Administration Guide

Getting started
- Summary of steps
- Using the GUI
- Using the CLI
- Configuration and management
- Product registration with FortiCare
- FortiGate models
Dashboards and Monitors
- Using dashboards
- Using widgets
- Viewing device dashboards in the Security Fabric
- Creating a fabric system and license dashboard
- Dashboards
- Monitors
Network
- Interfaces
- DNS
- Explicit and transparent proxies
- DHCP servers and relays
- Static routing
- Dynamic routing
- Multicast
- FortiExtender
  - Adding a FortiExtender
- LTE modems
- LLDP reception
- Virtual routing and forwarding
- NetFlow
- sFlow
- Link monitor
- IPv6
- FortiGate LAN extension
- SCTP packets with zero checksum on the NP7 platform
- Industrial Connectivity
- Diagnostics
  - Using the packet capture tool
  - Using the debug flow tool
SD-WAN
- SD-WAN overview
  - SD-WAN components and design principles
  - SD-WAN designs and architectures
- SD-WAN quick start
- SD-WAN members and zones
- Performance SLA
- SD-WAN rules
- Advanced routing
- VPN overlay
- Advanced configuration
- SD-WAN cloud on-ramp
- SD-WAN Network Monitor service
- Troubleshooting SD-WAN
Zero Trust Network Access
- Zero Trust Network Access introduction
- ZTNA advanced configurations
- ZTNA configuration examples
- ZTNA troubleshooting and debugging commands
- ZTNA troubleshooting scenarios
Policy and Objects
- Policies
- Address objects
- Protocol options
  - Stripping the X-Forwarded-For value in the HTTP header
- Traffic shaping
- Internet Services
Security Profiles
- Inspection modes
  - Flow mode inspection (default mode)
  - Proxy mode inspection
  - Inspection mode feature comparison
- Antivirus
  - Antivirus introduction
  - Advanced configurations
  - Configuration examples
- Web filter
  - Web filter introduction
  - Advanced CLI configuration
  - Configuration examples
    - Configuring web filter profiles with Hebrew domain names
    - Configuring web filter profiles to block AI and cryptocurrency
- Video filter
  - Filtering based on FortiGuard categories
  - Filtering based on YouTube channel
  - Filtering based on title
  - Filtering based on description
  - Configuring a video filter keyword list
  - Replacement messages displayed in blocked videos
- DNS filter
  - Configuring a DNS filter profile
  - FortiGuard category-based DNS domain filtering
  - Botnet C&C domain blocking
  - DNS safe search
  - Local domain filter
  - DNS translation
  - Applying DNS filter to FortiGate DNS server
  - DNS inspection with DoT and DoH
  - DNS over QUIC and DNS over HTTP3 for transparent and local-in DNS modes
  - Troubleshooting for DNS filter
- Application control
  - Configuring an application sensor
  - Application matching signature priority
  - Basic category filters and overrides
  - Excluding signatures in application control profiles
  - Port enforcement check
  - Protocol enforcement
  - SSL-based application detection over decrypted traffic in a sandwich topology
  - Matching multiple parameters on application control signatures
  - Application signature dissector for DNP3
  - Domain fronting protection
- Inline CASB
  - Inline CASB examples
- Intrusion prevention
  - Signature-based defense
  - Configuring an IPS sensor
  - IPS configuration options
  - SCTP filtering capabilities
  - Diameter protocol inspection
  - IPS signature filter options
  - IPS with botnet C&C IP blocking
  - IPS signatures for the operational technology security service
  - IPS sensor for IEC 61850 MMS protocol
  - IPS Modbus TCP decoder
- File filter
  - Supported file types
- Email filter
  - Configuring an email filter profile
  - Local-based filters
  - FortiGuard-based filters
  - Third-party-based filters
  - Filtering order
  - Protocols and actions
  - Configuring webmail filtering
  - Spam email header
- VoIP solutions
  - General use cases
  - NAT46 and NAT64 for SIP ALG
  - SIP message inspection and filtering
  - SIP ALG and SIP session helper
  - SIP pinholes
  - SIP over TLS
  - Voice VLAN auto-assignment
  - Scanning MSRP traffic
- ICAP
  - ICAP configuration example
  - ICAP response filtering
  - Secure ICAP clients
  - ICAP scanning with SCP and FTP
  - Domain name in XFF with ICAP
  - Selective forwarding to ICAP server
- Web application firewall
  - Protecting a server running web applications
- Data loss prevention
