ansible/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2024-09-14 20:13:21 +02:00
Code Releases Activity
community.general/test/integration/targets/fortios_address/files/default_config.conf.backup

3135 lines
86 KiB
Text
Raw Normal View History

Manage Fortios/Fortigate Address (#21542) * New module fortios_address * Add module_utils required_if + fix Doc * Merge spec & required_if from module_utils * Fix pep8 * Py2.5 compat , cosmetic changes * Fix param timeout * Fortios_address module + integration tests * add netaddr library in requirements for integration tests * Pep8 problems * ANSIBLE_METADATA.version -> ANSIBLE_METADATA.metadata_version
2017-08-01 19:17:12 +02:00
config system global
set timezone 04
set admintimeout 480
set admin-server-cert "Fortinet_Firmware"
set fgd-alert-subscription advisory latest-threat
set hostname "FortiGate-VM64-HV"
end
config system accprofile
edit prof_admin
set vpngrp read-write
set updategrp read-write
set utmgrp read-write
set routegrp read-write
set wifi read-write
set sysgrp read-write
set loggrp read-write
set mntgrp read-write
set netgrp read-write
set admingrp read-write
set wanoptgrp read-write
set fwgrp read-write
set authgrp read-write
set endpoint-control-grp read-write
next
end
config system interface
edit port1
set ip 192.168.137.154 255.255.255.0
set type physical
set allowaccess ping https ssh http fgfm
set vdom "root"
next
edit port2
set type physical
set vdom "root"
next
edit port3
set type physical
set vdom "root"
next
edit port4
set type physical
set vdom "root"
next
edit port5
set type physical
set vdom "root"
next
edit port6
set type physical
set vdom "root"
next
edit port7
set type physical
set vdom "root"
next
edit port8
set type physical
set vdom "root"
next
edit ssl.root
set alias "SSL VPN interface"
set type tunnel
set vdom "root"
next
end
config system custom-language
edit en
set filename "en"
next
edit fr
set filename "fr"
next
edit sp
set filename "sp"
next
edit pg
set filename "pg"
next
edit x-sjis
set filename "x-sjis"
next
edit big5
set filename "big5"
next
edit GB2312
set filename "GB2312"
next
edit euc-kr
set filename "euc-kr"
next
end
config system admin
edit admin
set accprofile "super_admin"
set vdom "root"
config dashboard-tabs
edit 1
set name "Status"
next
end
config dashboard
edit 1
set column 1
set tab-id 1
next
edit 2
set column 1
set widget-type licinfo
set tab-id 1
next
edit 3
set column 1
set widget-type jsconsole
set tab-id 1
next
edit 4
set column 2
set widget-type sysres
set tab-id 1
next
edit 5
set column 2
set widget-type gui-features
set tab-id 1
next
edit 6
set column 2
set top-n 10
set widget-type alert
set tab-id 1
next
end
next
end
config system ha
set override disable
end
config system dns
set primary 208.91.112.53
set secondary 208.91.112.52
end
config system replacemsg-image
edit logo_fnet
set image-base64 ''
set image-type gif
next
edit logo_fguard_wf
set image-base64 ''
set image-type gif
next
edit logo_fw_auth
set image-base64 ''
set image-type png
next
edit logo_v2_fnet
set image-base64 ''
set image-type png
next
edit logo_v2_fguard_wf
set image-base64 ''
set image-type png
next
edit logo_v2_fguard_app
set image-base64 ''
set image-type png
next
end
config system replacemsg mail email-block
end
config system replacemsg mail email-dlp-subject
end
config system replacemsg mail email-dlp-ban
end
config system replacemsg mail email-filesize
end
config system replacemsg mail partial
end
config system replacemsg mail smtp-block
end
config system replacemsg mail smtp-filesize
end
config system replacemsg http bannedword
end
config system replacemsg http url-block
end
config system replacemsg http urlfilter-err
end
config system replacemsg http infcache-block
end
config system replacemsg http http-block
end
config system replacemsg http http-filesize
end
config system replacemsg http http-dlp-ban
end
config system replacemsg http http-archive-block
end
config system replacemsg http http-contenttypeblock
end
config system replacemsg http https-invalid-cert-block
end
config system replacemsg http http-client-block
end
config system replacemsg http http-client-filesize
end
config system replacemsg http http-client-bannedword
end
config system replacemsg http http-post-block
end
config system replacemsg http http-client-archive-block
end
config system replacemsg http switching-protocols-block
end
config system replacemsg webproxy deny
end
config system replacemsg webproxy user-limit
end
config system replacemsg webproxy auth-challenge
end
config system replacemsg webproxy auth-login-fail
end
config system replacemsg webproxy auth-authorization-fail
end
config system replacemsg webproxy http-err
end
config system replacemsg webproxy auth-ip-blackout
end
config system replacemsg ftp ftp-dl-blocked
end
config system replacemsg ftp ftp-dl-filesize
end
config system replacemsg ftp ftp-dl-dlp-ban
end
config system replacemsg ftp ftp-explicit-banner
end
config system replacemsg ftp ftp-dl-archive-block
end
config system replacemsg nntp nntp-dl-blocked
end
config system replacemsg nntp nntp-dl-filesize
end
config system replacemsg nntp nntp-dlp-subject
end
config system replacemsg nntp nntp-dlp-ban
end
config system replacemsg fortiguard-wf ftgd-block
end
config system replacemsg fortiguard-wf http-err
end
config system replacemsg fortiguard-wf ftgd-ovrd
end
config system replacemsg fortiguard-wf ftgd-quota
end
config system replacemsg fortiguard-wf ftgd-warning
end
config system replacemsg spam ipblocklist
end
config system replacemsg spam smtp-spam-dnsbl
end
config system replacemsg spam smtp-spam-feip
end
config system replacemsg spam smtp-spam-helo
end
config system replacemsg spam smtp-spam-emailblack
end
config system replacemsg spam smtp-spam-mimeheader
end
config system replacemsg spam reversedns
end
config system replacemsg spam smtp-spam-bannedword
end
config system replacemsg spam smtp-spam-ase
end
config system replacemsg spam submit
end
config system replacemsg im im-file-xfer-block
end
config system replacemsg im im-file-xfer-name
end
config system replacemsg im im-file-xfer-infected
end
config system replacemsg im im-file-xfer-size
end
config system replacemsg im im-dlp
end
config system replacemsg im im-dlp-ban
end
config system replacemsg im im-voice-chat-block
