats and attacks.
Using the web-based manager Page 1400 Install and System Administration for FortiOS 5.0
RAID monitor widget
The RAID Monitor widget displays the current state of the RAID array and each RAID disk. This
widget does not display unless the FortiGate unit has more than one disk installed and is not
available for FortiOS Carrier.
Disk status icon There is one icon for each disk in the array.
Green with a check mark shows a healthy disk.
Red with an X shows the disk has failed and needs attention.
Positioning the mouse over the disk status icon displays the status of
the disk, and the storage capacity of the disk.
RAID Level The RAID level of this RAID array. The RAID level is set as part of
configuring the RAID array.
Status bar The bar shows the percentage of the RAID array that is currently in use.
Used/Free/Total Displays the amount of RAID array storage that is being used, the
amount of storage that is free, and the total storage in the RAID array.
The values are in gigabytes.
Using the web-based manager Page 1401 Install and System Administration for FortiOS 5.0
Status The status, or health, of RAID array. This status can be one of:
OK standard status, everything is normal
OK (Background-Synchronizing) (%) synchronizing the disks after
changing RAID level, Synchronizing progress bar shows percent
complete
Degraded One or more of the disks in the array has failed, been
removed, or is not working properly. A warning is displayed about
the lack of redundancy in this state. Also, a degraded array is slower
than a healthy array. Select Rebuild RAID to fix the array.
Degraded (Background-Rebuilding) (%) The same as degraded, but
the RAID array is being rebuilt in the background. The array
continues to be in a fragile state until the rebuilding is completed.
Size The size of the RAID array in gigabytes (GB). The size of the array
depends on the RAID level selected, and the number of disks in the
array.
Rebuild RAID Select to rebuild the array after a new disk has been added to the array,
or after a disk has been swapped in for a failed disk.
If you try to rebuild a RAID array with too few disks you will get a rebuild
error. After inserting a functioning disk, the rebuild will start.
This button is only available when the RAID array is in a degraded state
and has enough disks to be rebuilt.
You cannot restart a rebuild once a rebuild is already in progress.
Note: If a disk has failed, the number of working disks may not be
enough for the RAID level to function. In this case, replace the failed
disk with a working disk to rebuild the RAID array.
Disk# The disks position in the array. This corresponds to the physical slot of
the disk.
If a disk is removed from the FortiGate unit, the disk is marked as not a
member of the array and its position is retained until a new disk is
inserted in that drive bay.
Status The status of this disk. Options include OK, and unavailable.
A disk is unavailable if it is removed or has failed.
Basic configurations
Before going ahead and configuring security policies, users, and security profiles, you should
perform some basic configurations to set up your FortiGate unit.
Using the web-based manager Page 1402 Install and System Administration for FortiOS 5.0
To change an administrators password, go to System > Admin > Administrators, edit the
administrator account, and then change the password.
For details on selecting a password, and password best practices, see Passwords on
page 1429.
For information about resetting a lost administrators password, see
docs.fortinet.com/sysadmin.html.
Switching VDOMs
When VDOMs are enabled, a menu appears in the left column called Current VDOM. This menu
displays a drop-down list that lists the configured VDOMs.
To switch to a VDOM using the Current VDOM menu, select the VDOM that you want to switch
to from the drop-down list. You are automatically redirected to that VDOM.
VDOMs are enabled on the System Information Dashboard Widget.
Using the web-based manager Page 1403 Install and System Administration for FortiOS 5.0
To connect to the CLI console, go to System > Dashboard > Status and select inside the
window of the CLI Console widget to automatically connect. For more information on using the
CLI, see Using the CLI on page 1405.
Logging out
Select the Logout icon to quit your administrative session. If you only close the browser or leave
the web-based manager to surf to another web site, you remain logged in until the idle timeout
(default 5 minutes) expires. To change the timeout, see Changing the web-based manager idle
timeout on page 1403.
Using the web-based manager Page 1404 Install and System Administration for FortiOS 5.0
Using the CLI
The command line interface (CLI) is an alternative configuration tool to the web-based manager.
While the configuration of the web-based manager uses a point-and-click method, the CLI
requires typing commands or uploading batches of commands from a text file, like a
configuration script.
This section also explains common CLI tasks that an administrator does on a regular basis and
includes the topics:
Connecting to the CLI
Command syntax
Sub-commands
Permissions
Tips
Page 1405
The following procedure describes connection using Microsoft HyperTerminal software; steps
may vary with other terminal emulators.
If you do not want to use an SSH/Telnet client and you have access to the web-based manager,
you can alternatively access the CLI through the network using the CLI Console widget in the
web-based manager.
You must enable SSH and/or Telnet on the network interface associated with that physical
network port. If your computer is not connected directly or through a switch, you must also
configure the FortiGate unit with a static route to a router that can forward packets from the
FortiGate unit to your computer. You can do this using either a local console connection or the
web-based manager.
Using the CLI Page 1406 Install and System Administration for FortiOS 5.0
Requirements
a computer with an available serial communications (COM) port and RJ-45 port
terminal emulation software such as HyperTerminal for Microsoft Windows
the RJ-45-to-DB-9 or null modem cable included in your FortiGate package
a network cable
prior configuration of the operating mode, network interface, and static route (for details,
see)
To enable SSH or Telnet access to the CLI using a local console connection
1. Using the network cable, connect the FortiGate units network port either directly to your
computers network port, or to a network through which your computer can reach the
FortiGate unit.
2. Note the number of the physical network port.
3. Using a local console connection, connect and log into the CLI. For details, see Connecting
to the CLI using a local console on page 1405.
4. Enter the following command:
config system interface
edit <interface_str>
set allowaccess <protocols_list>
next
end
where:
<interface_str> is the name of the network interface associated with the physical
network port and containing its number, such as port1
<protocols_list> is the complete, space-delimited list of permitted administrative
access protocols, such as https ssh telnet
For example, to exclude HTTP, HTTPS, SNMP, and PING, and allow only SSH and Telnet
administrative access on port1:
set system interface port1 config allowaccess ssh telnet
5. To confirm the configuration, enter the command to display the network interfaces settings.
get system interface <interface_str>
The CLI displays the settings, including the allowed administrative access protocols, for the
network interfaces.
To connect to the CLI through the network interface, see Connecting to the CLI using SSH
on page 1407 or Connecting to the CLI using Telnet on page 1408.
Using the CLI Page 1407 Install and System Administration for FortiOS 5.0
To connect to the CLI using SSH
1. On your management computer, start an SSH client.
2. In Host Name (or IP Address), enter the IP address of a network interface on which you have
enabled SSH administrative access.
3. In Port, enter 22.
4. For the Connection type, select SSH.
5. Select Open.
The SSH client connects to the FortiGate unit.
The SSH client may display a warning if this is the first time you are connecting to the
FortiGate unit and its SSH key is not yet recognized by your SSH client, or if you have
previously connected to the FortiGate unit but used a different IP address or SSH key. This is
normal If your management computer is directly connected to the FortiGate unit with no
network hosts between them.
6. Click Yes to verify the fingerprint and accept the FortiGate units SSH key. You will not be
able to log in until you have accepted the key.
7. The CLI displays a login prompt.
8. Type a valid administrator account name (such as admin) and press Enter.
9. Type the password for this administrator account and press Enter.
The FortiGate unit displays a command prompt (its host name followed by a #). You can
now enter CLI commands.
If three incorrect login or password attempts occur in a row, you will be disconnected. If this
occurs, wait one minute, then reconnect to attempt the login again.
Telnet is not a secure access method. SSH should be used to access the CLI from the Internet
or any other untrusted network.
Before you can connect to the CLI using Telnet, you must first configure a network interface to
accept SSH connections. For details, see Enabling access to the CLI through the network
(SSH or Telnet) on page 1406.
Using the CLI Page 1408 Install and System Administration for FortiOS 5.0
4. Type the password for this administrator account and press Enter.
The FortiGate unit displays a command prompt (its host name followed by a #). You can
now enter CLI commands.
If three incorrect login or password attempts occur in a row, you will be disconnected. If this
occurs, wait one minute, then reconnect to attempt the login again.
Command syntax
When entering a command, the command line interface (CLI) requires that you use valid syntax
and conform to expected input constraints. It will reject invalid commands.
Fortinet documentation uses the following conventions to describe valid command syntax
Terminology
Each command line consists of a command word that is usually followed by words for the
configuration data or other specific item that the command uses or affects:
get system admin
To describe the function of each word in the command line, especially if that nature has
changed between firmware versions, Fortinet uses terms with the following definitions.
command A word that begins the command line and indicates an action that the
FortiGate unit should perform on a part of the configuration or host on the network, such as
config or execute. Together with other words, such as fields or values, that end when you
press the Enter key, it forms a command line. Exceptions include multiline command lines,
which can be entered using an escape sequence. (See Shortcuts and key commands on
page 1416.)
Valid command lines must be unambiguous if abbreviated. (See Command abbreviation
on page 1417.) Optional words or other command line permutations are indicated by syntax
notation. (See Notation on page 1410.)
sub-command A kind of command that is available only when nested within the scope of
another command. After entering a command, its applicable sub-commands are available to
you until you exit the scope of the command, or until you descend an additional level into
Using the CLI Page 1409 Install and System Administration for FortiOS 5.0
another sub-command. Indentation is used to indicate levels of nested commands. (See
Indentation on page 1410.)
Not all top-level commands have sub-commands. Available sub-commands vary by their
containing scope. (See Sub-commands on page 1412.)
object A part of the configuration that contains tables and/or fields. Valid command lines
must be specific enough to indicate an individual object.
table A set of fields that is one of possibly multiple similar sets which each have a name
or number, such as an administrator account, policy, or network interface. These named or
numbered sets are sometimes referenced by other parts of the configuration that use them.
(See Notation on page 1410.)
field The name of a setting, such as ip or hostname. Fields in some tables must be
configured with values. Failure to configure a required field will result in an invalid object
configuration error message, and the FortiGate unit will discard the invalid table.
value A number, letter, IP address, or other type of input that is usually your configuration
setting held by a field. Some commands, however, require multiple input values which may
not be named but are simply entered in sequential order in the same command line. Valid
input types are indicated by constraint notation. (See Notation on page 1410.)
option A kind of value that must be one or more words from of a fixed set of options. (See
Notation on page 1410.)
Indentation
Indentation indicates levels of nested commands, which indicate what other subcommittees are
available from within the scope. For example, the edit sub-command is available only within a
command that affects tables, and the next sub-command is available only from within the
edit sub-command:
config system interface
edit port1
set status up
next
end
For information about available sub-commands, see Sub-commands on page 1412.
Notation
Brackets, braces, and pipes are used to denote valid permutations of the syntax. Constraint
notations, such as <address_ipv4>, indicate which data types or string patterns are
acceptable value input.
Table 60: Command syntax notation
Convention Description
Using the CLI Page 1410 Install and System Administration for FortiOS 5.0
Table 60: Command syntax notation
Angle brackets < > A word constrained by data type. The angled brackets contain a
descriptive name followed by an underscore ( _ ) and suffix that
indicates the valid data type. For example, <retries_int>,
indicates that you should enter a number of retries, such as 5.
Data types include:
<xxx_name>: A name referring to another part of the
configuration, such as policy_A.
<xxx_index>: An index number referring to another part of the
configuration, such as 0 for the first static route.
<xxx_pattern>: A regular expression or word with wild cards
that matches possible variations, such as *@example.com to
match all email addresses ending in @example.com.
<xxx_fqdn>: A fully qualified domain name (FQDN), such as
mail.example.com.
<xxx_email>: An email address, such as admin@example.com.
<xxx_ipv4>: An IPv4 address, such as 192.168.1.99.
<xxx_v4mask>: A dotted decimal IPv4 netmask, such as
255.255.255.0.
<xxx_ipv4mask>: A dotted decimal IPv4 address and netmask
separated by a space, such as
192.168.1.99 255.255.255.0.
<xxx_ipv4/mask>: A dotted decimal IPv4 address and
CIDR-notation netmask separated by a slash, such as
192.168.1.1/24.
<xxx_ipv4range>: A hyphen ( - )-delimited inclusive range of
IPv4 addresses, such as 192.168.1.1-192.168.1.255.
<xxx_ipv6>: A colon( : )-delimited hexadecimal IPv6 address,
such as 3f2e:6a8b:78a3:0d82:1725:6a2f:0370:6234.
<xxx_v6mask>: An IPv6 netmask, such as /96.
<xxx_ipv6mask>: A dotted decimal IPv6 address and netmask
separated by a space.
<xxx_str>: A string of characters that is not another data type,
such as P@ssw0rd. Strings containing spaces or special
characters must be surrounded in quotes or use escape
sequences. See Special characters on page 1418.
<xxx_int>: An integer number that is not another data type,
such as 15 for the number of minutes.
Using the CLI Page 1411 Install and System Administration for FortiOS 5.0
Table 60: Command syntax notation
Sub-commands
Each command line consists of a command word that is usually followed by words for the
configuration data or other specific item that the command uses or affects:
get system admin
Sub-commands are available from within the scope of some commands.When you enter a
sub-command level, the command prompt changes to indicate the name of the current
command scope. For example, after entering:
config system admin
the command prompt becomes:
(admin)#
Applicable sub-commands are available to you until you exit the scope of the command, or until
you descend an additional level into another sub-command.
For example, the edit sub-command is available only within a command that affects tables;
the next sub-command is available only from within the edit sub-command:
config system interface
edit port1
set status up
next
end
Sub-command scope is indicated by indentation. See Indentation on page 1410.
Available sub-commands vary by command.From a command prompt within config, two
types of sub-commands might become available:
commands affecting fields
commands affecting tables
Using the CLI Page 1412 Install and System Administration for FortiOS 5.0
Table 61: Commands for tables
clone <table> Clone (or make a copy of) a table from the current object.
For example, in config firewall policy, you could enter the
following command to clone security policy 27 to create security policy 30:
clone 27 to 39
In config antivirus profile, you could enter the following
command to clone an antivirus profile named av_pro_1 to create a new
antivirus profile named av_pro_2:
clone av_pro_1 to av_pro_2
clone may not be available for all tables.
end Save the changes to the current object and exit the config command.
This returns you to the top-level command prompt.
Using the CLI Page 1413 Install and System Administration for FortiOS 5.0
Table 61: Commands for tables
show Display changes to the default configuration. Changes are listed in the
form of configuration commands.
abort Exit both the edit and/or config commands without saving the fields.
end Save the changes made to the current table or object fields, and exit the
config command. (To exit without saving, use abort instead.)
move Move an object within a list, when list order is important. For example,
rearranging security policies within the policy list.
Using the CLI Page 1414 Install and System Administration for FortiOS 5.0
Table 62: Commands for fields
next Save the changes you have made in the current tables fields, and exit the
edit command to the object prompt. (To save and exit completely to the root
prompt, use end instead.)
next is useful when you want to create or edit several tables in the same
object, without leaving and re-entering the config command each time.
next is only available from a table prompt; it is not available from an object
prompt.
show Display changes to the default configuration. Changes are listed in the form of
configuration commands.
Permissions
Depending on the account that you use to log in to the FortiGate unit, you may not have
complete access to all CLI commands. Access profiles control which CLI commands an
administrator account can access. Access profiles assign either read, write, or no access to
each area of the FortiGate software. To view configurations, you must have read access. To
make changes, you must have write access.
Unlike other administrator accounts, the administrator account named admin exists by default
and cannot be deleted. The admin administrator account is similar to a root administrator
account. This administrator account always has full permission to view and change all FortiGate
configuration options, including viewing and changing all other administrator accounts. Its
name and permissions cannot be changed. It is the only administrator account that can reset
Using the CLI Page 1415 Install and System Administration for FortiOS 5.0
another administrators password without being required to enter that administrators existing
password.
Set a strong password for the admin administrator account, and change the password
regularly. By default, this administrator account has no password. Failure to maintain the
password of the admin administrator account could compromise the security of your FortiGate
unit.
For complete access to all commands, you must log in with the administrator account named
admin.
Tips
Basic features and characteristics of the CLI environment provide support and ease of use for
many CLI tasks.
Help
To display brief help during command entry, press the question mark (?) key.
Press the question mark (?) key at the command prompt to display a list of the commands
available and a description of each command.
Type a word or part of a word, then press the question mark (?) key to display a list of valid
word completions or subsequent words, and to display a description of each.
Action Keys
Move the cursor left or right within the command line. Left or Right
arrow
Using the CLI Page 1416 Install and System Administration for FortiOS 5.0
Table 63: Shortcuts and key commands
Abort current interactive commands, such as when entering multiple lines. Ctrl + C
If you are not currently within an interactive command such as config or
edit, this closes the CLI connection.
Continue typing a command on the next line for a multi-line command. \ then Enter
For each line that you want to continue, terminate it with a backslash ( \ ). To
complete the command line, terminate it by pressing the spacebar and then
the Enter key, without an immediately preceding backslash.
Command abbreviation
You can abbreviate words in the command line to their smallest number of non-ambiguous
characters.
For example, the command get system status could be abbreviated to g sy st.
Using the CLI Page 1417 Install and System Administration for FortiOS 5.0
Environment variables
The CLI supports the following environment variables. Variable names are case-sensitive.
Table 65: Environment variables
$USERFROM The management access type (ssh, telnet, jsconsole for the CLI
Console widget in the web-based manager, and so on) and the IP address of
the administrator that configured the item.
$USERNAME The account name of the administrator that configured the item.
For example, the FortiGate units host name can be set to its serial number.
config system global
set hostname $SerialNum
end
As another example, you could log in as admin1, then configure a restricted secondary
administrator account for yourself named admin2, whose first-name is admin1 to indicate
that it is another of your accounts:
config system admin
edit admin2
set first-name $USERNAME
Special characters
The characters <, >, (,), #, ', and are not permitted in most CLI fields. These characters are
special characters, also known as reserved characters.
You may be able to enter special character as part of a strings value by using a special
command, enclosing it in quotes, or preceding it with an escape sequence in this case, a
backslash ( \ ) character.
In other cases, different keystrokes are required to input a special character. If you need to enter
? as part of config, you first need to input CTRL-V. If you enter the question mark (?) without first
using CTRL-V, the question mark has a different meaning in CLI: it will show available command
options in that section.
For example, if you enter ? without CTRL-V:
edit "*.xe
token line: Unmatched double quote.
If you enter ? with CTRL-V:
edit "*.xe?"
new entry '*.xe?' added
Table 66: Entering special characters
Character Keys
? Ctrl + V then ?
Using the CLI Page 1418 Install and System Administration for FortiOS 5.0
Table 66: Entering special characters
' \'
(to be interpreted as part of a string value,
not to end the string)
" \"
(to be interpreted as part of a string value,
not to end the string)
\ \\
Using the CLI Page 1419 Install and System Administration for FortiOS 5.0
Using -f:
show | grep -f ldap-group1
config user group
edit "ldap-group1"
set member "pc40-LDAP"
next
end
config firewall policy
edit 2
set srcintf "port31"
set dstintf "port32"
set srcaddr "all"
set action accept
set identity-based enable
set nat enable
config identity-based-policy
edit 1
set schedule "always"
set groups "ldap-group1"
set dstaddr "all"
set service "ALL"
next
end
next
end
Using the CLI Page 1420 Install and System Administration for FortiOS 5.0
For best results, you should:
use UTF-8 encoding, or
use only the characters whose numerically encoded values are the same in UTF-8, such as
the US-ASCII characters that are also encoded using the same values in ISO 8859-1,
Windows code page 1252, Shift-JIS and other encodings, or
for regular expressions that must match HTTP requests, use the same encoding as your
HTTP clients.
HTTP clients may send requests in encodings other than UTF-8. Encodings usually vary by the
clients operating system or input language. If you cannot predict the clients encoding, you
may only be able to match any parts of the request that are in English, because regardless of
the encoding, the values for English characters tend to be encoded identically. For example,
English words may be legible regardless of interpreting a web page as either ISO 8859-1 or as
GB2312, whereas simplified Chinese characters might only be legible if the page is interpreted
as GB2312.
If you configure your FortiGate unit using other encodings, you may need to switch language
settings on your management computer, including for your web browser or Telnet/SSH client.
For instructions on how to configure your management computers operating system language,
locale, or input method, see its documentation.
If you choose to configure parts of the FortiGate unit using non-ASCII characters, verify that all
systems interacting with the FortiGate unit also support the same encodings. You should also
use the same encoding throughout the configuration if possible in order to avoid needing to
switch the language settings of the web-based manager and your web browser or Telnet/SSH
client while you work.
Similarly to input, your web browser or CLI client should usually interpret display output as
encoded using UTF-8. If it does not, your configured items may not display correctly in the
web-based manager or CLI. Exceptions include items such as regular expressions that you may
have configured using other encodings in order to match the encoding of HTTP requests that
the FortiGate unit receives.
Using the CLI Page 1421 Install and System Administration for FortiOS 5.0
Figure 226:Entering encoded characters (CLI Console widget)
10.Press Enter.
In the display area, the CLI Console widget displays your previous command interpreted into
its character code equivalent, such as:
edit \743\601\613\743\601\652
and the commands output.
You may need to surround words that use encoded characters with single quotes ( ' ).
Depending on your Telnet/SSH clients support for your languages input methods and for
sending international characters, you may need to interpret them into character codes
before pressing Enter.
For example, you might need to enter:
edit '\743\601\613\743\601\652'
5. The CLI displays your previous command and its output.
Screen paging
You can configure the CLI to pause after displaying each pages worth of text when displaying
multiple pages of output. When the display pauses, the last line displays --More--. You can
then either:
press the spacebar to display the next page.
type Q to truncate the output and return to the command prompt.
Using the CLI Page 1422 Install and System Administration for FortiOS 5.0
This may be useful when displaying lengthy output, such as the list of possible matching
commands for command completion, or a long list of settings. Rather than scrolling through or
possibly exceeding the buffer of your terminal emulator, you can simply display one page at a
time.
To configure the CLI display to pause when the screen is full:
config system console
set output more
end
Baud rate
You can change the default baud rate of the local console connection.
To change the baud rate enter the following commands:
config system console
set baudrate {115200 | 19200 | 38400 | 57600 | 9600}
end
Do not edit the first line. The first line(s) of the configuration file (preceded by a # character)
contains information about the firmware version and FortiGate model. If you change the model
number, the FortiGate unit will reject the configuration file when you attempt to restore it.
