FortiGate飞塔防火墙 简明配置指南

fortigate 简易设置手册一、更加语言设置：1、首先把PC的网卡IP修改成192.168.1.*的网段地址，在IE中输入：https://192.168.1.99进入设置界面，如下图：2、进入设置界面后，点击红框标注的位置（系统管理→状态→管理员设置），进入如下图：在红框标注的位置进行语言选择。

二、工作模式的设置：Fortigate防火墙可以工作在以下几种模式：路由/NAT模式、透明模式；要修改工作模式可在下图标注处进行更改，然后设置相应的IP地址和掩码等。

三、网络接口的设置：在系统管理→点击网络，就出现如下图所示，在下图所指的各个接口，您可以自已定义各个接口IP地址。

点击编辑按钮，进入如下图所示：在下图地址模式中，在LAN口上根据自已需要进行IP地址的设置，接着在管理访问中指定管理访问方式。

在WAN口上，如果是采用路由/NAT模式可有两种方式：1、采用静态IP的方式：如下图：在红框标注的地方，选中自定义，输入ISP商给你的IP地址、网关、掩码。

在管理访问的红框中，指定您要通过哪种方式进行远程管理。

如果你从ISP商获得多个IP的话，你可以在如下图中输入进去。

在如下图红框标注的地方，输入IP地址和掩码以及管理访问方式，点击ADD 即可。

注: 采用静态IP地址的方式，一定要加一条静态路由，否则就不能上网。

如下图：2、如采用ADSL拨号的方式，如下图：当你选中PPOE就会出现如下图所示的界面：在红框标注的地址模式中，输入ADSL用户和口令，同时勾选上‘从服务器上重新获得网关‘和改变内部DNS。

在管理访问方式中根据自已的需要，选中相应的管理方式，对于MTU值一般情况下都采用默认值就行了.四、防火墙的设置：防火墙的设置，首先要规化地址和地址池，如下图：输入你要过滤和保护的地址和地址段。

