投影片 1

Size: px

Start display at page:

Download "投影片 1"

用周
5 years ago
Views:

1 臺北市立松山高級工農職業學校臺北市政府教育局所屬市立高級中等以下學校 ( 不含幼兒園 ) 防火牆採購案防火牆教育訓練 Syscom Jaco Yang January 2016

2 Topic Hardware Overview VLAN at FortiGate Product Register SSL VPN Web Mode Firmware Update SSL VPN Tunnel Mode with split Tunneling System Setup Logging Firewall Policy Fortinet Wireless Network UTM 常見問題

3 Fortinet FortiGate Hardware Overview January 2016

4 FortiGate 200D 設備簡介

5 FortiGate 200D 設備燈號說明

6 FortiGate 200D 出廠預設值 FortiGate200D 帳號密碼出廠預設值 admin 空白 FortiGate200D mgmt 埠 IP 位址網路遮罩出廠預設值 FortiGate200D lan 埠 IP 位址網路遮罩出廠預設值 FortiGate200D dmz 埠 IP 位址網路遮罩出廠預設值 To reset the FortiGate unit to the factory defaults, in the CLI type the command : execute factoryreset 原廠預設連線方式 :

7 FortiGate 200D 整體效能 FortiGate 系統整體效能防火牆效能 (1518/512/64 byte UDP) IPSec VPN 效能 SSL VPN 效能 IPSec VPN 通道數 (Client-to-Gateway) 200D Base Unit 3/3/3 Gbps 1.3 Gbps 400 Mbps 5000 防病毒效能 600 IPS 效能 1.7 Gbps 最大同時連線數 1.4M 每秒新增連線數 77K 最大防火牆防火牆策略數 Local Storage 10, GB

8 什麼是 FortiASIC? 專為 UTM 設備打造的硬體加速晶片 FortiASIC-NP 專職網路層流量的加速, 有效提升防火牆 /VPN 的整體處理效能大小封包皆提供全線速 (Wire-Speed) 的防火牆效能提供異常網路流量防禦及網路品質管理 (QoS) 加速 FortiASIC-CP 專職內容過濾加速, 提升防毒等 UTM 功能過濾的處理效能提供 IPSec/SSL VPN 加速及 SSL 內容檢測加速 * FortiASIC-NP only on FG-200D

9 Fortinet FortiGate Product Register January 2016

10 設備進行線上註冊連線到 ( 原廠英文網站 ) 選取 "Service & Support", 再選取 "Support Login"

11 設備進行線上註冊登入系統, 鍵入 "Account ID" 及 "Password" 進入系統

12 設備進行線上註冊若無帳號密碼, 則需新增一組帳號密碼, 在畫面右上角選取 "Create an Account"

13 設備進行線上註冊填入必須的資料 ( 此處為登入帳號 ) 如不確定中文地址如何英譯, 可至中華郵政網站進行線上翻譯, 網址如下 :

14 設備進行線上註冊資料填完後, 按 Create Account 畫面就會帶到已登入的頁面

15 設備進行線上註冊在 "Asset" 項目中, 選取 "Register/Renew" 進入註冊畫面

16 設備進行線上註冊請輸入設備序號 : FG100D3G1280XXXX ( 此為範例, 請輸入正確序號 ), 完成後, 請按 Next", 進入下一畫面

17 設備進行線上註冊 Support Contract No: 輸入產品合約序號 Fortinet Partner : 選取 Syscom Inc. 完成後, 請按 Next, 進入下一程序 Agreement Verification Completion

18 註冊確認註冊完成後可至 Information Entitlements 確認註冊資訊

19 Fortinet FortiGate Firmware Update January 2016

20 Upgrade patch

21 Firmware 升級 (Web GUI)

22 Firmware 升級 (Web GUI) 續

23 Fortinet FortiGate System Setup January 2016

24 登入系統使用瀏覽器輸入 https : 第一次登入請輸入 : admin / 空白

25 更改語系逾時設定選擇 System Admin Setting

26 建立管理帳號選擇 Admin Administrators

27 設定管理權限選擇 Admin Admin Profiles

28 更改系統時間選擇 Status System Time

29 更改系統時間將系統預設 GMT - 8 更改為 GMT + 8 Taipei

30 備份與恢復

31 網路介面參數設定 System Network Interfaces

32 自訂介面位址連線如何更改 WAN 1 埠 IP 選擇 System Network Interfaces wan1 port edit wan1 port

33 設定 DHCP 連線

34 設定 PPPoE 連線

35 如何開啟遠端存取權限 System Network 選取要連線的 Interface ( 例如 :wan1 埠 ) 啟用系統管理存取 HTTPS 或其他連線方式

