FortiOS™ 5.6
Fortinet’s Network Operating System

Control all the security and networking capabilities
in all your Fortinet Security Fabric elements with one
intuitive operating system. Improve your protection
and visibility while reducing operating expenses andsaving time with a truly consolidated next-generationenterprise firewall solution. FortiOS enables theFortinet Security Fabric vision for enhanced
protection from IoT to Cloud.

Security Fabric Integration
Deep visibility and control throughout
the Security Fabric reduce the attack
surface from IoT to Cloud.

Accelerated Performance
Accelerated cloud-scale and security
processor-based appliances enablemaximum threat protection without
affecting performance, even whenlogging is turned on.

What’s New — Highlights§§ Security Fabric enhancements§§ Security Fabric Audit§§ Improved Dashboard§§ Transparent web proxy§§ NGFW policy mode§§ Controlled failover between
wireless controllers§§ Multiple PSK for WPA Personal§§ VXLAN support§§ FortiView Endpoint Vulnerability chart

Efficient Operations
Security Fabric Audit with recommendations
and automated actions, local and global
threat intelligence sharing, and single
pane of glass with NOC views help
better manage your network.
Seamlessly integrates with Fortinet
centralized management solution andoffers robust APIs.

§§ FortiClient Profile updates§§ CEF log support§§ Adding Internet services tofirewall policies§§ Source and destination NAT in a single
firewall policy§§ NP6 Host Protection Engine

DATA SHEETFortiOS™ 5.6

OVERVIEW
Introducing FortiOS 5.6

The transition to an evolving digital business model is one of thefor maximum flexibility and integration to protect even the most

most challenging aspects of security today for an enterprise. As

demanding enterprise environments. Fortinet’s security technologies

significant trends in computing and networking continue to drive

have earned the most independent certifications for security

changes across critical business infrastructures, architectures, andeffectiveness and performance in the industry. The Fortinet Security

practices, organizations are looking for innovative network security

Fabric closes gaps left by legacy point products and platforms bysolutions to help them embrace that evolution. The Fortinet Security

providing the broad, powerful, and automated protection that

Fabric, empowered by FortiOS 5.6, is an intelligent framework

today’s organizations require across their physical and virtual

designed for scalable, interconnected security combined with highenvironments, from endpoint to the cloud.

awareness, actionable threat intelligence, and open API standards

FortiOS 5.6 Anatomy
Control all the security and networking capabilities in all your FortiGates

all sizes to deploy the security gateway setup that best suits theiracross your entire network with one intuitive operating system.

environments. As requirements evolve, you can modify them with

FortiOS offers an extensive feature set that allows organizations ofminimal disruptions and cost.

Configuration

2

Log & Report

Diagnostics

Monitoring

Operation
Policy andControl

Policy Objects

DeviceIdentification

SSL inspection

Actions

Anti-Malware

IPS & DoS

Application
Control

Web Filtering

FirewallVPN

DLP

Email Filtering

SD WAN

Explicit Proxy

IPv6

High Availability

Routing/NAT

L2/Switching

Offline Inspection

Essential
Network
Services

Networking

PhysicalAppliance(+SPU)

Virtual System

Hypervisor

Cloud

Platform Support

Security

Systems
Integration

Central Mgmt. andProvisioning

Cloud & SDN
Integration

Visibility
AAA

Compliance

Advanced Threat Protection (ATP)Wireless
Controller

SwitchController

WAN Interface
Manager

Security Fabricwww.fortinet.com

FortiOS™ 5.6

HIGHLIGHTS
Security Fabric
FortiGate Integration
THIRD-PARTY
ALLIANCE SOLUTION

The Security Fabric allows security to dynamically expand andadapt as more and more workloads and data are added, and at
the same time, seamlessly follow and protect data, users, and

ENTERPRISE
FIREWALL

SECURITY OPERATIONSSOLUTION

applications as they move back and forth between IoT, smart

FortiGate

devices, and cloud environments throughout the network.
A FortiGate firewall may be deployed at the heart of the Security
SECURE ACCESSSOLUTION

Fabric, expanding its security reach via visibility and control, by

ATP
SOLUTIONAPPLICATION SECURITY
SOLUTION

tightly integrating with other FortiGates and Fortinet products,
plus Fabric-Ready solutions.

FortiView

Visibility
FortiView, in FortiOS 5.6, provides you with 360° visibility into your network traffic. With a single click you can view traffic by source,
destination, application, threat, interface, device, policy, and country. Graphical visualizations, such as country and topology maps andvolume-based bubble charts are available in addition to comprehensive table views. These allow you to identify issues quickly and intuitively.

3FortiOS™ 5.6

HIGHLIGHTS
Compliance
The Security Fabric Audit is a feature thatallows you to analyze your Security Fabricdeployment to identify potential vulnerabilities
and highlight best practices that could be used
to improve your network’s overall security andperformance. Also, by checking your Security
Fabric Score, which is determined based on
how many checks your network passes/fails
during the Audit, you can be confident thatyour network is getting more secure over time.

Advanced Threat Protection
Fortinet offers the most integrated and automated Advanced Threat Protection (ATP) solution available today through an ATP frameworkthat includes FortiGate, FortiSandbox, FortiMail, FortiClient, and FortiWeb. These products easily work together to provide closed loop
protection across all of the most common attack vectors. All products in the ATP framework are NSS Labs Recommended for both security
effectiveness and performance value.