end
config system replacemsg im im-video-chat-block
end
config system replacemsg im im-photo-share-block
end
config system replacemsg im im-long-chat-block
end
config system replacemsg alertmail alertmail-virus
end
config system replacemsg alertmail alertmail-block
end
config system replacemsg alertmail alertmail-nids-event
end
config system replacemsg alertmail alertmail-crit-event
end
config system replacemsg alertmail alertmail-disk-full
end
config system replacemsg admin pre_admin-disclaimer-text
end
config system replacemsg admin post_admin-disclaimer-text
end
config system replacemsg auth auth-disclaimer-page-1
end
config system replacemsg auth auth-disclaimer-page-2
end
config system replacemsg auth auth-disclaimer-page-3
end
config system replacemsg auth auth-reject-page
end
config system replacemsg auth auth-login-page
end
config system replacemsg auth auth-login-failed-page
end
config system replacemsg auth auth-token-login-page
end
config system replacemsg auth auth-token-login-failed-page
end
config system replacemsg auth auth-success-msg
end
config system replacemsg auth auth-challenge-page
end
config system replacemsg auth auth-keepalive-page
end
config system replacemsg auth auth-portal-page
end
config system replacemsg auth auth-password-page
end
config system replacemsg auth auth-fortitoken-page
end
config system replacemsg auth auth-next-fortitoken-page
end
config system replacemsg auth auth-email-token-page
end
config system replacemsg auth auth-sms-token-page
end
config system replacemsg auth auth-email-harvesting-page
end
config system replacemsg auth auth-email-failed-page
end
config system replacemsg auth auth-cert-passwd-page
end
config system replacemsg auth auth-guest-print-page
end
config system replacemsg auth auth-guest-email-page
end
config system replacemsg auth auth-success-page
end
config system replacemsg auth auth-block-notification-page
end
config system replacemsg sslvpn sslvpn-login
end
config system replacemsg sslvpn sslvpn-limit
end
config system replacemsg sslvpn hostcheck-error
end
config system replacemsg ec endpt-download-portal
end
config system replacemsg ec endpt-download-portal-mac
end
config system replacemsg ec endpt-download-portal-ios
end
config system replacemsg ec endpt-download-portal-aos
end
config system replacemsg ec endpt-download-portal-other
end
config system replacemsg device-detection-portal device-detection-failure
end
config system replacemsg nac-quar nac-quar-virus
end
config system replacemsg nac-quar nac-quar-dos
end
config system replacemsg nac-quar nac-quar-ips
end
config system replacemsg nac-quar nac-quar-dlp
end
config system replacemsg nac-quar nac-quar-admin
end
config system replacemsg traffic-quota per-ip-shaper-block
end
config system replacemsg utm virus-html
end
config system replacemsg utm virus-text
end
config system replacemsg utm dlp-html
end
config system replacemsg utm dlp-text
end
config system replacemsg utm appblk-html
end
config vpn certificate ca
end
config vpn certificate local
edit Fortinet_CA_SSLProxy
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
set password ENC eRZ5UNnzW1eAAJn+reDWnDdgQZ1yxFr7z+rp0lzCeKX64OiaEcBKwGIzocIf5y5p37siqf1bPHwEMWkvISqQSXKT8JijvaLtA/oNlqTw8GwglMlW390JTckMS7v60mVQ2Jj1Ng9q4xi2dXKpVGXqYnpc1nDSApGqHTwpL/lgc1+HLh0CQvn4zQpIs8//4hVscjqz0g==
set certificate "-----BEGIN CERTIFICATE-----
set comments "This is the default CA certificate the SSL Inspection will use when generating new server certificates."
next
edit Fortinet_SSLProxy
set private-key "-----BEGIN ENCRYPTED PRIVATE KEY-----
set password ENC JGQ1Psth3oHimOP5bRUzt+zfBA5PlPBXZj6xLvqp7JILLBa6Der02qjotGI4UnaKAGSad7uEkPKLq2ePjzBy/Rc/E55FJO8OjffWzIOgpT1jYMmw8IOuAlB50weCRpzMowrLT+FKFF53SxG+oe5n4EaoiqR92WZsXzOTFpNdSFXyvggt/lmOz4Zm08AMD3sWFWg/ZA==
set certificate "-----BEGIN CERTIFICATE-----
next
end
config user device-category
edit ipad
next
edit iphone
next
edit gaming-console
next
edit blackberry-phone
next
edit blackberry-playbook
next
edit linux-pc
next
edit mac
next
edit windows-pc
next
edit android-phone
next
edit android-tablet
next
edit media-streaming
next
edit windows-phone
next
edit windows-tablet
next
edit fortinet-device
next
edit ip-phone
next
edit router-nat-device
next
edit printer
next
edit other-network-device
next
edit collected-emails
next
edit all
next
end
config system session-sync
end
config system fortiguard
set webfilter-sdns-server-ip "208.91.112.220"
end
config ips global
set default-app-cat-mask 18446744073474670591
end
config ips dbinfo
set version 1
end
config gui console
end
config system session-helper
edit 1
set protocol 6
set name pptp
set port 1723
next
edit 2
set protocol 6
set name h323
set port 1720
next
edit 3
set protocol 17
set name ras
set port 1719
next
edit 4
set protocol 6
set name tns
set port 1521
next
edit 5
set protocol 17
set name tftp
set port 69
next
edit 6
set protocol 6
set name rtsp
set port 554
next
edit 7
set protocol 6
set name rtsp
set port 7070
next
edit 8
set protocol 6
set name rtsp
set port 8554
next
edit 9
set protocol 6
set name ftp
set port 21
next
edit 10
set protocol 6
set name mms
set port 1863
next
edit 11
set protocol 6
set name pmap
set port 111
next
edit 12
set protocol 17
set name pmap
set port 111
next
edit 13
set protocol 17
set name sip
set port 5060
next
edit 14
set protocol 17
set name dns-udp
set port 53
next
edit 15
set protocol 6
set name rsh
set port 514
next
edit 16
set protocol 6
set name rsh
set port 512
next
edit 17
set protocol 6
set name dcerpc
set port 135
next
edit 18
set protocol 17
set name dcerpc
set port 135
next
edit 19
set protocol 17
set name mgcp
set port 2427
next
edit 20
set protocol 17
set name mgcp
set port 2727
next
end
config system auto-install
set auto-install-config enable
set auto-install-image enable
end
config system ntp
set ntpsync enable
set syncinterval 60
end
config system settings
end
config firewall address
edit SSLVPN_TUNNEL_ADDR1
set type iprange
set end-ip 10.212.134.210
set start-ip 10.212.134.200
next
edit all
next
edit none
set subnet 0.0.0.0 255.255.255.255
next
edit apple
set type fqdn
set fqdn "*.apple.com"
next
edit dropbox.com
set type fqdn
set fqdn "*.dropbox.com"
next
edit Gotomeeting
set type fqdn
set fqdn "*.gotomeeting.com"
next
edit icloud
