fortigate Wed Oct 15 09:07:37 PM EDT 2025
This commit is contained in:
parent
1c73f53ea9
commit
98cfed6197
71
configs/fortigate/global/antivirus.cfg
Normal file
71
configs/fortigate/global/antivirus.cfg
Normal file
@ -0,0 +1,71 @@
|
||||
config antivirus profile
|
||||
edit "g-default"
|
||||
set comment "Scan files and block viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Scan files and monitor viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
end
|
||||
29
configs/fortigate/global/application.cfg
Normal file
29
configs/fortigate/global/application.cfg
Normal file
@ -0,0 +1,29 @@
|
||||
config application list
|
||||
edit "g-default"
|
||||
set comment "Monitor all applications."
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor all applications."
|
||||
unset options
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set deep-app-inspection disable
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
69
configs/fortigate/global/certificate.cfg
Normal file
69
configs/fortigate/global/certificate.cfg
Normal file
@ -0,0 +1,69 @@
|
||||
config certificate ca
|
||||
end
|
||||
config certificate local
|
||||
edit "Fortinet_CA_SSL"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_CA_Untrusted"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA1024"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA2048"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA4096"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA1024"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA2048"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA256"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA384"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA521"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED25519"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED448"
|
||||
set password ENC *HIDDEN*
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set source factory
|
||||
next
|
||||
end
|
||||
9
configs/fortigate/global/dlp.cfg
Normal file
9
configs/fortigate/global/dlp.cfg
Normal file
@ -0,0 +1,9 @@
|
||||
config dlp sensor
|
||||
edit "g-default"
|
||||
set comment "Default sensor."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Log a summary of email and web traffic."
|
||||
set summary-proto smtp pop3 imap http-get http-post
|
||||
next
|
||||
end
|
||||
17
configs/fortigate/global/endpoint-control.cfg
Normal file
17
configs/fortigate/global/endpoint-control.cfg
Normal file
@ -0,0 +1,17 @@
|
||||
config endpoint-control fctems
|
||||
edit 1
|
||||
set pull-sysinfo disable
|
||||
set pull-vulnerabilities disable
|
||||
set pull-avatars disable
|
||||
set pull-tags disable
|
||||
set pull-malware-hash disable
|
||||
next
|
||||
edit 2
|
||||
next
|
||||
edit 3
|
||||
next
|
||||
edit 4
|
||||
next
|
||||
edit 5
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/global/file-filter.cfg
Normal file
8
configs/fortigate/global/file-filter.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config file-filter profile
|
||||
edit "g-default"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
end
|
||||
5230
configs/fortigate/global/firewall.cfg
Normal file
5230
configs/fortigate/global/firewall.cfg
Normal file
File diff suppressed because it is too large
Load Diff
26
configs/fortigate/global/ips.cfg
Normal file
26
configs/fortigate/global/ips.cfg
Normal file
@ -0,0 +1,26 @@
|
||||
config ips sensor
|
||||
edit "g-default"
|
||||
set comment "Prevent critical attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor IPS attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
10
configs/fortigate/global/log.cfg
Normal file
10
configs/fortigate/global/log.cfg
Normal file
@ -0,0 +1,10 @@
|
||||
config log syslogd filter
|
||||
set severity error
|
||||
end
|
||||
config log fortianalyzer setting
|
||||
set status enable
|
||||
set server "10.1.48.40"
|
||||
set serial "FAZVMSTM22000402"
|
||||
set source-ip "192.168.1.241"
|
||||
set upload-option realtime
|
||||
end
|
||||
1320
configs/fortigate/global/system.cfg
Normal file
1320
configs/fortigate/global/system.cfg
Normal file
File diff suppressed because one or more lines are too long
1309
configs/fortigate/global/wanopt.cfg
Normal file
1309
configs/fortigate/global/wanopt.cfg
Normal file
File diff suppressed because it is too large
Load Diff
562
configs/fortigate/global/webfilter.cfg
Normal file
562
configs/fortigate/global/webfilter.cfg
Normal file
@ -0,0 +1,562 @@
|
||||
config webfilter profile
|
||||
edit "g-default"
|
||||
set comment "Default web filtering."
|
||||
config ftgd-wf
|
||||
unset options
|
||||
config filters
|
||||
edit 1
|
||||
set action block
|
||||
next
|
||||
edit 2
|
||||
set category 2
|
||||
set action block
|
||||
next
|
||||
edit 3
|
||||
set category 7
|
||||
set action block
|
||||
next
|
||||
edit 4
|
||||
set category 8
|
||||
set action block
|
||||
next
|
||||
edit 5
|
||||
set category 9
|
||||
set action block
|
||||
next
|
||||
edit 6
|
||||
set category 11
|
||||
set action block
|
||||
next
|
||||
edit 7
|
||||
set category 12
|
||||
set action block
|
||||
next
|
||||
edit 8
|
||||
set category 13
|
||||
set action block
|
||||
next
|
||||
edit 9
|
||||
set category 14
|
||||
set action block
|
||||
next
|
||||
edit 10
|
||||
set category 15
|
||||
set action block
|
||||
next
|
||||
edit 11
|
||||
set category 16
|
||||
set action block
|
||||
next
|
||||
edit 12
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 13
|
||||
set category 57
|
||||
set action block
|
||||
next
|
||||
edit 14
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 15
|
||||
set category 63
|
||||
set action block
|
||||
next
|
||||
edit 16
|
||||
set category 64
|
||||
set action block
|
||||
next
|
||||
edit 17
|
||||
set category 65
|
||||
set action block
|
||||
next
|
||||
edit 18
|
||||
set category 66
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 67
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor web traffic."
|
||||
config ftgd-wf
|
||||
config filters
|
||||
edit 1
|
||||
next
|
||||
edit 2
|
||||
set category 1
|
||||
next
|
||||
edit 3
|
||||
set category 2
|
||||
next
|
||||
edit 4
|
||||
set category 3
|
||||
next
|
||||
edit 5
|
||||
set category 4
|
||||
next
|
||||
edit 6
|
||||
set category 5
|
||||
next
|
||||
edit 7
|
||||
set category 6
|
||||
next
|
||||
edit 8
|
||||
set category 7
|
||||
next
|
||||
edit 9
|
||||
set category 8
|
||||
next
|
||||
edit 10
|
||||
set category 9
|
||||
next
|
||||
edit 11
|
||||
set category 11
|
||||
next
|
||||
edit 12
|
||||
set category 12
|
||||
next
|
||||
edit 13
|
||||
set category 13
|
||||
next
|
||||
edit 14
|
||||
set category 14
|
||||
next
|
||||
edit 15
|
||||
set category 15
|
||||
next
|
||||
edit 16
|
||||
set category 16
|
||||
next
|
||||
edit 17
|
||||
set category 17
|
||||
next
|
||||
edit 18
|
||||
set category 18
|
||||
next
|
||||
edit 19
|
||||
set category 19
|
||||
next
|
||||
edit 20
|
||||
set category 20
|
||||
next
|
||||
edit 21
|
||||
set category 23
|
||||
next
|
||||
edit 22
|
||||
set category 24
|
||||
next
|
||||
edit 23
|
||||
set category 25
|
||||
next
|
||||
edit 24
|
||||
set category 26
|
||||
next
|
||||
edit 25
|
||||
set category 28
|
||||
next
|
||||
edit 26
|
||||
set category 29
|
||||
next
|
||||
edit 27
|
||||
set category 30
|
||||
next
|
||||
edit 28
|
||||
set category 31
|
||||
next
|
||||
edit 29
|
||||
set category 33
|
||||
next
|
||||
edit 30
|
||||
set category 34
|
||||
next
|
||||
edit 31
|
||||
set category 35
|
||||
next
|
||||
edit 32
|
||||
set category 36
|
||||
next
|
||||
edit 33
|
||||
set category 37
|
||||
next
|
||||
edit 34
|
||||
set category 38
|
||||
next
|
||||
edit 35
|
||||
set category 39
|
||||
next
|
||||
edit 36
|
||||
set category 40
|
||||
next
|
||||
edit 37
|
||||
set category 41
|
||||
next
|
||||
edit 38
|
||||
set category 42
|
||||
next
|
||||
edit 39
|
||||
set category 43
|
||||
next
|
||||
edit 40
|
||||
set category 44
|
||||
next
|
||||
edit 41
|
||||
set category 46
|
||||
next
|
||||
edit 42
|
||||
set category 47
|
||||
next
|
||||
edit 43
|
||||
set category 48
|
||||
next
|
||||
edit 44
|
||||
set category 49
|
||||
next
|
||||
edit 45
|
||||
set category 50
|
||||
next
|
||||
edit 46
|
||||
set category 51
|
||||
next
|
||||
edit 47
|
||||
set category 52
|
||||
next
|
||||
edit 48
|
||||
set category 53
|
||||
next
|
||||
edit 49
|
||||
set category 54
|
||||
next
|
||||
edit 50
|
||||
set category 55
|
||||
next
|
||||
edit 51
|
||||
set category 56
|
||||
next
|
||||
edit 52
|
||||
set category 57
|
||||
next
|
||||
edit 53
|
||||
set category 58
|
||||
next
|
||||
edit 54
|
||||
set category 59
|
||||
next
|
||||
edit 55
|
||||
set category 61
|
||||
next
|
||||
edit 56
|
||||
set category 62
|
||||
next
|
||||
edit 57
|
||||
set category 63
|
||||
next
|
||||
edit 58
|
||||
set category 64
|
||||
next
|
||||
edit 59
|
||||
set category 65
|
||||
next
|
||||
edit 60
|
||||
set category 66
|
||||
next
|
||||
edit 61
|
||||
set category 67
|
||||
next
|
||||
edit 62
|
||||
set category 68
|
||||
next
|
||||
edit 63
|
||||
set category 69
|
||||
next
|
||||
edit 64
|
||||
set category 70
|
||||
next
|
||||
edit 65
|
||||
set category 71
|
||||
next
|
||||
edit 66
|
||||
set category 72
|
||||
next
|
||||
edit 67
|
||||
set category 75
|
||||
next
|
||||
edit 68
|
||||
set category 76
|
||||
next
|
||||
edit 69
|
||||
set category 77
|
||||
next
|
||||
edit 70
|
||||
set category 78
|
||||
next
|
||||
edit 71
|
||||
set category 79
|
||||
next
|
||||
edit 72
|
||||
set category 80
|
||||
next
|
||||
edit 73
|
||||
set category 81
|
||||
next
|
||||
edit 74
|
||||
set category 82
|
||||
next
|
||||
edit 75
|
||||
set category 83
|
||||
next
|
||||
edit 76
|
||||
set category 84
|
||||
next
|
||||
edit 77
|
||||
set category 85
|
||||
next
|
||||
edit 78
|
||||
set category 86
|
||||
next
|
||||
edit 79
|
||||
set category 87
|
||||
next
|
||||
edit 80
|
||||
set category 88
|
||||
next
|
||||
edit 81
|
||||
set category 89
|
||||
next
|
||||
edit 82
|
||||
set category 90
|
||||
next
|
||||
edit 83
|
||||
set category 91
|
||||
next
|
||||
edit 84
|
||||
set category 92
|
||||
next
|
||||
edit 85
|
||||
set category 93
|
||||
next
|
||||
edit 86
|
||||
set category 94
|
||||
next
|
||||
edit 87
|
||||
set category 95
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set options block-invalid-url
|
||||
config ftgd-wf
|
||||
unset options
|
||||
config filters
|
||||
edit 1
|
||||
next
|
||||
edit 2
|
||||
set category 2
|
||||
set action block
|
||||
next
|
||||
edit 3
|
||||
set category 7
|
||||
set action block
|
||||
next
|
||||
edit 4
|
||||
set category 8
|
||||
set action block
|
||||
next
|
||||
edit 5
|
||||
set category 9
|
||||
set action block
|
||||
next
|
||||
edit 6
|
||||
set category 11
|
||||
set action block
|
||||
next
|
||||
edit 7
|
||||
set category 12
|
||||
set action block
|
||||
next
|
||||
edit 8
|
||||
set category 13
|
||||
set action block
|
||||
next
|
||||
edit 9
|
||||
set category 14
|
||||
set action block
|
||||
next
|
||||
edit 10
|
||||
set category 15
|
||||
set action block
|
||||
next
|
||||
edit 11
|
||||
set category 16
|
||||
set action block
|
||||
next
|
||||
edit 12
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 13
|
||||
set category 57
|
||||
set action block
|
||||
next
|
||||
edit 14
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 15
|
||||
set category 63
|
||||
set action block
|
||||
next
|
||||
edit 16
|
||||
set category 64
|
||||
set action block
|
||||
next
|
||||
edit 17
|
||||
set category 65
|
||||
set action block
|
||||
next
|
||||
edit 18
|
||||
set category 66
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 67
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
config webfilter search-engine
|
||||
edit "g-google"
|
||||
set hostname ".*\\.google\\..*"
|
||||
set url "^\\/((custom|search|images|videosearch|webhp)\\?)"
|
||||
set query "q="
|
||||
set safesearch url
|
||||
set safesearch-str "&safe=active"
|
||||
next
|
||||
edit "g-yahoo"
|
||||
set hostname ".*\\.yahoo\\..*"
|
||||
set url "^\\/search(\\/video|\\/images){0,1}(\\?|;)"
|
||||
set query "p="
|
||||
set safesearch url
|
||||
set safesearch-str "&vm=r"
|
||||
next
|
||||
edit "g-bing"
|
||||
set hostname ".*\\.bing\\..*"
|
||||
set url "^(\\/images|\\/videos)?(\\/search|\\/async|\\/asyncv2)\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yandex"
|
||||
set hostname "yandex\\..*"
|
||||
set url "^\\/((yand|images\\/|video\\/)(search)|search\\/)\\?"
|
||||
set query "text="
|
||||
set safesearch url
|
||||
set safesearch-str "&family=yes"
|
||||
next
|
||||
edit "g-youtube"
|
||||
set hostname ".*youtube.*"
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-baidu"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/s?\\?"
|
||||
set query "wd="
|
||||
next
|
||||
edit "g-baidu2"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/(ns|q|m|i|v)\\?"
|
||||
set query "word="
|
||||
next
|
||||
edit "g-baidu3"
|
||||
set hostname "tieba\\.baidu\\.com"
|
||||
set url "^\\/f\\?"
|
||||
set query "kw="
|
||||
next
|
||||
edit "g-vimeo"
|
||||
set hostname ".*vimeo.*"
|
||||
set url "^\\/search\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yt-scan-1"
|
||||
set url "www.youtube.com/user/"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-2"
|
||||
set url "www.youtube.com/youtubei/v1/browse"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-3"
|
||||
set url "www.youtube.com/youtubei/v1/player"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-4"
|
||||
set url "www.youtube.com/youtubei/v1/navigator"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-channel"
|
||||
set url "www.youtube.com/channel"
|
||||
set safesearch yt-channel
|
||||
next
|
||||
edit "g-yt-pattern"
|
||||
set url "youtube.com/channel/"
|
||||
set safesearch yt-pattern
|
||||
next
|
||||
edit "g-twitter"
|
||||
set hostname "twitter\\.com"
|
||||
set url "^\\/i\\/api\\/graphql\\/.*\\/UserByScreenName"
|
||||
set query "variables="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-google-translate-1"
|
||||
set hostname "translate\\.google\\..*"
|
||||
set url "^\\/translate"
|
||||
set query "u="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-google-translate-2"
|
||||
set hostname ".*\\.translate\\.goog"
|
||||
set url "^\\/"
|
||||
set safesearch translate
|
||||
next
|
||||
end
|
||||
75
configs/fortigate/vdom_Policy/antivirus.cfg
Normal file
75
configs/fortigate/vdom_Policy/antivirus.cfg
Normal file
@ -0,0 +1,75 @@
|
||||
config antivirus settings
|
||||
set machine-learning-detection enable
|
||||
set grayware enable
|
||||
end
|
||||
config antivirus profile
|
||||
edit "g-default"
|
||||
set comment "Scan files and block viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Scan files and monitor viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
end
|
||||
81
configs/fortigate/vdom_Policy/dlp.cfg
Normal file
81
configs/fortigate/vdom_Policy/dlp.cfg
Normal file
@ -0,0 +1,81 @@
|
||||
config dlp filepattern
|
||||
edit 1
|
||||
set name "builtin-patterns"
|
||||
config entries
|
||||
edit "*.bat"
|
||||
next
|
||||
edit "*.com"
|
||||
next
|
||||
edit "*.dll"
|
||||
next
|
||||
edit "*.doc"
|
||||
next
|
||||
edit "*.exe"
|
||||
next
|
||||
edit "*.gz"
|
||||
next
|
||||
edit "*.hta"
|
||||
next
|
||||
edit "*.ppt"
|
||||
next
|
||||
edit "*.rar"
|
||||
next
|
||||
edit "*.scr"
|
||||
next
|
||||
edit "*.tar"
|
||||
next
|
||||
edit "*.tgz"
|
||||
next
|
||||
edit "*.vb?"
|
||||
next
|
||||
edit "*.wps"
|
||||
next
|
||||
edit "*.xl?"
|
||||
next
|
||||
edit "*.zip"
|
||||
next
|
||||
edit "*.pif"
|
||||
next
|
||||
edit "*.cpl"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit 2
|
||||
set name "all_executables"
|
||||
config entries
|
||||
edit "bat"
|
||||
set filter-type type
|
||||
set file-type bat
|
||||
next
|
||||
edit "exe"
|
||||
set filter-type type
|
||||
set file-type exe
|
||||
next
|
||||
edit "elf"
|
||||
set filter-type type
|
||||
set file-type elf
|
||||
next
|
||||
edit "hta"
|
||||
set filter-type type
|
||||
set file-type hta
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config dlp sensitivity
|
||||
edit "Private"
|
||||
next
|
||||
edit "Critical"
|
||||
next
|
||||
edit "Warning"
|
||||
next
|
||||
end
|
||||
config dlp sensor
|
||||
edit "g-default"
|
||||
set comment "Default sensor."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Log a summary of email and web traffic."
|
||||
set summary-proto smtp pop3 imap http-get http-post
|
||||
next
|
||||
end
|
||||
84
configs/fortigate/vdom_Policy/dnsfilter.cfg
Normal file
84
configs/fortigate/vdom_Policy/dnsfilter.cfg
Normal file
@ -0,0 +1,84 @@
|
||||
config dnsfilter profile
|
||||
edit "default"
|
||||
set comment "Default dns filtering."