FortiSandbox
File Submission

1

File Submission

2

Detailed Status Report

File Status Result for
Auto File Hold &Quarantine

4

FSA Dynamic
Threat DB Update

FSA Dynamic
Threat DB Update

Query
1

1 File submission for analysis

23a4

2 Respective analysis results
are returned
Remediation
3a Auto File Quarantine on hostwith option to hold file until result

SECURED BYFORTIGUARD®

3b Manual Host Quarantine
by administrator

Real-time engine andintelligence updates

FortiGate
3b3c Manual Source IP Quarantine
using firewall

FortiClient

Protection

Control Host Quarantine

3c

Enforce Network
Quarantine

4 Proactive dynamic Threat DB
update to gateway and host

FEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

System Integration§§

Standard-based monitoring output – SNMP Netflow/Sflow§§§§

Syslog support to external (third-party) SIEM and logging system§§

Technology alliance with specialized vendors inheterogeneous environment

Detailed logs and SNMP output provide more insights so thatorganizations can accurately and quickly identify and resolve incidents
or problems.

§§§§

Native Integration with Fortinet Products — FortiMail, FortiCache,and FortiWeb

Ability to reuse organization’s existing systems lowers TCO andstreamlines processes.

4

www.fortinet.com

FortiOS™ 5.6

HIGHLIGHTSFEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

Central Management
and Provisioning§§

Fortinet/third-party automation and portal services support via APIs and
CLI scripts§§

Comprehensive APIs and CLI commands offer feature-richservice enablement.

§§

Rapid deployment features including cloud-based provisioning solutions§§

Comprehensive rapid deployment options save time and costs.

§§

Developer community platform and professional service options forcomplex integrations§§

Fortinet Developer Network (FNDN) empowers large service providers
and enterprises with shared implementation/customization/
integration knowledge.

Cloud and SDN Integration§§

Integration with Openstack, VMware NSX, and Cisco ACI infrastructure§§

Robust and comprehensive SDN integration capabilities allow
organizations to implement cloud solutions securely withoutcompromising agility.

Visibility§§

Drill-down and topology viewers that illustrate real-time and historicalthreat status and network usage with comprehensive contextual
information§§

One-click remediation against listed sources/destinations offers
accurate and quick protection against threats and abuses.

NEW: Aggregated data views with remote control ofdownstream FortiGates§§§§

Unique threat score system correlates weighted threats with particularusers to prioritize investigations.

NEW: Endpoint vulnerability views that present ranked vulnerable
clients with details§§§§

Fabric-wide views expand visibility beyond a single security entity,
including endpoint vulnerabilities.

§§

FortiOS integrates with a wide variety of AAA services to facilitate user
admission control from various entry points, giving users a simplified
experience while implementing greater security.

§§

Easily implement two-factor authentication for user and administrator
access at little cost.

Authentication Authorization and §§Accounting (AAA)Compliance

Advance Threat Protection (ATP)Wireless Controller

Switch Controller

WAN Interface Manager

Interface with FortiAuthenticator and a wide variety of external identity
management systems to facilitate user authentication processes.

§§

Wide-ranging single sign-on identity acquisition methods, including
Windows AD, terminal servers, access portals, and mail services§§

Built-in token server that manages both physical and mobile tokens
for use with various FortiOS authentication requirements such as VPN
access and FortiGate administration.

§§

Periodic system configuration check using a pre-defined
PCI-compliance checklist§§

Automates compliance auditing which frees up administration
resources§§

Endpoint enforcement: posture checking profile assignment based on
device/user groups§§§§

NEW: Fabric-wide FortiGate security configuration and client
vulnerability status audits

Simplified mobile user security enforcement by easily distributing andupdating clients’ security profiles that are consistent with gateway
protection§§

Quickly verify the status and health of your connected devices within
the Fabric and identify any gaps that can potentially leave you at
greater risk§§

Supported by proven and industry-validated AV research services§§

Ability to adopt robust ATP framework that reaches mobile users andbranch offices, detecting and preventing advanced attacks that may
bypass traditional defenses by examining files from various vectors,
including encrypted files§§

The wireless controller integrated into the FortiGate console provides
true single-pane-of-glass management for ease-of-use and lower TCO.

§§

Expands security to access level to stop threats and protect terminals
from one another§§

Allows organizations to use or add 3G/4G connectivity for WAN
connections while maintaining access control and defining usage forthose links§§

Flow- and proxy-based AV options for choice between protection andperformance§§

Local file quarantine (for models with storage)§§

Anti-bot capability using IP reputation DB terminates botnet
communication to C&C servers§§

Receive dynamic remediation (malicious file checksum and URLs) DB
updates and detail analysis reports from external Fortinet file analysis
solution (FortiSandbox)§§

Integrated wireless controller for Fortinet’s wide range of AP form
factors, including indoor, outdoor, and remote models, with noadditional license or component fees§§Enterprise-class wireless management functionality, including rogue AP
protection, wireless security, monitoring, and reporting§§

NEW: 802.3az support on WAVE2 WiFi APs§§

NEW: Manage distirbuted cloud-based FortiAPs§§

Integrated switch controller for Fortinet access switches with noadditional license or component fees§§

NEW: Improved GUI configuration support§§

Supports the use of 3G/4G modems via USB port or FortiExtender5FortiOS™ 5.6

HIGHLIGHTS
Operation
FortiOS provides a broad set of operation tools that make identification and response to security and network issues effective. Security
operations is further optimized with automations which contribute to faster and more accurate problem resolutions.
FEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

Configuration§§

Wide variety of configuration tools — Client software, Web UI, and CLI§§§§

Ease of use with intuitive, state-of-the-art GUI and wizards

Unique FortiExplorer configuration tool allows administrators to quickly
access configurations, including via mobile phones and tablets.

§§

One-click access and actions between log viewers, FortiView, policy
tables, and more§§

VPN wizards facilitate easy setup, including to popular mobile clientsand other vendors’ VPN gateways.