set type fqdn
set fqdn "*.icloud.com"
next
edit itunes
set type fqdn
set fqdn "*itunes.apple.com"
next
edit android
set type fqdn
set fqdn "*.android.com"
next
edit skype
set type fqdn
set fqdn "*.messenger.live.com"
next
edit swscan.apple.com
set type fqdn
set fqdn "swscan.apple.com"
next
edit update.microsoft.com
set type fqdn
set fqdn "update.microsoft.com"
next
edit appstore
set type fqdn
set fqdn "*.appstore.com"
next
edit eease
set type fqdn
set fqdn "*.eease.com"
next
edit google-drive
set type fqdn
set fqdn "*drive.google.com"
next
edit google-play
set type fqdn
set fqdn "play.google.com"
next
edit google-play2
set type fqdn
set fqdn "*.ggpht.com"
next
edit google-play3
set type fqdn
set fqdn "*.books.google.com"
next
edit microsoft
set type fqdn
set fqdn "*.microsoft.com"
next
edit adobe
set type fqdn
set fqdn "*.adobe.com"
next
edit Adobe Login
set type fqdn
set fqdn "*.adobelogin.com"
next
edit fortinet
set type fqdn
set fqdn "*.fortinet.com"
next
edit googleapis.com
set type fqdn
set fqdn "*.googleapis.com"
next
edit citrix
set type fqdn
set fqdn "*.citrixonline.com"
next
edit verisign
set type fqdn
set fqdn "*.verisign.com"
next
edit Windows update 2
set type fqdn
set fqdn "*.windowsupdate.com"
next
edit *.live.com
set type fqdn
set fqdn "*.live.com"
next
edit auth.gfx.ms
set type fqdn
set fqdn "auth.gfx.ms"
next
edit autoupdate.opera.com
set type fqdn
set fqdn "autoupdate.opera.com"
next
edit softwareupdate.vmware.com
set type fqdn
set fqdn "softwareupdate.vmware.com"
next
edit firefox update server
set type fqdn
set fqdn "aus*.mozilla.org"
next
end
config firewall multicast-address
edit all
set end-ip 239.255.255.255
set start-ip 224.0.0.0
next
edit all_hosts
set end-ip 224.0.0.1
set start-ip 224.0.0.1
next
edit all_routers
set end-ip 224.0.0.2
set start-ip 224.0.0.2
next
edit Bonjour
set end-ip 224.0.0.251
set start-ip 224.0.0.251
next
edit EIGRP
set end-ip 224.0.0.10
set start-ip 224.0.0.10
next
edit OSPF
set end-ip 224.0.0.6
set start-ip 224.0.0.5
next
end
config firewall address6
edit SSLVPN_TUNNEL_IPv6_ADDR1
set ip6 fdff:ffff::/120
next
edit all
next
edit none
set ip6 ::/128
next
end
config firewall service category
edit General
set comment "General services."
next
edit Web Access
set comment "Web access."
next
edit File Access
set comment "File access."
next
edit Email
set comment "Email services."
next
edit Network Services
set comment "Network services."
next
edit Authentication
set comment "Authentication service."
next
edit Remote Access
set comment "Remote access."
next
edit Tunneling
set comment "Tunneling service."
next
edit VoIP, Messaging & Other Applications
set comment "VoIP, messaging, and other applications."
next
edit Web Proxy
set comment "Explicit web proxy."
next
end
config firewall service custom
edit ALL
set category "General"
set protocol IP
next
edit ALL_TCP
set category "General"
set tcp-portrange 1-65535
next
edit ALL_UDP
set category "General"
set udp-portrange 1-65535
next
edit ALL_ICMP
set category "General"
set protocol ICMP
next
edit ALL_ICMP6
set category "General"
set protocol ICMP6
next
edit GRE
set category "Tunneling"
set protocol-number 47
set protocol IP
next
edit AH
set category "Tunneling"
set protocol-number 51
set protocol IP
next
edit ESP
set category "Tunneling"
set protocol-number 50
set protocol IP
next
edit AOL
set visibility disable
set tcp-portrange 5190-5194
next
edit BGP
set category "Network Services"
set tcp-portrange 179
next
edit DHCP
set category "Network Services"
set udp-portrange 67-68
next
edit DNS
set category "Network Services"
set udp-portrange 53
set tcp-portrange 53
next
edit FINGER
set visibility disable
set tcp-portrange 79
next
edit FTP
set category "File Access"
set tcp-portrange 21
next
edit FTP_GET
set category "File Access"
set tcp-portrange 21
next
edit FTP_PUT
set category "File Access"
set tcp-portrange 21
next
edit GOPHER
set visibility disable
set tcp-portrange 70
next
edit H323
set category "VoIP, Messaging & Other Applications"
set udp-portrange 1719
set tcp-portrange 1720 1503
next
edit HTTP
set category "Web Access"
set tcp-portrange 80
next
edit HTTPS
set category "Web Access"
set tcp-portrange 443
next
edit IKE
set category "Tunneling"
set udp-portrange 500 4500
next
edit IMAP
set category "Email"
set tcp-portrange 143
next
edit IMAPS
set category "Email"
set tcp-portrange 993
next
edit Internet-Locator-Service
set visibility disable
set tcp-portrange 389
next
edit IRC
set category "VoIP, Messaging & Other Applications"
set tcp-portrange 6660-6669
next
edit L2TP
set category "Tunneling"
set udp-portrange 1701
set tcp-portrange 1701
next
edit LDAP
set category "Authentication"
set tcp-portrange 389
next
edit NetMeeting
set visibility disable
set tcp-portrange 1720
next
edit NFS
set category "File Access"
set udp-portrange 111 2049
set tcp-portrange 111 2049
next
edit NNTP
set visibility disable
set tcp-portrange 119
next
edit NTP
set category "Network Services"
set udp-portrange 123
set tcp-portrange 123
next
edit OSPF
set category "Network Services"
set protocol-number 89
set protocol IP
next
edit PC-Anywhere
set category "Remote Access"
set udp-portrange 5632
set tcp-portrange 5631
next
edit PING
set category "Network Services"
set protocol ICMP
set icmptype 8
next
edit TIMESTAMP
set protocol ICMP
set visibility disable
set icmptype 13
next
edit INFO_REQUEST
set protocol ICMP
set visibility disable
set icmptype 15
next
edit INFO_ADDRESS
set protocol ICMP
set visibility disable
set icmptype 17
next
edit ONC-RPC
set category "Remote Access"
set udp-portrange 111
set tcp-portrange 111
next
edit DCE-RPC
set category "Remote Access"
set udp-portrange 135
set tcp-portrange 135
next
edit POP3
set category "Email"
set tcp-portrange 110
next
edit POP3S
set category "Email"
set tcp-portrange 995
next
edit PPTP
set category "Tunneling"
set tcp-portrange 1723
next
edit QUAKE
set udp-portrange 26000 27000 27910 27960
set visibility disable
next
edit RAUDIO
set udp-portrange 7070
set visibility disable
next
edit REXEC
set visibility disable
set tcp-portrange 512
next
edit RIP
set category "Network Services"
set udp-portrange 520
next
edit RLOGIN
set visibility disable
set tcp-portrange 513:512-1023
next
edit RSH
set visibility disable
set tcp-portrange 514:512-1023
