FortiGate高级路由配置实用手册

需积分: 7 61 浏览量更新于2024-07-20 收藏 5.91MB PDF 举报

本篇文档是Fortinet FortiOS™ Handbook中的高级路由配置指南，适用于Fortigate路由器，版本为5.2.2。这份实用手册旨在帮助用户深入了解和管理Fortigate设备上的路由功能，以便在网络安全环境中实现高效的数据包转发。首先，章节"ChangeLog"列出了文档的更新历史，便于跟踪新功能和更改。"Introduction"部分为读者介绍了手册的目的，以及在开始配置前的必要准备，如理解基本的网络架构和路由原理。 "Routing concepts"详细阐述了路由的基本概念，包括路由表、目的地址解析、子网掩码等，确保读者对网络通信有深入理解。"Routing in VDOMs"针对Fortigate的虚拟域（VDOMs）环境，解释了如何在不同逻辑隔离的域间进行路由设置，以增强安全性。 "Default route"讲解了缺省路由的作用和配置方法，即当无法找到特定目的地址的直接路径时，数据包如何在网络中流转。"Adding a static route"指导用户如何添加静态路由，包括配置目标地址、下一跳地址以及相关参数。 "Routing table"部分深入探讨了如何查看、管理和优化路由表，确保路由策略的有效执行。"Static routing security"关注静态路由的安全性，如防止路由环路和恶意路由注入，并提供了安全最佳实践。 "Multipath routing and determining the best route"讨论了多路径路由，以及如何通过比较不同的路由路径来选择最优路由，以提高网络性能和可靠性。"Route priority"介绍了如何设置路由优先级，以便在多个可用路径中动态选择。 "Troubleshooting static routing"为遇到问题的用户提供故障排查步骤和常见错误的解决方案，有助于快速定位并解决问题。"Static routing tips"则提供了实用的配置技巧和建议，以提升效率。接下来的章节"Policy routing"介绍策略路由，允许管理员基于策略而不是简单的距离或下一跳地址来决定数据包的转发。"Adding a policy route"和"Moving a policy route"分别指导用户如何创建和调整策略路由规则。 "Transparent mode static routing"涉及透明模式下的静态路由，通常用于处理外部网络与内部网络之间的通信，确保数据包不受VDOM限制地正确传输。整个手册内容丰富，不仅涵盖理论知识，还包含了实践操作指导和故障解决策略，是Fortigate路由器高级路由配置的权威参考资料。对于任何负责企业网络路由管理的IT专业人员来说，这是一份不可或缺的工具。

Routing concepts Advanced Static Routing

proto Type of installation. This indicates where the route came from. Valid values

include:

0 - unspecific

2 - kernel

11 - ZebOS routing module

14 - FortiOS

15 - HA

16 - authentication based

17 - HA1

prio Priority of the route. Lower priorities are preferred.

->10.11.201.0/24

(->x.x.x.x/mask)

The IP address and subnet mask of the destination

pref Preferred next hop along this route

gwy Gateway - the address of the gateway this route will use

dev Outgoing interface index. This number is associated with the interface for this

route, and if VDOMs are enabled the VDOM will be included here as well. If an inter-

face alias is set for this interface it will also be displayed here.

Searching the routing table

You can apply a filter to search the routing table and display certain routes only. For example, you can display one or

more static routes, connected routes, routes learned through RIP, OSPF, or BGP, and routes associated with the

network or gateway that you specify.

If you want to search the routing table by route type and further limit the display according to network or gateway, all of

the values that you specify as search criteria must match corresponding values in the same routing table entry in order

for that entry to be displayed — an implicit AND condition is applied to all of the search parameters you specify.

For example, if the FortiGate unit is connected to network 172.16.14.0/24 and you want to display all directly

connected routes to network 172.16.14.0/24, you must select Connected from the Type list, type

172.16.14.0/24 in the Network field, and then select Apply Filter to display the associated routing table entry or

entries. Any entry that contains the word “Connected” in its Type field and the specified value in the Gateway field will

be displayed.

In this example, you will apply a filter to search for an entry for static route to 10.10.10.10/24

To search the FortiGate unit routing table in the web-based manager

Go to Router > Monitor > Routing Monitor.

From the Type list, select the type of route to display. In our example, select Static.

3. If you want to display routes to a specific network, type the IP address and netmask of the network in the

Networks field. In our example, enter 10.10.10.10/24.

If you want to display routes to a specific gateway, type the IP address of the gateway in the Gateway field.

Select Apply Filter.

Advanced Routing for FortiOS 5.2

Fortinet Technologies Inc.

Advanced Static Routing Routing concepts

All of the values that you specify as search criteria must match corresponding values in the same

routing table entry in order for that entry to be displayed.

To search the FortiGate unit routing table in the CLI

FGT # get router info routing-table details 10.10.10.10

Routing entry for 10.10.10.10/24

Known via "static", distance 10, metric 0, best

If there are multiple routes that match your filter, they will all be listed, with the best match at the top of the list as

indicated by the word best.

