擋facebook, 相信大家也是於心不忍阿 ~ 不過礙於老闆最大的原則...
其實在Fortigate 要擋Facebook其實是蠻容易的, 只要使用url過濾就可以.
這方式, 無論Fortigate有沒有license都可以使用喔~ ^ ___ ^
3.0 or 4.0 這部份設定是差不多的, 所以我只用4.0的畫面來說明。
config system global目前知道支援的有
set internal-switch-mode {interface | switch}
Enable SACK, timestamp and MSS TCP options.
For normal operation tcp-option should be enabled.
Disable for performance testing or in rare cases where it impairs performance.
Fortigate #另外, 還要注意, DNS server 要指定客戶內部的DNS主機, 否則還是會有問題喔!!
Fortigate # config system autoupdate clientoverride
Fortigate (clientoverride) # set address 123.123.123.123 (客戶 Fortigate的真實IP)
Fortigate (clientoverride) # set status enable
Fortigate (clientoverride) # end
Fortigate #
Fortigate # config system fortiguard
Fortigate (fortiguard) # set port 8888 (可以不設)
Fortigate (fortiguard) # set client-override-status enable
Fortigate (fortiguard) # set client-override-ip 123.123.123.123 (客戶Fortigate的真實IP)
Fortigate (fortiguard) # set antispam-status enable
Fortigate (fortiguard) # set webfilter-status enable
Fortigate (fortiguard) # end
Fortigate #
New option scanextended for the ftp and http variables. Scans for viruses and不過, ETDB檔案還真是大, 下載要花好多時間說!
worms using the extended database of virus definitions.
The extended antivirus data is available on newer FortiGate
models with more than one partition, for example:
• FortiGate-50B and FortiWiFi-50B
• FortiGate-60B and FortiWiFi-60B
• FortiGate-310B
• FortiGate-1000A and FortiGate-1000AFA2
• FortiGate-1000A-LENC
• FortiGate-3016B, FortiGate-3600A, and FortiGate-3810A
• FortiGate-5005FA2 and FortiGate-5001A