点击上图标注处进入地址设置栏，首先从类型中选择你要的地址类型，然后根据所选的类型输入IP地址或地址段以及网络接口。

接着就是计划时间表和保护内容列表的设置，其中保护内容列表包括有病毒过滤、网址过滤、内容过滤、防入侵等。

HighlightsValidatedSecurityUniversal PlatformSupportOne NetworkOSSingle Paneof GlassPerformanceFortiGate appliances, interconnectedwith the Fortinet Security Fabric,form the backbone of theFortinet Enterprise Solution/sfDATA SHEETFortiGate/FortiWiFi® 30E Unified Threat Management Distributed Enterprise FirewallDATA SHEET: FortiGate/FortiWiFi 30EHARDWAREInstall in Minutes with FortiExplorerThe FortiExplorer wizard enables easy setup and configuration coupled with easy-to-follow instructions. FortiExplorer runs on popular mobile devices like Android and iOS. Using FortiExplorer is as simple as starting the application and connecting to the appropriate USB port on the FortiGate. By using FortiExplorer, you can be up and running and protected in minutes.Wireless and 3G/4G WAN ExtensionsThe FortiGate supports external 3G/4G modems that allow additional or redundant WAN connectivity for maximum reliability. The FortiGate can also operate as a wireless access point controller to further extend wireless capabilities.Compact and Reliable Form FactorDesigned for small environments, you can simply place the FortiGate/FortiWiFi 30E on a desktop. It is small, lightweight yet highly reliable with superior MTBF (Mean Time Between Failure), minimizing the chance of a network disruption.Superior Wireless CoverageA built-in dual-band, dual-stream access point with internal antennas is integrated on the FortiWiFi 30E and provides speedy 802.11n coverage on both 2.4 GHz and 5 GHz bands. The dual- band chipset addresses the PCI-DSS compliance requirement for rogue AP wireless scanning, providing maximum protection for regulated environments.Interfaces1. USB Port2. Console Port3. 1x GE RJ45 WAN Port4. 4x GE RJ45 Switch PortsFortiGate 30EFortiWiFi 30EInterfaces1. USB Port2. Console Port3. 1x GE RJ45 WAN Port4. 4x GE RJ45 Switch PortsSERVICESFortiGuard ™ Security ServicesFortiGuard Labs offers real-time intelligence on the threat landscape, delivering comprehensive security updates across the full range of Fortinet’s solutions. Comprised of security threat researchers, engineers, and forensic specialists, the team collaborates with the world’s leading threat monitoring organizations, other network and security vendors, as well as law enforcement agencies:§Real-time Updates — 24x7x365 Global Operations research security intelligence, distributed via Fortinet Distributed Network to all Fortinet platforms.§Security Research — FortiGuard Labs have discovered over 170 unique zero-day vulnerabilities to date, totaling millions of automated signature updates monthly.§Validated Security Intelligence — Based on FortiGuard intelligence, Fortinet’s network security platform is tested and validated by the world’s leading third-party testing labs and customers globally.FortiCare ™ Support ServicesOur FortiCare customer support team provides global technical support for all Fortinet products. With support staff in the Americas, Europe, Middle East and Asia, FortiCare offers services to meet the needs of enterprises of all sizes:§Enhanced Support — For customers who need support during local business hours only.§Comprehensive Support — For customers who need around-the-clock mission critical support, including advanced exchange hardware replacement.§Advanced Services — For global or regional customers who need an assigned Technical Account Manager, enhanced service level agreements, extended software support, priority escalation, on-site visits and more.§Professional Services — For customers with more complex security implementations that require architecture and design services, implementation and deployment services, operational services and more.Enterprise BundleFortiGuard Labs delivers a number of security intelligence services to augment the FortiGate firewall platform. You can easily optimize the protection capabilities of your FortiGate with the FortiGuard Enterprise Bundle. This bundle contains the full set of FortiGuard security services plus FortiCare service and support offering the most flexibility and broadest range of protection all in one package.For more information, please refer to the FortiOS data sheet available at filter web traffic based on millions of real-time URL ratings. §Detect, contain and block advanced attacks automatically in minutes with integrated advanced threat protection framework. §Solve your networking needs with extensive routing, switching, WiFi, LAN and WAN capabilities.§Activate all the ASIC-boosted capabilities you need on the fastest firewall platform available.GLOBAL HEADQUARTERS Fortinet Inc.899 Kifer RoadSunnyvale, CA 94086United StatesTel: +/salesEMEA SALES OFFICE 905 rue Albert Einstein Valbonne 06560Alpes-Maritimes, France Tel: +33.4.8987.0500APAC SALES OFFICE 300 Beach Road 20-01The Concourse Singapore 199555Tel: +65.6395.2788LATIN AMERICA SALES OFFICE Sawgrass Lakes Center13450 W. Sunrise Blvd., Suite 430 Sunrise, FL 33323United StatesTel: +1.954.368.9990Copyright© 2016 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary and may be significantly less effective than the metrics stated herein. Network variables, different network environments and other conditions may negatively affect performance results and other metrics stated herein. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet and any such commitment shall be limited by the disclaimers in this paragraph and other limitations in the written contract. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests, and in no event will Fortinet be responsible for events or issues that are outside of its reasonable control. Notwithstanding anything to the contrary, Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.DATA SHEET: FortiGate/FortiWiFi30EFirewall Latency (64 byte UDP packets)130 μs Firewall Throughput (Packets Per Second)180 Kpps Concurrent Sessions (TCP)900,000New Sessions/Second (TCP)15,000Firewall Policies5,000IPsec VPN Throughput (512 byte packets)75 Mbps Gateway-to-Gateway IPsec VPN Tunnels 200Client-to-Gateway IPsec VPN Tunnels 250SSL-VPN Throughput35 Mbps Concurrent SSL-VPN Users (Recommended Maximum)80IPS Throughput (HTTP / Enterprise Mix) 1600 / 240 Mbps SSL Inspection Throughput 2200 Mbps Application Control Throughput 3300 Mbps NGFW Throughput 4200 Mbps Threat Protection Throughput 5150 Mbps CAPWAP Throughput6950 Mbps Virtual Domains (Default / Maximum)5 / 5Maximum Number of FortiAPs (Total / Tunnel Mode) 2 / 2Maximum Number of FortiTokens20Maximum Number of Registered FortiClients 200High Availability ConfigurationsActive/Active, Active/Passive, ClusteringSPECIFICATIONSORDER INFORMATIONNote: A ll performance values are “up to” and vary depending on system configuration. IPsec VPN performance is based on512 byte UDP packets using AES-256+SHA1. 1. IPS performance is measured using 1 Mbyte HTTP and Enterprise Traffic Mix. 2. SSL Inspection is measured with IPS enabled and HTTP traffic, using TLS v1.2 with AES256-SHA. 3. Application Control performance is measured with 64 Kbytes HTTP traffic. 4. NGFW performance is measured with IPS and Application Control enabled, based on Enterprise Traffic Mix. 5. Threat Protection performance is measured with IPS and Application Control and Malware protection enabled, based on Enterprise Traffic Mix. 6. CAPWAP performance is based on 1444 byte UDP packets.。

