飞塔防火墙OSPF配置

如何过滤或控制重发布路由版本 1.0时间2013年4月支持的版本N/A状态已审核反馈support_cn@描述:该文档描述如何过滤或控制静态和直连路由重发布至OSPF。

该例中，FG80C 和FG300A在area0.0.0.0.互为neighbors需要将FG80C的部分路由重新发布至FG300A:直连网络10.168.6.0/23;静态路由10.11.0.0/24;配置:1.路由过滤前的配置FGT80Cconfig router ospfconfig areaedit 0.0.0.0nextendconfig networkedit 1set prefix 10.168.0.0 255.255.254.0nextendconfig redistribute "connected"set status enableendconfig redistribute "static"set status enableendset router-id 0.0.0.114endFGT80C# get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate defaultS* 0.0.0.0/0 [10/0] via 172.31.225.254, wan1S 10.11.0.0/24 [10/0] via 10.168.4.103, vlan4S 10.12.0.0/24 [10/0] via 10.168.4.103, vlan4C 10.168.0.0/23 is directly connected, internalC 10.168.4.0/23 is directly connected, vlan4C 10.168.6.0/23 is directly connected, wan2C 172.31.224.0/23 is directly connected, wan1FG300Aconfig router ospfconfig areaedit 0.0.0.0nextendconfig networkedit 1set prefix 10.168.0.0 255.255.254.0nextendconfig redistribute "connected"endconfig redistribute "static"endset router-id 0.0.0.137endFG300A# get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate defaultS* 0.0.0.0/0 [10/0] via 192.168.183.254, port5O E2 10.11.0.0/24 [110/10] via 10.168.1.114, port1, 00:07:25O E2 10.12.0.0/24 [110/10] via 10.168.1.114, port1, 00:07:25C 10.168.0.0/23 is directly connected, port1O E2 10.168.4.0/23 [110/10] via 10.168.1.114, port1, 00:00:38 O E2 10.168.6.0/23 [110/10] via 10.168.1.114, port1, 00:07:33 O E2 172.31.224.0/23 [110/10] via 10.168.1.114, port1, 00:00:38 C 192.168.100.0/24 is directly connected, port2C 192.168.182.0/23 is directly connected, port52.FG80C添加过滤后配置FGT80Cconfig router access-listedit "OnlyNet6"config ruleedit 1set prefix 10.168.6.0 255.255.254.0set exact-match enablenextendnextedit "1"nextedit "OnlyNet11"config ruleedit 1set prefix 10.11.0.0 255.255.255.0set exact-match enablenextnextendconfig router route-mapedit "Map-OnlyNet6"config ruleedit 1set match-ip-address "OnlyNet6"nextendnextedit "Map-OnlyNet11"config ruleedit 1set match-ip-address "OnlyNet11"nextendnextendconfig router ospfconfig areaedit 0.0.0.0nextendconfig networkset prefix 10.168.0.0 255.255.254.0nextendconfig redistribute "connected"set status enableset routemap "Map-OnlyNet6"endconfig redistribute "static"set status enableset routemap "Map-OnlyNet11"endset router-id 0.0.0.114end3.检查FG300A上路由表FG300A2904500072 # get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate defaultS* 0.0.0.0/0 [10/0] via 192.168.183.254, port5O E2 10.11.0.0/24 [110/10] via 10.168.1.114, port1, 00:01:07C 10.168.0.0/23 is directly connected, port1O E2 10.168.6.0/23 [110/10] via 10.168.1.114, port1, 00:01:35C 192.168.100.0/24 is directly connected, port2 C 192.168.182.0/23 is directly connected, port5过滤后仅有目标的2条路由被重发布至OSPF。

OSPF配置步骤1、设备配置将OSPF模块加载到网络设备上，并启用和配置路由协议，如果要使用指定路由协议，必须先进行配置。

2、配置Router IDRouter ID是使用OSPF协议进行通信的路由器节点的标识，在路由器中是唯一的，它必须在OSPF配置的初始步骤中显式定义，无法由系统选择。

