台北市教育局防火牆 安裝程序及注意事項

Agenda 防火牆設定 安裝作業 簽收文件

防火牆設定 統一使用OS 5.0 MR2 Patch3 Fortigate 5.2.3 VM and Installation Guide 下載位置 https://www.dropbox.com/sh/dw7wlv0dfehd8ku/AABHaVQ7AtqXBLxx8-qveWjja?dl=0 拿到設備後請務必使用Console將原有韌體刪除，再上傳新的韌體（無論原本使用哪個版本） 設定正確時區 admin帳號給老師使用 另請新增一個superadmin帳號密碼為 tpe / tpe21002458，並開啟WAN port的HTTPS權限以供遠端登入 若老師有要鎖管理IP，請輸入力麗科技 IP：59.124.82.62

重置韌體作業程序 –模式一 電腦請設定IP為192.168.1.168，並接上FG200D的MGMT port 開啟Console及TFTP軟體 FG200D開機 FortiGate-200D (17:46-08.07.2014) Ver:05000004 Serial number:FG200D4614809035 RAM activation CPU(00:000206a7 bfebfbff): MP initialization CPU(02:000206a7 bfebfbff): MP initialization Total RAM: 4096MB Enabling cache...Done. Scanning PCI bus...Done. Allocating PCI resources...Done. Enabling PCI resources...Done. Zeroing IRQ settings...Done. Verifying PIRQ tables...Done. Boot up, boot device capacity: 15272MB. Press any key to display configuration menu... ..... 請按下任意鍵以中斷開機程序

[C]: Configure TFTP parameters. [R]: Review TFTP parameters. [T]: Initiate TFTP firmware transfer. [F]: Format boot device. [B]: Boot with backup firmware and set as default. [I]: System information. [Q]: Quit menu and continue to boot. [H]: Display this list of options. Enter C,R,T,F,B,I,Q,or H: All data will be erased,continue:[Y/N]? Formatting boot device... .............................. Format boot device completed. 輸入“F”刪除原有韌體 輸入“Y”

Enter C,R,T,F,B,I,Q,or H: Image download port: MGMT DHCP status: disabled Local VLAN ID: none Local IP address: 192.168.1.68 Local subnet mask: 255.255.255.0 Local gateway: 192.168.1.254 TFTP server IP address: 192.168.1.168 Firmware file name: FGT_200D-v5-build0318-FORTINET.out 輸入“R”確認各項資訊是否正確 韌體檔名不對，需更換 輸入“C”更換韌體檔名

[P]: Set image download port. [D]: Set DHCP mode. [I]: Set local IP address. [S]: Set local subnet mask. [G]: Set local gateway. [V]: Set local VLAN ID. [T]: Set remote TFTP server IP address. [F]: Set firmware image file name. [E]: Reset TFTP parameters to factory defaults. [R]: Review TFTP parameters. [N]: Diagnose networking (ping). [Q]: Quit this menu. [H]: Display this list of options. Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: Enter firmware file name [FGT_200D-v5-build0318-FORTINET.out]:FGT_200D-v5-build0670-FORTINET.out 輸入“F”更換韌體檔名 輸入5.2.3韌體檔名

Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: [C]: Configure TFTP parameters. [R]: Review TFTP parameters. [T]: Initiate TFTP firmware transfer. [F]: Format boot device. [B]: Boot with backup firmware and set as default. [I]: System information. [Q]: Quit menu and continue to boot. [H]: Display this list of options. Enter C,R,T,F,B,I,Q,or H: Image download port: MGMT DHCP status: disabled Local VLAN ID: none Local IP address: 192.168.1.68 Local subnet mask: 255.255.255.0 Local gateway: 192.168.1.254 TFTP server IP address: 192.168.1.168 Firmware file name: FGT_200D-v5-build0670-FORTINET.out 輸入“Q”回到上層選單 輸入“R”再次確認是否正確

Enter C,R,T,F,B,I,Q,or H: Please connect TFTP server to Ethernet port "MGMT". Initiating firmware TFTP Transfer... MAC: 08:5B:0E:AD:7E:40 ################################ Total 33922470 bytes data downloaded. Verifying the integrity of the firmware image. Total 262144kB unzipped. Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?d Programming the boot device now. ................................................................................................................................................................................................................................................................ Reading boot image 1379898 bytes. Initializing firewall... System is starting... Resizing shared data partition...done Starting system maintenance... Scanning /dev/sda1... (100%) Formatting shared data partition ... done! 輸入“T”開始上傳韌體 輸入“d”使成為預設韌體 使用新韌體開機完成

重置韌體作業程序 –模式二 電腦請設定IP為192.168.1.168，並接上FG200D的MGMT port 開啟Console及TFTP軟體 FG200D開機 FortiGate-600C (20:43-08.19.2014) Ver:04000023 Serial number:FG200D3914802273 RAM activation CPU(00:00020655 bfebfbff): MP initialization CPU(01:00020655 bfebfbff): MP initialization Total RAM: 4096MB Enabling cache...Done. Scanning PCI bus...Done. Allocating PCI resources...Done. Enabling PCI resources...Done. Zeroing IRQ settings...Done. Verifying PIRQ tables...Done. Boot up, boot device capacity: 15272MB. Press any key to display configuration menu... 請按下任意鍵以中斷開機程序

[G]: Get firmware image from TFTP server. [F]: Format boot device. [B]: Boot with backup firmware and set as default. [I]: Configuration and information. [Q]: Quit menu and continue to boot with default firmware. [H]: Display this list of options. Enter Selection [G]: Enter G,F,B,I,Q,or H: All data will be erased,continue:[Y/N]? Formatting boot device... .............................. Format boot device completed. 輸入“F”刪除原有韌體 輸入“Y”

