Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 18 views

    18 Zone+Lab Fortigate

    Uploaded by

    Garudmani Pavan
    18-Zone+Lab-Fortigate

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    18 Zone+Lab Fortigate

    Uploaded by

    Garudmani Pavan
    18 views6 pages
    18-Zone+Lab-Fortigate

    Original Title

    18-Zone+Lab-Fortigate

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    18-Zone+Lab-Fortigate

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    18 views6 pages

    18 Zone+Lab Fortigate

    Uploaded by

    Garudmani Pavan
    18-Zone+Lab-Fortigate

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 6

    https://docs.fortinet.com/document/fortigate/7.4.

    1/administration-guide/116821/zone

    Open above link, and read the doc after completing below lab reading, link explanation is very
    clear then below lab and you can see CLI config as well

    Read lab-17, to understand easily


    Zone:
    o Zones are a group of one or more physical or virtual FortiGate firewall interfaces.
    o To simplify the policy configuration, you can group interfaces into logical zones.
    o That you can apply the security policies to control inbound and outbound traffic.
    o Grouping interfaces, VLAN subinterfaces into zones simplifies creation security policies.
    o Where number of network segments can use same policy settings & protection profiles.
    o When add zone, select names of interfaces and VLAN subinterfaces to add to the zone.
    o Each interface still has its own address and routing is still done between the interfaces.
    o You can use FortiGate Firewall security policies to control the flow of intra-zone traffic.
    o Admin making separate security policies make simpler by adding interfaces to a zone.
    o However, you should note that an interface in a zone cannot be referenced individually.
    o Only configure policies for connections to & from zone but not between interfaces zone. not b/w interfaces in
    o You can create a security policy in FortiGate Firewall to go between zone 1 and zone 3. the zone
    o but you cannot create security policy between WAN2 and WAN1, or WAN1 and DMZ1.Refer below digaram.
    o In zone configuration set intrazone deny prohibiting different interfaces in same zone.
    o Enable Block intra-zone traffic, block different interfaces in same zone to talk each other.
    Zone will help you to
    minimize policy

    1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , WhatsApp: 00966564303717


    NOT SHOWING SUB
    INTERFACE VLANS IN
    INTERFACE MEMBERS
    OPTION, BECAISE FW got 192.168.100.200 MGMT IP which is
    THOSE ARE USED IN given by MGMT PC present below
    POLICY
    Zone Lab:

    First let’s delete the previously created Firewall policies for VLAN 40 and VLAN 50.

    To create a zone in Go to Network > Interfaces Click Create New > Zone.
    Also you can right click
    and delete policy

    2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , WhatsApp: 00966564303717


    Configure the Name and add the Interface Members in our case VLAN40 & VLAN50.
    Enable Block intra-zone traffic, block different interfaces in same zone to talk each other.

    Create a firewall policy, go to Policy & Objects > Firewall Policy, and click Create New.

    3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , WhatsApp: 00966564303717


    Test and Verification:
    Try to access any website from SRV1 in this case facebook.com it’s working.

    Now, try to access any website from SRV2 in this case twitter.com it’s working.

    4 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , WhatsApp: 00966564303717


    Go to Dashboard> FortiView Sources to display and verify VLAN40 & VLAN50 source IP.

    Go to Dashboard> FortiView Destinations to display and verify the destinations domains & IP.

    Go to Dashboard> FortiView Polices to display and verify security polices has been hits & used.

    5 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , WhatsApp: 00966564303717


    Go to Dashboard> FortiView Sessions to display and verify all VLANs visited links sessions.

    Go to Log & Report> Forward Traffic to display and verify all VLANs visited links sessions.

    6 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , WhatsApp: 00966564303717

    You might also like