Fortinet FortiGuard Analysis 1.2.0 manual

www.fortinet.com F or tiG ua rd An alys is an d Management Ser vice V ersion 1 .2.0 ADMINISTRA TION GUIDE[...]

FortiGuard Analysis and Management Service Admini stration Guide V ersion 1.2. 0 31 October 2008 13-12000-40 6-20081031 © Copyright 2008 Fortine t, Inc. All right s reserved. No p art of this publication including text, examples, diagrams or illustrations may be re produced, transmitted, or translate d in any form or by any means, electronic, mech[...]

Contents FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 3 Contents Introduction ............... ................................. .............................. .......... 7 About this document ..................... ................. ................... ................... ............. 7 Doc[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 4 13-12000-406-200810 31 Contents Management ......... .................................................................. .......... 35 Device .............. ................... ................ ................... .................... ................ ....... 35 Viewi[...]

Contents FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 5 Index ............... .................................... .............................. 75[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 6 13-12000-406-200810 31 Contents[...]

Introduction About this document FortiGuard Analysis and Management Servic e Version 1.2.0 Administration Guide 13-12000-406-20081002 7 Introduction The FortiGuard Analysis an d Management Service is a subscription-based service that provides remo te management and logging and reporting capabilities for all FortiGate units. The FortiGuard Analysis [...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 8 13-12000-406-200810 02 Fortinet documentation Introduction Typographic conventions Fortinet documenta tion uses the fo llowing typographical co nventions: Fortinet document ation The most up-to-da te publications and previous releases of F ortinet product documentat [...]

Introduction Customer service a nd technical suppo rt FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 02 9 Customer service and technical support Fortinet T echnical Support provides services designed to make sure that your Fortinet systems install quickly , config ure easily , and operate reliab[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 10 13-12000-406-200810 02 Customer service and technical support Introduction[...]

Setup About the portal web site FortiGuard Analysis and Management Servic e Version 1.2.0 Administration Guide 13-12000-406-20081031 11 Setup This section explains how to: • log in to the portal web site • navigate within the porta l web site • properly set up the service • connect a device to the service. This section also explains ho w to[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 12 13-12000-406-200810 31 About the portal web site Setup Figure 1: The port al web site When you ente r the email address and password for logging in, the Service Account ID appears. Y ou can select which Service Accou nt ID you want to view when logging in to the por[...]

Setup About the portal web site FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 13 Figure 2: Port al web site layout, Ma nagement vie w Dashboard main menu The Dashboard main menu provides all features that are rela ted to it, such as customizing and addi ng pages. Y ou can add widgets to the [...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 14 13-12000-406-200810 31 Obtaining a trial contract Setup Obt aining a trial contract When you first access the port al web site , you can immediately sign up for a trial contract. With a trial contract, you can fa miliarize yourself wit h the feat ures the service pr[...]

Setup Obta ining a tria l contract FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 15 T o obtain a trial contract 1 Go to https://fams.fortinet.com/ . 2 Select the Sign Up Now link. 3 Enter the appropriate infor mation for the following fields: Note: If you have previously logged in to the ser[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 16 13-12000-406-200810 31 Configuri ng a device to use the service Setup 4 Select Submit. Y ou are automatica lly logged in to the por tal web site. Y ou should immediately log out of the portal web site so that you ca n configure the de vices to use FortiGua rd Analys[...]

Setup Configuring a device to use the service FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 17 2 Select the Expand Arrow be side Analysis & Management Service Options to reveal the availa ble options. 3 Enter the service account ID in the Account ID field. The service account ID entered [...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 18 13-12000-406-200810 31 Configuri ng a device to use the service Setup T o configure remote logging to the service 1 In the FortiGate web-based man ager , go to Log&Report > Log Config > Log Setting . Figure 5: FortiGuard logg ing options in Log Settin g 2 [...]

Setup Expanding or renewing service FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 19 Figure 6: Central Manag ement options 2 Select the check box beside Enable Central Manage ment. 3 From T ype, select FortiGua rd Manageme nt Service. 4 Select Apply . 5 Select any of the following options th[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 20 13-12000-406-200810 31 Expanding or renewing service Setup Renewing contracts If you want to extend the serv ice period, you can add a r enewal contract to the previous contract. T o add a renewal contract 1 Go to the Fortinet T echnical Suppor t web site and log in[...]