§§

Intelligent object panel for policy setups and edits§§

Useful one-click access and actions bring administrators to next steps
quickly and accurately to swiftly mitigate threats or resolve problems.

§§

Detailed logs and out-of-the-box reports that are essential forcompliance, audits, and diagnostic purposes§§

Includes deep contextual information, including source device details
and strong audit trail§§

NEW: Real-time logging to FortiAnalyzer and FortiCloud§§

GUI Report Editor offering highly customizable reports§§

NEW: Common Event Format (CEF) support§§§§

NEW: Logging consolidation within Security FabricManaging logs holistically simplifies configuration and guarantees
that critical information from every FortiGate is centrally collected andavailable for analysis. This closes any gaps in intelligence.

§§

Diagnostic CLI commands, session tracer, and packet capture fortroubleshooting hardware, system, and network issues§§

Comprehensive diagnostic tools help organizations quickly remediateproblems and investigate abnormal situations.

§§Hardware testing suite on CLI§§

Policy and routing GUI tracer§§

Real-time monitors§§§§

NEW: NOC Dashboard

Dashboard NOC view allows you to keep mission-critical information inview at all times. Interactive and drill-down widgets avoid dead-ends
during your investigations, keeping analysis moving quickly and smoothly.

Log & Report

Diagnostics

Monitoring

Policy and Control
FortiGate provides a valuable policy enforcement point in your network where you can control your network traffic and apply security
technologies. With FortiOS, you can set consolidated policies that include granular security controls. Every security service is managed
through a similar paradigm of control and can be easily plugged into a consolidated policy. Intuitive drag-and-drop controls allow you toeasily create policies and one-click navigation shortcuts allow you to more quickly quarantine end points or make policy edits.
FEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

Policy Objects§§

GeoIP and FQDN defined address objects to intelligently track dynamic
IP/IP ranges§§

Comprehensive range of object types that facilitate today’s dynamic
and granular network requirements§§

Internet Service DB: dynamically updated DB that provides a list of
popular cloud applications with their vital information that can be used
for policy setup, routing, and link load-balancing configurations.

§§

Identification and control of network access for different types ofdevices present on the network§§

Empowers organizations to add critical security to today’s BYOD
environment by identifying and controlling personal devices§§

NEW: Improved device identification and management§§

Effectively examine SSL-encrypted traffic with various security controls,
such as AV and DLP§§

Identify and block threats hidden within encrypted traffic without
significantly impacting performance.

§§

High-performance SSL inspection with content processors§§

Reputable sites database for exemptions§§

Implements security policies that use a combination of source objects,
IPs, users, and/or devices.

§§§§

Highly customizable notifications are sent when user activities are
not allowed.

Flexible policy setup using additional identified elements and active
user notifications assist organizations in implementing effective network
security, while robust quarantining features helps to mitigate threats.

§§

Automatically or manually quarantine users/attackers.

§§

Directs registered FortiClient to host quarantine.

Device Identification

SSL Inspection

Actions

6

www.fortinet.com

FortiOS™ 5.6

HIGHLIGHTS
Security
FortiGuard Labs provides the industry-leading security services and threat intelligence delivered through Fortinet solutions. FortiOS manages
the broad range of FortiGuard services available for the FortiGate platform, including application control, intrusion prevention, web filtering,
antivirus, advanced threat protection, SSL inspection, and mobile security. Services can be licensed a la carte or in a cost-effective bundle
for maximum flexibility of deployment.
Industry-leading security effectiveness
Fortinet solutions are consistently validated for industry-leading security effectiveness inindustry tests by NSS Labs for IPS and application control, by Virus Bulletin in the VB100
comparative anti-malware industry tests, and by AV Comparatives.
§§ Recommended Next Generation Firewall with near perfect, 99.6% security
effectiveness rating. (2016 NSS Labs NGFW Test of FortiGate 3200D)§§ Recommended Breach Detection Systems with 99%+ overall detection. (2016 NSS
Breach Detection Systems Test of FortiGate 500D with FortiSandbox Cloud)§§ Recommended Data Center Intrusion Prevention Systems with 99.9% exploit
block rate, highest in test. (2016 NSS Data Center Intrusion Prevention Test with
FortiGate 3000D)§§ Highest antivirus security effectiveness of any vendor offering a next generation firewalland 2nd highest security effectiveness of all business antivirus solutions tested.
(Oct 2014–April 2015 Virus Bulletin Reactive and Proactive Test average results)§§ ICSA Certified network firewalls, network IPS, IPsec, SSL-TLS VPN, antivirus.

FEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

Anti-Malware§§§§

Supported by proven and industry-validated AV research services.

§§Ability to adopt robust ATP framework that reaches mobile users andbranch offices, detecting and preventing advanced attacks that may
bypass traditional defenses by examining files from various vectors,
including encrypted files.

§§

Proven quality protection with “NSS Recommended” award for superior
coverage and cost/performance.

§§

Adapts to enterprise needs with full IPS features and NGIPS capabilities,
such as contextual visibility.

IPS and DoS

Application Control

Web Filtering

Flow- and proxy-based AV options for choice between protection
and performance.

§§

Anti-bot capability using IP reputation DB terminates botnet
communication to C&C servers.

§§

Receive dynamic remediation (malicious file checksum and URLs)
DB updates and detail analysis reports from external Fortinet fileanalysis solution (FortiSandbox).

§§

Regular and rate-based signatures, supported byzero-day threat protection and research for effective. IPS
implementation.

§§

Integrated DoS protection defends against abnormal traffic behaviors.

§§

CVE reference for IPS signatures.

§§Supports various network deployment requirements, such as sniffer
mode, and compatible with active-bypass FortiBridge or built-in bypass
ports for selected model.

§§

Detects and acts against traffic based on applications while providing
visibility on network usage.