  - DLP techniques
  - Basic DLP settings
  - Advanced DLP configurations
  - DLP fingerprinting
  - FortiGuard DLP service
  - Sensitivity labels
  - Exact data matching
  - DLP examples
- Virtual patching
  - OT virtual patching basic examples
  - OT and IoT virtual patching on NAC policies
- SSL & SSH Inspection
  - Configuring an SSL/SSH inspection profile
  - Certificate inspection
  - Deep inspection
  - Protecting an SSL server
  - Handling SSL offloaded traffic from an external decryption device
  - SSH traffic file scanning
  - Redirect to WAD after handshake completion
  - HTTP/2 support in proxy mode SSL inspection
  - Define multiple certificates in an SSL profile in replace mode
  - Disabling the FortiGuard IP address rating
  - Block or allow ECH TLS connections
- Custom signatures
  - Configuring custom signatures
  - Blocking applications with custom signatures
  - Filters for application control groups
  - Application groups in traffic shaping policies
- Overrides
  - Web rating override
  - Using local and remote categories
  - Web profile override
- IP ban
  - IP ban using the CLI
  - IP ban using security profiles
  - Configuring the persistency for a banned IP list
- Profile groups
IPsec VPN
- General IPsec VPN configuration
- Site-to-site VPN
  - FortiGate-to-FortiGate
  - FortiGate-to-third-party
- Remote access
- Aggregate and redundant VPN
- ADVPN
- Fabric Overlay Orchestrator
- Other VPN topics
- VPN IPsec troubleshooting
  - Understanding VPN related logs
  - IPsec related diagnose commands
SSL VPN
- SSL VPN to dial-up VPN migration
- SSL VPN best practices
- SSL VPN security best practices
- SSL VPN quick start
- SSL VPN tunnel mode
- SSL VPN web mode
- SSL VPN authentication
- SSL VPN to IPsec VPN
- SSL VPN protocols
- Configuring OS and host check
- FortiGate as SSL VPN Client
- Dual stack IPv4 and IPv6 support for SSL VPN
- Disable the clipboard in SSL VPN web mode RDP connections
- SSL VPN IP address assignments
- Using SSL VPN interfaces in zones
- SSL VPN troubleshooting
  - Debug commands
  - Troubleshooting common issues
User & Authentication
- User definition, groups, and settings
- Basic authentication with cached client certificates
- LDAP servers
- RADIUS servers
- SAML
- TACACS+ servers
- SCIM servers
- Bearer token authentication for SCIM servers
- FortiTokens
- PKI
  - Configuring a PKI user
  - Using the SAN field for LDAP-integrated certificate authentication
- FSSO
- Include usernames in logs
Wireless configuration
Switch Controller
System
- Administrators
  - Local authentication
  - Remote authentication for administrators
  - Administrator account options
  - REST API administrator
  - SSO administrators
  - FortiCloud SSO
  - Allowing the FortiGate to override FortiCloud SSO administrator user permissions
  - Password policy
  - Public key SSH access
  - Separating the SSHD host key from the administration server certificate
  - Restricting SSH and Telnet jump host capabilities
  - Restricting local administrator logins through the console
  - Remote administrators with TACACS+ VSA attributes
- Administrator profiles
- Firmware & Registration
  - About firmware installations
  - Firmware labels
  - Upgrading individual devices
  - Upgrading all devices
  - Registering devices
  - Enabling automatic firmware upgrades
  - Upgrade prompt when a critical vulnerability is detected upon login
  - Viewing firmware upgrade reports
  - Authorizing devices
  - Firmware upgrade notifications
  - Downloading a firmware image
  - Testing a firmware version
  - Installing firmware from system reboot
  - Restoring from a USB drive
  - Using controlled upgrades
  - Downgrading individual device firmware
  - Downloading the EOS support package for supported Fabric devices
  - How the FortiGate firmware license works
- Settings
  - Default administrator password
  - Changing the host name
  - Setting the system time
    - SHA-1 authentication support (for NTPv4)
    - PTPv2
  - Configuring ports
    - Custom default service port range
  - Setting the idle timeout time
  - Setting the password policy
  - Changing the view settings
  - Setting the administrator password retries and lockout time
  - TLS configuration
  - Controlling return path with auxiliary session
  - Email alerts
  - Using configuration save mode
  - Trusted platform module support