可以使用任何32位的IPv4地址，通常是路由器接口的IP地址或者一个特定的Loopback地址。

3、定义网络网络是OSPF划分子网关系和路由器节点间连接点之间的逻辑连接。

定义网络时，需要指定一个“主机”IP地址，它将决定路由器节点间连续网络之间接口上启用OSPF的哪一方。

4、指定区域通过区域可以将路由器分割为一个或多个网络拓扑，以便管理路由条目的传输和收集。

OSPF协议分为区域型、网络型和主机型，每种类型运行不同的OSPF协议。

5、定义路由器节点路由器节点是OSPF网络中的分隔点，连接网络的另一部分。

在网络中，每一个路由器都是一个独立的实体，关联拥有不同或相同网络地址部分网络范围的路由器节点6、设置网络拓扑结构在网络设置完成后，可以按照自己的需求设置不同的网络拓扑结构，包括内网、外网、跨网等。

此外，还可以添加OSPF路由记录以控制流量，以及管理拓扑路由器之间的OSPF链路。

7、OSPF安全配置OSPF安全配置是重要的，可以防止“联盟”路由器的攻击，以及“源路由”攻击，让网络免受外界的威胁，保证网络的稳定性。

8、OSPF性能调整OSPF性能调整可以通过更改链路延迟，使用加权路由等方式来调整，以优化OSPF网络的通信效率和性能。

9、运行测试测试OSPF有效性并验证配置的正确性，以保证OSPF的正确性和安全性，测试过程中可以检查配置、状态和链接数据，以确保正确的路由决策和稳定的通信结果。

FortiGate 常用配置命令一、命令结构config Configure object. 对策略，对象等进行配置get Get dynamic and system information. 查看相关关对象的参数信息show Show configuration. 查看配置文件diagnose Diagnose facility. 诊断命令execute Execute static commands. 常用的工具命令，如ping exit Exit the CLI. 退出二、常用命令1、配置接口地址:FortiGate # config system interfaceFortiGate (interface) # edit lanFortiGate (lan) # set ip 192.168.100.99/24FortiGate (lan) # end2、配置静态路由FortiGate (static) # edit 1FortiGate (1) # set device wan1FortiGate (1) # set dst 10.0.0.0 255.0.0.0FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # end3、配置默认路由FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # set device wan1FortiGate (1) # end4、添加地址FortiGate # config firewall addressFortiGate (address) # edit clientnetnew entry 'clientnet' addedFortiGate (clientnet) # set subnet 192.168.1.0 255.255.255.0 FortiGate (clientnet) # end5、添加 ip 池FortiGate (ippool) # edit nat-poolnew entry 'nat-pool' addedFortiGate (nat-pool) # set startip 100.100.100.1FortiGate (nat-pool) # set endip 100.100.100.100FortiGate (nat-pool) # end6、添加虚拟 ipFortiGate # config firewall vipFortiGate (vip) # edit webservernew entry 'webserver' addedFortiGate (webserver) # set extip 202.0.0.167FortiGate (webserver) # set extintf wan1FortiGate (webserver) # set mappedip 192.168.0.168 FortiGate (webserver) # end7、配置上网策略FortiGate # config firewall policyFortiGate (policy) # edit 1FortiGate (1)#set srcintf internal //源接口FortiGate (1)#set dstintf wan1 //目的接口FortiGate (1)#set