fortigate防火墙怎么样设置fortigate防火墙的设置好坏，会影响到我们电脑的安全，那么要怎么样去设置呢?下面由店铺给你做出详细的fortigate防火墙设置方法介绍!希望对你有帮助!fortigate防火墙设置方法一：近期经常有群友和坛友反映将FortiOS升级到4.0 MR2后经常出现资源利用率很高的情况，大家可以参考下面的一些建议;1，FortiGate设备应该有足够的资源应对攻击资源利用率最好不要超过65% get sys performance status 在65%到85%是正常的。

2，只开启用得着的管理服务如果不用SSH或SNMP，就不要启用,避免开放可用的端口.。

3，将用得最多或最重要的防火墙策略尽量靠前防火墙策略是至上而下执行的。

4，只开启那些必要的流量日志流量日志会降低系统性能。

5，只开启那些必须的应用层协议检查应用层检查对系统性能是敏感的。

6，最小化发送系统告警信息如果已经配置了syslog或FAZ日志,尽可能不要配置SNMP或Email告警。

7，AV/IPS特征库更新间隔为4或6小时并启用允许服务器推升级。

8，精简保护内容表数量。

9，删除不必要的保护内容表。

10，精简虚拟域数量删除不必要的虚拟域低端设备最好不要用虚拟域。

11，如果性能显示不足就避免启用流量整形流量整形将降低流量处理性能如何优化防火墙内存使用率1，尽量不启用内存日志2，尽量不启用不必要的AV扫描协议3，减小扫描病毒文件的上限值，大多数带病毒的文件文件都小于2、3M4，删除不用的DHCP服务5，取消不用的DNS转发服务6，如IPS不需要，执行命令节省内存 Diag ips global all status disable7，改变session的ttl值set default 300 [conf sys session-ttl]set tcp-halfclose-timer 30 [config sys global]set tcp-halfopen-timer 20 [conf sys global]8，改变fortiguard的ttl值set webfilter-cache-ttl [conf sys fortiguard ]set antispam-cache-ttl [conf sys fortiguard ]9，改变DNS缓存的条数set dns-cache-limit [conf sys dns]10，不启用DNS转发unset fwdintf [conf system dns]上面出现的命令可查看CLI文档中相关用法fortigate防火墙设置方法二：恢复飞塔(FortiGate)防火墙的出厂设置当我们不能登录飞塔(FortiGate)防火墙的管理界面时可以使用此方法，不过必须要知道管理密码。