§§

Superior coverage, including both desktop and mobile applications,enabling better management of network access policies.

§§

Fine-grained control on popular cloud applications, such as SalesForce,
Google Docs, and Dropbox.

§§

Applies deeper application inspections for better control and visibility as
more enterprises rely on public cloud services.

§§Enterprise-class URL filtering solution that includes quotas, user
overrides, transparent safe search, and search engine keyword logging.

§§§§

Superior coverage with URL ratings of over 70 languages and identifies
redirected (cached and translated) sites.

Multi-layered anti-proxy avoidance capabilities with integrated
application control and IPS allow organizations to implement air-tightweb usage controls.

7

FortiOS™ 5.6

HIGHLIGHTSFEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

Firewall§§

High-performance firewall with SPU-powered appliance§§Industry’s top firewall appliance with superior cost-performance ratio§§

Easy-to-use policy management with unique Section or Global
View options§§

NEW: NGFW Policy-Based Mode§§

Comprehensive enterprise-class features for various types of
VPN setups§§§§

SSL and IPsec VPN wizards

The FortiGate’s unmatched performance for VPN allows organizations
to establish secure communications and data privacy between multiple
networks and hosts by leveraging custom security processors (SPUs)
to accelerate encryption and decryption of network traffic.

§§

Monitor network traffic and stop sensitive information from leaving the
network by matching against file format and content definitions.

§§

Prevent sensitive information from leaving the network, easily andcost-effectively.

§§

The FortiExplorer Watermark Tool allows organizers to apply document
marking for DLP.

§§

Highly effective, multilayered spam filters with low false positives§§

Cost-efficient anti-spam solution for small organizations or branch§§

offices without requiring investment in an additional system

VPN

DLP

Email Filtering

Networking
With FortiOS you can manage your networking and security in one consistent native OS on the FortiGate. FortiOS delivers a wide range of
networking capabilities, including extensive routing, NAT, switching, Wi-Fi, WAN, load balancing, and high availability, making the FortiGate apopular choice for organizations wanting to consolidate their networking and security functions.
SD WAN
Fortinet’s Distributed Enterprise Firewall enables software-defined
WAN (SD-WAN). It essentially links network and security paths acrossthe world through the Internet or private WAN links, making it a truly
borderless infrastructure for the enterprise. In addition, it provides
application visibility and intelligent load balancing. Consolidation andcontrol of network security features in a centralized environment
simplifies administration.

FEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

Routing / NAT§§

Comprehensive routing protocols and NAT support§§§§

Traffic redirection with ICAP and WCCP support

Wide ranging routing features that meet carrier and enterprise
resilience networking requirements§§

Ability to craft software switches or emulate VLAN switches frominterfaces§§§§

Support SPAN ports and port aggregation with multiple interfaces.

Flexible interface configurations offer various setup possibilities thatbest suit an organization’s network requirements, while providing
optional access security.

§§

Implement admission control modes on interfaces such as 802.1x or
captive portal.

§§

Comprehensive WiFi and WAN interface configuration options§§

NEW: VXLAN support§§

Sniffer mode allows threat and usage monitoring of network
activities offline.

§§

Offline mode provides flexibility when deploying into existing critical
networks where in-line security solution is not yet appropriate.

L2 / Switching

Offline Inspection

8

www.fortinet.com

FortiOS™ 5.6

HIGHLIGHTSFEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

SD WAN§§§§

Robust multi-link feature aids organizations in SD-WAN implementation.

§§

QoS capabilities adjust allocation of bandwidth to different traffic
types, improving the performance and stability of latency-sensitive or
bandwidth-intensive network applications.

§§

Built-in WAN optimization capabilities reduce network overhead,
resulting in more efficient use of bandwidth and better application
performance, without the need for costly WAN link upgrades.

Comprehensive WAN Link LB algorithm, link status, plus quality checks,
and policy routing support§§

Direct traffic among WAN links based on applications and users/
user groups§§

Manage the level of service and preference given to the various types
and sources of traffic using traffic policing, traffic shaping, and queuing.

§§Peer-to-peer and remote user WAN optimization for protocol
optimization and byte caching technologies§§

Web cached storage of remote files and web pages on local devices
for easy local access to commonly accessed objects

High Availability§§

Support for industry standard VRRP and various proprietary solutions,with ability to combine more than one high availability solution into asingle configuration§§

Flexible high availability offerings allow organizations to pick the mostsuitable solutions based on their network environments and SLA
requirements.

IPv6

§§

Comprehensive IPv6 support for routing, NAT, security policies,
and more§§

Operating mode options provide flexibility when deploying into existingor new networks, reducing network change requirements.

Explicit Proxy§§

Explicit HTTP and HTTPS, FTP over HTTP, or SOCKS proxying of IPv4
and IPV6 traffic on one or more interfaces§§§§

NEW: Transparent web proxyIntegrated, enterprise-class explicit web proxy provides HTTP andHTTPS proxying with the added benefits of UTM security anduser identity.

§§

A wealth of networking services such as DHCP, DNS server, NTP
server etc.

§§

Built-in, out-of-the-box capabilities let organizations quickly provide
necessary network services to internal terminals or to integrate withother network devices.

Essential Network Services

Platform Support
Performance

Ultimate deployment flexibility

The FortiGate appliances deliver up to 5 times

Protect your entire network inside and out through a policy-driven

the next generation firewall performance andnetwork segmentation strategy using the Fortinet solution. It is easy

10 times the firewall performance of equivalently

to deploy segment optimized firewalls, leveraging the wide range ofpriced platforms from other vendors. The highFortiGate platforms and the flexibility of FortiOS to protect internal

performance levels in the FortiGate are based on a Parallel Path

network segments, the network perimeter, distributed locations,

Processing architecture in FortiOS that leverages performance,

public and private clouds, and the data center — making sure

optimized security engines, and custom developed network andyou have the right mix of capabilities and performance for eachcontent processors. Thus, FortiGate achieved the best cost per

deployment mode.

