Endpoint
FortiOS™ Handbook v2
for FortiOS 4.0 MR2
FortiOS™ Handbook: Endpoint
v2
20 October 2010
01-420-122871-20101020
for FortiOS 4.0 MR2
© Copyright 2010 Fortinet, Inc. All rights reserved. No part of this publication including text, examples,
diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of
Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,
FortiGate®, FortiGate Unified Threat Management System, FortiGuard®, FortiGuard-Antispam,
FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager,
Fortinet®, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and
FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual
companies and products mentioned herein may be the trademarks of their respective owners.
Contents
Introduction
5
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
How this guide is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
IP addresses . . . . . . . . . . .
Example Network configuration .
Cautions, Notes and Tips . . . .
Typographical conventions . . . .
CLI command syntax conventions
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. . 6
. . 8
. . 9
. 10
. 10
Entering FortiOS configuration data . . . . . . . . . . . . . . . . . . . . . . . . . .
Entering text strings (names).
Entering numeric values . . .
Selecting options from a list .
Enabling or disabling options.
.
.
.
.
.
.
.
.
.
.
.
.
12
13
13
13
Registering your Fortinet product. . . . . . . . . . . . . . . . . . . . . . . . . . . .
13
Fortinet products End User License Agreement . . . . . . . . . . . . . . . . . . . .
13
Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
14
Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
14
Fortinet Tools and Documentation CD . . . . . . . . . . . . . . . . . . . . . . .
Fortinet Knowledge Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Comments on Fortinet technical documentation . . . . . . . . . . . . . . . . .
14
14
14
Customer service and technical support . . . . . . . . . . . . . . . . . . . . . . . .
14
Network Access Control and monitoring
15
NAC overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
15
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
15
16
16
17
17
Configuring FortiClient required version and download location . . . . . . . . . . . .
18
Configuring application detection and control . . . . . . . . . . . . . . . . . . . . .
19
Configuring application sensors . . . . . . . . . . . . . . . . . . . . . . . . . .
Viewing the application database . . . . . . . . . . . . . . . . . . . . . . . . .
19
21
Configuring Endpoint profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
22
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
.
.
.
.
.
.
.
.
.
12
.
.
.
.
User experience . . . . . . . . . .
Non-compliant user warning . .
Non-compliant user quarantine
Blocked user . . . . . . . . . .
Configuration overview . . . . . . .
.
.
.
.
.
.
.
.
.
3
Contents
Enabling Endpoint NAC in firewall policies . . . . . . . . . . . . . . . . . . . . . . .
Monitoring endpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
24
Viewing details about the endpoint . . . . . . . . . . . . . . . . . . . . . . . . .
25
Modifying Endpoint NAC replacement pages . . . . . . . . . . . . . . . . . . . . .
25
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
26
Configuring FortiClient download source and required version
Configuring an application sensor . . . . . . . . . . . . . . .
Configuring an endpoint profile. . . . . . . . . . . . . . . . .
Configuring the firewall policy . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
26
26
28
28
Network Vulnerability Scan
31
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
31
Selecting assets to scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
31
Discovering assets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding assets manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
31
33
Configuring scans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
34
Viewing scan results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
36
Viewing scan logs . . . . . . . . . .
Viewing Executive Summary graphs .
Creating reports . . . . . . . . . . .
Viewing reports . . . . . . . . . . . .
Index
4
23
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
36
37
37
38
39
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Introduction
Welcome and thank you for selecting Fortinet products for your network protection. This
document describes how to use the Endpoint features of FortiOS: endpoint Network
Access Control (NAC), endpoint application detection, endpoint monitoring, and network
vulnerability scanning.
This chapter contains the following topics:
•
Before you begin
•
Document conventions
•
Entering FortiOS configuration data
•
Registering your Fortinet product
•
Fortinet products End User License Agreement
•
Training
•
Documentation
•
Customer service and technical support
Before you begin
Before you begin using this guide, please ensure that:
•
You have administrative access to the web-based manager and/or CLI.
•
The FortiGate unit is integrated into your network.
•
The operation mode has been configured.
•
The system time, DNS settings, administrator password, and network interfaces have
been configured.
•
Firmware, FortiGuard Antivirus and FortiGuard Antispam updates are completed.
•
FortiGuard Analysis & Management Service is properly configured.
While using the instructions in this guide, note that administrators are assumed to be
super_admin administrators unless otherwise specified. Some restrictions will apply to
other administrators.
How this guide is organized
This FortiOS Handbook chapter contains the following sections:
Network Access Control and monitoring explains how to configure endpoint NAC,
including the configuration of endpoint application control. The endpoint monitor feature is
also explained.
Network Vulnerability Scan explains how to scan your network for potential security
issues.
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
5
Document conventions
Document conventions
Fortinet technical documentation uses the conventions described below.
IP addresses
To avoid publication of public IP addresses that belong to Fortinet or any other
organization, the IP addresses used in Fortinet technical documentation are fictional and
follow the documentation guidelines specific to Fortinet. The addresses used are from the
private IP address ranges defined in RFC 1918: Address Allocation for Private Internets,
available at http://ietf.org/rfc/rfc1918.txt?number-1918.
Most of the examples in this document use the following IP addressing:
•
IP addresses are made up of A.B.C.D
•
A - can be one of 192, 172, or 10 - the non-public addresses covered in RFC 1918.
•
B - 168, or the branch / device / virtual device number.
•
•
6
•
Branch number can be 0xx, 1xx, 2xx - 0 is Head office, 1 is remote, 2 is other.
•
Device or virtual device - allows multiple FortiGate units in this address space
(VDOMs).
•
Devices can be from x01 to x99.
C - interface - FortiGate units can have up to 40 interfaces, potentially more than one
on the same subnet
•
001 - 099- physical address ports, and non -virtual interfaces
•
100-255 - VLANs, tunnels, aggregate links, redundant links, vdom-links, etc.
D - usage based addresses, this part is determined by what device is doing
•
The following gives 16 reserved, 140 users, and 100 servers in the subnet.
•
001 - 009 - reserved for networking hardware, like routers, gateways, etc.
•
010 - 099 - DHCP range - users
•
100 - 109 - FortiGate devices - typically only use 100
•
110 - 199 - servers in general (see later for details)
•
200 - 249 - static range - users
•
250 - 255 - reserved (255 is broadcast, 000 not used)
•
The D segment servers can be farther broken down into:
•
110 - 119 - Email servers
•
120 - 129 - Web servers
•
130 - 139 - Syslog servers
•
140 - 149 - Authentication (RADIUS, LDAP, TACACS+, FSAE, etc)
•
150 - 159 - VoIP / SIP servers / managers
•
160 - 169 - FortiAnalyzers
•
170 - 179 - FortiManagers
•
180 - 189 - Other Fortinet products (FortiScan, FortiDB, etc.)
•
190 - 199 - Other non-Fortinet servers (NAS, SQL, DNS, DDNS, etc.)
•
Fortinet products, non-FortiGate, are found from 160 - 189.
FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Document conventions
The following table shows some examples of how to choose an IP number for a device
based on the information given. For internal and dmz, it is assumed in this case there is
only one interface being used.