FortiGate 常用配置命令一、命令结构config Configure object. 对策略，对象等进行配置get Get dynamic and system information. 查看相关关对象的参数信息show Show configuration. 查看配置文件diagnose Diagnose facility. 诊断命令execute Execute static commands. 常用的工具命令，如ping exit Exit the CLI. 退出二、常用命令1、配置接口地址:FortiGate # config system interfaceFortiGate (interface) # edit lanFortiGate (lan) # set ip 192.168.100.99/24FortiGate (lan) # end2、配置静态路由FortiGate (static) # edit 1FortiGate (1) # set device wan1FortiGate (1) # set dst 10.0.0.0 255.0.0.0FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # end3、配置默认路由FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # set device wan1FortiGate (1) # end4、添加地址FortiGate # config firewall addressFortiGate (address) # edit clientnetnew entry 'clientnet' addedFortiGate (clientnet) # set subnet 192.168.1.0 255.255.255.0 FortiGate (clientnet) # end5、添加 ip 池FortiGate (ippool) # edit nat-poolnew entry 'nat-pool' addedFortiGate (nat-pool) # set startip 100.100.100.1FortiGate (nat-pool) # set endip 100.100.100.100FortiGate (nat-pool) # end6、添加虚拟 ipFortiGate # config firewall vipFortiGate (vip) # edit webservernew entry 'webserver' addedFortiGate (webserver) # set extip 202.0.0.167FortiGate (webserver) # set extintf wan1FortiGate (webserver) # set mappedip 192.168.0.168 FortiGate (webserver) # end7、配置上网策略FortiGate # config firewall policyFortiGate (policy) # edit 1FortiGate (1)#set srcintf internal //源接口FortiGate (1)#set dstintf wan1 //目的接口FortiGate (1)#set srcaddr all //源地址FortiGate (1)#set dstaddr all //目的地址FortiGate (1)#set action accept //动作FortiGate (1)#set schedule always //时间FortiGate (1)#set service ALL //服务FortiGate (1)#set logtraffic disable //日志开关FortiGate (1)#set nat enable //开启 natend8、配置映射策略FortiGate # config firewall policyFortiGate (policy) #edit 2FortiGate (2)#set srcintf wan1 //源接口FortiGate (2)#set dstintf internal //目的接口FortiGate (2)#set srcaddr all //源地址FortiGate (2)#set dstaddr FortiGate1 //目的地址，虚拟 ip 映射，事先添加好的FortiGate (2)#set action accept //动作FortiGate (2)#set schedule always //时间FortiGate (2)#set service ALL //服务FortiGate (2)#set logtraffic all //日志开关end9、把 internal 交换接口修改为路由口确保关于 internal 口的路由、dhcp、防火墙策略都删除FortiGate # config system globalFortiGate (global) # set internal-switch-mode interfaceFortiGate (global) #end重启1、查看主机名，管理端口FortiGate # show system global2、查看系统状态信息，当前资源信息FortiGate # get system performance status3、查看应用流量统计FortiGate # get system performance firewall statistics4、查看 arp 表FortiGate # get system arp5、查看 arp 丰富信息FortiGate # diagnose ip arp list6、清楚 arp 缓存FortiGate # execute clear system arp table7、查看当前会话表FortiGate # diagnose sys session stat 或 FortiGate # diagnose sys session full- stat；8、查看会话列表FortiGate # diagnose sys session list9、查看物理接口状态FortiGate # get system interface physical10、查看默认路由配置FortiGate # show router static11、查看路由表中的静态路由FortiGate # get router info routing-table static12、查看 ospf 相关配置FortiGate # show router ospf13、查看全局路由表FortiGate # get router info routing-table all1、查看 HA 状态FortiGate # get system ha status2、查看主备机是否同步FortiGate # diagnose sys ha showcsum3.诊断命令：FortiGate # diagnose debug application ike -1execute 命令：FortiGate #execute ping 8.8.8.8 //常规 ping 操作FortiGate #execute ping-options source 192.168.1.200 //指定 ping 数据包的源地址 192.168.1.200FortiGate #execute ping 8.8.8.8 //继续输入 ping 的目标地址，即可通过 192.168.1.200 的源地址执行 ping 操作FortiGate #execute traceroute 8.8.8.8FortiGate #execute telnet 2.2.2.2 //进行 telnet 访问FortiGate #execute ssh 2.2.2.2 //进行 ssh 访问FortiGate #execute factoryreset //恢复出厂设置FortiGate #execute reboot //重启设备FortiGate #execute shutdown //关闭设备。