|
||||
config ftgd-dns
|
||||
config filters
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 7
|
||||
next
|
||||
edit 3
|
||||
set category 8
|
||||
next
|
||||
edit 4
|
||||
set category 9
|
||||
next
|
||||
edit 5
|
||||
set category 11
|
||||
next
|
||||
edit 6
|
||||
set category 12
|
||||
next
|
||||
edit 7
|
||||
set category 13
|
||||
next
|
||||
edit 8
|
||||
set category 14
|
||||
next
|
||||
edit 9
|
||||
set category 15
|
||||
next
|
||||
edit 10
|
||||
set category 16
|
||||
next
|
||||
edit 11
|
||||
next
|
||||
edit 12
|
||||
set category 57
|
||||
next
|
||||
edit 13
|
||||
set category 63
|
||||
next
|
||||
edit 14
|
||||
set category 64
|
||||
next
|
||||
edit 15
|
||||
set category 65
|
||||
next
|
||||
edit 16
|
||||
set category 66
|
||||
next
|
||||
edit 17
|
||||
set category 67
|
||||
next
|
||||
edit 18
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
set block-botnet enable
|
||||
next
|
||||
end
|
||||
20
configs/fortigate/vdom_Policy/emailfilter.cfg
Normal file
20
configs/fortigate/vdom_Policy/emailfilter.cfg
Normal file
@ -0,0 +1,20 @@
|
||||
config emailfilter profile
|
||||
edit "default"
|
||||
set comment "Malware and phishing URL filtering."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
edit "sniffer-profile"
|
||||
set comment "Malware and phishing URL monitoring."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_Policy/file-filter.cfg
Normal file
8
configs/fortigate/vdom_Policy/file-filter.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config file-filter profile
|
||||
edit "g-default"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
end
|
||||
1145
configs/fortigate/vdom_Policy/firewall.cfg
Normal file
1145
configs/fortigate/vdom_Policy/firewall.cfg
Normal file
File diff suppressed because it is too large
Load Diff
14
configs/fortigate/vdom_Policy/icap.cfg
Normal file
14
configs/fortigate/vdom_Policy/icap.cfg
Normal file
@ -0,0 +1,14 @@
|
||||
config icap profile
|
||||
edit "default"
|
||||
config icap-headers
|
||||
edit 1
|
||||
set name "X-Authenticated-User"
|
||||
set content "$user"
|
||||
next
|
||||
edit 2
|
||||
set name "X-Authenticated-Groups"
|
||||
set content "$local_grp"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
26
configs/fortigate/vdom_Policy/ips.cfg
Normal file
26
configs/fortigate/vdom_Policy/ips.cfg
Normal file
@ -0,0 +1,26 @@
|
||||
config ips sensor
|
||||
edit "g-default"
|
||||
set comment "Prevent critical attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor IPS attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
80
configs/fortigate/vdom_Policy/log.cfg
Normal file
80
configs/fortigate/vdom_Policy/log.cfg
Normal file
@ -0,0 +1,80 @@
|
||||
config log threat-weight
|
||||
config web
|
||||
edit 1
|
||||
set category 26
|
||||
set level high
|
||||
next
|
||||
edit 2
|
||||
set category 61
|
||||
set level high
|
||||
next
|
||||
edit 3
|
||||
set category 86
|
||||
set level high
|
||||
next
|
||||
edit 4
|
||||
set category 1
|
||||
set level medium
|
||||
next
|
||||
edit 5
|
||||
set category 3
|
||||
set level medium
|
||||
next
|
||||
edit 6
|
||||
set category 4
|
||||
set level medium
|
||||
next
|
||||
edit 7
|
||||
set category 5
|
||||
set level medium
|
||||
next
|
||||
edit 8
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
edit 9
|
||||
set category 12
|
||||
set level medium
|
||||
next
|
||||
edit 10
|
||||
set category 59
|
||||
set level medium
|
||||
next
|
||||
edit 11
|
||||
set category 62
|
||||
set level medium
|
||||
next
|
||||
edit 12
|
||||
set category 83
|
||||
set level medium
|
||||
next
|
||||
edit 13
|
||||
set category 72
|
||||
next
|
||||
edit 14
|
||||
set category 14
|
||||
next
|
||||
edit 15
|
||||
set category 96
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
config application
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
end
|
||||
config log memory setting
|
||||
set status enable
|
||||
end
|
||||
config log disk setting
|
||||
set status disable
|
||||
end
|
||||
config log null-device setting
|
||||
set status disable
|
||||
end
|
||||
96
configs/fortigate/vdom_Policy/router.cfg
Normal file
96
configs/fortigate/vdom_Policy/router.cfg
Normal file
@ -0,0 +1,96 @@
|
||||
config router rip
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ripng
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ospf
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ospf6
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router bgp
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
config redistribute6 "isis"
|
||||
end
|
||||
end
|
||||
config router isis
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "bgp"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
end
|
||||
config router multicast
|
||||
end
|
||||
end
|
||||
|
||||
224
configs/fortigate/vdom_Policy/switch-controller.cfg
Normal file
224
configs/fortigate/vdom_Policy/switch-controller.cfg
Normal file
@ -0,0 +1,224 @@
|
||||
config switch-controller traffic-policy
|
||||
edit "quarantine"
|
||||
set description "Rate control for quarantined traffic"
|
||||
set guaranteed-bandwidth 163840
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
edit "sniffer"
|
||||
set description "Rate control for sniffer mirrored traffic"
|
||||
set guaranteed-bandwidth 50000
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy 802-1X
|
||||
edit "802-1X-policy-default"
|
||||
set user-group "SSO_Guest_Users"
|
||||
set mac-auth-bypass disable
|
||||
set open-auth disable
|
||||
set eap-passthru enable
|
||||
set eap-auto-untagged-vlans enable
|
||||
set guest-vlan disable
|
||||
set auth-fail-vlan disable
|
||||
set framevid-apply enable
|
||||
set radius-timeout-overwrite disable
|
||||
set authserver-timeout-vlan disable
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy local-access
|
||||
edit "default"
|
||||
set mgmt-allowaccess https ping ssh
|
||||
set internal-allowaccess https ping ssh
|
||||
next
|
||||
end
|
||||
config switch-controller lldp-profile
|
||||
edit "default"
|
||||
set med-tlvs inventory-management network-policy location-identification
|
||||
set auto-isl disable
|
||||
config med-network-policy
|
||||
edit "voice"
|
||||
next
|
||||
edit "voice-signaling"
|
||||
next
|
||||
edit "guest-voice"
|
||||
next
|
||||
edit "guest-voice-signaling"
|
||||
next
|
||||
edit "softphone-voice"
|
||||
next
|
||||
edit "video-conferencing"
|
||||
next
|
||||
edit "streaming-video"
|
||||
next
|
||||
edit "video-signaling"
|
||||
next
|
||||
end
|
||||
config med-location-service
|
||||
edit "coordinates"
|
||||
next
|
||||
edit "address-civic"
|
||||
next
|
||||
edit "elin-number"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "default-auto-isl"
|
||||
next
|
||||
edit "default-auto-mclag-icl"
|
||||
set auto-mclag-icl enable
|
||||
next
|
||||
end
|
||||
config switch-controller qos dot1p-map
|
||||
edit "voice-dot1p"
|
||||
set priority-0 queue-4
|
||||
set priority-1 queue-4
|
||||
set priority-2 queue-3
|
||||
set priority-3 queue-2
|
||||
set priority-4 queue-3
|
||||
set priority-5 queue-1
|
||||
set priority-6 queue-2
|
||||
set priority-7 queue-2
|
||||
next
|
||||
end
|
||||
config switch-controller qos ip-dscp-map
|
||||
edit "voice-dscp"
|
||||
config map
|
||||
edit "1"
|
||||
set cos-queue 1
|
||||
set value 46
|
||||
next
|
||||
edit "2"
|
||||
set cos-queue 2
|
||||
set value 24,26,48,56
|
||||
next
|
||||
edit "5"
|
||||
set cos-queue 3
|
||||
set value 34
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos queue-policy
|
||||
edit "default"
|
||||
set schedule round-robin
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
next
|
||||
edit "queue-2"
|
||||
next
|
||||
edit "queue-3"
|
||||
next
|
||||
edit "queue-4"
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "voice-egress"
|
||||
set schedule weighted
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
set weight 0
|
||||
next
|
||||
edit "queue-2"
|
||||
set weight 6
|
||||
next
|
||||
edit "queue-3"
|
||||
set weight 37
|
||||
next
|
||||
edit "queue-4"
|
||||
set weight 12
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos qos-policy
|
||||
edit "default"
|
||||
next
|
||||
edit "voice-qos"
|
||||
set trust-dot1p-map "voice-dot1p"
|
||||
set trust-ip-dscp-map "voice-dscp"
|
||||
set queue-policy "voice-egress"
|
||||
next
|
||||
end
|
||||
config switch-controller storm-control-policy
|
||||
edit "default"
|
||||
set description "default storm control on all port"
|
||||
next
|
||||
edit "auto-config"
|
||||
set description "storm control policy for fortilink-isl-icl port"
|
||||
set storm-control-mode disabled
|
||||
next
|
||||
end
|
||||
config switch-controller auto-config policy
|
||||
edit "default"
|
||||
next
|
||||
edit "default-icl"
|
||||
set poe-status disable
|
||||
set igmp-flood-report enable
|
||||
set igmp-flood-traffic enable
|
||||
next
|
||||
end
|
||||
config switch-controller initial-config template
|
||||
edit "_default"
|
||||
set vlanid 1
|
||||
next
|
||||
edit "quarantine"
|
||||
set vlanid 4093
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "rspan"
|
||||
set vlanid 4092
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "voice"
|
||||
set vlanid 4091
|
||||
next
|
||||
edit "video"
|
||||
set vlanid 4090
|
||||
next
|
||||
edit "onboarding"
|
||||
set vlanid 4089
|
||||
next
|
||||
edit "nac_segment"
|
||||
set vlanid 4088
|
||||
set dhcp-server enable
|
||||
next
|
||||
end
|
||||
config switch-controller switch-profile
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config switch-controller ptp settings
|
||||
set mode disable
|
||||
end
|
||||
config switch-controller ptp policy
|
||||
edit "default"
|
||||
set status enable
|
||||
next
|
||||
end
|
||||
config switch-controller remote-log
|
||||
edit "syslogd"
|
||||
next
|
||||
edit "syslogd2"
|
||||
next
|
||||
end
|
||||
90
configs/fortigate/vdom_Policy/system.cfg
Normal file
90
configs/fortigate/vdom_Policy/system.cfg
Normal file
@ -0,0 +1,90 @@
|
||||
config system object-tagging
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config system settings
|
||||
set comments "Test VDOM for Policy-based"
|
||||
set ngfw-mode policy-based
|
||||
set h323-direct-model enable
|
||||
end
|
||||
config system replacemsg-group
|
||||
edit "default"
|
||||
set comment "Default replacement message group."
|
||||
next
|
||||
end
|
||||
config system sdwan
|
||||
config zone
|
||||
edit "virtual-wan-link"
|
||||
next
|
||||
end
|
||||
config health-check
|
||||
edit "Default_DNS"
|
||||
set system-dns enable
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Office_365"
|
||||
set server "www.office.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Gmail"
|
||||
set server "gmail.com"
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 2
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Google Search"
|
||||
set server "www.google.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_FortiGuard"
|
||||
set server "fortiguard.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
end
|
||||
7
configs/fortigate/vdom_Policy/user.cfg
Normal file
7
configs/fortigate/vdom_Policy/user.cfg
Normal file
@ -0,0 +1,7 @@
|
||||
config user setting
|
||||
set auth-cert "Fortinet_Factory"
|
||||
end
|
||||
config user group
|
||||
edit "SSO_Guest_Users"
|
||||
next
|
||||
end
|
||||
299
configs/fortigate/vdom_Policy/vpn.cfg
Normal file
299
configs/fortigate/vdom_Policy/vpn.cfg
Normal file
@ -0,0 +1,299 @@
|
||||
config vpn certificate ca
|
||||
end
|
||||
config vpn certificate local
|
||||
edit "Fortinet_CA_SSL"
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_CA_Untrusted"
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA1024"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA2048"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA4096"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA1024"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA2048"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA256"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA384"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA521"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED25519"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED448"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
end
|
||||
config vpn ssl web host-check-software
|
||||
edit "FortiClient-AV"
|
||||
set guid "1A0271D5-3D4F-46DB-0C2C-AB37BA90D9F7"
|
||||
next
|
||||
edit "FortiClient-FW"
|
||||
set type fw
|
||||
set guid "528CB157-D384-4593-AAAA-E42DFF111CED"
|
||||
next
|
||||
edit "FortiClient-AV-Vista"
|
||||
set guid "385618A6-2256-708E-3FB9-7E98B93F91F9"
|
||||
next
|
||||
edit "FortiClient-FW-Vista"
|
||||
set type fw
|
||||
set guid "006D9983-6839-71D6-14E6-D7AD47ECD682"
|
||||
next
|
||||
edit "FortiClient5-AV"
|
||||
set guid "5EEDDB8C-C27A-6714-3657-DBD811D1F1B7"
|
||||
next
|
||||
edit "AVG-Internet-Security-AV"
|
||||
set guid "17DDD097-36FF-435F-9E1B-52D74245D6BF"
|
||||
next
|
||||
edit "AVG-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "8DECF618-9569-4340-B34A-D78D28969B66"
|
||||
next
|
||||
edit "AVG-Internet-Security-AV-Vista-Win7"
|
||||
set guid "0C939084-9E57-CBDB-EA61-0B0C7F62AF82"
|
||||
next
|
||||
edit "AVG-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "34A811A1-D438-CA83-C13E-A23981B1E8F9"
|
||||
next
|
||||
edit "CA-Anti-Virus"
|
||||
set guid "17CFD1EA-56CF-40B5-A06B-BD3A27397C93"
|
||||
next
|
||||
edit "CA-Internet-Security-AV"
|
||||
set guid "6B98D35F-BB76-41C0-876B-A50645ED099A"
|
||||
next
|
||||
edit "CA-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "38102F93-1B6E-4922-90E1-A35D8DC6DAA3"
|
||||
next
|
||||
edit "CA-Internet-Security-AV-Vista-Win7"
|
||||
set guid "3EED0195-0A4B-4EF3-CC4F-4F401BDC245F"
|
||||
next
|
||||
edit "CA-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "06D680B0-4024-4FAB-E710-E675E50F6324"
|
||||
next
|
||||
edit "CA-Personal-Firewall"
|
||||
set type fw
|
||||
set guid "14CB4B80-8E52-45EA-905E-67C1267B4160"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-AV"
|
||||
set guid "E7512ED5-4245-4B4D-AF3A-382D3F313F15"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "D4747503-0346-49EB-9262-997542F79BF4"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-AV-Vista-Win7"
|
||||
set guid "15414183-282E-D62C-CA37-EF24860A2F17"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "2D7AC0A6-6241-D774-E168-461178D9686C"
|
||||
next
|
||||
edit "Kaspersky-AV"
|
||||
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
|
||||
next
|
||||
edit "Kaspersky-FW"
|
||||
set type fw
|
||||
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
|
||||
next
|
||||
edit "Kaspersky-AV-Vista-Win7"
|
||||
set guid "AE1D740B-8F0F-D137-211D-873D44B3F4AE"
|
||||
next
|
||||
edit "Kaspersky-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "9626F52E-C560-D06F-0A42-2E08BA60B3D5"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-AV"
|
||||
set guid "84B5EE75-6421-4CDE-A33A-DD43BA9FAD83"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-FW"
|
||||
set type fw
|
||||
set guid "94894B63-8C7F-4050-BDA4-813CA00DA3E8"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-AV-Vista-Win7"
|
||||
set guid "86355677-4064-3EA7-ABB3-1B136EB04637"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "BE0ED752-0A0B-3FFF-80EC-B2269063014C"
|
||||
next
|
||||
edit "McAfee-Virus-Scan-Enterprise"
|
||||
set guid "918A2B0B-2C60-4016-A4AB-E868DEABF7F0"
|
||||
next
|
||||
edit "Norton-360-2.0-AV"
|
||||
set guid "A5F1BC7C-EA33-4247-961C-0217208396C4"
|
||||
next
|
||||
edit "Norton-360-2.0-FW"
|
||||
set type fw
|
||||
set guid "371C0A40-5A0C-4AD2-A6E5-69C02037FBF3"
|
||||
next
|
||||
edit "Norton-360-3.0-AV"
|
||||
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
|
||||
next
|
||||
edit "Norton-360-3.0-FW"
|
||||
set type fw
|
||||
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
|
||||
next
|
||||
edit "Norton-Internet-Security-AV"
|
||||
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
|
||||
next
|
||||
edit "Norton-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
|
||||
next
|
||||
edit "Norton-Internet-Security-AV-Vista-Win7"
|
||||
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
|
||||
next
|
||||
edit "Norton-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-AV"
|
||||
set guid "FB06448E-52B8-493A-90F3-E43226D3305C"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-FW"
|
||||
set type fw
|
||||
set guid "BE898FE3-CD0B-4014-85A9-03DB9923DDB6"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-AV-Vista-Win7"
|
||||
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
|
||||
next
|
||||
edit "Panda-Antivirus+Firewall-2008-AV"
|
||||
set guid "EEE2D94A-D4C1-421A-AB2C-2CE8FE51747A"
|
||||
next
|
||||
edit "Panda-Antivirus+Firewall-2008-FW"
|
||||
set type fw
|
||||
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
|
||||
next
|
||||
edit "Panda-Internet-Security-AV"
|
||||
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
|
||||
next
|
||||
edit "Panda-Internet-Security-2006~2007-FW"
|
||||
set type fw
|
||||
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
|
||||
next
|
||||
edit "Panda-Internet-Security-2008~2009-FW"
|
||||
set type fw
|
||||
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
|
||||
next
|
||||
edit "Sophos-Anti-Virus"
|
||||
set guid "3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-FW"
|
||||
set type fw
|
||||
set guid "0786E95E-326A-4524-9691-41EF88FB52EA"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-AV-Vista-Win7"
|
||||
set guid "479CCF92-4960-B3E0-7373-BF453B467D2C"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "7FA74EB7-030F-B2B8-582C-1670C5953A57"
|
||||
next
|
||||
edit "Trend-Micro-AV"
|
||||
set guid "7D2296BC-32CC-4519-917E-52E652474AF5"
|
||||
next
|
||||
edit "Trend-Micro-FW"
|
||||
set type fw
|
||||
set guid "3E790E9E-6A5D-4303-A7F9-185EC20F3EB6"
|
||||
next
|
||||
edit "Trend-Micro-AV-Vista-Win7"
|
||||
set guid "48929DFC-7A52-A34F-8351-C4DBEDBD9C50"
|
||||
next
|
||||
edit "Trend-Micro-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "70A91CD9-303D-A217-A80E-6DEE136EDB2B"
|
||||
next
|
||||
edit "ZoneAlarm-AV"
|
||||
set guid "5D467B10-818C-4CAB-9FF7-6893B5B8F3CF"
|
||||
next
|
||||
edit "ZoneAlarm-FW"
|
||||
set type fw
|
||||
set guid "829BDA32-94B3-44F4-8446-F8FCFF809F8B"
|
||||
next
|
||||
edit "ZoneAlarm-AV-Vista-Win7"
|
||||
set guid "D61596DF-D219-341C-49B3-AD30538CBC5B"
|
||||
next
|
||||
edit "ZoneAlarm-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "EE2E17FA-9876-3544-62EC-0405AD5FFB20"
|
||||
next
|
||||
edit "ESET-Smart-Security-AV"
|
||||
set guid "19259FAE-8396-A113-46DB-15B0E7DFA289"
|
||||
next
|
||||
edit "ESET-Smart-Security-FW"
|
||||
set type fw
|
||||
set guid "211E1E8B-C9F9-A04B-6D84-BC85190CE5F2"
|
||||
next
|
||||
end
|
||||
config vpn ssl web portal
|
||||
edit "full-access"
|
||||
set tunnel-mode enable
|
||||
set ipv6-tunnel-mode enable
|
||||
set web-mode enable
|
||||
set ip-pools "SSLVPN_TUNNEL_ADDR1"
|
||||
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
|
||||
next
|
||||
edit "web-access"
|
||||
set web-mode enable
|
||||
next
|
||||
edit "tunnel-access"
|
||||
set tunnel-mode enable
|
||||
set ipv6-tunnel-mode enable
|
||||
set ip-pools "SSLVPN_TUNNEL_ADDR1"
|
||||
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
|
||||
next
|
||||
end
|
||||
config vpn ssl settings
|
||||
set servercert "Fortinet_Factory"
|
||||
set port 443
|
||||
end
|
||||
106
configs/fortigate/vdom_Policy/waf.cfg
Normal file
106
configs/fortigate/vdom_Policy/waf.cfg
Normal file
@ -0,0 +1,106 @@
|
||||
config waf profile
|
||||
edit "default"
|
||||
config signature
|
||||
config main-class 100000000
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 20000000
|
||||
end
|
||||
config main-class 30000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 40000000
|
||||
end
|
||||
config main-class 50000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 60000000
|
||||
end
|
||||
config main-class 70000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 80000000
|
||||
set status enable
|
||||
set severity low
|
||||
end
|
||||
config main-class 110000000
|
||||
set status enable
|
||||
set severity high
|
||||
end
|
||||
config main-class 90000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
set disabled-signature 80080005 80200001 60030001 60120001 80080003 90410001 90410002
|
||||
end
|
||||
config constraint
|
||||
config header-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config content-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config line-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config url-param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config version
|
||||
set log enable
|
||||
end
|
||||
config method
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config hostname
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config malformed
|
||||
set log enable
|
||||
end
|
||||
config max-cookie
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-header-line
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-url-param
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-range-segment
|
||||
set status enable
|
||||
set log enable
|
||||
set severity high
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_Policy/wanopt.cfg
Normal file
8
configs/fortigate/vdom_Policy/wanopt.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config wanopt settings
|
||||
set host-id "default-id"
|
||||
end
|
||||
config wanopt profile
|
||||
edit "default"
|
||||
set comments "Default WANopt profile."
|
||||
next
|
||||
end
|
||||
3
configs/fortigate/vdom_Policy/web-proxy.cfg
Normal file
3
configs/fortigate/vdom_Policy/web-proxy.cfg
Normal file
@ -0,0 +1,3 @@
|
||||
config web-proxy global
|
||||
set proxy-fqdn "default.fqdn"
|
||||
end
|
||||
129
configs/fortigate/vdom_Policy/webfilter.cfg
Normal file
129
configs/fortigate/vdom_Policy/webfilter.cfg
Normal file
@ -0,0 +1,129 @@
|
||||
config webfilter ftgd-local-cat
|
||||
edit "custom1"
|
||||
set id 140
|
||||
next
|
||||
edit "custom2"
|
||||
set id 141
|
||||
next
|
||||
end
|
||||
config webfilter ips-urlfilter-setting
|
||||
end
|
||||
config webfilter ips-urlfilter-setting6
|
||||
end
|
||||
config webfilter profile
|
||||
edit "g-default"
|
||||
set comment "Default web filtering."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor web traffic."