3. Use execute restore to upload the modified configuration file back to the FortiGate unit.
The FortiGate unit downloads the configuration file and checks that the model information is
correct. If it is, the FortiGate unit loads the configuration file and checks each command for
errors. If a command is invalid, the FortiGate unit ignores the command. If the configuration
file is valid, the FortiGate unit restarts and loads the new configuration.
Using the CLI Page 1423 Install and System Administration for FortiOS 5.0
Differences between regular expression and wildcard pattern matching
In Perl regular expressions, the period (.) character refers to any single character. It is similar to
the question mark (?) character in wildcard pattern matching. As a result:
example.com not only matches example.com but also matches exampleacom,
examplebcom, exampleccom and so on.
To match a special character such as the period ('.') and the asterisk (*), regular expressions
use the slash (\) escape character. For example:
To match example.com, the regular expression should be example\.com.
In Perl regular expressions, the asterisk (*) means match 0 or more times of the character
before it, not 0 or more times of any character. For example:
exam*\.com matches exammmm.com but does not match eample.com.
To match any character 0 or more times, use .* where . means any character and the *
means 0 or more times. For example:
the wildcard match pattern exam*.com is equivalent to the regular expression
exam.*\.com.
Word boundary
In Perl regular expressions, the pattern does not have an implicit word boundary. For example,
the regular expression test not only matches the word test but also matches any word that
contains the word test such as atest, mytest, testimony, atestb. The notation \b
specifies the word boundary. To match exactly the word test, the expression should be
\btest\b.
Case sensitivity
Regular expression pattern matching is case sensitive in the Web and Spam filters. To make a
word or phrase case insensitive, use the regular expression /i. For example, /bad
language/i will block all instances of bad language regardless of case.
Table 67: Perl regular expression examples
Expression Matches
abc abc (that exact character sequence, but anywhere in the string)
^abc|abc$ the string abc at the beginning or at the end of the string
Using the CLI Page 1424 Install and System Administration for FortiOS 5.0
Table 67: Perl regular expression examples
[abc]+ any (nonempty) string of a's, b's and c's (such as a, abba, acbabcacaa)
[^abc]+ any (nonempty) string which does not contain any of a, b and c (such as
defg)
100\s*mk the strings 100 and mk optionally separated by any amount of white space
(spaces, tabs, newlines)
abc\b abc when followed by a word boundary (e.g. in abc! but not in abcd)
perl\B perl when not followed by a word boundary (e.g. in perlert but not in perl
stuff)
\x tells the regular expression parser to ignore white space that is neither
backslashed nor within a character class. You can use this to break up your
regular expression into (slightly) more readable parts.
Using the CLI Page 1425 Install and System Administration for FortiOS 5.0
Basic Administration
The FortiGate unit requires some basic configuration to add it to your network. These basic
steps include assigning IP addresses, adding routing, and configuring security policies. Until the
administrator completes these steps, inter-network and Internet traffic will not flow through the
unit.
There are two methods of configuring the FortiGate unit: the web-based manager or the
command line interface (CLI). This chapter will step through both methods to complete the
basic configurations to put the device on your network. Use whichever you are most
comfortable with.
This chapter also provides guidelines for password and administrator best practices as well as
how to upgrade the firmware.
This section includes the topics:
Connecting to the FortiGate unit
System configuration
Passwords
Administrators
Configuration backups
Firmware
Controlled upgrade
For setup and configuration of your specific FortiGate models, see the QuickStart Guide for that
model.
To configure, maintain and administer the FortiGate unit, you need to connect to it from a
management computer. There are two ways to do this:
using the web-based manager: a GUI interface that you connect to using a current web
browser, such as Firefox or Internet Explorer.
using the command line interface (CLI): a command line interface similar to DOS or UNIX
commands that you connect to using SSH or a Telnet terminal.
Page 1426
To connect to the web-based manager
1. Set the IP address of the management computer to the static IP address 192.168.1.2 with
a netmask of 255.255.255.0.
2. Using the Ethernet cable, connect the internal or port 1 interface of the FortiGate unit to the
computer Ethernet connection.
3. Start your browser and enter the address https://192.168.1.99. (remember to include
the s in https://).
To support a secure HTTPS authentication method, the FortiGate unit ships with a
self-signed security certificate that is offered to remote clients whenever they initiate a
HTTPS connection to the FortiGate unit. When you connect, the FortiGate unit displays two
security warnings in a browser.
The first warning prompts you to accept and optionally install the FortiGate units self-signed
security certificate. If you do not accept the certificate, the FortiGate unit refuses the
connection. If you accept the certificate, the FortiGate login page appears. The credentials
entered are encrypted before they are sent to the FortiGate unit. If you choose to accept the
certificate permanently, the warning is not displayed again.
Just before the FortiGate login page is displayed, a second warning informs you that the
FortiGate certificate distinguished name differs from the original request. This warning
occurs because the FortiGate unit redirects the connection. This is an informational
message. Select OK to continue logging in.
4. Type admin in the Name field and select Login.
System configuration
Once the FortiGate unit is connected and traffic can pass through, several more configuration
options are available. While not mandatory, they will help to ensure better control with the
firewall.
Basic Administration Page 1427 Install and System Administration for FortiOS 5.0
Set the time and date - CLI
config system global
set timezone <zone_value>
end
execute date [<date_str>]
execute time [<time_str>]
By default, FortiOS has the daylight savings time configuration enabled. The system time must
be manually adjusted after daylight saving time ends. To disable DST, enter the following
command in the CLI:
config system global
set dst disable
end
Configuring FortiGuard
FortiGuard is Fortinets threat research and response team. With more than 200 security
engineers and forensic analysts around the globe providing 24 hours a day, 365 days a year
analysis of current threats on the Internet, the FortiGuard teams sole purpose is to protect
customers.
The FortiGuard Distribution Network (FDN) is a world-wide network of FortiGuard Distribution
Servers (FDS). When the FortiGate unit connects to the FDN, it connects to the nearest FDS. To
do this, all FortiGate units are programmed with a list of FDS addresses sorted by nearest time
zone according to the time zone configured for the FortiGate unit.
Before you can begin receiving updates, you must register your FortiGate unit from the Fortinet
webpage. After registering, you need to configure the FortiGate unit to connect to the FDN to
update antivirus, antispam, and IPS attack definitions.
Basic Administration Page 1428 Install and System Administration for FortiOS 5.0
Updating antivirus and IPS definitions
After you have registered your FortiGate unit, you can update the definitions for antivirus and
IPS. The FortiGuard Center enables you to receive push updates, allow push update to a
specific IP address, and schedule updates for daily, weekly, or hourly intervals.
Updating antivirus definitions can cause a very short disruption in traffic currently being
scanned while the FortiGate unit applies the new signature database. Schedule updates when
traffic is light, for example overnight, to minimize any disruption.
Passwords
The FortiGate unit ships with a default admin account that has no password. You will want to
apply a password to prevent anyone from logging into the FortiGate unit and changing
configuration options.
Password considerations
When changing the password, consider the following to ensure better security.
Do not make passwords that are obvious, such as the company name, administrator names,
or other obvious word or phrase.
Use numbers in place of letters, for example, passw0rd. Alternatively, spell words with extra
letters, for example, password.
Administrative passwords can be up to 64 characters.
Basic Administration Page 1429 Install and System Administration for FortiOS 5.0
Include a mixture of letters, numbers, and upper and lower case.
Use multiple words together, or possibly even a sentence, for example keytothehighway.
Use a password generator.
Change the password regularly and always make the new password unique and not a
variation of the existing password, such as changing from password to password1.
Write the password down and store it in a safe place away from the management computer,
in case you forget it or ensure that at least two people know the password in the event that
one person becomes ill, is away on vacation or leaves the company. Alternatively, have two
different admin logins.
Password policy
The FortiGate unit includes the ability to enforce a password policy for administrator login. With
this policy, you can enforce regular changes and specific criteria for a password including:
minimum length between 8 and 64 characters.
if the password must contain uppercase (A, B, C) and/or lowercase (a, b, c) characters.
if the password must contain numbers (1, 2, 3).
if the password must contain non-alphanumeric characters (!, @, #, $, %, ^, &, *, ().
where the password applies (admin or IPsec or both).
the duration of the password before a new one must be specified.
Basic Administration Page 1430 Install and System Administration for FortiOS 5.0
Lost Passwords
If an administrator password has been lost, refer to the SysAdmins Notebook article Resetting
a lost admin password, found at docs.fortinet.com/p/sysadmin-s-notebook-and-tech-notes.
Administrators
By default, the FortiGate unit has a super administrator called admin. This user login cannot
be deleted and always has ultimate access over the FortiGate unit. Additional administrators
can be added for various functions, each with a unique username, password, and set of access
privileges.
There are two levels of administrator accounts; regular administrators and system
administrators. Regular administrators are administrators with any admin profile other than the
default super_admin. System administrators are administrators that are assigned the
super_admin profile, which has the highest level of access.
Adding administrators
The name of the administrator should not contain the characters <>()#"'. Using these
characters in the administrator account name can result in a cross site scripting (XSS)
vulnerability.
Only the default admin account or an administrator with read-write access control to add new
administrator accounts and control their permission levels can create a new administrator
account. If you log in with an administrator account that does not have the super_admin admin
profile, the administrators list will show only the administrators for the current virtual domain.
When adding administrators, you are setting up the administrators user account. An
administrator account comprises of an administrators basic settings as well as their access
profile. The access profile is a definition of what the administrator is capable of viewing and
editing.
Basic Administration Page 1431 Install and System Administration for FortiOS 5.0
To add an administrator - CLI
config system admin
edit <admin_name>
set password <password>
set accprofile <profile_name>
end
Basic Administration Page 1432 Install and System Administration for FortiOS 5.0
3. In the section labelled Remote authentication servers, select Add.
4. Select the Remote Server from the drop-down list.
5. Select OK.
Monitoring administrators
You can view the administrators logged in using the System Information widget on the
Dashboard. On the widget is the Current Administrator row that shows the administrator logged
in and the total logged in. Selecting Details displays the administrators), where they are logging
in from and how (CLI, web-based manager) and when they logged in.
You are also able to monitor the activities the administrators perform on the FortiGate unit using
the logging of events. Event logs include a number of options to track configuration changes.
Basic Administration Page 1433 Install and System Administration for FortiOS 5.0
To set logging - web-based manager
1. Go to Log & Report > Log Config > Log Settings.
2 Under Event Logging, ensure System activity event is selected.
3 Select Apply.
Administrator profiles
Administer profiles define what the administrator user can do when logged into the FortiGate
unit. When you set up an administrator user account, you also assign an administrator profile,
which dictates what the administrator user will see. Depending on the nature of the
administrators work, access level or seniority, you can allow them to view and configure as
much, or as little, as required.
super_admin profile
The super_admin administrator is the administrative account that the primary administrator
should have to log into the FortiGate unit. The profile can not be deleted or modified to ensure
there is always a method to administer the FortiGate unit.This user profile has access to all
components of FortiOS, including the ability to add and remove other system administrators.
For some administrative functions, such as backing up and restoring the configuration using
SCP, super_admin access is required.
Creating profiles
To configure administrator profiles go to System > Admin > Admin Profiles. You can only assign
one profile to an administrator user.
On the New Admin Profile page, you define the components of FortiOS that will be available to
view and/or edit. For example, if you configure a profile so that the administrator can only
access the firewall components, when an administrator with that profile logs into the FortiGate
unit, they will only be able to view and edit any firewall components including policies,
addresses, schedules and any other settings that directly affect security policies.
Basic Administration Page 1434 Install and System Administration for FortiOS 5.0
Global and vdom profiles
By default, when you add a new administrative profile, it is set to have a vdom scope. That is,
only the super_admin has a global profile that enables configuration of the entire FortiGate unit.
There may be instances where additional global administrative profiles may be required. To add
more global profiles, use the following CLI command to set or change an administrative profile
to be global.
config system accprofile
set scope global
...
end
Once the scope is set, you can enable the read and read/write settings.
Management access
Management access defines how administrators are able to log on to the FortiGate unit to
perform management tasks such as configuration and maintenance. Methods of access can
include local access through the console connection or remote access over a network or
modem interface using various protocols including Telnet and HTTPS.
You can configure management access on any interface in your VDOM. In NAT mode, the
interface IP address is used for management access. In transparent mode, you configure a
single management IP address that applies to all interfaces in your VDOM that permit
management access. The FortiGate unit also uses this IP address to connect to the FDN for
virus and attack updates.
The system administrator (admin) can access all VDOMs, and create regular administrator
accounts. A regular administrator account can access only the VDOM to which it belongs and
the management computer must connect to an interface in that VDOM. In both cases, the
management computer must connect to an interface that permits management access and its
IP address must be on the same network. Management access can be via HTTP, HTTPS, Telnet,
or SSH sessions, if those services are enabled on the interface. HTTPS and SSH are preferred
as they are more secure.
You can allow remote administration of the FortiGate unit. However, allowing remote
administration from the Internet could compromise the security of the FortiGate unit. You should
avoid this unless it is required for your configuration. The following precautions can be taken to
improve the security of a FortiGate unit that allows remote administration from the Internet:
Use secure administrative user passwords.
Change these passwords regularly.
Enable two-factor authentication for administrators.
Enable secure administrative access to this interface using only HTTPS or SSH.
Use Trusted Hosts to limit where the remote access can originate from.
Do not change the system idle timeout from the default value of 5 minutes.
Basic Administration Page 1435 Install and System Administration for FortiOS 5.0
Security Precautions
One potential point of a security breach is at the management computer. Administrators who
leave their workstations for a prolonged amount of time while staying logged into the
web-based manager or CLI leave the firewall open to malicious intent.
To do this, you need to create another super user with full access and log in as that user. Then
go to System > Admin > Administrator, select the admin account, and select Edit to change the
user name.
If it has not been done already, the password should also be changed at this time. For tips
about changing the password, see Password considerations on page 1429.
To disable concurrent admin sessions, enter the following command in the CLI:
config system global
set admin-concurrent disable
end
On 2U FortiGate units, this option is also available in the Web-Based Manager by going to
System > Admin > Settings and select Allow each admin to log in with multiple sessions.
Basic Administration Page 1436 Install and System Administration for FortiOS 5.0
Segregated administrative roles
To minimize the effect of an administrator causing errors to the FortiGate configuration and
possibly jeopardizing the network, create individual administrative roles where none of the
administrators have super-admin permissions. For example, one admin account is used solely
to create security policies, another for users and groups, another for VPN, and so on.
Administrator lockout
By default, the FortiGate unit includes set number of three password retries, allowing the
administrator a maximum of three attempts to log into their account before they are locked out
for a set amount of time (by default, 60 seconds).
The number of attempts can be set to an alternate value, as well as the default wait time before
the administrator can try to enter a password again. You can also change this to further sway
would-be hackers. Both settings are must be configured with the CLI
Idle time-out
To avoid the possibility of an administrator walking away from the management computer and
leaving it exposed to unauthorized personnel, you can add an idle time-out that will
automatically log the user out if the web-based manager is not used for a specified amount of
time. This will cause the administrator to log in to the device again in order to continue their
work.
Basic Administration Page 1437 Install and System Administration for FortiOS 5.0
The time-out can be set as high as 480 minutes, or eight hours, although this is not recommend.
Administrative ports
You can set the web-based manager access to use HTTP, HTTPS, SSH, and Telnet. In these
cases, the default ports for these protocols are 80, 443, 22, and 23 respectively. You can
change the ports used for network administration to a different, unused port to further limit
potential hackers.
Ensure the port you select is not a port you will be using for other applications. For a list of
assigned port numbers, see http://www.iana.org/assignments/port-numbers.
HTTPS redirect
When selecting port numbers for various protocols, you can also enable or disable the Redirect
to HTTPS option. When enabled, if you select the Administrative Access for an interface to be
Basic Administration Page 1438 Install and System Administration for FortiOS 5.0
only HTTP, HTTPS will automatically be enabled, allowing the administrator access with either
HTTP or HTTPS. The administrator can then log in using HTTPS for better security.
Note that if an SSL VPN is also configured for the same port, the SSL connection is over the
HTTPS protocol. In these situations, the FortiGate unit will not redirect an HTTP address to the
SSL VPN HTTPS address. Ideally, the administrator should not have the management address
and an SSL VPN portal on the same interface.
To disable an interface:
config system global
set pre-login-banner enable
set post-login-banner enable
end
When set, once the administrator enters their user name and password, the disclaimer appears.
They must select either Accept or Decline to proceed. When the post login is enabled, once the
administrator logs out they are presented with the same message.
The banner is a default message that you can customize by going to System > Config >
Replacement Messages. Select Extended View to see the Admin category and messages.
To disable an interface:
config system console
set login disable
end
Disable interfaces
If any of the interfaces on the FortiGate unit are not being used, disable traffic on that interface.
This avoids someone plugging in network cables and potentially causing network bypass or
loop issues.
Basic Administration Page 1439 Install and System Administration for FortiOS 5.0
To disable an interface - CLI
config system interface
edit <inerface_name>
set status down
end
Basic Administration Page 1440 Install and System Administration for FortiOS 5.0
If you want to use an TACACS+ server to authenticate administrators in your VDOM, you must
configure the authentication before you create the administrator accounts. To do this you need
to:
configure the FortiGate unit to access the TACACS+ server
create a TACACS+ user group
configure an administrator to authenticate with a TACACS+ server.
General Settings
Go to System > Admin > Settings to configure basic settings for administrative access,
password policies and displaying additional options in the web-based manager.
Password policies
Password policies, available by going to System > Admin > Settings, enable you to create a
password policy that any administrator or user who updates their password, must follow. Using
the available options you can define the required length of the password, what it must contain
(numbers, upper and lower case, and so on) and an expiry time frame.
The FortiGate unit will warn of any password that is added and does not meet the criteria.
Feature Select
Feature Select is used to disable features which are not required for network administration.
Disabling features also removes all related configuration options from the web-based manager.
Feature Select can be managed using the Features widget on the Status page. They can also be
found at System > Config > Features, where additional features are also available by selecting
Show More.
Basic Administration Page 1441 Install and System Administration for FortiOS 5.0
Figure 230:The Features widget
If a feature, such as IPv6, has been configured before being removed from the web-based
manager, this configuration will still exist as part of the network, even though it is no longer
visible using the web-based manager.
Configuration backups
Once you configure the FortiGate unit and it is working correctly, it is extremely important that
you backup the configuration. In some cases, you may need to reset the FortiGate unit to
factory defaults or perform a TFTP upload of the firmware, which will erase the existing
configuration. In these instances, the configuration on the device will have to be recreated,
unless a backup can be used to restore it.
It is also recommended that once any further changes are made that you backup the
configuration immediately, to ensure you have the most current configuration available. Also,
ensure you backup the configuration before upgrading the FortiGate units firmware. Should
anything happen during the upgrade that changes the configuration, you can easily restore the
saved configuration.
Always backup the configuration and store it on the management computer or off-site. You
have the option to save the configuration file to various locations including the local PC, USB
key, FTP and TFTP site.The latter two are configurable through the CLI only.
If you have VDOMs, you can back up the configuration of the entire FortiGate unit or only a
specific VDOM. Note that if you are using FortiManager or FortiCloud, full backups are
performed and the option to backup individual VDOMs will not appear.
Basic Administration Page 1442 Install and System Administration for FortiOS 5.0
3. Select to backup to your Local PC or to a USB key.
The USB Disk option will be grayed out if no USB drive is inserted in the USB port. You can
also backup to the FortiManager using the CLI.
4. If VDOMs are enabled, select to backup the entire FortiGate configuration (Full Config) or
only a specific VDOM configuration (VDOM Config).
5. If backing up a VDOM configuration, select the VDOM name from the list.
6. Select Encrypt configuration file.
Encryption must be enabled on the backup file to back up VPN certificates.
7. Enter a password and enter it again to confirm it. You will need this password to restore the
file.
8. Select Backup.
9. The web browser will prompt you for a location to save the configuration file. The
configuration file will have a .conf extension.
Basic Administration Page 1443 Install and System Administration for FortiOS 5.0
Enable SSH access on the interface
SCP uses the SSH protocol to provide secure file transfer. The interface you use for
administration must allow SSH access.
When adding to, or removing a protocol, you must type the entire list again. For example, if you
have an access list of HTTPS and SSH, and you want to add PING, typing:
set allowaccess ping
Linux
scp admin@<FortiGate_IP>:fgt-config <location>
Windows
pscp admin@<FortiGate_IP>:fgt-config <location>
The following examples show how to download the configuration file from a FortiGate-100D, at
IP address 172.20.120.171, using Linux and Windows SCP clients.
Basic Administration Page 1444 Install and System Administration for FortiOS 5.0
SCP public-private key authentication
SCP authenticates itself to the FortiGate unit in the same way as an administrator using SSH
accesses the CLI. Instead of using a password, you can configure the SCP client and the
FortiGate unit with a public-private key pair.
Restoring a configuration
Should you need to restore a configuration file, use the following steps:
Basic Administration Page 1445 Install and System Administration for FortiOS 5.0
To back up the FortiGate configuration - CLI
execute restore config management-station normal 0
or
execute restore config usb <filename> [<password>]
or for FTP, note that port number, username are optional depending on the FTP site
execute backup config ftp <backup_filename> <ftp_server> [<port>]
[<user_name>] [<password>]
or for TFTP
execute backup config tftp <backup_filename> <tftp_server> <password>
The FortiGate unit will load the configuration file and restart. Once the restart has completed,
verify that the configuration has been restored.
Configuration revisions
The Revisions options on the System Information widget enables you to manage multiple
versions of configuration files. Revision control requires either a configured central management
server, or FortiGate units with 512 MB or more of memory. The central management server can
either be a FortiManager unit or the FortiCloud.
When revision control is enabled on your unit, and configurations have been backed up, a list of
saved revisions of those backed-up configurations appears.
To reset the FortiGate unit to its factory default settings - web-based manager
1. Go to System > Dashboard > Status.
2. In the System Information widget, select Restore for the System Configuration.
3. Select Restore Factory Defaults at the top of the page.
Firmware
Fortinet periodically updates the FortiGate firmware to include new features and resolve
important issues. After you have registered your FortiGate unit, you can download firmware
updates from the support web site, http://support.fortinet.com.
Basic Administration Page 1446 Install and System Administration for FortiOS 5.0
The FortiGate unit includes a number of firmware installation options that enables you to test
new firmware without disrupting the existing installation, and load it from different locations as
required.
Before you install any new firmware, be sure to follow the steps below:
review the Release Notes for a new firmware release.
review the Supported Upgrade Paths document to make sure the upgrade from your current
image to the desired new image is supported.
backup the current configuration.
download the new firmware image.
test the patch release until you are satisfied that it applies to your configuration.