srcaddr all //源地址FortiGate (1)#set dstaddr all //目的地址FortiGate (1)#set action accept //动作FortiGate (1)#set schedule always //时间FortiGate (1)#set service ALL //服务FortiGate (1)#set logtraffic disable //日志开关FortiGate (1)#set nat enable //开启 natend8、配置映射策略FortiGate # config firewall policyFortiGate (policy) #edit 2FortiGate (2)#set srcintf wan1 //源接口FortiGate (2)#set dstintf internal //目的接口FortiGate (2)#set srcaddr all //源地址FortiGate (2)#set dstaddr FortiGate1 //目的地址，虚拟 ip 映射，事先添加好的FortiGate (2)#set action accept //动作FortiGate (2)#set schedule always //时间FortiGate (2)#set service ALL //服务FortiGate (2)#set logtraffic all //日志开关end9、把 internal 交换接口修改为路由口确保关于 internal 口的路由、dhcp、防火墙策略都删除FortiGate # config system globalFortiGate (global) # set internal-switch-mode interfaceFortiGate (global) #end重启1、查看主机名，管理端口FortiGate # show system global2、查看系统状态信息，当前资源信息FortiGate # get system performance status3、查看应用流量统计FortiGate # get system performance firewall statistics4、查看 arp 表FortiGate # get system arp5、查看 arp 丰富信息FortiGate # diagnose ip arp list6、清楚 arp 缓存FortiGate # execute clear system arp table7、查看当前会话表FortiGate # diagnose sys session stat 或 FortiGate # diagnose sys session full- stat；8、查看会话列表FortiGate # diagnose sys session list9、查看物理接口状态FortiGate # get system interface physical10、查看默认路由配置FortiGate # show router static11、查看路由表中的静态路由FortiGate # get router info routing-table static12、查看 ospf 相关配置FortiGate # show router ospf13、查看全局路由表FortiGate # get router info routing-table all1、查看 HA 状态FortiGate # get system ha status2、查看主备机是否同步FortiGate # diagnose sys ha showcsum3.诊断命令：FortiGate # diagnose debug application ike -1execute 命令：FortiGate #execute ping 8.8.8.8 //常规 ping 操作FortiGate #execute ping-options source 192.168.1.200 //指定 ping 数据包的源地址 192.168.1.200FortiGate #execute ping 8.8.8.8 //继续输入 ping 的目标地址，即可通过 192.168.1.200 的源地址执行 ping 操作FortiGate #execute traceroute 8.8.8.8FortiGate #execute telnet 2.2.2.2 //进行 telnet 访问FortiGate #execute ssh 2.2.2.2 //进行 ssh 访问FortiGate #execute factoryreset //恢复出厂设置FortiGate #execute reboot //重启设备FortiGate #execute shutdown //关闭设备。