Mbps performance value results.

FEATUREHIGHLIGHTS

THE FORTINET ADVANTAGE

Physical Appliance (+SPU)§§

Integration with proprietary hardware architecture that includes
acceleration components (SPU) and multicore processors.

§§

Superior software and hardware integration ensures most optimaluse of hardware components, yielding best cost/performancefor customers.

Virtual Systems§§

Virtual Domains (VDOMs): Virtualized FOS components to multiple
logical systems on a single virtual or physical appliance.

§§§§

Proxy and Flow-based VDOM options to simplify security
profile settings

Offers MSSPs and large organizations the ability to run separate
instances of FOS for multi-tenant environment or to consolidate various
security gateways for lower TCO.

Hypervisor§§

Support for popular hypervisor platforms, including VMware vSphere,
Citrix and open source Xen, KVM, and MS Hyper-V.

§§

Consistent management and features between physical and virtual
appliances reduces management cost and simplifies deployments.

Cloud

§§

Support for public cloud services: Amazon Web Services (AWS) andMicrosoft Azure.

§§

Consistent management and features between on-premises and cloud
platforms reduces management cost and simplifies deployments.

9FortiOS™ 5.6

SPECIFICATIONS
Security Fabric

WIRELESS CONTROLLERSYSTEM INTEGRATIONManages and provisions settings for local and remote Thin Access points or switches (selected models)

SNMP System Monitoring:- SNMP v1and v2c support- SNMP v3 implementation includes support for queries, traps, authentication, and privacy- SNMP traps alerting to events such as a full log disk or a virus detected
Traffic Monitoring:- sFlow version 5 and Netflow V9.0
External Logging:- Syslog- Reliable syslog (RAW Profile) based on RFC 3195
- WebTrends WELF compatible

Set up access and authentication methods for SSIDs and VLANs, supports integrated or external captive
portal, 802.1x, preshared keys
Multiple PSK for WPA Personal
WiFi Security: Rogue AP suppression, wireless IDS
Wireless topology support: Fast roaming, AP load balancing, Wireless Mesh and bridging
Controlled failover between wireless controllers
SWITCH CONTROLLER
Extends access control and security to wired devices by managing Fortinet switches (FortSwitch) via
CAPWAP-like communication.

Technology ecosystem encompasses leading partners in the Firewall and Network Risk Management, SDN
and Virtualization, Security Information and Event Management (SIEM), Systems Integration, Testing andTraining, and Wireless markets

WAN INTERFACE MANAGER

Native integration with FortiMail, FortiCache, and FortiWeb

Support USB 3G/4G Wireless WAN modems

Security Fabric logging- Synchronised logging to FortiAnalyzer configurations among FortiGates- Data exchange (information such as topology and device asset tags) with FortiAnalyzer
CENTRAL MANAGEMENT AND PROVISIONING
Central management support: FortiManager, FortiCloud hosted service, web service APIs
Rapid deployment: Install wizards, USB auto-install, local and remote script execution
CLOUD AND SDN INTEGRATION
Integration with Openstack, VMWare NSX, and Cisco ACI infrastructure
VISIBILITY

Ability to configure switch port features such as PoE, VLAN assignment

Operation
CONFIGURATIONManagement Access: HTTPS via web browser, SSH, telnet, console
FortiExplorer:- Management client for Windows and IOS platforms- Ease-of-use by using USB connectivity
Feature Store: Toggle GUI component displays
GUI configuration:- ‘One-Click’ access that transfer administrators to next step panels quickly- Dynamic object selectors and predictive search queries

Interactive and graphical visualizer for user, device, network, and security activities (FortiView):- A variety of GUI consoles that display current and historical status using different perspectives such as‘sources’, ‘destinations’, ‘interfaces’, ‘applications’, ‘threats’ etc.
- Phyiscal and logical topology views- Threat and VPN map- Data views options: Table, bubble chart, or world map if applicable- File analysis/sandbox result view (FortiSandbox integration required)- Endpoint Vulnerbility view (FortiClient integration required)- Accelerated session indication on ‘All sessions’ FortiView Console- WHOIS Lookup for Public IP addresses within FortiView and log tables

LOG & REPORT

Aggregated data views with downstream FortiGates within a Security Fabric- presented on FortiView and monitors

Scheduled batch log uploading or real-time logging

AUTHENTICATION AUTHORIZATION AND ACCOUNTING (AAA)
Local user database and remote user authentication service support: LDAP, Radius and TACACS+, two-factor
authentication
Single-sign-on: Intergation with Windows AD, Microsoft Exchange Server, Novell eDirectory, FortiClient, Citrix
and Terminal Server Agent, Radius (accounting message), POP3/POP3S, user access (802.1x, captive
portal) authentication
PKI and certificates: X.509 certificates, SCEP support, Certificate Signing Request (CSR) creation, autorenewal of certificates before expiry, OCSP support

Web UI administration language support: English, Spanish, French, Portuguese, Japanese, Simplified Chinese,
Traditional Chinese, Korean

Logging facilities support: Local memory & storage (if available), multiple syslog servers, multiple
FortiAnalyzers, WebTrends servers, FortiCloud hosted service
Reliable logging using TCP option (RFC 3195)
Encrypted logging & log Integrity with FortiAnalyzer
Detailed traffic logs:fForwarded, violated sessions, local traffic, invalid packets
Comprehensive event logs: systems & administrators activity audits, routing & networking, VPN, user
authentications, WiFi related events
Brief traffic log format option
Sending logs to syslog servers in Common Event Format (CEF)
IP and service port name resolution option
DIAGNOSTICS

Integrated token server that provisions and manages physical, SMS, and Soft One Time Password (OTP) tokens

Diagnostic CLI commands, session tracer, and packet capture for troubleshooting hardware, system, andnetwork issues.