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set options block-invalid-url
|
||||
next
|
||||
end
|
||||
config webfilter search-engine
|
||||
edit "g-baidu"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/s?\\?"
|
||||
set query "wd="
|
||||
next
|
||||
edit "g-baidu2"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/(ns|q|m|i|v)\\?"
|
||||
set query "word="
|
||||
next
|
||||
edit "g-baidu3"
|
||||
set hostname "tieba\\.baidu\\.com"
|
||||
set url "^\\/f\\?"
|
||||
set query "kw="
|
||||
next
|
||||
edit "g-bing"
|
||||
set hostname ".*\\.bing\\..*"
|
||||
set url "^(\\/images|\\/videos)?(\\/search|\\/async|\\/asyncv2)\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-google"
|
||||
set hostname ".*\\.google\\..*"
|
||||
set url "^\\/((custom|search|images|videosearch|webhp)\\?)"
|
||||
set query "q="
|
||||
set safesearch url
|
||||
set safesearch-str "&safe=active"
|
||||
next
|
||||
edit "g-google-translate-1"
|
||||
set hostname "translate\\.google\\..*"
|
||||
set url "^\\/translate"
|
||||
set query "u="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-google-translate-2"
|
||||
set hostname ".*\\.translate\\.goog"
|
||||
set url "^\\/"
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-twitter"
|
||||
set hostname "twitter\\.com"
|
||||
set url "^\\/i\\/api\\/graphql\\/.*\\/UserByScreenName"
|
||||
set query "variables="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-vimeo"
|
||||
set hostname ".*vimeo.*"
|
||||
set url "^\\/search\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yahoo"
|
||||
set hostname ".*\\.yahoo\\..*"
|
||||
set url "^\\/search(\\/video|\\/images){0,1}(\\?|;)"
|
||||
set query "p="
|
||||
set safesearch url
|
||||
set safesearch-str "&vm=r"
|
||||
next
|
||||
edit "g-yandex"
|
||||
set hostname "yandex\\..*"
|
||||
set url "^\\/((yand|images\\/|video\\/)(search)|search\\/)\\?"
|
||||
set query "text="
|
||||
set safesearch url
|
||||
set safesearch-str "&family=yes"
|
||||
next
|
||||
edit "g-youtube"
|
||||
set hostname ".*youtube.*"
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yt-channel"
|
||||
set url "www.youtube.com/channel"
|
||||
set safesearch yt-channel
|
||||
next
|
||||
edit "g-yt-pattern"
|
||||
set url "youtube.com/channel/"
|
||||
set safesearch yt-pattern
|
||||
next
|
||||
edit "g-yt-scan-1"
|
||||
set url "www.youtube.com/user/"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-2"
|
||||
set url "www.youtube.com/youtubei/v1/browse"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-3"
|
||||
set url "www.youtube.com/youtubei/v1/player"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-4"
|
||||
set url "www.youtube.com/youtubei/v1/navigator"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "translate"
|
||||
set hostname "translate\\.google\\..*"
|
||||
set url "^\\/translate\\?"
|
||||
set query "u="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "yt-video"
|
||||
set url "www.youtube.com/watch"
|
||||
set safesearch yt-video
|
||||
next
|
||||
end
|
||||
43
configs/fortigate/vdom_Policy/wireless-controller.cfg
Normal file
43
configs/fortigate/vdom_Policy/wireless-controller.cfg
Normal file
@ -0,0 +1,43 @@
|
||||
config wireless-controller setting
|
||||
set darrp-optimize-schedules "default-darrp-optimize"
|
||||
end
|
||||
config wireless-controller arrp-profile
|
||||
edit "arrp-default"
|
||||
next
|
||||
end
|
||||
config wireless-controller wids-profile
|
||||
edit "default"
|
||||
set comment "Default WIDS profile."
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
set wireless-bridge enable
|
||||
set deauth-broadcast enable
|
||||
set null-ssid-probe-resp enable
|
||||
set long-duration-attack enable
|
||||
set invalid-mac-oui enable
|
||||
set weak-wep-iv enable
|
||||
set auth-frame-flood enable
|
||||
set assoc-frame-flood enable
|
||||
set spoofed-deauth enable
|
||||
set asleap-attack enable
|
||||
set eapol-start-flood enable
|
||||
set eapol-logoff-flood enable
|
||||
set eapol-succ-flood enable
|
||||
set eapol-fail-flood enable
|
||||
set eapol-pre-succ-flood enable
|
||||
set eapol-pre-fail-flood enable
|
||||
next
|
||||
edit "default-wids-apscan-enabled"
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
next
|
||||
end
|
||||
config wireless-controller ble-profile
|
||||
edit "fortiap-discovery"
|
||||
set advertising ibeacon eddystone-uid eddystone-url
|
||||
next
|
||||
end
|
||||
75
configs/fortigate/vdom_TEST/antivirus.cfg
Normal file
75
configs/fortigate/vdom_TEST/antivirus.cfg
Normal file
@ -0,0 +1,75 @@
|
||||
config antivirus settings
|
||||
set machine-learning-detection enable
|
||||
set grayware enable
|
||||
end
|
||||
config antivirus profile
|
||||
edit "g-default"
|
||||
set comment "Scan files and block viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Scan files and monitor viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
end
|
||||
29
configs/fortigate/vdom_TEST/application.cfg
Normal file
29
configs/fortigate/vdom_TEST/application.cfg
Normal file
@ -0,0 +1,29 @@
|
||||
config application list
|
||||
edit "g-default"
|
||||
set comment "Monitor all applications."
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor all applications."
|
||||
unset options
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set deep-app-inspection disable
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
81
configs/fortigate/vdom_TEST/dlp.cfg
Normal file
81
configs/fortigate/vdom_TEST/dlp.cfg
Normal file
@ -0,0 +1,81 @@
|
||||
config dlp filepattern
|
||||
edit 1
|
||||
set name "builtin-patterns"
|
||||
config entries
|
||||
edit "*.bat"
|
||||
next
|
||||
edit "*.com"
|
||||
next
|
||||
edit "*.dll"
|
||||
next
|
||||
edit "*.doc"
|
||||
next
|
||||
edit "*.exe"
|
||||
next
|
||||
edit "*.gz"
|
||||
next
|
||||
edit "*.hta"
|
||||
next
|
||||
edit "*.ppt"
|
||||
next
|
||||
edit "*.rar"
|
||||
next
|
||||
edit "*.scr"
|
||||
next
|
||||
edit "*.tar"
|
||||
next
|
||||
edit "*.tgz"
|
||||
next
|
||||
edit "*.vb?"
|
||||
next
|
||||
edit "*.wps"
|
||||
next
|
||||
edit "*.xl?"
|
||||
next
|
||||
edit "*.zip"
|
||||
next
|
||||
edit "*.pif"
|
||||
next
|
||||
edit "*.cpl"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit 2
|
||||
set name "all_executables"
|
||||
config entries
|
||||
edit "bat"
|
||||
set filter-type type
|
||||
set file-type bat
|
||||
next
|
||||
edit "exe"
|
||||
set filter-type type
|
||||
set file-type exe
|
||||
next
|
||||
edit "elf"
|
||||
set filter-type type
|
||||
set file-type elf
|
||||
next
|
||||
edit "hta"
|
||||
set filter-type type
|
||||
set file-type hta
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config dlp sensitivity
|
||||
edit "Private"
|
||||
next
|
||||
edit "Critical"
|
||||
next
|
||||
edit "Warning"
|
||||
next
|
||||
end
|
||||
config dlp sensor
|
||||
edit "g-default"
|
||||
set comment "Default sensor."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Log a summary of email and web traffic."
|
||||
set summary-proto smtp pop3 imap http-get http-post
|
||||
next
|
||||
end
|
||||
84
configs/fortigate/vdom_TEST/dnsfilter.cfg
Normal file
84
configs/fortigate/vdom_TEST/dnsfilter.cfg
Normal file
@ -0,0 +1,84 @@
|
||||
config dnsfilter profile
|
||||
edit "default"
|
||||
set comment "Default dns filtering."
|
||||
config ftgd-dns
|
||||
config filters
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 7
|
||||
next
|
||||
edit 3
|
||||
set category 8
|
||||
next
|
||||
edit 4
|
||||
set category 9
|
||||
next
|
||||
edit 5
|
||||
set category 11
|
||||
next
|
||||
edit 6
|
||||
set category 12
|
||||
next
|
||||
edit 7
|
||||
set category 13
|
||||
next
|
||||
edit 8
|
||||
set category 14
|
||||
next
|
||||
edit 9
|
||||
set category 15
|
||||
next
|
||||
edit 10
|
||||
set category 16
|
||||
next
|
||||
edit 11
|
||||
next
|
||||
edit 12
|
||||
set category 57
|
||||
next
|
||||
edit 13
|
||||
set category 63
|
||||
next
|
||||
edit 14
|
||||
set category 64
|
||||
next
|
||||
edit 15
|
||||
set category 65
|
||||
next
|
||||
edit 16
|
||||
set category 66
|
||||
next
|
||||
edit 17
|
||||
set category 67
|
||||
next
|
||||
edit 18
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
set block-botnet enable
|
||||
next
|
||||
end
|
||||
20
configs/fortigate/vdom_TEST/emailfilter.cfg
Normal file
20
configs/fortigate/vdom_TEST/emailfilter.cfg
Normal file
@ -0,0 +1,20 @@
|
||||
config emailfilter profile
|
||||
edit "default"
|
||||
set comment "Malware and phishing URL filtering."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
edit "sniffer-profile"
|
||||
set comment "Malware and phishing URL monitoring."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_TEST/file-filter.cfg
Normal file
8
configs/fortigate/vdom_TEST/file-filter.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config file-filter profile
|
||||
edit "g-default"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
end
|
||||
1229
configs/fortigate/vdom_TEST/firewall.cfg
Normal file
1229
configs/fortigate/vdom_TEST/firewall.cfg
Normal file
File diff suppressed because it is too large
Load Diff
14
configs/fortigate/vdom_TEST/icap.cfg
Normal file
14
configs/fortigate/vdom_TEST/icap.cfg
Normal file
@ -0,0 +1,14 @@
|
||||
config icap profile
|
||||
edit "default"
|
||||
config icap-headers
|
||||
edit 1
|
||||
set name "X-Authenticated-User"
|
||||
set content "$user"
|
||||
next
|
||||
edit 2
|
||||
set name "X-Authenticated-Groups"
|
||||
set content "$local_grp"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
39
configs/fortigate/vdom_TEST/ips.cfg
Normal file
39
configs/fortigate/vdom_TEST/ips.cfg
Normal file
@ -0,0 +1,39 @@
|
||||
config ips sensor
|
||||
edit "g-default"
|
||||
set comment "Prevent critical attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor IPS attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "IPS_Test"
|
||||
set block-malicious-url enable
|
||||
set scan-botnet-connections block
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
set action block
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "gdd-botnet C&C IP blocking"
|
||||
set comment "This allows you to enable botnet blocking across all traffic that matches the policy by configuring one setting in the GUI"
|
||||
next
|
||||
end
|
||||
80
configs/fortigate/vdom_TEST/log.cfg
Normal file
80
configs/fortigate/vdom_TEST/log.cfg
Normal file
@ -0,0 +1,80 @@
|
||||
config log threat-weight
|
||||
config web
|
||||
edit 1
|
||||
set category 26
|
||||
set level high
|
||||
next
|
||||
edit 2
|
||||
set category 61
|
||||
set level high
|
||||
next
|
||||
edit 3
|
||||
set category 86
|
||||
set level high
|
||||
next
|
||||
edit 4
|
||||
set category 1
|
||||
set level medium
|
||||
next
|
||||
edit 5
|
||||
set category 3
|
||||
set level medium
|
||||
next
|
||||
edit 6
|
||||
set category 4
|
||||
set level medium
|
||||
next
|
||||
edit 7
|
||||
set category 5
|
||||
set level medium
|
||||
next
|
||||
edit 8
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
edit 9
|
||||
set category 12
|
||||
set level medium
|
||||
next
|
||||
edit 10
|
||||
set category 59
|
||||
set level medium
|
||||
next
|
||||
edit 11
|
||||
set category 62
|
||||
set level medium
|
||||
next
|
||||
edit 12
|
||||
set category 83
|
||||
set level medium
|
||||
next
|
||||
edit 13
|
||||
set category 72
|
||||
next
|
||||
edit 14
|
||||
set category 14
|
||||
next
|
||||
edit 15
|
||||
set category 96
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
config application
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
end
|
||||
config log memory setting
|
||||
set status enable
|
||||
end
|
||||
config log disk setting
|
||||
set status disable
|
||||
end
|
||||
config log null-device setting
|
||||
set status disable
|
||||
end
|
||||
96
configs/fortigate/vdom_TEST/router.cfg
Normal file
96
configs/fortigate/vdom_TEST/router.cfg
Normal file
@ -0,0 +1,96 @@
|
||||
config router rip
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ripng
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ospf
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ospf6
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router bgp
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
config redistribute6 "isis"
|
||||
end
|
||||
end
|
||||
config router isis
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "bgp"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
end
|
||||
config router multicast
|
||||
end
|
||||
end
|
||||
|
||||
224
configs/fortigate/vdom_TEST/switch-controller.cfg
Normal file
224
configs/fortigate/vdom_TEST/switch-controller.cfg
Normal file
@ -0,0 +1,224 @@
|
||||
config switch-controller traffic-policy
|
||||
edit "quarantine"
|
||||
set description "Rate control for quarantined traffic"
|
||||
set guaranteed-bandwidth 163840
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
edit "sniffer"
|
||||
set description "Rate control for sniffer mirrored traffic"
|
||||
set guaranteed-bandwidth 50000
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy 802-1X
|
||||
edit "802-1X-policy-default"
|
||||
set user-group "SSO_Guest_Users"
|
||||
set mac-auth-bypass disable
|
||||
set open-auth disable
|
||||
set eap-passthru enable
|
||||
set eap-auto-untagged-vlans enable
|
||||
set guest-vlan disable
|
||||
set auth-fail-vlan disable
|
||||
set framevid-apply enable
|
||||
set radius-timeout-overwrite disable
|
||||
set authserver-timeout-vlan disable
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy local-access
|
||||
edit "default"
|
||||
set mgmt-allowaccess https ping ssh
|
||||
set internal-allowaccess https ping ssh
|
||||
next
|
||||
end
|
||||
config switch-controller lldp-profile
|
||||
edit "default"
|
||||
set med-tlvs inventory-management network-policy location-identification
|
||||
set auto-isl disable
|
||||
config med-network-policy
|
||||
edit "voice"
|
||||
next
|
||||
edit "voice-signaling"
|
||||
next
|
||||
edit "guest-voice"
|
||||
next
|
||||
edit "guest-voice-signaling"
|
||||
next
|
||||
edit "softphone-voice"
|
||||
next
|
||||
edit "video-conferencing"
|
||||
next
|
||||
edit "streaming-video"
|
||||
next
|
||||
edit "video-signaling"
|
||||
next
|
||||
end
|
||||
config med-location-service
|
||||
edit "coordinates"
|
||||
next
|
||||
edit "address-civic"
|
||||
next
|
||||
edit "elin-number"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "default-auto-isl"
|
||||
next
|
||||
edit "default-auto-mclag-icl"
|
||||
set auto-mclag-icl enable
|
||||
next
|
||||
end
|
||||
config switch-controller qos dot1p-map
|
||||
edit "voice-dot1p"
|
||||
set priority-0 queue-4
|
||||
set priority-1 queue-4
|
||||
set priority-2 queue-3
|
||||
set priority-3 queue-2
|
||||
set priority-4 queue-3
|
||||
set priority-5 queue-1
|
||||
set priority-6 queue-2
|
||||
set priority-7 queue-2
|
||||
next
|
||||
end
|
||||
config switch-controller qos ip-dscp-map
|
||||
edit "voice-dscp"
|
||||
config map
|
||||
edit "1"
|
||||
set cos-queue 1
|
||||
set value 46
|
||||
next
|
||||
edit "2"
|
||||
set cos-queue 2
|
||||
set value 24,26,48,56
|
||||
next
|
||||
edit "5"
|
||||
set cos-queue 3
|
||||
set value 34
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos queue-policy
|
||||
edit "default"
|
||||
set schedule round-robin
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
next
|
||||
edit "queue-2"
|
||||
next
|
||||
edit "queue-3"
|
||||
next
|
||||
edit "queue-4"
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "voice-egress"
|
||||
set schedule weighted
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
set weight 0
|
||||
next
|
||||
edit "queue-2"
|
||||
set weight 6
|
||||
next
|
||||
edit "queue-3"
|
||||
set weight 37
|
||||
next
|
||||
edit "queue-4"
|
||||
set weight 12
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos qos-policy
|
||||
edit "default"
|
||||
next
|
||||
edit "voice-qos"
|
||||
set trust-dot1p-map "voice-dot1p"
|
||||
set trust-ip-dscp-map "voice-dscp"
|
||||
set queue-policy "voice-egress"
|
||||
next
|
||||
end
|
||||
config switch-controller storm-control-policy
|
||||
edit "default"
|
||||
set description "default storm control on all port"
|
||||
next
|
||||
edit "auto-config"
|
||||
set description "storm control policy for fortilink-isl-icl port"
|
||||
set storm-control-mode disabled
|
||||
next
|
||||
end
|
||||
config switch-controller auto-config policy
|
||||
edit "default"
|
||||
next
|
||||
edit "default-icl"
|
||||
set poe-status disable
|
||||
set igmp-flood-report enable
|
||||
set igmp-flood-traffic enable
|
||||
next
|
||||
end
|
||||
config switch-controller initial-config template
|
||||
edit "_default"
|
||||
set vlanid 1
|
||||
next
|
||||
edit "quarantine"
|
||||
set vlanid 4093
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "rspan"
|
||||
set vlanid 4092
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "voice"
|
||||
set vlanid 4091
|
||||
next
|
||||
edit "video"
|
||||
set vlanid 4090
|
||||
next
|
||||
edit "onboarding"
|
||||
set vlanid 4089
|
||||
next
|
||||
edit "nac_segment"
|
||||
set vlanid 4088
|
||||
set dhcp-server enable
|
||||
next
|
||||
end
|
||||
config switch-controller switch-profile
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config switch-controller ptp settings
|
||||
set mode disable
|
||||
end
|
||||
config switch-controller ptp policy
|
||||
edit "default"
|
||||
set status enable
|
||||
next
|
||||
end
|
||||
config switch-controller remote-log
|
||||
edit "syslogd"
|
||||
next
|
||||
edit "syslogd2"
|
||||
next
|
||||
end
|
||||
97
configs/fortigate/vdom_TEST/system.cfg
Normal file
97
configs/fortigate/vdom_TEST/system.cfg
Normal file
@ -0,0 +1,97 @@
|
||||
config system object-tagging
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config system settings
|
||||
set h323-direct-model enable
|
||||
set gui-advanced-policy enable
|
||||
end
|
||||
config system replacemsg-group
|
||||
edit "default"
|
||||
set comment "Default replacement message group."
|
||||
next
|
||||
end
|
||||
config system zone
|
||||
edit "Outside_Zone"
|
||||
set interface "port10"
|
||||
next
|
||||
edit "Inside_Zone"
|
||||
set interface "port9"
|
||||
next
|
||||
end
|
||||
config system sdwan
|
||||
config zone
|
||||
edit "virtual-wan-link"
|
||||
next
|
||||
end
|
||||
config health-check
|
||||
edit "Default_DNS"
|
||||
set system-dns enable
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Office_365"
|
||||
set server "www.office.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Gmail"
|
||||
set server "gmail.com"
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 2
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Google Search"
|
||||
set server "www.google.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_FortiGuard"
|
||||
set server "fortiguard.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
end
|
||||
7
configs/fortigate/vdom_TEST/user.cfg
Normal file
7
configs/fortigate/vdom_TEST/user.cfg
Normal file
@ -0,0 +1,7 @@
|
||||
config user setting
|
||||
set auth-cert "Fortinet_Factory"
|
||||
end
|
||||
config user group
|
||||
edit "SSO_Guest_Users"
|
||||
next
|
||||
end
|
||||
38
configs/fortigate/vdom_TEST/voip.cfg
Normal file
38
configs/fortigate/vdom_TEST/voip.cfg
Normal file
@ -0,0 +1,38 @@
|
||||
config voip profile
|
||||
edit "default"
|
||||
set comment "Default VoIP profile."