DEPLOYMENT GUIDEFortinet FortiGate and FireMonFortinet FortiGate and FireMonOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Deployment Prerequisites (3)FireMon Configuration (4)Fortinet Configuration (7)Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12FireMon Configuration1. From the Administration screen, click Device.2. From the Devices screen, click Create > Fortinet.3. Choose FortiGate Firewall or FortiGate Firewall VDOM if your deployment has VDOMs.4. For VDOMs, be sure to input the correct VDOM name in the device property section.5. Under General Properties, give the device a name and enter the IP Address.6. Under Device Settings, enter the password for the Admin user then re-enter the password.7. Click Save when done.8. Please note: The Admin user will need to be configured with the super_admin profile on the FortiGate.The next screen should look like this.If you plan on using Policy Optimizer, make sure to check the box to enable the License.9. Then go to Workflow.10. Under Policy Planner, click Create > Access Request.11. Give it a Name, then click Save.The Workflow screen shout now look like the image below.12. Do the same for the Policy Optimizer configuration.Note: If adding FortiGate firewalls via FortiManager, do this from Devices > Management Stations. The Admin user will need access to all VDOMs enabled.Fortinet Configuration1. Ensure all Firewall rules are set to Log All Sessions.If not, enable this for each rule under Logging Options.2. Configure FortiGate to send Syslog to the FireMon IP address.3. Under Log & Report, click Log Settings.4. Enable Send Logs to Syslog.5. Enter the IP Address or FQDN of the FireMon server.6. Select the desired Log Settings.7. Click Save.Note: If the primary Syslog is already configured, you can use the CLI to configure additional Syslog servers.8. The configuration is now complete. Go back to the Devices screen in the FireMon interface. It should look like the imagebelow once logs are received and the configuration has been retrieved.9. You can initiate a manual retrieval of the configuration by clicking the box on the far right.Security Manager Dashboard Views.Security Manager Policy Views11Security Manager Security & Compliance ViewsCopyright © 2021 Fortinet, Inc. All rights reserved. Fortinet , FortiGate , FortiCare and FortiGuard , and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.October 7, 2021 3:55 PMMacintosh HD:Users:austin:Dropbox (Red Rider):Clients:Fortinet:Solution Brief Updates:Working Group 5:DG-Fortinet-and-Firemon-102021:DG-Fortinet-and-Firemon-10202191828-A-0-EN Security Manager Security & Change ViewsSummaryFireMon helps keep Fortinet firewalls running smoothly with a complete configuration management solution, including fullsupport for the FortiGate line of network security platforms and appliances. FireMon monitors each appliance, capturing event and traffic logs in real time. All change events trigger a full configuration capture including detailed change history and a full audit trail of operations. Fortinet devices can be monitored directly or indirectly if another event collection system is in place.Solution Guide: https:///content/dam/fortinet/assets/alliances/firemon-integration-brief-for-fortinet.pdfFortiGate 5.6 Handbook: https:///uploaded/files/3999/fortios-handbook-56.pdf。

Fortinet产品家族fortinet 的产品家族涵盖了完备的网络安全解决方案包括邮件，日志，报告，网络管理，安全性管理以及fortigate 统一安全性威胁管理系统的既有软件也有硬件设备的产品。

更多fortinet产品信息，详见/products.FortiGuard服务订制fortiguard 服务定制是全球fortinet安全专家团队建立,更新并管理的安全服务。

fortinet安全专家们确保最新的攻击在对您的资源损害或感染终端用户使用设备之前就能够被检测到并阻止。

fortiguard服务均以最新的安全技术构建，以最低的运行成本考虑设计。

fortiguard 服务订制包括：1、fortiguard 反病毒服务2、 fortiguard 入侵防护（ips）服务3、 fortiguard 网页过滤服务4、fortiguard 垃圾邮件过滤服务5、fortiguard premier伙伴服务并可获得在线病毒扫描与病毒信息查看服务。

FortiClientforticlient 主机安全软件为使用微软操作系统的桌面与便携电脑用户提供了安全的网络环境。

forticlient的功能包括：1、建立与远程网络的vpn连接2、病毒实时防护3、防止修改windows注册表4、病毒扫描forticlient还提供了无人值守的安装模式，管理员能够有效的将预先配置的forticlient分配到几个用户的计算机。

FortiMailfortimail安全信息平台针对邮件流量提供了强大且灵活的启发式扫描与报告功能。

fortimail 单元在检测与屏蔽恶意附件例如dcc（distributed checksum clearinghouse）与bayesian扫描方面具有可靠的高性能。