Integrating Fortinet into an OSPF NetworkVersion 1.0Date 10/11/04Product FortiOS 2.8Description This technical note describes the configuration stepsnecessary to integrate Fortinet into an OSPF network. Author Jason ClarkSend comments regarding this document to *******************ContentsIntroduction.......Configuration.....Validation...System Resources...Secure OSPF Configuration...Appendix.......References....... IntroductionOSPF is a link state routing protocol based on the SPF (shortest path first) algorithm.Hence each router maintains a link state database which defines the topology of theAutonomous System. An autonomous system is comprised of a group of areasconnected to a backbone.Fortinet can participate within OSPF areas, as well as act as an ABR or ASBR. Thereare four required configuration steps in order to enable OSPF support within a Fortigateplatform. This document covers these four requirements; router id, area, network, andinterfaces. We will also touch on some best practices for securing OSPF.This technical note assumes a basic understanding of the OSPF protocol. Foradditional OSPF information please review RFC 2328. ConfigurationThere are a number of configurable OSPF options within FortiOS 2.8. OSPF settings are currently configurable via the FortiOS command line interface. This section covers therequired configurable parameters for enabling OSPF. The four parameters discussed are as follows:Router IDAreaNetworkOSPF InterfaceRouter IDBy default Fortinet does not create a Router ID value. Thus, this must be manuallyconfigured. The Router ID should be a 32-bit number that uniquely identifies aparticipating router with a routing domain or Autonomous System. A Router ID of 0.0.0.0is not allowed as this value is used during the designated router and BDR elections.Perform the following steps to configure the router idEnter OSPF router configuration modeconfigure router ospf <enter>From the ospf# prompt, set the 32-bit router id.set router-id ip address <enter>Type end to save changesExampleconfigure router ospfset router-id 192.168.1.99endAREARouting devices in an OSPF Autonomous System are organized into groupings referredto as areas. All routers within an area maintain link state databases for their specific area.An area id of 0 or 0.0.0.0 indicates the backbone area. There must be a backbone forwhich areas can connect to. Virtual links can be used for areas that do not have aconnection to the backbone. A maximum of 20 areas is allowed across all models.Perform the following steps to specify the area for with the Fortigate will participate in.Enter OSPF router configuration modeconfigure router ospf <enter>From the ospf# prompt enter the area sub menuconfigure area <enter>From the area# prompt create the area IDedit area ID <enter>Type end to save changesExampleconfigure router ospfconfigure areaedit 0.0.0.0endNote: Within the area menu, you have the option to configure additional parameters such as area type, authentication, and filtering. Some of these optional parameters will becovered later in this document.NetworkWithin a Fortigate the network command specifies networks and interfaces belonging to an Area. Multiple networks can be assigned to a single physical network. A maximum of 100 networks is allowed is across all models.Perform the following steps assign a network interface(s) to an area.Enter OSPF router configuration modeconfigure router ospf <enter>Enter the network configuration submenuconfigure network <enter>Create a network entry ID in the form of an integeredit integer <enter>Create subnet/supernetset prefix IP Subnet Mask <enter>Attach network to specific area.set area area_id <enter>Type end to save changes.Note: Multiple networks can be defined by creating additional ID Integers.OSPF InterfaceTo apply your OSPF configuration, you must specify an interface name, IP address, as well as a physical interface. Within the OSPF interface configuration you also have the ability to configure additional parameters that will help determine link state information.Such parameters include cost, priority, and status, among others. Descriptions of these optional parameters can be found in the Fortigate 2.8 CLI reference guide.Perform the following steps to apply an OSPF configuration to a specific interface(s)Enter OSPF router configuration modeconfigure router ospf <enter>Enter interface configuration modeconfigure ospf-interface <enter>Create a descriptive interface nameedit interface name <enter>Specify a physical interfaceset interface interface name <enter>Note: Interface_name must be a configured physical interfaceType end to save changes.Exampleconfigure router ospfconfigure ospf-interfaceedit internalset interface internalendValidationFortiOS offers various commands to validate and verify OSPF configuration. We willcover multiple verification options.To validate that OSPF is enabled on a specific interface we will use the followingcommandget router info ospf interface <enter>The output should be as followswan2 is down, line protocol is downOSPF not enabled on this interfacewan1 is up, line protocol is upOSPF not enabled on this interfacedmz is up, line protocol is upOSPF not enabled on this interfaceinternal is up, line protocol is upInternet Address 192.168.1.99/24, Area 