|
||||
next
|
||||
edit "strict"
|
||||
config sip
|
||||
set malformed-request-line discard
|
||||
set malformed-header-via discard
|
||||
set malformed-header-from discard
|
||||
set malformed-header-to discard
|
||||
set malformed-header-call-id discard
|
||||
set malformed-header-cseq discard
|
||||
set malformed-header-rack discard
|
||||
set malformed-header-rseq discard
|
||||
set malformed-header-contact discard
|
||||
set malformed-header-record-route discard
|
||||
set malformed-header-route discard
|
||||
set malformed-header-expires discard
|
||||
set malformed-header-content-type discard
|
||||
set malformed-header-content-length discard
|
||||
set malformed-header-max-forwards discard
|
||||
set malformed-header-allow discard
|
||||
set malformed-header-p-asserted-identity discard
|
||||
set malformed-header-sdp-v discard
|
||||
set malformed-header-sdp-o discard
|
||||
set malformed-header-sdp-s discard
|
||||
set malformed-header-sdp-i discard
|
||||
set malformed-header-sdp-c discard
|
||||
set malformed-header-sdp-b discard
|
||||
set malformed-header-sdp-z discard
|
||||
set malformed-header-sdp-k discard
|
||||
set malformed-header-sdp-a discard
|
||||
set malformed-header-sdp-t discard
|
||||
set malformed-header-sdp-r discard
|
||||
set malformed-header-sdp-m discard
|
||||
end
|
||||
next
|
||||
end
|
||||
299
configs/fortigate/vdom_TEST/vpn.cfg
Normal file
299
configs/fortigate/vdom_TEST/vpn.cfg
Normal file
@ -0,0 +1,299 @@
|
||||
config vpn certificate ca
|
||||
end
|
||||
config vpn certificate local
|
||||
edit "Fortinet_CA_SSL"
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_CA_Untrusted"
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA1024"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA2048"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA4096"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA1024"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA2048"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA256"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA384"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA521"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED25519"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED448"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
end
|
||||
config vpn ssl web host-check-software
|
||||
edit "FortiClient-AV"
|
||||
set guid "1A0271D5-3D4F-46DB-0C2C-AB37BA90D9F7"
|
||||
next
|
||||
edit "FortiClient-FW"
|
||||
set type fw
|
||||
set guid "528CB157-D384-4593-AAAA-E42DFF111CED"
|
||||
next
|
||||
edit "FortiClient-AV-Vista"
|
||||
set guid "385618A6-2256-708E-3FB9-7E98B93F91F9"
|
||||
next
|
||||
edit "FortiClient-FW-Vista"
|
||||
set type fw
|
||||
set guid "006D9983-6839-71D6-14E6-D7AD47ECD682"
|
||||
next
|
||||
edit "FortiClient5-AV"
|
||||
set guid "5EEDDB8C-C27A-6714-3657-DBD811D1F1B7"
|
||||
next
|
||||
edit "AVG-Internet-Security-AV"
|
||||
set guid "17DDD097-36FF-435F-9E1B-52D74245D6BF"
|
||||
next
|
||||
edit "AVG-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "8DECF618-9569-4340-B34A-D78D28969B66"
|
||||
next
|
||||
edit "AVG-Internet-Security-AV-Vista-Win7"
|
||||
set guid "0C939084-9E57-CBDB-EA61-0B0C7F62AF82"
|
||||
next
|
||||
edit "AVG-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "34A811A1-D438-CA83-C13E-A23981B1E8F9"
|
||||
next
|
||||
edit "CA-Anti-Virus"
|
||||
set guid "17CFD1EA-56CF-40B5-A06B-BD3A27397C93"
|
||||
next
|
||||
edit "CA-Internet-Security-AV"
|
||||
set guid "6B98D35F-BB76-41C0-876B-A50645ED099A"
|
||||
next
|
||||
edit "CA-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "38102F93-1B6E-4922-90E1-A35D8DC6DAA3"
|
||||
next
|
||||
edit "CA-Internet-Security-AV-Vista-Win7"
|
||||
set guid "3EED0195-0A4B-4EF3-CC4F-4F401BDC245F"
|
||||
next
|
||||
edit "CA-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "06D680B0-4024-4FAB-E710-E675E50F6324"
|
||||
next
|
||||
edit "CA-Personal-Firewall"
|
||||
set type fw
|
||||
set guid "14CB4B80-8E52-45EA-905E-67C1267B4160"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-AV"
|
||||
set guid "E7512ED5-4245-4B4D-AF3A-382D3F313F15"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "D4747503-0346-49EB-9262-997542F79BF4"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-AV-Vista-Win7"
|
||||
set guid "15414183-282E-D62C-CA37-EF24860A2F17"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "2D7AC0A6-6241-D774-E168-461178D9686C"
|
||||
next
|
||||
edit "Kaspersky-AV"
|
||||
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
|
||||
next
|
||||
edit "Kaspersky-FW"
|
||||
set type fw
|
||||
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
|
||||
next
|
||||
edit "Kaspersky-AV-Vista-Win7"
|
||||
set guid "AE1D740B-8F0F-D137-211D-873D44B3F4AE"
|
||||
next
|
||||
edit "Kaspersky-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "9626F52E-C560-D06F-0A42-2E08BA60B3D5"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-AV"
|
||||
set guid "84B5EE75-6421-4CDE-A33A-DD43BA9FAD83"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-FW"
|
||||
set type fw
|
||||
set guid "94894B63-8C7F-4050-BDA4-813CA00DA3E8"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-AV-Vista-Win7"
|
||||
set guid "86355677-4064-3EA7-ABB3-1B136EB04637"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "BE0ED752-0A0B-3FFF-80EC-B2269063014C"
|
||||
next
|
||||
edit "McAfee-Virus-Scan-Enterprise"
|
||||
set guid "918A2B0B-2C60-4016-A4AB-E868DEABF7F0"
|
||||
next
|
||||
edit "Norton-360-2.0-AV"
|
||||
set guid "A5F1BC7C-EA33-4247-961C-0217208396C4"
|
||||
next
|
||||
edit "Norton-360-2.0-FW"
|
||||
set type fw
|
||||
set guid "371C0A40-5A0C-4AD2-A6E5-69C02037FBF3"
|
||||
next
|
||||
edit "Norton-360-3.0-AV"
|
||||
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
|
||||
next
|
||||
edit "Norton-360-3.0-FW"
|
||||
set type fw
|
||||
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
|
||||
next
|
||||
edit "Norton-Internet-Security-AV"
|
||||
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
|
||||
next
|
||||
edit "Norton-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
|
||||
next
|
||||
edit "Norton-Internet-Security-AV-Vista-Win7"
|
||||
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
|
||||
next
|
||||
edit "Norton-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-AV"
|
||||
set guid "FB06448E-52B8-493A-90F3-E43226D3305C"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-FW"
|
||||
set type fw
|
||||
set guid "BE898FE3-CD0B-4014-85A9-03DB9923DDB6"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-AV-Vista-Win7"
|
||||
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
|
||||
next
|
||||
edit "Panda-Antivirus+Firewall-2008-AV"
|
||||
set guid "EEE2D94A-D4C1-421A-AB2C-2CE8FE51747A"
|
||||
next
|
||||
edit "Panda-Antivirus+Firewall-2008-FW"
|
||||
set type fw
|
||||
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
|
||||
next
|
||||
edit "Panda-Internet-Security-AV"
|
||||
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
|
||||
next
|
||||
edit "Panda-Internet-Security-2006~2007-FW"
|
||||
set type fw
|
||||
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
|
||||
next
|
||||
edit "Panda-Internet-Security-2008~2009-FW"
|
||||
set type fw
|
||||
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
|
||||
next
|
||||
edit "Sophos-Anti-Virus"
|
||||
set guid "3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-FW"
|
||||
set type fw
|
||||
set guid "0786E95E-326A-4524-9691-41EF88FB52EA"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-AV-Vista-Win7"
|
||||
set guid "479CCF92-4960-B3E0-7373-BF453B467D2C"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "7FA74EB7-030F-B2B8-582C-1670C5953A57"
|
||||
next
|
||||
edit "Trend-Micro-AV"
|
||||
set guid "7D2296BC-32CC-4519-917E-52E652474AF5"
|
||||
next
|
||||
edit "Trend-Micro-FW"
|
||||
set type fw
|
||||
set guid "3E790E9E-6A5D-4303-A7F9-185EC20F3EB6"
|
||||
next
|
||||
edit "Trend-Micro-AV-Vista-Win7"
|
||||
set guid "48929DFC-7A52-A34F-8351-C4DBEDBD9C50"
|
||||
next
|
||||
edit "Trend-Micro-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "70A91CD9-303D-A217-A80E-6DEE136EDB2B"
|
||||
next
|
||||
edit "ZoneAlarm-AV"
|
||||
set guid "5D467B10-818C-4CAB-9FF7-6893B5B8F3CF"
|
||||
next
|
||||
edit "ZoneAlarm-FW"
|
||||
set type fw
|
||||
set guid "829BDA32-94B3-44F4-8446-F8FCFF809F8B"
|
||||
next
|
||||
edit "ZoneAlarm-AV-Vista-Win7"
|
||||
set guid "D61596DF-D219-341C-49B3-AD30538CBC5B"
|
||||
next
|
||||
edit "ZoneAlarm-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "EE2E17FA-9876-3544-62EC-0405AD5FFB20"
|
||||
next
|
||||
edit "ESET-Smart-Security-AV"
|
||||
set guid "19259FAE-8396-A113-46DB-15B0E7DFA289"
|
||||
next
|
||||
edit "ESET-Smart-Security-FW"
|
||||
set type fw
|
||||
set guid "211E1E8B-C9F9-A04B-6D84-BC85190CE5F2"
|
||||
next
|
||||
end
|
||||
config vpn ssl web portal
|
||||
edit "full-access"
|
||||
set tunnel-mode enable
|
||||
set ipv6-tunnel-mode enable
|
||||
set web-mode enable
|
||||
set ip-pools "SSLVPN_TUNNEL_ADDR1"
|
||||
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
|
||||
next
|
||||
edit "web-access"
|
||||
set web-mode enable
|
||||
next
|
||||
edit "tunnel-access"
|
||||
set tunnel-mode enable
|
||||
set ipv6-tunnel-mode enable
|
||||
set ip-pools "SSLVPN_TUNNEL_ADDR1"
|
||||
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
|
||||
next
|
||||
end
|
||||
config vpn ssl settings
|
||||
set servercert "Fortinet_Factory"
|
||||
set port 443
|
||||
end
|
||||
106
configs/fortigate/vdom_TEST/waf.cfg
Normal file
106
configs/fortigate/vdom_TEST/waf.cfg
Normal file
@ -0,0 +1,106 @@
|
||||
config waf profile
|
||||
edit "default"
|
||||
config signature
|
||||
config main-class 100000000
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 20000000
|
||||
end
|
||||
config main-class 30000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 40000000
|
||||
end
|
||||
config main-class 50000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 60000000
|
||||
end
|
||||
config main-class 70000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 80000000
|
||||
set status enable
|
||||
set severity low
|
||||
end
|
||||
config main-class 110000000
|
||||
set status enable
|
||||
set severity high
|
||||
end
|
||||
config main-class 90000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
set disabled-signature 80080005 80200001 60030001 60120001 80080003 90410001 90410002
|
||||
end
|
||||
config constraint
|
||||
config header-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config content-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config line-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config url-param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config version
|
||||
set log enable
|
||||
end
|
||||
config method
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config hostname
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config malformed
|
||||
set log enable
|
||||
end
|
||||
config max-cookie
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-header-line
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-url-param
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-range-segment
|
||||
set status enable
|
||||
set log enable
|
||||
set severity high
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_TEST/wanopt.cfg
Normal file
8
configs/fortigate/vdom_TEST/wanopt.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config wanopt settings
|
||||
set host-id "default-id"
|
||||
end
|
||||
config wanopt profile
|
||||
edit "default"
|
||||
set comments "Default WANopt profile."
|
||||
next
|
||||
end
|
||||
3
configs/fortigate/vdom_TEST/web-proxy.cfg
Normal file
3
configs/fortigate/vdom_TEST/web-proxy.cfg
Normal file
@ -0,0 +1,3 @@
|
||||
config web-proxy global
|
||||
set proxy-fqdn "default.fqdn"
|
||||
end
|
||||
584
configs/fortigate/vdom_TEST/webfilter.cfg
Normal file
584
configs/fortigate/vdom_TEST/webfilter.cfg
Normal file
@ -0,0 +1,584 @@
|
||||
config webfilter ftgd-local-cat
|
||||
edit "custom1"
|
||||
set id 140
|
||||
next
|
||||
edit "custom2"
|
||||
set id 141
|
||||
next
|
||||
end
|
||||
config webfilter ips-urlfilter-setting
|
||||
end
|
||||
config webfilter ips-urlfilter-setting6
|
||||
end
|
||||
config webfilter profile
|
||||
edit "g-default"
|
||||
set comment "Default web filtering."
|
||||
config ftgd-wf
|
||||
unset options
|
||||
config filters
|
||||
edit 1
|
||||
set action block
|
||||
next
|
||||
edit 2
|
||||
set category 2
|
||||
set action block
|
||||
next
|
||||
edit 3
|
||||
set category 7
|
||||
set action block
|
||||
next
|
||||
edit 4
|
||||
set category 8
|
||||
set action block
|
||||
next
|
||||
edit 5
|
||||
set category 9
|
||||
set action block
|
||||
next
|
||||
edit 6
|
||||
set category 11
|
||||
set action block
|
||||
next
|
||||
edit 7
|
||||
set category 12
|
||||
set action block
|
||||
next
|
||||
edit 8
|
||||
set category 13
|
||||
set action block
|
||||
next
|
||||
edit 9
|
||||
set category 14
|
||||
set action block
|
||||
next
|
||||
edit 10
|
||||
set category 15
|
||||
set action block
|
||||
next
|
||||
edit 11
|
||||
set category 16
|
||||
set action block
|
||||
next
|
||||
edit 12
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 13
|
||||
set category 57
|
||||
set action block
|
||||
next
|
||||
edit 14
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 15
|
||||
set category 63
|
||||
set action block
|
||||
next
|
||||
edit 16
|
||||
set category 64
|
||||
set action block
|
||||
next
|
||||
edit 17
|
||||
set category 65
|
||||
set action block
|
||||
next
|
||||
edit 18
|
||||
set category 66
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 67
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor web traffic."
|
||||
config ftgd-wf
|
||||
config filters
|
||||
edit 1
|
||||
next
|
||||
edit 2
|
||||
set category 1
|
||||
next
|
||||
edit 3
|
||||
set category 2
|
||||
next
|
||||
edit 4
|
||||
set category 3
|
||||
next
|
||||
edit 5
|
||||
set category 4
|
||||
next
|
||||
edit 6
|
||||
set category 5
|
||||
next
|
||||
edit 7
|
||||
set category 6
|
||||
next
|
||||
edit 8
|
||||
set category 7
|
||||
next
|
||||
edit 9
|
||||
set category 8
|
||||
next
|
||||
edit 10
|
||||
set category 9
|
||||
next
|
||||
edit 11
|
||||
set category 11
|
||||
next
|
||||
edit 12
|
||||
set category 12
|
||||
next
|
||||
edit 13
|
||||
set category 13
|
||||
next
|
||||
edit 14
|
||||
set category 14
|
||||
next
|
||||
edit 15
|
||||
set category 15
|
||||
next
|
||||
edit 16
|
||||
set category 16
|
||||
next
|
||||
edit 17
|
||||
set category 17
|
||||
next
|
||||
edit 18
|
||||
set category 18
|
||||
next
|
||||
edit 19
|
||||
set category 19
|
||||
next
|
||||
edit 20
|
||||
set category 20
|
||||
next
|
||||
edit 21
|
||||
set category 23
|
||||
next
|
||||
edit 22
|
||||
set category 24
|
||||
next
|
||||
edit 23
|
||||
set category 25
|
||||
next
|
||||
edit 24
|
||||
set category 26
|
||||
next
|
||||
edit 25
|
||||
set category 28
|
||||
next
|
||||
edit 26
|
||||
set category 29
|
||||
next
|
||||
edit 27
|
||||
set category 30
|
||||
next
|
||||
edit 28
|
||||
set category 31
|
||||
next
|
||||
edit 29
|
||||
set category 33
|
||||
next
|
||||
edit 30
|
||||
set category 34
|
||||
next
|
||||
edit 31
|
||||
set category 35
|
||||
next
|
||||
edit 32
|
||||
set category 36
|
||||
next
|
||||
edit 33
|
||||
set category 37
|
||||
next
|
||||
edit 34
|
||||
set category 38
|
||||
next
|
||||
edit 35
|
||||
set category 39
|
||||
next
|
||||
edit 36
|
||||
set category 40
|
||||
next
|
||||
edit 37
|
||||
set category 41
|
||||
next
|
||||
edit 38
|
||||
set category 42
|
||||
next
|
||||
edit 39
|
||||
set category 43
|
||||
next
|
||||
edit 40
|
||||
set category 44
|
||||
next
|
||||
edit 41
|
||||
set category 46
|
||||
next
|
||||
edit 42
|
||||
set category 47
|
||||
next
|
||||
edit 43
|
||||
set category 48
|
||||
next
|
||||
edit 44
|
||||
set category 49
|
||||
next
|
||||
edit 45
|
||||
set category 50
|
||||
next
|
||||
edit 46
|
||||
set category 51
|
||||
next
|
||||
edit 47
|
||||
set category 52
|
||||
next
|
||||
edit 48
|
||||
set category 53
|
||||
next
|
||||
edit 49
|
||||
set category 54
|
||||
next
|
||||
edit 50
|
||||
set category 55
|
||||
next
|
||||
edit 51
|
||||
set category 56
|
||||
next
|
||||
edit 52
|
||||
set category 57
|
||||
next
|
||||
edit 53
|
||||
set category 58
|
||||
next
|
||||
edit 54
|
||||
set category 59
|
||||
next
|
||||
edit 55
|
||||
set category 61
|
||||
next
|
||||
edit 56
|
||||
set category 62
|
||||
next
|
||||
edit 57
|
||||
set category 63
|
||||
next
|
||||
edit 58
|
||||
set category 64
|
||||
next
|
||||
edit 59
|
||||
set category 65
|
||||
next
|
||||
edit 60
|
||||
set category 66
|
||||
next
|
||||
edit 61
|
||||
set category 67
|
||||
next
|
||||
edit 62
|
||||
set category 68
|
||||
next
|
||||
edit 63
|
||||
set category 69
|
||||
next
|
||||
edit 64
|
||||
set category 70
|
||||
next
|
||||
edit 65
|
||||
set category 71
|
||||
next
|
||||
edit 66
|
||||
set category 72
|
||||
next
|
||||
edit 67
|
||||
set category 75
|
||||
next
|
||||
edit 68
|
||||
set category 76
|
||||
next
|
||||
edit 69
|
||||
set category 77
|
||||
next
|
||||
edit 70
|
||||
set category 78
|
||||
next
|
||||
edit 71
|
||||
set category 79
|
||||
next
|
||||
edit 72
|
||||
set category 80
|
||||
next
|
||||
edit 73
|
||||
set category 81
|
||||
next
|
||||
edit 74
|
||||
set category 82
|
||||
next
|
||||
edit 75
|
||||
set category 83
|
||||
next
|
||||
edit 76
|
||||
set category 84
|
||||
next
|
||||
edit 77
|
||||
set category 85
|
||||
next
|
||||
edit 78
|
||||
set category 86
|
||||
next
|
||||
edit 79
|
||||
set category 87
|
||||
next
|
||||
edit 80
|
||||
set category 88
|
||||
next
|
||||
edit 81
|
||||
set category 89
|
||||
next
|
||||
edit 82
|
||||
set category 90
|
||||
next
|
||||
edit 83
|
||||
set category 91
|
||||
next
|
||||
edit 84
|
||||
set category 92
|
||||
next
|
||||
edit 85
|
||||
set category 93
|
||||
next
|
||||
edit 86
|
||||
set category 94
|
||||
next
|
||||
edit 87
|
||||
set category 95
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set options block-invalid-url
|
||||
config ftgd-wf
|
||||
unset options
|
||||
config filters
|
||||
edit 1
|
||||
next
|
||||
edit 2
|
||||
set category 2
|
||||
set action block
|
||||
next
|
||||
edit 3
|
||||
set category 7
|
||||
set action block
|
||||
next
|
||||
edit 4
|
||||
set category 8
|
||||
set action block
|
||||
next
|
||||
edit 5
|
||||
set category 9
|
||||
set action block
|
||||
next
|
||||
edit 6
|
||||
set category 11
|
||||
set action block
|
||||
next
|
||||
edit 7
|
||||
set category 12
|
||||
set action block
|
||||
next
|
||||
edit 8
|
||||
set category 13
|
||||
set action block
|
||||
next
|
||||
edit 9
|
||||
set category 14
|
||||
set action block
|
||||
next
|
||||
edit 10
|
||||
set category 15
|
||||
set action block
|
||||
next
|
||||
edit 11
|
||||
set category 16
|
||||
set action block
|
||||
next
|
||||
edit 12
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 13
|
||||
set category 57
|
||||
set action block
|
||||
next
|
||||
edit 14
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 15
|
||||
set category 63
|
||||
set action block
|
||||
next
|
||||
edit 16
|
||||
set category 64
|
||||
set action block
|
||||
next
|
||||
edit 17
|
||||
set category 65
|
||||
set action block
|
||||
next
|
||||
edit 18
|
||||
set category 66
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 67
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
config webfilter search-engine
|
||||
edit "g-baidu"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/s?\\?"
|
||||
set query "wd="
|
||||
next
|
||||
edit "g-baidu2"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/(ns|q|m|i|v)\\?"
|
||||
set query "word="
|
||||
next
|
||||
edit "g-baidu3"
|
||||
set hostname "tieba\\.baidu\\.com"
|
||||
set url "^\\/f\\?"
|
||||
set query "kw="
|
||||
next
|
||||
edit "g-bing"
|
||||
set hostname ".*\\.bing\\..*"
|
||||
set url "^(\\/images|\\/videos)?(\\/search|\\/async|\\/asyncv2)\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-google"
|
||||
set hostname ".*\\.google\\..*"
|
||||
set url "^\\/((custom|search|images|videosearch|webhp)\\?)"
|
||||
set query "q="
|
||||
set safesearch url
|
||||
set safesearch-str "&safe=active"
|
||||
next
|
||||
edit "g-google-translate-1"
|
||||
set hostname "translate\\.google\\..*"
|
||||
set url "^\\/translate"
|
||||
set query "u="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-google-translate-2"
|
||||
set hostname ".*\\.translate\\.goog"
|
||||
set url "^\\/"
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-twitter"
|
||||
set hostname "twitter\\.com"
|
||||
set url "^\\/i\\/api\\/graphql\\/.*\\/UserByScreenName"
|
||||
set query "variables="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-vimeo"
|
||||
set hostname ".*vimeo.*"
|
||||
set url "^\\/search\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yahoo"
|
||||
set hostname ".*\\.yahoo\\..*"
|
||||
set url "^\\/search(\\/video|\\/images){0,1}(\\?|;)"
|
||||
set query "p="
|
||||
set safesearch url
|
||||
set safesearch-str "&vm=r"
|
||||
next
|
||||
edit "g-yandex"
|
||||
set hostname "yandex\\..*"
|
||||
set url "^\\/((yand|images\\/|video\\/)(search)|search\\/)\\?"
|
||||
set query "text="
|
||||
set safesearch url
|
||||
set safesearch-str "&family=yes"
|
||||
next
|
||||
edit "g-youtube"
|
||||
set hostname ".*youtube.*"
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yt-channel"
|
||||
set url "www.youtube.com/channel"
|
||||
set safesearch yt-channel
|
||||
next
|
||||
edit "g-yt-pattern"
|
||||
set url "youtube.com/channel/"
|
||||
set safesearch yt-pattern
|
||||
next
|
||||
edit "g-yt-scan-1"
|
||||
set url "www.youtube.com/user/"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-2"
|
||||
set url "www.youtube.com/youtubei/v1/browse"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-3"
|
||||
set url "www.youtube.com/youtubei/v1/player"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-4"
|
||||
set url "www.youtube.com/youtubei/v1/navigator"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "translate"
|
||||
set hostname "translate\\.google\\..*"
|
||||
set url "^\\/translate\\?"
|
||||
set query "u="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "yt-video"
|
||||
set url "www.youtube.com/watch"
|
||||
set safesearch yt-video
|
||||
next
|
||||
end
|
||||
43
configs/fortigate/vdom_TEST/wireless-controller.cfg
Normal file
43
configs/fortigate/vdom_TEST/wireless-controller.cfg
Normal file
@ -0,0 +1,43 @@
|
||||
config wireless-controller setting
|
||||
set darrp-optimize-schedules "default-darrp-optimize"
|
||||
end
|
||||
config wireless-controller arrp-profile
|
||||
edit "arrp-default"
|
||||
next
|
||||
end
|
||||
config wireless-controller wids-profile
|
||||
edit "default"
|
||||
set comment "Default WIDS profile."
