FortiGate 방화벽 운용 팁 요약

FortiGate 방화벽 운용 팁 요약

FortiGate admin 계정 ACL

FG1K5D3I15805012 # config system admin

FG1K5D3I15805012 (admin) # show
config system admin
    edit "admin"
        set trusthost1 192.168.50.0 255.255.255.0
        set trusthost2 192.168.10.0 255.255.255.0
        set accprofile "super_admin"
        set vdom "root"
    next
end

Note	CLI 모드에서만 적용 가능

FortiGate Session Helper 적용

Note	Passive mode FTP 에서 포트 변경시 꼭 썰정해야 작동 함

• 설정

  # config system session-helper
      edit 200                    # 중복되지 않도록 "show config system session-helper" 명령으로 확인 후 적용
          set name ftp
          set protocol 6
          set port 2002           # 지정할 포트 번호
      next
  # end

  Note	CLI 모드에서만 설정 가능

• 설정 확인

  # show system session-helper
  config system session-helper
      edit 1
          set name pptp
          set protocol 6
          set port 1723
      next
      edit 2
          set name h323
          set protocol 6
          set port 1720
      next
      edit 3
          set name ras
          set protocol 17
          set port 1719
      next
      edit 4
          set name tns
          set protocol 6
          set port 1521
      next
      edit 5
          set name tftp
          set protocol 17
          set port 69
      next
      edit 6
          set name rtsp
          set protocol 6
          set port 554
      next
      edit 7
          set name rtsp
          set protocol 6
          set port 7070
      next
      edit 8
          set name rtsp
          set protocol 6
          set port 8554
      next
      edit 9
          set name ftp
          set protocol 6
          set port 21
      next
      edit 10
          set name mms
          set protocol 6
          set port 1863
      next
      edit 11
          set name pmap
          set protocol 6
          set port 111
      next
      edit 12
          set name pmap
          set protocol 17
          set port 111
      next
      edit 13
          set name sip
          set protocol 17
          set port 5060
      next
      edit 14
          set name dns-udp
          set protocol 17
          set port 53
      next
      edit 15
      set name rsh
          set protocol 6
          set port 514
      next
      edit 16
          set name rsh
          set protocol 6
          set port 512
      next
      edit 17
          set name dcerpc
          set protocol 6
          set port 135
      next
      edit 18
          set name dcerpc
          set protocol 17
          set port 135
      next
      edit 19
          set name mgcp
          set protocol 17
          set port 2427
      next
      edit 20
          set name mgcp
          set protocol 17
          set port 2727
      next
      edit 200
          set name ftp
          set protocol 6
          set port 2002
      next
  end

FortiGate 초기 설정

• MGMT 초기 연결 정보

  항목	내용
  Network Interface	MGMT
  URL	https://192.168.1.99/
  Administrator Account	admin
  Password

  Note	연결하는 PC IP:192.168.1.2/24

• 초기 설정 순서

  1) System / Admin Profiles
  2) System / Administrators
  3) System / Settings
  4) Network / Interfaces (Name, IP,  Access)
  5) Network / Static Routes

FortiGate 패스워드 초기화 및 공장 초기화

• 로그인

  Serial number: FGT60C3G101234
  
  username: maintainer
  Password: bcpbF0C3G101234

  Note	시리얼 넘버는 예시

• 패스워드 초기화

  #- Vdom이 비활성화된 장비
  config system admin
  edit admin
  set password <psswrd>
  end
  
  #- Vdom이 활성화된 장비
  config global
  config system admin
  edit admin
  set password <psswrd>
  end

• 공장 초기화

  exec factoryreset
  (Y/N) Y <enter>
  
  reboot
  
  User : admin
  Password : <없음>