Table 1: Examples of the IP numbering
Location and device
Internal
Dmz
External
Head Office, one FortiGate
10.011.101.100
10.011.201.100
172.20.120.191
Head Office, second FortiGate
10.012.101.100
10.012.201.100
172.20.120.192
Branch Office, one FortiGate
10.021.101.100
10.021.201.100
172.20.120.193
Office 7, one FortiGate with 9
VDOMs
10.079.101.100
10.079.101.100
172.20.120.194
Office 3, one FortiGate, web
server
n/a
10.031.201.110
n/a
Bob in accounting on the
corporate user network (dhcp)
at Head Office, one FortiGate
10.0.11.101.200
n/a
n/a
Router outside the FortiGate
n/a
n/a
172.20.120.195
FortiOS™ Handbook v2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
7
Document conventions
Example Network configuration
The network configuration shown in Figure 1 or variations on it is used for many of the
examples in this document. In this example, the 172.20.120.0 network is equivalent to the
Internet. The network consists of a head office and two branch offices.
Figure 1: Example network configuration
WLAN: 10.12.101.100
SSID: example.com
Password: supermarine
DHCP range: 10.12.101.200-249
Linux PC
10.11.101.20
IN
10 T
.11
.10
FortiWiFi-80CM
Windows PC
10.11.101.10
1.1
01
Internal network
P
10 ort 2
.11
.10
1.1
FortiAnalyzer-100B
10
Switch
30
10
.11
10
.11
.11
.10 Po
1.1 rt 2
02
P
17 ort 1
2.2 (s
0 . 1 n i ff
20 er
FortiGate-82C
.14 mo
1
de
.10 Po
1.1 rt 2
00
.10 Por
1.1 t 1
10
P
17 ort 1
2.2
0.1
20
FortiGate-620B
HA cluster
.14
FortiMail-100C
1
f
rt 8 r o
Po mirro
(
Po
an rt 2
d3
Po
)
p
s
ort
2a
nd
3)
rt 1
Switch
He
P
10 ort 1
.21
.10
1.1
FortiGate-3810A
01
Linux PC
10.21.101.10
rt 1 10
Po 0.21.
1
1.1
Bra
17
nch
o ff
Bra
ice
nch
2.2
o ff
0.1
ice
ad
o ff
ice
20 WAN
.12 1
2
I
10 ntern
.31 al
.10
1.1
FortiGate-51B
0
0
60
Windows PC
10.31.101.10
FortiManager-3000B
10
rt 4
Po .100
1
.10
2
.2
Cluster
Port 1: 10.21.101.102
FortiGate-5005FA2
Port 1: 10.21.101.102
FortiGate-5005FA2
Port 1: 10.21.101.103
FortiSwitch-5003A
Port 1: 10.21.101.161
FortiGate-5050-SM
Port 1: 10.21.101.104
Engineering network
10.22.101.0
8
FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Document conventions
Cautions, Notes and Tips
Fortinet technical documentation uses the following guidance and styles for cautions,
notes and tips.
Caution: Warns you about commands or procedures that could have unexpected or
undesirable results including loss of data or damage to equipment.
Note: Presents useful information, but usually focused on an alternative, optional method,
such as a shortcut, to perform a step.
Tip: Highlights useful additional information, often tailored to your workplace activity.
FortiOS™ Handbook v2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
9
Document conventions
Typographical conventions
Fortinet documentation uses the following typographical conventions:
Table 2: Typographical conventions in Fortinet technical documentation
Convention
Example
Button, menu, text box, From Minimum log level, select Notification.
field, or check box label
CLI input
config system dns
set primary <address_ipv4>
end
CLI output
FGT-602803030703 # get system settings
comments
: (null)
opmode
: nat
Emphasis
HTTP connections are not secure and can be intercepted by a third
party.
File content
<HTML><HEAD><TITLE>Firewall
Authentication</TITLE></HEAD>
<BODY><H4>You must authenticate to use this
service.</H4>
Hyperlink
Visit the Fortinet Technical Support web site,
https://support.fortinet.com.
Keyboard entry
Type a name for the remote VPN peer or client, such as
Central_Office_1.
Navigation
Go to VPN > IPSEC > Auto Key (IKE).
Publication
For details, see the FortiOS Handbook.
CLI command syntax conventions
This guide uses the following conventions to describe the syntax to use when entering
commands in the Command Line Interface (CLI).
Brackets, braces, and pipes are used to denote valid permutations of the syntax.
Constraint notations, such as <address_ipv4>, indicate which data types or string
patterns are acceptable value input.
Table 3: Command syntax notation
10
Convention
Description
Square brackets [ ]
A non-required word or series of words. For example:
[verbose {1 | 2 | 3}]
indicates that you may either omit or type both the verbose word and
its accompanying option, such as:
verbose 3
FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Document conventions
Table 3: Command syntax notation (Continued)
Convention
Description
Angle brackets < >
A word constrained by data type.
To define acceptable input, the angled brackets contain a descriptive
name followed by an underscore ( _ ) and suffix that indicates the
valid data type. For example:
<retries_int>
indicates that you should enter a number of retries, such as 5.
Data types include:
• <xxx_name>: A name referring to another part of the
configuration, such as policy_A.
• <xxx_index>: An index number referring to another part of the
configuration, such as 0 for the first static route.
• <xxx_pattern>: A regular expression or word with wild cards
that matches possible variations, such as *@example.com to
match all email addresses ending in @example.com.
• <xxx_fqdn>: A fully qualified domain name (FQDN), such as
mail.example.com.
• <xxx_email>: An email address, such as
[email protected].
• <xxx_url>: A uniform resource locator (URL) and its associated
protocol and host name prefix, which together form a uniform
resource identifier (URI), such as
http://www.fortinet./com/.
• <xxx_ipv4>: An IPv4 address, such as 192.168.1.99.
• <xxx_v4mask>: A dotted decimal IPv4 netmask, such as
255.255.255.0.
• <xxx_ipv4mask>: A dotted decimal IPv4 address and netmask
separated by a space, such as
192.168.1.99 255.255.255.0.
• <xxx_ipv4/mask>: A dotted decimal IPv4 address and
CIDR-notation netmask separated by a slash, such as such as
192.168.1.99/24.
• <xxx_ipv6>: A colon( : )-delimited hexadecimal IPv6 address,
such as 3f2e:6a8b:78a3:0d82:1725:6a2f:0370:6234.
• <xxx_v6mask>: An IPv6 netmask, such as /96.
• <xxx_ipv6mask>: An IPv6 address and netmask separated by a
space.
• <xxx_str>: A string of characters that is not another data type,
such as P@ssw0rd. Strings containing spaces or special
characters must be surrounded in quotes or use escape
sequences.
• <xxx_int>: An integer number that is not another data type,
such as 15 for the number of minutes.
FortiOS™ Handbook v2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
11
Entering FortiOS configuration data
Table 3: Command syntax notation (Continued)
Convention
Description
Curly braces { }
A word or series of words that is constrained to a set of options
delimited by either vertical bars or spaces.
You must enter at least one of the options, unless the set of options is
surrounded by square brackets [ ].
Options
delimited by
vertical bars |
Mutually exclusive options. For example:
{enable | disable}
indicates that you must enter either enable or disable, but must
not enter both.
Options
delimited by
spaces
Non-mutually exclusive options. For example:
{http https ping snmp ssh telnet}
indicates that you may enter all or a subset of those options, in any
order, in a space-delimited list, such as:
ping https ssh
Note: To change the options, you must re-type the entire list. For
example, to add snmp to the previous example, you would type:
ping https snmp ssh
If the option adds to or subtracts from the existing list of options,
instead of replacing it, or if the list is comma-delimited, the exception
will be noted.
Entering FortiOS configuration data
The configuration of a FortiGate unit is stored as a series of configuration settings in the
FortiOS configuration database. To change the configuration you can use the web-based
manager or CLI to add, delete or change configuration settings. These configuration
changes are stored in the configuration database as they are made.