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
set wireless-bridge enable
|
||||
set deauth-broadcast enable
|
||||
set null-ssid-probe-resp enable
|
||||
set long-duration-attack enable
|
||||
set invalid-mac-oui enable
|
||||
set weak-wep-iv enable
|
||||
set auth-frame-flood enable
|
||||
set assoc-frame-flood enable
|
||||
set spoofed-deauth enable
|
||||
set asleap-attack enable
|
||||
set eapol-start-flood enable
|
||||
set eapol-logoff-flood enable
|
||||
set eapol-succ-flood enable
|
||||
set eapol-fail-flood enable
|
||||
set eapol-pre-succ-flood enable
|
||||
set eapol-pre-fail-flood enable
|
||||
next
|
||||
edit "default-wids-apscan-enabled"
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
next
|
||||
end
|
||||
config wireless-controller ble-profile
|
||||
edit "fortiap-discovery"
|
||||
set advertising ibeacon eddystone-uid eddystone-url
|
||||
next
|
||||
end
|
||||
75
configs/fortigate/vdom_root/antivirus.cfg
Normal file
75
configs/fortigate/vdom_root/antivirus.cfg
Normal file
@ -0,0 +1,75 @@
|
||||
config antivirus settings
|
||||
set machine-learning-detection enable
|
||||
set grayware enable
|
||||
end
|
||||
config antivirus profile
|
||||
edit "g-default"
|
||||
set comment "Scan files and block viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Scan files and monitor viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
end
|
||||
39
configs/fortigate/vdom_root/application.cfg
Normal file
39
configs/fortigate/vdom_root/application.cfg
Normal file
@ -0,0 +1,39 @@
|
||||
config application list
|
||||
edit "g-default"
|
||||
set comment "Monitor all applications."
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor all applications."
|
||||
unset options
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set deep-app-inspection disable
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "block-high-risk"
|
||||
config entries
|
||||
edit 1
|
||||
set category 2 6
|
||||
next
|
||||
edit 2
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
149
configs/fortigate/vdom_root/dlp.cfg
Normal file
149
configs/fortigate/vdom_root/dlp.cfg
Normal file
@ -0,0 +1,149 @@
|
||||
config dlp filepattern
|
||||
edit 1
|
||||
set name "builtin-patterns"
|
||||
config entries
|
||||
edit "*.bat"
|
||||
next
|
||||
edit "*.com"
|
||||
next
|
||||
edit "*.dll"
|
||||
next
|
||||
edit "*.doc"
|
||||
next
|
||||
edit "*.exe"
|
||||
next
|
||||
edit "*.gz"
|
||||
next
|
||||
edit "*.hta"
|
||||
next
|
||||
edit "*.ppt"
|
||||
next
|
||||
edit "*.rar"
|
||||
next
|
||||
edit "*.scr"
|
||||
next
|
||||
edit "*.tar"
|
||||
next
|
||||
edit "*.tgz"
|
||||
next
|
||||
edit "*.vb?"
|
||||
next
|
||||
edit "*.wps"
|
||||
next
|
||||
edit "*.xl?"
|
||||
next
|
||||
edit "*.zip"
|
||||
next
|
||||
edit "*.pif"
|
||||
next
|
||||
edit "*.cpl"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit 2
|
||||
set name "all_executables"
|
||||
config entries
|
||||
edit "bat"
|
||||
set filter-type type
|
||||
set file-type bat
|
||||
next
|
||||
edit "exe"
|
||||
set filter-type type
|
||||
set file-type exe
|
||||
next
|
||||
edit "elf"
|
||||
set filter-type type
|
||||
set file-type elf
|
||||
next
|
||||
edit "hta"
|
||||
set filter-type type
|
||||
set file-type hta
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config dlp sensitivity
|
||||
edit "Private"
|
||||
next
|
||||
edit "Critical"
|
||||
next
|
||||
edit "Warning"
|
||||
next
|
||||
end
|
||||
config dlp sensor
|
||||
edit "g-default"
|
||||
set comment "Default sensor."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Log a summary of email and web traffic."
|
||||
set summary-proto smtp pop3 imap http-get http-post
|
||||
next
|
||||
edit "Content_Archive"
|
||||
set feature-set proxy
|
||||
set full-archive-proto smtp pop3 imap http-get http-post ftp nntp mapi
|
||||
set summary-proto smtp pop3 imap http-get http-post ftp nntp mapi
|
||||
next
|
||||
edit "Content_Summary"
|
||||
set feature-set proxy
|
||||
set summary-proto smtp pop3 imap http-get http-post ftp nntp mapi
|
||||
next
|
||||
edit "Credit-Card"
|
||||
set feature-set proxy
|
||||
config filter
|
||||
edit 1
|
||||
set name "Credit-Card-Filter"
|
||||
set severity high
|
||||
set proto smtp pop3 imap http-get http-post mapi
|
||||
set action log-only
|
||||
next
|
||||
edit 2
|
||||
set name "Credit-Card-Filter"
|
||||
set severity high
|
||||
set type message
|
||||
set proto smtp pop3 imap http-post mapi
|
||||
set action log-only
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Large-File"
|
||||
set feature-set proxy
|
||||
config filter
|
||||
edit 1
|
||||
set name "Large-File-Filter"
|
||||
set proto smtp pop3 imap http-get http-post mapi
|
||||
set filter-by file-size
|
||||
set file-size 5120
|
||||
set action log-only
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "SSN-Sensor"
|
||||
set comment "Match SSN numbers but NOT WebEx invite emails."
|
||||
set feature-set proxy
|
||||
config filter
|
||||
edit 1
|
||||
set name "SSN-Sensor-Filter"
|
||||
set severity high
|
||||
set type message
|
||||
set proto smtp pop3 imap mapi
|
||||
set filter-by regexp
|
||||
set regexp "WebEx"
|
||||
next
|
||||
edit 2
|
||||
set name "SSN-Sensor-Filter"
|
||||
set severity high
|
||||
set type message
|
||||
set proto smtp pop3 imap mapi
|
||||
set filter-by ssn
|
||||
set action log-only
|
||||
next
|
||||
edit 3
|
||||
set name "SSN-Sensor-Filter"
|
||||
set severity high
|
||||
set proto smtp pop3 imap http-get http-post ftp mapi
|
||||
set filter-by ssn
|
||||
set action log-only
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
84
configs/fortigate/vdom_root/dnsfilter.cfg
Normal file
84
configs/fortigate/vdom_root/dnsfilter.cfg
Normal file
@ -0,0 +1,84 @@
|
||||
config dnsfilter profile
|
||||
edit "default"
|
||||
set comment "Default dns filtering."
|
||||
config ftgd-dns
|
||||
config filters
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 7
|
||||
next
|
||||
edit 3
|
||||
set category 8
|
||||
next
|
||||
edit 4
|
||||
set category 9
|
||||
next
|
||||
edit 5
|
||||
set category 11
|
||||
next
|
||||
edit 6
|
||||
set category 12
|
||||
next
|
||||
edit 7
|
||||
set category 13
|
||||
next
|
||||
edit 8
|
||||
set category 14
|
||||
next
|
||||
edit 9
|
||||
set category 15
|
||||
next
|
||||
edit 10
|
||||
set category 16
|
||||
next
|
||||
edit 11
|
||||
next
|
||||
edit 12
|
||||
set category 57
|
||||
next
|
||||
edit 13
|
||||
set category 63
|
||||
next
|
||||
edit 14
|
||||
set category 64
|
||||
next
|
||||
edit 15
|
||||
set category 65
|
||||
next
|
||||
edit 16
|
||||
set category 66
|
||||
next
|
||||
edit 17
|
||||
set category 67
|
||||
next
|
||||
edit 18
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
set block-botnet enable
|
||||
next
|
||||
end
|
||||
20
configs/fortigate/vdom_root/emailfilter.cfg
Normal file
20
configs/fortigate/vdom_root/emailfilter.cfg
Normal file
@ -0,0 +1,20 @@
|
||||
config emailfilter profile
|
||||
edit "sniffer-profile"
|
||||
set comment "Malware and phishing URL monitoring."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
edit "default"
|
||||
set comment "Malware and phishing URL filtering."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_root/file-filter.cfg
Normal file
8
configs/fortigate/vdom_root/file-filter.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config file-filter profile
|
||||
edit "g-default"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
end
|
||||
1132
configs/fortigate/vdom_root/firewall.cfg
Normal file
1132
configs/fortigate/vdom_root/firewall.cfg
Normal file
File diff suppressed because it is too large
Load Diff
14
configs/fortigate/vdom_root/icap.cfg
Normal file
14
configs/fortigate/vdom_root/icap.cfg
Normal file
@ -0,0 +1,14 @@
|
||||
config icap profile
|
||||
edit "default"
|
||||
config icap-headers
|
||||
edit 1
|
||||
set name "X-Authenticated-User"
|
||||
set content "$user"
|
||||
next
|
||||
edit 2
|
||||
set name "X-Authenticated-Groups"
|
||||
set content "$local_grp"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
81
configs/fortigate/vdom_root/ips.cfg
Normal file
81
configs/fortigate/vdom_root/ips.cfg
Normal file
@ -0,0 +1,81 @@
|
||||
config ips sensor
|
||||
edit "g-default"
|
||||
set comment "Prevent critical attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor IPS attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "all_default"
|
||||
set comment "All predefined signatures with default setting."
|
||||
config entries
|
||||
edit 1
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "all_default_pass"
|
||||
set comment "All predefined signatures with PASS action."
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "high_security"
|
||||
set comment "Blocks all Critical/High/Medium and some Low severity vulnerabilities"
|
||||
set block-malicious-url enable
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
set status enable
|
||||
set action block
|
||||
next
|
||||
edit 2
|
||||
set severity low
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "protect_client"
|
||||
set comment "Protect against client-side vulnerabilities."
|
||||
config entries
|
||||
edit 1
|
||||
set location client
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "protect_email_server"
|
||||
set comment "Protect against email server-side vulnerabilities."
|
||||
config entries
|
||||
edit 1
|
||||
set location server
|
||||
set protocol SMTP POP3 IMAP
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "protect_http_server"
|
||||
set comment "Protect against HTTP server-side vulnerabilities."
|
||||
config entries
|
||||
edit 1
|
||||
set location server
|
||||
set protocol HTTP
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
86
configs/fortigate/vdom_root/log.cfg
Normal file
86
configs/fortigate/vdom_root/log.cfg
Normal file
@ -0,0 +1,86 @@
|
||||
config log threat-weight
|
||||
config web
|
||||
edit 1
|
||||
set category 26
|
||||
set level high
|
||||
next
|
||||
edit 2
|
||||
set category 61
|
||||
set level high
|
||||
next
|
||||
edit 3
|
||||
set category 86
|
||||
set level high
|
||||
next
|
||||
edit 4
|
||||
set category 1
|
||||
set level medium
|
||||
next
|
||||
edit 5
|
||||
set category 3
|
||||
set level medium
|
||||
next
|
||||
edit 6
|
||||
set category 4
|
||||
set level medium
|
||||
next
|
||||
edit 7
|
||||
set category 5
|
||||
set level medium
|
||||
next
|
||||
edit 8
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
edit 9
|
||||
set category 12
|
||||
set level medium
|
||||
next
|
||||
edit 10
|
||||
set category 59
|
||||
set level medium
|
||||
next
|
||||
edit 11
|
||||
set category 62
|
||||
set level medium
|
||||
next
|
||||
edit 12
|
||||
set category 83
|
||||
set level medium
|
||||
next
|
||||
edit 13
|
||||
set category 72
|
||||
next
|
||||
edit 14
|
||||
set category 14
|
||||
next
|
||||
edit 15
|
||||
set category 96
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
config application
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
end
|
||||
config log memory setting
|
||||
set status enable
|
||||
end
|
||||
config log disk setting
|
||||
set status disable
|
||||
end
|
||||
config log null-device setting
|
||||
set status disable
|
||||
end
|
||||
config log setting
|
||||
set local-in-allow enable
|
||||
set local-in-deny-unicast enable
|
||||
set local-in-deny-broadcast enable
|
||||
set local-out enable
|
||||
end
|
||||
102
configs/fortigate/vdom_root/router.cfg
Normal file
102
configs/fortigate/vdom_root/router.cfg
Normal file
@ -0,0 +1,102 @@
|
||||
config router rip
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ripng
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router static
|
||||
edit 1
|
||||
set gateway 192.168.1.1
|
||||
set device "mgmt1"
|
||||
next
|
||||
end
|
||||
config router ospf
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ospf6
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router bgp
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
config redistribute6 "isis"
|
||||
end
|
||||
end
|
||||
config router isis
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "bgp"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
end
|
||||
config router multicast
|
||||
end
|
||||
end
|
||||
|
||||
224
configs/fortigate/vdom_root/switch-controller.cfg
Normal file
224
configs/fortigate/vdom_root/switch-controller.cfg
Normal file
@ -0,0 +1,224 @@
|
||||
config switch-controller traffic-policy
|
||||
edit "quarantine"
|
||||
set description "Rate control for quarantined traffic"
|
||||
set guaranteed-bandwidth 163840
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
edit "sniffer"
|
||||
set description "Rate control for sniffer mirrored traffic"
|
||||
set guaranteed-bandwidth 50000
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy 802-1X
|
||||
edit "802-1X-policy-default"
|
||||
set user-group "SSO_Guest_Users"
|
||||
set mac-auth-bypass disable
|
||||
set open-auth disable
|
||||
set eap-passthru enable
|
||||
set eap-auto-untagged-vlans enable
|
||||
set guest-vlan disable
|
||||
set auth-fail-vlan disable
|
||||
set framevid-apply enable
|
||||
set radius-timeout-overwrite disable
|
||||
set authserver-timeout-vlan disable
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy local-access
|
||||
edit "default"
|
||||
set mgmt-allowaccess https ping ssh
|
||||
set internal-allowaccess https ping ssh
|
||||
next
|
||||
end
|
||||
config switch-controller lldp-profile
|
||||
edit "default"
|
||||
set med-tlvs inventory-management network-policy location-identification
|
||||
set auto-isl disable
|
||||
config med-network-policy
|
||||
edit "voice"
|
||||
next
|
||||
edit "voice-signaling"
|
||||
next
|
||||
edit "guest-voice"
|
||||
next
|
||||
edit "guest-voice-signaling"
|
||||
next
|
||||
edit "softphone-voice"
|
||||
next
|
||||
edit "video-conferencing"
|
||||
next
|
||||
edit "streaming-video"
|
||||
next
|
||||
edit "video-signaling"
|
||||
next
|
||||
end
|
||||
config med-location-service
|
||||
edit "coordinates"
|
||||
next
|
||||
edit "address-civic"
|
||||
next
|
||||
edit "elin-number"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "default-auto-isl"
|
||||
next
|
||||
edit "default-auto-mclag-icl"
|
||||
set auto-mclag-icl enable
|
||||
next
|
||||
end
|
||||
config switch-controller qos dot1p-map
|
||||
edit "voice-dot1p"
|
||||
set priority-0 queue-4
|
||||
set priority-1 queue-4
|
||||
set priority-2 queue-3
|
||||
set priority-3 queue-2
|
||||
set priority-4 queue-3
|
||||
set priority-5 queue-1
|
||||
set priority-6 queue-2
|
||||
set priority-7 queue-2
|
||||
next
|
||||
end
|
||||
config switch-controller qos ip-dscp-map
|
||||
edit "voice-dscp"
|
||||
config map
|
||||
edit "1"
|
||||
set cos-queue 1
|
||||
set value 46
|
||||
next
|
||||
edit "2"
|
||||
set cos-queue 2
|
||||
set value 24,26,48,56
|
||||
next
|
||||
edit "5"
|
||||
set cos-queue 3
|
||||
set value 34
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos queue-policy
|
||||
edit "default"
|
||||
set schedule round-robin
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
next
|
||||
edit "queue-2"
|
||||
next
|
||||
edit "queue-3"
|
||||
next
|
||||
edit "queue-4"
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "voice-egress"
|
||||
set schedule weighted
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
set weight 0
|
||||
next
|
||||
edit "queue-2"
|
||||
set weight 6
|
||||
next
|
||||
edit "queue-3"
|
||||
set weight 37
|
||||
next
|
||||
edit "queue-4"
|
||||
set weight 12
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos qos-policy
|
||||
edit "default"
|
||||
next
|
||||
edit "voice-qos"
|
||||
set trust-dot1p-map "voice-dot1p"
|
||||
set trust-ip-dscp-map "voice-dscp"
|
||||
set queue-policy "voice-egress"
|
||||
next
|
||||
end
|
||||
config switch-controller storm-control-policy
|
||||
edit "default"
|
||||
set description "default storm control on all port"
|
||||
next
|
||||
edit "auto-config"
|
||||
set description "storm control policy for fortilink-isl-icl port"
|
||||
set storm-control-mode disabled
|
||||
next
|
||||
end
|
||||
config switch-controller auto-config policy
|
||||
edit "default"
|
||||
next
|
||||
edit "default-icl"
|
||||
set poe-status disable
|
||||
set igmp-flood-report enable
|
||||
set igmp-flood-traffic enable
|
||||
next
|
||||
end
|
||||
config switch-controller initial-config template
|
||||
edit "_default"
|
||||
set vlanid 1
|
||||
next
|
||||
edit "quarantine"
|
||||
set vlanid 4093
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "rspan"
|
||||
set vlanid 4092
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "voice"
|
||||
set vlanid 4091
|
||||
next
|
||||
edit "video"
|
||||
set vlanid 4090
|
||||
next
|
||||
edit "onboarding"
|
||||
set vlanid 4089
|
||||
next
|
||||
edit "nac_segment"
|
||||
set vlanid 4088
|
||||
set dhcp-server enable
|
||||
next
|
||||
end
|
||||
config switch-controller switch-profile
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config switch-controller ptp settings
|
||||
set mode disable
|
||||
end
|
||||
config switch-controller ptp policy
|
||||
edit "default"
|
||||
set status enable
|
||||
next
|
||||
end
|
||||
config switch-controller remote-log
|
||||
edit "syslogd"
|
||||
next
|
||||
edit "syslogd2"
|
||||
next
|
||||
end
|
||||
91
configs/fortigate/vdom_root/system.cfg
Normal file
91
configs/fortigate/vdom_root/system.cfg
Normal file
@ -0,0 +1,91 @@
|
||||
config system object-tagging
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config system settings
|
||||
set h323-direct-model enable
|
||||
set gui-webfilter disable
|
||||
set gui-dnsfilter disable
|
||||
end
|
||||
config system replacemsg-group
|
||||
edit "default"
|
||||
set comment "Default replacement message group."