0.0.0.0, MTU 1500Router ID 192.168.1.99, Network Type BROADCAST, Cost:10Transmit Delay is 1 sec, State DR, Priority 1Designated Router (ID) 192.168.1.99, InterfaceAddress 192.168.1.99No backup designated router on this networkTimer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5Hello due in 00:00:08Neighbor Count is 1, Adjacent neighbor count is 1Crypt Sequence Number is 0Hello received 81 sent 81, DD received 8 sent 3S-Req received 0 sent 3, LS-Upd received 4 sent 2LS-Ack received 2 sent 3, Discarded 0root is up, line protocol is upOSPF not enabled on this interfaceppp0 is up, line protocol is upOSPF not enabled on this interfaceThe above output tells us that OSPF is enabled on the internal interface and this deviceis acting as the Designated Router. We also see that our adjacent neighbor count is 1.To view our OSPF neighbors use the following commandget router info ospf neighbor <enter>The output should be as followsNeighbor ID Pri State Dead Time Address Interface 192.168.1.32 0 Full 00:00:38 192.168.1.32 internalTo view the current OSPF routing entries use the followingget router info ospf route <enter>The output should be as followsOSPF process 1:Codes: C - connected, D - Discard, O - OSPF, IA - OSPFinter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSAexternal type 2 E1 - OSPF external type 1, E2 - OSPFexternal type 2E1 0.0.0.0/0 [12] via 192.168.1.99, port1E1 10.33.3.1/32 [11] via 192.168.1.99, port1O 192.168.1.0/24 [10] is directly connected, port1, area 0E1 192.168.102.0/24 [11] via 192.168.1.99, port1The OSPF routing table may also be viewed from the Web UI as shown belowSystem Resources There are two main system resource factors to keep in mind when implementing a Fortigate into your OSPF network. The first is memory as OSPF utilizes system memory to store routing information. The size of an OSPF LSA is a minimum of 32 bytes, although is typically around 64 bytes. The second resource factor is CPU utilization. The SPF algorithm uses CPU cycles to generate routing entries when link state changes. By default a Fortigate will perform an SPF calculation 5 seconds after receiving new routing information. When integrating a Fortigate into an OSPF network proper sizing is critical as FortiOS utilizes memory and CPU for additional functions. Additional parameters can be tuned to ensure optimum resource utilization. Some of these parameters will be covered below.SPF TimersFortinet allows for the configuration of SPF delay time and SPF hold time as discussedbelow.The SPF delay_integer specifies the delay after a routing update is received until the SPF calculation is performed. The SPF hold_integer specifies the time between SPFcalculations. The default in seconds is 5 for the delay_integer and 10 for the hold_integer.If the OSPF routing environment permits, you can increase the delay and frequency inwhich SPF calculations are performed.To adjust these values, perform the followingEnter OSPF router configuration modeconfigure router ospf <enter>Configure values where the first number is the delay integer and the second is the holdintegerset spf-timers delay_integer hold_integer <enter> Exampleconfigure router ospfset spf-timers 60 3600endDatabase OverflowDatabase overflow configuration can provide relief from unnecessary or sudden floodingof LSA s. While database overflow state cannot validate the quality of an LSA it can limitthe database usage. Additional information on the database overflow state can be foundin RFC 1765.To enable database overflow follow the steps belowEnter ospf router configuration modeConfigure router ospf <enter>Enable database overflowSet database-overflow enable <enter>Set the number of external LSA s that can be stored in a link state database beforeentering the overflow state. A valid integer is between 0 and 4294967294.Set database-overflow-max-lsas integer <enter> Type end to save changesExampleconfigure router ospfset database-overflow enableset database-overflow-max-lsas 5000endendStub AreaConfiguring your Fortigate to participate in a stub area can also reduce the size of the database as well as the number of SPF calculations. Stub areas reject the flooding of external LSA s into the area.For Fortigate stub area configuration follow the below stepsEnter ospf router configurationconfigure router ospf <enter>Enter area configurationconfigure area <enter>Edit desired areaedit area area_id <enter>Set area typeset type stub <enter>Examplec onfigure router ospfconfigure areaedit 0.0.0.0set type stubendendSecure OSPF ConfigurationOSPF is not an inherently secure routing protocol, thus there are some security issues that should be discussed. OSPF is not only vulnerable to malicious activity, butadministrator mis-configurations as well.BroadcastingThe default OSPF behavior within a Fortigate is to broadcast LSA updates via multicast.With broadcast mode enabled mis-configurations in routing can be propagatedthroughout a routing domain. Adjacent devices configured to broadcast can introduce possible malicious route injections.FortiOS offers multiple network types per OSPF interface including broadcast, non-broadcast, point-to-point, and point-to-multipoint. For our purposes, we will cover thesteps necessary to configure non-broadcast mode.Enter OSPF router configuration