COMPLIANCE

Policy and routing GUI tracer

Run a series of system configuration compliance check and log results periodically or on-demand

Packet flow CLI tracer

Security Fabric Audit: Audit FortiGate within the fabric, provide results and recommendation, then allow users
to easily apply remediations for some items.

Hardware testing suite on CLIManages network devices compliance via client software:- Posture checking: Enforce client software installation and desired settings accordingly to device type/group
and/or user/usergroup and/or locations (IPs)- Quarantine clients if hit vulnerability level threshold
ADVANCE THREAT PROTECTION (ATP)External cloud-based or on-premise file analysis (OS sandbox) integration:- File submission (with option to select types)- Receive file analysis reports- Receive dynamic signature updates from file analysis system (file checksum and malicious URL DB)

MONITORING
Graphical Monitors: Real-time system, network service, and users status viewers
Dashboard: customized widgets and layout

Policy and Control
POLICY OBJECTS
Policy objects: predefined, customs, object grouping, tagging, and coloring
Address objects: subnet, IP, IP range, GeoIP (Geography), FQDNInternet Service DB: Dynamically updated DB that provides a list of popular cloud applications with their vital
information that can be used for policy setup, routing and link load-balacing configurations.

10

www.fortinet.com

FortiOS™ 5.6

SPECIFICATIONSDEVICE IDENTIFICATION

Web filtering local categories & category rating override

Device Identification: Device and OS fingerprinting, automatic classification, inventory management

Web filtering profile override: Allows administrator to temporarily assign different profiles to user/user group/IP

Support for MAC Authentication enforcement and bypass

Restrict access to Google Corporate Accounts only

SSL INSPECTION
Inspect SSL encrypted traffic option for IPS, application control, antivirus, web filtering, and DLP
SSL MITM Mirroring
SSL Inspection Method options: SSL certificate inspection or full SSL inspection
SSL inspection exemption by site reputation DB, web categories, and/or policy addresses
ACTIONS
User notifications: customizable replacement message for block sites and attachments
Web Browser top banner insert (Fortinet Bar): shows application control violations, Endpoint control
enforcement, web browsing quota etc
User quarantine:- Manually assigned with perpetual or customizable duration- Automatically when triggered by violated IPS signature

Additional features offered by proxy-based web filtering:- Filter Java Applet, ActiveX, and/or cookie- Block HTTP Post
- Log search keywords- Rate images by URL- Block HTTP redirects by rating- Exempt scanning encrypted connections on certain categories for privacy- Web Browsing quota by categories
FIREWALLOperating modes: NAT/route and transparent (bridge)
Schedules: One-time, recurring
Session helpers and ALGs: DCE/RPC, DNS-TCP, DNS-UDP, FTP, H.245 I, H.245 0, H.323, MGCP, MMS,
PMAP, PPTP, RAS, RSH, SIP, TFTP, TNS (Oracle)
VoIP traffic support: SIP/H.323 /SCCP NAT traversal, RTP pin holing
Protocol type support: SCTP, TCP, UDP, ICMP, IP

Security

User and device-based policies
Policy Management: Section or global policy management view

ANTI-MALWARENGFW policy mode: setup policies with applications and URLs as objects

Botnet server IP blocking with global IP reputation database

VPN

Antivirus database type selection (on selected models)Customizable SSL VPN portal: Color themes, layout, bookmarks, connection tools, client download

Flow-based or proxy-based AV option:- Support for popular web, mail, and FTP protocols- Scan encrypted traffic with SSL inspection

SSL VPN realm support: Allows multiple custom SSL VPN logins associated with user groups(URL paths, design)

Option to treat Windows executables in email attachments as viruses

Personal bookmarks management: allow administrators to view and maintain remote client bookmarks

File quarantine (local storage required)

Limit SSL portal concurrent users

IPS AND DOS

One time login per user options: Prevents concurrent logins using same username

IPS engine: 7,000+ up-to-date signatures, protocol anomaly detection, rate-based detection, custom
signatures, manual, automatic pull or push signature update, threat encyclopedia integration
IPS Actions: Default, monitor, block, reset, or quarantine (attackers IP, attackers IP and Victim IP, incominginterface) with expiry timeSingle-sign-on bookmarks: reuse previous login or predefined credentials to access resources

SSL VPN web mode: For thin remote clients equipped with a web browser only and support web application,such as HTTP/HTTPS Proxy, FTP, Telnet, SMB/CIFS, SSH. VNC, RDP, Citrix
SSL VPN tunnel mode: for remote computers that run a variety of client and server applications, SSL VPN
client supports MAC OSX, Linux, Windows Vista and with 64-bit Windows operating systems

Packet logging option

SSL VPN port forwarding mode: uses a Java Applet that listens on local ports on the user’s computer. Whenit receives data from a client application, the port forward module encrypts and sends the data to the SSL
VPN device, which then forwards the traffic to the application server.