|
||||
next
|
||||
end
|
||||
config system dhcp server
|
||||
edit 1
|
||||
set dns-service default
|
||||
set default-gateway 192.168.200.1
|
||||
set netmask 255.255.255.0
|
||||
set interface "mgmt2"
|
||||
config ip-range
|
||||
edit 1
|
||||
set start-ip 192.168.200.2
|
||||
set end-ip 192.168.200.254
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config system sdwan
|
||||
config zone
|
||||
edit "virtual-wan-link"
|
||||
next
|
||||
end
|
||||
config health-check
|
||||
edit "Default_Office_365"
|
||||
set server "www.office.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Gmail"
|
||||
set server "gmail.com"
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 2
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Google Search"
|
||||
set server "www.google.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_FortiGuard"
|
||||
set server "fortiguard.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
end
|
||||
24
configs/fortigate/vdom_root/user.cfg
Normal file
24
configs/fortigate/vdom_root/user.cfg
Normal file
@ -0,0 +1,24 @@
|
||||
config user fortitoken
|
||||
edit "FTKMOB2134C905F9"
|
||||
set license "FTMTRIAL03307A6F"
|
||||
next
|
||||
edit "FTKMOB21BF31F838"
|
||||
set license "FTMTRIAL03307A6F"
|
||||
next
|
||||
end
|
||||
config user local
|
||||
edit "guest"
|
||||
set type password
|
||||
set passwd ENC xPBvzRl0fSM2uN3J7UIN5ZgsnzDN6HlyERGlWMjnJwiOPjoavEAA7GBbieLcGi6kdM3yKTs+HoV/KJp/wFrDo5phGDorttSDcqGGcEYeOsH68xCT+1/OTAlp8NsLaa50tbQ5ujQQjWHBuFoWYqK3xqu820+DvKAP8UOceD719WobX5wwC/mKmGbCpMeJO1JZxdStzQ==
|
||||
next
|
||||
end
|
||||
config user setting
|
||||
set auth-cert "Fortinet_Factory"
|
||||
end
|
||||
config user group
|
||||
edit "SSO_Guest_Users"
|
||||
next
|
||||
edit "Guest-group"
|
||||
set member "guest"
|
||||
next
|
||||
end
|
||||
38
configs/fortigate/vdom_root/voip.cfg
Normal file
38
configs/fortigate/vdom_root/voip.cfg
Normal file
@ -0,0 +1,38 @@
|
||||
config voip profile
|
||||
edit "default"
|
||||
set comment "Default VoIP profile."
|
||||
next
|
||||
edit "strict"
|
||||
config sip
|
||||
set malformed-request-line discard
|
||||
set malformed-header-via discard
|
||||
set malformed-header-from discard
|
||||
set malformed-header-to discard
|
||||
set malformed-header-call-id discard
|
||||
set malformed-header-cseq discard
|
||||
set malformed-header-rack discard
|
||||
set malformed-header-rseq discard
|
||||
set malformed-header-contact discard
|
||||
set malformed-header-record-route discard
|
||||
set malformed-header-route discard
|
||||
set malformed-header-expires discard
|
||||
set malformed-header-content-type discard
|
||||
set malformed-header-content-length discard
|
||||
set malformed-header-max-forwards discard
|
||||
set malformed-header-allow discard
|
||||
set malformed-header-p-asserted-identity discard
|
||||
set malformed-header-sdp-v discard
|
||||
set malformed-header-sdp-o discard
|
||||
set malformed-header-sdp-s discard
|
||||
set malformed-header-sdp-i discard
|
||||
set malformed-header-sdp-c discard
|
||||
set malformed-header-sdp-b discard
|
||||
set malformed-header-sdp-z discard
|
||||
set malformed-header-sdp-k discard
|
||||
set malformed-header-sdp-a discard
|
||||
set malformed-header-sdp-t discard
|
||||
set malformed-header-sdp-r discard
|
||||
set malformed-header-sdp-m discard
|
||||
end
|
||||
next
|
||||
end
|
||||
301
configs/fortigate/vdom_root/vpn.cfg
Normal file
301
configs/fortigate/vdom_root/vpn.cfg
Normal file
@ -0,0 +1,301 @@
|
||||
config vpn certificate ca
|
||||
end
|
||||
config vpn certificate local
|
||||
edit "Fortinet_CA_SSL"
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_CA_Untrusted"
|
||||
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA1024"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA2048"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_RSA4096"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA1024"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_DSA2048"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA256"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA384"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ECDSA521"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED25519"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
edit "Fortinet_SSL_ED448"
|
||||
set comments "This certificate is embedded in the hardware at the factory and is unique to this unit. "
|
||||
set range global
|
||||
set source factory
|
||||
next
|
||||
end
|
||||
config vpn ssl web host-check-software
|
||||
edit "FortiClient-AV"
|
||||
set guid "1A0271D5-3D4F-46DB-0C2C-AB37BA90D9F7"
|
||||
next
|
||||
edit "FortiClient-FW"
|
||||
set type fw
|
||||
set guid "528CB157-D384-4593-AAAA-E42DFF111CED"
|
||||
next
|
||||
edit "FortiClient-AV-Vista"
|
||||
set guid "385618A6-2256-708E-3FB9-7E98B93F91F9"
|
||||
next
|
||||
edit "FortiClient-FW-Vista"
|
||||
set type fw
|
||||
set guid "006D9983-6839-71D6-14E6-D7AD47ECD682"
|
||||
next
|
||||
edit "FortiClient5-AV"
|
||||
set guid "5EEDDB8C-C27A-6714-3657-DBD811D1F1B7"
|
||||
next
|
||||
edit "AVG-Internet-Security-AV"
|
||||
set guid "17DDD097-36FF-435F-9E1B-52D74245D6BF"
|
||||
next
|
||||
edit "AVG-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "8DECF618-9569-4340-B34A-D78D28969B66"
|
||||
next
|
||||
edit "AVG-Internet-Security-AV-Vista-Win7"
|
||||
set guid "0C939084-9E57-CBDB-EA61-0B0C7F62AF82"
|
||||
next
|
||||
edit "AVG-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "34A811A1-D438-CA83-C13E-A23981B1E8F9"
|
||||
next
|
||||
edit "CA-Anti-Virus"
|
||||
set guid "17CFD1EA-56CF-40B5-A06B-BD3A27397C93"
|
||||
next
|
||||
edit "CA-Internet-Security-AV"
|
||||
set guid "6B98D35F-BB76-41C0-876B-A50645ED099A"
|
||||
next
|
||||
edit "CA-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "38102F93-1B6E-4922-90E1-A35D8DC6DAA3"
|
||||
next
|
||||
edit "CA-Internet-Security-AV-Vista-Win7"
|
||||
set guid "3EED0195-0A4B-4EF3-CC4F-4F401BDC245F"
|
||||
next
|
||||
edit "CA-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "06D680B0-4024-4FAB-E710-E675E50F6324"
|
||||
next
|
||||
edit "CA-Personal-Firewall"
|
||||
set type fw
|
||||
set guid "14CB4B80-8E52-45EA-905E-67C1267B4160"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-AV"
|
||||
set guid "E7512ED5-4245-4B4D-AF3A-382D3F313F15"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "D4747503-0346-49EB-9262-997542F79BF4"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-AV-Vista-Win7"
|
||||
set guid "15414183-282E-D62C-CA37-EF24860A2F17"
|
||||
next
|
||||
edit "F-Secure-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "2D7AC0A6-6241-D774-E168-461178D9686C"
|
||||
next
|
||||
edit "Kaspersky-AV"
|
||||
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
|
||||
next
|
||||
edit "Kaspersky-FW"
|
||||
set type fw
|
||||
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
|
||||
next
|
||||
edit "Kaspersky-AV-Vista-Win7"
|
||||
set guid "AE1D740B-8F0F-D137-211D-873D44B3F4AE"
|
||||
next
|
||||
edit "Kaspersky-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "9626F52E-C560-D06F-0A42-2E08BA60B3D5"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-AV"
|
||||
set guid "84B5EE75-6421-4CDE-A33A-DD43BA9FAD83"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-FW"
|
||||
set type fw
|
||||
set guid "94894B63-8C7F-4050-BDA4-813CA00DA3E8"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-AV-Vista-Win7"
|
||||
set guid "86355677-4064-3EA7-ABB3-1B136EB04637"
|
||||
next
|
||||
edit "McAfee-Internet-Security-Suite-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "BE0ED752-0A0B-3FFF-80EC-B2269063014C"
|
||||
next
|
||||
edit "McAfee-Virus-Scan-Enterprise"
|
||||
set guid "918A2B0B-2C60-4016-A4AB-E868DEABF7F0"
|
||||
next
|
||||
edit "Norton-360-2.0-AV"
|
||||
set guid "A5F1BC7C-EA33-4247-961C-0217208396C4"
|
||||
next
|
||||
edit "Norton-360-2.0-FW"
|
||||
set type fw
|
||||
set guid "371C0A40-5A0C-4AD2-A6E5-69C02037FBF3"
|
||||
next
|
||||
edit "Norton-360-3.0-AV"
|
||||
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
|
||||
next
|
||||
edit "Norton-360-3.0-FW"
|
||||
set type fw
|
||||
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
|
||||
next
|
||||
edit "Norton-Internet-Security-AV"
|
||||
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
|
||||
next
|
||||
edit "Norton-Internet-Security-FW"
|
||||
set type fw
|
||||
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
|
||||
next
|
||||
edit "Norton-Internet-Security-AV-Vista-Win7"
|
||||
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
|
||||
next
|
||||
edit "Norton-Internet-Security-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-AV"
|
||||
set guid "FB06448E-52B8-493A-90F3-E43226D3305C"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-FW"
|
||||
set type fw
|
||||
set guid "BE898FE3-CD0B-4014-85A9-03DB9923DDB6"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-AV-Vista-Win7"
|
||||
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
|
||||
next
|
||||
edit "Symantec-Endpoint-Protection-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
|
||||
next
|
||||
edit "Panda-Antivirus+Firewall-2008-AV"
|
||||
set guid "EEE2D94A-D4C1-421A-AB2C-2CE8FE51747A"
|
||||
next
|
||||
edit "Panda-Antivirus+Firewall-2008-FW"
|
||||
set type fw
|
||||
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
|
||||
next
|
||||
edit "Panda-Internet-Security-AV"
|
||||
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
|
||||
next
|
||||
edit "Panda-Internet-Security-2006~2007-FW"
|
||||
set type fw
|
||||
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
|
||||
next
|
||||
edit "Panda-Internet-Security-2008~2009-FW"
|
||||
set type fw
|
||||
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
|
||||
next
|
||||
edit "Sophos-Anti-Virus"
|
||||
set guid "3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-FW"
|
||||
set type fw
|
||||
set guid "0786E95E-326A-4524-9691-41EF88FB52EA"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-AV-Vista-Win7"
|
||||
set guid "479CCF92-4960-B3E0-7373-BF453B467D2C"
|
||||
next
|
||||
edit "Sophos-Enpoint-Secuirty-and-Control-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "7FA74EB7-030F-B2B8-582C-1670C5953A57"
|
||||
next
|
||||
edit "Trend-Micro-AV"
|
||||
set guid "7D2296BC-32CC-4519-917E-52E652474AF5"
|
||||
next
|
||||
edit "Trend-Micro-FW"
|
||||
set type fw
|
||||
set guid "3E790E9E-6A5D-4303-A7F9-185EC20F3EB6"
|
||||
next
|
||||
edit "Trend-Micro-AV-Vista-Win7"
|
||||
set guid "48929DFC-7A52-A34F-8351-C4DBEDBD9C50"
|
||||
next
|
||||
edit "Trend-Micro-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "70A91CD9-303D-A217-A80E-6DEE136EDB2B"
|
||||
next
|
||||
edit "ZoneAlarm-AV"
|
||||
set guid "5D467B10-818C-4CAB-9FF7-6893B5B8F3CF"
|
||||
next
|
||||
edit "ZoneAlarm-FW"
|
||||
set type fw
|
||||
set guid "829BDA32-94B3-44F4-8446-F8FCFF809F8B"
|
||||
next
|
||||
edit "ZoneAlarm-AV-Vista-Win7"
|
||||
set guid "D61596DF-D219-341C-49B3-AD30538CBC5B"
|
||||
next
|
||||
edit "ZoneAlarm-FW-Vista-Win7"
|
||||
set type fw
|
||||
set guid "EE2E17FA-9876-3544-62EC-0405AD5FFB20"
|
||||
next
|
||||
edit "ESET-Smart-Security-AV"
|
||||
set guid "19259FAE-8396-A113-46DB-15B0E7DFA289"
|
||||
next
|
||||
edit "ESET-Smart-Security-FW"
|
||||
set type fw
|
||||
set guid "211E1E8B-C9F9-A04B-6D84-BC85190CE5F2"
|
||||
next
|
||||
end
|
||||
config vpn ssl web portal
|
||||
edit "full-access"
|
||||
set tunnel-mode enable
|
||||
set ipv6-tunnel-mode enable
|
||||
set web-mode enable
|
||||
set ip-pools "SSLVPN_TUNNEL_ADDR1"
|
||||
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
|
||||
next
|
||||
edit "web-access"
|
||||
set web-mode enable
|
||||
next
|
||||
edit "tunnel-access"
|
||||
set tunnel-mode enable
|
||||
set ipv6-tunnel-mode enable
|
||||
set ip-pools "SSLVPN_TUNNEL_ADDR1"
|
||||
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
|
||||
next
|
||||
end
|
||||
config vpn ssl settings
|
||||
set servercert "Fortinet_Factory"
|
||||
set port 443
|
||||
end
|
||||
config vpn ocvpn
|
||||
end
|
||||
116
configs/fortigate/vdom_root/waf.cfg
Normal file
116
configs/fortigate/vdom_root/waf.cfg
Normal file
@ -0,0 +1,116 @@
|
||||
config waf profile
|
||||
edit "default"
|
||||
config signature
|
||||
config main-class 100000000
|
||||
set action block
|
||||
set log disable
|
||||
set severity high
|
||||
end
|
||||
config main-class 20000000
|
||||
set log disable
|
||||
end
|
||||
config main-class 30000000
|
||||
set status enable
|
||||
set action block
|
||||
set log disable
|
||||
set severity high
|
||||
end
|
||||
config main-class 40000000
|
||||
set log disable
|
||||
end
|
||||
config main-class 50000000
|
||||
set status enable
|
||||
set action block
|
||||
set log disable
|
||||
set severity high
|
||||
end
|
||||
config main-class 60000000
|
||||
set log disable
|
||||
end
|
||||
config main-class 70000000
|
||||
set status enable
|
||||
set action block
|
||||
set log disable
|
||||
set severity high
|
||||
end
|
||||
config main-class 80000000
|
||||
set status enable
|
||||
set log disable
|
||||
set severity low
|
||||
end
|
||||
config main-class 110000000
|
||||
set status enable
|
||||
set log disable
|
||||
set severity high
|
||||
end
|
||||
config main-class 90000000
|
||||
set status enable
|
||||
set action block
|
||||
set log disable
|
||||
set severity high
|
||||
end
|
||||
set disabled-signature 80080005 80200001 60030001 60120001 80080003 90410001 90410002
|
||||
end
|
||||
config constraint
|
||||
config header-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config content-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config line-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config url-param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config version
|
||||
set log enable
|
||||
end
|
||||
config method
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config hostname
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config malformed
|
||||
set log enable
|
||||
end
|
||||
config max-cookie
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-header-line
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-url-param
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-range-segment
|
||||
set status enable
|
||||
set log enable
|
||||
set severity high
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_root/wanopt.cfg
Normal file
8
configs/fortigate/vdom_root/wanopt.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config wanopt settings
|
||||
set host-id "default-id"
|
||||
end
|
||||
config wanopt profile
|
||||
edit "default"
|
||||
set comments "Default WANopt profile."
|
||||
next
|
||||
end
|
||||
3
configs/fortigate/vdom_root/web-proxy.cfg
Normal file
3
configs/fortigate/vdom_root/web-proxy.cfg
Normal file
@ -0,0 +1,3 @@
|
||||
config web-proxy global
|
||||
set proxy-fqdn "default.fqdn"
|
||||
end
|
||||
1336
configs/fortigate/vdom_root/webfilter.cfg
Normal file
1336
configs/fortigate/vdom_root/webfilter.cfg
Normal file
File diff suppressed because it is too large
Load Diff
43
configs/fortigate/vdom_root/wireless-controller.cfg
Normal file
43
configs/fortigate/vdom_root/wireless-controller.cfg
Normal file
@ -0,0 +1,43 @@
|
||||
config wireless-controller setting
|
||||
set darrp-optimize-schedules "default-darrp-optimize"
|
||||
end
|
||||
config wireless-controller arrp-profile
|
||||
edit "arrp-default"
|
||||
next
|
||||
end
|
||||
config wireless-controller wids-profile
|
||||
edit "default"
|
||||
set comment "Default WIDS profile."
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
set wireless-bridge enable
|
||||
set deauth-broadcast enable
|
||||
set null-ssid-probe-resp enable
|
||||
set long-duration-attack enable
|
||||
set invalid-mac-oui enable
|
||||
set weak-wep-iv enable
|
||||
set auth-frame-flood enable
|
||||
set assoc-frame-flood enable
|
||||
set spoofed-deauth enable
|
||||
set asleap-attack enable
|
||||
set eapol-start-flood enable
|
||||
set eapol-logoff-flood enable
|
||||
set eapol-succ-flood enable
|
||||
set eapol-fail-flood enable
|
||||
set eapol-pre-succ-flood enable
|
||||
set eapol-pre-fail-flood enable
|
||||
next
|
||||
edit "default-wids-apscan-enabled"
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
next
|
||||
end
|
||||
config wireless-controller ble-profile
|
||||
edit "fortiap-discovery"
|
||||
set advertising ibeacon eddystone-uid eddystone-url
|
||||
next
|
||||
end
|
||||
75
configs/fortigate/vdom_scsd/antivirus.cfg
Normal file
75
configs/fortigate/vdom_scsd/antivirus.cfg
Normal file
@ -0,0 +1,75 @@
|
||||
config antivirus settings
|
||||
set machine-learning-detection enable
|
||||
set grayware enable
|
||||
end
|
||||
config antivirus profile
|
||||
edit "g-default"
|
||||
set comment "Scan files and block viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Scan files and monitor viruses."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config http
|
||||
set av-scan block
|
||||
end
|
||||
config ftp
|
||||
set av-scan block
|
||||
end
|
||||
config imap
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config pop3
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
config smtp
|
||||
set av-scan block
|
||||
set executables virus
|
||||
end
|
||||
set outbreak-prevention-archive-scan disable
|
||||
set external-blocklist-enable-all enable
|
||||
next
|
||||
end
|
||||
58
configs/fortigate/vdom_scsd/application.cfg
Normal file
58
configs/fortigate/vdom_scsd/application.cfg
Normal file
@ -0,0 +1,58 @@
|
||||
config application list
|
||||
edit "g-default"
|
||||
set comment "Monitor all applications."