36 設定 Default Gateway Router Static Routes Gateway 設定為指定的路由器位址

37 Routing Table List 在 Route/NAT 模式中, 檢視各個路由的狀況和資訊

38 Policy Routes Router Policy Routes Create New

39 設定 DNS 選擇 Network DNS

40 如何開啟 / 關閉 DHCP Server System Network Interfaces 請注意系統預設 lan 埠 DHCP Server 為開啟客戶可以依需求開啟或關閉 DHCP Server, 或依需求更改為所需網段 IP 位址

41 確認註冊資訊是否正確登入 FortiGate 系統管理畫面點選安裝的 FortiGate 設備, 出現畫面如下 : 正確信息為連線正常且燈號為綠色

42 確認功能是否開啟 System Config Features

43 Fortinet FortiGate Firewall Policy January 2016

44 如何新增一條防火牆政策位址預設 All Deny 服務虛擬 IP 新增設定防火牆政策 IP Pool

45 如何新增位址 Policy & Objects Objects Addresses Create New 新增一個內部 IP 位址 Address type 有四種類型 : FQDN Geography IP Range IP/Network

46 如何設定服務相關的連接埠 Policy & Objects Objects Service

47 如何設定服務相關的連接埠 Policy & Objects Objects Services Create New

48 Create Policy Policy & Objects Policy IPv4 Create New

49 Create Policy 設定阻擋這個 IP 位址連線到 Internet

50 Create Policy 按 ok 後, 新增一條防火牆政策, 但會發現新增的防火牆政策無法生效需要將 Deny 政策移動到 Accept 之前 ACCEPT 在 DENY 之前

51 移動防火牆政策到合適的位置 Deny 的防火牆政策必須在 Accept 之前用滑鼠點 Seq.# 然後用拖拉方式移動 policy 更改後可阻擋這個 IP 連線到 Internet

52 如何新增 IP Pool (SNAT) Policy & Objects Objects IP Pools Create New

53 如何新增 IP Pool (SNAT) Policy & Objects Policy IPv4 Create New Firewall / Network Options Use Dynamic IP Pool

54 如何新增伺服器 IP 位址對應 (DNAT) Policy & Objects Objects Virtual IPs Create New 新增一筆 Web Server 的 IP 對應, 讓外部 IP 對應到內部 IP

55 如何新增伺服器 IP 位址對應 (DNAT) 完成 Web Server 對應, 下一步需新增一筆防火牆政策

56 如何新增伺服器 IP 位址對應 (DNAT) 新增一筆由介面 port10 來源位址 all, 到介面 dmz 目的位址 Web Server, 服務 HTTP, 採取行動為 ACCEPT

57 如何新增伺服器 IP 位址對應 (DNAT) 完成圖

58 Fortinet FortiGate UTM January 2016

59 Antivirus Mode Flow-based: 封包掃毒, 會扣住最後一個封包作辨識 Proxy-based: 會將封包全部重組後在掃毒, 所以會較慢, 但可以設定過大檔案 pass 不掃 Flow-based 速度較快較不嚴謹較耗效能 Proxy-based 速度較慢較嚴謹可減輕效能

