FortiGate Administration Guide - FirewallShop.com

Configuring dynamic policies
Switch (FortiGate-224B only)
Configuring dynamic policies
The FortiGate-224B unit can protect the network from a potential security threat
by moving the affected switch port to the quarantine VLAN. This isolates devices
on that switch port from the rest of the network.
The FortiGate-224B unit can quarantine a port for several different reasons:
• The host computer failed access host-check. For more information, see
“Configuring port quarantine” on page 220.
• The antivirus or IPS system triggered an alert based on the activity on the port.
For more information, see “Configuring a dynamic policy” on page 224.
• The administrator assigned the port to the quarantine VLAN
From the quarantine VLAN, only the quarantine web portal and selected thirdparty
URLs are accessible. All other URL requests are redirected to the web
portal. The web portal provides downloadable FortiClient Host Security or other
security software. Optionally, the user can request a new host-check. If the hostcheck
passes, the port is removed from the quarantine VLAN.
Viewing quarantine policies
Go to Switch > Port Quarantine > Dynamic Policy to configure dynamic policies
for the switch ports.
Figure 136:Viewing Dynamic policies
Name
AV/IPS Alert
Ports
Quarantine Portal
Client Profile
Delete icon
Edit icon
The name of the dynamic policy.
Shows whether antivirus (AV) and/or IPS protection are enabled in
this dynamic policy. See “Configuring a dynamic policy” on
page 224.
The ports to which this policy applies.
Lists the Quarantine web portal settings for this policy. See
“Configuring a dynamic policy” on page 224.
The name of the client profile. For more information, see
“Configuring a client profile” on page 221.
Delete this dynamic policy.
Edit this dynamic policy.
Configuring a dynamic policy
Go to Switch > Port Quarantine > Dynamic Policy and select Create New to
configure a dynamic policy. You can configure dynamic web portal page settings
for selected switch ports.
Note: A dynamic policy is effective only if there is a firewall policy for the port.
FortiGate Version 3.0 MR5 Administration Guide
224 01-30005-0203-20070830