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor all applications."
|
||||
unset options
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set deep-app-inspection disable
|
||||
config entries
|
||||
edit 1
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "App_Ctrl_1"
|
||||
set other-application-log enable
|
||||
set unknown-application-log enable
|
||||
config entries
|
||||
edit 1
|
||||
set application 43541 48977 48976 47822
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
edit 2
|
||||
set application 17405
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
edit 3
|
||||
set application 39243 42662 16171 25953 38547 16270
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
edit 4
|
||||
set category 2 6
|
||||
next
|
||||
edit 5
|
||||
set category 25
|
||||
set action pass
|
||||
set log disable
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
81
configs/fortigate/vdom_scsd/dlp.cfg
Normal file
81
configs/fortigate/vdom_scsd/dlp.cfg
Normal file
@ -0,0 +1,81 @@
|
||||
config dlp filepattern
|
||||
edit 1
|
||||
set name "builtin-patterns"
|
||||
config entries
|
||||
edit "*.bat"
|
||||
next
|
||||
edit "*.com"
|
||||
next
|
||||
edit "*.dll"
|
||||
next
|
||||
edit "*.doc"
|
||||
next
|
||||
edit "*.exe"
|
||||
next
|
||||
edit "*.gz"
|
||||
next
|
||||
edit "*.hta"
|
||||
next
|
||||
edit "*.ppt"
|
||||
next
|
||||
edit "*.rar"
|
||||
next
|
||||
edit "*.scr"
|
||||
next
|
||||
edit "*.tar"
|
||||
next
|
||||
edit "*.tgz"
|
||||
next
|
||||
edit "*.vb?"
|
||||
next
|
||||
edit "*.wps"
|
||||
next
|
||||
edit "*.xl?"
|
||||
next
|
||||
edit "*.zip"
|
||||
next
|
||||
edit "*.pif"
|
||||
next
|
||||
edit "*.cpl"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit 2
|
||||
set name "all_executables"
|
||||
config entries
|
||||
edit "bat"
|
||||
set filter-type type
|
||||
set file-type bat
|
||||
next
|
||||
edit "exe"
|
||||
set filter-type type
|
||||
set file-type exe
|
||||
next
|
||||
edit "elf"
|
||||
set filter-type type
|
||||
set file-type elf
|
||||
next
|
||||
edit "hta"
|
||||
set filter-type type
|
||||
set file-type hta
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config dlp sensitivity
|
||||
edit "Private"
|
||||
next
|
||||
edit "Critical"
|
||||
next
|
||||
edit "Warning"
|
||||
next
|
||||
end
|
||||
config dlp sensor
|
||||
edit "g-default"
|
||||
set comment "Default sensor."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Log a summary of email and web traffic."
|
||||
set summary-proto smtp pop3 imap http-get http-post
|
||||
next
|
||||
end
|
||||
160
configs/fortigate/vdom_scsd/dnsfilter.cfg
Normal file
160
configs/fortigate/vdom_scsd/dnsfilter.cfg
Normal file
@ -0,0 +1,160 @@
|
||||
config dnsfilter profile
|
||||
edit "default"
|
||||
set comment "Default dns filtering."
|
||||
config ftgd-dns
|
||||
config filters
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 7
|
||||
next
|
||||
edit 3
|
||||
set category 8
|
||||
next
|
||||
edit 4
|
||||
set category 9
|
||||
next
|
||||
edit 5
|
||||
set category 11
|
||||
next
|
||||
edit 6
|
||||
set category 12
|
||||
next
|
||||
edit 7
|
||||
set category 13
|
||||
next
|
||||
edit 8
|
||||
set category 14
|
||||
next
|
||||
edit 9
|
||||
set category 15
|
||||
next
|
||||
edit 10
|
||||
set category 16
|
||||
next
|
||||
edit 11
|
||||
next
|
||||
edit 12
|
||||
set category 57
|
||||
next
|
||||
edit 13
|
||||
set category 63
|
||||
next
|
||||
edit 14
|
||||
set category 64
|
||||
next
|
||||
edit 15
|
||||
set category 65
|
||||
next
|
||||
edit 16
|
||||
set category 66
|
||||
next
|
||||
edit 17
|
||||
set category 67
|
||||
next
|
||||
edit 18
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
set block-botnet enable
|
||||
next
|
||||
edit "DNS_Profile"
|
||||
set comment "Default dns filtering."
|
||||
config ftgd-dns
|
||||
set options error-allow
|
||||
config filters
|
||||
edit 1
|
||||
set category 12
|
||||
next
|
||||
edit 2
|
||||
set category 2
|
||||
next
|
||||
edit 3
|
||||
set category 7
|
||||
next
|
||||
edit 4
|
||||
set category 8
|
||||
next
|
||||
edit 5
|
||||
set category 9
|
||||
next
|
||||
edit 6
|
||||
set category 11
|
||||
next
|
||||
edit 7
|
||||
set category 13
|
||||
next
|
||||
edit 8
|
||||
set category 14
|
||||
next
|
||||
edit 9
|
||||
set category 15
|
||||
next
|
||||
edit 10
|
||||
set category 16
|
||||
next
|
||||
edit 11
|
||||
set category 57
|
||||
next
|
||||
edit 12
|
||||
set category 63
|
||||
next
|
||||
edit 13
|
||||
set category 64
|
||||
next
|
||||
edit 14
|
||||
set category 65
|
||||
next
|
||||
edit 15
|
||||
set category 66
|
||||
next
|
||||
edit 16
|
||||
set category 67
|
||||
next
|
||||
edit 17
|
||||
set category 26
|
||||
next
|
||||
edit 18
|
||||
set category 61
|
||||
next
|
||||
edit 19
|
||||
set category 86
|
||||
next
|
||||
edit 20
|
||||
set category 88
|
||||
next
|
||||
edit 21
|
||||
set category 90
|
||||
next
|
||||
edit 22
|
||||
set category 91
|
||||
next
|
||||
edit 23
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
20
configs/fortigate/vdom_scsd/emailfilter.cfg
Normal file
20
configs/fortigate/vdom_scsd/emailfilter.cfg
Normal file
@ -0,0 +1,20 @@
|
||||
config emailfilter profile
|
||||
edit "default"
|
||||
set comment "Malware and phishing URL filtering."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
edit "sniffer-profile"
|
||||
set comment "Malware and phishing URL monitoring."
|
||||
config imap
|
||||
end
|
||||
config pop3
|
||||
end
|
||||
config smtp
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_scsd/file-filter.cfg
Normal file
8
configs/fortigate/vdom_scsd/file-filter.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config file-filter profile
|
||||
edit "g-default"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "File type inspection."
|
||||
next
|
||||
end
|
||||
6568
configs/fortigate/vdom_scsd/firewall.cfg
Normal file
6568
configs/fortigate/vdom_scsd/firewall.cfg
Normal file
File diff suppressed because it is too large
Load Diff
14
configs/fortigate/vdom_scsd/icap.cfg
Normal file
14
configs/fortigate/vdom_scsd/icap.cfg
Normal file
@ -0,0 +1,14 @@
|
||||
config icap profile
|
||||
edit "default"
|
||||
config icap-headers
|
||||
edit 1
|
||||
set name "X-Authenticated-User"
|
||||
set content "$user"
|
||||
next
|
||||
edit 2
|
||||
set name "X-Authenticated-Groups"
|
||||
set content "$local_grp"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
46
configs/fortigate/vdom_scsd/ips.cfg
Normal file
46
configs/fortigate/vdom_scsd/ips.cfg
Normal file
@ -0,0 +1,46 @@
|
||||
config ips sensor
|
||||
edit "g-default"
|
||||
set comment "Prevent critical attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor IPS attacks."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
config entries
|
||||
edit 1
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Incoming_IPS"
|
||||
set block-malicious-url enable
|
||||
config entries
|
||||
edit 1
|
||||
set location server
|
||||
set severity medium high critical
|
||||
set action block
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Outgoing_IPS"
|
||||
set block-malicious-url enable
|
||||
set scan-botnet-connections block
|
||||
config entries
|
||||
edit 1
|
||||
set location client
|
||||
set severity medium high critical
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
86
configs/fortigate/vdom_scsd/log.cfg
Normal file
86
configs/fortigate/vdom_scsd/log.cfg
Normal file
@ -0,0 +1,86 @@
|
||||
config log threat-weight
|
||||
config web
|
||||
edit 1
|
||||
set category 26
|
||||
set level high
|
||||
next
|
||||
edit 2
|
||||
set category 61
|
||||
set level high
|
||||
next
|
||||
edit 3
|
||||
set category 86
|
||||
set level high
|
||||
next
|
||||
edit 4
|
||||
set category 1
|
||||
set level medium
|
||||
next
|
||||
edit 5
|
||||
set category 3
|
||||
set level medium
|
||||
next
|
||||
edit 6
|
||||
set category 4
|
||||
set level medium
|
||||
next
|
||||
edit 7
|
||||
set category 5
|
||||
set level medium
|
||||
next
|
||||
edit 8
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
edit 9
|
||||
set category 12
|
||||
set level medium
|
||||
next
|
||||
edit 10
|
||||
set category 59
|
||||
set level medium
|
||||
next
|
||||
edit 11
|
||||
set category 62
|
||||
set level medium
|
||||
next
|
||||
edit 12
|
||||
set category 83
|
||||
set level medium
|
||||
next
|
||||
edit 13
|
||||
set category 72
|
||||
next
|
||||
edit 14
|
||||
set category 14
|
||||
next
|
||||
edit 15
|
||||
set category 96
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
config application
|
||||
edit 1
|
||||
set category 2
|
||||
next
|
||||
edit 2
|
||||
set category 6
|
||||
set level medium
|
||||
next
|
||||
end
|
||||
end
|
||||
config log memory setting
|
||||
set status enable
|
||||
end
|
||||
config log disk setting
|
||||
set status disable
|
||||
end
|
||||
config log null-device setting
|
||||
set status disable
|
||||
end
|
||||
config log setting
|
||||
set local-in-allow enable
|
||||
set local-in-deny-unicast enable
|
||||
set local-in-deny-broadcast enable
|
||||
set local-out enable
|
||||
end
|
||||
306
configs/fortigate/vdom_scsd/router.cfg
Normal file
306
configs/fortigate/vdom_scsd/router.cfg
Normal file
@ -0,0 +1,306 @@
|
||||
config router rip
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ripng
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router static
|
||||
edit 1
|
||||
set gateway 198.36.24.1
|
||||
set distance 1
|
||||
set device "outside lag"
|
||||
set comment "Outgoing traffic"
|
||||
next
|
||||
edit 2
|
||||
set dst 10.0.0.0 255.0.0.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Internal traffic"
|
||||
next
|
||||
edit 3
|
||||
set dst 10.250.201.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 1"
|
||||
next
|
||||
edit 4
|
||||
set dst 10.250.202.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 2"
|
||||
next
|
||||
edit 5
|
||||
set dst 10.250.203.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 3"
|
||||
next
|
||||
edit 6
|
||||
set dst 10.250.204.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 4"
|
||||
next
|
||||
edit 7
|
||||
set dst 10.250.205.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 5"
|
||||
next
|
||||
edit 8
|
||||
set dst 10.250.206.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 6"
|
||||
next
|
||||
edit 9
|
||||
set dst 10.250.207.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 7"
|
||||
next
|
||||
edit 10
|
||||
set dst 10.250.208.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Ring 8"
|
||||
next
|
||||
edit 11
|
||||
set dst 172.17.0.0 255.255.0.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "CK Mobile 01 IP Range Route"
|
||||
next
|
||||
edit 12
|
||||
set dst 172.18.0.0 255.255.0.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "CK Mobile 02 IP Range Route"
|
||||
next
|
||||
edit 13
|
||||
set dst 172.19.0.0 255.255.0.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "CK Mobile 03 IP Range Route"
|
||||
next
|
||||
edit 14
|
||||
set dst 192.168.0.0 255.255.0.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Management Internal"
|
||||
next
|
||||
edit 15
|
||||
set dst 10.212.134.0 255.255.255.0
|
||||
set gateway 10.251.1.1
|
||||
set distance 1
|
||||
set device "inside lag"
|
||||
set comment "Fortinet VPN"
|
||||
next
|
||||
edit 16
|
||||
set dst 170.161.52.27 255.255.255.255
|
||||
set distance 1
|
||||
set device "SRIC_BOCES"
|
||||
set comment "SRIC BOCES Site-to-Site VPN Route"
|
||||
next
|
||||
edit 17
|
||||
set dst 10.222.0.0 255.255.0.0
|
||||
set device "vpn-042e9903"
|
||||
set comment "eScholar AWS Site-to-Site VPN"
|
||||
next
|
||||
edit 18
|
||||
set dst 10.250.0.0 255.255.0.0
|
||||
set gateway 10.250.100.92
|
||||
set device "city_phones lag"
|
||||
set comment "Route to City Phones"
|
||||
next
|
||||
edit 19
|
||||
set dst 10.107.49.0 255.255.255.0
|
||||
set device "SCHC"
|
||||
set comment "Syracuse Community Health Center Routes"
|
||||
next
|
||||
edit 20
|
||||
set dst 10.107.100.0 255.255.255.0
|
||||
set device "SCHC"
|
||||
set comment "Syracuse Community Health Center Routes"
|
||||
next
|
||||
edit 21
|
||||
set dst 10.107.50.0 255.255.255.0
|
||||
set device "SCHC"
|
||||
set comment "Syracuse Community Health Center Routes"
|
||||
next
|
||||
edit 22
|
||||
set dst 10.253.17.0 255.255.255.0
|
||||
set gateway 10.250.100.92
|
||||
set device "city_phones lag"
|
||||
set comment "City CGRs"
|
||||
next
|
||||
edit 23
|
||||
set dst 10.253.18.0 255.255.255.0
|
||||
set gateway 10.250.100.92
|
||||
set device "city_phones lag"
|
||||
set comment "City CGRs"
|
||||
next
|
||||
edit 24
|
||||
set gateway 10.250.100.92
|
||||
set device "city_phones lag"
|
||||
set comment "City Side Park Place VoIP Route"
|
||||
set dstaddr "City_Side_VoIP_Park_Place_Group"
|
||||
next
|
||||
edit 25
|
||||
set dst 10.249.0.46 255.255.255.255
|
||||
set gateway 10.250.100.92
|
||||
set device "city_phones lag"
|
||||
set comment "City Water/DPW Recording"
|
||||
next
|
||||
edit 26
|
||||
set gateway 10.250.100.92
|
||||
set device "city_phones lag"
|
||||
set comment "SPD Genetec"
|
||||
set dstaddr "SPD_Side_Genetec"
|
||||
next
|
||||
edit 34
|
||||
set dst 172.30.44.0 255.255.254.0
|
||||
set device "vpn-0fc50345"
|
||||
next
|
||||
edit 28
|
||||
set status disable
|
||||
set dst 172.30.45.35 255.255.255.255
|
||||
set device "vpn-0fc50345"
|
||||
next
|
||||
edit 29
|
||||
set dst 172.30.44.0 255.255.254.0
|
||||
set distance 253
|
||||
set blackhole enable
|
||||
next
|
||||
edit 30
|
||||
set dst 10.11.0.0 255.255.240.0
|
||||
set device "vpn-0403e61"
|
||||
set comment "eScholar AWS 2024"
|
||||
next
|
||||
edit 31
|
||||
set dst 10.46.0.0 255.255.0.0
|
||||
set device "DPS"
|
||||
next
|
||||
edit 32
|
||||
set dst 192.168.46.0 255.255.255.0
|
||||
set device "DPS"
|
||||
next
|
||||
edit 33
|
||||
set dst 10.51.62.0 255.255.255.0
|
||||
set device "Highstreet"
|
||||
next
|
||||
edit 37
|
||||
set dst 192.168.146.0 255.255.255.0
|
||||
set device "DPS"
|
||||
next
|
||||
edit 35
|
||||
set dst 192.168.79.0 255.255.255.0
|
||||
set device "RAP"
|
||||
next
|
||||
edit 36
|
||||
set dst 10.79.0.0 255.255.0.0
|
||||
set device "RAP"
|
||||
set comment "RAP Users"
|
||||
next
|
||||
end
|
||||
config router ospf
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router ospf6
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
end
|
||||
config router bgp
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute "isis"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
config redistribute6 "isis"
|
||||
end
|
||||
end
|
||||
config router isis
|
||||
config redistribute "connected"
|
||||
end
|
||||
config redistribute "rip"
|
||||
end
|
||||
config redistribute "ospf"
|
||||
end
|
||||
config redistribute "bgp"
|
||||
end
|
||||
config redistribute "static"
|
||||
end
|
||||
config redistribute6 "connected"
|
||||
end
|
||||
config redistribute6 "rip"
|
||||
end
|
||||
config redistribute6 "ospf"
|
||||
end
|
||||
config redistribute6 "bgp"
|
||||
end
|
||||
config redistribute6 "static"
|
||||
end
|
||||
end
|
||||
config router multicast
|
||||
end
|
||||
224
configs/fortigate/vdom_scsd/switch-controller.cfg
Normal file
224
configs/fortigate/vdom_scsd/switch-controller.cfg
Normal file
@ -0,0 +1,224 @@
|
||||
config switch-controller traffic-policy
|
||||
edit "quarantine"
|
||||
set description "Rate control for quarantined traffic"
|
||||
set guaranteed-bandwidth 163840
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
edit "sniffer"
|
||||
set description "Rate control for sniffer mirrored traffic"
|
||||
set guaranteed-bandwidth 50000
|
||||
set guaranteed-burst 8192
|
||||
set maximum-burst 163840
|
||||
set cos-queue 0
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy 802-1X
|
||||
edit "802-1X-policy-default"
|
||||
set user-group "SSO_Guest_Users"
|
||||
set mac-auth-bypass disable
|
||||
set open-auth disable
|
||||
set eap-passthru enable
|
||||
set eap-auto-untagged-vlans enable
|
||||
set guest-vlan disable
|
||||
set auth-fail-vlan disable
|
||||
set framevid-apply enable
|
||||
set radius-timeout-overwrite disable
|
||||
set authserver-timeout-vlan disable
|
||||
next
|
||||
end
|
||||
config switch-controller security-policy local-access
|
||||
edit "default"
|
||||
set mgmt-allowaccess https ping ssh
|
||||
set internal-allowaccess https ping ssh
|
||||
next
|
||||
end
|
||||
config switch-controller lldp-profile
|
||||
edit "default"
|
||||
set med-tlvs inventory-management network-policy location-identification
|
||||
set auto-isl disable
|
||||
config med-network-policy
|
||||
edit "voice"
|
||||
next
|
||||
edit "voice-signaling"
|
||||
next
|
||||
edit "guest-voice"
|
||||
next
|
||||
edit "guest-voice-signaling"
|
||||
next
|
||||
edit "softphone-voice"
|
||||
next
|
||||
edit "video-conferencing"
|
||||
next
|
||||
edit "streaming-video"
|
||||
next
|
||||
edit "video-signaling"
|
||||
next
|
||||
end
|
||||
config med-location-service
|
||||
edit "coordinates"
|
||||
next
|
||||
edit "address-civic"
|
||||
next
|
||||
edit "elin-number"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "default-auto-isl"
|
||||
next
|
||||
edit "default-auto-mclag-icl"
|
||||
set auto-mclag-icl enable
|
||||
next
|
||||
end
|
||||
config switch-controller qos dot1p-map
|
||||
edit "voice-dot1p"
|
||||
set priority-0 queue-4
|
||||
set priority-1 queue-4
|
||||
set priority-2 queue-3
|
||||
set priority-3 queue-2
|
||||
set priority-4 queue-3
|
||||
set priority-5 queue-1
|
||||
set priority-6 queue-2
|
||||
set priority-7 queue-2
|
||||
next
|
||||
end
|
||||
config switch-controller qos ip-dscp-map
|
||||
edit "voice-dscp"
|
||||
config map
|
||||
edit "1"
|
||||
set cos-queue 1
|
||||
set value 46
|
||||
next
|
||||
edit "2"
|
||||
set cos-queue 2
|
||||
set value 24,26,48,56
|
||||
next
|
||||
edit "5"
|
||||
set cos-queue 3
|
||||
set value 34
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos queue-policy
|
||||
edit "default"
|
||||
set schedule round-robin
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
next
|
||||
edit "queue-2"
|
||||
next
|
||||
edit "queue-3"
|
||||
next
|
||||
edit "queue-4"
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "voice-egress"
|
||||
set schedule weighted
|
||||
set rate-by kbps
|
||||
config cos-queue
|
||||
edit "queue-0"
|
||||
next
|
||||
edit "queue-1"
|
||||
set weight 0
|
||||
next
|
||||
edit "queue-2"
|
||||
set weight 6
|
||||
next
|
||||
edit "queue-3"
|
||||
set weight 37
|
||||
next
|
||||
edit "queue-4"
|
||||
set weight 12
|
||||
next
|
||||
edit "queue-5"
|
||||
next
|
||||
edit "queue-6"
|
||||
next
|
||||
edit "queue-7"
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
config switch-controller qos qos-policy
|
||||
edit "default"
|
||||
next
|
||||
edit "voice-qos"
|
||||
set trust-dot1p-map "voice-dot1p"
|
||||
set trust-ip-dscp-map "voice-dscp"
|
||||
set queue-policy "voice-egress"
|
||||
next
|
||||
end
|
||||
config switch-controller storm-control-policy
|
||||
edit "default"
|
||||
set description "default storm control on all port"
|
||||
next
|
||||
edit "auto-config"
|
||||
set description "storm control policy for fortilink-isl-icl port"
|
||||
set storm-control-mode disabled
|
||||
next
|
||||
end
|
||||
config switch-controller auto-config policy
|
||||
edit "default"
|
||||
next
|
||||
edit "default-icl"
|
||||
set poe-status disable
|
||||
set igmp-flood-report enable
|
||||
set igmp-flood-traffic enable
|
||||
next
|
||||
end
|
||||
config switch-controller initial-config template
|
||||
edit "_default"
|
||||
set vlanid 1
|
||||
next
|
||||
edit "quarantine"
|
||||
set vlanid 4093
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "rspan"
|
||||
set vlanid 4092
|
||||
set dhcp-server enable
|
||||
next
|
||||
edit "voice"
|
||||
set vlanid 4091
|
||||
next
|
||||
edit "video"
|
||||
set vlanid 4090
|
||||
next
|
||||
edit "onboarding"
|
||||
set vlanid 4089
|
||||
next
|
||||
edit "nac_segment"
|
||||
set vlanid 4088
|
||||
set dhcp-server enable
|
||||
next
|
||||
end
|
||||
config switch-controller switch-profile
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config switch-controller ptp settings
|
||||
set mode disable
|
||||
end
|
||||
config switch-controller ptp policy
|
||||
edit "default"
|
||||
set status enable
|
||||
next
|
||||
end
|
||||
config switch-controller remote-log
|
||||
edit "syslogd"
|
||||
next
|
||||
edit "syslogd2"
|
||||
next
|
||||
end
|
||||
120
configs/fortigate/vdom_scsd/system.cfg
Normal file
120
configs/fortigate/vdom_scsd/system.cfg
Normal file
@ -0,0 +1,120 @@
|
||||
config system object-tagging
|
||||
edit "default"
|
||||
next
|
||||
end
|
||||
config system settings
|
||||
set h323-direct-model enable
|
||||
set gui-voip-profile enable
|
||||
set gui-local-in-policy enable
|
||||
set gui-wireless-controller disable
|
||||
set gui-switch-controller disable
|
||||
set gui-dnsfilter disable
|
||||
set gui-advanced-policy enable
|
||||
set gui-allow-unnamed-policy enable
|
||||
set gui-multiple-interface-policy enable
|
||||
end
|
||||
config system replacemsg-group
|
||||
edit "default"
|
||||
set comment "Default replacement message group."