next
edit SCCP
set category "VoIP, Messaging & Other Applications"
set tcp-portrange 2000
next
edit SIP
set category "VoIP, Messaging & Other Applications"
set udp-portrange 5060
set tcp-portrange 5060
next
edit SIP-MSNmessenger
set category "VoIP, Messaging & Other Applications"
set tcp-portrange 1863
next
edit SAMBA
set category "File Access"
set tcp-portrange 139
next
edit SMTP
set category "Email"
set tcp-portrange 25
next
edit SMTPS
set category "Email"
set tcp-portrange 465
next
edit SNMP
set category "Network Services"
set udp-portrange 161-162
set tcp-portrange 161-162
next
edit SSH
set category "Remote Access"
set tcp-portrange 22
next
edit SYSLOG
set category "Network Services"
set udp-portrange 514
next
edit TALK
set udp-portrange 517-518
set visibility disable
next
edit TELNET
set category "Remote Access"
set tcp-portrange 23
next
edit TFTP
set category "File Access"
set udp-portrange 69
next
edit MGCP
set udp-portrange 2427 2727
set visibility disable
next
edit UUCP
set visibility disable
set tcp-portrange 540
next
edit VDOLIVE
set visibility disable
set tcp-portrange 7000-7010
next
edit WAIS
set visibility disable
set tcp-portrange 210
next
edit WINFRAME
set visibility disable
set tcp-portrange 1494 2598
next
edit X-WINDOWS
set category "Remote Access"
set tcp-portrange 6000-6063
next
edit PING6
set protocol ICMP6
set visibility disable
set icmptype 128
next
edit MS-SQL
set category "VoIP, Messaging & Other Applications"
set tcp-portrange 1433 1434
next
edit MYSQL
set category "VoIP, Messaging & Other Applications"
set tcp-portrange 3306
next
edit RDP
set category "Remote Access"
set tcp-portrange 3389
next
edit VNC
set category "Remote Access"
set tcp-portrange 5900
next
edit DHCP6
set category "Network Services"
set udp-portrange 546 547
next
edit SQUID
set category "Tunneling"
set tcp-portrange 3128
next
edit SOCKS
set category "Tunneling"
set udp-portrange 1080
set tcp-portrange 1080
next
edit WINS
set category "Remote Access"
set udp-portrange 1512
set tcp-portrange 1512
next
edit RADIUS
set category "Authentication"
set udp-portrange 1812 1813
next
edit RADIUS-OLD
set udp-portrange 1645 1646
set visibility disable
next
edit CVSPSERVER
set udp-portrange 2401
set visibility disable
set tcp-portrange 2401
next
edit AFS3
set category "File Access"
set udp-portrange 7000-7009
set tcp-portrange 7000-7009
next
edit TRACEROUTE
set category "Network Services"
set udp-portrange 33434-33535
next
edit RTSP
set category "VoIP, Messaging & Other Applications"
set udp-portrange 554
set tcp-portrange 554 7070 8554
next
edit MMS
set udp-portrange 1024-5000
set visibility disable
set tcp-portrange 1755
next
edit KERBEROS
set category "Authentication"
set udp-portrange 88
set tcp-portrange 88
next
edit LDAP_UDP
set category "Authentication"
set udp-portrange 389
next
edit SMB
set category "File Access"
set tcp-portrange 445
next
edit NONE
set visibility disable
set tcp-portrange 0
next
edit webproxy
set category "Web Proxy"
set explicit-proxy enable
set protocol ALL
set tcp-portrange 0-65535:0-65535
next
end
config firewall service group
edit Email Access
set member "DNS" "IMAP" "IMAPS" "POP3" "POP3S" "SMTP" "SMTPS"
next
edit Web Access
set member "DNS" "HTTP" "HTTPS"
next
edit Windows AD
set member "DCE-RPC" "DNS" "KERBEROS" "LDAP" "LDAP_UDP" "SAMBA" "SMB"
next
edit Exchange Server
set member "DCE-RPC" "DNS" "HTTPS"
next
end
config webfilter ftgd-local-cat
edit custom1
set id 140
next
edit custom2
set id 141
next
end
config ips sensor
edit default
set comment "Prevent critical attacks."
config entries
edit 1
set severity medium high critical
next
end
next
edit all_default
set comment "All predefined signatures with default setting."
config entries
edit 1
next
end
next
edit all_default_pass
set comment "All predefined signatures with PASS action."
config entries
edit 1
set action pass
next
end
next
edit protect_http_server
set comment "Protect against HTTP server-side vulnerabilities."
config entries
edit 1
set protocol HTTP
set location server
next
end
next
edit protect_email_server
set comment "Protect against email server-side vulnerabilities."
config entries
edit 1
set protocol SMTP POP3 IMAP
set location server
next
end
next
edit protect_client
set comment "Protect against client-side vulnerabilities."
config entries
edit 1
set location client
next
end
next
edit high_security
set comment "Blocks all Critical/High/Medium and some Low severity vulnerabilities"
config entries
edit 1
set status enable
set action block
set severity medium high critical
next
edit 2
set severity low
next
end
next
end
config firewall shaper traffic-shaper
edit high-priority
set per-policy enable
set maximum-bandwidth 1048576
next
edit medium-priority
set priority medium
set per-policy enable
set maximum-bandwidth 1048576
next
edit low-priority
set priority low
set per-policy enable
set maximum-bandwidth 1048576
next
edit guarantee-100kbps
set guaranteed-bandwidth 100
set maximum-bandwidth 1048576
set per-policy enable
next
edit shared-1M-pipe
set maximum-bandwidth 1024
next
end
config web-proxy global
set proxy-fqdn "default.fqdn"
end
config application list
edit default
set comment "Monitor all applications."
config entries
edit 1
set action pass
next
end
next
edit block-p2p
config entries
edit 1
set category 2
next
end
next
edit monitor-p2p-and-media
config entries
edit 1
set category 2
set action pass
next
edit 2
set category 5
set action pass
next
end
next
end
config dlp filepattern
edit 1
set name "builtin-patterns"
config entries
edit *.bat
next
edit *.com
next
edit *.dll
next
edit *.doc
next
edit *.exe
next
edit *.gz
next
edit *.hta
next
edit *.ppt
next
edit *.rar
next
edit *.scr
next
edit *.tar
next
edit *.tgz
next
edit *.vb?
next
edit *.wps
next
edit *.xl?
next
edit *.zip
next
edit *.pif
next
edit *.cpl
next
end
next
edit 2
set name "all_executables"
config entries
edit bat
set file-type bat
set filter-type type
next
edit exe
set file-type exe
set filter-type type
next
edit elf
set file-type elf
set filter-type type
next
edit hta
set file-type hta
set filter-type type
next
end
next
end
config dlp fp-sensitivity
edit Private
next
edit Critical
next
edit Warning
next
end
config dlp sensor
edit default
set comment "Log a summary of email and web traffic."