Setup Expanding or renewing service FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 21 Figure 8: Contract Number 6 Select Renew . The terms of the contr act appear . 7 If you agree, select Agree. A contract term confirmation appears. If you do not agree to the terms of th e se rvice contract, [...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 22 13-12000-406-200810 31 Expanding or renewing service Setup Figure 9: Locating the Serv ice Account ID Near the bottom of the p age, a Product/Contract Maintenance area appears. 4 Enter the Contract Number and a Description in the appropriate fields. Figure 10: Addin[...]

Setup Required port numbers FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 23 7 If your contract details appear to be correct, select Complete Registration. If you have added a contract for a dif fer ent service, or added a contract with service levels greater than a trial contract, you may w[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 24 13-12000-406-200810 31 Required port numbers Setup[...]

Dashboard The Dashboard main menu FortiGuard Analysis and Management Servic e Version 1.2.0 Administration Guide 13-12000-406-20081031 25 Dashboard The Dashboard main menu allows users to cu stomize what system information they want to monitor , such as virus ac tivity and system resources, which are displayed as widget s. Within this menu, users c[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 26 13-12000-406-200810 31 Widgets Dashboard Figure 1 1: C ustomized Dashboard page Widget s The Dashboard widge ts provide valu able information about what is happ ening on your network. The information gath ered is received from logs and SNMP request s. Y ou can cu st[...]

Dashboard Adding and customizing pages FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 27 Adding and customizing p ages Y ou can add up to nine p ages within the Dashboard main menu, and you can customize the widgets that you apply to th ose pages. Th e following procedure explains how to do s[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 28 13-12000-406-200810 31 Configuring widgets Dashboard Figure 12: Resource Monitor • • Configuring the Network Monitor The Network Monitor provides inform ation about what is happening on the network fo r which the device is curr ently configure d. T o configure a[...]

Dashboard Configuring widge ts FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 29 Figure 13: Network Monitor • Configuring the Trap Console The T rap Console provides information about SNMP trap s. The T rap Console provides monitor or alert in formation, help ing you to deter mine what trap[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 30 13-12000-406-200810 31 Configuring widgets Dashboard T o configure a T rap Console widget, select Add T rap Console in Add Widget s, follow the instructions in the table below , and select OK. If you want to edit an existing T rap Console widget, select the Ed it ic[...]

Dashboard Configuring widge ts FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 31 • Event Report – provides informatio n about event a ctivity th at is based on event logs, such as an admin istrator logg ing in to that de vice’s web-based manager . • Virus Re port – provides specific[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 32 13-12000-406-200810 31 Configuring widgets Dashboard • Figure 16: T raffic Report pie chart displ aying the top traffic level by pro tocol Figure 17: T raffic Report pie chart displ aying second-level in formation for 80/tcp To d a t e Th e end date and time of th[...]

Dashboard Customizing the Dashboard page FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 33 Figure 18: W eb Report bar chart displaying th e web category names Figure 19: W eb Report bar chart displaying second -level information for the Sports category Customizing the Dashboard p age Y ou can[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 34 13-12000-406-200810 31 Customizing the Dashboard page Dashboard[...]

Management Device FortiGuard Analysis and Management Servic e Version 1.2.0 Administration Guide 13-12000-406-20081031 35 Management The Mana gement men u provides re mote manage ment featur es, allowing yo u to upload script s, schedule when to upgra de firmware on a device, and view account information. This section includes the following to pics[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 36 13-12000-406-200810 31 Device Management The Device Detail tab displays the Ba sic Information section, which shows information such as the internal IP a ddress of the device and the cu rrent firmware version ru nning on the device. This tab also displays the T asks[...]

Management Device FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 37 Adding and editing devices Y ou can add devices to the contract or edit th e daily volume and quot a for a device. Adding devices to a contr act is av ailable only if your contract allows it. T o add a device 1 Go to Manageme[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 38 13-12000-406-200810 31 Device Management T o edit a device 1 Go to Management > Device . 2 In the Device section, select Edit. 3 Enter the appro priate information fo r the following: 4 Select Submit. Authorizing the service on devices Y ou can authorize current [...]