IP(s) exemption from specified IPS signatures

Host integrity checking and OS check (for windows terminals only) prior to SSL tunnel mode connections

IPv4 and IPv6 rate-based DOS protection (available on most models) with threshold settings against TCP Syn
flood, TCP/UDP/SCTP port scan, ICMP sweep, TCP/UDP/SCTP/ICMP session flooding (source/destination)

MAC host check per portal

Filter-Based Selection: Severity, target, OS, application, and/or protocol

IDS sniffer mode
Active bypass with bypass Interfaces (selected models) and FortiBridge
APPLICATION CONTROL
Detects thousands of applications in 18 Categories: Business, Cloud IT, Collaboration, Email, Game, General
Interest, Mobile, Network Service, P2P, Proxy, Remote Access, Social Media, Storage/Backup, Update, Video/
Audio, VoIP, Web Chat and Industrial.
Custom application signature support
Supports detection for traffic using HTTP/2 protocol and able to block QUIC traffic so taht browser
automatically falls back to HTTP/2 + TLS 1.2
Filter-based overrides: By behavior, category, popularity, technology, risk, vendor, and/or protocol
Actions: Allow, block, reset session (CLI only), monitor only
SSH Inspection
Deep application control over popular public cloud services, such as SalesForce, Google Docs, and Dropbox
WEB FILTERINGWeb filtering inspection mode support: Proxy-based, flow-based, and DNS
Manually defined web filtering based on URL, web content and MIME header
Dynamic web filtering with cloud-based real-time categorization database:- Over 250 million URLs rated into 78 categories, in 70 languages
Safe Search enforcement: transparently inserts Safe Search parameter to queries. Supports Google, Yahoo!,Bing and Yandex, definable YouTube Education Filter
Proxy avoidance prevention: Proxy site category blocking, rate URLs by domain & IP address, block redirects
from cache & translation sites, proxy avoidance application blocking (application control), proxy behavior
blocking (IPS)

Cache cleaning option just before the SSL VPN session ends
Virtual desktop option to isolates the SSL VPN session from the client computer’s desktop environment
IPsec VPN:
- Remote peer support: IPsec-compliant dialup clients, peers with static IP/dynamic DNS- Authentication method: Certificate, pre-shared key- IPsec Phase 1 mode: Aggressive and main (ID protection) mode
- Peer acceptance options: Any ID, specific ID, ID in dialup user group- Supports IKEv1, IKEv2 (RFC 4306)- IKE mode configuration support (as server or client), DHCP over IPsec- Phase 1/Phase 2 Proposal encryption: DES, 3DES, AES128. AES192, AES256- Phase 1/Phase 2 Proposal authentication: MD5, SHA1, SHA256, SHA384, SHA512- Phase 1/Phase 2 Diffie-Hellman Group support: 1, 2, 5, 14- XAuth support as client or server mode
- XAuth for dialup users: Server type option (PAP, CHAP, Auto), NAT Traversal option- Configurable IKE encryption key expiry, NAT traversal keepalive frequency- Dead peer detection- Replay detection- Autokey keep-alive for Phase 2 SA
IPsec Configuration Wizard for termination with popular third-party devices
IPsec VPN deployment modes: Gateway-to-gateway, hub-and-spoke, full mesh, redundant-tunnel, VPN
termination in transparent mode,
IPsec VPN Configuration options: Route-based or policy-based
VPN monitoring: View and manage current IPsec and SSL VPN connections in details
Other VPN support: L2TP client (on selected models) and server mode, L2TP over IPsec, PPTP,
GRE over IPEC

11

FortiOS™ 5.6

SPECIFICATIONSDLPWeb filtering inspection mode support: proxy-based, flow-based and DNS
DLP message filter:- Protocol supported: HTTP-POST, SMTP, POP3, IMAP, MAPI, NNTP
- Actions: Log only, block, quarantine user/IP/Interface- Predefined filter: Credit card number, Social Security ID
DLP file filter:- Protocols Supported: HTTP-POST, HTTP=-GET,SMTP, POP3, IMAP, MAPI, FTP, NNTP
- Filter options: size, file type, watermark, content, if encrypted
DLP watermarking: Allows filter files that pass through the FortiGate unit and contain a corporate identifier(a text string) and a sensitivity level (Critical, Private, and Warning) hidden in a watermark. Support Windows
and Linux free watermarking tools.
DLP fingerprinting: Generates a checksum fingerprint from intercepted files and compare it to those in thefingerprint database.
DLP archiving: Records full content in email, FTP, IM, NNTP, and web traffic
EMAIL FILTERING
Mail protocol support: IMAP(S), POP3(S), and SMTP(S)Transparent Mode option: Keeps the original source address of the packets, so servers appear to receive
traffic directly from clients.
WAN optimization techniques: Protocol optimization and byte caching
WAN Optimization protocols supported: CIFS, FTP, HTTP(S), MAPI, TCP
Secure Tunneling option: Use AES-128bit-CBC SSL to encrypt the traffic in the WAN optimization tunnel
Tunnel sharing option: Multiple WAN optimization sessions share the same tunnel
Web caching: Object caching that accelerates web applications and web servers by reducing bandwidth
usage, server load, and perceived latency. Supports caching of HTTP 1.0 and HTTP 1.1 web sites
SSL Offloading with Web caching:- Full mode: Performs both decryption and encryption of the HTTPS traffic- Half mode: Only performs one encryption or decryption action
Option to exempt certain web sites from web caching with URL patterns
Support advanced web caching configurations and options:- Always revalidate, Max cache object zie, negative response duration, fresh factor, Max/Min/Default TTL,
proxy FQDN, Max HTTP request/message length, ignore options, cache expired objects, revalidated
prama-no-cache
WAN optimization and web cache monitor

Anti-Spam DB query: IP address check, URL check, and email checksum

EXPLICIT PROXY

Local Spam Filtering: HELO DNS Lookup, return email DNS check, and Black/White List

Explicit web & FTP proxy: FTP, HTTP, and HTTPS proxying on one or more interfaces
Proxy auto-config (PAC): Provide automatic proxy configurations for explicit web proxy users

Networking
ROUTING / NAT
Static and policy routing
Dynamic routing protocols: RIPv1 and v2, OSPF v2 and v3, ISIS, BGP4
Content routing: WCCP and ICAP