modeconfigure router ospf <enter>Enter interface configuration modeconfigure ospf-interface <enter>Edit the ospf interfaceedit interface name <enter>Set the network-type to non-broadcastset network-type non-broadcast <enter>Now that non-broadcast is enabled, we must configure our adjacent neighbors.The following steps are required to configure adjacent neighborsEnter OSPF router configuration modeconfigure router ospf <enter>Enter the neighbor configuration sub categoryconfigure neighbor <enter>Create a neighbor entry ID in the form of an integeredit integer <enter>Specify the IP address of the neighbor routerset ip IP address <enter>Type end to save changesExampleconfigure router ospfconfigure ospf-interfaceedit internalset network-type non-broadcastendconfigure neighboredit 1set ip 192.168.1.32endendAuthenticationBy default authentication is not required to receive routing updates into the link statedatabase. This introduces obvious vulnerabilities such as unauthorized route injectionsand spoofed routing devices.To enable authentication for an interface follow the below stepsEnter OSPF router configuration modeconfigure router ospf <enter>Enter the OSPF interface sub categoryconfigure ospf-interface <enter>Edit the desired OSPF interfaceedit Interface_name <enter>Set authentication typeset authentication md5 <enter>Create an md5 entry and key to be used for authenticationset md5-key integer_id md5_key <enter>Type end to save changes.Exampleconfigure router ospfconfigure ospf-interfaceedit internalset authentication md5set md5-key 1 fortinetendendAccess ListsAlthough a Fortigate employs stateful inspection firewall functionality, firewall rules arenot applied to OSPF routing updates destined for itself. Fortinet does however providethe ability to create access lists to control source and destination routing communication.To configure OSPF access lists follow the steps below.Enter the access list configuration sub menuconfigure router access-list <enter>Create a descriptive access list nameedit access_list_name <enter>Enter the rule configuration sub menuconfigure rule <enter>Create access rule number in the form of an integeredit integer_id <enter>Specify access list action as permit or denyset action permit | deny <enter>Specify network or IP that the action will apply toset prefix network number <enter>Type end to save changesOnce the access list has been created it is now necessary to apply it to the OSPF area Enter OSPF router configuration modeconfigure router ospf <enter>From the ospf# prompt enter the area sub menuconfigure area <enter>From the area# prompt create the area IDedit area ID <enter>Enter the filter list sub menuconfigure filter-list <enter>Create a new filter list in the form of an integeredit integer_id <enter>Specify the direction in which the access list will be appliedset direction in | out <enter>Specify access list to be appliedset list access_list_number <enter>Type end to save changesExampleconfigure router access-listedit OSPF_ACLconfigure ruleedit 1set action permitset prefix 192.168.1.0 255.255.255.0endconfigure router ospfconfigure areaedit 0.0.0.0configure filter-listedit 1set direction inset list ospfendendASBRIt is not recommended to configure your Fortigate platform as an ASBR (AutonomousSystem Border Router). ASBR s are used to receive and distribute external routinginformation. An ASBR will flood external LSA s throughout non-stub areas. Typicallyonly a single ASBR exists for a single Autonomous System. The implication of this is that routing updates cannot be verified against other ASBR s. This is in contrast to thebehavior of ABR s where multiple border routers may exist and perform an inherentvalidation of routing updates.When configuring a Fortigate as an ASBR is absolutely necessary, enabling databaseoverflow can help with the flooding of excess routes. Additional information on database overflow can be found in RFC 1765.To configure database overflow parameters follow the below stepsEnter ospf router configuration modeconfigure router ospf <enter>Enable database overflowset database-overflow enable <enter>Set the number of external LSA s that can be stored in a link state database beforeentering the overflow state. A valid integer is between 0 and 4294967294.set database-overflow-max-lsas integer <enter> Type end to save changesExampleconfigure router ospfset database-overflow enableset database-overflow-max-lsas 5000endendAppendixExtreme Configurationconfigure ospf add vlan vlan_192 area 0.0.0.0configure ospf vlan_192 authentication encrypted md5 1enable ospf export direct cost 10 type ase-type-1 tag 0enable ospfCisco Configurationrouter ospf 1network 192.168.1.0 255.255.255.0 area 0router-id 192.168.1.32FortiOS 2.8 Configurationconfigure router ospfset abr-type standardconfigure areaedit 0.0.0.0nextendset default-information-originate alwaysconfigure networkedit 1set prefix 192.168.1.0 255.255.255.0set area 0.0.0.0nextendconfigure ospf-interfaceedit "port1"set interface "port1"set ip 192.168.1.61nextendconfigure redistribute "connected"set status enableendconfigure redistribute "static"set status enableendconfigure redistribute "rip"set status enableendset router-id 192.168.1.61endReferencesFortigate 2.8 MR5 Command Line Reference GuideRFC 1765RFC 2328。