60 AntiVirus Security Profiles Antivirus

61 Antivirus- Chunked Bypass Policy Policy Proxy Options

62 Enable Antivirus profile

63 Web Filter Security Profiles Web Filter

64 URL Filter

65 Web Filter Override

66 Enable Web Filter Profile

67 Application Control Security Profiles Application Control

68 Application Override

69 Enable Application Profile

70 Intrusion protection Security Profiles Intrusion Protection

71 Enable IPS Profile

72 Fortinet FortiGate VLAN at FortiGate January 2016

73 Create VLAN System Network Interfaces Create New

74 View VLAN

75 VLAN (Firewall Policy) 防火牆防火牆策略 Create New

76 Fortinet FortiGate SSL VPN Web Mode January 2016

77 Topology

78 Create User User & Device User User Definition Create New

79 Choose User Type

80 Enter Login Credentials

81 Enter Contact Info

82 Enter Extra Info

83 Configuring SSL VPN Setting VPN SSL Settings

84 Create Security Policy

85 Login Authentication page

86 Fortinet FortiGate SSL VPN Tunnel Mode with Split Tunneling January 2016

87 Create User User & Device User User Definition Create New

88 Create Tunnel Client Address Policy & Objects Objects Address Create New

89 Enter IP Address Range

90 Create Routeing

91 Configuring SSL VPN Setting VPN SSL Settings

92 Configuring web portals VPN SSL Portals Create New

93 Enable Split Tunneling

94 Create Security Policy Policy & Object IPv4 Create New

95 Configure SSL VPN Policy

96 Login Authentication page

97 Connect SSL VPN

98 Fortinet FortiGate Logging January 2016

99 Log Storage Locations Local Logging System Memory Overwrites older logs when capacity reached Logs lost when FortiGate reset or loses power Disk FortiGate unit must have hard disk

100 Log Storage Locations Remote Logging Syslog Forward logs to remote computer FortiGuard Analysis Service (FortiCloud) Subscription-based web service FortiAnalyzer Device dedicated to log collection, analysis and storage

101 Log Types and Subtypes Traffic Log Event Log Forward (Traffic passed/blocked by Firewall policies) Local (Traffic aimed directly at, or created by FortiGate device) Invalid (Packets considered invalid/malformed and dropped) System (System related events) Router, VPN, User, WanOpt & Cache, Wifi UTM Security Log Antivirus, Web Filter, Intrusion Protection, etc.

102 Traffic Log Default Behavior Forward Traffic Traffic passing through Local Traffic Management

Traffic Log extended-utm-log Enable extended-utm-log in UTM Security profiles (CLI) to revert behavior and have logs sent to individual UTM classification Not recommended Log consolidation done for

103 Traffic Log extended-utm-log Enable extended-utm-log in UTM Security profiles (CLI) to revert behavior and have logs sent to individual UTM classification Not recommended Log consolidation done for performance reasons and allows for easier lookups config [antivirus/webfilter/spamfilter..] profile edit (profile name) set extended-utm-log enable end Enabled in profiles during upgrade Not enabled in new profiles by default

104 Traffic Log 滑鼠右鍵

105 Traffic Log 條件過濾中文過濾條件

106 Generating Logs in Event Log

107 Event Log 107

108 FortiView

109 Fortinet FortiGate Fortinet Wireless Network January 2016

110 傳統無線方案的瓶頸複雜的管控安全性不足擴充的限制過多的設備需要進行整合管控, 防毒應用程式管控, 頻寬管理等等發生狀況時難以快速找到問題根本建置成本日趨昂貴無法針對量流量提供辨識與管控能力無法防止來自內部行動設備所帶來的威脅與攻擊需透過其他設備才能補強資安上的需求無線傳輸是一個共享介質, 如何有效提高傳輸的效能會是新一代無線建置的重點控制器的擴充能力與維護費用會是另一個思考重點傳統的無線供應商已無法應付在資安功能上要求

111 建構絕佳安全的無線解決方案 Wireless Access Points Infrastructure Security with Integrated Wireless Controller Secure Wireless Space

112 完整的無線網路安全方案多層次的威脅過濾防護基於應用層的程式控管 Advanced Network-Based Security 基於設備種類的政策管理使用者和設備的認證機制高效能的無線傳輸 High- Performance Wireless Networking

113 智慧頻帶管理技術 (DARRP) Distributed Automatic Radio Resource Provisioning DARRP 技術允許每個 FortiAP 自動搜尋最佳的頻帶已確保每個連線用戶可以得到最佳得連線品質有效減低 Controller 負載大量減少 AP 之間的干擾每五分鐘進行通道測試評估客戶端自動信號遷移到新通道相容於所有用戶系統軟體與硬體充分利用現有的頻譜簡易的使用介面與鄰近的 AP 加以區隔, 有效避免干擾源與 n 40Mhz 通道相容

114 Auto TX Power Control 功率自動調整透過功率自動調整, 用戶可以讓每一個 AP 依照環境, 自動調適出最適合的功率大小並且可以制定上下限制的閥值有效提升 AP 的涵蓋範圍與傳輸效率

115 安全的訪客存取控管透過用戶登入網頁 (captive portal) 提供給訪客或臨時雇員的身分認證簽入支援多種認證資訊 :AD / LDAP / RADIUS / TACAS+ / Guest Guest Password