Individual settings in the configuration database can be text strings, numeric values,
selections from a list of allowed options, or on/off (enable/disable).
Entering text strings (names)
Text strings are used to name entities in the configuration. For example, the name of a
firewall address, administrative user, and so on. You can enter any character in a
FortiGate configuration text string except, to prevent Cross-Site Scripting (XSS)
vulnerabilities, text strings in FortiGate configuration names cannot include the following
characters:
" (double quote), & (ampersand), ' (single quote), < (less than) and < (greater than)
You can determine the limit to the number of characters that are allowed in a text string by
determining how many characters the web-based manager or CLI allows for a given name
field. From the CLI, you can also use the tree command to view the number of
characters that are allowed. For example, firewall address names can contain up to 64
characters. When you add a firewall address to the web-based manager you are limited to
entering 64 characters in the firewall address name field. From the CLI you can do the
following to confirm that the firewall address name field allows 64 characters.
config firewall address
tree
-- [address] --*name (64)
|- subnet
|- type
|- start-ip
|- end-ip
12
FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Registering your Fortinet product
|||||+-
fqdn (256)
cache-ttl (0,86400)
wildcard
comment (64 xss)
associated-interface (16)
color (0,32)
Note that the tree command output also shows the number of characters allowed for other
firewall address name settings. For example, the fully-qualified domain name (fqdn) field
can contain up to 256 characters.
Entering numeric values
Numeric values are used to configure various sizes, rates, numeric addresses, or other
numeric values. For example, a static routing priority of 10, a port number of 8080, or an
IP address of 10.10.10.1. Numeric values can be entered as a series of digits without
spaces or commas (for example, 10 or 64400), in dotted decimal format (for example the
IP address 10.10.10.1) or as in the case of MAC or IPv6 addresses separated by colons
(for example, the MAC address 00:09:0F:B7:37:00). Most numeric values are standard
base-10 numbers, but some fields (again such as MAC addresses) require hexadecimal
numbers.
Most web-based manager numeric value configuration fields limit the number of numeric
digits that you can add or contain extra information to make it easier to add the acceptable
number of digits and to add numbers in the allowed range. CLI help includes information
about allowed numeric value ranges. Both the web-based manager and the CLI prevent
you from entering invalid numbers.
Selecting options from a list
If a configuration field can only contain one of a number of selected options, the
web-based manager and CLI present you a list of acceptable options and you can select
one from the list. No other input is allowed. From the CLI you must spell the selection
name correctly.
Enabling or disabling options
If a configuration field can only be on or off (enabled or disabled) the web-based manager
presents a check box or other control that can only be enabled or disabled. From the CLI
you can set the option to enable or disable.
Registering your Fortinet product
Before you begin configuring and customizing features, take a moment to register your
Fortinet product at the Fortinet Technical Support web site, https://support.fortinet.com.
Many Fortinet customer services, such as firmware updates, technical support, and
FortiGuard Antivirus and other FortiGuard services, require product registration.
For more information, see the Fortinet Knowledge Center article Registration Frequently
Asked Questions.
Fortinet products End User License Agreement
See the Fortinet products End User License Agreement.
FortiOS™ Handbook v2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
13
Training
Training
Fortinet Training Services provides courses that orient you quickly to your new equipment,
and certifications to verify your knowledge level. Fortinet provides a variety of training
programs to serve the needs of our customers and partners world-wide.
To learn about the training services that Fortinet provides, visit the Fortinet Training
Services web site at http://campus.training.fortinet.com, or email [email protected].
Documentation
The Fortinet Technical Documentation web site, http://docs.fortinet.com, provides the
most up-to-date versions of Fortinet publications, as well as additional technical
documentation such as technical notes.
In addition to the Fortinet Technical Documentation web site, you can find Fortinet
technical documentation on the Fortinet Tools and Documentation CD, and on the Fortinet
Knowledge Center.
Fortinet Tools and Documentation CD
Many Fortinet publications are available on the Fortinet Tools and Documentation CD
shipped with your Fortinet product. The documents on this CD are current at shipping
time. For current versions of Fortinet documentation, visit the Fortinet Technical
Documentation web site, http://docs.fortinet.com.
Fortinet Knowledge Base
The Fortinet Knowledge Base provides additional Fortinet technical documentation, such
as troubleshooting and how-to-articles, examples, FAQs, technical notes, a glossary, and
more. Visit the Fortinet Knowledge Base at http://kb.fortinet.com.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this or any Fortinet technical
document to [email protected].
Customer service and technical support
Fortinet Technical Support provides services designed to make sure that your Fortinet
products install quickly, configure easily, and operate reliably in your network.
To learn about the technical support services that Fortinet provides, visit the Fortinet
Technical Support web site at https://support.fortinet.com.
You can dramatically improve the time that it takes to resolve your technical support ticket
by providing your configuration file, a network diagram, and other specific information. For
a list of required information, see the Fortinet Knowledge Base article FortiGate
Troubleshooting Guide - Technical Support Requirements.
14
FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and
monitoring
This section describes the Endpoint NAC feature and how to configure it.
The following topics are included in this section:
•
NAC overview
•
Configuring FortiClient required version and download location
•
Configuring application detection and control
•
Configuring Endpoint profiles
•
Enabling Endpoint NAC in firewall policies
•
Monitoring endpoints
•
Modifying Endpoint NAC replacement pages
•
Example
NAC overview
Network Access Control (NAC) ensures that workstation computers (endpoints) meet
security requirements, otherwise they are not permitted access. Endpoint NAC can
enforce
•
use of FortiClient Endpoint Security
•
use of FortiClient firewall
•
use of FortiClient antivirus protection
•
use of up-to-date FortiClient antivirus signatures
•
installation or running of specific applications
•
absence or non-use of specific applications
Non-compliant endpoints are quarantined. Optionally, endpoints that lack FortiClient
Endpoint Security can be warned instead of quarantined.
Endpoint NAC settings are grouped into one or more Endpoint NAC Profiles. You enable
Endpoint NAC in firewall policies and select a NAC Profile.
User experience
Endpoint NAC applies to users attempting to make a connection that is controlled by a
firewall policy with Endpoint NAC enabled. The user of a non-compliant endpoint using a
web browser receives a replacement message HTML page from the FortiGate unit. For
information about modifying these replacement pages, see “Modifying Endpoint NAC
replacement pages” on page 25.
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
15
NAC overview
Network Access Control and monitoring
Non-compliant user warning
If the Endpoint NAC profile Notify Hosts to Install FortiClient (Warn only) option is enabled,
the user sees a message like this:
Figure 2: Default non-compliant endpoint warning
If there is a FortiClient installer available for the user’s endpoint computer, a link is
provided to download the installer from the location defined in Endpoint > NAC >
FortiClient. If there is no installer available, the user is asked to contact the network
administrator.
The link at the bottom of the page enables the user to continue to the requested web site
without installing FortiClient Endpoint Security.
Non-compliant user quarantine
If the Endpoint NAC profile Quarantine Hosts to User Portal (Enforce compliance) option is
enabled, the user sees a message like this:
Figure 3: Default non-compliant endpoint quarantine
16
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and monitoring
NAC overview
There is a download link for the FortiClient installer, if one is available. The same message
will be displayed for every connection attempt Endpoint NAC is in effect until the user
installs FortiClient Endpoint Security.
Blocked user
If an endpoint has FortiClient Endpoint Security installed but is not compliant with the
Endpoint NAC profile’s Additional Client Options or Application Detection rules, the
FortiGate unit sends a message like this to the user’s browser.