FortiGate 常用配置命令一、命令结构config Configure object. 对策略，对象等进行配置get Get dynamic and system information. 查看相关关对象的参数信息show Show configuration. 查看配置文件diagnose Diagnose facility. 诊断命令execute Execute static commands. 常用的工具命令，如ping exit Exit the CLI. 退出二、常用命令1、配置接口地址:FortiGate # config system interfaceFortiGate (interface) # edit lanFortiGate (lan) # set ip 192.168.100.99/24FortiGate (lan) # end2、配置静态路由FortiGate (static) # edit 1FortiGate (1) # set device wan1FortiGate (1) # set dst 10.0.0.0 255.0.0.0FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # end3、配置默认路由FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # set device wan1FortiGate (1) # end4、添加地址FortiGate # config firewall addressFortiGate (address) # edit clientnetnew entry 'clientnet' addedFortiGate (clientnet) # set subnet 192.168.1.0 255.255.255.0 FortiGate (clientnet) # end5、添加ip池FortiGate (ippool) # edit nat-poolnew entry 'nat-pool' addedFortiGate (nat-pool) # set startip 100.100.100.1FortiGate (nat-pool) # set endip 100.100.100.100FortiGate (nat-pool) # end6、添加虚拟ipFortiGate # config firewall vipFortiGate (vip) # edit webservernew entry 'webserver' addedFortiGate (webserver) # set extip 202.0.0.167FortiGate (webserver) # set extintf wan1FortiGate (webserver) # set mappedip 192.168.0.168 FortiGate (webserver) # end7、配置上网策略FortiGate # config firewall policyFortiGate (policy) # edit 1FortiGate (1)#set srcintf internal //源接口FortiGate (1)#set dstintf wan1 //目的接口FortiGate (1)#set srcaddr all //源地址FortiGate (1)#set dstaddr all //目的地址FortiGate (1)#set action accept //动作FortiGate (1)#set schedule always //时间FortiGate (1)#set service ALL //服务FortiGate (1)#set logtraffic disable //日志开关FortiGate (1)#set nat enable //开启natend8、配置映射策略FortiGate # config firewall policyFortiGate (policy) #edit 2FortiGate (2)#set srcintf wan1 //源接口FortiGate (2)#set dstintf internal //目的接口FortiGate (2)#set srcaddr all //源地址FortiGate (2)#set dstaddr FortiGate1 //目的地址，虚拟ip映射，事先添加好的FortiGate (2)#set action accept //动作FortiGate (2)#set schedule always //时间FortiGate (2)#set service ALL //服务FortiGate (2)#set logtraffic all //日志开关end9、把internal交换接口修改为路由口确保关于internal口的路由、dhcp、防火墙策略都删除FortiGate # config system globalFortiGate (global) # set internal-switch-mode interfaceFortiGate (global) #end重启--------------------------------------1、查看主机名，管理端口FortiGate # show system global2、查看系统状态信息，当前资源信息FortiGate # get system performance status3、查看应用流量统计FortiGate # get system performance firewall statistics4、查看arp表FortiGate # get system arp5、查看arp丰富信息FortiGate # diagnose ip arp list6、清楚arp缓存FortiGate # execute clear system arp table7、查看当前会话表FortiGate # diagnose sys session stat 或FortiGate # diagnose sys session full-stat；8、查看会话列表FortiGate # diagnose sys session list9、查看物理接口状态FortiGate # get system interface physical10、查看默认路由配置FortiGate # show router static11、查看路由表中的静态路由FortiGate # get router info routing-table static12、查看ospf相关配置FortiGate # show router ospf13、查看全局路由表FortiGate # get router info routing-table all-----------------------------------------------1、查看HA状态FortiGate # get system ha status2、查看主备机是否同步FortiGate # diagnose sys ha showcsum---------------------------------------------------3.诊断命令：FortiGate # diagnose debug application ike -1---------------------------------------------------execute 命令：FortiGate #execute ping 8.8.8.8 //常规ping操作FortiGate #execute ping-options source 192.168.1.200 //指定ping数据包的源地址192.168.1.200FortiGate #execute ping 8.8.8.8 //继续输入ping 的目标地址，即可通过192.168.1.200的源地址执行ping操作FortiGate #execute traceroute 8.8.8.8FortiGate #execute telnet 2.2.2.2 //进行telnet访问FortiGate #execute ssh 2.2.2.2 //进行ssh 访问FortiGate #execute factoryreset //恢复出厂设置FortiGate #execute reboot //重启设备FortiGate #execute shutdown //关闭设备。