Installing a patch release without reviewing release notes or testing the firmware may result in
changes to settings or unexpected issues.
Only FortiGate admin user and administrators whose access profiles contain system read and
write privileges can change the FortiGate firmware.
Downloading firmware
Firmware images for all FortiGate units is available on the Fortinet Customer Support website.
You must register your FortiGate unit to access firmware images. Register the FortiGate unit by
visiting http://support.fortinet.com and select Product Registration.
To download firmware
1. Log into the site using your user name and password.
2. Go to Firmware Images > FortiGate.
3. Select the most recent FortiOS version.
4. Locate the firmware for your FortiGate unit, right-click the link and select the Download
option for your browser.
Basic Administration Page 1447 Install and System Administration for FortiOS 5.0
5. Enter the following command to restart the FortiGate unit:
execute reboot
6. As the FortiGate unit reboots, press any key to interrupt the system startup. As the FortiGate
unit starts, a series of system startup messages appears.
When the following messages appears:
Press any key to display configuration menu....
7. Immediately press any key to interrupt the system startup.
You have only 3 seconds to press any key. If you do not press a key soon enough, the FortiGate
unit reboots and you must login and repeat the execute reboot command.
If you successfully interrupt the startup process, the following messages appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B[: Boot with backup firmware and set as default
[C]: Configuration and information
[Q]: Quit menu and continue to boot with default
firmware.
[H]: Display this list of options.
Enter G, F, Q, or H:
8. Type G to get the new firmware image from the TFTP server.
The following message appears:
Enter TFTP server address [192.168.1.168]:
9. Type the address of the TFTP server and press Enter:
The following message appears:
Enter Local Address [192.168.1.188]:
10.Type an IP address of the FortiGate unit to connect to the TFTP server.
The IP address must be on the same network as the TFTP server.
Make sure you do not enter the IP address of another device on this network.
Basic Administration Page 1448 Install and System Administration for FortiOS 5.0
You can test the new firmware image as required. When done testing, you can reboot the
FortiGate unit, and the FortiGate unit will resume using the firmware that was running before you
installed the test firmware.
Always remember to back up your configuration before making any changes to the firmware.
Always remember to back up your configuration before making any changes to the firmware.
Basic Administration Page 1449 Install and System Administration for FortiOS 5.0
5. Enter the following command to copy the firmware image from the TFTP server to the
FortiGate unit:
execute restore image tftp <filename> <tftp_ipv4>
Where <name_str> is the name of the firmware image file and <tftp_ip4> is the IP
address of the TFTP server. For example, if the firmware image file name is image.out and
the IP address of the TFTP server is 192.168.1.168, enter:
execute restore image tftp image.out 192.168.1.168
The FortiGate unit responds with the message:
This operation will replace the current firmware version!
Do you want to continue? (y/n)
6. Type y.
7. The FortiGate unit uploads the firmware image file, upgrades to the new firmware version,
and restarts. This process takes a few minutes.
8. Reconnect to the CLI.
9. Update antivirus and attack definitions, by entering:
execute update-now
Basic Administration Page 1450 Install and System Administration for FortiOS 5.0
6. Enter the following command to restart the FortiGate unit.
execute reboot
The FortiGate unit responds with the following message:
This operation will reboot the system!
Do you want to continue? (y/n)
7 Type y.
As the FortiGate unit starts, a series of system startup messages appears. When the
following messages appears:
Press any key to display configuration menu..........
Immediately press any key to interrupt the system startup.
You have only 3 seconds to press any key. If you do not press a key soon enough, the FortiGate
unit reboots and you must log in and repeat the execute reboot command.
If you successfully interrupt the startup process, the following messages appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B[: Boot with backup firmware and set as default
[C]: Configuration and information
[Q]: Quit menu and continue to boot with default
firmware.
[H]: Display this list of options.
Enter G, F, Q, or H:
8. Type G to get to the new firmware image form the TFTP server.
The following message appears:
Enter TFTP server address [192.168.1.168]:
9. Type the address of the TFTP server and press Enter:
The following message appears:
Enter Local Address [192.168.1.188]:
10.Type an IP address the FortiGate unit can use to connect to the TFTP server. The IP address
can be any IP address that is valid for the network the interface is connected to.
Make sure you do not enter the IP address of another device on this network.
Basic Administration Page 1451 Install and System Administration for FortiOS 5.0
12 Type D.
The FortiGate unit installs the new firmware image and restarts. The installation might take a
few minutes to complete.
Always remember to back up your configuration before making any changes to the firmware.
Basic Administration Page 1452 Install and System Administration for FortiOS 5.0
4. Make sure the FortiGate unit can connect to the TFTP server execute by using the execute
ping command.
5. Enter the following command to copy the firmware image from the TFTP server to the
FortiGate unit:
execute restore image tftp <name_str> <tftp_ipv4>
Where <name_str> is the name of the firmware image file and <tftp_ip4> is the IP
address of the TFTP server. For example, if the firmware image file name is imagev28.out
and the IP address of the TFTP server is 192.168.1.168, enter:
execute restore image tftp image28.out 192.168.1.168
The FortiGate unit responds with this message:
This operation will replace the current firmware version!
Do you want to continue? (y/n)
6. Type y.
The FortiGate unit uploads the firmware image file. After the file uploads, a message similar
to the following appears:
Get image from tftp server OK.
Check image OK.
This operation will downgrade the current firmware version!
Do you want to continue? (y/n)
7. Type y.
8. The FortiGate unit reverts to the old firmware version, resets the configuration to factory
defaults, and restarts. This process takes a few minutes.
9. Reconnect to the CLI.
10.To restore your previous configuration, if needed, use the command:
execute restore config <name_str> <tftp_ip4>
11.Update antivirus and attack definitions using the command:
execute update-now.
Configuration Revision
The Configuration Revisions menu enables you to manage multiple versions of configuration
files on models that have a 512 flash memory and higher. Revision control requires either a
configured central management server or the local hard drive. The central management server
can either be a FortiManager unit or FortiCloud.
If central management is not configured on your FortiGate unit, a message appears to tell you to
do one of the following:
enable central management (see Central management)
obtain a valid license.
When revision control is enabled on your FortiGate unit, and configurations backups have been
made, a list of saved revisions of those backed-up configurations appears.
Configuration revisions are viewed in the System Information widget on the Dashboard.
Basic Administration Page 1453 Install and System Administration for FortiOS 5.0
You can only save VPN certificates if you encrypt the file. Make sure the configuration
encryption is enabled so you can save the VPN certificates with the configuration file. An
encrypted file is ineffective if selected for the USB Auto-Install feature.
Controlled upgrade
Using a controlled upgrade, you can upload a new version of the FortiOS firmware to a separate
partition in the FortiGate memory for later upgrade. The FortiGate unit can also be configured so
that when it is rebooted, it will automatically load the new firmware (CLI only). Using this option,
you can stage a number of FortiGate units to do an upgrade simultaneously to all devices using
FortiManager or script.
Basic Administration Page 1454 Install and System Administration for FortiOS 5.0
To load the firmware for later installation - web-based manager
1. Go to System > Dashboard > Status.
2. Under System Information > Firmware Version, select Update.
3. Type the path and filename of the firmware image file, or select Browse and locate the file.
4. Deselect the Boot the New Firmware option
5. Select OK.
Basic Administration Page 1455 Install and System Administration for FortiOS 5.0
Best practices
The FortiGate unit is installed, and traffic is moving. With your network sufficiently protected,
you can now fine-tune the firewall for the best performance and efficiency. This chapter
describes configuration options that can ensure your FortiGate unit is running at its best
performance.
This section includes the topics on:
Hardware
Shutting down
Performance
Firewall
Intrusion protection
Antivirus
Web filtering
Antispam
Hardware
Environmental specifications
Keep the following environmental specifications in mind when installing and setting up your
FortiGate unit.
Operating temperature: 32 to 104F (0 to 40C) (temperatures may vary, depending on the
FortiGate model)
If you install the FortiGate unit in a closed or multi-unit rack assembly, the operating ambient
temperature of the rack environment may be greater than room ambient temperature.
Therefore, make sure to install the equipment in an environment compatible with the
manufacturer's maximum rated ambient temperature.
Storage temperature: -13 to 158F (-25 to 70C) (temperatures may vary, depending on the
FortiGate model)
Humidity: 5 to 90% non-condensing
Air flow - For rack installation, make sure that the amount of air flow required for safe
operation of the equipment is not compromised.
For free-standing installation, make sure that the appliance has at least 1.5 in. (3.75 cm) of
clearance on each side to allow for adequate air flow and cooling.
This device complies with part FCC Class A, Part 15, UL/CUL, C Tick, CE and VCCI. Operation
is subject to the following two conditions:
This device may not cause harmful interference, and
This device must accept any interference received, including interference that may cause
undesired operation.
This equipment has been tested and found to comply with the limits for a Class B digital device,
pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable
protection against harmful interference in a residential installation. This equipment generates,
uses, and can radiate radio frequency energy and, if not installed and used in accordance with
Page 1456
the instructions, may cause harmful interference to radio communications. However, there is no
guarantee that interference will not occur in a particular installation. If this equipment does
cause harmful interference to radio or television reception, which can be determined by turning
the equipment off and on, the user is encouraged to try to correct the interference by one or
more of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and receiver.
Connect the equipment into an outlet on a circuit different from that to which the receiver is
connected.
Consult the dealer or an experienced radio/TV technician for help.
The equipment compliance with FCC radiation exposure limit set forth for uncontrolled
Environment.
Grounding
Ensure the FortiGate unit is connected and properly grounded to a lightning and surge
protector. WAN or LAN connections that enter the premises from outside the building should
be connected to an Ethernet CAT5 (10/100 Mb/s) surge protector.
Shielded Twisted Pair (STP) Ethernet cables should be used whenever possible rather than
Unshielded Twisted Pair (UTP).
Do not connect or disconnect cables during lightning activity to avoid damage to the
FortiGate unit or personal injury.
Best practices Page 1457 Install and System Administration for FortiOS 5.0
Shutting down
Always shut down the FortiGate operating system properly before turning off the power switch
to avoid potential hardware problems.
Performance
Disable any management features you do not need. If you dont need SSH or SNMP, disable
them. SSH also provides another possibility for would-be hackers to infiltrate your FortiGate
unit.
Put the most used firewall rules to the top of the interface list.
Log only necessary traffic. The writing of logs, especially if to an internal hard disk, slows
down performance.
Enable only the required application inspections.
Keep alert systems to a minimum. If you send logs to a syslog server, you may not need
SNMP or email alerts, making for redundant processing.
Establish scheduled FortiGuard updates at a reasonable rate. Daily updates occurring every
4-5 hours are sufficient for most situations. In more heavy-traffic situations, schedule
updates for the evening when more bandwidth can be available.
Keep security profiles to a minimum. If you do not need a profile on a firewall rule, do not
include it.
Keep VDOMs to a minimum. On low-end FortiGate units, avoid using them if possible.
Avoid traffic shaping if you need maximum performance. Traffic shaping, by definition, slows
down traffic.
Firewall
Avoid using the All selection for the source and destination addresses. Use addresses or
address groups.
Avoid using Any for the services.
Use logging on a policy only when necessary and be aware of the performance impact. For
example, you may want to log all dropped connections but can choose to use this sparingly
Best practices Page 1458 Install and System Administration for FortiOS 5.0
by sampling traffic data rather than have it continually storing log information you may not
use.
Use the comment field to input management data, for example: who requested the rule, who
authorized it, etc.
Avoid FQDN addresses if possible, unless they are internal. It can cause a performance
impact on DNS queries and security impact from DNS spoofing.
If possible, avoid port ranges on services for security reasons.
Use groups whenever possible.
To ensure that all AV push updates occur, ensure you have an AV profile enabled in a security
policy.
Intrusion protection
Create and use security profiles with specific signatures and anomalies you need
per-interface and per-rule.
Do not use predefined or generic profiles. While these profiles are convenient to supply
immediate protection, you should create profiles to suit your network environment.
If you do use the default profiles, reduce the IPS signatures/anomalies enabled in the profile
to conserve processing time and memory.
If you are going to enable anomalies, make sure you tune thresholds according to your
environment.
If you need protection, but not audit information, disable the logging option.
Tune the IP-protocol parameter accordingly.
Antivirus
Enable only the protocols you need to scan. If you have antivirus scans occurring on the
SMTP server, or use FortiMail, it is redundant to have scanning occur on the FortiGate unit
as well.
Reduce the maximum file size to be scanned. Viruses usually travel in small files of around 1
to 2 megabytes.
Antivirus scanning within an HA cluster can impact performance.
Enable grayware scanning on security profiles tied to Internet browsing.
Do not quarantine files unless you regularly monitor and review them. This is otherwise a
waste of space and impacts performance.
Use file patterns to avoid scanning where it is not required.
Enable heuristics from the CLI if high security is required using the command
config antivirus heuristic.
Best practices Page 1459 Install and System Administration for FortiOS 5.0
Web filtering
Antispam
If possible use, a FortiMail unit. The antispam engines are more robust.
Use fast DNS servers.
Use specific security profiles for the rule that will use antispam.
DNS checks may cause false positive with HELO DNS lookup.
Content analysis (banned words) may impose performance overhead.
Security
Use NTP to synchronize time on the FortiGate and the core network systems, such as email
servers, web servers, and logging services.
Enable log rules to match corporate policy. For example, log administration authentication
events and access to systems from untrusted interfaces.
Minimize adhoc changes to live systems, if possible, to minimize interruptions to the
network. When not possible, create backup configurations and implement sound audit
systems using FortiAnalyzer and FortiManager.
If you only need to allow access to a system on a specific port, limit the access by creating
the strictest rule possible.
Best practices Page 1460 Install and System Administration for FortiOS 5.0
FortiGuard
The FortiGuard Distribution Network (FDN) of servers provides updates to antivirus, antispam
and IPS definitions to your FortiGate unit. Worldwide coverage of FortiGuard services is
provided by FortiGuard service points. FortiGuard Subscription Services provide
comprehensive Unified Threat Management (UTM) security solutions to enable protection
against content and network level threats.
The FortiGuard team can be found around the globe, monitoring virus, spyware and vulnerability
activities. As vulnerabilities are found, signatures are created and pushed to the subscribed
FortiGate units. The Global Threat Research Team enables Fortinet to deliver a combination of
multi-layered security intelligence and provide true zero-day protection from new and emerging
threats.The FortiGuard Network has data centers around the world located in secure, high
availability locations that automatically deliver updates to the Fortinet security platforms to and
protect the network with the most up-to-date information.
To ensure optimal response and updates, the FortiGate unit will contact a FortiGuard service
point closest to the FortiGate installation, using the configured time zone information.
FortiGuard services are continuously updated year-round, 24x7.
Every FortiGate unit includes a free 30-day FortiGuard trial license. FortiGuard license
management is performed by Fortinet servers. The FortiGate unit automatically contacts a
FortiGuard service point when enabling FortiGuard services. Contact Fortinet Technical Support
to renew a FortiGuard license after the free trial.
This section includes the topics:
FortiGuard Services
Antivirus and IPS
Web filtering
Email filtering
Security tools
Troubleshooting
FortiGuard Services
The FortiGuard services provide a number of services to monitor world-wide activity and
provide the best possible security.
Page 1461
system to recognize threats when no signature has yet been developed. It also provides
more than 1000 application identity signatures for complete application control.
Application Control - Application Control allows you to identify and control applications on
networks and endpoints regardless of port, protocol, and IP address used. It gives you
unmatched visibility and control over application traffic, even traffic from unknown
applications and sources.
Other Services
FortiGuard provides a number of additional services, including:
Vulnerability Scanning - FortiGuard Services provide comprehensive and continuous
updates for vulnerabilities, remediation, patch scan, and configuration benchmarks.
Email Filtering - The FortiGuard Antispam Service uses both a sender IP reputation
database and a spam signature database, along with sophisticated spam filtering tools on
Fortinet appliances and agents, to detect and block a wide range of spam messages.
Updates to the IP reputation and spam signature databases are provided continuously via
the FDN.
Messaging Services - Messaging Services allow a secure email server to be automatically
enabled on your FortiGate unit to send alert email or send email authentication tokens. With
the SMS gateway, you can enter phone numbers where the FortiGate unit will send the SMS
messages.
Note that depending on your carrier, there may be a slight time delay on receiving messages.
DNS and DDNS - The FortiGuard DNS and DDNS services provide an efficient method of
DNS lookups once subscribed to the FortiGuard network. This is the default option. The
FortiGate unit connects automatically to the FortiGuard DNS server. If you do not register,
you need to configure an alternate DNS server.
Configure the DDNS server settings using the CLI commands:
config system fortiguard
set ddns-server-ip
set ddns-server-port
end
FortiGuard Page 1462 Install and System Administration for FortiOS 5.0
Support Contract and FortiGuard Subscription Services
The Support Contract and FortiGuard Subscription Services sections are displayed in
abbreviated form within the License Information widget. A detailed version is available by going
to System > Config > FortiGuard.
The Support Contract area displays the availability or status of your FortiGate units support
contract. The status displays can be either Unreachable, Not Registered, or Valid Contract.
The FortiGuard Subscription Services area displays detailed information about your FortiGate
units support contract and FortiGuard subscription services. On this page, you can also
manually update the antivirus and IPS engines.
The status icons for each section Indicates the state of the subscription service. The icon
corresponds to the availability description.
Gray (Unreachable) the FortiGate unit is not able to connect to service.
Orange (Not Registered) the FortiGate unit can connect, but not subscribed.
Yellow (Expired) the FortiGate unit had a valid license that has expired.
Green (Valid license) the FortiGate unit can connect to FDN and has a registered support
contract. If the Status icon is green, the expiry date also appears.
FortiCloud
FortiCloud is a hosted security management and log retention service for FortiGate products. It
gives you a centralized reporting, traffic analysis, configuration and log retention without the
need for additional hardware and software.
A subscription to FortiCloud also includes Cloud Sandbox, a service in which suspicious files
can be inspected in isolation from your network.
For more information about FortiCloud, see FortiCloud on page 1474.
The FortiGuard network is an always updating service, including grayware and signatures for
application control. There are two methods of updating the virus and IPS signatures on your
FortiGate unit: manually or through push updates.
FortiGuard Page 1463 Install and System Administration for FortiOS 5.0
Antivirus and IPS Options
Go to System > Config > FortiGuard, and expand the AV and IPS Options section to configure
the antivirus and IPS options for connecting and downloading definition files.
Use override server Select to configure an override server if you cannot connect to the FDN
address or if your organization provides updates using their own FortiGuard
server.
Allow Push Update Select to allow updates sent automatically to your FortiGate unit when
they are available
Allow Push Update The status of the FortiGate unit for receiving push updates:
status icon
Gray (Unreachable) - the FortiGate unit is not able to connect to push
update service
Yellow (Not Available) - the push update service is not available with
your current support license
Green (Available) - the push update service is allowed.
Use override push Available only if both Use override server address and Allow Push
IP and Port Update are enabled.
Enter the IP address and port of the NAT device in front of your
FortiGate unit. FDS will connect to this device when attempting to reach
the FortiGate unit.
The NAT device must be configured to forward the FDS traffic to the
FortiGate unit on UDP port 9443.
Schedule Updates Select this check box to enable updates to be sent to your FortiGate
unit at a specific time. For example, to minimize traffic lag times, you
can schedule the update to occur on weekends or after work hours.
Note that a schedule of once a week means any urgent updates will not
be pushed until the scheduled time. However, if there is an urgent
update required, select the Update Now button.
Submit attack Select to help Fortinet maintain and improve IPS signatures. The
characteristics information sent to the FortiGuard servers when an attack occurs and
(recommended) can be used to keep the database current as variants of attacks evolve.
Manual updates
To manually update the signature definitions file, you need to first go to the Support web site at
https://support.fortinet.com. Once logged in, select FortiGuard Service Updates from the
Download area of the web page. The browser will present you the most current antivirus and
IPS signature definitions which you can download.
Once downloaded to your computer, log into the FortiGate unit to load the definition file.
FortiGuard Page 1464 Install and System Administration for FortiOS 5.0
To load the definition file onto the FortiGate unit
1. Go to System > Config > FortiGuard.
2. Select the Update link for either AV Definitions or IPS Definitions.
3. Locate the downloaded file and select OK.
The upload may take a few minutes to complete.
Automatic updates
The FortiGate unit can be configured to request updates from the FortiGuard Distribution
Network. You can configure this to be on a scheduled basis, or with push notifications.
Scheduling updates
Scheduling updates ensures that the virus and IPS definitions are downloaded to your FortiGate
unit on a regular basis, ensuring that you do not forget to check for the definition files yourself.
As well, by scheduling updates during off-peak hours, such as evenings or weekends, when
network usage is minimal, ensures that the network activity will not suffer from the added traffic
of downloading the definition files.
If you require the most up-to-date definitions as viruses and intrusions are found in the wild, the
FortiGuard Distribution Network can push updates to the FortiGate units as they are developed.
This ensures that your network will be protected from any breakouts of a virus within the
shortest amount of time, minimizing any damaging effect that can occur. Push updates require
that you have registered your FortiGate unit.
Once push updates are enabled, the next time new antivirus or IPS attack definitions are
released, the FDN notifies all the FortiGate unit that a new update is available. Within 60
seconds of receiving a push notification, the unit automatically requests the update from the
FortiGuard servers.
Push updates
Push updates enable you to get immediate updates when new virus or intrusions have been
discovered and new signatures are created. This ensures that when the latest signature is
available it will be sent to the FortiGate.
When a push notification occurs, the FortiGuard server sends a notice to the FortiGate unit that
there is a new signature definition file available. The FortiGate unit then initiates a download of
the definition file, similar to the scheduled update.
FortiGuard Page 1465 Install and System Administration for FortiOS 5.0
To ensure maximum security for your network, you should have a scheduled update as well as
enable the push update, in case an urgent signature is created, and your cycle of the updates
only occurs weekly.
Push IP override
If the FortiGate unit is behind another NAT device (or another FortiGate unit), to ensure it
receives the push update notifications, you need to use an override IP address for the
notifications. To do this, you create a virtual IP to map to the external port of the NAT device.
Generally speaking, if there are two FortiGate devices as in the diagram below, the following
steps need to be completed on the FortiGate NAT device to ensure the FortiGate unit on the
internal network receives the updates:
Add a port forwarding virtual IP to the FortiGate NAT device that connects to the Internet by
going to Firewall Objects > Virtual IP.