Management Device FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 39 Sending manual or automati c configuration revisions The service can receive manual and au tomatic configuration ba ckups when you change a licensed device’ s configuration. After the service receive s the revisions, you ca[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 40 13-12000-406-200810 31 Device Management Searching configuration revisions Y ou can search configuration revisions to fin d a configuration change tha t occurred on a device. T o search a revision 1 Go to Management > Device > Revision History . 2 From the Dev[...]

Management Device FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 41 Comparing configuration revisions As you accrue conf iguration revisions, yo u may want to determine what changed between two revisions. This can be usef ul for troubleshooting a configuration change, or for creating scripts.[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 42 13-12000-406-200810 31 Device Management T o compare co nfiguration revision s from within the FortiGate web-b ased manager 1 In the FortiGate web-based man ager , go to System > Maintenance > Revision Control . 2 In the Action column, in the row correspondi n[...]

Management Device FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 43 Running scripts Y ou can run script s or schedule when a scri pt runs from the T asks section of the Device menu. Scripts allow you to deploy identical configuration item s to many devices. Scrip ts are configured fro m confi[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 44 13-12000-406-200810 31 Device Management Changing firmware from the portal web site The Device De tail tab displays each device’s curren t firmware vers ion and any scheduled firmware changes. Authorized, configured devices p eriodically poll the service. If you h[...]

Management Scripts FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 45 Changing firmware from the device In addition to immediately changing a devi ce’ s firmware from within the portal , you can also immediately chang e the device’ s firmware by logging in to the device’ s web-based mana[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 46 13-12000-406-200810 31 Scripts Management Creating scripts With a plain text edito r , you can create scr ipts fro m backed up configuration files, and then upload them as a script. Alternatively , you can type CLI commands directly into a script in the port al web [...]

Management Scripts FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 47 7 Select Submit. The script is added to the list of available scr ipts. Viewing available c onfiguration scripts The Script t ab displays all configuration script s that you have uploaded or input, and any deployment sch edu[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 48 13-12000-406-200810 31 T opology T ool Management T opology T ool The T opology T ool tab, similar to the T o pology tab found on mo st devices, allows you to create and save a dia gram of your specific network. Mu ltiple network diagrams can also be create d and sa[...]

Management T opology T ool FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 49 Figure 25: Network diagram in Edit mode Within the T o pology T o ol section, additi onal menus allow you to access network diagrams and custo mize the view . These additional menus diff er between V iew mode and Edi[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 50 13-12000-406-200810 31 T opology T ool Management In Edit mode, many dif ferent icons (or drawing tools) an d shapes help you create a network diagram. These sh apes are available in the Shap es section and are used to show the dif ferent Fortinet product s that may[...]

Management Settings FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 51 4 Select Save to save the network diagram to the service’ s server . Y ou can save the network diag ram to either the Private or Share d folders. If you save the network diagram to the Private fold ers, it is accessible o[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 52 13-12000-406-200810 31 Settings Management Figure 26: Settings menu Delete Edit Account Information This section provide s information s pecific to your account, such a s the service account ID, the time zo ne, and other details about your contract. Service Account [...]

Management Settings FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 53 Adding, editing and re moving administrators If multiple users will be accessing the serv ice portal, you can add those users to the accoun t from the User Information area. User roles define access privileges, and can be N[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 54 13-12000-406-200810 31 Settings Management T o add or edit account users 1 Go to Management > Settings . 2 In User Information, select eith er Add User to create a new user , or select the Edit icon in the row of the us er you want to change. 3 Enter the followi [...]

Management Settings FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 55 4 Select Submit. Changing your service account ID The Account In formation area includes th e Service Account ID an d time zone, and is displayed the same way for all users and devic es connecting to the ac count. The Servi[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 56 13-12000-406-200810 31 Settings Management 4 Select OK. Name Enter a name for the alert profile. When [<nn>] occurrences within [<nn_min_hr>] Select a number from the first lis t to specify th e number of alerts that must occur before an email notificati[...]

Analysis FortiGuard Analysis and Management Servic e Version 1.2.0 Administration Guide 13-12000-406-20081031 59 Analysis In the Analysis menu, you can view , search and browse through log files of each registered device. Y ou can also view and generate report s. The Analysis menu also includes the e- Discovery tab , which allows you to search for [...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 60 13-12000-406-200810 31 Log Viewer Analysis Log V iewer From the Log V iewer tab, you can view re cen t and specific logs on the registered devices. There are two types of log viewing options: • Recent – disp lays current log mess ages, as they are re ceived by t[...]