set summary-proto smtp pop3 imap http-get http-post
next
end
config webfilter content
end
config webfilter urlfilter
end
config spamfilter bword
end
config spamfilter bwl
end
config spamfilter mheader
end
config spamfilter dnsbl
end
config spamfilter iptrust
end
config log threat-weight
config web
edit 1
set category 26
set level high
next
edit 2
set category 61
set level high
next
edit 3
set category 86
set level high
next
edit 4
set category 1
set level medium
next
edit 5
set category 3
set level medium
next
edit 6
set category 4
set level medium
next
edit 7
set category 5
set level medium
next
edit 8
set category 6
set level medium
next
edit 9
set category 12
set level medium
next
edit 10
set category 59
set level medium
next
edit 11
set category 62
set level medium
next
edit 12
set category 83
set level medium
next
edit 13
set category 72
next
edit 14
set category 14
next
end
config application
edit 1
set category 2
next
edit 2
set category 6
set level medium
next
edit 3
set category 19
set level critical
next
end
end
config icap profile
edit default
next
end
config user local
edit guest
set passwd ENC EntYbQ4nWAFLGsQz5QbIt8MIxko4Ms6Nm/9fMo/5+L7FJO42JRExvl705N++oKwIB0NvfdWaiqfZ/LGPDSOVqRZnqn4pUWOlNVE6yfGxbCZUIXTlcSL58A2ok3Yd428rHETuf7mNrOJMdVS1tfnrx5+92ofsXVzAn/kpKeJLrtBRWNfBQ1YplQ2FfEDCHHW27akz4g==
set type password
next
end
config user group
edit SSO_Guest_Users
next
edit Guest-group
set member "guest"
next
end
config user device-group
edit Mobile Devices
set member "android-phone" "android-tablet" "blackberry-phone" "blackberry-playbook" "ipad" "iphone" "windows-phone" "windows-tablet"
set comment "Phones, tablets, etc."
next
edit Network Devices
set member "fortinet-device" "other-network-device" "router-nat-device"
set comment "Routers, firewalls, gateways, etc."
next
edit Others
set member "gaming-console" "media-streaming"
set comment "Other devices."
next
end
config vpn ssl web host-check-software
edit FortiClient-AV
set guid "C86EC76D-5A4C-40E7-BD94-59358E544D81"
next
edit FortiClient-FW
set guid "528CB157-D384-4593-AAAA-E42DFF111CED"
set type fw
next
edit FortiClient-AV-Vista-Win7
set guid "385618A6-2256-708E-3FB9-7E98B93F91F9"
next
edit FortiClient-FW-Vista-Win7
set guid "006D9983-6839-71D6-14E6-D7AD47ECD682"
set type fw
next
edit AVG-Internet-Security-AV
set guid "17DDD097-36FF-435F-9E1B-52D74245D6BF"
next
edit AVG-Internet-Security-FW
set guid "8DECF618-9569-4340-B34A-D78D28969B66"
set type fw
next
edit AVG-Internet-Security-AV-Vista-Win7
set guid "0C939084-9E57-CBDB-EA61-0B0C7F62AF82"
next
edit AVG-Internet-Security-FW-Vista-Win7
set guid "34A811A1-D438-CA83-C13E-A23981B1E8F9"
set type fw
next
edit CA-Anti-Virus
set guid "17CFD1EA-56CF-40B5-A06B-BD3A27397C93"
next
edit CA-Internet-Security-AV
set guid "6B98D35F-BB76-41C0-876B-A50645ED099A"
next
edit CA-Internet-Security-FW
set guid "38102F93-1B6E-4922-90E1-A35D8DC6DAA3"
set type fw
next
edit CA-Internet-Security-AV-Vista-Win7
set guid "3EED0195-0A4B-4EF3-CC4F-4F401BDC245F"
next
edit CA-Internet-Security-FW-Vista-Win7
set guid "06D680B0-4024-4FAB-E710-E675E50F6324"
set type fw
next
edit CA-Personal-Firewall
set guid "14CB4B80-8E52-45EA-905E-67C1267B4160"
set type fw
next
edit F-Secure-Internet-Security-AV
set guid "E7512ED5-4245-4B4D-AF3A-382D3F313F15"
next
edit F-Secure-Internet-Security-FW
set guid "D4747503-0346-49EB-9262-997542F79BF4"
set type fw
next
edit F-Secure-Internet-Security-AV-Vista-Win7
set guid "15414183-282E-D62C-CA37-EF24860A2F17"
next
edit F-Secure-Internet-Security-FW-Vista-Win7
set guid "2D7AC0A6-6241-D774-E168-461178D9686C"
set type fw
next
edit Kaspersky-AV
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
next
edit Kaspersky-FW
set guid "2C4D4BC6-0793-4956-A9F9-E252435469C0"
set type fw
next
edit Kaspersky-AV-Vista-Win7
set guid "AE1D740B-8F0F-D137-211D-873D44B3F4AE"
next
edit Kaspersky-FW-Vista-Win7
set guid "9626F52E-C560-D06F-0A42-2E08BA60B3D5"
set type fw
next
edit McAfee-Internet-Security-Suite-AV
set guid "84B5EE75-6421-4CDE-A33A-DD43BA9FAD83"
next
edit McAfee-Internet-Security-Suite-FW
set guid "94894B63-8C7F-4050-BDA4-813CA00DA3E8"
set type fw
next
edit McAfee-Internet-Security-Suite-AV-Vista-Win7
set guid "86355677-4064-3EA7-ABB3-1B136EB04637"
next
edit McAfee-Internet-Security-Suite-FW-Vista-Win7
set guid "BE0ED752-0A0B-3FFF-80EC-B2269063014C"
set type fw
next
edit McAfee-Virus-Scan-Enterprise
set guid "918A2B0B-2C60-4016-A4AB-E868DEABF7F0"
next
edit Norton-360-2.0-AV
set guid "A5F1BC7C-EA33-4247-961C-0217208396C4"
next
edit Norton-360-2.0-FW
set guid "371C0A40-5A0C-4AD2-A6E5-69C02037FBF3"
set type fw
next
edit Norton-360-3.0-AV
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
next
edit Norton-360-3.0-FW
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
set type fw
next
edit Norton-Internet-Security-AV
set guid "E10A9785-9598-4754-B552-92431C1C35F8"
next
edit Norton-Internet-Security-FW
set guid "7C21A4C9-F61F-4AC4-B722-A6E19C16F220"
set type fw
next
edit Norton-Internet-Security-AV-Vista-Win7
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
next
edit Norton-Internet-Security-FW-Vista-Win7
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
set type fw
next
edit Symantec-Endpoint-Protection-AV
set guid "FB06448E-52B8-493A-90F3-E43226D3305C"
next
edit Symantec-Endpoint-Protection-FW
set guid "BE898FE3-CD0B-4014-85A9-03DB9923DDB6"
set type fw
next
edit Symantec-Endpoint-Protection-AV-Vista-Win7