Add a security policy to the FortiGate NAT device that connects to the Internet that includes
the port forwarding virtual IP.
Configure the FortiGate unit on the internal network with an override push IP and port.
On the FortiGate internal device, the virtual IP is entered as the Use push override IP address.
FortiGuard Page 1466 Install and System Administration for FortiOS 5.0
Figure 231:Using a virtual IP for a FortiGate unit behind a NAT device
n
tio
tribu
Dis
u ard work
rtG Net
Fo
17
2.2
0.1
20
.7
e T
ic NA
0.1
ev e
D at
0.1
tiG
.1
or
10
F
20 IP 3
2. al 0.
.8
17 tu 0.1
20
V .1
.1
10
i r
F
or
tiG De
at vic
e e
In
te
rn
la
Web filtering
The multiple FortiGuard data centers around the world hold the entire categorized URL
database and receive rating requests from customer-owned FortiGate units, typically triggered
by browser-based URL requests. When these rating requests are responded to with the
categories stored for specific URLs, the requesting FortiGate unit will then use its own local
profile configuration to determine what action to take, for example blocking, monitoring, or
permitting the URL request.
Rating responses can also be cached locally on the FortiGate unit, providing a quicker response
time while easing load on the FortiGuard servers and aiding in a quicker response time for less
common URL requests. This is a very effective method for common sites such as search
FortiGuard Page 1467 Install and System Administration for FortiOS 5.0
engines and other frequently visited sites. Other sites that are less frequently visited can also be
cached locally for a determined amount of time.
By default, the web filtering cache is enabled. The cache includes a time-to-live value, which is
the amount of time a URL will stay in the cache before expiring. You can change this value to
shorten or extend the time between 300 and 86400 seconds. For a site such as Google, the
frequency of its access can keep it in the cache, while other sites can remain in the cache up to
24 hours, or less depending on the configuration.
Web Filter cache TTL Set the Time To Live value. This is the number of seconds the
FortiGate unit will store a blocked IP or URL locally, saving time and
network access traffic, checking the FortiGuard server. Once the TTL
has expired, the FortiGate unit will contact an FDN server to verify a
web address. The TTL must be between 300 and 86400 seconds.
Antispam cache TTL Set the Time To Live value. This is the number of seconds the
FortiGate unit will store a blocked IP or URL locally, saving time and
network access traffic, checking the FortiGuard server. Once the TTL
has expired, the FortiGate unit will contact an FDN server to verify a
web address. The TTL must be between 300 and 86400 seconds.
Port Section Select the port assignments for contacting the FortiGuard servers.
Select the Test Availability button to verify the connection using the
selected port.
To have a URL's Select to re-evaluate a URLs category rating on the FortiGuard Web
category rating Filter service.
re-evaluated, please
click here
URL verification
If you discover a URL - yours or one you require access to has been incorrectly flagged as an
inappropriate site - you can ask the FortiGuard team to re-evaluate the site. To do this, go to
System > Config > FortiGuard, select the blue arrow for Web Filtering and Email Filtering
Options and select the link for re-evaluation.
FortiGuard Page 1468 Install and System Administration for FortiOS 5.0
Further web filtering options can be configured to block specific URLs, and allow others
through. These configurations are available through the Security Profiles > Web Filter menu. For
more information, see Security chapter of The Handbook.
Email filtering
The FortiGuard data centers monitor and update email databases of known spam sources. With
FortiGuard Antispam enabled, the FortiGate unit verifies incoming email sender address and IPs
against the database, and take the necessary action as defined within the antivirus profiles.
Spam source IP addresses can also be cached locally on the FortiGate unit, providing a quicker
response time, while easing load on the FortiGuard servers, aiding in a quicker response time
for less common email address requests.
By default, the antispam cache is enabled. The cache includes a time-to-live value, which is the
amount of time an email address will stay in the cache before expiring. You can change this
value to shorten or extend the time between 300 and 86400 seconds.
Security tools
The FortiGuard online center provides a number of online security tools that enable you to verify
or check ratings of web sites, email addresses as well as check file for viruses. These features
are available at http://www.fortiguard.com.
URL lookup
By entering a web site address, you can see if it has been rated and what category and
classification it is filed as. If you find your web site or a site you commonly go to has been
wrongly categorized, you can use this page to request that the site be re-evaluated.
http://www.fortiguard.com/webfiltering/webfiltering.html
FortiGuard Page 1469 Install and System Administration for FortiOS 5.0
Online virus scanner
If you discover a suspicious file on your machine, or suspect that a program you downloaded
from the Internet might be malicious you can scan it using the FortiGuard online scanner. The
questionable file can be uploaded from your computer to a dedicated server where it will be
scanned using FortiClient Antivirus. Only one file of up to 1 MB can be checked at any one time.
All files will be forwarded to our research labs for analysis.
http://www.fortiguard.com/antivirus/virus_scanner.html
FortiSandbox
A FortiSandbox unit can be used for automated sample tracking, or sandboxing, for files from a
FortiGate unit. This allows suspicious files to be sent to be inspected without risking network
security. If the file exhibits risky behavior, or is found to contain a virus, a new virus signature is
created and added to the FortiGuard antivirus signature database.
Cloud Sandbox can also be used for sandboxing if you have an active FortiCloud subscription.
For more information, see FortiCloud on page 1474.
Troubleshooting
If you are not getting FortiGuard web filtering or antispam services, there are a few things to
verify communication to the FortiGuard Distribution Network (FDN) is working. Before any
troubleshooting, ensure that the FortiGate unit has been registered and you or your company,
has subscribed to the FortiGuard services.
FortiGuard Page 1470 Install and System Administration for FortiOS 5.0
Figure 232:License Information widget showing FortiGuard availability
You can also view the FortiGuard connection status by going to System > Config > FortiGuard.
FortiGuard Page 1471 Install and System Administration for FortiOS 5.0
CLI verification
You can also use the CLI to see what FortiGuard servers are available to your FortiGate unit.
Use the following CLI command to ping the FDN for a connection:
ping guard.fortinet.net
You can also use diagnose command to find out what FortiGuard servers are available:
diagnose debug rating
From this command, you will see output similar to the following:
Locale : english
License : Contract
Expiration : Sun Jul 24 20:00:00 2011
Hostname : service.fortiguard.net
D Indicates the server was found via the DNS lookup of the hostname. If the hostname
returns more than one IP address, all of them will be flagged with 'D' and will be used
first for INIT requests before falling back to the other servers.
I Indicates the server to which the last INIT request was sent
F The server has not responded to requests and is considered to have failed.
The server list is sorted first by weight and then the server with the smallest RTT is put at the top
of the list, regardless of weight. When a packet is lost, it will be resent to the next server in the
list.
The weight for each server increases with failed packets and decreases with successful
packets. To lower the possibility of using a faraway server, the weight is not allowed to dip
below a base weight, which is calculated as the difference in hours between the FortiGate unit
and the server multiplied by 10. The further away the server is, the higher its base weight and
the lower in the list it will appear.
Port assignment
FortiGate units contact the FortiGuard Distribution Network (FDN) for the latest list of FDN
servers by sending UDP packets with typical source ports of 1027 or 1031, and destination
ports of 53 or 8888. The FDN reply packets have a destination port of 1027 or 1031.
FortiGuard Page 1472 Install and System Administration for FortiOS 5.0
If your ISP blocks UDP packets in this port range, the FortiGate unit cannot receive the FDN
reply packets. As a result, the FortiGate unit will not receive the complete FDN server list.
If your ISP blocks the lower range of UDP ports (around 1024), you can configure your FortiGate
unit to use higher-numbered ports, using the CLI command
config system global
set ip-src-port-range <start port>-<end port>
end
where the <start port> and <end port> are numbers ranging of 1024 to 25000.
For example, you could configure the FortiGate unit to not use ports lower than 2048 or ports
higher than the following range:
config system global
set ip-src-port-range 2048-20000
end
Trial and error may be required to select the best source port range. You can also contact your
ISP to determine the best range to use. Push updates might be unavailable if:
there is a NAT device installed between the unit and the FDN
your unit connects to the Internet using a proxy server.
FortiGuard Page 1473 Install and System Administration for FortiOS 5.0
FortiCloud
FortiCloud is a hosted security management and log retention service for FortiGate products. It
gives you a centralized reporting, traffic analysis, configuration and log retention without the
need for additional hardware and software.
FortiCloud Features
Service security
All communication (including log information) between the devices and the clouds is encrypted.
Redundant data centers are always used to give the service high availability. Operational
Page 1474
FortiCloud Fortinet Technologies Inc.
security measures have been put in place to make sure your data is secure only you can view
or retrieve it.
There are five key activation steps. The procedure for each step may vary depending on your
model and your FortiOS firmware version, and whether your device (FortiGate or FortiWifi) is
brand new.
The steps are:
1. Registering with Support (New devices only)
2. Activating your FortiCloud account
3. Enabling logging to FortiCloud
4. Logging into the FortiCloud portal
5. Upgrading to a 200Gb subscription (Recommended)
Fortinet Technologies Inc. Page 1475 FortiOS Handbook - Whats New for FortiOS 5.0
FortiCloud Fortinet Technologies Inc.
2. A dialogue asking you to register your FortiCloud account will appear. Enter your
information, view and accept the Terms and Conditions and select Create Account.
3. A second dialogue window will appear, asking you to enter your information to confirm your
account. This will send a confirmation email to your registered email. The dashboard widget
will update to show that confirmation is required.
4. Open your email, and follow the confirmation link contained in it.
A FortiCloud page will open, stating that your account has been confirmed. The Activation
Pending message on the dashboard will change to state the type of account you have (1Gb
Free or 200Gb Subscription), and will now provide a link to the FortiCloud portal.
FortiOS 5.0
FortiOS 5.0 will automatically start logging Traffic and Event logs to FortiCloud upon activation.
Logging can be disabled or configured through the FortiGate interface or CLI Console.
Fortinet Technologies Inc. Page 1476 FortiOS Handbook - Whats New for FortiOS 5.0
FortiCloud Fortinet Technologies Inc.
There are five main tabs in the FortiCloud portal, which allow you to access different features
and information. The FortiCloud Settings, Help, and Logout buttons appear in the upper right.
Dashboards
Logs & Archives
Drilldown
Reports
Management
AV Submissions (this tab only appears if sandboxing has occurred, see Cloud
Sandboxing on page 1479)
Fortinet Technologies Inc. Page 1477 FortiOS Handbook - Whats New for FortiOS 5.0
FortiCloud Fortinet Technologies Inc.
Using FortiCloud
Below is a list of possible tasks that show you how to make the best of the features that
FortiCloud has to offer.
Fortinet Technologies Inc. Page 1478 FortiOS Handbook - Whats New for FortiOS 5.0
FortiCloud Fortinet Technologies Inc.
Tasks:
Adding a new dashboard with custom charts
Filtering logs to find specific information
Downloading logs
Using drilldown charts to find specific information
Viewing and printing existing reports
Generating scheduled and immediate reports
Creating and configuring a new report with your logo
Checking the status of your registration contract
Adding a new user account to a FortiCloud account
For further information about using FortiCloud, please see the FortiCloud Getting Started Guide.
Cloud Sandboxing
FortiCloud can be used for automated sample tracking, or sandboxing, for files from a FortiGate
unit. This allows suspicious files to be sent to be inspected without risking network security. If
the file exhibits risky behavior, or is found to contain a virus, a new virus signature is created and
added to the FortiGuard antivirus signature database.This feature was formerly known as
FortiGuard Analytics.
Cloud sandboxing is configured by going to System > Config > FortiSandbox. After enabling
FortiSandbox, select Cloud Sandbox (FortiCloud).
Sandboxing results will be shown in a new tab called AV Submissions in the FortiCloud portal.
This tab will only appear after a file has been sent for sandboxing.
Fortinet Technologies Inc. Page 1479 FortiOS Handbook - Whats New for FortiOS 5.0
Interfaces
Interfaces, both physical and virtual, enable traffic to flow to and from the internal network, and
the Internet and between internal networks. The FortiGate unit has a number of options for
setting up interfaces and groupings of subnetworks that can scale to a companys growing
requirements.
This chapter includes:
Physical
Interface settings
Software switch
Virtual Switch
Loopback interfaces
Redundant interfaces
One-armed sniffer
Aggregate Interfaces
DHCP addressing mode on an interface
Administrative access
Wireless
Interface MTU packet size
Secondary IP addresses to an interface
Virtual domains
Virtual LANs
Zones
Physical
FortiGate units have a number of physical ports where you connect ethernet or optical cables.
Depending on the model, they can have anywhere from four to 40 physical ports. Some units
have a grouping of ports labelled as internal, providing a built-in switch functionality.
In FortiOS, the port names, as labeled on the FortiGate unit, appear in the web-based manager
in the Unit Operation widget, found on the Dashboard. They also appear when you are
configuring the interfaces, by going to System > Network > Interface. As shown below, the
FortiGate-100D (Generation 2) has 22 interfaces.
Two of the physical ports on the FortiGate-100D (Generation 2) are SFP ports. These ports
share the numbers 15 and 16 with RJ-45 ports. Because of this, when SFP port 15 is used,
RJ-45 port 15 cannot be used, and vice versa.
These ports also share the same MAC address.
Page 1480
Figure 235:FortiGate-100D physical interfaces
Normally the internal interface is configured as a single interface shared by all physical interface
connections - a switch. The switch mode feature has two states - switch mode and interface
mode. Switch mode is the default mode with only one interface and one address for the entire
internal switch. Interface mode enables you to configure each of the internal switch physical
interface connections separately. This enables you to assign different subnets and netmasks to
each of the internal physical interface connections.
The larger FortiGate units can also include Advanced Mezzanine Cards (AMC), which can
provide additional interfaces (Ethernet or optical), with throughput enhancements for more
efficient handling of specialized traffic. These interfaces appear in FortiOS as port amc/sw1,
amc/sw2 and so on. In the following illustration, the FortiGate-3810A has three AMC cards
installed: two single-width (amc/sw1, amc/sw2) and one double-width (amc/dw).
Interfaces Page 1481 Install and System Administration for FortiOS 5.0
Figure 238:FortiGate-3810A AMC card port naming
Interface settings
In System > Network > Interface, you configure the interfaces, physical and virtual, for the
FortiGate unit. There are different options for configuring interfaces when the FortiGate unit is in
NAT mode or transparent mode. On FortiOS Carrier, you can also enable the Gi gatekeeper on
each interface for anti-overbilling.
Interface page
Create New Select to add a new interface, zone or, in transparent mode, port pair.
For more information on configuring zones, see Zones.
Depending on the model you can add a VLAN interface, a loopback
interface, a IEEE 802.3ad aggregated interface, or a redundant interface.
When VDOMs are enabled, you can also add Inter-VDOM links.
Name The names of the physical interfaces on your FortiGate unit. This includes
any alias names that have been configured.
When you combine several interfaces into an aggregate or redundant
interface, only the aggregate or redundant interface is listed, not the
component interfaces.
If you have added VLAN interfaces, they also appear in the name list, below
the physical or aggregated interface to which they have been added.
If you have added loopback interfaces, they also appear in the interface list,
below the physical interface to which they have been added. If you have
software switch interfaces configured, you will be able to view them. For
more information, see Software switch on page 1486.
If your FortiGate unit supports AMC modules, the interfaces are named
amc-sw1/1, amc-dw1/2, and so on.
Interfaces Page 1482 Install and System Administration for FortiOS 5.0
IP/Netmask The current IP address and netmask of the interface.
In VDOM mode, when VDOMs are not all in NAT or transparent mode some
values may not be available for display and will be displayed as -.
Administrative Indicates if the interface can be accessed for administrative purposes. If the
Status administrative status is a green arrow, and administrator could connect to
the interface using the configured access.
If the administrative status is a red arrow, the interface is administratively
down and cannot be accessed for administrative purposes.
Link Status The status of the interface physical connection. Link status can be either up
(green arrow) or down (red arrow). If link status is up the interface is
connected to the network and accepting traffic. If link status is down the
interface is not connected to the network or there is a problem with the
connection. You cannot change link status from the web-based manager,
and typically is indicative of an ethernet cable plugged into the interface.
Link status is only displayed for physical interfaces.
Mode Shows the addressing mode of the interface. The addressing mode can be
manual, DHCP, or PPPoE.
MTU The maximum number of bytes per transmission unit (MTU) for the interface.
Virtual Domain The virtual domain to which the interface belongs. This column is visible
when VDOM configuration is enabled.
Alias Enter an alternate name for a physical interface on the FortiGate unit. This
field appears when editing an existing physical interface.
The alias can be a maximum of 25 characters. The alias name will not
appears in logs.
Link Status Indicates whether the interface is connected to a network (link status is
Up) or not (link status is Down). This field appears when editing an existing
physical interface.
Interfaces Page 1483 Install and System Administration for FortiOS 5.0
Interface Displayed when Type is set to VLAN.
Select the name of the physical interface to which to add a VLAN
interface. Once created, the VLAN interface is listed below its physical
interface in the Interface list.
You cannot change the physical interface of a VLAN interface except when
adding a new VLAN interface.
Virtual Domain Select the virtual domain to add the interface to.
Admin accounts with super_admin profile can change the Virtual Domain.
Physical Interface This section has two different forms depending on the interface type:
Members
Software switch interface - this section is a display-only field
showing the interfaces that belong to the software switch virtual
interface.
802.3ad aggregate or Redundant interface - this section includes
available interface and selected interface lists to enable adding or
removing interfaces from the interface. For more information, see
Redundant interfaces.
Select interfaces from this Available Interfaces list and select the right
arrow to add an interface to the Selected Interface list.
Interfaces Page 1484 Install and System Administration for FortiOS 5.0
IP/Netmask If Addressing Mode is set to Manual, enter an IPv4 address/subnet mask
for the interface. FortiGate interfaces cannot have IP addresses on the
same subnet.
IPv6 Address If Addressing Mode is set to Manual and IPv6 support is enabled, enter an
IPv6 address/subnet mask for the interface. A single interface can have
both an IPv4 and IPv6 address or just one or the other.
Administrative Select the types of administrative access permitted for IPv4 connections
Access to this interface.
HTTPS Allow secure HTTPS connections to the web-based manager through this
interface. If configured, this option will enable automatically when
selecting the HTTP option. For information on this setting, see HTTPS
redirect on page 1438.
PING Interface responds to pings. Use this setting to verify your installation and
for testing.
TELNET Allow Telnet connections to the CLI through this interface. Telnet
connections are not secure and can be intercepted by a third party.
FCT-Access You can configure a FortiGate interface as an interface that will accept
FortiClient connections. When configured, the FortiGate unit sends
broadcast messages which the FortiClient software running on a end user
PC is listening for.
CAPWAP Allows the FortiGate units wireless controller to manage a wireless access
point, such as a FortiAP unit.
IPv6 Select the types of administrative access permitted for IPv6 connections
Administrative to this interface. These types are the same as for Administrative Access.
Access
Security Mode Select a captive portal for the interface. When selected, you can define the
portal message and look that the user sees when logging into the
interface. You can also define one or more user groups that have access
to the interface.
DHCP Server Select to enable a DHCP server for the interface. For more information on
configuring a DHCP server on the interface, see DHCP servers and
relays on page 1577.
Detect and Select to enable the interface to be used with BYOD hardware such as
Identify Devices iPhones. Define the device definitions by going to User & Device > Device.
Interfaces Page 1485 Install and System Administration for FortiOS 5.0
Add New Devices This option appears when Detect and Identify Devices is enabled. When
to Vulnerability enabled, the FortiGate unit performs a network vulnerability scan of any
Scan List devices detected or seen on the interface. The vulnerability scan occur as
configured, either on demand, or as scheduled.
Enable Explicit Available when enabling explicit proxy on the System Information
Web Proxy Dashboard (System > Dashboard > Status).
This option is not available for a VLAN interface selection. Select to enable
explicit web proxying on this interface. When enabled, this interface will be
displayed on System > Network > Explicit Proxy under Listen on Interfaces
and web traffic on this interface will be proxied according to the Web
Proxy settings.
Enable STP With FortiGate units with a switch interface is in switch mode, this option
is enabled by default. It enables the single instance MSTP spanning tree
protocol.
Listen for RADIUS Select to use the interface as a listening port for RADIUS content.
Accounting
Messages
Secondary IP Add additional IPv4 addresses to this interface. Select the Expand Arrow
Address to expand or hide the section.
Administrative Select either Up (green arrow) or Down (red arrow) as the status of this
Status interface.
Up indicates the interface is active and can accept network traffic.
Down indicates the interface is not active and cannot accept traffic.
Gi Gatekeeper For FortiOS Carrier, enable Gi Gatekeeper to enable the Gi firewall as part
(FortiOS Carrier of the anti-overbilling configuration. You must also configure Gi
only) Gatekeeper Settings by going to System > Admin > Settings.
Software switch
A software switch, or soft switch, is a virtual switch that is implemented at the software, or
firmware level, rather than the hardware level. A software switch can be used to simplify
communication between devices connected to different FortiGate interfaces. For example,
using a software switch, you can place the FortiGate interface connected to an internal network
on the same subnet as your wireless interfaces. Then devices on the internal network can
communicate with devices on the wireless network without any additional configuration such as
additional security policies, on the FortiGate unit.
Interfaces Page 1486 Install and System Administration for FortiOS 5.0
It can also be useful if you require more hardware ports on for the switch on a FortiGate unit. For
example, if your FortiGate unit has a 4-port switch, WAN1, WAN2 and DMZ interfaces, and you
need one more port, you can create a soft switch that can include the 4-port switch and the
DMZ interface all on the same subnet. These types of applications also apply to wireless
interfaces and virtual wireless interfaces and physical interfaces such as those with FortiWiFi
and FortiAP unit.
Similar to a hardware switch, a software switch functions like a single interface. A software
switch has one IP address; all of the interfaces in the software switch are on the same subnet.
Traffic between devices connected to each interface are not regulated by security policies, and
traffic passing in and out of the switch are affected by the same policy.
There are a few things to consider when setting up a software switch:
Ensure you create a back up of the configuration.
Ensure you have at least one port or connection such as the console port to connect to the
FortiGate unit. If you accidentally combine too many ports, you will need a way to undo any
errors.
The ports that you include must not have any link or relation to any other aspect of the
FortiGate unit. For example, DHCP servers, security policies, and so on.
For increased security, you can create a captive portal for the switch, allowing only specific
user groups access to the resources connected to the switch.