  - Using the default certificate for HTTPS administrative access
  - Configure TCP NPU session delay globally
- Virtual Domains
  - VDOM overview
  - General configurations
  - Configuring global profiles
  - Backing up and restoring configurations in multi-VDOM mode
  - Inter-VDOM routing configuration example: Internet access
  - Inter-VDOM routing configuration example: Partial-mesh VDOMs
- High Availability
  - FGCP
  - FGSP
  - Standalone configuration synchronization
    - Layer 3 unicast standalone configuration synchronization
  - VRRP
  - Session failover
- SNMP
  - Basic configuration
  - MIB files
  - Access control for SNMP
  - Important SNMP traps
  - SNMP traps and automation-stitch notifications for DIO module
  - SNMP examples
- Replacement messages
- Replacement message groups
- FortiGuard
  - Anycast
  - Configuring FortiGuard updates
  - Using a proxy server to connect to the FortiGuard Distribution Network
  - Manual updates
  - Automatic updates
  - Scheduled updates
  - Sending malware statistics to FortiGuard
  - Update server location
  - Filtering
  - Online security tools
  - Anycast and unicast services
  - Using FortiManager as a local FortiGuard server
  - Cloud service communication statistics
  - IoT detection service
  - FortiAP query to FortiGuard IoT service to determine device details
  - FortiGate Cloud / FDN communication through an explicit proxy
  - FDS-only ISDB package in firmware images
  - Licensing in air-gap environments
  - License expiration
  - FortiGate StateRamp support
  - Disable all cloud communication
- Feature visibility
- Certificates
  - Automatically provision a certificate
  - Generate a new certificate
  - Regenerate default certificates
  - Import a certificate
  - Generate a CSR
  - CA certificate
  - Remote certificate
  - Certificate revocation list
  - Export a certificate
  - Uploading certificates using an API
  - Procuring and importing a signed SSL certificate
  - Microsoft CA deep packet inspection
  - Administrative access using certificates
  - Creating certificates with XCA
  - Enrollment over Secure Transport for automatic certificate management
- Security
  - BIOS-level signature and file integrity checking
  - Real-time file system integrity checking
  - Running a file system check automatically
  - Built-in entropy source
  - FortiGate VM unique certificate
  - Closed network VM license security
  - Encrypt configuration files in the eCryptfs file system
  - FIPS-CC mode and OpenSSL FIPS provider
  - Enhanced administrator password security
- Configuration scripts
- Workspace mode
- Custom languages
- RAID
- FortiGate encryption algorithm cipher suites
- Conserve mode
- Using APIs
- Configuration backups and reset
Fortinet Security Fabric
- Components
- Security Fabric connectors
- Using the Security Fabric
- Configuring the Security Fabric with SAML
- Security rating
- Automation stitches
- Public and private SDN connectors
- Endpoint/Identity connectors
- External feeds
- Generic connector for importing addresses
- Troubleshooting
  - Viewing a summary of all connected FortiGates in a Security Fabric
  - Diagnosing automation stitches
Log and Report
- Viewing event logs
- System Events log page
- Security Events log page
- Reports page
- Log settings and targets
- Logging to FortiAnalyzer
- Advanced and specialized logging
- Sample logs by log type
- Troubleshooting
WAN optimization
- Overview
- Example topologies
- Configuration examples
VM
- Amazon Web Services
- Microsoft Azure
- Google Cloud Platform
- OCI
- AliCloud
- Private cloud
- VM license
- Permanent trial mode for FortiGate-VM
- Adding VDOMs with FortiGate v-series
- PF and VF SR-IOV driver and virtual SPU support
- Using OCI IMDSv2
- FIPS cipher mode for AWS, Azure, OCI, and GCP FortiGate-VMs
- Cloud-init
- TPM support for FortiGate-VM
Hyperscale firewall
Troubleshooting
- Troubleshooting methodologies
- Connectivity Fault Management
- Troubleshooting scenarios
- CLI troubleshooting cheat sheet
- CLI error codes
- Additional resources
Change Log

Home FortiGate / FortiOS 7.6.2 Administration Guide

7.6.2

Amazon Web Services

See the FortiOS 7.6.2 AWS Administration Guide.

Amazon Web Services

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Administration Guide

Amazon Web Services

Amazon Web Services

Amazon Web Services

Amazon Web Services