Building the routing table

In the factory default configuration, the FortiGate unit routing table contains a single static default route. You can add

routing information to the routing table by defining additional static routes.

It is possible that the routing table is faced with several different routes to the same destination—the IP addresses of

the next-hop router specified in those routes or the FortiGate interfaces associated with those routes may vary. In this

situation, the “best” route is selected from the table.

The FortiGate unit selects the “best” route for a packet by evaluating the information in the routing table. The “best”

route to a destination is typically associated with the shortest distance between the FortiGate unit and the closest

gateway, also known as a next-hop router. In some cases, the next best route may be selected if the best route is

unavailable.

The FortiGate unit installs the best available routes in the unit’s forwarding table, which is a subset of the unit’s routing

table. Packets are forwarded according to the information in the forwarding table.

Static routing security

Securing the information on your company network is a top priority for network administrators. Security is also required

as the routing protocols used are internationally known standards that typically provide little or no inherent security by

themselves.

The two reasons for securing your network are the sensitive and proprietary information on your network, and also your

external bandwidth. Hackers not only can steal your information, but they can also steal your bandwidth. Routing is a

good low level way to secure your network, even before UTM features are applied.

Routing provides security to your network in a number of ways including obscuring internal network addresses with

NAT and blackhole routing, using RPF to validate traffic sources, and maintaining an access control list (ACL) to limit

access to the network.

This section includes:

l Network Address Translation (NAT)

l Access Control List (ACL)

l Blackhole Route

l Reverse path lookup

17 Advanced Routing for FortiOS 5.2

Fortinet Technologies Inc.

Routing concepts Advanced Static Routing

Network Address Translation (NAT)

Network address translation (NAT) is a method of changing the address from which traffic appears to originate. This

practice is used to hide the IP address on a company’s internal networks, and helps prevent malicious attacks that use

those specific addresses.

This is accomplished by the router connected to that local network changing all the IP addresses to its externally

connected IP address before sending the traffic out to the other networks, such as the Internet. Incoming traffic uses

the established sessions to determine which traffic goes to which internal IP address. This also has the benefit of

requiring only the router to be very secure against external attacks, instead of the whole internal network as would be

the case without NAT. Securing one computer is much cheaper and easier to maintain.

1. Configuring NAT on your FortiGate unit includes the following steps.

2. Configure your internal network. For example use the 10.11.101.0 subnet.

3. Connect your internal subnet to an interface on your FortiGate unit. For example use port1.

4. Connect your external connection, for example an ISP gateway of 172.20.120.2, to another interface on

your Fortigate unit, for example port2.

Configure security policies to allow traffic between port1 and port2 on your FortiGate unit, ensuring that the NAT

feature is enabled.

The above steps show that traffic from your internal network will originate on the 10.11.101.0 subnet and pass on to

the 172.20.120.0 network. The FortiGate unit moves the traffic to the proper subnet. In doing that, the traffic appears

to originate from the FortiGate unit interface on that subnet — it does not appear to originate from where it actually

came from.

NAT “hides” the internal network from the external network. This provides security through obscurity. If a hacker tries to

directly access your network, they will find the Fortigate unit, but will not know about your internal network. The hacker

would have to get past the security-hardened FortiGate unit to gain access to your internal network. NAT will not

prevent hacking attempts that piggy back on valid connections between the internal network and the outside world.

However other UTM security measures can deal with these attempts.

Another security aspect of NAT is that many programs and services have problems with NAT. Consider if someone on

the Internet tries to initiate a chat with someone on the internal network. The outsider only can access the FortiGate

unit’s external interface unless the security policy allows the traffic through to the internal network. If allowed in, the

proper internal user would respond to the chat. However if its not allowed, the request to chat will be refused or time-

out. This is accomplished in the security policy by allowing or denying different protocols.

Access Control List (ACL)

An access control list (ACL) is a table of addresses that have permission to send and receive data over a router’s

interface or interfaces. The router maintains an ACL, and when traffic comes in on a particular interface it is buffered,

while the router looks up in the ACL if that traffic is allowed over that port or not. If it is allowed on that incoming

interface, then the next step is to check the ACL for the destination interface. If the traffic passes that check as well the

buffered traffic is delivered to its accentuation. If either of those steps fail the ACL check, the traffic is dropped and an

error message may be sent to the sender. The ACL ensures that traffic follows expected paths, and any unexpected

traffic is not delivered. This stops many network attacks. However, to be effective the ACL must be kept up to date —

when employees or computers are removed from the internal network their IP addresses must also be removed from

the ACL. For more information on the ACL, see the router chapter of the FortiGate CLI Reference.

Blackhole Route

A blackhole route is a route that drops all traffic sent to it. It is very much like /dev/null in Linux programming.

Advanced Routing for FortiOS 5.2

Fortinet Technologies Inc.

Advanced Static Routing Routing concepts

Blackhole routes are used to dispose of packets instead of responding to suspicious inquiries. This provides added

security since the originator will not discover any information from the target network.

