fortigate防火墙管理系统应用

fortigate防火墙管理系统应用内容摘要：

SrcIP DstIP Prot SrcPort DstPort Data 6 54321 80 Get NAT Route 路 由運作原理 Inter .5 .5 HttpServer .1 SrcIP DstIP Prot SrcPort DstPort Data 6 12345 80 Get SrcIP DstIP Prot SrcPort DstPort Data 6 12345 80 Get Route • 防火牆 policy (不啓動 NAT).  FG只檢查路由表 ,根據路由表將封包送往所指定的位址 ,而不變動來源 IP或來源埠 Transparent 通透模式運作原理 • 防火牆 policy  沒有 NAT或路由 ,FG單純地檢查經過的封包 Inter .5 .5 HttpServer .1 SrcIP DstIP Prot SrcPort DstPort Data 6 12345 80 Get SrcIP DstIP Prot SrcPort DstPort Data 6 12345 80 Get Trans Authentication  A User object is a instance of an authentication method  A User Group object is a container for User objects  Identifies group members  Protection Profile and Type provides authorization attributes for members  FortiGate units control access to resources based on group membership  The bination of User Group and Firewall Policy defines the authorization for a particular user  Firewall Policy: VPN (SSL/IPSec/PPTP/L2TP), FWUA (firewall user authentication) Authentication – User/Server Types  Local password file  Username and password prompt  RADIUS  Username and password prompt  LDAP / AD  Username and password prompt  FSAE / NTLM (AD)  Single Sign On based on earlier authentication event  PKI  Certificate based authentication Authentication – Services  Firewall Policies (Firewall User Authentication)  SSL VPN  IPSec VPN  PPTP and L2TP  Admin login  FortiGuard Web Filtering Override Firewall Policies  User Groups linked to Accept Firewall Policies  On successful authentication a temporary rule is created  If no tra。