輸入“G”開始上傳韌體 Enter G,F,B,I,Q,or H: Please connect TFTP server to Ethernet port "MGMT1". Enter TFTP server address [192.168.1.168]: Enter local address [192.168.1.188]: Enter firmware image file name [image.out]: FGT_200D-v5-build0670-FORTINET.out MAC:085B0E9CAED2 ############################### Total 32526608 bytes data downloaded. Verifying the integrity of the firmware image. Total 262144kB unzipped. Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]?d Programming the boot device now. ................................................................................................................................................................................................................................................................ Reading boot image 1376326 bytes. Initializing firewall... System is starting... Formatting shared data partition ... done! 直接按Enter跳過 輸入5.2.3韌體檔名 輸入“d”使成為預設韌體 使用新韌體開機完成

使用Zone建立Interface，將Interface放到Zone之中 TANet接在WAN1，Lan使用Switch Port1（單獨拆出來），Wifi使用Swicth Port2（單獨拆出來） ZONE名稱分別使用WAN, LAN, WIFI

移除SIP session helper避免干擾網路電話運作 在CLI中輸入 config system setting set sip-helper disable end config system session-helper delete 13

認證機制（無線網路認證由Fortigate為之） 無線網路使用者（舊有Fat AP以及Cisco Thin AP）透過有線網路進到Fortigate 同時使用教育局Radius以及學校自有AD或者Radius認證 User & Device -> Authentication -> RADIUS Servers，新增

Radius Server Name : 自訂 Primary Server IP : 163.21.249.130 Primary Server Secret : tpeduaaa 可使用“Test Connectivity”請老師輸入教育局帳號密碼測試 若學校自有認證伺服器為Radius，請再建立一組即可

AD Server User & Device -> Authentication -> LDAP Servers，新增

Name : 自訂 Primary Server IP : 自訂 Server Port : 389 Common Name Identifier : SamAccountName Distinguished Name : 如下圖範例所示，需填寫完整路徑 Bind Type : Regular User DN :如下圖範例所示，需填寫完整路徑 Password : 自訂 可使用“Test Connectivity”確認是否成功

設定認證群組 User & Device -> User -> User Groups，新增 Name : 自訂 Remote Groups->新增->選定先前新增的Radius and LDAP Server

介面啟用Captive Portal 選擇WIFI介面 Security Mode -> Captive Portal User Groups -> 先前建立的group

無線學習載具排除清單設置 User & Device -> Device Definitions，新增 Alias : 輸入MAC Address MAC Address :輸入MAC Address

User & Device -> Device Groups，新增 Name : 自訂 Members:自行加入所需之MAC Address

WIFI介面 Exempt List : 選擇先前建立的Device Group

安裝作業 安裝前務必依據“初驗表”確認現有網路運作狀態 市網連線參考網站：http://speedtest.tp.edu.tw 學校網頁IPv6測試參考網站：http://ipv6.tp.edu.tw/ DNS IPv6測試參考網站：http://ipv6.tp.edu.tw/dns.php

線路改接後，防火牆上下 Layer3設備請老師重開機 Cisco 3560, Cisco Wireless Controller（大部分學校是這幾個設備） 使用指令輸入FG200D：diag ipv6 address list，查看介接Wireless Controller的port，並抄下local address（此範例是接在port16） 登入Cisco Controller更改IPv6 Gateway Controller->Interfaces->IPv6 Gateway

改完後請記得存檔 更改完成後請用telnet登入Cisco Controller進行Ping 2001:b000:168::1 <- Hinet DNS PS. 請勿使用GUI的Ping測試，是無法測通 若Controller並未開放Telnet，請到Management中啟用

簽收文件 Fortigate操作手冊 簡易除厝手冊 防火牆初驗表 ： https://dl.dropboxusercontent.com/u/53758003/%E6%95%99%E8%82%B2%E5%B1%80/%E4%BA%A4%E4%BB%98%E8%B3%87%E6%96%99/104%E9%98%B2%E7%81%AB%E7%89%86%E5%88%9D%E9%A9%97%E8%A1%A8-new-F2.docx 拓樸圖（安裝後）：https://dl.dropboxusercontent.com/u/53758003/%E6%95%99%E8%82%B2%E5%B1%80/%E4%BA%A4%E4%BB%98%E8%B3%87%E6%96%99/%E6%8B%93%E6%A8%B8%E5%9C%96.docx 貼上保固貼紙 設備照片 以上文件於安裝完成後請各校資訊組長簽名並複印，複本給學校留存，正本攜回後交給負責組長統一交付力麗科技 各廠商負責人請每天填妥“工作時數表” 並寄送給Harry : harry@llt.com.tw 下載位置https://dl.dropboxusercontent.com/u/53758003/%E6%95%99%E8%82%B2%E5%B1%80/%E4%BA%A4%E4%BB%98%E8%B3%87%E6%96%99/(Excel%E6%AA%94)%E8%87%BA%E5%8C%97%E5%B8%82%E6%95%99%E8%82%B2%E7%B6%B2223%E5%AE%B6%E5%AD%B8%E6%A0%A1_%E5%B7%A5%E4%BD%9C%E6%99%82%E6%95%B8%E8%A1%A8v2.xlsx

多個內網IP轉換成一個真實IP （內對外） 一對一對應 (通常在DMZ） IPv6 RA要啟用 Web Server做成一個群組，未來只要多一個網站，直接將IP放進該條Policy即可 校務行政自己做一條 若無法提供環境調查表，可請老師提供防火牆登入資訊，自行連線進去移轉設定 或者直接內對外全開，再詢問老師有哪些對外服務，直接設定即可

Fortinet FortiGate Pricing FortiGuard Services simple licensing and pricing model maintained FortiGate more performance, more features, same aggressive pricing No complex feature enablement No per user calculations No surprises