116 區間漫遊 (Fast Roaming) AP2 AP1 AP3 AP4

Identified, 16 Categories Advanced IM & P2P

SSL Content Inspection Priority App Non-

117 應用程式的管制 Bandwidth Control Uses Layer-7 inspection Ensures business critical applications are prioritized Ensures bandwidth allocation is fair Critical for optimization of WAN links Fortinet Application Control Sensors Over 3,000+ Apps Identified, 16 Categories Advanced IM & P2P control Application Control Traffic Shaping SSL Content Inspection Priority App Non- Priority App Non- Priority App FortiGate FortiAP INTERNET Client #1 Client #2

118 私接 AP 的偵測與抑制 File Server Ethernet Switch Radio 2 Client services FortiAP-220B/221B Radio 1 Air monitoring on 2.4GHz & 5GHz Rogue AP Rogue Client PCI reports generated by FortiAnalyzer Valid Client De-authentication Frames

119 BYOD Device Identification and Policy Identification Device User Application Policies Enforcement on Device/User/App

120 Thin AP architecture CAPWAP Control And Provisioning of Wireless Access Points. RFC5415 March 2009 CAPWAP is a standard, interoperable protocol that enables a controller to manage a collection of wireless access points, and uses UDP ports 5246 and Floor Wiring Closet CAPWAP Aggregation Thin AP tunnels all traffic to FortiGate Controller Data Cente FortiGate Controller Thin AP architecture tunnels all traffic to the FortiGate Controller for added security and ease of management

121 Remote AP with Local Bridging Headquarters Bridges Wi-Fi trafic to FortiAP Ethernet port No u-turn to HQ to access local network Resiliency in case of WAN failure WAN Internet

122 Integrated Captive Portal for Authentication HTML Customizable Captive Portal Allows users to log-in to the WLAN via a web browser Runs directly on the FortiGate No additional licensing required! address for anonymous login Address can be captured and logged Validates address authenticity Enables Business Intelligence and marketing opportunities

123 Live Captive Portal HTML Customization

124 Single Radio Dual Radio FortiAP Product Matrix 3x3:3 FAP-320C ac FAP-321C ac FAP-222C ac FAP-223C ac 2x2:2 FAP-224D FAP-221C ac FAP-28C FAP-25D FAP-21D FAP-24D 1x1:1 FAP-14C FAP-11C FAP-112D FAP-112B Remote Outdoor Indoor

125 FortiAP-221C Specifications Target Environment Indoor Number of Radio 2 Ports Bands Tx / RX Stream (802.11n) Number of Antenna Power Supply Max Transmission Power 1 x GE RJ45 Interface Dual Concurrent Radios Radio 1-2.4/5GHz and Radio 2 2.4GHz 2x2 MIMO with Dual Spatial streams, 1167 Mbps Total 4 internal AC power supply, POE 802.3af 17 dbm a b g n ac

126 Fortinet FortiGate 常見問題 January 2016

127 常見問題 PC 無法連線到我的 FortiGate 設備? Ans: 確認 PC IP 與 FortiGate 可以連線確認 FortiGate 介面的 HTTP HTTPS TELNET SSH 服務有開啟 PC 無法上網? Ans:FortiGate 網路設定是否正確 PC gateway IP 是否設定為 FortiGate 介面 IP Firewall Policy 是否開啟

128 常見問題我的 FortiGate 無法更新病毒碼? Ans:FortiGate 需要到美國原廠網站上註冊後, 才可更新病毒碼如何測試防毒功能是否運作正常? anti_virus_test_file.htm

129 常見問題如何更改使用介面語系? Ans: System -> Admin -> Settings -> View Settings -> select Language 如何將防火牆使用紀錄保存在其他設備上? Ans: Log&Report -> Log config -> Log Settings

130 常見問題密碼遺忘? Ans: 1. 重新開機, 由 Console(RS-232) 進入 CLI 2. 前 14 秒內以下列帳號登入 Login:maintainer Password : bcpbfgxxxxxxxxx 3. 更新系統管理員密碼機器序號 #config system admin (admin)#edit admin (admin)#set password Pa$$w0rd (admin)#end

131 常見問題如何知道封包有無進入設備? Ans: Trouble Shooting 功能 - Sniffer diag sniffer packet any host 監聽 any interface 上有關 IP 的資料流有 reply 代表正常,ping 有回又應

常見問題如何知道封包有無進入設備? Ans: Trouble Shooting 功能 - Sniffer diag sniffer packet any host 192.168.5.