Figure 4: Endpoint blocked message
The user needs to resolve the listed issues and retry the connection.
Configuration overview
Endpoint NAC requires that all hosts using the firewall policy have the FortiClient Endpoint
Security application installed. Make sure that all hosts affected by this policy are able to
install this application. Currently, FortiClient Endpoint Security is available for Microsoft
Windows 2000 and later only.
To set up Endpoint NAC, you need to
•
Enable Central Management by the FortiGuard Analysis & Management Service if you
will use FortiGuard Services to update the FortiClient application or antivirus
signatures. You do not need to enter account information. See “Centralized
Management” in the System Administration chapter of the FortiOS Handbook.
•
Configure the minimum required version of FortiClient and the location from which noncompliant endpoints can download the FortiClient installer. See “Configuring FortiClient
required version and download location” on page 18.
•
Configure application sensors. An application sensor specifies which applications are
required, allowed, or not allowed on endpoints. See “Configuring application sensors”
on page 19.
•
Configure Endpoint profiles which specify the FortiClient enforcement settings and the
application detection list to apply. See “Configuring Endpoint profiles” on page 22.
•
Enable Endpoint in firewall policies, selecting the appropriate Endpoint NAC profile.
Note: You cannot enable Endpoint in firewall policies if Redirect HTTP Challenge to a
Secure Channel (HTTPS) is enabled in User > Authentication.
•
Optionally, modify the inactivity timeout for endpoints. The default is 5 minutes. After
that time period, the FortiGate unit rechecks the endpoint for Endpoint compliance. To
change the timeout, adjust the compliance-timeout value in the config
endpoint-control settings CLI command.
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
17
Configuring FortiClient required version and download location
•
Network Access Control and monitoring
Optionally, modify the Endpoint Download Portal and the Endpoint Recommendation
Portal replacement messages.
Configuring FortiClient required version and download location
The Endpoint NAC feature can set a minimum FortiClient version that endpoints are
required to run. To make this policy easy for users, you can configure a download source
for the FortiClient installer.
Configuring FortiClient requirement and download location - web-based manager
1 Go to Endpoint > NAC > FortiClient.
Figure 5: Configuring FortiClient version requirements and installer source
2 Do one of the following:
• Select FortiGuard Distribution Network. FortiGuard must be configured on the
FortiGate unit.
• Select This FortiGate. Users can download a FortiClient installer file from this
FortiGate unit. This option is available only on FortiGate models that support upload
of FortiClient installer files.
• Select Custom URL. Enter the URL from which users can download the FortiClient
installer.
Note: Select This FortiGate or Custom URL if you want to provide a customized
FortiClient application. This is required if a FortiManager unit will centrally manage
FortiClient applications. For information about customizing the FortiClient application,
see the FortiClient Administration Guide.
18
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and monitoring
Configuring application detection and control
3 Optionally, select Enforce Minimum Version and select the minimum acceptable
version number or Latest Available for the FortiClient Endpoint Security application.
The list contains the FortiClient versions available from the selected FortiClient Installer
Download Location.
Fortinet recommends that administrators wait for a reasonable period of time after
deploying a FortiClient version update before updating the minimum version required
to the most recent version. This gives users some time to install the update.
Configuring FortiClient requirement and download location - CLI
In this example, users are required to have FortiClient version 4.1.3 or later. FortiGuard
provides the FortiClient installer.
config endpoint-control
set enforce minimum-version enable
set version-check minimum
set version 4.1.3
set download-location fortiguard
end
Configuring application detection and control
Network access control (NAC) can allow or deny endpoint access to the network based on
the applications that are installed or running on the endpoint. The Application Sensor
defines the rules for endpoint applications and is selected as part of the Endpoint NAC
profile.
Configuring application sensors
An application sensor is part of an Endpoint NAC profile that you can apply in your firewall
policies. Application detection rules in the sensor detect the application by name and
vendor and test its current status on the endpoint. A rule can test for any of the following
status values:
• Installed — application is installed and may or may not be currently running
• Not Installed — application is not installed
• Running — application is installed and currently running
• Not Running — application is not currently running or is not installed
The rule determines the action to take when the specified application matches the status.
The possible actions are:
• Allow — allow the endpoint to connect.
• Deny — warn or quarantine the endpoint, depending on Endpoint profile settings.
• Monitor — allow the endpoint to connect and include this endpoint’s information in
statistics and logs on the Endpoint Monitor page.
You also choose one of these options as the default action when other unspecified
applications are detected on the endpoint. If you select Deny, endpoints can have only a
specific set of applications installed and are denied access if any other applications are
installed.
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
19
Configuring application detection and control
Network Access Control and monitoring
Application sensor rules are based on application signatures provided by FortiGuard
Services. Create your application detection list entries by selecting applications from
FortiGuard-supplied lists of categories, vendors, and application names. To view
application information from FortiGuard services, go to Endpoint > NAC > Application
Database.
An application sensor rule checks applications against the database from the top down
until it finds a match. Specific entries, such as those that list one particular application,
should precede more general entries, such as those that match all applications of a
particular category.
To create an application sensor - web-based manager
1 Go to Endpoint > NAC > Application Sensor and select Create New.
2 Enter a Name and optionally Comments for the application sensor, then select OK.
The options for the sensor are displayed.
3 In Other Applications, select the action to take if an application is detected that does
not have an entry in this sensor.
4 Select whether to Allow, Deny, or simply Monitor the applications not listed in this
sensor.
If you select Deny, endpoints must have only the applications you specify and are
denied access if any other applications are installed.
If you select Allow or Monitor, endpoints can have any application installed, and are
denied access only if they have an application for which you created a specific Deny
rule.
5 Select Create New.
6 Select the software Vendor and then select the specific Application.
If you select an application Category, the Application list is limited to applications in the
selected category. To see all applications for the selected Vendor, leave Category set
to All Categories.
7 Select the Status and Action, depending on the type of rule you are creating:
Application detection rule
Status
Action
Application must be installed and running
Not Running
Deny
Application must be installed
Not Installed
Deny
Monitor endpoint with this application running
Running
Monitor
Monitor endpoint with this application installed
Installed
Monitor
Application must not be running
Running
Deny
Application must not be installed
Installed
Deny
Application is allowed
(not required if Other Application is Allow)
any
Allow
8 Select OK.
9 To create additional rules for this sensor, repeat steps 5 through 8.
10 Select OK.
To create an application sensor - CLI
This example creates an application sensor that denies access to endpoints with peer-topeer file sharing applications installed. All other applications are allowed.
20
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and monitoring
Configuring application detection and control
config endpoint-control app-detect rule-list
edit "sensor1"
set other-application-action allow
config entries
edit 1
set application 0
set category 15
set vendor 0
set status installed
set action deny
end
end
Viewing the application database
You can view the application list provided by FortiGuard Services. Go to Endpoint > NAC >
Application Database.
Figure 6: Endpoint NAC Predefined application list
The list contains the following information. You can select the name of any column to sort
the data by that field. You can also create filters on each column.
Application Database page
Lists all the applications that are provided by FortiGuard Services
Category
The type of application. Example: Document Viewers
Name
The name of the application.
Vendor
The vendor that the application is associated with. For example, the
Adobe Reader is associated with the vendor, Adobe Systems
Incorporated.
ID
Unique application ID.
Group
Another categorization of the applications. Groups are not used in
application sensor rules.
Page controls
Shows the current page number in the list. Select the left and right
arrows to display the first, previous, next or last page of known
endpoints.
[Total Signatures:
<number>]
The total number of application signatures currently in the database.