set guid "88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855"
next
edit Symantec-Endpoint-Protection-FW-Vista-Win7
set guid "B0F2DB13-C654-2E74-30D4-99C9310F0F2E"
set type fw
next
edit Panda-Antivirus+Firewall-2008-AV
set guid "EEE2D94A-D4C1-421A-AB2C-2CE8FE51747A"
next
edit Panda-Antivirus+Firewall-2008-FW
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
set type fw
next
edit Panda-Internet-Security-AV
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
next
edit Panda-Internet-Security-2006~2007-FW
set guid "4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0"
set type fw
next
edit Panda-Internet-Security-2008~2009-FW
set guid "7B090DC0-8905-4BAF-8040-FD98A41C8FB8"
set type fw
next
edit Sophos-Anti-Virus
set guid "3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD"
next
edit Sophos-Enpoint-Secuirty-and-Control-FW
set guid "0786E95E-326A-4524-9691-41EF88FB52EA"
set type fw
next
edit Sophos-Enpoint-Secuirty-and-Control-AV-Vista-Win7
set guid "479CCF92-4960-B3E0-7373-BF453B467D2C"
next
edit Sophos-Enpoint-Secuirty-and-Control-FW-Vista-Win7
set guid "7FA74EB7-030F-B2B8-582C-1670C5953A57"
set type fw
next
edit Trend-Micro-AV
set guid "7D2296BC-32CC-4519-917E-52E652474AF5"
next
edit Trend-Micro-FW
set guid "3E790E9E-6A5D-4303-A7F9-185EC20F3EB6"
set type fw
next
edit Trend-Micro-AV-Vista-Win7
set guid "48929DFC-7A52-A34F-8351-C4DBEDBD9C50"
next
edit Trend-Micro-FW-Vista-Win7
set guid "70A91CD9-303D-A217-A80E-6DEE136EDB2B"
set type fw
next
edit ZoneAlarm-AV
set guid "5D467B10-818C-4CAB-9FF7-6893B5B8F3CF"
next
edit ZoneAlarm-FW
set guid "829BDA32-94B3-44F4-8446-F8FCFF809F8B"
set type fw
next
edit ZoneAlarm-AV-Vista-Win7
set guid "D61596DF-D219-341C-49B3-AD30538CBC5B"
next
edit ZoneAlarm-FW-Vista-Win7
set guid "EE2E17FA-9876-3544-62EC-0405AD5FFB20"
set type fw
next
edit ESET-Smart-Security-AV
set guid "19259FAE-8396-A113-46DB-15B0E7DFA289"
next
edit ESET-Smart-Security-FW
set guid "211E1E8B-C9F9-A04B-6D84-BC85190CE5F2"
set type fw
next
end
config vpn ssl web portal
edit full-access
set web-mode enable
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set page-layout double-column
set ip-pools "SSLVPN_TUNNEL_ADDR1"
set ipv6-tunnel-mode enable
set tunnel-mode enable
next
edit web-access
set web-mode enable
next
edit tunnel-access
set ip-pools "SSLVPN_TUNNEL_ADDR1"
set ipv6-tunnel-mode enable
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set tunnel-mode enable
next
end
config vpn ssl settings
set servercert "self-sign"
set port 443
end
config voip profile
edit default
set comment "Default VoIP profile."
next
edit strict
config sip
set malformed-header-max-forwards discard
set malformed-header-rack discard
set malformed-header-allow discard
set malformed-header-call-id discard
set malformed-header-sdp-v discard
set malformed-header-record-route discard
set malformed-header-contact discard
set malformed-header-sdp-s discard
set malformed-header-content-length discard
set malformed-header-sdp-z discard
set malformed-header-from discard
set malformed-header-route discard
set malformed-header-sdp-b discard
set malformed-header-sdp-c discard
set malformed-header-sdp-a discard
set malformed-header-sdp-o discard
set malformed-header-sdp-m discard
set malformed-header-sdp-k discard
set malformed-header-sdp-i discard
set malformed-header-to discard
set malformed-header-via discard
set malformed-header-sdp-t discard
set malformed-request-line discard
set malformed-header-sdp-r discard
set malformed-header-content-type discard
set malformed-header-expires discard
set malformed-header-rseq discard
set malformed-header-p-asserted-identity discard
set malformed-header-cseq discard
end
next
end
config webfilter profile
edit default
set comment "Default web filtering."
set post-action comfort
config ftgd-wf
config filters
edit 1
set category 2
set action warning
next
edit 2
set category 7
set action warning
next
edit 3
set category 8
set action warning
next
edit 4
set category 9
set action warning
next
edit 5
set category 11
set action warning
next
edit 6
set category 12
set action warning
next
edit 7
set category 13
set action warning
next
edit 8
set category 14
set action warning
next
edit 9
set category 15
set action warning
next
edit 10
set category 16
set action warning
next
edit 11
set action warning
next
edit 12
set category 57
set action warning
next
edit 13
set category 63
set action warning
next
edit 14
set category 64
set action warning
next
edit 15
set category 65
set action warning
next
edit 16
set category 66
set action warning
next
edit 17
set category 67
set action warning
next
edit 18
set category 26
set action block
next
end
end
next
edit web-filter-flow
set comment "Flow-based web filter profile."
set inspection-mode flow-based
set post-action comfort
config ftgd-wf
config filters
edit 1
set category 2
next
edit 2
set category 7
next
edit 3
set category 8
next
edit 4
set category 9
next
edit 5
set category 11
next
edit 6
set category 12
next
edit 7
set category 13
next
edit 8
set category 14
next
edit 9
set category 15
next
edit 10
set category 16
next
edit 11
next
edit 12
set category 57
next
edit 13
set category 63
next
edit 14
set category 64
next
edit 15
set category 65
next
edit 16
set category 66
next
edit 17
set category 67
next
edit 18
set category 26
set action block
next
end
end
next
edit monitor-all
set comment "Monitor and log all visited URLs, proxy-based."