Interfaces Page 1487 Install and System Administration for FortiOS 5.0
between two subnets is problematic. By putting both interfaces on the same subnet the
synching will work. The software switch will accomplish this.
In this example, the soft switch includes a wireless interface. Remember to configure any
wireless security before proceeding. If you leave this interface open without any password or
other security, it leaves open access to not only the wireless interface but to any other
interfaces and devices connected within the software switch.
Final steps
With the switch set up, you can now add security policies, DHCP servers an any other
configuration that you would normally do to configure interfaces on the FortiGate unit.
Virtual Switch
Virtual switch feature enables you create virtual switches on top of the physical switch(es) with
designated interfaces/ports so that a virtual switch can build up its forwarding table through
learning and forward traffic accordingly. When traffic is forwarded among interfaces belonging
to the same virtual switch, the traffic doesn't need to go up to the software stack, but forwarded
directly by the switch. When traffic has to be relayed to interfaces not on the virtual switch, the
traffic will go through the normal data path and be offloaded to NP4 when possible.
This feature is only available on mid to high end FortiGate units, including the 100D, 600C,
1000C, and 1240B.
Interfaces Page 1488 Install and System Administration for FortiOS 5.0
To enable and configure the virtual switch, enter the CLI commands:
config system virtual-switch
edit vs1
set physical-switch sw0
config port
edit 1
set port port1
set speed xx
set duplex xx
set status [up|down]
edit 2
set port port2
set ...
end
end
end
Loopback interfaces
A loopback interface is a logical interface that is always up (no physical link dependency) and
the attached subnet is always present in the routing table.
The FortiGate's loopback IP address does not depend on one specific external port, and is
therefore possible to access it through several physical or VLAN interfaces. Multiple loopback
interfaces can be configured in either non-VDOM mode or in each VDOM.
Loopback interfaces still require appropriate firewall policies to allow traffic to and from this type
of interface.
A loopback interface can be used with:
Management access
BGP (TCP) peering
PIM RP
Loopback interfaces are a good practice for OSPF. Setting the OSPF router ID the same as
loopback IP address troubleshooting OSPF easier, and remembering the management IP
addresses (telnet to router ID).
Dynamic routing protocols can be enabled on loopback interfaces
For black hole static route, use the black hole route type instead of the loopback interface.
Redundant interfaces
On some models you can combine two or more physical interfaces to provide link redundancy.
This feature enables you to connect to two or more switches to ensure connectivity in the event
one physical interface or the equipment on that interface fails.
In a redundant interface, traffic is only going over one interface at any time. This differs from an
aggregated interface where traffic is going over all interfaces for distribution of increased
bandwidth. This difference means redundant interfaces can have more robust configurations
with fewer possible points of failure. This is important in a fully-meshed HA configuration.
Interfaces Page 1489 Install and System Administration for FortiOS 5.0
An interface is available to be in a redundant interface if:
it is a physical interface, not a VLAN interface
it is not already part of an aggregated or redundant interface
it is in the same VDOM as the redundant interface
it has no defined IP address
is not configured for DHCP or PPPoE
it has no DHCP server or relay configured on it
it does not have any VLAN subinterfaces
it is not referenced in any security policy, VIP, or multicast policy
it is not monitored by HA
it is not one of the FortiGate-5000 series backplane interfaces
When an interface is included in a redundant interface, it is not listed on the System > Network
> Interface page. You cannot configure the interface individually and it is not available for
inclusion in security policies, VIPs, or routing.
One-armed sniffer
A one-armed sniffer is used to configure a physical interface on the FortiGate unit as a one-arm
intrusion detection system (IDS). Traffic sent to the interface is examined for matches to the
configured IPS sensor and application control list. Matches are logged and then all received
traffic is dropped. Sniffing only reports on attacks. It does not deny or otherwise influence
traffic.
Using the one-arm sniffer, you can configure a FortiGate unit to operate as an IDS appliance by
sniffing network traffic for attacks without actually processing the packets. To configure
one-arm IDS, you enable sniffer mode on a FortiGate interface and connect the interface to a
hub or to the SPAN port of a switch that is processing network traffic.
To assign an interface as a sniffer interface, go to System > Network > Interface, edit the
interface and select One-Arm Sniffer.
If the check box is not available, the interface is in use. Ensure that the interface is not selected
in any firewall policies, routes, virtual IPs or other features in which a physical interface is
specified.
Enable Filters Select to include filters to define a more granular sniff of network
traffic. Select specific addresses, ports, VLANs and protocols.
In all cases, enter a number, or number range, for the filtering
type. For Protocol values, standard protocols are:
UDP - 17
TCP - 6
ICMP - 1
Include IPv6 Packets If your network is running a combination of IPv4 and IPv6
addressing, select to sniff both addressing types. Otherwise, the
FortiGate unit will only sniff IPv4 traffic.
Interfaces Page 1490 Install and System Administration for FortiOS 5.0
Include Non-IP Packets Select for a more intense scan of content in the traffic.
UTM Security Profiles IPS sensors, and application control lists enable you to select
specific sensors and application you want to identify within
the traffic.
Aggregate Interfaces
Link aggregation (IEEE 802.3ad) enables you to bind two or more physical interfaces together to
form an aggregated (combined) link. This new link has the bandwidth of all the links combined.
If a link in the group fails, traffic is transferred automatically to the remaining interfaces with the
only noticeable effect being a reduced bandwidth.
This is similar to redundant interfaces with the major difference being that a redundant interface
group only uses one link at a time, where an aggregate link group uses the total bandwidth of
the functioning links in the group, up to eight.
Support of the IEEE standard 802.3ad for link aggregation is available on some models.
An interface is available to be an aggregate interface if:
it is a physical interface, not a VLAN interface or subinterface
it is not already part of an aggregate or redundant interface
it is in the same VDOM as the aggregated interface. Aggregate ports cannot span multiple
VDOMs.
it does not have an IP address and is not configured for DHCP or PPPoE
it is not referenced in any security policy, VIP, IP Pool or multicast policy
it is not an HA heartbeat interface
it is not one of the FortiGate-5000 series backplane interfaces
Some models of FortiGate units do not support aggregate interfaces. In this case, the
aggregate option is not an option in the web-based manager or CLI. As well, you cannot create
aggregate interfaces from the interfaces in a switch port.
To see if a port is being used or has other dependencies, use the following diagnose command:
diagnose sys checkused system.interface.name <interface_name>
When an interface is included in an aggregate interface, it is not listed on the System > Network
> Interface page. Interfaces will still appear in the CLI, although configuration for those
interfaces will not take affect. You cannot configure the interface individually and it is not
available for inclusion in security policies, VIPs, IP pools, or routing.
Example
This example creates an aggregate interface on a FortiGate-3810A using ports 4-6 with an
internal IP address of 10.13.101.100, as well as the administrative access to HTTPS and SSH.
Interfaces Page 1491 Install and System Administration for FortiOS 5.0
5. Select the Addressing Mode of Manual.
6. Enter the IP address for the port of 10.13.101.100/24.
7. For Administrative Access select HTTPS and SSH.
8. Select OK.
If you configure an interface to use DHCP, the FortiGate unit automatically broadcasts a DHCP
request from the interface. The interface is configured with the IP address and any DNS server
addresses and default gateway address that the DHCP server provides.
Configure DHCP for an interface in System > Network > Interface and selecting the interface
from the list, and selecting DHCP in the Address Mode. The table describes the DHCP status
information when DHCP is configured for an interface.
Obtained The IP address and netmask leased from the DHCP server. Only
IP/Netmask displayed if Status is connected.
Renew Select to renew the DHCP license for this interface. Only displayed if
Status is connected.
Interfaces Page 1492 Install and System Administration for FortiOS 5.0
Expiry Date The time and date when the leased IP address and netmask is no
longer valid for the interface. The IP address is returned to the pool to
be allocated to the next user request for an IP address. Only
displayed if Status is connected.
Default Gateway The IP address of the gateway defined by the DHCP server. Only
displayed if Status is connected, and if Receive default gateway from
server is selected.
Distance Enter the administrative distance for the default gateway retrieved
from the DHCP server. The administrative distance, an integer from
1-255, specifies the relative priority of a route when there are multiple
routes to the same destination. A lower administrative distance
indicates a more preferred route.
Retrieve default Enable to retrieve a default gateway IP address from the DHCP
gateway from server server. The default gateway is added to the static routing table.
Override internal DNS Enable to use the DNS addresses retrieved from the DHCP server
instead of the DNS server IP addresses on the DNS page.
When VDOMs are enabled, you can override the internal DNS only
on the management VDOM.
If you configure the interface to use PPPoE, the FortiGate unit automatically broadcasts a
PPPoE request from the interface.
The FortiGate units support many PPPoE RFC features (RFC 2516) including unnumbered IPs,
initial discovery timeout and PPPoE Active Discovery Terminate (PADT).
PPPoE is only configurable in the web-based manager on desktop FortiGate units. 1U
FortiGates and up must be configured in the CLI using the commands:
config system interface
edit <port_name>
set mode pppoe
set username <ISP_username>
set password <ISP_password>
set idle-timeout <seconds>
set distance <integer>
set ipunnumbered <unumbered-IP>
set disc-retry-timeout <seconds>
set padt-retry-timeout <seconds>
set lcp-echo-interval <seconds>
set dns-server-override {enable | disable}
end
Interfaces Page 1493 Install and System Administration for FortiOS 5.0
Configure PPPoE on an interface in System > Network > Interface. The table describes the
PPPoE status information when PPPoE is configured for an interface.
Status Displays PPPoE status messages as the FortiGate unit connects to the
PPPoE server and gets addressing information. Select Status to refresh
the addressing mode status message.
The status is only displayed if you selected Edit.
Status can be any one of the following 4 messages.
Initializing No activity.
Connected The interface retrieves an IP address, netmask, and other settings from
the PPPoE server.
When the status is connected, PPPoE connection information is
displayed.
Unnumbered IP Specify the IP address for the interface. If your ISP has assigned you a
block of IP addresses, use one of them. Otherwise, this IP address can
be the same as the IP address of another interface or can be any IP
address.
Initial Disc Timeout Enter Initial discovery timeout. Enter the time to wait before starting to
retry a PPPoE discovery.
Initial PADT timeout Enter Initial PPPoE Active Discovery Terminate (PADT) timeout in
seconds. Use this timeout to shut down the PPPoE session if it is idle
for this number of seconds. PADT must be supported by your ISP. Set
initial PADT timeout to 0 to disable.
Distance Enter the administrative distance for the default gateway retrieved from
the PPPoE server. The administrative distance, an integer from 1-255,
specifies the relative priority of a route when there are multiple routes to
the same destination. A lower administrative distance indicates a more
preferred route. The default distance for the default gateway is 1.
Retrieve default Enable to retrieve a default gateway IP address from a PPPoE server.
gateway from server The default gateway is added to the static routing table.
Override internal Enable to replace the DNS server IP addresses on the System DNS
DNS page with the DNS addresses retrieved from the PPPoE server.
When VDOMs are enabled, you can override the internal DNS only on
the management VDOM.
Interfaces Page 1494 Install and System Administration for FortiOS 5.0
Administrative access
Interfaces, especially the public-facing ports can be potentially accessed by those who you
may not want access to the FortiGate unit. When setting up the FortiGate unit, you can set the
type of protocol an administrator must use to access the FortiGate unit. The options include:
HTTPS SNMP
HTTP PING
You can select as many, or as few, even none, that are accessible by an administrator.
This example adds an IPv4 address 172.20.120.100 to the WAN1 interface as well as the
administrative access to HTTPS and SSH. As a good practice, set the administrative access
when you are setting the IP address for the port.
When adding to, or removing a protocol, you must type the entire list again. For example, if you
have an access list of HTTPS and SSH, and you want to add PING, typing:
set allowaccess ping
...only PING will be set. In this case, you must type...
set allowaccess https ssh ping
Wireless
A wireless interface is similar to a physical interface only it does not include a physical
connection. The FortiWiFi units enables you to add multiple wireless interfaces that can be
available at the same time (the FortiWiFi-30B can only have one wireless interface). On FortiWiFi
units, you can configure the device to be either an access point, or a wireless client. As an
access point, the FortiWiFi unit can have up to four separate SSIDs, each on their own subnet
for wireless access. In client mode, the FortiWiFi only has one SSID, and is used as a receiver,
to enable remote users to connect to the existing network using wireless protocols.
Interfaces Page 1495 Install and System Administration for FortiOS 5.0
Wireless interfaces also require additional security measures to ensure the signal does not get
hijacked and data tampered or stolen.
For more information on configuring wireless interfaces see the Deploying Wireless Networks
Guide.
You can change the maximum transmission unit (MTU) of the packets that the FortiGate unit
transmits to improve network performance. Ideally, the MTU should be the same as the smallest
MTU of all the networks between the FortiGate unit and the destination of the packets. If the
packets that the FortiGate unit sends are larger than the smallest MTU, they are broken up or
fragmented, which slows down transmission. You can easily experiment by lowering the MTU to
find an MTU size for optimum network performance.
To change the MTU, select Override default MTU value (1500) and enter the MTU size based on
the addressing mode of the interface
68 to 1 500 bytes for static mode
576 to 1 500 bytes for DHCP mode
576 to 1 492 bytes for PPPoE mode
larger frame sizes if supported by the FortiGate model
Only available on physical interfaces. Virtual interfaces associated with a physical interface
inherit the physical interface MTU size.
Interfaces on some models support frames larger than the traditional 1500 bytes. Jumbo frames
are supported on FortiGate models that have either a SOC2 or NP4lite, except for the
FortiGate-30D, as well as on FortiGate-100D series models (for information about your
FortiGate units hardware, see the Hardware Acceleration guide). For other models, please
contact Fortinet Customer Support for the maximum frame size that is supported.
If you need to enable sending larger frames over a route, you need all Ethernet devices on that
route to support that larger frame size, otherwise your larger frames will not be recognized and
are dropped.
If you have standard size and larger size frame traffic on the same interface, routing alone
cannot route them to different routes based only on frame size. However, you can use VLANs to
make sure the larger frame traffic is routed over network devices that support that larger size.
VLANs will inherit the MTU size from the parent interface. You will need to configure the VLAN to
include both ends of the route as well as all switches and routers along the route.
MTU packet size is changed in the CLI. If you select an MTU size larger than your FortiGate unit
supports, an error message will indicate this. In this situation, try a smaller MTU size until the
value is supported.
In Transparent mode, if you change the MTU of an interface, you must change the MTU of all
interfaces on the FortiGate unit to match the new MTU.
Interfaces Page 1496 Install and System Administration for FortiOS 5.0
To change the MTU size, use the following CLI commands:
config system interface
edit <interface_name>
set mtu-override enable
set mtu <byte_size>
end
If an interface is configured with a manual or static IP address, you can also add secondary
static IP addresses to the interface. Adding secondary IP addresses effectively adds multiple IP
addresses to the interface. Secondary IP addresses cannot be assigned using DCHP or PPPoE.
All of the IP addresses added to an interface are associated with the single MAC address of the
physical interface and all secondary IP addresses are in the same VDOM as the interface that
are added to. You configure interface status detection for gateway load balancing separately for
each secondary IP addresses. As with all other interface IP addresses, secondary IP addresses
cannot be on the same subnet as any other primary or secondary IP address assigned to a
FortiGate interface unless they are in separate VDOMs.
To configure a secondary IP, go to System > Network > Interface, select Edit or Create New and
select the Secondary IP Address check box.
Virtual domains
Virtual domains (VDOMs) are a method of dividing a FortiGate unit into two or more virtual units
that function as multiple independent units. A single FortiGate unit is then flexible enough to
serve multiple departments of an organization, separate organizations, or to act as the basis for
a service providers managed security service.
VDOMs provide separate security domains that allow separate zones, user authentication,
security policies, routing, and VPN configurations. By default, each FortiGate unit has a VDOM
named root. This VDOM includes all of the FortiGate physical interfaces, modem, VLAN
subinterfaces, zones, security policies, routing settings, and VPN settings.
When a packet enters a VDOM, it is confined to that VDOM. In a VDOM, you can create security
policies for connections between Virtual LAN (VLAN) subinterfaces or zones in the VDOM.
Packets do not cross the virtual domain border internally. To travel between VDOMs, a packet
must pass through a firewall on a physical interface. The packet then arrives at another VDOM
on a different interface, but it must pass through another firewall before entering the VDOM.
Both VDOMs are on the same FortiGate unit. Inter-VDOMs change this behavior in that they are
internal interfaces; however their packets go through all the same security measures as on
physical interfaces.
This example shows how to enable VDOMs on the FortiGate unit and the basic and create a
VDOM accounting on the DMZ2 port and assign an administrator to maintain the VDOM. First
enable Virtual Domains on the FortiGate unit. When you enable VDOMs, the FortiGate unit will
log you out.
For desktop and low-end FortiGate units, VDOMs are enabled using the CLI. On larger
FortiGate units, you can enable on the web-based manager or the CLI. Once enabled all further
configuration can me made in the web-based manager or CLI.
Interfaces Page 1497 Install and System Administration for FortiOS 5.0
2. In the System Information widget, select Enable for Virtual Domain.
The FortiGate unit logs you out. Once you log back in, you will notice that the menu structure
has changed. This reflects the global settings for all Virtual Domains.
Virtual LANs
The term VLAN subinterface correctly implies the VLAN interface is not a complete interface by
itself. You add a VLAN subinterface to the physical interface that receives VLAN-tagged
packets. The physical interface can belong to a different VDOM than the VLAN, but it must be
connected to a network route that is configured for this VLAN. Without that route, the VLAN will
not be connected to the network, and VLAN traffic will not be able to access this interface.The
traffic on the VLAN is separate from any other traffic on the physical interface.
Interfaces Page 1498 Install and System Administration for FortiOS 5.0
FortiGate unit interfaces cannot have overlapping IP addresses, the IP addresses of all
interfaces must be on different subnets. This rule applies to both physical interfaces and to
virtual interfaces such as VLAN subinterfaces. Each VLAN subinterface must be configured with
its own IP address and netmask. This rule helps prevent a broadcast storm or other similar
network problems.
Any FortiGate unit, with or without VDOMs enabled, can have a maximum of 255 interfaces in
Transparent operating mode. In NAT/Route operating mode, the number can range from 255 to
8192 interfaces per VDOM, depending on the FortiGate model. These numbers include VLANs,
other virtual interfaces, and physical interfaces. To have more than 255 interfaces configured in
Transparent operating mode, you need to configure multiple VDOMs with many interfaces on
each VDOM.
This example shows how to add a VLAN, vlan_accounting on the FortiGate unit internal
interface with an IP address of 10.13.101.101.
Zones
Zones are a group of one or more FortiGate interfaces, both physical and virtual, that you can
apply security policies to control inbound and outbound traffic. Grouping interfaces and VLAN
subinterfaces into zones simplifies the creation of security policies where a number of network
segments can use the same policy settings and protection profiles. When you add a zone, you
select the names of the interfaces and VLAN subinterfaces to add to the zone. Each interface
still has its own address and routing is still done between interfaces, that is, routing is not
affected by zones. Security policies can also be created to control the flow of intra-zone traffic.
For example, in the illustration below, the network includes three separate groups of users
representing different entities on the company network. While each group has its own set of
Interfaces Page 1499 Install and System Administration for FortiOS 5.0
port and VLANs, in each area, they can all use the same security policy and protection profiles
to access the Internet. Rather than the administrator making nine separate security policies, he
can add the required interfaces to a zone, and create three policies, making administration
simpler.
Zone 1
Zone 1 policies
WAN1, DMZ1,
Zo VLAN 1, 2, 4
ne
2p
Zone 3
oli
cie
s
policies
Zone 2
Internal
ports 1, 2, 3
Zone 3
WAN2, DMZ2,
VLAN 3
You can configure policies for connections to and from a zone, but not between interfaces in a
zone. Using the above example, you can create a security policy to go between zone 1 and
zone 3, but not between WAN2 and WAN1, or WAN1 and DMZ1.
This example explains how to set up a zone to include the Internal interface and a VLAN.
Probing Interfaces
Server probes can be used on interfaces. In order for this to occur, the probe response must
first be enabled and configured, then the probe response must be allowed administrative
access on the interface. Both steps must be done through the CLI.
Interfaces Page 1500 Install and System Administration for FortiOS 5.0
Enabling and configuring the probe
config system probe-response
set http-probe-port <port>
set http-probe enable
end
Interfaces Page 1501 Install and System Administration for FortiOS 5.0
Central management
This chapter describes the basics of using FortiManager as an administration tool for multiple
FortiGate units. It describes the basics of setting up a FortiGate unit in FortiManager and some
key management features you can use within FortiManager to manage the FortiGate unit.
This section includes the topics:
Adding a FortiGate to FortiManager
Configuration through FortiManager
Firmware updates
FortiGuard
Backup and restore configurations
Administrative domains
In order for the FortiGate unit and FortiManager unit to properly connect, both units must have
compatible firmware. To find out if your firmware is compatible, refer to the FortiOS or
FortiManager Release Notes.
Before you can maintain a FortiGate unit using a FortiManager unit, you need to add it to the
FortiManager. To do this requires configuration on both the FortiGate and FortiManager. This
section describes the basics to configure management using a FortiManager device. For more
information on the interaction of FortiManager with the FortiGate unit, see the FortiManager
documentation.
FortiGate configuration
These steps ensure that the FortiGate unit will be able to receive updated antivirus and IPS
updates and allow remote management through the FortiManager system. You can add a
FortiGate unit whether it is running in either NAT mode or transparent mode. The FortiManager
unit provides remote management of a FortiGate unit over TCP port 541.
If you have not already done so, register the FortiGate unit by visiting http://support.fortinet.com
and select Product Registration. By registering your Fortinet unit, you will receive updates to
threat detection and prevention databases (Antivirus, Intrusion Detection, etc.) and will also
ensure your access to technical support.
You must enable the FortiGate management option so the FortiGate unit can accept
management updates to firmware, antivirus signatures, and IPS signatures.
Page 1502
The FortiManager ID now appears in the Trusted FortiManager table.
As an additional security measure, you can also select Registration Password and enter a
password to connect to the FortiManager.
FortiManager configuration
Once the connection between the FortiGate unit and the FortiManager unit has been
configured, you can add the FortiGate to the Device Manager in the FortiManager units
web-based manager.
With the FortiManager system, you can monitor and configure multiple FortiGate units from one
location and log in. Using the FortiManagers Device Manager, you can view the FortiGate units
and make the usual configuration updates and changes, without having to log in and out of
multiple FortiGate units.