Blackhole routes can also limit traffic on a subnet. If some subnet addresses are not in use, traffic to those addresses

(traffic which may be valid or malicious) can be directed to a blackhole for added security and to reduce traffic on the

subnet.

The loopback interface, a virtual interface that does not forward traffic, was added to enable easier configuration of

blackhole routing. Similar to a normal interface, this loopback interface has fewer parameters to configure, and all

traffic sent to it stops there. Since it cannot have hardware connection or link status problems, it is always available,

making it useful for other dynamic routing roles. Once configured, you can use a loopback interface in security policies,

routing, and other places that refer to interfaces. You configure this feature only from the CLI. For more information,

see the system chapter of the FortiGate CLI Reference.

Reverse path lookup

Whenever a packet arrives at one of the FortiGate unit’s interfaces, the unit determines whether the packet was

received on a legitimate interface by doing a reverse lookup using the source IP address in the packet header. This is

also called anti-spoofing. If the FortiGate unit cannot communicate with the computer at the source IP address

through the interface on which the packet was received, the FortiGate unit drops the packet as it is likely a hacking

attempt.

If the destination address can be matched to a local address (and the local configuration permits delivery), the

FortiGate unit delivers the packet to the local network. If the packet is destined for another network, the Fortigate unit

forwards the packet to a next-hop router according to a policy route and the information stored in the FortiGate

forwarding table.

Multipath routing and determining the best route

Multipath routing occurs when more than one entry to the same destination is present in the routing table. When

multipath routing happens, the FortiGate unit may have several possible destinations for an incoming packet, forcing

the FortiGate unit to decide which next-hop is the best one.

It should be noted that some IP addresses will be rejected by routing protocols. These are called Martian addresses.

They are typically IP addresses that are invalid and not routable because they have been assigned an address by a

misconfigured system, or are spoofed addresses.

Two methods to manually resolve multiple routes to the same destination are to lower the administrative distance of

one route or to set the priority of both routes. For the FortiGate unit to select a primary (preferred) route, manually

lower the administrative distance associated with one of the possible routes. Setting the priority on the routes is a

FortiGate unit feature and may not be supported by non-Fortinet routers.

Administrative distance is based on the expected reliability of a given route. It is determined through a combination of

the number of hops from the source and the protocol used. A hop is when traffic moves from one router to the next.

More hops from the source means more possible points of failure. The administrative distance can be from 1 to 255,

with lower numbers being preferred. A distance of 255 is seen as infinite and will not be installed in the routing table.

Here is an example to illustrate how administration distance works — if there are two possible routes traffic can take

between two destinations with administration distances of 5 (always up) and 31 (sometimes not available), the traffic

will use the route with an administrative distance of 5. If for some reasons the preferred route (admin distance of 5) is

not available, the other route will be used as a backup.

19 Advanced Routing for FortiOS 5.2

Fortinet Technologies Inc.

Routing concepts Advanced Static Routing

Different routing protocols have different default administrative distances. These different administrative distances are

based on a number of factors of each protocol such as reliability, speed, and so on. The default administrative

distances for any of these routing protocols are configurable.

Default administrative distances for routing protocols and connections

Routing protocol Default administrative distance

Direct physical connection 1

Static 10

EBGP 20

OSPF 110

IS-IS 115

RIP 120

IBGP 200

Another method to determine the best route is to manually change the priority of both routes in question. If the next-

hop administrative distances of two routes on the FortiGate unit are equal, it may not be clear which route the packet

will take. Manually configuring the priority for each of those routes will make it clear which next-hop will be used in the

case of a tie. The priority for a route be set in the CLI, or when editing a specific static route, as described in the next

section. Lower priority routes are preferred. Priority is a Fortinet value that may or may not be present in other brands

of routers.

All entries in the routing table are associated with an administrative distance. If the routing table contains several

entries that point to the same destination (the entries may have different gateways or interface associations), the

FortiGate unit compares the administrative distances of those entries first, selects the entries having the lowest

distances, and installs them as routes in the FortiGate unit forwarding table. As a result, the FortiGate unit forwarding

table contains only those routes having the lowest distances to every possible destination. While only static routing

uses administrative distance as its routing metric, other routing protocols such as RIP can use metrics that are similar

to administrative distance.

Route priority

After the FortiGate unit selects static routes for the forwarding table based on their administrative distances, the

priority field of those routes determines routing preference. Priority is a Fortinet value that may or may not be present

in other brands of routers.

You can configure the priority field through the CLI or the web-based manager. Priority values can range from 0 to

4294967295. The route with the lowest value in the priority field is considered the best route. It is also the primary

route.

Advanced Routing for FortiOS 5.2

Fortinet Technologies Inc.

剩余194页未读，继续阅读

Free_like_wind

粉丝: 0
资源: 3

FortiGate高级路由配置实用手册

FortiGate透明模式详解

FortiGate防火墙部署指南与WebUI定制化

FortiGate OSPF配置指南

Fortigate Spec

Fortigate 60

fortigate7.2.4

fortigate7.0.11

Fortigate Clinet

Fortigate一本通

配置FortiGate

最新资源