Column Settings
Select the columns to display in the list. You can also determine the
order in which they appear.
Clear All Filters
Clear any column display filters you might have applied.
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
21
Configuring Endpoint profiles
Network Access Control and monitoring
Configuring Endpoint profiles
An Endpoint profile contains FortiClient enforcement settings and can specify an
application detection list. Firewall policies can apply an Endpoint profile to the traffic they
handle.
To create an endpoint profile
1 Go to Endpoint > NAC > Profile and select Create New.
Figure 7: Creating Endpoint NAC profiles
2 Enter a Name for the profile.
3 Choose what to do when users do not have the required version of FortiClient Endpoint
Security installed:
• Notify Hosts to Install FortiClient (Warn only)
• Quarantine Hosts to User Portal (Enforce compliance)
4 Optionally enable Additional Client Options and any of the following options:
• Anti-virus Enabled — the FortiClient antivirus feature must be enabled
• Anti-virus Up-to-date — the FortiClient antivirus signatures must be up-to-date
• Firewall enabled — the FortiClient firewall must not be set to Pass All
5 Optionally, Enable Application Detection and select the Application Detection List.
Endpoints will be allowed or blocked based on the selected application sensor.
6 Select OK.
To configure the endpoint profile - CLI
In the CLI only, there is an option require-license that requires the user’s copy of
FortiClient Endpoint Security to be licensed. In this example, the license is not required.
22
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and monitoring
Enabling Endpoint NAC in firewall policies
config endpoint-control profile
edit "our_profile"
set application-detection enable
set application-detection-rule-list "sensor1"
set feature-enforcement enable
set recommendation-disclaimer disable
set require-av disable
set require-firewall enable
set require-license disable
set require-webfilter disable
end
Enabling Endpoint NAC in firewall policies
Endpoint NAC is applied to any traffic where the controlling firewall policy has Endpoint
NAC enabled. The selected Endpoint NAC profile determines the conditions that govern
network access.
You can also enable Endpoint NAC in identity-based firewall policies. Users must
authenticate and their computers must meet the requirements of the Endpoint NAC profile.
To enable Endpoint NAC - web-based manager
1 Go to Firewall > Policy > Policy and edit the firewall policy where you want to enable
Endpoint NAC.
2 Select Enable Endpoint NAC and select the Endpoint NAC profile.
Figure 8: Enabling Endpoint NAC in a firewall policy
3 Select OK.
To configure the firewall policy - CLI
In this example, the LAN connects to Port 2 and the Internet is connected to Port 1. An
Endpoint NAC profile is applied.
config firewall policy
edit 0
set srcintf port2
set dstintf port1
set srcaddr LANusers
set dstaddr all
set action accept
set schedule "always"
set service "ANY"
set nat enable
set endpoint-check enable
set endpoint-profile "our_profile"
end
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
23
Monitoring endpoints
Network Access Control and monitoring
Monitoring endpoints
To view the list of known endpoints, go to Endpoint > Monitor > Endpoint Monitor. You can
view compliant and non-compliant endpoints. By default, both are shown. An endpoint is
added to the list when it uses a firewall policy that has Endpoint NAC enabled.
Once an endpoint is added to the list, it remains there until the FortiGate unit restarts.
Every time an endpoint accesses (or attempts to access) network services through the
FortiGate unit the entry for the endpoint is updated.
The endpoints list can provide an inventory of the endpoints on your network. Entries for
endpoints not running the FortiClient application include the IP address, last update time,
and traffic volume/attempts. The “non-compliant” status indicates the endpoint is not
running the FortiClient application.
Entries for endpoints running the FortiClient application show much more information,
depending on what is available for the FortiClient application to gather. Detailed
information you can view includes endpoint hardware (CPU and model name) and the
software running on the endpoints. You can adjust column settings and filters to display
this information in many different forms.
From the endpoints list, you can view information for each endpoint, temporarily exempt
blocked endpoints, and restore exempted end points to their blocked state.
Figure 9: Endpoint Monitor (showing one endpoint without FortiClient software installed)
Refresh
Non-Compliant
Non-Compliant
But Temporarily
Exempted
24
View
Exempt Temporarily
Restore to
Blocked State
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and monitoring
Modifying Endpoint NAC replacement pages
Viewing details about the endpoint
Select the View icon to see more information about the endpoint.
Figure 10: Viewing details about an endpoint
Modifying Endpoint NAC replacement pages
The FortiGate unit sends one of the following HTML pages to non-compliant users who
attempt to use a firewall policy in which Endpoint NAC is enabled:
•
Endpoint NAC Download Portal — The FortiGate unit sends this page if the Endpoint
NAC profile has the Quarantine Hosts to User Portal (Enforce compliance) option
selected. The user can download the FortiClient Endpoint Security application installer.
If you modify this replacement message, be sure to retain the %%LINK%% tag which
provides the download URL for the FortiClient installer.
•
Endpoint NAC Recommendation Portal — The FortiGate unit sends this page if the
Endpoint NAC profile has the Notify Hosts to Install FortiClient (Warn only) option
selected. The user can either download the FortiClient Endpoint Security application
installer or select the Continue to link to access their desired destination. If you modify
this replacement message, be sure to retain both the %%LINK%% tag which provides
the download URL for the FortiClient installer and the %%DST_ADDR%% link that
contains the URL that the user requested.
To modify these messages in the web-based manager, go to System > Config >
Replacement Message. Expand Endpoint NAC and select the Edit icon of the message
that you want to modify.
You can also modify these messages in the CLI.
•
Download portal:
config system replacemsg ec endpt-download-portal
•
Recommendation portal:
config system replacemsg ec endpt-recommendation-portal
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
25
Example
Network Access Control and monitoring
Example
The Example company has the following requirements for employee computers:
•
must run FortiClient Endpoint Security version 4.1.3 with firewall enabled
•
must have OpenOffice 3.1 installed
•
cannot have any peer-to-peer file sharing applications installed
•
must not have any games running
•
all other applications are allowed
Configuring FortiClient download source and required version
FortiGuard Services will provide the FortiClient installer.
To configure FortiClient requirements - web-based manager
1 Go to Endpoint > NAC > FortiClient.
2 Check that FortiGuard Availability shows a green checkmark icon.
If you see a red ‘X’ icon, check your FortiGuard configuration.
3 Under FortiGuard Installer Download Location, select FortiGuard Distribution Network.
4 Select Enforce Minimum Version and then select 4.1.3 from the list.
5 Select Apply.
To configure FortiClient requirements - CLI
config endpoint-control settings
set download-location fortiguard
set version-check minimum
set enforce-minimum-version enable
set version 4.1.3
set compliance-timeout 5
end
Configuring an application sensor
Create sensors for OpenOffice, P2P applications, and games.
To configure the application sensor - web-based manager
1 Go to Endpoint > NAC > Application Sensor.
2 Select Create New, enter a Name for the sensor, and then select OK.
3 In Other Applications (not specified below), select Allow.
4 Select Create New, enter the following information, and then select OK:
This creates a rule requiring OpenOffice 3.1.
26
Category
All Categories
Vendor
OpenOffice.org
Application
OpenOffice.org 3.1
Status
Not Installed
Action
Deny
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and monitoring
Example
5 Select Create New, enter the following information, and then select OK:
This creates a rule denying users with P2P applications installed.
Category
P2P File Sharing
Vendor
All Vendors
Application
All Applications
Status
Installed
Action
Deny
6 Select Create New, enter the following information, and then select OK:
This creates a rule denying users with games applications running.