Analysis Log Viewer FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 61 Figure 27: V iewin g recent event log messages Device The device that you are currently viewing log messages from. Ty p e T he type of log messages you are cu rrently viewing. For example, if Event Log is selected, all even[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 62 13-12000-406-200810 31 Customizing the log view Analysis Figure 28: Viewing historical event log messages Customizing the log view The service allows you to customize what columns and log information are displayed when viewing logs, providing anothe r way to find sp[...]

Analysis Customizing the log view FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 63 Figure 29: Column Display Settings wi ndow for Even t log T o show or hide columns 1 Select Column Settings. A list of columns available for that log typ e appears. 2 Select columns that yo u want displayed or[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 64 13-12000-406-200810 31 Customizing the log view Analysis Figure 30: Filter icons for logs When filtering by sour ce or destination IP , you can use the followi ng in the filtering criteria: • a single address ( 2.2.2.2 ) • an address range using a wild card ( 1.[...]

Analysis Log File Browser FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 65 Log File Browser Y ou can down load all log files stored on each device. By downloading the log files, you can view all log messag es that were rec orded in that lo g file outside of the portal web site. When you down[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 66 13-12000-406-200810 31 Deleting log file s from the Fort iGate web-ba sed manager Analysis T o download a log fi le 1 Go to Analysis > Log File Browser . 2 In the row contai ning the file you want to download, select Download. 3 After the log file downloads to yo[...]

Analysis Reports FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 67 Y ou can access reports on the portal web s ite either from t he Dashboard m enu or from Analysis > Report . The FortiGuard An alysis server provides report s for each device, and can generate the repo rts whene ver you nee[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 68 13-12000-406-200810 31 Reports Analysis Figure 33: Generated daily report fo r the period of Septemb er 22, 2008 to Sept ember 23, 2008 T o view a generated report 1 Go to Analysis > Report . 2 From the calendar , select the date that the report was generated on.[...]

Analysis e-Discovery FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 69 4 Select the dates using the calendars in Delete Repo rts. When selecting dates, remem ber that reports within th e time period will be deleted as well. For example, if y ou select Septe mber 1 to Se ptember 5, t he report[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 70 13-12000-406-200810 31 e-Discovery Analysis Figure 34: An e-Discovery task in the e-Discovery menu Copy Ta s k Delete Ta s k Edit Ta s k Reschedule T asks <T ask name> D etails of the <T ask Name> T ask List This section displays the current t asks. Y ou[...]

Analysis e-Discovery FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 71 Figure 35: Search Result s t ab with email messages found during the search View er s The users who have p ermission to view the task. For example, if the “no admin” role was selected, the users who have the “no admi[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 72 13-12000-406-200810 31 e-Discovery Analysis Creating tasks for e-Discovery Y ou can create det ailed tasks for both users and th ird-par ty administrators to vie w . Y ou can also copy an existing task to form the basis of a new t ask. The following procedure s desc[...]

Analysis e-Discovery FortiGuard Analysis and Ma nagement Serv ice Version 1.2.0 Administration Gu ide 13-12000-406-200810 31 73 T o create t asks for e-Discovery 1 Go to Analysis > e-Discove ry . 2 In T asks, select New T as k. 3 Enter the appropriate infor mation in the available fields. 4 Select Submit. T o copy a t ask and apply it to a new t[...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 74 13-12000-406-200810 31 e-Discovery Analysis[...]

Index FortiGuard Analysis and Management Servic e Version 1.2.0 Administration Guide 13-12000-406-20081031 75 Index A adding purchased contracts 21 adding, configuring, or defining administrators 55 copying a search task in e-Discovery 74 devices 37 devices to use the service 16 login profile 56 network diagram, topology tool 52 pages 27 purchased [...]

FortiGuard Analysis and Manageme nt Service V ersion 1.2.0 Administratio n Guide 76 13-12000-406-200810 31 Index topology tool 49 O obtaining a trial con tract 14 P port numbers required for the service 23 portal web site UR L 11 R recent logs, viewing 60 remote logging 18 renewing contracts 20 reports deleting reports 69 viewing generated reports [...]

www.fortinet.com[...]

www.fortinet.com[...]