sebuah catatan dan dokumentasi kehidupan: fortinet

fortinet - Basic Firewall

internal network ---------- fortigate --------- internet

objective: create 3 policy
1 user internet policy --- web access
2 user mobile policy --- web access with web filtering
3 admin policy --- sys admin unrestricted access

======================
1 user internet policy

policy & object > IPv4 Policy >
name = internet
Service = DNS, HTTP, HTTPS
NAT = enabled
Log Allowed Traffic = All Sessions

=====================

2 user mobile policy

policy & object > IPv4 Policy >
name = Mobile
incoming interface = lan
outgoing interface = wan

source = mobile devices, all

dest = all

service = DNS, HTTP, HTTPS

NAT = enabled

web filter = enabled, default
SSL/SSH inspection = enabled, certificate-inspection

Log Allowed Traffic = All Sessions

======================
3 admin policy

user & devices > Custom Devices & Groups > Create New > new

device
alias = Admin
Mac = xxxx
Device Type = windows pc

policy & object > ipv4 policy
name = Admin
incoming interface = lan
outgoing interface = wan1
source = all, admin PC
dest = all
service = all
nat = enabled
log allowed traffic = all session
save

Policy & object > Ipv4 Policy > By Sequence -> urutannya
1 internet
2 mobile
3 admin
4 implicit deny

^ untuk ngubah urutan policy tgl drag nomernya keatas

==================

fortinet - Transparent Web Proxy

transparent web proxy:

- apply web authentication to all http traffic that accepted by firewall policy

objective: applying proxy to all user web traffic without configure end user

client configuration change ( web proxy , system proxy )

dulu -> support explicit web proxy
skrg -> support transparent web proxy

system > setting > System Operation Settings > Inspection Mode = proxy
save

system > feature visibility > explicit proxy = enabled
apply

network > explicit web proxy = enabled
http port = 8080 !! bisa di custom
apply

security profiles > proxy options > http policy redirect = enabled

policy & object > IPv4 Policy > edit > security profiles > antivirus = enabled
proxy options = default
ssl / ssh inspection - certificate- inspections
OK

policy & object > Proxy Policy > Create New > Transparent Web
incoming = port1
outgoing = wan1
source = all
dest = all
security profiles > antivirus = enabled ( default )

-----------------------------------------------

fortiview > policies > internet > drill down to detail

fortinet - HIGH AVAILABILITY

high availability

internet ---- switch ----- fortigate1 ------- sw1 ------ fgt140d ---- net1
| x
|--------- fortigate 2 ------ sw2 ---- fgt 40d ---- net2

==================================

intinya klo 1 fortigate down, tugasnya akan dialihkan ke fortigate sebelahnya.
jadi network tetep up.

redundancy!

==================================
** setting di primary fortigate

- setting registration & licensing.

1 firmwarenya harus sama di ke 2 fortigate
2 register license & apply same level of license ( IPS, antivirus, webfiltering, forticlient, forticloud ,fortiguard)

3 system > setting > hostname > primary-fortigate
4 system> HA > mode : active-passive
5 device priority naikin dari 128 ke 250 (higher, default = 128) -> buat jadi primary

6 group name: External-HA-Cluster
password : xxx

7 heartbeat interfaces : 2 interface yang mengarah ke fortigate yang lain.

8 heartbeat interfaces priority: 50

config system ha set group-id 25 !! klo ada cluster yg lain. ( hrs di set group id )
end

====================================
note:
1 hrs ada switch diantara cluster fortigate - internet
2 hrs ada switch diantara cluster fortigate - internal network

===================================

**setting backup fortigate

1 firmwarenya harus sama di ke 2 fortigate
2 register license & apply same level of license ( IPS, antivirus, webfiltering, forticlient, forticloud ,fortiguard)

3 system > setting > hostname > backup-fortigate
4 system> HA > mode : active-passive
5 device priority turunin dari 128 ke 50 (lower, default = 128) -> buat jadi backup )

6 group name: External-HA-Cluster !! samain nama group seperti di fortigate primary
password : xxx

7 heartbeat interfaces : 2 interface yang mengarah ke fortigate yang lain.

8 heartbeat interfaces priority: 50

done. nanti dicheck 1 role: master
2 role: slave

check via main > HA Status > active-passive , uptime xxx

=================================

cara test:
- matiin primary fortigate

via cli:

#execute shutdown

=================

fortinet

solusi fortinet:

- next gen firewall
- secure SD-WAN
- virtualized next-gen firewall
- secure wifi
- endpoint security
- email security

- IPS ( instruction prevention system )
- sandbox
- public cloud security
- web application firewall
- secure switching
- application delivery control

- secure web gateway
- management
- cloud access security broker
- SIEM
- identify and access management
- DDos

fortigate 7000,5000 series --- chassis based NGFW

fortigate 6000 series --- ultra high end

fortigate 3000,2000,1000 series --- high end

fortigate 900, 800,600,500,400,300,200,100 series --- mid range

fortigate 90, 80, 60 , 50, 30 series ---- entry

===============
next gen firewall (NGFW)
intrusion prevention system (IPS)
software-defined WAN (SD-WAN)
Secure Web Gateway (SWG)

===============

fortinet :
high performance network security products and services including the Fortigate firewall. It is their flagship integrated network security soution.

================

WF---IPS---FW----internet

FW = firewall
IPS = intrusion prevention system
wf = web filtering

security
control
performance

=================

sebuah catatan dan dokumentasi kehidupan

Pages

Friday, March 30, 2018

fortinet - Basic Firewall

fortinet - Transparent Web Proxy

fortinet IPSEC / site-to-site VPN

fortinet - HIGH AVAILABILITY

fortinet