Category
Games
Vendor
All Vendors
Application
All Applications
Status
Running
Action
Deny
7 Optionally enter a descriptive Comment.
8 Select OK.
To configure the application sensor - CLI
The three application detection entries are entered in the same order as for the webbased manager, above. To find codes, use the ‘?’. For example, set vendor ? lists the
vendor codes.
config endpoint-control app-detect rule-list
edit "apprules1"
set other-application-action allow
config entries
edit 1
set application 1141
set category 0
set vendor 64
set status not-installed
set action deny
next
edit 2
set application 0
set category 15
set vendor 0
set status installed
set action deny
next
edit 3
set application 0
set category 20
set vendor 0
set status running
set action deny
end
end
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
27
Example
Network Access Control and monitoring
Configuring an endpoint profile
Configure user quarantine, require users to have firewall protection, and apply the
application detection list you created earlier.
To configure the endpoint profile - web-based manager
1 Go to Endpoint > NAC > Profile and select Create New.
2 Enter a Name for the profile.
3 Select Quarantine Hosts to User Portal (Enforce compliance).
4 Enable Additional Client Options, then enable Firewall Enabled.
5 Select Enable Application Detection and then select the Application Detection List that
you configured earlier.
6 Select OK.
To configure the endpoint profile - CLI
config endpoint-control profile
edit "our_profile"
set application-detection enable
set application-detection-rule-list "apprules1"
set feature-enforcement enable
set recommendation-disclaimer disable
set require-av disable
set require-firewall enable
set require-license disable
set require-webfilter disable
end
Configuring the firewall policy
The firewall policy enables access to the Internet, but requires hosts to meet the Endpoint
NAC requirements configured in the Endpoint NAC profile that you configured earlier.
To configure the firewall policy - web-based manager
1 Go to Firewall Policy and select Create New.
2 Enter the following information and select OK:
28
Source Interface/Zone
Select the interface which connects to the LAN.
Source Address
Select the LAN address range.
Destination Interface/Zone
Select the interface which connects to the Internet.
Destination Address
All
Schedule
as required
Service
ANY
Action
ACCEPT
NAT
Enable NAT
Enable Endpoint NAC
Select the Endpoint NAC profile that you configured
earlier.
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Access Control and monitoring
Example
To configure the firewall policy - CLI
In this example, the LAN connects to Port 2 and the Internet is connected to Port 1.
config firewall policy
edit 0
set srcintf port2
set dstintf port1
set srcaddr LANusers
set dstaddr all
set action accept
set schedule "always"
set service "ANY"
set nat enable
set endpoint-check enable
set endpoint-profile "our_profile"
end
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
29
Example
30
Network Access Control and monitoring
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Vulnerability Scan
The Network Vulnerability Scan helps you to protect your network assets (servers and
workstations) by scanning them for security weaknesses. You can scan on-demand or on
a scheduled basis. Results are viewable on the FortiGate unit, but results are also sent to
an attached FortiAnalyzer unit. The FortiAnalyzer unit can collect the results of
vulnerability scans from multiple FortiGate units at different locations on your network,
compiling a comprehensive report about network security.
This section describes how to configure a single FortiGate unit for network scanning and
how to view the results of the scan.
Note: Some of the web-based manager configuration described in this document is not
available in the initial release of FortiOS v4.0 MR2. Use the CLI commands instead.
The following topics are included in this section:
•
Overview
•
Selecting assets to scan
•
Configuring scans
•
Viewing scan results
Overview
Network vulnerability scanning has three main parts:
•
Select the assets to scan
•
Schedule scans or initiate them manually
•
View the scan results
Selecting assets to scan
An asset is a server or workstation computer on your network. You can specify assets
individually, but it is easier to use the network vulnerability scan feature’s asset discovery
function. The discovery function searches a specified IP address range and populates the
asset list. You then select the assets to include in network vulnerability scans.
Asset discovery scans the following ports:
•
TCP: 21-23, 25, 53, 80, 88,110-111, 135, 139, 443, 445
•
UDP: 53, 111, 135, 137, 161, 500
Discovering assets
The simplest way to build the Asset list is to perform a discovery scan on the range of IP
addresses where your network assets are installed.
To discover assets - web-based manager
1 Go to Endpoint > Network Vulnerability Scan > Asset and select Create New.
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
31
Selecting assets to scan
Network Vulnerability Scan
2 Enter a Name for this scan.
3 In Type, select Range and then enter the IP address Range to scan.
4 In Scan Type, select Asset Discovery Only.
5 Select OK.
This creates an entry in the Asset list.
6 Select the Enable check box for the asset that you just created and then select
Discover Assets.
Above the table header, on the top right, the status of the current scan is shown.
Depending on the number of computers to be discovered, the scan can take several
minutes, until the web-based manager reports “Scan completed.” The number of
assets discovered is listed to the left of the Discover Assets button.
7 Select Assets Found and then select Import.
The discovered assets are added to the Asset list. By default, all are enabled for
scanning.
8 Unless you want to discover assets on every scan, clear the Enable check box for this
Asset discovery only asset.
You might want to add authentication credentials to some of your assets. To edit an entry
in the Asset list, select its check box (at the left side of the list) and then select Edit. For
more information about individual asset settings, see “Adding assets manually”, below.
To discover assets - CLI
This example discovers assets in the range 10.11.101.10 to 10.11.101.200.
1 First configure the asset range to scan:
config netscan assets
edit 0
set name "office_discovery"
set addr-type range
set start-ip 10.11.101.10
set end-ip 10.11.101.200
set mode discovery
set status enable
end
2 Execute the discovery scan:
execute netscan start discover
3 Check the status of the discovery scan:
execute netscan status
Repeat periodically until status is “scan complete”.
4 Optionally, view a list of the discovered assets:
execute netscan list
5 Add the discovered assets to the asset list:
execute netscan import
32
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Vulnerability Scan
Selecting assets to scan
Adding assets manually
There is no need to perform a discovery scan if you know the IP address of the computer
that you want to scan, or you know that you want to scan all of the computers in a
particular IP address range.
If you create an asset with an IP address range, any authentication credentials you enter
will apply to all devices in the range. If this is not appropriate, you need to create individual
entries for each computer instead.
To add an asset - web-based manager
1 Go to Endpoint > Network Vulnerability Scan > Asset and select Create New.
2 Enter the following information and select OK:
Name
Enter a name for this asset.
Type
Select Host to configure a single IP address.
Select Range to configure a range of IP addresses to scan.
IP Address
Enter the IP address of the asset. (Type is Host.)
Range
Enter the start and end of the IP address range. (Type is Range.)
Scan Type
Select Vulnerability Scan.
Windows Authentication Select to use authentication on a Windows operating system.
Enter the username and password in the fields provided.
Unix Authentication
Select to use authentication on a Unix operating system.
Enter the username and password in the fields provided.
To add an asset - CLI
This example adds a single computer to the Asset list:
config netscan assets
edit 0
set name "server1"
set addr-type ip
set start-ip 10.11.101.20
set mode scan
set auth-windows enable
set win-username admin
set win-password zxcvbnm
set status enable
end
This example adds an address range to the Asset list. Authentication is not used:
config netscan assets
edit 0
set name "fileservers"
set addr-type range
set start-ip 10.11.101.160
set end-ip 10.11.101.170
set mode scan
set status enable
end
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
33
Configuring scans
Network Vulnerability Scan
Configuring scans
You can configure regular network scans on a daily, weekly, or monthly basis. There are
three scan modes. Full scan checks every TCP and UDP port and takes the most time.