设置FortiGate动态路由协议OSPF本文档针对所有FortiGate设备的动态路由协议OSPF配置进行说明。

环境介绍：本文使用FortiGate400A做演示。

本文支持的系统版本为FortiOS v2.8及更高。

OSPF ：链路状态路由协议，采用多播更新，收敛快，适用于大中型网络。

FortiGate设备支持OSPF版本2，参见RFC2328。

步骤一：设置路由器ID路由器ID：唯一标识FortiGate设备的IP地址，可以任意设置。

如果不填，默认选择最大接口IP。

(点击放大)步骤二：创建区域，在各个区中点击新建区：用32位IP地址唯一标识一个区，区0.0.0.0为主干区域类型：FortiGate设备支持普通（regular）区域，NSSA区域，Stub区域认证：FortiGate设备支持明文和MD5认证，认证对该区域有效(点击放大)步骤三：发布网络，在各个网络中点击新建IP/掩码：宣告网路地址和掩码区域：选择该网络所在区域(点击放大)步骤四：发布接口，在各个接口中点击新建名称：自定义接口名称接口：选择要宣告的接口，路由更新会通过该接口发布出去IP：该宣告接口IP认证：FortiGate设备支持明文和MD5认证，认证对该接口有效Hello/Dead时间：定义该接口OSPF Hello/Dead时间，如果接口间时间不一致则不能建立邻居，即收不到对方路由(点击放大)步骤五：高级选项缺省信息：让FortiGate设备产生一条OSPF缺省路由经常：路由表中必须有静态缺省路由才能在OSPF中产生缺省路由总是：任何情况都可以在OSPF中产生缺省路由重发布：FortiGate设备支持将直连、静态、RIP和BGP重发布进OSPF距离：指重发布进OSPF路由的度量值(点击放大)步骤六：验证在另外一台FortiGate中可以看到该OSPF路由，选择路由----当前路由(点击放大)。

Fortinet产品家族fortinet 的产品家族涵盖了完备的网络安全解决方案包括邮件，日志，报告，网络管理，安全性管理以及fortigate 统一安全性威胁管理系统的既有软件也有硬件设备的产品。

更多fortinet产品信息，详见/products.FortiGuard服务订制fortiguard 服务定制是全球fortinet安全专家团队建立,更新并管理的安全服务。

fortinet安全专家们确保最新的攻击在对您的资源损害或感染终端用户使用设备之前就能够被检测到并阻止。

fortiguard服务均以最新的安全技术构建，以最低的运行成本考虑设计。

fortiguard 服务订制包括：1、fortiguard 反病毒服务2、fortiguard 入侵防护（ips）服务3、fortiguard 网页过滤服务4、fortiguard 垃圾邮件过滤服务5、fortiguard premier伙伴服务并可获得在线病毒扫描与病毒信息查看服务。

FortiClientforticlient 主机安全软件为使用微软操作系统的桌面与便携电脑用户提供了安全的网络环境。

forticlient的功能包括：1、建立与远程网络的vpn连接2、病毒实时防护3、防止修改windows注册表4、病毒扫描forticlient还提供了无人值守的安装模式，管理员能够有效的将预先配置的forticlient分配到几个用户的计算机。

FortiMailfortimail安全信息平台针对邮件流量提供了强大且灵活的启发式扫描与报告功能。

fortimail 单元在检测与屏蔽恶意附件例如dcc（distributed checksum clearinghouse）与bayesian扫描方面具有可靠的高性能。

在fortinet卓越的fortios 与fortiasic技术的支持下，fortimail反病毒技术深入扩展到全部的内容检测功能，能够检测到最新的邮件威胁。