Proxy chaining: Web proxy forwarding to redirect web proxy sessions to other proxy servers
Web proxy forwarding server monitoring and health checking
IP reflect capability
Load balancing for forward proxy and proxy chaining
Explicit web proxy authentication: IP-Based authentication and per session authentication
Transparent web proxy

NAT configuration: Per policy based and central NAT Table

IPV6

NAT support: NAT64, NAT46, static NAT, dynamic NAT, PAT, Full Cone NAT, STUN
Multicast traffic: sparse and dense mode, PIM support

IPv6 Support: Management over IPv6, IPv6 routing protocols, IPv6 tunnelling, firewall and UTM for IPv6
traffic, NAT46, NAT64, IPv6 IPsec VPN

L2 / SWITCHING

HIGH AVAILABILITY

Layer-2 interface modes: Port aggregated, loopback, VLANs (802.1Q and Trunking), virtual hardware,
software, and VLAN switchesHigh availability modes: Active-passive, active-active, virtual clusters, VRRP, FG-5000 series clustering

VXLAN support:- interVTEP (VXLAN Tunnel End Point)- Support for multiple remote IPs, these remote IPs can be IPv4 unicast, IPv6 unicast, IPv4 multicast,or IPv6 multicast.

HA reserved management interface

Virtual Wire Pair:- Process traffic only between 2 assigned interfaces on the same network segment- available on both transparent and NAT/route Mode
- Option to implement wildcard VLANs setup
OFFLINE INSPECTION

Redundant heartbeat interfaces
Failover:- Port, local and remote link monitoring- Stateful failover- Subsecond failover- Failure detection notification
Deployment Options:- HA with link aggregation- Full mesh HA- Geographically dispersed HA

Sniffer Mode: An interface can be dedicated to its exclusive use where all traffic entering the interface isprocessed by the sniffer.

Standalone session synchronization

Offline Security inspection: AV, Web Filtering, Application Control, IPS, and Anti-spam

ESSENTIAL NETWORK SERVICES

SD WAN
WAN Load balancing (weighted) algorithms: By volume, sessions, source-destination IP and Source IP
Usage-based WAN link assignment: Routes new sessions to interfaces that have not reached a configured
bandwidth limit
WAN link checks:- Ping or HTTP probes- Monitoring Criterias including latency, jitter, and packet loss
- Configurable warning, alert, and failure thresholds
Route Overrides Rules which direct specific traffic based on source/user/usergroups and cloud applications/policy address objects.
Traffic shaping and QoS per policy or applications: Shared policy shaping, per-IP shaping, maximum andguaranteed bandwidth, maximum concurrent connections per IP, traffic prioritization, Type of Service (TOS),
and Differentiated Services (DiffServ) support
Traffic Shaping Policies: Assigns traffic shape profile according to matching policy based on source,
destination, service, application, application category, and/or URL category.
Inline and out-of-path WAN optimization topology, peer to peer and remote client support

12

Built-in DHCP, NTP, DNS Server, and DNS proxy
FortiGuard NTP, DDNS, and DNS service

Platform Support
PHYSICAL APPLIANCE (+SPU)
Integrates with SPU components for traffic processing acceleration.
VIRTUAL SYSTEMS
Virtual Systems (FortiOS Virtual Domains) divide a single FortiGate unit into two or more virtual instances ofFortiOS that function separately and can be managed independently.
Configurable virtual systems resource limiting and management such as maximum/guaranteed ‘active
sessions’ and log disk quota
VDOM operating modes: NAT/Route or Transparent
VDOM security inspection modes: Proxy or Flow-basedwww.fortinet.com

FortiOS™ 5.6

SPECIFICATIONSHYPERVISOR

OthersSupport for popular hypervisor platform, including VMware vSphere, Citrix and open source Xen, KVM, andMS hyper-V

OTHERSCLOUDWeb Application Firewall:- Signature based, URL constraints and HTTP method policy
Server load balancing: traffic can be distributed across multiple backend servers:- Based on multiple methods including static (failover), round robin, weighted or based on round trip time,number of connections.
- Supports HTTP, HTTPS, IMAPS, POP3S, SMTPS, SSL or generic TCP/UDP or IP protocols.
- Session persistence is supported based on the SSL session ID or based on an injected HTTP cookie.

Support for public cloud services: Amazon AWS and Microsoft Azure

NOTE: Feature set based on FortiOS V5.4.GA, some features may not apply to all models. For availability, please refer to Softwarefeature Matrix on docs.fortinet.com

REFERENCES
RESOURCEURLThe FortiOS Handbook — The Complete Guide

http://docs.fortinet.com/fgt.html

Fortinet Knowledge Base

http://kb.fortinet.com/

Product Data Sheets & Matrix

http://www.fortinet.com/resource_center/datasheets.html

GLOBAL HEADQUARTERS
Fortinet Inc.
899 KIFER ROAD
Sunnyvale, CA 94086
United States
Tel: +1.408.235.7700
www.fortinet.com/sales

EMEA SALES OFFICE
905 rue Albert Einstein
06560 ValbonneFranceTel: +33.4.8987.0500

APAC SALES OFFICE
300 Beach Road 20-01
The Concourse
Singapore 199555
Tel: +65.6395.2788

LATIN AMERICA SALES OFFICE
Sawgrass Lakes Center
13450 W. Sunrise Blvd., Suite 430
Sunrise, FL 33323
United States
Tel: +1.954.368.9990

Copyright© 2017 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All otherproduct or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affectperformance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified productwill perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in
Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations, and guarantees pursuant
hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.
FST-PROD-DS-FOS

FOS-DAT-R4-201705