在fortinet卓越的fortios 与fortiasic技术的支持下，fortimail反病毒技术深入扩展到全部的内容检测功能，能够检测到最新的邮件威胁。

（完整版）FortiGate防火墙常用配置命令FortiGate 常用配置命令一、命令结构config Configure object. 对策略，对象等进行配置get Get dynamic and system information. 查看相关关对象的参数信息show Show configuration. 查看配置文件diagnose Diagnose facility. 诊断命令execute Execute static commands. 常用的工具命令，如ping exit Exit the CLI. 退出二、常用命令1、配置接口地址:FortiGate # config system interfaceFortiGate (interface) # edit lanFortiGate (lan) # set ip 192.168.100.99/24FortiGate (lan) # end2、配置静态路由FortiGate (static) # edit 1FortiGate (1) # set device wan1FortiGate (1) # set dst 10.0.0.0 255.0.0.0FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # end3、配置默认路由FortiGate (1) # set gateway 192.168.57.1FortiGate (1) # set device wan1FortiGate (1) # end4、添加地址FortiGate # config firewall addressFortiGate (address) # edit clientnetnew entry 'clientnet' addedFortiGate (clientnet) # set subnet 192.168.1.0 255.255.255.0 FortiGate (clientnet) # end5、添加ip池FortiGate (ippool) # edit nat-poolnew entry 'nat-pool' addedFortiGate (nat-pool) # set startip 100.100.100.1FortiGate (nat-pool) # set endip 100.100.100.100FortiGate (nat-pool) # end6、添加虚拟ipFortiGate # config firewall vipFortiGate (vip) # edit webservernew entry 'webserver' addedFortiGate (webserver) # set extip 202.0.0.167FortiGate (webserver) # set extintf wan1FortiGate (webserver) # set mappedip 192.168.0.168 FortiGate (webserver) # end7、配置上网策略FortiGate # config firewall policyFortiGate (policy) # edit 1FortiGate (1)#set srcintf internal //源接口FortiGate (1)#set dstintf wan1 //目的接口FortiGate (1)#set srcaddr all //源地址FortiGate (1)#set dstaddr all //目的地址FortiGate (1)#set action accept //动作FortiGate (1)#set schedule always //时间FortiGate (1)#set service ALL //服务FortiGate (1)#set logtraffic disable //日志开关FortiGate (1)#set nat enable //开启natend8、配置映射策略FortiGate # config firewall policyFortiGate (policy) #edit 2FortiGate (2)#set srcintf wan1 //源接口FortiGate (2)#set dstintf internal //目的接口FortiGate (2)#set srcaddr all //源地址FortiGate (2)#set dstaddr FortiGate1 //目的地址，虚拟ip映射，事先添加好的FortiGate (2)#set action accept //动作FortiGate (2)#set schedule always //时间FortiGate (2)#set service ALL //服务FortiGate (2)#set logtraffic all //日志开关end9、把internal交换接口修改为路由口确保关于internal口的路由、dhcp、防火墙策略都删除FortiGate # config system globalFortiGate (global) # set internal-switch-mode interfaceFortiGate (global) #end重启--------------------------------------1、查看主机名，管理端口FortiGate # show system global2、查看系统状态信息，当前资源信息FortiGate # get system performance status3、查看应用流量统计FortiGate # get system performance firewall statistics4、查看arp表FortiGate # get system arp5、查看arp丰富信息FortiGate # diagnose ip arp list6、清楚arp缓存FortiGate # execute clear system arp table7、查看当前会话表FortiGate # diagnose sys session stat 或FortiGate # diagnose sys session full-stat；8、查看会话列表FortiGate # diagnose sys session list9、查看物理接口状态FortiGate # get system interface physical10、查看默认路由配置FortiGate # show router static11、查看路由表中的静态路由FortiGate # get router info routing-table static12、查看ospf相关配置FortiGate # show router ospf13、查看全局路由表FortiGate # get router info routing-table all-----------------------------------------------1、查看HA状态FortiGate # get system ha status2、查看主备机是否同步FortiGate # diagnose sys ha showcsum---------------------------------------------------3.诊断命令：FortiGate # diagnose debug application ike -1---------------------------------------------------execute 命令：FortiGate #execute ping 8.8.8.8 //常规ping操作FortiGate #execute ping-options source 192.168.1.200 //指定ping数据包的源地址192.168.1.200FortiGate #execute ping 8.8.8.8 //继续输入ping 的目标地址，即可通过192.168.1.200的源地址执行ping操作FortiGate #execute traceroute 8.8.8.8FortiGate #execute telnet 2.2.2.2 //进行telnet访问FortiGate #execute ssh 2.2.2.2 //进行ssh 访问FortiGate #execute factoryreset //恢复出厂设置FortiGate #execute reboot //重启设备FortiGate #execute shutdown //关闭设备。