set web-content-log disable
set web-filter-applet-log disable
set web-ftgd-err-log disable
set web-filter-jscript-log disable
set web-filter-activex-log disable
set web-filter-referer-log disable
set web-filter-js-log disable
set web-invalid-domain-log disable
set web-ftgd-quota-usage disable
set web-filter-command-block-log disable
set web-filter-vbs-log disable
set web-filter-unknown-log disable
set web-filter-cookie-log disable
set log-all-url enable
set web-filter-cookie-removal-log disable
set web-url-log disable
config ftgd-wf
config filters
edit 1
set category 1
next
edit 2
set category 3
next
edit 3
set category 4
next
edit 4
set category 5
next
edit 5
set category 6
next
edit 6
set category 12
next
edit 7
set category 59
next
edit 8
set category 62
next
edit 9
set category 83
next
edit 10
set category 2
next
edit 11
set category 7
next
edit 12
set category 8
next
edit 13
set category 9
next
edit 14
set category 11
next
edit 15
set category 13
next
edit 16
set category 14
next
edit 17
set category 15
next
edit 18
set category 16
next
edit 19
set category 57
next
edit 20
set category 63
next
edit 21
set category 64
next
edit 22
set category 65
next
edit 23
set category 66
next
edit 24
set category 67
next
edit 25
set category 19
next
edit 26
set category 24
next
edit 27
set category 25
next
edit 28
set category 72
next
edit 29
set category 75
next
edit 30
set category 76
next
edit 31
set category 26
next
edit 32
set category 61
next
edit 33
set category 86
next
edit 34
set category 17
next
edit 35
set category 18
next
edit 36
set category 20
next
edit 37
set category 23
next
edit 38
set category 28
next
edit 39
set category 29
next
edit 40
set category 30
next
edit 41
set category 33
next
edit 42
set category 34
next
edit 43
set category 35
next
edit 44
set category 36
next
edit 45
set category 37
next
edit 46
set category 38
next
edit 47
set category 39
next
edit 48
set category 40
next
edit 49
set category 42
next
edit 50
set category 44
next
edit 51
set category 46
next
edit 52
set category 47
next
edit 53
set category 48
next
edit 54
set category 54
next
edit 55
set category 55
next
edit 56
set category 58
next
edit 57
set category 68
next
edit 58
set category 69
next
edit 59
set category 70
next
edit 60
set category 71
next
edit 61
set category 77
next
edit 62
set category 78
next
edit 63
set category 79
next
edit 64
set category 80
next
edit 65
set category 82
next
edit 66
set category 85
next
edit 67
set category 87
next
edit 68
set category 31
next
edit 69
set category 41
next
edit 70
set category 43
next
edit 71
set category 49
next
edit 72
set category 50
next
edit 73
set category 51
next
edit 74
set category 52
next
edit 75
set category 53
next
edit 76
set category 56
next
edit 77
set category 81
next
edit 78
set category 84
next
edit 79
next
end
end
next
edit flow-monitor-all
set comment "Monitor and log all visited URLs, flow-based."
set web-content-log disable
set web-filter-applet-log disable
set web-ftgd-err-log disable
set web-filter-command-block-log disable
set web-filter-jscript-log disable
set web-filter-activex-log disable
set web-filter-referer-log disable
set web-filter-js-log disable
set web-invalid-domain-log disable
set web-ftgd-quota-usage disable
set inspection-mode flow-based
set web-filter-vbs-log disable
set web-filter-unknown-log disable
set web-filter-cookie-log disable
set log-all-url enable
set web-filter-cookie-removal-log disable
set web-url-log disable
config ftgd-wf
config filters
edit 1
set category 1
next
edit 2
set category 3
next
edit 3
set category 4
next
edit 4
set category 5
next
edit 5
set category 6
next
edit 6
set category 12
next
edit 7
set category 59
next
edit 8
set category 62
next
edit 9
set category 83
next
edit 10
set category 2
next
edit 11
set category 7
next
edit 12
set category 8
next
edit 13
set category 9
next
edit 14
set category 11
next
edit 15
set category 13
next
edit 16
set category 14
next
edit 17
set category 15
next
edit 18
set category 16
next
edit 19
set category 57
next
edit 20
set category 63
next
edit 21
set category 64
next
edit 22
set category 65
next
edit 23
set category 66
next
edit 24
set category 67
next
edit 25
set category 19
next
edit 26
set category 24
next
edit 27
set category 25
next
edit 28
set category 72
next
edit 29
set category 75
next
edit 30
set category 76
next
edit 31
set category 26
next
edit 32
set category 61
next
edit 33
set category 86
next
edit 34
set category 17
next
edit 35
set category 18
next
edit 36
set category 20
next
edit 37
set category 23
next
edit 38
set category 28
next
edit 39
set category 29
next
edit 40
set category 30
next
edit 41
set category 33
next
edit 42
set category 34
next
edit 43
set category 35
next
edit 44
set category 36
next
edit 45
set category 37
next
edit 46
set category 38
next
edit 47
set category 39
next
edit 48
set category 40
next
edit 49
set category 42
next
edit 50
set category 44
next
edit 51
set category 46
next
edit 52
set category 47
next
edit 53
set category 48
next
edit 54
set category 54
next
edit 55
set category 55
next
edit 56
set category 58
next
edit 57
set category 68
next
edit 58
set category 69
next
edit 59
set category 70
next
edit 60
set category 71
next
edit 61
set category 77
next
edit 62
set category 78
next
edit 63
set category 79
next
edit 64
set category 80
next
edit 65
set category 82
next
edit 66
set category 85
next
edit 67
set category 87
next
edit 68
set category 31
next
edit 69
set category 41
next
edit 70
set category 43
next
edit 71
set category 49
next
edit 72
set category 50
next
edit 73
set category 51
next
edit 74
set category 52
next
edit 75
set category 53
next
edit 76
set category 56
next
edit 77
set category 81
next
edit 78
set category 84
next
edit 79
next
end
end
next
edit block-security-risks
set comment "Block security risks."
config ftgd-wf
set options rate-server-ip
config filters
edit 1
set category 26
set action block
next
edit 2
set category 61
set action block
next
edit 3
set category 86
set action block
next
edit 4
set action warning
next
end
end
next
end
config webfilter override
end
config webfilter override-user
end
config webfilter ftgd-warning
end
config webfilter ftgd-local-rating
end
config webfilter search-engine
edit google
set url "^\\/((custom|search|images|videosearch|webhp)\\?)"
set query "q="
set safesearch-str "&safe=active"
set hostname ".*\\.google\\..*"
set safesearch url
next
edit yahoo
set url "^\\/search(\\/video|\\/images){0,1}(\\?|;)"
set query "p="
set safesearch-str "&vm=r"
set hostname ".*\\.yahoo\\..*"
set safesearch url
next
edit bing
set url "^(\\/images|\\/videos)?(\\/search|\\/async|\\/asyncv2)\\?"
set query "q="
set safesearch-str "&adlt=strict"
set hostname "www\\.bing\\.com"
set safesearch url
next
edit yandex
set url "^\\/((yand|images\\/|video\\/)(search)|search\\/)\\?"
set query "text="
set safesearch-str "&family=yes"
set hostname "yandex\\..*"
set safesearch url
next
edit youtube
set safesearch header
set hostname ".*\\.youtube\\..*"
next
edit baidu
set url "^\\/s?\\?"
set query "wd="
set hostname ".*\\.baidu\\.com"
next
edit baidu2
set url "^\\/(ns|q|m|i|v)\\?"
set query "word="
set hostname ".*\\.baidu\\.com"
next
edit baidu3
set url "^\\/f\\?"
set query "kw="
set hostname "tieba\\.baidu\\.com"
next
end
config antivirus profile
edit default
set comment "Scan files and block viruses."
config http
set options scan
end
config ftp
set options scan
end
config imap
set options scan
end
config pop3
set options scan
end
config smtp
set options scan
end
next
end
config spamfilter profile
edit default
set comment "Malware and phishing URL filtering."
next
end
config wanopt settings
set host-id "default-id"
end
config wanopt profile
edit default
set comments "Default WANopt profile."
next
end
config firewall schedule recurring
edit always
set day sunday monday tuesday wednesday thursday friday saturday
next
edit none
set day none
next
end
config firewall profile-protocol-options
edit default
set comment "All default services."
