1. Internal test : Confidential 224B Port Quarantine Simple test
Fortinet Japan
Internal test : Confidential 224B Port Quarantine Simple test
Kiyoshi Kodama, SE Japan
29-Aug-2007

2. Port Quarantine Simple test
Test purpose
I would like to confirm to how works 224B is detect and block to both anomaly (large_icmp) packet and Virus (eicar.com) file with dynamic port quarantine configuration.
Configuration
FortiGate 224B v3.0 B005
Switch mode, VLAN 1 (fe0, fe1…..fe26), Intra-VLAN
PC-1 ( /24)
PC-2 ( /26) FTP server
Port-1 = PC-1, Port-26 = PC-2
TP mode (Virtual IP for management /24)
Traffic exchange between port1 and port26.
Test scenarios
Test1: PC1 try to download virus file from PC-2 via FTP.
Test2: PC1 ping (large icmp) to PC2.
Fortinet Confidential 224B Port Quarantine Simple test

3. Fortinet Confidential 224B Port Quarantine Simple test
Configuration
2 subscribers are connecting to 224B, port-1 and port-26.
FTP server is runs at PC-2.
224B
VLAN ID 1
Port-1……………Port-26
PC-2
FTP server
PC-1
Fortinet Confidential 224B Port Quarantine Simple test

4. Fortinet Confidential 224B Port Quarantine Simple test
Launch CMD program at PC-1, and then try to download virus (eicar.com) file from FTP server (PC-2).
224B
ftp> get eicar.com
VLAN ID 1
Port-1……………Port-26
PC-2
FTP server
PC-1
Fortinet Confidential 224B Port Quarantine Simple test

5. Fortinet Confidential 224B Port Quarantine Simple test
224B is detect virus and block port #26
PC-1 user receive error message on CMD.
224B
ftp> get eicar.com
200 PORT command successful.
150 File status OK ; about to open data connection
550-Transfer failed. The file eicar.com is infected with the virus EICAR_TEST_
ILE. File quarantined as .
550 *
ftp>
VLAN ID 1
Port-1……………Port-26
PC-2
FTP server
PC-1
Fortinet Confidential 224B Port Quarantine Simple test

6. System>Status>Statistics>Attack log>FTP
WEB Management Screen: Quarantined Port status (Virus) and Log
Switch > Status
System>Status>Statistics>Attack log>FTP
Fortinet Confidential 224B Port Quarantine Simple test

7. Fortinet Confidential 224B Port Quarantine Simple test
PC-1 user ping large_icmp packet to PC-2.
224B
# ping large ICMP packet
VLAN ID 1
Port-1……………Port-26
PC-2
FTP server
PC-1
Fortinet Confidential 224B Port Quarantine Simple test

8. Fortinet Confidential 224B Port Quarantine Simple test
224B is detect large_icmp packet and block port #1
PC-1 can’t access inter/intranet.
224B
# ping large icmp packet
Response time out…
VLAN ID 1
Port-1……………Port-26
PC-2
FTP server
PC-1
Fortinet Confidential 224B Port Quarantine Simple test

9. Fortinet Confidential 224B Port Quarantine Simple test
WEB Management Screen: Quarantined Port status (IPS)
Switch > Status
Fortinet Confidential 224B Port Quarantine Simple test

10. System>Status>Statistics>Attack log>IPS
WEB Management Screen: Log (IPS)
System>Status>Statistics>Attack log>IPS
Fortinet Confidential 224B Port Quarantine Simple test

11. Fortinet Confidential 224B Port Quarantine Simple test
Key points
If are you using Intranet-VLAN.
Keep it in your mind…
Ensure to enable secure port configuration , switch > port > interface > secure port.
Fortinet Confidential 224B Port Quarantine Simple test

12. Fortinet Confidential 224B Port Quarantine Simple test
Continue….
Then enable to Intra-VLAN policy when you create new profile.
Fortinet Confidential 224B Port Quarantine Simple test

13. Fortinet Confidential 224B Port Quarantine Simple test
Thank you
Fortinet Confidential 224B Port Quarantine Simple test