Standard scan checks the ports used by most known applications. Quick scan checks only
the most commonly used ports. For a detailed list of the TCP and UDP ports examined by
each scan mode, see Table 4 on page 34. Also, the get netscan settings CLI
command lists the TCP and UDP ports scanned in the current scan mode. See the
tcp-ports and udp-ports fields.
You can also initiate the configured scan manually.
Table 4: Ports scanned in each scan mode
Standard TCP: 1-3, 5, 7, 9, 11, 13, 15, 17-25, 27, 29, 31, 33, 35, 37-39, 41-223, 242-246, 256265, 280-282, 309, 311, 318, 322-325, 344-351, 363, 369-581, 587, 592-593, 598, 600,
Scan
606-620, 624, 627, 631, 633-637, 666-674, 700, 704-705, 707, 709-711, 729-731, 740742, 744, 747-754, 758-765, 767, 769-777, 780-783, 786, 799-801, 860, 873, 886-888,
900-901, 911, 950, 954-955, 990-993, 995-1001, 1008, 1010-1011, 1015, 1023-1100,
1109-1112, 1114, 1123, 1155, 1167, 1170, 1207, 1212, 1214, 1220-1222, 1234-1236,
1241, 1243, 1245, 1248, 1269, 1313-1314, 1337, 1344-1625, 1636-1774, 1776-1815,
1818-1824, 1901-1909, 1911-1920, 1944-1951, 1973, 1981, 1985-2028, 2030, 20322036, 2038, 2040-2049, 2053, 2065, 2067, 2080, 2097, 2100, 2102-2107, 2109, 2111,
2115, 2120, 2140, 2160-2161, 2201-2202, 2213, 2221-2223, 2232-2239, 2241, 2260,
2279-2288, 2297, 2301, 2307, 2334, 2339, 2345, 2381, 2389, 2391, 2393-2394, 2399,
2401, 2433, 2447, 2500-2501, 2532, 2544, 2564-2565, 2583, 2592, 2600-2605, 26262627, 2638-2639, 2690, 2700, 2716, 2766, 2784-2789, 2801, 2908-2912, 2953-2954,
2998, 3000-3002, 3006-3007, 3010-3011, 3020, 3047-3049, 3080, 3127-3128, 31413145, 3180-3181, 3205, 3232, 3260, 3264, 3267-3269, 3279, 3306, 3322-3325, 3333,
3340, 3351-3352, 3355, 3372, 3389, 3421, 3454-3457, 3689-3690, 3700, 3791, 3900,
3984-3986, 4000-4002, 4008-4009, 4080, 4092, 4100, 4103, 4105, 4107, 4132-4134,
4144, 4242, 4321, 4333, 4343, 4443-4454, 4500-4501, 4567, 4590, 4626, 4651, 46604663, 4672, 4899, 4903, 4950, 5000-5005, 5009-5011, 5020-5021, 5031, 5050, 5053,
5080, 5100-5101, 5145, 5150, 5190-5193, 5222, 5236, 5300-5305, 5321, 5400-5402,
5432, 5510, 5520-5521, 5530, 5540, 5550, 5554-5558, 5569, 5599-5601, 5631-5632,
5634, 5678-5679, 5713-5717, 5729, 5742, 5745, 5755, 5757, 5766-5767, 5800-5802,
5900-5902, 5977-5979, 5997-6053, 6080, 6103, 6110-6112, 6123, 6129, 6141-6149,
6253, 6346, 6387, 6389, 6400, 6455-6456, 6499-6500, 6515, 6558, 6588, 6660-6670,
6672-6673, 6699, 6767, 6771, 6776, 6831, 6883, 6912, 6939, 6969-6970, 7000-7021,
7070, 7080, 7099-7100, 7121, 7161, 7174, 7200-7201, 7300-7301, 7306-7308, 7395,
7426-7431, 7491, 7511, 7777-7778, 7781, 7789, 7895, 7938, 7999-8020, 8023, 8032,
8039, 8080-8082, 8090, 8100, 8181, 8192, 8200, 8383, 8403, 8443, 8450, 8484, 8732,
8765, 8886-8894, 8910, 9000-9001, 9005, 9043, 9080, 9090, 9098-9100, 9400, 9443,
9535, 9872-9876, 9878, 9889, 9989-10000, 10005, 10007, 10080-10082, 10101, 10520,
10607, 10666, 11000, 11004, 11223, 12076, 12223, 12345-12346, 12361-12362, 12456,
12468-12469, 12631, 12701, 12753, 13000, 13333, 14237-14238, 15858, 16384,
16660, 16959, 16969, 17007, 17300, 18000, 18181-18186, 18190-18192, 18194,
18209-18210, 18231-18232, 18264, 19541, 20000-20001, 20011, 20034, 20200, 20203,
20331, 21544, 21554, 21845-21849, 22222, 22273, 22289, 22305, 22321, 22555,
22800, 22951, 23456, 23476-23477, 25000-25009, 25252, 25793, 25867, 26000,
26208, 26274, 27000-27009, 27374, 27665, 29369, 29891, 30029, 30100-30102,
30129, 30303, 30999, 31336-31337, 31339, 31554, 31666, 31785, 31787-31788,
32000, 32768-32790, 33333, 33567-33568, 33911, 34324, 37651, 40412, 40421-40423,
42424, 44337, 47557, 47806, 47808, 49400, 50505, 50766, 51102, 51107, 51112,
53001, 54321, 57341, 60008, 61439, 61466, 65000, 65301, 65512
UDP: 7, 9, 13, 17, 19, 21, 37, 53, 67-69, 98, 111, 121, 123, 135, 137-138, 161, 177, 371,
389, 407, 445, 456, 464, 500, 512, 514, 517-518, 520, 555, 635, 666, 858, 1001, 10101011, 1015, 1024-1049, 1051-1055, 1170, 1243, 1245, 1434, 1492, 1600, 1604, 1645,
1701, 1807, 1812, 1900, 1978, 1981, 1999, 2001-2002, 2023, 2049, 2115, 2140, 2801,
3024, 3129, 3150, 3283, 3527, 3700, 3801, 4000, 4092, 4156, 4569, 4590, 4781, 50005001, 5036, 5060, 5321, 5400-5402, 5503, 5569, 5632, 5742, 6073, 6502, 6670, 6771,
6912, 6969, 7000, 7300-7301, 7306-7308, 7778, 7789, 7938, 9872-9875, 9989, 10067,
10167, 11000, 11223, 12223, 12345-12346, 12361-12362, 15253, 15345, 16969, 20001,
20034, 21544, 22222, 23456, 26274, 27444, 30029, 31335, 31337-31339, 31666,
31785, 31789, 31791-31792, 32771, 33333, 34324, 40412, 40421-40423, 40426,
47262, 50505, 50766, 51100-51101, 51109, 53001, 61466, 65000
34
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Vulnerability Scan
Configuring scans
Full Scan All TCP and UDP ports (1-65535)
Quick
Scan
TCP: 11, 13, 15, 17, 19-23, 25, 37, 42, 53, 66, 69-70, 79-81, 88, 98, 109-111, 113, 118119, 123, 135, 139, 143, 220, 256-259, 264, 371, 389, 411, 443, 445, 464-465, 512-515,
523-524, 540, 548, 554, 563, 580, 593, 636, 749-751, 873, 900-901, 990, 992-993, 995,
1080, 1114, 1214, 1234, 1352, 1433, 1494, 1508, 1521, 1720, 1723, 1755, 1801, 20002001, 2003, 2049, 2301, 2401, 2447, 2690, 2766, 3128, 3268-3269, 3306, 3372, 3389,
4100, 4443-4444, 4661-4662, 5000, 5432, 5555-5556, 5631-5632, 5634, 5800-5802,
5900-5901, 6000, 6112, 6346, 6387, 6666-6667, 6699, 7007, 7100, 7161, 7777-7778,
8000-8001, 8010, 8080-8081, 8100, 8888, 8910, 9100, 10000, 12345-12346, 20034,
21554, 32000, 32768-32790
UDP: 7, 13, 17, 19, 37, 53, 67-69, 111, 123, 135, 137, 161, 177, 407, 464, 500, 517-518,
520, 1434, 1645, 1701, 1812, 2049, 3527, 4569, 4665, 5036, 5060, 5632, 6502, 7778,
15345
To configure scanning - web-based manager
1 Go to Endpoint > Network Vulnerability Scan > Scan.
2 Enter the following information and select Apply.
Scan Mode
Quick — check only the most commonly used ports
Standard — check the ports used by most known applications
Full — check all TCP and UDP ports
For a detailed list of the TCP and UDP ports examined by each scan
mode, see Table 4 on page 34.
