DOCSEARCHbyAlgolia
Submit Docs

FortiGate Support Documentation

website·Indexed 33 days ago

https://support.fortinet.com.cn

Technical documentation and troubleshooting guides for FortiGate, covering FortiOS 7.X.X and 8.0.0. Includes configuration and management of IPSec and SSL VPN, SD-WAN, VDOM, routing (OSPF, BGP), UTM features (Web and DNS filtering, Application Control), FortiLink, and cloud deployments on AWS and Aliyun.

Tokens
406.9K
Snippets
1.7K
Records
2.5K
Agent score
57%

What's inside FortiGate

  1. Overview of FortiGate Chinese Reference Manual (一本通)

    The FortiGate Chinese Reference Manual (一本通) is a one-stop reference and learning guide focusing on FortiGate functional features, configuration techniques, and typical use cases. It covers key operational areas including System Management, Network Management, FortiLink, VDOM, HA (High Availability), Routing, IPv6, Policies and Objects, UTM, VPN, User Authentication, Cloud Deployment, Security Fabric, Logging, FAQs, Troubleshooting, and Daily Maintenance.

  2. Overview of the FortiGate Chinese Comprehensive Manual

    The 《FortiGate 中文一本通》 is a systematic Chinese manual for FortiOS 7 series (including versions 7.0, 7.2, 7.4, and 7.6), maintained by the Fortinet TAC team. It covers a wide range of scenarios from basic configuration to complex enterprise architectures, including: system management, network configuration, VDOM architecture, HA (High Availability), routing, UTM, security policies, VPN, user authentication, cloud deployment, Security Fabric, log analysis, and troubleshooting.

  3. Overview of FortiManager Centralized Management

    FortiManager is a unified management platform for FortiGate devices designed to reduce initial deployment and operational costs in large-scale environments. It provides a single console to manage multiple firewalls, ensuring compliance through centralized CLI script distribution and automating configuration backups and policy module maintenance.

  4. Overview of Local-out Traffic Control

    Local-out traffic refers to traffic originating from the FortiGate device and destined for external addresses, such as Syslog, FortiAnalyzer logs, FortiGuard services, and remote authentication. By default, this traffic follows the routing table. However, if multiple interfaces are available via load balancing and only one is viable for the destination, manual interface selection or SD-WAN rules can be used to ensure connectivity.

    VDOM Configuration Note:

    • Security Fabric (External Resources), Logging (FortiAnalyzer/Syslog), and System services (DNS/FortiGuard) must be configured in the Global view if multi-VDOM is enabled.
    • Remote authentication servers (LDAP, TACACS+, Radius) must be configured in the VDOM view.

  5. Overview of Software Signature Enhancement in FortiOS

    Software Signature Enhancement is a security feature introduced in FortiOS 7 (effective from versions 6.4.13, 7.0.12, 7.2.5, 7.4.0, and 7.6.0). It implements BIOS-level signing and file integrity checks for critical system files and executables. The feature consists of three main modules:

    1. Boot Protection: Verifies the signature of the firmware and AV/IPS engines during boot.
    2. System Security Assurance: Detects attempts to tamper with the file system or files, triggering an immediate device reboot and generating event logs.
    3. Periodic System Checks: Every 6 hours, the system verifies process names, permissions, and signatures. Anomalies trigger a device reboot and event logs.

  6. Overview of the Policy Match tool

    The Policy Match tool is used to query which firewall policy traffic is likely to match based on parameters such as the ingress interface, protocol, source/destination addresses, and ports. It is particularly useful for locating candidate policies when multiple similar policies exist or for verifying identity-based policies and Web Filter matching results. Note that this tool performs a query based on current configuration and does not create a real session; actual traffic may still be affected by routing, VIP/NAT, policy order, user authentication status, and the session table.

  7. Overview of XAuth for IKEv1 IPSec VPN

    Extended Authentication (XAuth) adds a username and password authentication step after the IKEv1 Phase 1 negotiation is complete. It is primarily used for dial-up IPSec VPNs and supports local user groups, RADIUS, or LDAP servers for verification.

    Critical Constraints:

    • XAuth is only compatible with IKEv1. For IKEv2, use EAP for user authentication.
    • XAuth must be enabled on both ends of the tunnel; if one end is enabled and the other is not, the tunnel will fail to establish, and logs may not explicitly state the XAuth mismatch.

  8. Overview of Intrusion Prevention System (IPS)

    The Intrusion Prevention System (IPS) identifies and actively blocks malicious traffic from entering a corporate network. It uses a signature database to detect vulnerabilities and exploit programs within the traffic. When a threat is detected, the system takes action based on the defined security defense policy, such as blocking access.

  9. Overview of DNS Session Helper

    The DNS Session Helper monitors DNS traffic forwarded by the FortiGate to passively learn hostnames and A/AAAA records from DNS responses. This information is stored in two types of caches:

    1. Hostname Cache: Maps IP addresses to domain names. This reduces active queries for the DNS Proxy and provides association data for logs and network visibility features.
    2. FQDN Address Object Cache: Stores IP addresses resolved or learned for FQDN address objects. While standard FQDN objects use active queries, wildcard FQDN objects rely on the Session Helper to learn IPs from passing DNS responses.

    FortiOS provides two helpers:

    • dns-udp: Listens on UDP port 53 (Enabled by default).
    • dns-tcp: Listens on TCP port 53 (Disabled by default).

  10. Overview of FortiGate Threat Feed types and usage

    Threat Feeds are dynamic lists used in FortiGate security policies and filters. They support the following types:

    • IP Addresses: IPv4/IPv6, ranges, and subnets. Used in firewall policies, proxy policies, Local-in policies, ZTNA rules, and as external IP blocklists in DNS Filters.
    • Domains: Used in DNS Filter profiles under 'Remote Categories' to block or monitor specific domains.
    • MAC Addresses: Individual addresses, MAC OUI, or ranges. Used as sources in firewall/proxy/ZTNA policies, or as source/destination in transparent mode or Virtual Wire Pair (VWP) policies.
    • FortiGuard Classifications: Used for remote classifications in WebFilter.
    • Malware Hashes: Used in Antivirus (AV) profiles for file hash checks via the 'Use external malware blocklist' feature (does not require av-scan to be enabled).

  11. Overview of L2TP VPN on FortiGate

    L2TP (Layer 2 Tunneling Protocol) VPN is a tunneling technology used to carry PPP packets over UDP port 1701. It is primarily used for remote employees to access corporate internal network resources.

    Important Performance and Security Note: For FortiGate users, SSL VPN or IPSec VPN are strongly recommended over L2TP. SSL/IPSec VPNs provide higher security (encryption) and significantly better performance because they are accelerated by NP (Network Processor) chips, whereas L2TP is processed by the CPU.

  12. Overview of Enhanced MAC VLAN (EMAC VLAN)

    Enhanced MAC VLAN (EMAC VLAN) allows a FortiGate device to simulate multiple VLAN interfaces on a single physical interface, where each EMAC VLAN interface is assigned a unique MAC address. This differs from traditional MAC VLANs and provides the following advantages:

    • Unique MAC Addresses: Each EMAC VLAN has its own MAC, allowing it to be paired with distinct IP addresses and network configurations.
    • VIP and IP Pool Support: Because MAC addresses are unique, neighbor routers' ARP tables can distinguish between different EMAC VLANs on the same physical port, enabling the use of Virtual IPs (VIP) and IP Pools.
    • SNAT Support: Policies can disable SNAT to preserve original source IP information.