-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathfgtvm.conf
168 lines (160 loc) · 2.73 KB
/
fgtvm.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
Content-Type: multipart/mixed; boundary="==AWS=="
MIME-Version: 1.0
--==AWS==
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
config system global
set hostname FGTVM-GWLB
set admin-sport ${adminsport}
end
config system interface
edit port1
set alias public
set mode dhcp
set allowaccess ping https ssh
next
edit port2
set alias private
set mode dhcp
set allowaccess https ssh fgfm probe-response
set defaultgw disable
next
end
config system probe-response
set mode http-probe
end
config system global
set vdom-mode split-vdom
end
config global
config system interface
edit port2
set vdom FG-traffic
next
end
end
config vdom
edit FG-traffic
config system geneve
edit "gwlb-az2a"
set interface "port2"
set type ppp
set remote-ip ${endpointip}
next
edit "gwlb-az2b"
set interface "port2"
set type ppp
set remote-ip ${endpointip2b}
next
edit "gwlb-az2c"
set interface "port2"
set type ppp
set remote-ip ${endpointip2c}
next
end
config system zone
edit "gwlb-tunnels"
set interface "gwlb-az2a" "gwlb-az2b" "gwlb-az2c"
next
end
config webfilter urlfilter
edit 1
set name "webfilter"
config entries
edit 1
set url "*facebook.com"
set type wildcard
set action monitor
next
edit 2
set url "*instagram.com"
set type wildcard
set action block
next
end
next
end
config webfilter profile
edit "webfilter"
config web
set urlfilter-table 1
end
config ftgd-wf
unset options
end
next
end
config firewall policy
edit 1
set name "http-deny"
set srcintf "gwlb-tunnels"
set dstintf "gwlb-tunnels"
set srcaddr "all"
set dstaddr "all"
set action deny
set schedule "always"
set service "HTTP"
set logtraffic disable
next
edit 2
set name "https-allow"
set srcintf "gwlb-tunnels"
set dstintf "gwlb-tunnels"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
end
config router static
edit 1
set device gwlb-az2a
next
edit 2
set device gwlb-az2b
next
edit 3
set device gwlb-az2c
next
edit 4
set device port2
set dst ${cidr}
set gateway ${gateway}
next
end
config router policy
edit 1
set input-device "gwlb-az2a"
set output-device "gwlb-az2a"
set src "0.0.0.0/0.0.0.0"
set dst "0.0.0.0/0.0.0.0"
set gateway ${endpointip}
next
edit 2
set input-device "gwlb-az2b"
set output-device "gwlb-az2b"
set src "0.0.0.0/0.0.0.0"
set dst "0.0.0.0/0.0.0.0"
set gateway ${endpointip2b}
next
edit 3
set input-device "gwlb-az2c"
set output-device "gwlb-az2c"
set src "0.0.0.0/0.0.0.0"
set dst "0.0.0.0/0.0.0.0"
set gateway ${endpointip2c}
next
end
%{ if type == "byol" }
--==AWS==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="license"
${file(license_file)}
%{ endif }
--==AWS==--
# execute log filter category utm-webfilter
# execute log display