FortiManager enables you to complete the configuration, by going to the Device Manager,
selecting the FortiGate unit and using the same menu structure and pages as you would see in
the FortiGate web-based manager. All changes to the FortiGate configuration are stored locally
on the FortiManager unit until you synchronize with the FortiGate unit.
When a FortiGate unit is under control of a FortiManager system, administrators will not be able
to change the configuration using the FortiGate. When trying to change options, the unit
Central management Page 1503 Install and System Administration for FortiOS 5.0
displays a message that it is configured through FortiManager, and any changes may be
reverted.
Global objects
If you are maintaining a number of FortiGate units within a network, many of the policies and
configuration elements will be the same across the corporation. In these instances, the adding
and editing of many of the same policies will be come a tedious and error-prone activity. With
FortiManager global objects, this level of configuration is simplified.
A global object is an object that is not associated specifically with one device or group. Global
objects includes security policies, a DNS server, VPN, and IP pools.
The Global Objects window is where you can configure global objects and copy the
configurations to the FortiManager device database for a selected device or a group of devices.
You can also import configurations from the FortiManager device database for a selected
device and modify the configuration as required.
When configuring or creating a global policy object the interface, prompts, and fields are the
same as creating the same object on a FortiGate unit using the FortiGate web-based manager.
Firmware updates
A FortiManager unit can also perform firmware updates for multiple FortiGate units, saving time
rather than upgrading each FortiGate unit individually.
The FortiManager unit stores local copies of firmware images, either by downloading images
from the Fortinet Distribution Network (FDN) or by accepting firmware images that are uploaded
from the management computer.
If you are using the FortiManager unit to download firmware images, the FDN first validates
device licenses and support contracts and then provides a list of currently available firmware
images. For devices with valid Fortinet Technical Support contracts, you can download new
firmware images from the FDN and the firmware release notes.
After firmware images have been either downloaded from the FDN or imported to the firmware
list, you can either schedule or immediately upgrade/downgrade a device or group of devices
firmware.
FortiGuard
FortiManager can also connect to the FortiGuard Distribution Network (FDN) to receive push
updates for IPS signatures and antivirus definitions. These updates can then be used to update
multiple FortiGate units throughout an organization. By using the FortiManager as the host for
updates, bandwidth use is minimized as updates are downloaded to one source instead of
many.
To receive IPS and antivirus updates from FortiManager, indicate an alternate IP address on the
FortiGate unit.
Central management Page 1504 Install and System Administration for FortiOS 5.0
To configure updates from FortiManager
1. Go to System > Config > FortiGuard.
2. Select AntiVirus and IPS Options to expand the options.
3. Enable both Allow Push Update and Use override push IP.
4. Enter the IP address of the FortiManager unit.
5. Select Apply.
FortiManager stores configuration files for backup and restore purposes. FortiManager also
enables you to save revisions of configuration files. Configuration backups occur automatically
when the administrator logs out, the administrator login session expires, or the FortiGate
restarts. Administrators can also start a backup manually.
FortiManager also enables you to view differences between different configurations to view
where changes have been made.
Configure the FortiGate as follows to support backing up the configuration to FortiManager:
config system central-management
set mode backup
set fortimanager-fds-override enable
set fmg "192.168.206.26"
end
On the FortiManager site, the ADOM that includes the FortiGate must be set to backup.
Enabling fortimanager-fds-override means that the FortiGate must use the FortiManager for
FortiGuard updates and FortiGuard web filtering lookups.
Administrative domains
Central management Page 1505 Install and System Administration for FortiOS 5.0
Monitoring
With network administration, the first step is installing and configuring the FortiGate unit to be
the protector of the internal network. Once the system is running efficiently, the next step is to
monitor the system and network traffic, making configuration changes as necessary when a
threat or vulnerability is discovered.
This chapter discusses the various methods of monitoring both the FortiGate unit and the
network traffic through a range of different tools available within FortiOS.
This section includes the topics:
Dashboard
sFlow
Monitor menus
Logging
Alert email
SNMP
Dashboard
The FortiOS dashboard provides a location to view real-time system information. By default, the
dashboard displays the key statistics of the FortiGate unit itself, providing the memory and CPU
status, as well as the health of the ports, whether they are up or down and their throughput.
Widgets
Within the dashboard is a number of smaller windows, called widgets, that provide this status
information. Beyond what is visible by default, you can add a number of other widgets that
display other key traffic information including application use, traffic per IP address, top attacks,
traffic history and logging statistics.
You can add multiple dashboards to reflect what data you want to monitor, and add the widgets
accordingly. Dashboard configuration is only available through the web-based manager.
Administrators must have read and write privileges to customize and add widgets when in either
menu. Administrators must have read privileges if they want to view the information.
Page 1506
FortiClient software
The License Information widget includes information for the FortiClient connections. It displays
the number of FortiClient connections allowed and the number of users connecting. By
selecting the Details link for the number of connections, you can view more information about
the connecting user, including IP address, user name, and type of operating system the user is
connecting with.
Included with this information is a link for Mac and Windows. Selecting these links automatically
downloads the FortiClient install file (.dmg or .exe) to the management computer.
sFlow
sFlow is a method of monitoring the traffic on your network to identify areas on the network that
may impact performance and throughput. FortiOS implements sFlow version 5.
sFlow uses packet sampling to monitor network traffic. The sFlow Agent captures packet
information at defined intervals and sends them to an sFlow Collector for analysis, providing
real-time data analysis. The information sent is only a sampling of the data for minimal impact
on network throughput and performance.
The sFlow Agent is embedded in the FortiGate unit. Once configured, the FortiGate unit sends
sFlow datagrams of the sampled traffic to the sFlow Collector, also called an sFlow Analyzer.
The sFlow Collector receives the datagrams, and provides real-time analysis and graphing to
indicate where potential traffic issues are occurring. sFlow Collector software is available from a
number of third party software vendors.
sFlow data captures only a sampling of network traffic, not all traffic like the traffic logs on the
FortiGate unit. Sampling works by the sFlow Agent looking at traffic packets when they arrive
on an interface. A decision is made whether the packet is dropped and allowed to be to its
destination or if a copy is forwarded to the sFlow Collector. The sample used and its frequency
are determined during configuration.
sFlow is not supported on virtual interfaces such as vdom link, ipsec, ssl.<vdom> or gre.
The sFlow datagram sent to the Collector contains the information:
Packet header (e.g. MAC,IPv4,IPv6,IPX,AppleTalk,TCP,UDP, ICMP)
Sample process parameters (rate, pool etc.)
Input/output ports
Priority (802.1p and TOS)
VLAN (802.1Q)
Source/destination prefix
Next hop address
Source AS, Source Peer AS
Destination AS Path
Communities, local preference
User IDs (TACACS/RADIUS) for source/destination
URL associated with source/destination
Interface statistics (RFC 1573, RFC 2233, and RFC 2358)
sFlow agents can be added to any type of FortiGate interface. sFlow isn't supported on some
virtual interfaces such as VDOM link, IPsec, gre, and ssl.<vdom>.
For more information on sFlow, Collector software and sFlow MIBs, visit www.sflow.org.
Monitoring Page 1507 Install and System Administration for FortiOS 5.0
Configuration
sFlow configuration is available only from the CLI. Configuration requires two steps: enabling
the sFlow Agent and configuring the interface for the sampling information.
Enable sFlow
config system sflow
set collector-ip <ip_address>
set collector-port <port_number>
end
The default port for sFlow is UDP 6343. To configure in VDOM, use the commands:
config system vdom-sflow
set vdom-sflow enable
set collector-ip <ip_address>
set collector-port <port_number>
end
Configure sFlow agents per interface.
config system interface
edit <interface_name>
set sflow-sampler enable
set sample-rate <every_n_packets>
set sample-direction [tx | rx | both]
set polling-interval <seconds>
end
Monitor menus
The Monitor menus enable you to view session and policy information and other activity
occurring on your FortiGate unit. The monitors provide the details of user activity, traffic and
policy usage to show live activity. Monitors are available for DHCP, routing, security policies,
traffic shaping, load balancing, security features, VPN, users, WiFi, and logging.
Logging
FortiOS provides a robust logging environment that enables you to monitor, store, and report
traffic information and FortiGate events, including attempted log ins and hardware status.
Depending on your requirements, you can log to a number of different hosts.
To configure logging in the web-based manager, go to Log & Report > Log Config > Log
Settings.
To configure logging in the CLI use the commands config log <log_location>.
For details on configuring logging see the Logging and Reporting Guide.
If you will be using several FortiGate units, you can also use a FortiAnalyzer unit for logging. For
more information, see the FortiAnalyzer Administration Guide.
Monitoring Page 1508 Install and System Administration for FortiOS 5.0
FortiCloud
The FortiCloud is a subscription-based hosted service. With this service, you can have
centralized management, logging, and reporting capabilities available in FortiAnalyzer and
FortiManager platforms, without any additional hardware to purchase, install or maintain. In
most cases, FortiCloud is the recommended location for saving and viewing logs.
This service includes a full range of reporting, analysis and logging, firmware management and
configuration revision history. It is hosted within the Fortinet global FortiGuard Network for
maximum reliability and performance, and includes reporting, and drill-down analysis widgets
makes it easy to develop custom views of network and security events.
The FortiGate unit sends log messages to the FortiCloud using TCP port 443. Configuration is
available once a user account has been set up and confirmed. To enable the account on the
FortiGate unit, go to System > Dashboard > Status, select Activate, and enter the account ID.
For FortiCloud traffic, you can identify a specific port/IP address for logging traffic.
Configuration of these services is performed in the CLI, using the command set source-ip.
When configured, this becomes the dedicated port to send this traffic over.
For example, to set the source IP of the FortiCloud server to be on the DMZ1 port with an IP of
192.168.4.5, the commands are:
config log fortiguard setting
set status enable
set source-ip 192.168.4.5
end
From the FortiGate unit, you can configure the connection and sending of log messages to be
sent over an SSL tunnel to ensure log messages are sent securely. To do this, use the CLI
commands to enable the encrypted connection and define the level of encryption.
config log fortiguard setting
set status enable
set enc-alogorithm {default | high | low | disable}
end
For more information on each encryption level see Configuring an SSL connection on
page 1511.
FortiGate memory
Logs are saved to the internal memory by default. Inexpensive yet volatile, for basic event logs
or verifying traffic, AV or spam patterns, logging to memory is a simple option. However,
because logs are stored in the limited space of the internal memory, only a small amount is
available for logs. As such logs can fill up and be overridden with new entries, negating the use
of recursive data. This is especially true for traffic logs. Also, should the FortiGate unit be shut
down or rebooted, all log information will be lost.
Monitoring Page 1509 Install and System Administration for FortiOS 5.0
Further options are available when enabled to configure log file sizes, and uploading/backup
events.
As well, note that the write speeds of hard disks compared to the logging of ongoing traffic may
cause the dropping such, it is recommended that traffic logging be sent to a FortiAnalyzer or
other device meant to handle large volumes of data.
Syslog server
An industry standard for collecting log messages, for off-site storage. In the web-based
manager, you are able to send logs to a single syslog server, however in the CLI you can
configure up to three syslog servers where you can also use multiple configuration options. For
example, send traffic logs to one server, antivirus logs to another. The FortiGate unit sends
Syslog traffic over UIDP port 514. Note that if a secure tunnel is configured for communication
to a FortiAnalyzer unit, then Syslog traffic will be sent over an IPSec connection, using UPD
500/4500, protocol IP/50.
To configure a Syslog server in the web-based manager, go to Log & Report > Log Config > Log
Settings. In the CLI use the commands:
config log syslogd setting
set status enable
end
Further options are available when enabled to configure a different port, facility and server IP
address.
For Syslog traffic, you can identify a specific port/IP address for logging traffic. Configuration of
these services is performed in the CLI, using the command set source-ip. When configured,
this becomes the dedicated port to send this traffic over.
For example, to set the source IP of a Syslog server to be on the DMZ1 port with an IP of
192.168.4.5, the commands are:
config log syslogd setting
set status enable
set source-ip 192.168.4.5
end
FortiAnalyzer
The FortiAnalyzer family of logging, analyzing, and reporting appliances securely aggregate log
data from Fortinet devices and other syslog-compatible devices. Using a comprehensive suite
of easily-customized reports, users can filter and review records, including traffic, event, virus,
attack, Web content, and email data, mining the data to determine your security stance and
assure regulatory compliance. FortiAnalyzer also provides advanced security management
functions such as quarantined file archiving, event correlation, vulnerability assessments, traffic
analysis, and archiving of email, Web access, instant messaging and file transfer content.
The FortiGate unit sends log messages over UDP port 514 or OFTP (TCP 514). If a secure
connection has been configured, log traffic is sent over UDP port 500/4500, Protocol IP/50. For
more information on configuring a secure connection see Sending logs using a secure
connection on page 1511.
For FortiAnalyzer traffic, you can identify a specific port/IP address for logging traffic.
Configuration of these services is performed in the CLI, using the command set source-ip.
When configured, this becomes the dedicated port to send this traffic over.
Monitoring Page 1510 Install and System Administration for FortiOS 5.0
For example, to set the source IP of a FortiAnalyzer unit to be on port 3 with an IP of
192.168.21.12, the commands are:
config log fortiguard setting
set status enable
set source-ip 192.168.21.12
end
You must configure the secure tunnel on both ends of the tunnel, the FortiGate unit and the
FortiAnalyzer unit.
This configuration is for FortiAnalyzer OS version 4.0 MR2 or lower. For version 40 MR3, see
Configuring an SSL connection on page 1511.
Monitoring Page 1511 Install and System Administration for FortiOS 5.0
The default encryption automatically sets high and medium encryption algorithms. Algorithms
used for high, medium, and low follows openssl definitions:
High - Key lengths larger than 128 bits, and some cipher suites with 128-bit keys.
Algorithms are: DHE-RSA-AES256-SHA:AES256-SHA: EDH-RSA-DES-CBC3-SHA:
DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:AES128-SHA
Medium - Key strengths of 128 bit encryption.
Algorithms are: RC4-SHA:RC4-MD5:RC4-MD
Low - Key strengths of 64 or 56 bit encryption algorithms but excluding export cipher suites
Algorithms are: EDH-RSA-DES-CDBC-SHA; DES-CBC-SHA; DES-CBC-MD5.
If you want to use an IPSec tunnel to connect to the FortiAnalyzer unit, you need to first disable
the enc-algorithm:
config log fortianalyzer setting
set status enable
set enc-algorithm disable
Then set the IPSec encryption:
set encrypt enable
set psksecret <preshared_IPSec_tunnel_key>
end
Packet Capture
When troubleshooting networks, it helps to look inside the header of the packets. This helps to
determine if the packets, route, and destination are all what you expect. Packet capture can
also be called a network tap, packet sniffing, or logic analyzing.
Monitoring Page 1512 Install and System Administration for FortiOS 5.0
intermittent missing PING packets
a particular type of packet is having problems, such as UDP, which is commonly used for
streaming video
If you are running a constant traffic application such as ping, packet capture can tell you if the
traffic is reaching the destination, how the port enters and exits the FortiGate unit, if the ARP
resolution is correct, and if the traffic is returning to the source as expected. You can also use
packet switching to verify that NAT or other configuration is translating addresses or routing
traffic the way that you want it to.
Before you start capturing packets, you need to have a good idea of what you are looking for.
Capture is used to confirm or deny your ideas about what is happening on the network. If you
try capture without a plan to narrow your search, you could end up with too much data to
effectively analyze. On the other hand, you need to capture enough packets to really
understand all of the patterns and behavior that you are looking for.
Alert email
As an administrator, you want to be certain you can respond quickly to issues occurring on your
network or on the FortiGate unit. Alert emails provide an efficient and direct method of notifying
an administrator of events. By configuring alert messages, you can define the threshold when a
problem becomes critical and needs attention. When this threshold is reached, the FortiGate
unit will send an email to one or more individuals, notifying them of the issue.
In the following example, the FortiGate unit is configured to send email to two administrators
(admin1 and admin2) when multiple intrusions are detected every two minutes. The FortiGate
unit has its own email address on the mail server.
SMTP Server Enter the address or name of the email server. For example,
smtp.example.com.
Default Reply To Enter an email address to associate with the alert email. This field is
optional. If you enter an email address here, it overrides the email
address entered when configuring alert email in Log & Report > Alert
E-mail.
Password *********************
Email to admin1@example.com
admin2@example.com
Monitoring Page 1513 Install and System Administration for FortiOS 5.0
3. For the Interval Time, enter 2.
4. Select Intrusion Detected.
5. Select Apply.
SNMP
Simple Network Management Protocol (SNMP) enables you to monitor hardware on your
network. You can configure the hardware, such as the FortiGate SNMP agent, to report system
information and send traps (alarms or event messages) to SNMP managers. An SNMP
manager, or host, is a typically a computer running an application that can read the incoming
trap and event messages from the agent and send out SNMP queries to the SNMP agents. A
FortiManager unit can act as an SNMP manager to one or more FortiGate units. FortiOS
supports SNMP using IPv4 and IPv6 addressing.
By using an SNMP manager, you can access SNMP traps and data from any FortiGate interface
or VLAN subinterface configured for SNMP management access. Part of configuring an SNMP
manager is to list it as a host in a community on the FortiGate unit it will be monitoring.
Otherwise, the SNMP monitor will not receive any traps from that FortiGate unit or be able to
query that unit.
The FortiGate SNMP implementation is read-only. SNMP v1, v2c, and v3 compliant SNMP
managers have read-only access to FortiGate system information through queries and can
receive trap messages from the FortiGate unit.
To monitor FortiGate system information and receive FortiGate traps, you must first compile the
Fortinet and FortiGate Management Information Base (MIB) files. A MIB is a text file that
describes a list of SNMP data objects that are used by the SNMP manager. These MIBs provide
information the SNMP manager needs to interpret the SNMP trap, event, and query messages
sent by the FortiGate unit SNMP agent.
FortiGate core MIB files are available for download by going to System > Config > SNMP and
selecting the download link on the page.
The Fortinet implementation of SNMP includes support for most of RFC 2665 (Ethernet-like
MIB) and most of RFC 1213 (MIB II). For more information, see Fortinet MIBs on page 1520.
RFC support for SNMP v3 includes Architecture for SNMP Frameworks (RFC 3411), and partial
support of User-based Security Model (RFC 3414).
SNMP traps alert you to events that occur such as an a full log disk or a virus detected.
Monitoring Page 1514 Install and System Administration for FortiOS 5.0
SNMP fields contain information about the FortiGate unit, such as CPU usage percentage or
the number of sessions. This information is useful for monitoring the condition of the unit on an
ongoing basis and to provide more information when a trap occurs.
The FortiGate SNMP v3 implementation includes support for queries, traps, authentication, and
privacy. Authentication and encryption are configured in the CLI. See the system snmp user
command in the FortiGate CLI Reference.
Description Enter descriptive information about the FortiGate unit. The description
can be up to 35 characters.
Location Enter the physical location of the FortiGate unit. The system location
description can be up to 35 characters long.
Contact Enter the contact information for the person responsible for this
FortiGate unit. The contact information can be up to 35 characters.
Queries Indicates whether queries protocols (v1 and v2c) are enabled or
disabled. A green check mark indicates queries are enabled; a gray x
indicates queries are disabled. If one query is disabled and another one
enabled, there will still be a green check mark.
Traps Indicates whether trap protocols (v1 and v2c) are enabled or disabled. A
green check mark indicates traps are enabled; a gray x indicates traps
are disabled. If one query is disabled and another one enabled, there
will still be a green check mark.
SNMP v3 section
To create a new SNMP community, see Create New SNMP V3 User.
Queries Indicates whether queries are enabled or disabled. A green check mark
indicates queries are enabled; a gray x indicates queries are disabled
Monitoring Page 1515 Install and System Administration for FortiOS 5.0
New SNMP Community page
Hosts (section)
IP Address Enter the IP address and Identify the SNMP managers that can use the
settings in this SNMP community to monitor the FortiGate unit.
You can also set the IP address to 0.0.0.0 to so that any SNMP manager
can use this SNMP community.
Interface Optionally, select the name of the interface that this SNMP manager
uses to connect to the FortiGate unit. You only have to select the
interface if the SNMP manager is not on the same subnet as the
FortiGate unit. This can occur if the SNMP manager is on the Internet or
behind a router.
In virtual domain mode, the interface must belong to the management
VDOM to be able to pass SNMP traps.
Delete Removes an SNMP manager from the list within the Hosts section.
Add Select to add a blank line to the Hosts list. You can add up to eight
SNMP managers to a single community.
Queries (section)
Protocol The SNMP protocol. In the v1 row, this means that the settings are for
SNMP v1. In the v2c row, this means that the settings are for SNMP v2c.
Port Enter the port number (161 by default) that the SNMP managers in this
community use for SNMP v1 and SNMP v2c queries to receive
configuration information from the FortiGate unit. Select the Enable
check box to activate queries for each SNMP version.
Note: The SNMP client software and the FortiGate unit must use the
same port for queries.
Traps (section)
Protocol The SNMP protocol. In the v1 row, this means that the settings are for
SNMP v1. In the v2c row, this means that the settings are for SNMP v2c.
Local Enter the remote port numbers (port 162 for each by default) that the
FortiGate unit uses to send SNMP v1 or SNMP v2c traps to the SNMP
managers in this community. Select the Enable check box to activate
traps for each SNMP version.
Note: The SNMP client software and the FortiGate unit must use the
same port for traps.
Remote Enter the remote port number (port 162 is default) that the FortiGate unit
uses to send SNMP v1 or v2c traps to the SNMP managers in this
community.
Note: The SNMP client software and the FortiGate unit must use the
same port for queries.
Monitoring Page 1516 Install and System Administration for FortiOS 5.0
Enable Select to activate traps for each SNMP version.
SNMP Event Enable each SNMP event for which the FortiGate unit should send traps
to the SNMP managers in this community.
CPU Over usage traps sensitivity is slightly reduced, by spreading
values out over 8 polling cycles. This prevents sharp spikes due to CPU
intensive short-term events such as changing a policy.
Power Supply Failure event trap is available only on some models.
AMC interfaces enter bypass mode event trap is available only on
models that support AMC modules.
Security Level Select the type of security level the user will have.
Notification Host Enter the IP address of the notification host. If you want to add more
than one host, after entering the IP address of the first host, select the
plus sign to add another host.
Enable Query Select to enable or disable the query. By default, the query is enabled.
Events Select the SNMP events that will be associated with that user.