config http
set ports 80
end
config ftp
set ports 21
set options splice
end
config imap
set ports 143
set options fragmail
end
config mapi
set ports 135
set options fragmail
end
config pop3
set ports 110
set options fragmail
end
config smtp
set ports 25
set options fragmail splice
end
config nntp
set ports 119
set options splice
end
config dns
set ports 53
end
next
end
config firewall ssl-ssh-profile
edit deep-inspection
set comment "Deep inspection."
config https
set ports 443
end
config ftps
set ports 990
end
config imaps
set ports 993
end
config pop3s
set ports 995
end
config smtps
set ports 465
end
config ssh
set ports 22
end
config ssl-exempt
edit 1
set fortiguard-category 31
next
edit 2
set fortiguard-category 33
next
edit 3
set fortiguard-category 87
next
edit 4
set type address
set address "apple"
next
edit 5
set type address
set address "appstore"
next
edit 6
set type address
set address "dropbox.com"
next
edit 7
set type address
set address "Gotomeeting"
next
edit 8
set type address
set address "icloud"
next
edit 9
set type address
set address "itunes"
next
edit 10
set type address
set address "android"
next
edit 11
set type address
set address "skype"
next
edit 12
set type address
set address "swscan.apple.com"
next
edit 13
set type address
set address "update.microsoft.com"
next
edit 14
set type address
set address "eease"
next
edit 15
set type address
set address "google-drive"
next
edit 16
set type address
set address "google-play"
next
edit 17
set type address
set address "google-play2"
next
edit 18
set type address
set address "google-play3"
next
edit 19
set type address
set address "microsoft"
next
edit 20
set type address
set address "adobe"
next
edit 21
set type address
set address "Adobe Login"
next
edit 22
set type address
set address "fortinet"
next
edit 23
set type address
set address "googleapis.com"
next
edit 24
set type address
set address "citrix"
next
edit 25
set type address
set address "verisign"
next
edit 26
set type address
set address "Windows update 2"
next
edit 27
set type address
set address "*.live.com"
next
edit 28
set type address
set address "auth.gfx.ms"
next
edit 29
set type address
set address "autoupdate.opera.com"
next
edit 30
set type address
set address "softwareupdate.vmware.com"
next
edit 31
set type address
set address "firefox update server"
next
end
next
edit certificate-inspection
set comment "SSL handshake inspection."
config https
set status certificate-inspection
set ports 443
end
config ftps
set status disable
set ports 990
end
config imaps
set status disable
set ports 993
end
config pop3s
set status disable
set ports 995
end
config smtps
set status disable
set ports 465
end
config ssh
set status disable
set ports 22
end
next
end
config firewall identity-based-route
end
config firewall policy
end
config firewall local-in-policy
end
config firewall policy6
end
config firewall local-in-policy6
end
config firewall ttl-policy
end
config firewall policy64
end
config firewall policy46
end
config firewall explicit-proxy-policy
end
config firewall interface-policy
end
config firewall interface-policy6
end
config firewall DoS-policy
end
config firewall DoS-policy6
end
config firewall sniffer
end
config endpoint-control profile
edit default
config forticlient-winmac-settings
set forticlient-wf-profile "default"
end
config forticlient-android-settings
end
config forticlient-ios-settings
end
next
end
config wireless-controller wids-profile
edit default
set comment "Default WIDS profile."
set deauth-broadcast enable
set assoc-frame-flood enable
set invalid-mac-oui enable
set ap-scan enable
set eapol-logoff-flood enable
set long-duration-attack enable
set eapol-pre-fail-flood enable
set eapol-succ-flood enable
set eapol-start-flood enable
set wireless-bridge enable
set eapol-pre-succ-flood enable
set auth-frame-flood enable
set asleap-attack enable
set eapol-fail-flood enable
set spoofed-deauth enable
set weak-wep-iv enable
set null-ssid-probe-resp enable
next
edit default-wids-apscan-enabled
set ap-scan enable
next
end
config wireless-controller wtp-profile
edit FAP112B-default
set ap-country US
config platform
set type 112B
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP220B-default
set ap-country US
config radio-1
set band 802.11n-5G
end
config radio-2
set band 802.11n
end
next
edit FAP223B-default
set ap-country US
config platform
set type 223B
end
config radio-1
set band 802.11n-5G
end
config radio-2
set band 802.11n
end
next
edit FAP210B-default
set ap-country US
config platform
set type 210B
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP222B-default
set ap-country US
config platform
set type 222B
end
config radio-1
set band 802.11n
end
config radio-2
set band 802.11n-5G
end
next
edit FAP320B-default
set ap-country US
config platform
set type 320B
end
config radio-1
set band 802.11n-5G
end
config radio-2
set band 802.11n
end
next
edit FAP11C-default
set ap-country US
config platform
set type 11C
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP14C-default
set ap-country US
config platform
set type 14C
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP28C-default
set ap-country US
config platform
set type 28C
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP320C-default
set ap-country US
config platform
set type 320C
end
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac
end
next
edit FAP221C-default
set ap-country US
config platform
set type 221C
end
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac
end
next
edit FAP25D-default
set ap-country US
config platform
set type 25D
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP222C-default
set ap-country US
config platform
set type 222C
end
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac
end
next
edit FAP224D-default
set ap-country US
config platform
set type 224D
end
config radio-1
set band 802.11n-5G
end
config radio-2
set band 802.11n
end
next
edit FK214B-default
set ap-country US
config platform
set type 214B
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP21D-default
set ap-country US
config platform
set type 21D
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP24D-default
set ap-country US
config platform
set type 24D
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP112D-default
set ap-country US
config platform
set type 112D
end
config radio-1
set band 802.11n
end
config radio-2
set mode disabled
end
next
edit FAP223C-default
set ap-country US
config platform
set type 223C
end
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac
end
next
edit FAP321C-default
set ap-country US
config platform
set type 321C
end
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac
end
next
end
config log memory setting
set status enable
end
config router rip
config redistribute connected
end
config redistribute static
end
config redistribute ospf
end
config redistribute bgp
end
config redistribute isis
end
end
config router ripng
config redistribute connected
end
config redistribute static
end
config redistribute ospf
end
config redistribute bgp
end
config redistribute isis
end
end
config router ospf
config redistribute connected
end
config redistribute static
end
config redistribute rip
end
config redistribute bgp
end
config redistribute isis
end
end
config router ospf6
config redistribute connected
end
config redistribute static
end
config redistribute rip
end
config redistribute bgp
end
config redistribute isis
end
end
config router bgp
config redistribute connected
end
config redistribute rip
end
config redistribute ospf
end
config redistribute static
end
config redistribute isis
end
config redistribute6 connected
end
config redistribute6 rip
end
config redistribute6 ospf
end
config redistribute6 static
end
config redistribute6 isis
end
end
config router isis
config redistribute connected
end
config redistribute rip
end
config redistribute ospf
end
config redistribute bgp
end
config redistribute static
end
end
config router multicast
end
Copy permalink