132 常見問題如何知道封包有無進入設備? Ans: Trouble Shooting 功能 - Sniffer diag sniffer packet any host 監聽 any interface 上有關 IP 的資料流代表封包有進入 Fortigate 設備但僅有 Request, 代表 ping 沒回應, 需檢查是否有開 ping or route 有問題

常見問題如何檢視系統 CPU 使用狀況? Ans: Trouble Shooting 功能 diag sys top U is % of user space applications using CPU. S is % of system processes using CPU. I is % of idle CPU.

133 常見問題如何檢視系統 CPU 使用狀況? Ans: Trouble Shooting 功能 diag sys top U is % of user space applications using CPU. S is % of system processes using CPU. I is % of idle CPU. T is the total FortiOS system memory in Mb. F is free memory in Mb. KF is the total shared memory pages used. cli is the process name. 96 is the process ID. R is the state that the process is running in. R running. S sleep. Z zombie. D disk sleep. 0.9 is the amount of CPU that the process is using. 0.7 is the amount of memory that the process is using.

134 常見問題 Asymmetric route 的問題跟解決方法? 此架構需開啟 Asymmetric route Asymmetric route 僅能在 Command 下開啟 config system settings set asymroute enable end

135 常見問題 Debug 指令如何使用? FGT# diagnose debug enable FGT# diagnose debug flow show console enable FGT # diagnose debug flow show function-name enable FGT# diagnose debug flow filter addr FGT# diagnose debug flow filter port 8 FGT# diagnose debug flow trace start 20

136 Policy Deny id=36871 trace_id=1 func=resolve_ip_tuple_fast line=3769 msg= "vd-root received a packet(proto=1, :1-> :8) from internal. 第一個封包 ( :1-> :8) 從 internal 進入 Fortigate id=36871 trace_id=1 func=resolve_ip_tuple line=3909 msg="allocate a new session ca Fortigate 確認為一個新的 Session id=36871 trace_id=1 func=vf_ip4_route_input line=1591 msg="find a route: gw via wan1 Fortigate 去看路由表, 確認有這筆路由 id=36871 trace_id=1 func=fw_forward_handler line=430 msg="denied by forward policy check 但找不到相對應的 Policy, 因此被 Deny by Policy

Policy Allow id=36871 trace_id=131 func=resolve_ip_tuple_fast line=3769 msg="vd-root received a packet(proto=6, 192.168.1.77:56231->74.125.232.

137 Policy Allow id=36871 trace_id=131 func=resolve_ip_tuple_fast line=3769 msg="vd-root received a packet(proto=6, :56231-> :80) from internal. 第一個封包 ( :1-> :80) 從 internal 進入 Fortigate id=36871 trace_id=131 func=resolve_ip_tuple line=3909 msg="allocate a new session-0000b19b Fortigate 確認為一個新的 Session id=36871 trace_id=131 func=vf_ip4_route_input line=1591 msg="find a route: gw via wan1" Fortigate 去看路由表, 確認有這筆路由 id=36871 trace_id=131 func=get_new_addr line=1948 msg="find SNAT: IP , port Fortigate 作 SNAT id=36871 trace_id=131 func=fw_forward_handler line=545 msg="allowed by Policy-6: SNAT Fortigate 去看 Policy 表確認有一條 Policy ID 6 id=36871 trace_id=131 func= ip_session_run_tuple line=2110 msg="snat > :19243" 最後將 IP NAT 成

138 Fortinet 資料參考網站 Fortinet 相關技術與設定參考文件放置網站 Product Information ( FortiOS Release Notes Knowledge Center (kb.fortinet.com) Technical Forums (support.fortinet.com/forum) FortiDocs (docs.fortinet.com)

IP505SM_manual_cn.doc

IP505SM_manual_cn.doc IP505SM 1 Introduction 1...4...4...4...5 LAN...5...5...6...6...7 LED...7...7 2...9...9...9 3...11...11...12...12...12...14...18 LAN...19 DHCP...20...21 4 PC...22...22 Windows...22 TCP/IP -...22 TCP/IP