Huong Dan Cau Hinh FortiGate

  • View
    619

  • Download
    6

Embed Size (px)

Text of Huong Dan Cau Hinh FortiGate

CNG TY CP U T PHT TRIN CNG NGH NG DNG TON CU HYPERLOGY -------------------

HNG DN CU HNH FORTIGATE FIREWALL

H ni 10/2007

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

Mc lc1.Cc giao din ca FortiGate .......................................................................... 3 Cc n bo hiu ............................................................................................... 3 2. Cu hnh FortiGate ........................................................................................ 3 2.1. Cc cch truy nhp cu hnh FortiGate..................................................... 3 2.2. Ln u tin cu hnh FortiGate .................................................................. 3 2.3. Cc bc cu hnh ............................................................................................. 4 2.4. Cu hnh mode hot ng ca FortiGate ................................................. 4 2.5. Cu hnh cc giao din .................................................................................... 6 2.6. Cu hnh DHCP ................................................................................................... 6 2.7. Cu hnh cc a ch v vng a ch ......................................................... 8 2.8. Cu hnh cc dch v ........................................................................................ 9 2.9. Cu hnh cc Protection profile .................................................................. 12 2.10. Cu hnh cc Policy ......................................................................................... 12 2.11. Cu hnh Virtual IP .......................................................................................... 13 2.12. Cu hnh dch v AntiVirus........................................................................... 14 2.13. Cu hnh dch v AntiSpam ......................................................................... 15 2.14. Cu hnh dch v IPS...................................................................................... 16 2.15. Cu hnh dch v Web filter ......................................................................... 17 2.16. Cu hnh ghi log ............................................................................................... 19 3. Kim tra hot ng ca FortiGate ................................................ 22 3.1. Kim tra cu hnh giao din ........................................................................ 22 3.2. Kim tra cu hnh nh tuyn ..................................................................... 22 3.3. Kim tra cu hnh Policy ............................................................................... 22 3.4. Kim tra hot ng ca mng.................................................................... 23 4. Theo di hot ng ..................................................................................... 23 4.1. Mn hnh Status ............................................................................................... 23 4.2. Theo di log ....................................................................................................... 24 5. Sao lu v phc hi cu hnh ............................................................ 24 5.1. Sao lu v phc hi cu hnh ..................................................................... 24 5.2. Sao lu v phc hi ton b ....................................................................... 25 1.1. 1.2.

Gii thiu FortiGate ...................................................................................... 3

2Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

1. Gii thiu FortiGate1.1. Cc giao din ca FortiGateConsole: Ta c th truy cp giao din dng lnh (Command Line Interface-CLI) ca FortiGate thng qua kt ni gia cng Serial ca 1 my tnh qun tr vi cng Serial ca FortiGate . Internal: y l giao din kt ni vi mng LAN ca n v .Da trn thit k ca mng cu hnh cc thng s nh IP, DHCP,DNS Server ... WAN: y l giao din kt ni vi mng Internet thng qua Modem (Lease Line,ADSL) DMZ y l giao din kt ni vi vng mng cn bo mt cao ,hn ch cc truy cp t bn ngoi Internet ,LAN... da trn cc chnh sch (Policy) do ngi qun tr t ra.Cc my ch nh Mail Server,Web Server.. thng t trong vng ny. USB: y l giao din dng backup,restore,upgrade Firmware cho FortiGate .Ngoi ra n cn dng kt ni vi modem dial-up lm ng d phng cho kt ni ra Internet.

1.2. Cc n bo hiuHin th trng thi ca FortiGate : ngun,trng thi ca cc Interface Power : c cc trng thi sau: Nhp nhy : FortiGate ang khi dng Xanh : FortiGate ang hot ng bnh thng Tt : FortiGate tt ngun Internal,WAN.DMZ c cc trng thi sau : Xanh : cp u ni ng s dng, thit b u ni n bt. Nhp nhy : mng ang hot ng trn Interface ny. Tt : cha c kt ni Link : Nu xanh l mng ang hot ng tc 100Mbps

2. Cu hnh FortiGate2.1. Cc cch truy nhp cu hnh FortiGateFortiGate h tr cc phng thc truy nhp v cu hnh sau: Console: http: https: telnet: ssh: snmp:

2.2. Ln u tin cu hnh FortiGateLn u tin c a v s dng, FortiGate c cu hnh do nh sn xut t sn bao gm: Mode hot ng mc nh: NAT Tn v Password truy nhp mc nh: admin/trng 3Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

a ch IP mc nh ca cc giao din : Internal : 192.168.1.99/24 WAN1 : 192.168.100.99/24 WAN2 : 192.168.101.99/24 DMZ : 10.10.10.1/24 Giao thc cho php truy nhp mc nh: telnet, http, https,

2.3. Cc bc cu hnhCu hnh FortiGate cn tun theo cc bc sau: Cu hnh mode hot ng ca FortiGate: Cu hnh cc giao din Cu hnh DHCP Cu hnh cc a ch v vng a ch Cu hnh cc dch v Cu hnh cc Protection profile Cu hnh cc Policy Cu hnh Virtual IP Cu hnh dch v AntiVirus Cu hnh dch v AntiSpam Cu hnh dch v IPS Cu hnh dch v Web filter Cu hnh ghi log

2.4. Cu hnh mode hot ng ca FortiGateTrn giao din web : https Thng qua giao din Internal(hoc DMZ) cu hnh :

4Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

Tn truy cp : admin Mt khu : trng Chn "Login" , sau chn System Network

Ti ct Access hin th cho ta thy cc Mode c php hot ng trn tng giao din. Mun thay i Mode ca tng giao din ,ti cui dng ca giao din cn i Mode ta chn nt thay i Mode theo yu cu.

5Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

Console, telnet, ssh Tham kho thm trong ti liu hoc trn trang web: http://kc.forticare.com/

2.5. Cu hnh cc giao dinTrn giao din web: http, https Chn "Login" , sau chn System Network. Chn giao din cn thay i Console, telnet, ssh Tham kho thm trong ti liu hoc trn trang web: http://kc.forticare.com/

2.6. Cu hnh DHCPTrn giao din web: http, https Chn "Login" , sau chn System DHCP.Chn giao din cn thay i trong "Service"

Sau thay i tham s theo yu cu :

6Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

Tip n chn "Server", "Creat New" giao din cn cu hnh DHCP:

7Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

Cc ty chn DNS Server ,WINS Server... Console, telnet, ssh Tham kho thm trong ti liu hoc trn trang web: http://kc.forticare.com/

2.7. Cu hnh cc a ch v vng a chTrn giao din web: http, https Login vo h thng ,chn "Firewall" "Address"

Chn "Creat New" nh ngha cc vng : DMZ,LAN,... 8Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

V d :

Console, telnet, ssh Tham kho thm trong ti liu hoc trn trang web: http://kc.forticare.com/

2.8. Cu hnh cc dch vTrn giao din web: http, https Login vo h thng ,chn "Firewall" "Service"

9Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

Predefined : y l cc dch v c nh ngha trc vi cc tn tng ng. Custom : Nu ta mun nh ngha thm cc dch v theo yu cu . V d :

Khi ta s thy :

10Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

Nu mun nhm li 1 s dch v d dng hn khi to cc Policy , ta c th to 1 nhm cc dch v v c th to 1 Policy cho ton b cc dch v trong nhm ny. 1 nhm cc dch v ny c th bao gm cc dch v Predefined v Custom.

Console, telnet, ssh Tham kho thm trong ti liu hoc trn trang web: http://kc.forticare.com/ 11Ti liu hng cu hnh thit b

Cng ty C phn u t Pht trin Cng ngh ng dng Ton Cu Hyperlogy JSC Tel: +84 4 6405636 Fax: +84 4 6405639 Website: http://www.hyperlogy.com

2.9. Cu hnh cc Protection profileTrn giao din web: http, https Vic s dng protection profiles p dng cc thit lp bo v khc nhau cho lung thng tin m c iu khin bi cc policy ca FortiGate. Mc ch : - Cu hnh chng Virus cho cc giao thc HTTP,FTP,IMAP,POP3,SMTP. - Cu hnh lc Web cho HTTP - Cu hnh chng Spam cho IMAP,POP3,SMTP - Cho php chng xm nhp (IPS- Intrusion Prevention System) cho tt c cc dch v. Console, telnet, ssh Tham kho thm trong ti liu hoc trn trang web: http://kc.forticare.com/

2.10. Cu hnh cc PolicyTrn giao din web: http, https Login vo h thng ,chn "Firewall" "Policy"

Source : Interface/Zone :Giao din ngun Address Name: tn ca a ch ngun (a ch c nh ngha trn) Destination : Interface/Zone :Giao din ch Address Name :tn

Search related