Gigabit interfaces
When determining the interface speed of a FortiGate unit with a 10G interface, the
IF-MIB.ifSpeed may not return the correct value. IF-MIB.ifSpeed is a 32-bit gauge used to
report interface speeds in bits/second and cannot convert to a 64-bit value. The 32-bit counter
wrap the output too fast to be accurate.
In this case, you can use the value ifHighSpeed. It reports interface speeds in megabits/second.
This ensures that 10Gb interfaces report the correct value.
SNMP agent
You need to first enter information and enable the FortiGate SNMP Agent. Enter information
about the FortiGate unit to identify it so that when your SNMP manager receives traps from the
FortiGate unit, you will know which unit sent the information.
Monitoring Page 1517 Install and System Administration for FortiOS 5.0
To configure SNMP agent - CLI
config system snmp sysinfo
set status enable
set contact-info <contact_information>
set description <description_of_FortiGate>
set location <FortiGate_location>
end
SNMP community
An SNMP community is a grouping of devices for network administration purposes. Within that
SNMP community, devices can communicate by sending and receiving traps and other
information. One device can belong to multiple communities, such as one administrator
terminal monitoring both a firewall SNMP and a printer SNMP community.
Add SNMP communities to your FortiGate unit so that SNMP managers can connect to view
system information and receive SNMP traps.
You can add up to three SNMP communities. Each community can have a different
configuration for SNMP queries and traps. Each community can be configured to monitor the
FortiGate unit for a different set of events. You can also add the IP addresses of up to 8 SNMP
managers to each community.
When the FortiGate unit is in virtual domain mode, SNMP traps can only be sent on interfaces in
the management virtual domain. Traps cannot be sent over other interfaces.
Monitoring Page 1518 Install and System Administration for FortiOS 5.0
To add an SNMP v1/v2c community - CLI
config system snmp community
edit <index_number>
set events <events_list>
set name <community_name>
set query-v1-port <port_number>
set query-v1-status {enable | disable}
set query-v2c-port <port_number>
set query-v2c-status {enable | disable}
set status {enable | disable}
set trap-v1-lport <port_number>
set trap-v1-rport <port_number>
set trap-v1-status {enable | disable}
set trap-v2c-lport <port_number>
set trap-v2c-rport <port_number>
set trap-v2c-status {enable | disable}
end
Monitoring Page 1519 Install and System Administration for FortiOS 5.0
3. In Administrative Access, select SNMP.
4. Select OK.
If the interface you are configuring already has protocols that are allowed access, use the
command append allowaccess snmp instead, or else the other protocols will be replaced.
For more information, see Adding and removing options from lists on page 1417.
Fortinet MIBs
The FortiGate SNMP agent supports Fortinet proprietary MIBs as well as standard RFC 1213
and RFC 2665 MIBs. RFC support includes support for the parts of RFC 2665 (Ethernet-like
MIB) and the parts of RFC 1213 (MIB II) that apply to FortiGate unit configuration.
There are two MIB files for FortiGate units - the Fortinet MIB, and the FortiGate MIB. The
Fortinet MIB contains traps, fields and information that is common to all Fortinet products. The
FortiGate MIB contains traps, fields and information that is specific to FortiGate units. Each
Fortinet product has its own MIB. If you use other Fortinet products you will need to download
their MIB files as well. Both MIB files are used for FortiOS and FortiOS Carrier; there are no
additional traps for the Carrier version of the operating system.
The Fortinet MIB and FortiGate MIB along with the two RFC MIBs are listed in tables in this
section. You can download the two FortiGate MIB files from Fortinet Customer Support. The
Fortinet MIB contains information for Fortinet products in general. the Fortinet FortiGate MIB
includes the system information for The FortiGate unit and version of FortiOS. Both files are
required for proper SNMP data collection.
To download the MIB files, go to System > Config > SNMP and select a MIB link in the FortiGate
SNMP MIB section.
Your SNMP manager may already include standard and private MIBs in a compiled database
that is ready to use. You must add the Fortinet proprietary MIB to this database to have access
to the Fortinet specific information.
There were major changes to the MIB files between v3.0 and v4.0. You need to use the new
MIBs for v4.0 or you may mistakenly access the wrong traps and fields.
MIB files are updated for each version of FortiOS. When upgrading the firmware ensure that
you updated the Fortinet FortiGate MIB file as well.
Monitoring Page 1520 Install and System Administration for FortiOS 5.0
Table 68: Fortinet MIBs
RFC-1213 (MIB II) The FortiGate SNMP agent supports MIB II groups with
these exceptions.
No support for the EGP group from MIB II (RFC 1213,
section 3.11 and 6.10).
Protocol statistics returned for MIB II groups
(IP/ICMP/TCP/UDP/etc.) do not accurately capture all
FortiGate traffic activity. More accurate information
can be obtained from the information reported by the
Fortinet MIB.
RFC-2665 (Ethernet-like MIB) The FortiGate SNMP agent supports Ethernet-like MIB
information. FortiGate SNMP does not support for the
dot3Tests and dot3Errors groups.
Normally, to get configuration and status information for a FortiGate unit, an SNMP manager
would use an SNMP get commands to get the information in a MIB field. The SNMP get
command syntax would be similar to:
snmpget -v2c -c <community_name> <address_ipv4> {<OID> | <MIB_field>}
where
<community_name> is an SNMP community name added to the FortiGate configuration. You
can add more than one community name to a FortiGate SNMP configuration. The most
commonly used community name is public.
<address_ipv4> is the IP address of the FortiGate interface that the SNMP manager
connects to.
{<OID> | <MIB_field>} is the object identifier (OID) for the MIB field or the MIB field name
itself.
The SNMP get command gets firmware version running on the FortiGate unit. The community
name is public. The IP address of the interface configured for SNMP management access is
10.10.10.1. The firmware version MIB field is fgSysVersion and the OID for this MIB field is
Monitoring Page 1521 Install and System Administration for FortiOS 5.0
1.3.6.1.4.1.12356.101.4.1.1 The first command uses the MIB field name and the
second uses the OID:
snmpget -v2c -c public 10.10.10.1 fgSysVersion.0
snmpget -v2c -c public 10.10.10.1 1.3.6.1.4.1.12356.101.4.1.1.0
The OIDs and object names used in these examples are dependent on the version of MIB and
are subject to change.
Monitoring Page 1522 Install and System Administration for FortiOS 5.0
VLANs
Virtual Local Area Networks (VLANs) multiply the capabilities of your FortiGate unit, and can
also provide added network security. Virtual LANs (VLANs) use ID tags to logically separate
devices on a network into smaller broadcast domains. These smaller domains forward packets
only to devices that are part of that VLAN domain. This reduces traffic and increases network
security.
A Local Area Network (LAN) is a group of connected computers and devices that are arranged
into network broadcast domains. A LAN broadcast domain includes all the computers that
receive a packet broadcast from any computer in that broadcast domain. A switch will
automatically forward the packets to all of its ports; in contrast, routers do not automatically
forward network broadcast packets. This means routers separate broadcast domains. If a
network has only switches and no routers, that network is considered one broadcast domain,
no matter how large or small it is. Smaller broadcast domains are more efficient because fewer
devices receive unnecessary packets. They are more secure as well because a hacker reading
traffic on the network will have access to only a small portion of the network instead of the
entire networks traffic.
Virtual LANs (VLANs) use ID tags to logically separate a LAN into smaller broadcast domains.
Each VLAN is its own broadcast domain. Smaller broadcast domains reduce traffic and increase
network security. The IEEE 802.1Q standard defines VLANs. All layer-2 and layer-3 devices
along a route must be 802.1Q-compliant to support VLANs along that route. For more
information, see VLAN switching and routing on page 1524 and VLAN layer-3 routing on
page 1527.
VLANs reduce the size of the broadcast domains by only forwarding packets to interfaces that
are part of that VLAN or part of a VLAN trunk link. Trunk links form switch-to-switch or
switch-to-router connections, and forward traffic for all VLANs. This enables a VLAN to include
devices that are part of the same broadcast domain, but physically distant from each other.
VLAN ID tags consist of a 4-byte frame extension that switches and routers apply to every
packet sent and received in the VLAN. Workstations and desktop computers, which are
commonly originators or destinations of network traffic, are not an active part of the VLAN
process. All the VLAN tagging and tag removal is done after the packet has left the computer.
For more information, see VLAN ID rules on page 1524.
Any FortiGate unit without VDOMs enabled can have a maximum of 255 interfaces in
transparent operating mode. The same is true for any single VDOM. In NAT mode, the number
can range from 255 to 8192 interfaces per VDOM, depending on the FortiGate model. These
numbers include VLANs, other virtual interfaces, and physical interfaces. To have more than 255
interfaces configured in transparent operating mode, you need to configure multiple VDOMs
that enable you to divide the total number of interfaces over all the VDOMs.
One example of an application of VLANs is a companys accounting department. Accounting
computers may be located at both main and branch offices. However, accounting computers
need to communicate with each other frequently and require increased security. VLANs allow
the accounting network traffic to be sent only to accounting computers and to connect
accounting computers in different locations as if they were on the same physical subnet.
This guide uses the term packet to refer to both layer-2 frames and layer-3 packets.
Page 1523
VLAN ID rules
Layer-2 switches and layer-3 devices add VLAN ID tags to the traffic as it arrives and remove
them before they deliver the traffic to its final destination. Devices such as PCs and servers on
the network do not require any special configuration for VLANs. Twelve bits of the 4-byte VLAN
tag are reserved for the VLAN ID number. Valid VLAN ID numbers are from 1 to 4094, while 0 is
used for high priority frames, and 4095 is reserved.
On a layer-2 switch, you can have only one VLAN subinterface per physical interface, unless
that interface is configured as a trunk link. Trunk links can transport traffic for multiple VLANs to
other parts of the network.
On a FortiGate unit, you can add multiple VLANs to the same physical interface. However, VLAN
subinterfaces added to the same physical interface cannot have the same VLAN ID or have IP
addresses on the same subnet. You can add VLAN subinterfaces with the same VLAN ID to
different physical interfaces.
Creating VLAN subinterfaces with the same VLAN ID does not create any internal connection
between them. For example a VLAN ID of 300 on port1 and VLAN ID of 300 on port2 are
allowed, but they are not connected. Their relationship is the same as between any two
FortiGate network interfaces.
VLAN switching takes place on the OSI model layer-2, just like other network switching. VLAN
routing takes place on the OSI model layer-3. The difference between them is that during VLAN
switching, VLAN packets are simply forwarded to their destination. This is different from VLAN
routing where devices can open the VLAN packets and change their VLAN ID tags to route the
packets to a new destination.
VLANs Page 1524 Install and System Administration for FortiOS 5.0
Table 69: How ports and VLANs are used on Switch A and B
A 1-4 100
A 5-7 200
B 4-5 100
B 6 200
In this example, switch A is connected to the Branch Office and switch B to the Main Office.
0
N 10
LA e 00
V
O ffic N2
ch A
n VL
Bra
7
5- 0
P
10
ts
or
or
ts
N
P
LA
1-
me
4
V
Fra
P
S
or .1Q
w
t8
80
itc
5
h
A
4,
ts
P
tr
or
or
un
P
t8
k
lin
k
0
20
S
N
w
LA
itc
h
V
B
fice
Of
in
Ma
VLANs Page 1525 Install and System Administration for FortiOS 5.0
1 00 0
AN N 20
VL fice V LA
Of
n ch
Bra
7
5-
0
P
10
ts
or
or
ts
N
P
LA
1-
me
4
V
Fra
P 2.1
S
or Q
w
t8
80
itc
5
h
A
4,
ts
P i nk
tr
or
or
un
P
t8
k
l
0
20
S
N
w
LA
itc
h
V
B
fice
Of
in
Ma
4. Switch B receives the data frame over the trunk link (port 8).
5. Because there are VLAN 100 ports on switch B (ports 4 and 5), the data frame is forwarded
to those ports. As with switch A, the data frame is not delivered to VLAN 200.
If there were no VLAN 100 ports on switch B, the switch would not forward the data frame
and it would stop there.
0
N 10 20
0
LA LA
N
V fice V
h Of
c
B ran
7
5-
0
P
10
ts
or
or
ts
N
P
LA
1-
me
4
V
Fra
P
S
or .1Q
w
t8
80
itc
5
h
A
4,
ts
P
tr
or
or
un
P
t8
k
lin
k
00
N2
S
w
A
itc
VL
h
B
e
fic
Of
M ain
6. The switch removes the VLAN 100 ID tag before it forwards the data frame to an end
destination.
The sending and receiving computers are not aware of any VLAN tagging on the data frames
that are being transmitted. When any computer receives that data frame, it appears as a normal
data frame.
VLANs Page 1526 Install and System Administration for FortiOS 5.0
VLAN layer-3 routing
Routers are layer-3 devices. Layer 3 refers to the third layer of the OSI networking model, the
Network layer. FortiGate units in NAT mode act as layer-3 devices. As with layer 2, FortiGate
units acting as layer-3 devices are 802.1Q-compliant.
The main difference between layer-2 and layer-3 devices is how they process VLAN tags.
Layer-2 switches just add, read and remove the tags. They do not alter the tags or do any other
high-level actions. Layer-3 routers not only add, read and remove tags but also analyze the data
frame and its contents. This analysis allows layer-3 routers to change the VLAN tag if it is
appropriate and send the data frame out on a different VLAN.
In a layer-3 environment, the 802.1Q-compliant router receives the data frame and assigns a
VLAN ID. The router then forwards the data frame to other members of the same VLAN
broadcast domain. The broadcast domain can include local ports, layer-2 devices and layer-3
devices such as routers and firewalls. When a layer-3 device receives the data frame, the device
removes the VLAN tag and examines its contents to decide what to do with the data frame. The
layer-3 device considers:
source and destination addresses
protocol
port number.
The data frame may be forwarded to another VLAN, sent to a regular non-VLAN-tagged
network or just forwarded to the same VLAN as a layer-2 switch would do. Or, the data frame
may be discarded if the proper security policy has been configured to do so.
VLANs Page 1527 Install and System Administration for FortiOS 5.0
0
10 00
AN N2
VL ffic
e
VL
A
hO
nc
Bra
7
5-
P
ts
or
or
ts
P
1-
me
4
Fra
P 2.1
S
or Q
w
t8
80
itc
h
A
tr
un
k
lin
P
k
or
t3
rt 1
Po 3 0 0
t1
or
N fice
P
A
VL Of
Main
P
S
or
w
t5
itc
h
B
0
30
AN
VL
2. Switch A forwards the tagged data frame to the FortiGate unit over the 802.1Q trunk link,
and to the VLAN 100 interfaces on Switch A.
Up to this point everything is the same as in the layer-2 example.
0
10 00
AN N2
VL ffic
e
VL
A
hO
nc
Bra
7
5-
P
ts
or
or
ts
P
1-
4
P 2.1
S
or Q
w
t8
80
me
itc
h
Fra
A
tr
un
k
lin
P
k
or
t3
rt 1
Po 3 0 0
t1
or
N fice
P
V LA Of
in
Ma
P
S
or
w
t5
itc
h
B
00
A N3
VL
3. The FortiGate unit removes the VLAN 100 tag, and inspects the content of the data frame.
The FortiGate unit uses the content to select the correct security policy and routing options.
4. The FortiGate units security policy allows the data frame to go to VLAN 300 in this example.
The data frame will be sent to all VLAN 300 interfaces, but in the example there is only port 1
VLANs Page 1528 Install and System Administration for FortiOS 5.0
on the FortiGate unit. Before the data frame leaves, the FortiGate unit adds the VLAN ID 300
tag to the data frame.
This is the step that layer 2 cannot do. Only layer 3 can retag a data frame as a different
VLAN.
00 0
A N1 20
VL AN
fice VL
h Of
nc
Bra
7
5-
P
ts
or
or
ts
P
1-
4
P 2.1
S
or Q
w
t8
80
itc
h
A
tr
un
k
lin
P
k
or
Fra
t3
me
rt 1
Po 3 0 0
t1
or
N fice
P
A
VL Of
Main
P
S
or
w
t5
itc
h
B
0
30
AN
VL
5. Switch B receives the data frame, and removes the VLAN ID 300 tag, because this is the last
hop, and forwards the data frame to the computer on port 5.
0
10 00
AN N2
VL ffic
e
VL
A
O
ch
an
Br
7
5-
P
ts
or
or
ts
P
1-
4
P
S
or .1Q
w
t8
80
me
itc
2
h
Fra
A
tr
un
k
li n
P
k
or
t3
rt 1
Po 300
t1
or
N e
fic
P
A
VL Of
in
Ma
P
S
or
w
t5
itc
h
B
me
Fra
0
30
AN
VL
In this example, a data frame arrived at the FortiGate unit tagged as VLAN 100. After checking
its content, the FortiGate unit retagged the data frame for VLAN 300. It is this change from
VLANs Page 1529 Install and System Administration for FortiOS 5.0
VLAN 100 to VLAN 300 that requires a layer-3 routing device, in this case the FortiGate unit.
Layer-2 switches cannot perform this change.
In NAT mode the FortiGate unit functions as a layer-3 device. In this mode, the FortiGate unit
controls the flow of packets between VLANs, but can also remove VLAN tags from incoming
VLAN packets. The FortiGate unit can also forward untagged packets to other networks, such
as the Internet.
In NAT mode, the FortiGate unit supports VLAN trunk links with IEEE 802.1Q-compliant
switches, or routers. The trunk link transports VLAN-tagged packets between physical subnets
or networks. When you add VLAN sub-interfaces to the FortiGate unit physical interfaces, the
VLANs have IDs that match the VLAN IDs of packets on the trunk link. The FortiGate unit directs
packets with VLAN IDs to sub-interfaces with matching IDs.
You can define VLAN sub-interfaces on all FortiGate physical interfaces. However, if multiple
virtual domains are configured on the FortiGate unit, you will have access to only the physical
interfaces on your virtual domain. The FortiGate unit can tag packets leaving on a VLAN
subinterface. It can also remove VLAN tags from incoming packets and add a different VLAN
tag to outgoing packets.
Normally in VLAN configurations, the FortiGate unit's internal interface is connected to a VLAN
trunk, and the external interface connects to an Internet router that is not configured for VLANs.
In this configuration the FortiGate unit can apply different policies for traffic on each VLAN
interface connected to the internal interface, which results in less network traffic and better
security.
Physical interface
The term VLAN subinterface correctly implies the VLAN interface is not a complete interface by
itself. You add a VLAN subinterface to the physical interface that receives VLAN-tagged
packets. The physical interface can belong to a different VDOM than the VLAN, but it must be
connected to a network router that is configured for this VLAN. Without that router, the VLAN
will not be connected to the network, and VLAN traffic will not be able to access this interface.
The traffic on the VLAN is separate from any other traffic on the physical interface.
When you are working with interfaces on your FortiGate unit, use the Column Settings on the
Interface display to make sure the information you need is displayed. When working with
VLANs, it is useful to position the VLAN ID column close to the IP address. If you are working
with VDOMs, including the Virtual Domain column as well will help you troubleshoot problems
more quickly.
To view the Interface display, go to System > Network > Interface.
VLANs Page 1530 Install and System Administration for FortiOS 5.0
IP address and netmask
FortiGate unit interfaces cannot have overlapping IP addresses. The IP addresses of all
interfaces must be on different subnets. This rule applies to both physical interfaces and to
virtual interfaces such as VLAN subinterfaces. Each VLAN subinterface must be configured with
its own IP address and netmask pair. This rule helps prevent a broadcast storm or other similar
network problems.
If you are unable to change your existing configurations to prevent IP overlap, enter the CLI
command config system global and set ip-overlap enable to allow IP address
overlap. If you enter this command, multiple VLAN interfaces can have an IP address that is part
of a subnet used by another interface. This command is recommended for advanced users
only.
VLAN ID
The VLAN ID is part of the VLAN tag added to the packets by VLAN switches and routers. The
VLAN ID is a number between 1 and 4094 that allow groups of IP addresses with the same
VLAN ID to be associated together. VLAN ID 0 is used only for high priority frames, and 4095 is
reserved.
All devices along a route must support the VLAN ID of the traffic along that route. Otherwise, the
traffic will be discarded before reaching its destination. For example, if your computer is part of
VLAN_100 and a co-worker on a different floor of your building is also on the same VLAN_100,
you can communicate with each other over VLAN_100, only if all the switches and routers
support VLANs and are configured to pass along VLAN_100 traffic properly. Otherwise, any
traffic you send your co-worker will be blocked or not delivered.
VDOM
If VDOMs are enabled, each VLAN subinterface must belong to a VDOM. This rule also applies
for physical interfaces.
VLAN subinterfaces on separate VDOMs cannot communicate directly with each other. In this
situation, the VLAN traffic must exit the FortiGate unit and re-enter the unit again, passing
through firewalls in both directions. This situation is the same for physical interfaces.
A VLAN subinterface can belong to a different VDOM than the physical interface it is part of.
This is because the traffic on the VLAN is handled separately from the other traffic on that
interface. This is one of the main strengths of VLANs.
The following procedure will add a VLAN subinterface called VLAN_100 to the FortiGate internal
interface with a VLAN ID of 100. It will have an IP address and netmask of
172.100.1.1/255.255.255.0, and allow HTTPS, PING, and Telnet administrative access.
Note that in the CLI, you must enter set type vlan before setting the vlanid, and that the
allowaccess protocols are lower case.
VLANs Page 1531 Install and System Administration for FortiOS 5.0
3. Select Create New to add a VLAN subinterface.
4. Enter the following:
Type VLAN
Interface internal
VLAN ID 100
IP/Netmask 172.100.1.1/255.255.255.0
5. Select OK.
To view the new VLAN subinterface, select the expand arrow next to the parent physical
interface (the internal interface). This will expand the display to show all VLAN subinterfaces on
this physical interface. If there is no expand arrow displayed, there are no subinterfaces
configured on that physical interface.
For each VLAN, the list displays the name of the VLAN, and, depending on column settings, its
IP address, the Administrative access you selected for it, the VLAN ID number, and which
VDOM it belongs to if VDOMs are enabled.
VLANs Page 1532 Install and System Administration for FortiOS 5.0
Each VLAN needs a security policy for each of the following connections the VLAN will be using:
from this VLAN to an external network
from an external network to this VLAN
from this VLAN to another VLAN in the same virtual domain on the FortiGate unit
from another VLAN to this VLAN in the same virtual domain on the FortiGate unit.
The packets on each VLAN are subject to antivirus scans and other UTM measures as they
pass through the FortiGate unit.