|
||||
next
|
||||
end
|
||||
config system zone
|
||||
edit "outside"
|
||||
set intrazone allow
|
||||
set interface "outside lag"
|
||||
next
|
||||
edit "inside"
|
||||
set intrazone allow
|
||||
set interface "inside lag"
|
||||
next
|
||||
edit "city_phones"
|
||||
set intrazone allow
|
||||
set interface "city_phones lag"
|
||||
next
|
||||
end
|
||||
config system sdwan
|
||||
config zone
|
||||
edit "virtual-wan-link"
|
||||
next
|
||||
end
|
||||
config health-check
|
||||
edit "Default_DNS"
|
||||
set system-dns enable
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Office_365"
|
||||
set server "www.office.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Gmail"
|
||||
set server "gmail.com"
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 2
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_Google Search"
|
||||
set server "www.google.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
edit "Default_FortiGuard"
|
||||
set server "fortiguard.com"
|
||||
set protocol http
|
||||
set interval 1000
|
||||
set probe-timeout 1000
|
||||
set recoverytime 10
|
||||
config sla
|
||||
edit 1
|
||||
set latency-threshold 250
|
||||
set jitter-threshold 50
|
||||
set packetloss-threshold 5
|
||||
next
|
||||
end
|
||||
next
|
||||
end
|
||||
end
|
||||
config system link-monitor
|
||||
edit "1"
|
||||
set srcintf "vpn-0fc50345"
|
||||
set server "169.254.54.77"
|
||||
set interval 20
|
||||
set status disable
|
||||
next
|
||||
end
|
||||
end
|
||||
|
||||
5747
configs/fortigate/vdom_scsd/user.cfg
Normal file
5747
configs/fortigate/vdom_scsd/user.cfg
Normal file
File diff suppressed because it is too large
Load Diff
41
configs/fortigate/vdom_scsd/voip.cfg
Normal file
41
configs/fortigate/vdom_scsd/voip.cfg
Normal file
@ -0,0 +1,41 @@
|
||||
config voip profile
|
||||
edit "default"
|
||||
set comment "Default VoIP profile."
|
||||
next
|
||||
edit "strict"
|
||||
config sip
|
||||
set malformed-request-line discard
|
||||
set malformed-header-via discard
|
||||
set malformed-header-from discard
|
||||
set malformed-header-to discard
|
||||
set malformed-header-call-id discard
|
||||
set malformed-header-cseq discard
|
||||
set malformed-header-rack discard
|
||||
set malformed-header-rseq discard
|
||||
set malformed-header-contact discard
|
||||
set malformed-header-record-route discard
|
||||
set malformed-header-route discard
|
||||
set malformed-header-expires discard
|
||||
set malformed-header-content-type discard
|
||||
set malformed-header-content-length discard
|
||||
set malformed-header-max-forwards discard
|
||||
set malformed-header-allow discard
|
||||
set malformed-header-p-asserted-identity discard
|
||||
set malformed-header-sdp-v discard
|
||||
set malformed-header-sdp-o discard
|
||||
set malformed-header-sdp-s discard
|
||||
set malformed-header-sdp-i discard
|
||||
set malformed-header-sdp-c discard
|
||||
set malformed-header-sdp-b discard
|
||||
set malformed-header-sdp-z discard
|
||||
set malformed-header-sdp-k discard
|
||||
set malformed-header-sdp-a discard
|
||||
set malformed-header-sdp-t discard
|
||||
set malformed-header-sdp-r discard
|
||||
set malformed-header-sdp-m discard
|
||||
end
|
||||
next
|
||||
edit "parks_sip"
|
||||
set comment "VoIP Profile for Parks SIP"
|
||||
next
|
||||
end
|
||||
1026
configs/fortigate/vdom_scsd/vpn.cfg
Normal file
1026
configs/fortigate/vdom_scsd/vpn.cfg
Normal file
File diff suppressed because it is too large
Load Diff
106
configs/fortigate/vdom_scsd/waf.cfg
Normal file
106
configs/fortigate/vdom_scsd/waf.cfg
Normal file
@ -0,0 +1,106 @@
|
||||
config waf profile
|
||||
edit "default"
|
||||
config signature
|
||||
config main-class 100000000
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 20000000
|
||||
end
|
||||
config main-class 30000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 40000000
|
||||
end
|
||||
config main-class 50000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 60000000
|
||||
end
|
||||
config main-class 70000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
config main-class 80000000
|
||||
set status enable
|
||||
set severity low
|
||||
end
|
||||
config main-class 110000000
|
||||
set status enable
|
||||
set severity high
|
||||
end
|
||||
config main-class 90000000
|
||||
set status enable
|
||||
set action block
|
||||
set severity high
|
||||
end
|
||||
set disabled-signature 80080005 80200001 60030001 60120001 80080003 90410001 90410002
|
||||
end
|
||||
config constraint
|
||||
config header-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config content-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config line-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config url-param-length
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config version
|
||||
set log enable
|
||||
end
|
||||
config method
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config hostname
|
||||
set action block
|
||||
set log enable
|
||||
end
|
||||
config malformed
|
||||
set log enable
|
||||
end
|
||||
config max-cookie
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-header-line
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-url-param
|
||||
set status enable
|
||||
set log enable
|
||||
set severity low
|
||||
end
|
||||
config max-range-segment
|
||||
set status enable
|
||||
set log enable
|
||||
set severity high
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
8
configs/fortigate/vdom_scsd/wanopt.cfg
Normal file
8
configs/fortigate/vdom_scsd/wanopt.cfg
Normal file
@ -0,0 +1,8 @@
|
||||
config wanopt settings
|
||||
set host-id "default-id"
|
||||
end
|
||||
config wanopt profile
|
||||
edit "default"
|
||||
set comments "Default WANopt profile."
|
||||
next
|
||||
end
|
||||
3
configs/fortigate/vdom_scsd/web-proxy.cfg
Normal file
3
configs/fortigate/vdom_scsd/web-proxy.cfg
Normal file
@ -0,0 +1,3 @@
|
||||
config web-proxy global
|
||||
set proxy-fqdn "default.fqdn"
|
||||
end
|
||||
584
configs/fortigate/vdom_scsd/webfilter.cfg
Normal file
584
configs/fortigate/vdom_scsd/webfilter.cfg
Normal file
@ -0,0 +1,584 @@
|
||||
config webfilter ftgd-local-cat
|
||||
edit "custom1"
|
||||
set id 140
|
||||
next
|
||||
edit "custom2"
|
||||
set id 141
|
||||
next
|
||||
end
|
||||
config webfilter ips-urlfilter-setting
|
||||
end
|
||||
config webfilter ips-urlfilter-setting6
|
||||
end
|
||||
config webfilter profile
|
||||
edit "g-default"
|
||||
set comment "Default web filtering."
|
||||
config ftgd-wf
|
||||
unset options
|
||||
config filters
|
||||
edit 1
|
||||
set action block
|
||||
next
|
||||
edit 2
|
||||
set category 2
|
||||
set action block
|
||||
next
|
||||
edit 3
|
||||
set category 7
|
||||
set action block
|
||||
next
|
||||
edit 4
|
||||
set category 8
|
||||
set action block
|
||||
next
|
||||
edit 5
|
||||
set category 9
|
||||
set action block
|
||||
next
|
||||
edit 6
|
||||
set category 11
|
||||
set action block
|
||||
next
|
||||
edit 7
|
||||
set category 12
|
||||
set action block
|
||||
next
|
||||
edit 8
|
||||
set category 13
|
||||
set action block
|
||||
next
|
||||
edit 9
|
||||
set category 14
|
||||
set action block
|
||||
next
|
||||
edit 10
|
||||
set category 15
|
||||
set action block
|
||||
next
|
||||
edit 11
|
||||
set category 16
|
||||
set action block
|
||||
next
|
||||
edit 12
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 13
|
||||
set category 57
|
||||
set action block
|
||||
next
|
||||
edit 14
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 15
|
||||
set category 63
|
||||
set action block
|
||||
next
|
||||
edit 16
|
||||
set category 64
|
||||
set action block
|
||||
next
|
||||
edit 17
|
||||
set category 65
|
||||
set action block
|
||||
next
|
||||
edit 18
|
||||
set category 66
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 67
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
edit "g-sniffer-profile"
|
||||
set comment "Monitor web traffic."
|
||||
config ftgd-wf
|
||||
config filters
|
||||
edit 1
|
||||
next
|
||||
edit 2
|
||||
set category 1
|
||||
next
|
||||
edit 3
|
||||
set category 2
|
||||
next
|
||||
edit 4
|
||||
set category 3
|
||||
next
|
||||
edit 5
|
||||
set category 4
|
||||
next
|
||||
edit 6
|
||||
set category 5
|
||||
next
|
||||
edit 7
|
||||
set category 6
|
||||
next
|
||||
edit 8
|
||||
set category 7
|
||||
next
|
||||
edit 9
|
||||
set category 8
|
||||
next
|
||||
edit 10
|
||||
set category 9
|
||||
next
|
||||
edit 11
|
||||
set category 11
|
||||
next
|
||||
edit 12
|
||||
set category 12
|
||||
next
|
||||
edit 13
|
||||
set category 13
|
||||
next
|
||||
edit 14
|
||||
set category 14
|
||||
next
|
||||
edit 15
|
||||
set category 15
|
||||
next
|
||||
edit 16
|
||||
set category 16
|
||||
next
|
||||
edit 17
|
||||
set category 17
|
||||
next
|
||||
edit 18
|
||||
set category 18
|
||||
next
|
||||
edit 19
|
||||
set category 19
|
||||
next
|
||||
edit 20
|
||||
set category 20
|
||||
next
|
||||
edit 21
|
||||
set category 23
|
||||
next
|
||||
edit 22
|
||||
set category 24
|
||||
next
|
||||
edit 23
|
||||
set category 25
|
||||
next
|
||||
edit 24
|
||||
set category 26
|
||||
next
|
||||
edit 25
|
||||
set category 28
|
||||
next
|
||||
edit 26
|
||||
set category 29
|
||||
next
|
||||
edit 27
|
||||
set category 30
|
||||
next
|
||||
edit 28
|
||||
set category 31
|
||||
next
|
||||
edit 29
|
||||
set category 33
|
||||
next
|
||||
edit 30
|
||||
set category 34
|
||||
next
|
||||
edit 31
|
||||
set category 35
|
||||
next
|
||||
edit 32
|
||||
set category 36
|
||||
next
|
||||
edit 33
|
||||
set category 37
|
||||
next
|
||||
edit 34
|
||||
set category 38
|
||||
next
|
||||
edit 35
|
||||
set category 39
|
||||
next
|
||||
edit 36
|
||||
set category 40
|
||||
next
|
||||
edit 37
|
||||
set category 41
|
||||
next
|
||||
edit 38
|
||||
set category 42
|
||||
next
|
||||
edit 39
|
||||
set category 43
|
||||
next
|
||||
edit 40
|
||||
set category 44
|
||||
next
|
||||
edit 41
|
||||
set category 46
|
||||
next
|
||||
edit 42
|
||||
set category 47
|
||||
next
|
||||
edit 43
|
||||
set category 48
|
||||
next
|
||||
edit 44
|
||||
set category 49
|
||||
next
|
||||
edit 45
|
||||
set category 50
|
||||
next
|
||||
edit 46
|
||||
set category 51
|
||||
next
|
||||
edit 47
|
||||
set category 52
|
||||
next
|
||||
edit 48
|
||||
set category 53
|
||||
next
|
||||
edit 49
|
||||
set category 54
|
||||
next
|
||||
edit 50
|
||||
set category 55
|
||||
next
|
||||
edit 51
|
||||
set category 56
|
||||
next
|
||||
edit 52
|
||||
set category 57
|
||||
next
|
||||
edit 53
|
||||
set category 58
|
||||
next
|
||||
edit 54
|
||||
set category 59
|
||||
next
|
||||
edit 55
|
||||
set category 61
|
||||
next
|
||||
edit 56
|
||||
set category 62
|
||||
next
|
||||
edit 57
|
||||
set category 63
|
||||
next
|
||||
edit 58
|
||||
set category 64
|
||||
next
|
||||
edit 59
|
||||
set category 65
|
||||
next
|
||||
edit 60
|
||||
set category 66
|
||||
next
|
||||
edit 61
|
||||
set category 67
|
||||
next
|
||||
edit 62
|
||||
set category 68
|
||||
next
|
||||
edit 63
|
||||
set category 69
|
||||
next
|
||||
edit 64
|
||||
set category 70
|
||||
next
|
||||
edit 65
|
||||
set category 71
|
||||
next
|
||||
edit 66
|
||||
set category 72
|
||||
next
|
||||
edit 67
|
||||
set category 75
|
||||
next
|
||||
edit 68
|
||||
set category 76
|
||||
next
|
||||
edit 69
|
||||
set category 77
|
||||
next
|
||||
edit 70
|
||||
set category 78
|
||||
next
|
||||
edit 71
|
||||
set category 79
|
||||
next
|
||||
edit 72
|
||||
set category 80
|
||||
next
|
||||
edit 73
|
||||
set category 81
|
||||
next
|
||||
edit 74
|
||||
set category 82
|
||||
next
|
||||
edit 75
|
||||
set category 83
|
||||
next
|
||||
edit 76
|
||||
set category 84
|
||||
next
|
||||
edit 77
|
||||
set category 85
|
||||
next
|
||||
edit 78
|
||||
set category 86
|
||||
next
|
||||
edit 79
|
||||
set category 87
|
||||
next
|
||||
edit 80
|
||||
set category 88
|
||||
next
|
||||
edit 81
|
||||
set category 89
|
||||
next
|
||||
edit 82
|
||||
set category 90
|
||||
next
|
||||
edit 83
|
||||
set category 91
|
||||
next
|
||||
edit 84
|
||||
set category 92
|
||||
next
|
||||
edit 85
|
||||
set category 93
|
||||
next
|
||||
edit 86
|
||||
set category 94
|
||||
next
|
||||
edit 87
|
||||
set category 95
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
edit "g-wifi-default"
|
||||
set comment "Default configuration for offloading WiFi traffic."
|
||||
set options block-invalid-url
|
||||
config ftgd-wf
|
||||
unset options
|
||||
config filters
|
||||
edit 1
|
||||
next
|
||||
edit 2
|
||||
set category 2
|
||||
set action block
|
||||
next
|
||||
edit 3
|
||||
set category 7
|
||||
set action block
|
||||
next
|
||||
edit 4
|
||||
set category 8
|
||||
set action block
|
||||
next
|
||||
edit 5
|
||||
set category 9
|
||||
set action block
|
||||
next
|
||||
edit 6
|
||||
set category 11
|
||||
set action block
|
||||
next
|
||||
edit 7
|
||||
set category 12
|
||||
set action block
|
||||
next
|
||||
edit 8
|
||||
set category 13
|
||||
set action block
|
||||
next
|
||||
edit 9
|
||||
set category 14
|
||||
set action block
|
||||
next
|
||||
edit 10
|
||||
set category 15
|
||||
set action block
|
||||
next
|
||||
edit 11
|
||||
set category 16
|
||||
set action block
|
||||
next
|
||||
edit 12
|
||||
set category 26
|
||||
set action block
|
||||
next
|
||||
edit 13
|
||||
set category 57
|
||||
set action block
|
||||
next
|
||||
edit 14
|
||||
set category 61
|
||||
set action block
|
||||
next
|
||||
edit 15
|
||||
set category 63
|
||||
set action block
|
||||
next
|
||||
edit 16
|
||||
set category 64
|
||||
set action block
|
||||
next
|
||||
edit 17
|
||||
set category 65
|
||||
set action block
|
||||
next
|
||||
edit 18
|
||||
set category 66
|
||||
set action block
|
||||
next
|
||||
edit 19
|
||||
set category 67
|
||||
set action block
|
||||
next
|
||||
edit 20
|
||||
set category 86
|
||||
set action block
|
||||
next
|
||||
edit 21
|
||||
set category 88
|
||||
set action block
|
||||
next
|
||||
edit 22
|
||||
set category 90
|
||||
set action block
|
||||
next
|
||||
edit 23
|
||||
set category 91
|
||||
set action block
|
||||
next
|
||||
end
|
||||
end
|
||||
next
|
||||
end
|
||||
config webfilter search-engine
|
||||
edit "g-baidu"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/s?\\?"
|
||||
set query "wd="
|
||||
next
|
||||
edit "g-baidu2"
|
||||
set hostname ".*\\.baidu\\.com"
|
||||
set url "^\\/(ns|q|m|i|v)\\?"
|
||||
set query "word="
|
||||
next
|
||||
edit "g-baidu3"
|
||||
set hostname "tieba\\.baidu\\.com"
|
||||
set url "^\\/f\\?"
|
||||
set query "kw="
|
||||
next
|
||||
edit "g-bing"
|
||||
set hostname ".*\\.bing\\..*"
|
||||
set url "^(\\/images|\\/videos)?(\\/search|\\/async|\\/asyncv2)\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-google"
|
||||
set hostname ".*\\.google\\..*"
|
||||
set url "^\\/((custom|search|images|videosearch|webhp)\\?)"
|
||||
set query "q="
|
||||
set safesearch url
|
||||
set safesearch-str "&safe=active"
|
||||
next
|
||||
edit "g-google-translate-1"
|
||||
set hostname "translate\\.google\\..*"
|
||||
set url "^\\/translate"
|
||||
set query "u="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-google-translate-2"
|
||||
set hostname ".*\\.translate\\.goog"
|
||||
set url "^\\/"
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-twitter"
|
||||
set hostname "twitter\\.com"
|
||||
set url "^\\/i\\/api\\/graphql\\/.*\\/UserByScreenName"
|
||||
set query "variables="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "g-vimeo"
|
||||
set hostname ".*vimeo.*"
|
||||
set url "^\\/search\\?"
|
||||
set query "q="
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yahoo"
|
||||
set hostname ".*\\.yahoo\\..*"
|
||||
set url "^\\/search(\\/video|\\/images){0,1}(\\?|;)"
|
||||
set query "p="
|
||||
set safesearch url
|
||||
set safesearch-str "&vm=r"
|
||||
next
|
||||
edit "g-yandex"
|
||||
set hostname "yandex\\..*"
|
||||
set url "^\\/((yand|images\\/|video\\/)(search)|search\\/)\\?"
|
||||
set query "text="
|
||||
set safesearch url
|
||||
set safesearch-str "&family=yes"
|
||||
next
|
||||
edit "g-youtube"
|
||||
set hostname ".*youtube.*"
|
||||
set safesearch header
|
||||
next
|
||||
edit "g-yt-channel"
|
||||
set url "www.youtube.com/channel"
|
||||
set safesearch yt-channel
|
||||
next
|
||||
edit "g-yt-pattern"
|
||||
set url "youtube.com/channel/"
|
||||
set safesearch yt-pattern
|
||||
next
|
||||
edit "g-yt-scan-1"
|
||||
set url "www.youtube.com/user/"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-2"
|
||||
set url "www.youtube.com/youtubei/v1/browse"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-3"
|
||||
set url "www.youtube.com/youtubei/v1/player"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "g-yt-scan-4"
|
||||
set url "www.youtube.com/youtubei/v1/navigator"
|
||||
set safesearch yt-scan
|
||||
next
|
||||
edit "translate"
|
||||
set hostname "translate\\.google\\..*"
|
||||
set url "^\\/translate\\?"
|
||||
set query "u="
|
||||
set safesearch translate
|
||||
next
|
||||
edit "yt-video"
|
||||
set url "www.youtube.com/watch"
|
||||
set safesearch yt-video
|
||||
next
|
||||
end
|
||||
43
configs/fortigate/vdom_scsd/wireless-controller.cfg
Normal file
43
configs/fortigate/vdom_scsd/wireless-controller.cfg
Normal file
@ -0,0 +1,43 @@
|
||||
config wireless-controller setting
|
||||
set darrp-optimize-schedules "default-darrp-optimize"
|
||||
end
|
||||
config wireless-controller arrp-profile
|
||||
edit "arrp-default"
|
||||
next
|
||||
end
|
||||
config wireless-controller wids-profile
|
||||
edit "default"
|
||||
set comment "Default WIDS profile."
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
set wireless-bridge enable
|
||||
set deauth-broadcast enable
|
||||
set null-ssid-probe-resp enable
|
||||
set long-duration-attack enable
|
||||
set invalid-mac-oui enable
|
||||
set weak-wep-iv enable
|
||||
set auth-frame-flood enable
|
||||
set assoc-frame-flood enable
|
||||
set spoofed-deauth enable
|
||||
set asleap-attack enable
|
||||
set eapol-start-flood enable
|
||||
set eapol-logoff-flood enable
|
||||
set eapol-succ-flood enable
|
||||
set eapol-fail-flood enable
|
||||
set eapol-pre-succ-flood enable
|
||||
set eapol-pre-fail-flood enable
|
||||
next
|
||||
edit "default-wids-apscan-enabled"
|
||||
set ap-scan enable
|
||||
set ap-bgscan-intv 1
|
||||
set ap-bgscan-duration 20
|
||||
set ap-bgscan-idle 0
|
||||
next
|
||||
end
|
||||
config wireless-controller ble-profile
|
||||
edit "fortiap-discovery"
|
||||
set advertising ibeacon eddystone-uid eddystone-url
|
||||
next
|
||||
end
|
||||
Loading…
x
Reference in New Issue
Block a user