Schedule
Manually – perform scan on request only
Schedule – use the following fields to configure a schedule
Recurrence
Select Daily, Weekly, or Monthly.
If you select Weekly, the Day of Week drop-down list appears. If you
select Monthly, the Day of Month drop-down list appears.
Time
Select the time of day to start the scan, in the format HH:MM.
Day of Week
For a weekly scan, select the day of the week.
Day of Month
For a monthly scan, select the day of the month.
To configure scanning - CLI
To configure, for example, a standard scan to be performed every Sunday at 2:00am, you
would enter:
config netscan settings
set scan-mode standard
set schedule enable
set time 02:00
set recurrence weekly
set day-of-week sunday
end
To perform a vulnerability scan manually - web-based manager
1 Go to Endpoint > Network Vulnerability Scan > Asset.
2 Select the Enable check box for each asset you want to scan.
3 Select Start Scan.
Above the table header, on the top right, the status of the current scan is shown.
Depending on the number of computers to be discovered, the scan can take several
minutes, until the web-based manager reports “Scan completed.”
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
35
Viewing scan results
Network Vulnerability Scan
To perform a vulnerability scan manually - CLI
You must have some assets configured with mode set to scan.
1 Execute the discovery scan:
execute netscan start scan
2 Check the status of the discovery scan:
execute netscan status
Repeat periodically until status is “scan complete”.
Viewing scan results
The results of network scanning are available as summary graphs and log entries.
Viewing scan logs
To view network scan logs, go to Log&Report > Log Access > Network Scan.
Figure 11: Network scan logs
Select any log entry to view log details.
36
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Network Vulnerability Scan
Viewing scan results
Figure 12: Network scan log details
Viewing Executive Summary graphs
To view summary graphs, go to Log&Report > Report Access > Executive Summary. You
might need to add the following widgets to the page to view the summaries you require.
Table 5: Executive summary widgets for network scan
Chart
Widget name
Vulnerabilities by Category
vulner-by-category-last24h
Vulnerabilities by Severity
vulner-by-severity-last24h
Top Vulnerable Operating Systems Detected
top-vulner-os-last24h
Top Vulnerable Services Detected
top-vulner-service-last24h
Top Vulnerable TCP Services Detected
top-vulner-tcp-service-last24h
Top Vulnerable UDP Services Detected
top-vulner-udp-service-last24h
Creating reports
You can use the FortiGate unit’s Log&Report features to generate reports on the results of
network vulnerability scanning.
To create a report of scanning results
1 Go to Log&Report > Report Config > Layout and select Create New.
2 Enter a Name for the report.
3 Optionally select a Report Theme.
4 Enter a Title to appear on the report.
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
37
Viewing scan results
Network Vulnerability Scan
5 Choose each Option and Output Format that you require.
6 If you want to have the report generated on a regular basis, create a Schedule.
7 Select the Report Components.
The components are listed in order below the Report Components heading. For a
network vulnerability scan report, you will need to select Chart components from the
Vulnerability category. The following vulnerability charts are available:
Table 6: Executive summary widgets for network scan
Chart
Component name
Vulnerabilities by Category
vulner-by-category-last24h
Vulnerabilities by Severity
vulner-by-severity-last24h
Top Vulnerable Operating Systems Detected
top-vulner-os-last24h
Top Vulnerable Services Detected
top-vulner-service-last24h
Top Vulnerable TCP Services Detected
top-vulner-tcp-service-last24h
Top Vulnerable UDP Services Detected
top-vulner-udp-service-last24h
8 Optionally select other components, such as headings and text.
9 Select OK.
The report will be generated at the scheduled time.
To generate a report manually
1 Go to Log&Report > Report Config > Layout.
2 Select the required report.
3 Select Run.
Viewing reports
Go to Log&Report > Report Access > Disk to view generated reports.
Figure 13: List of reports
If HTML output was enabled, you can select the Report File name to view the report in a
separate browser window.
If PDF output was enabled, you can select the link in the Other Formats column to view
the report.
38
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
Index
A
F
application
database, viewing, 19, 21
detection, 19
sensor, 19
assets
adding manually, 33
discovering, 31
selecting to scan, 31
FAQ, 14
firewall policies
and Endpoint NAC, 23
FortiClient
download location, 18
required version, 18
FortiGate documentation
commenting on, 14
FortiGuard
Antispam, 5
Antivirus, 5, 13
as source of antivirus signatures, 17
as source of application signatures, 17
as source of FortiClient installer, 17
services, 13
Fortinet
Knowledge Center, 14
Technical Documentation, 14
Technical Documentation, conventions, 6
Technical Support, 14
Technical Support, registering with, 13
Technical Support, web site, 13
Training Services, 14
Fortinet customer service, 14
Fortinet documentation, 14
Fortinet Knowledge Center, 14
B
blocking of users
Endpoint NAC, 17
C
certification, 14
CLI syntax conventions, 10
comments, documentation, 14
conventions, 6
Cross-Site Scripting
protection from, 12
customer service, 14
D
default
password, 5
document conventions
CLI syntax, 10
documentation, 14
commenting on, 14
conventions, 6
Fortinet, 14
G
glossary, 14
H
how-to, 14
E
I
endpoint
viewing information, 25
Endpoint NAC
blocked users, 17
modifying download portal, 25
modifying recommendation portal, 25
modifying replacement pages, 25
monitoring endpoints, 24
endpoint profiles, 22
endpoints
monitoring, 24
example
Endpoint NAC configuration, 26
introduction
Fortinet documentation, 14
IP address
private network, 6
K
Knowledge Center, 14
M
mode
operation, 5
O
operation mode, 5
FortiOS™ Handbook v2: Endpoint
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback
39
Index
P
Training Services, 14
password
administrator, 5
product registration, 13
profiles
endpoint, 22
V
registering
with Fortinet Technical Support, 13
reports, vulnerability scans
creating, 37
viewing, 38
RFC
1918, 6
vulnerability
Cross-Site Scripting, 12
XSS, 12
vulnerability scan
adding assets manually, 33
configuring scans, 34
creating reports, 37
discovering assets, 31
selecting assets to scan, 31
viewing executive summary graphs, 37
viewing reports, 38
viewing results, 34, 36
viewing scan logs, 36
T
W
technical
documentation, 14
documentation conventions, 6
notes, 14
support, 14
technical support, 14
warning to install FortiClient, 16
R
40
X
XSS vulnerability
protection from, 12
Endpoint for FortiOS 4.0 MR2
01-420-122871-20101020
http://docs.fortinet.com/ • Feedback