fortigate使用手册FortiGate是一款功能强大的网络安全设备，可帮助企业保护其网络免受各种威胁和攻击。

本使用手册将引导您正确配置和使用FortiGate 设备，确保您的网络安全和数据的保护。

一、FortiGate设备简介FortiGate设备是一种集成了防火墙、入侵防御系统、虚拟专用网络等多种功能的网络安全设备。

它采用了先进的硬件和软件技术，能够提供高性能和可靠的安全解决方案。

FortiGate设备适用于各种规模的企业网络，从小型办公室到大型企业网络都可以使用。

二、FortiGate设备的安装与配置1. 设备安装在开始配置FortiGate设备之前，您需要确保设备已经正确安装在网络中。

将设备适配器插入电源插座，并将设备与网络交换机或路由器连接。

确保设备的电源和网络连接正常。

2. 监听设备在配置FortiGate设备之前，您需要确保您的计算机与设备处于同一网络中。

通过打开浏览器，在浏览器地址栏中输入设备的IP地址，如果一切正常，您将能够访问到设备的管理界面。

3. 初始配置初次登录设备管理界面时，您需要按照设备提供的引导进行初始配置。

设置管理员账户和密码，并进行基本网络设置，如IP地址、子网掩码、网关等。

此步骤将确保您能够正常访问设备并进行后续配置。

三、FortiGate设备的基本配置1. 接口配置FortiGate设备具有多个接口，用于与网络连接。

您需要为每个接口分配一个合适的IP地址，以确保设备能够与其他网络设备正常通信。

2. 防火墙策略配置防火墙策略是FortiGate设备的核心功能之一，它用于控制流经设备的网络流量。

您可以根据需求配置访问控制规则，允许或阻止特定的流量。

确保您的防火墙策略满足安全需求，并允许合法的网络通信。

3. 安全服务配置FortiGate设备提供了多种安全服务选项，如入侵防御系统、反病毒、反垃圾邮件等。

您可以根据需要启用这些服务，增强网络的安全性和保护能力。

四、FortiGate设备的高级配置1. 虚拟专用网络（VPN）配置FortiGate设备支持VPN功能，可实现安全的远程访问和分支之间的安全通信。

FortiGate飞塔防火墙简明配置指南说明：本文档针对所有飞塔 FortiGate设备的基本上网配置说明指南。

要求：FortiGate® 网络安全平台，支持的系统版本为FortiOS v3.0及更高。

步骤一：访问防火墙连线：通过PC与防火墙直连需要交叉线（internal接口可以用直通线），也可用直通线经过交换机与防火墙连接。

防火墙出厂接口配置：Internal或port1：192.168.1.99/24，访问方式：https、ping把PC的IP设为同一网段后（例192.168.1.10/24），即可以在浏览器中访问防火墙https://192.168.1.99防火墙的出厂帐户为admin，密码为空登陆到web管理页面后默认的语言为英文，可以改为中文在system----admin----settings中，将Idle TimeOut（超时时间）改为480分钟，Language 为simplified chinses （简体中文）。

如果连不上防火墙或不知道接口IP，可以通过console访问，并配置IP连线：PC的com1（九针口）与防火墙的console（RJ45）通过console线连接，有些型号的防火墙console是九针口，这时需要console转RJ45的转接头超级终端设置：所有程序----附件----通讯----超级终端连接时使用选择com1，设置如下图输入回车即可连接，如没有显示则断电重启防火墙即可连接后会提示login，输入帐号、密码进入防火墙查看接口IP：show system interface配置接口IP：config system interfaceedit port1或internal 编辑接口set ip 192.168.1.1 255.255.255.0 配置IPset allowaccess ping https http telnet 配置访问方式set status upend配置好后就可以通过网线连接并访问防火墙步骤二：配置接口在系统管理----网络中编辑接口配置IP和访问方式本例中内网接口是internal，IP，192.168.1.1 访问方式，https ping http telnet本例中外网接口是wan1，IP，192.168.100.1访问方式，https ping步骤三：配置路由在路由----静态中写一条出网路由，本例中网关是192.168.100.254步骤四：配置策略在防火墙----策略中写一条出网策略，即internal到wan1并勾选NAT即可。