Configuring routing
As a minimum, you need to configure a default static route to a gateway with access to an
external network for outbound packets. In more complex cases, you will have to configure
different static or dynamic routes based on packet source and destination addresses.
As with firewalls, you need to configure routes for VLAN traffic. VLANs need routing and a
gateway configured to send and receive packets outside their local subnet just as physical
interfaces do. The type of routing you configure, static or dynamic, will depend on the routing
used by the subnet and interfaces you are connecting to. Dynamic routing can be routing
information protocol (RIP), border gateway protocol (BGP), open shortest path first (OSPF), or
multicast.
If you enable SSH, PING, Telnet, HTTPS and HTTP on the VLAN, you can use those protocols to
troubleshoot your routing and test that it is properly configured. Enabling logging on the
interfaces and using CLI diagnose commands such as diagnose sniff packet
<interface_name> can also help locate any possible configuration or hardware issues.
In this example two different internal VLAN networks share one interface on the FortiGate unit,
and share the connection to the Internet. This example shows that two networks can have
separate traffic streams while sharing a single interface. This configuration could apply to two
departments in a single company, or to different companies.
There are two different internal network VLANs in this example. VLAN_100 is on the
10.1.1.0/255.255.255.0 subnet, and VLAN_200 is on the 10.1.2.0/255.255.255.0 subnet. These
VLANs are connected to the VLAN switch, such as a Cisco 2950 Catalyst switch.
The FortiGate internal interface connects to the VLAN switch through an 802.1Q trunk. The
internal interface has an IP address of 192.168.110.126 and is configured with two VLAN
subinterfaces (VLAN_100 and VLAN_200). The external interface has an IP address of
172.16.21.2 and connects to the Internet. The external interface has no VLAN subinterfaces.
VLANs Page 1533 Install and System Administration for FortiOS 5.0
Figure 240:FortiGate unit with VLANs in NAT mode
Un
t
pa agge
ck d
ets
Ex
17 tern
2.1 al
6.2 0
1.2 20
AN
VL
802
19 Inte
2.1 rna
.1Q
68 l trun
.11
0.1
k
26 Fa
rk
/9
o
0/2 0
.0 w
Fa
.2 et
4
.1 N
10 00
2
N
LA
V
h
itc
0
10 0/3
w
S
N Fa
N
A
VL
LA
V
o rk
.0 w
.1 et
.1 N
10 00
1
N
LA
V
When the VLAN switch receives packets from VLAN_100 and VLAN_200, it applies VLAN ID
tags and forwards the packets of each VLAN both to local ports and to the FortiGate unit across
the trunk link. The FortiGate unit has policies that allow traffic to flow between the VLANs, and
from the VLANs to the external network.
This section describes how to configure a FortiGate unit and a Cisco Catalyst 2950 switch for
this example network topology. The Cisco configuration commands used in this section are IOS
commands.
It is assumed that both the FortiGate unit and the Cisco 2950 switch are installed and
connected and that basic configuration has been completed. On the switch, you will need to be
able to access the CLI to enter commands. Refer to the manual for your FortiGate model as well
as the manual for the switch you select for more information.
It is also assumed that no VDOMs are enabled.
VLANs Page 1534 Install and System Administration for FortiOS 5.0
Configure the FortiGate unit
Configuring the FortiGate unit includes:
Configure the external interface
Add VLAN subinterfaces
Add the firewall addresses
Add the security policies
Name VLAN_100
Interface internal
VLAN ID 100
VLANs Page 1535 Install and System Administration for FortiOS 5.0
IP/Network Mask 10.1.1.1/255.255.255.0
Name VLAN_200
Interface internal
VLAN ID 200
VLANs Page 1536 Install and System Administration for FortiOS 5.0
3. Enter the following information and select OK:
Name VLAN_100_Net
Type Subnet
Name VLAN_200_Net
Type Subnet
You can customize the Security Policy display by including some or all columns, and customize
the column order onscreen. Due to this feature, security policy screenshots may not appear the
same as on your screen.
If you do not want to allow all services on a VLAN, you can create a security policy for each
service you want to allow. This example allows all services.
VLANs Page 1537 Install and System Administration for FortiOS 5.0
Schedule Always
Service ALL
Action ACCEPT
Schedule Always
Service ALL
Action ACCEPT
Schedule Always
Service ALL
Action ACCEPT
VLANs Page 1538 Install and System Administration for FortiOS 5.0
Outgoing Interface external
Schedule Always
Service ALL
Action ACCEPT
VLANs Page 1539 Install and System Administration for FortiOS 5.0
set dstintf external
set dstaddr all
set schedule always
set service ALL
set action accept
set nat enable
set status enable
end
To complete the setup, configure devices on VLAN_100 and VLAN_200 with default gateways.
The default gateway for VLAN_100 is the FortiGate VLAN_100 subinterface. The default
gateway for VLAN_200 is the FortiGate VLAN_200 subinterface.
VLANs Page 1540 Install and System Administration for FortiOS 5.0
Test the configuration
Use diagnostic commands, such as tracert, to test traffic routed through the FortiGate unit
and the Cisco switch.
In transparent mode, the FortiGate unit behaves like a layer-2 bridge but can still provide
services such as antivirus scanning, web filtering, spam filtering and intrusion protection to
traffic. There are some limitations in transparent mode in that you cannot use SSL VPN,
PPTP/L2TP VPN, DHCP server, or easily perform NAT on traffic. The limits in transparent mode
apply to IEEE 802.1Q VLAN trunks passing through the unit.
VLANs Page 1541 Install and System Administration for FortiOS 5.0
spam filtering, web filtering and anti-virus scanning, are applied through the UTM profiles
specified in each security policy, enabling very detailed control over traffic.
When the FortiGate unit receives a VLAN-tagged packet at a physical interface, it directs the
packet to the VLAN subinterface with the matching VLAN ID. The VLAN tag is removed from the
packet, and the FortiGate unit then applies security policies using the same method it uses for
non-VLAN packets. If the packet exits the FortiGate unit through a VLAN subinterface, the
VLAN ID for that subinterface is added to the packet and the packet is sent to the
corresponding physical interface. For a configuration example, see Example of VLANs in
transparent mode on page 1544.
There are two essential steps to configure your FortiGate unit to work with VLANs in transparent
mode:
Add VLAN subinterfaces
Create security policies
You can also configure the protection profiles that manage antivirus scanning, web filtering and
spam filtering. For more information on UTM profiles, see Unified Threat Management for
FortiOS 5.0 on page 2018.
Name internal_v225
Type VLAN
Interface internal
VLAN ID 225
Administrative Access Enable HTTPS, and SSH. These are very secure
access methods.
The FortiGate unit adds the new subinterface to the interface that you selected.
Repeat steps 2 and 3 to add additional VLANs. You will need to change the VLAN ID, Name,
and possibly Interface when adding additional VLANs.
VLANs Page 1542 Install and System Administration for FortiOS 5.0
To add VLAN subinterfaces in transparent mode - CLI
config system interface
edit internal_v225
set interface internal
set vlanid 225
set allowaccess HTTPS SSH
set description VLAN 225 on internal interface
set vdom root
end
VLANs Page 1543 Install and System Administration for FortiOS 5.0
set destaddr outgoing_VLAN_address
set service <protocol_to_allow_on VLAN>
set action ACCEPT
next
end
10
.1
10 00.0
.20 .1
0.0
.1
V
LA
Ex
N
ter 0
ro
na 20
ut
l
er
AN
VL
802
.1
VLA Q trun
Int
erna
l N1 k
,2
Fa
k
0/9
r
.0 o
0/2
.0 tw
Fa
00 Ne
4 .2 0
10 20
N
LA
V
h
itc
0
10 0/3
w
S
AN Fa
N
VL
LA
V
r k
.0 o
.0 tw
00 Ne
.1 0
10 10
N
LA
V
VLANs Page 1544 Install and System Administration for FortiOS 5.0
1. Configure the FortiGate unit which includes
Adding VLAN subinterfaces
Adding the security policies
2. Configure the Cisco switch and router
Name VLAN_100_int
Interface internal
VLAN ID 100
Name VLAN_100_ext
Interface external
VLAN ID 100
Name VLAN_200_int
Interface internal
VLAN ID 200
Name VLAN_200_ext
Interface external
VLAN ID 200
VLANs Page 1545 Install and System Administration for FortiOS 5.0
To add VLAN subinterfaces - CLI
config system interface
edit VLAN_100_int
set status down
set type vlan
set interface internal
set vlanid 100
next
edit VLAN_100_ext
set status down
set type vlan
set interface external
set vlanid 100
next
edit VLAN_200_int
set status down
set type vlan
set interface internal
set vlanid 200
next
edit VLAN_200_ext
set status down
set type vlan
set interface external
set vlanid 200
end
Schedule Always
Service ALL
Action ACCEPT
VLANs Page 1546 Install and System Administration for FortiOS 5.0
4. Select Create New.
5. Leave the Policy Type as Firewall and the Policy Subtype as Address.
6. Enter the following information and select OK:
Schedule Always
Service ALL
Action ACCEPT
Schedule Always
Service ALL
Action ACCEPT
Schedule Always
Service ALL
Action ACCEPT
VLANs Page 1547 Install and System Administration for FortiOS 5.0
To add the security policies - CLI
config firewall policy
edit 1
set srcintf VLAN_100_int
set srcaddr all
set dstintf VLAN_100_ext
set dstaddr all
set action accept
set schedule always
set service ALL
next
edit 2
set srcintf VLAN_100_ext
set srcaddr all
set dstintf VLAN_100_int
set dstaddr all
set action accept
set schedule always
set service ALL
next
edit 3
set srcintf VLAN_200_int
set srcaddr all
set dstintf VLAN_200_ext
set dstaddr all
set action accept
set schedule always
set service ALL
next
edit 4
set srcintf VLAN_200_ext
set srcaddr all
set dstintf VLAN_200_int
set dstaddr all
set action accept
set schedule always
set service ALL
end
VLANs Page 1548 Install and System Administration for FortiOS 5.0
Add this file to the Cisco switch:
interface FastEthernet0/3
switchport access vlan 100
!
interface FastEthernet0/9
switchport access vlan 200
!
interface FastEthernet0/24
switchport trunk encapsulation dot1q
switchport mode trunk
!
The switch has the following configuration:
VLANs Page 1549 Install and System Administration for FortiOS 5.0
Test the configuration
Use diagnostic network commands such as traceroute (tracert) and ping to test traffic routed
through the network.
Several problems can occur with your VLANs. Since VLANs are interfaces with IP addresses,
they behave as interfaces and can have similar problems that you can diagnose with tools such
as ping, traceroute, packet sniffing, and diag debug.
Asymmetric routing
You might discover unexpectedly that hosts on some networks are unable to reach certain other
networks. This occurs when request and response packets follow different paths. If the
FortiGate unit recognizes the response packets, but not the requests, it blocks the packets as
invalid. Also, if the FortiGate unit recognizes the same packets repeated on multiple interfaces,
it blocks the session as a potential attack.
This is asymmetric routing. By default, the FortiGate unit blocks packets or drops the session
when this happens. You can configure the FortiGate unit to permit asymmetric routing by using
the following CLI commands:
config vdom
edit <vdom_name>
config system settings
set asymroute enable
end
end
If VDOMs are enabled, this command is per VDOM. You must set it for each VDOM that has the
problem. If this solves your blocked traffic issue, you know that asymmetric routing is the cause.
But allowing asymmetric routing is not the best solution, because it reduces the security of your
network.
For a long-term solution, it is better to change your routing configuration or change how your
FortiGate unit connects to your network. The Asymmetric Routing and Other FortiGate Layer-2
VLANs Page 1550 Install and System Administration for FortiOS 5.0
Installation Issues technical note provides detailed examples of asymmetric routing situations
and possible solutions.
If you enable asymmetric routing, antivirus and intrusion prevention systems will not be
effective. Your FortiGate unit will be unaware of connections and treat each packet individually.
It will become a stateless firewall.
By default, FortiGate units do not pass layer-2 traffic. If there are layer-2 protocols such as IPX,
PPTP or L2TP in use on your network, you need to configure your FortiGate unit interfaces to
pass these protocols without blocking. Another type of layer-2 traffic is ARP traffic. For more
information on ARP traffic, see ARP traffic on page 1551.
You can allow these layer-2 protocols using the CLI command:
config vdom
edit <vdom_name>
config system interface
edit <name_str>
set l2forward enable
end
end
where <name_str> is the name of an interface.
If VDOMs are enabled, this command is per VDOM. You must set it for each VDOM that has the
problem. If you enable layer-2 traffic, you may experience a problem if packets are allowed to
repeatedly loop through the network. This repeated looping, very similar to a broadcast storm,
occurs when you have more than one layer-2 path to a destination. Traffic may overflow and
bring your network to a halt. You can break the loop by enabling Spanning Tree Protocol (STP)
on your networks switches and routers. For more information, see STP forwarding on
page 1262.
ARP traffic
Address Resolution Protocol (ARP) packets are vital to communication on a network, and ARP
support is enabled on FortiGate unit interfaces by default. Normally you want ARP packets to
pass through the FortiGate unit, especially if it is sitting between a client and a server or
between a client and a router.
ARP traffic can cause problems, especially in transparent mode where ARP packets arriving on
one interface are sent to all other interfaces including VLAN subinterfaces. Some layer-2
switches become unstable when they detect the same MAC address originating on more than
one switch interface or from more than one VLAN. This instability can occur if the layer-2 switch
does not maintain separate MAC address tables for each VLAN. Unstable switches may reset
and cause network traffic to slow down considerably.
The default ARP timeout value is 5 minutes (300 seconds). This timeout is not configurable.
Usually ARP entries are removed after 5 minutes. However, some conditions can cause ARP
entries to remain for a longer time. Enter the get system arp CLI command to view the
entries in the ARP list.
VLANs Page 1551 Install and System Administration for FortiOS 5.0
Multiple VDOMs solution
By default, physical interfaces are in the root domain. If you do not configure any of your VLANs
in the root VDOM, it will not matter how many interfaces are in the root VDOM.
The multiple VDOMs solution is to configure multiple VDOMs on the FortiGate unit, one for each
VLAN. In this solution, you configure one inbound and one outbound VLAN interface in each
VDOM. ARP packets are not forwarded between VDOMs. This configuration limits the VLANs in
a VDOM and correspondingly reduces the administration needed per VDOM.
As a result of this configuration, the switches do not receive multiple ARP packets with
duplicate MACs. Instead, the switches receive ARP packets with different VLAN IDs and
different MACs. Your switches are stable.
However, you should not use the multiple VDOMs solution under any of the following
conditions:
you have more VLANs than licensed VDOMs
you do not have enough physical interfaces
Instead, use one of two possible solutions, depending on which operation mode you are using:
In NAT mode, you can use the vlan forward CLI command.
In transparent mode, you can use the forward-domain CLI command. But you still need to
be careful in some rare configurations.
Vlanforward solution
If you are using NAT mode, the solution is to use the vlanforward CLI command for the
interface in question. By default, this command is enabled and will forward VLAN traffic to all
VLANs on this interface. When disabled, each VLAN on this physical interface can send traffic
only to the same VLAN. There is no cross-talk between VLANs, and ARP packets are forced to
take one path along the network which prevents the multiple paths problem.
In the following example, vlanforward is disabled on port1. All VLANs configured on port1
will be separate and will not forward any traffic to each other.
config system interface
edit port1
set vlanforward disable
end
Forward-domain solution
If you are using transparent mode, the solution is to use the forward-domain CLI command.
This command tags VLAN traffic as belonging to a particular collision group, and only VLANs
tagged as part of that collision group receive that traffic. It is like an additional set of VLANs. By
default, all interfaces and VLANs are part of forward-domain collision group 0. The many
benefits of this solution include reduced administration, the need for fewer physical interfaces,
and the availability of more flexible network solutions.
In the following example, forward-domain collision group 340 includes VLAN 340 traffic on
port1 and untagged traffic on port 2. Forward-domain collision group 341 includes VLAN 341
traffic on port 1 and untagged traffic on port 3. All other interfaces are part of forward-domain
collision group 0 by default. This configuration separates VLANs 340 and 341 from each other
on port 1, and prevents the ARP packet problems from before.
Use these CLI commands:
config system interface
edit port1
VLANs Page 1552 Install and System Administration for FortiOS 5.0
next
edit port2
set forward_domain 340
next
edit port3
set forward_domain 341
next
edit port1-340
set forward_domain 340
set interface port1
set vlanid 340
next
edit port1-341
set forward_domain 341
set interface port1
set vlanid 341
end
You may experience connection issues with layer-2 traffic, such as ping, if your network
configuration has:
packets going through the FortiGate unit in transparent mode more than once
more than one forwarding domain (such as incoming on one forwarding domain and
outgoing on another)
IPS and AV enabled.
Now IPS and AV is applied the first time packets go through the FortiGate unit, but not on
subsequent passes. Only applying IPS and AV to this first pass fixes the network layer-2 related
connection issues.
NetBIOS
Computers running Microsoft Windows operating systems that are connected through a
network rely on a WINS server to resolve host names to IP addresses. The hosts communicate
with the WINS server by using the NetBIOS protocol.
To support this type of network, you need to enable the forwarding of NetBIOS requests to a
WINS server. The following example will forward NetBIOS requests on the internal interface for
the WINS server located at an IP address of 192.168.111.222.
config system interface
edit internal
set netbios_forward enable
set wins-ip 192.168.111.222
end
These commands apply only in NAT mode. If VDOMs are enabled, these commands are per
VDOM. You must set them for each VDOM that has the problem.
STP forwarding
The FortiGate unit does not participate in the Spanning Tree Protocol (STP). STP is an IEEE
802.1 protocol that ensures there are no layer-2 loops on the network. Loops are created when
there is more than one route for traffic to take and that traffic is broadcast back to the original
switch. This loop floods the network with traffic, reducing available bandwidth to nothing.
VLANs Page 1553 Install and System Administration for FortiOS 5.0
If you use your FortiGate unit in a network topology that relies on STP for network loop
protection, you need to make changes to your FortiGate configuration. Otherwise, STP
recognizes your FortiGate unit as a blocked link and forwards the data to another path. By
default, your FortiGate unit blocks STP as well as other non-IP protocol traffic.
Using the CLI, you can enable forwarding of STP and other layer-2 protocols through the
interface. In this example, layer-2 forwarding is enabled on the external interface:
config system interface
edit external
set l2forward enable
set stpforward enable
end
By substituting different commands for stpforward enable, you can also allow layer-2
protocols such as IPX, PPTP or L2TP to be used on the network. For more information, see
Layer-2 and Arp traffic on page 1551.
Any virtual domain can have a maximum of 255 interfaces in transparent mode. This includes
VLANs, other virtual interfaces, and physical interfaces. NAT mode supports from 255 to 8192
depending on the FortiGate model. This total number of interfaces includes VLANs, other virtual
interfaces, and physical interfaces.
Your FortiGate unit may allow you to configure more interfaces than this. However, if you
configure more than 255 interfaces, your system will become unstable and, over time, will not
work properly. As all interfaces are used, they will overflow the routing table that stores the
interface information, and connections will fail. When you try to add more interfaces, an error
message will state that the maximum limit has already been reached.
If you see this error message, chances are you already have too many VLANs on your system
and your routing has become unstable. To verify, delete a VLAN and try to add it back. If you
have too many, you will not be able to add it back on to the system. In this case, you will need to
remove enough interfaces (including VLANs) so that the total number of interfaces drops to 255
or less. After doing this, you should also reboot your FortiGate unit to clean up its memory and
buffers, or you will continue to experience unstable behavior.
To configure more than 255 interfaces on your FortiGate unit in transparent mode, you have to
configure multiple VDOMs, each with many VLANs. However, if you want to create more than
the default 10 VDOMs (or a maximum of 2550 interfaces), you must buy a license for additional
VDOMs.
With these extra licenses, you can configure up to 500 VDOMs, with each VDOM containing up
to 255 VLANs in transparent mode. This is a theoretical maximum of over 127 500 interfaces.
However, system resources will quickly get used up before reaching that theoretical maximum.
To achieve the maximum number of VDOMs, you need to have top-end hardware with the most
resources possible.
In NAT mode, if you have a top-end model, the maximum interfaces per VDOM can be as high
as 8192, enough for all the VLANs in your configuration.
Your FortiGate unit has limited resources, such as CPU load and memory, that are divided
between all configured VDOMs. When running 250 or more VDOMs, you may need to monitor
the system resources to ensure there is enough to support the configured traffic processing.
VLANs Page 1554 Install and System Administration for FortiOS 5.0
PPTP and L2TP
A virtual private network (VPN) is a way to use a public network, such as the Internet, as a
vehicle to provide remote offices or individual users with secure access to private networks.
FortiOS supports the Point-to-Point Tunneling Protocol (PPTP), which enables interoperability
between FortiGate units and Windows or Linux PPTP clients. Because FortiGate units support
industry standard PPTP VPN technologies, you can configure a PPTP VPN between a FortiGate
unit and most third-party PPTP VPN peers.
This section describes how to configure PPTP and L2TP VPNs as well as PPTP passthrough.
This section includes the topics:
How PPTP VPNs work
FortiGate unit as a PPTP server
Configuring the FortiGate unit for PPTP VPN
Configuring the FortiGate unit for PPTP pass through
Testing PPTP VPN connections
Logging VPN events
Configuring L2TP VPNs
L2TP configuration overview
The Point-to-Point Tunneling Protocol enables you to create a VPN between a remote client and
your internal network. Because it is a Microsoft Windows standard, PPTP does not require
third-party software on the client computer. As long as the ISP supports PPTP on its servers,
you can create a secure connection by making relatively simple configuration changes to the
client computer and the FortiGate unit.
PPTP uses Point-to-Point protocol (PPP) authentication protocols so that standard PPP
software can operate on tunneled PPP links. PPTP packages data in PPP packets and then
encapsulates the PPP packets within IP packets for transmission through a VPN tunnel.
When the FortiGate unit acts as a PPTP server, a PPTP session and tunnel is created as soon as
the PPTP client connects to the FortiGate unit. More than one PPTP session can be supported
on the same tunnel. FortiGate units support PAP, CHAP, and plain text authentication. PPTP
clients are authenticated as members of a user group.
Traffic from one PPTP peer is encrypted using PPP before it is encapsulated using Generic
Routing Encapsulation (GRE) and routed to the other PPTP peer through an ISP network. PPP
packets from the remote client are addressed to a computer