Fortinet 3016B manual Firewall policies

Page 34

Firewall policies

Advanced configuration

Web Apply virus scanning and web content blocking to HTTP traffic.

Unfiltered Apply no scanning, blocking or IPS. Use the unfiltered content profile if no content protection for content traffic is required. Add this protection profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected.

The best way to begin creating your own protection profile is to open a predefined profile. This way you can see how a profile is set up, and then modify it suit your requirements. You access Protection profile options by going to Firewall > Protection Profile, and selecting Edit for one of the predefined profiles.

Protection profiles are used by the firewall policies to determine how network and Internet traffic is controlled, scanned and when necessary, rejected. The Protection Profiles can be considered the rules of the firewall policy. Because of this, you should take some time to review the various options to consider what you want the firewall policies to do. If, after setting the protection profile and firewall policies, traffic is not flowing or flowing too much, verify your profile settings.

The number of options and configuration for the protection profile is too vast for this document. For details on each protection profile feature and setting, see the FortiGate Administration Guide or the FortiGate Online Help.

Firewall policies

Firewall policies are instructions the FortiGate unit uses to decide what to do with a connection request. When the firewall receives a connection request, it analyzes it to extract its source address, destination address, and port number.

For the connection through the FortiGate unit to be successful, the source address, destination address, and service of the connection must match a firewall policy. The policy directs the firewall action for the connection. The action can be to allow the connection, deny the connection, require authentication before the connection is allowed, or process the packet as an IPSec VPN connection.

You can configure each firewall policy to route connections or apply network address translation (NAT) to translate source and destination IP addresses and ports. You also add protection profiles to firewall policies to apply different protection settings for the traffic controlled by firewall policies.

The FortiGate unit matches firewall policies by searching from the top of the firewall policy list and moving down until it finds the first match, then performs the required address translation, blocking and so on described by the protection profile, then passes on the packet information. This is important, because once the FortiGate unit finds a match to a policy, it will not continue down the list. You need to arrange policies in the policy list from more specific to more general.

For example, if you have two policies, one that blocks specific URLs or IP addresses, and another general policy that lets traffic through. If you put the general policy at the top, the FortiGate unit will act on the general policy, figuring the policy has been matched and potentially let the URLs or IPs you wanted blocked through.

Note: No traffic will flow through a FortiGate unit until at least one firewall policy is added.

 

FortiGate-3016B FortiOS 3.0 MR6 Install Guide

34

01-30006-0458-20080318

Image 34
Contents Install G U I D E Trademarks Regulatory complianceContents Advanced configuration AMC modulesTesting new firmware before installing Using the web-based managerInstalling firmware from a system reboot using the CLI FortiGate FirmwarePage Introduction Register your FortiGate unitAbout this document About the FortiGate-3016BDocument conventions Further Reading Typographic conventionsFortinet Knowledge Center Customer service and technical supportComments on Fortinet technical documentation Installing Environmental specificationsRack mount instructions GroundingMounting To install the FortiGate unit into a rack Installed mounting bracketsTo power on the FortiGate unit Plugging in the FortiGateTo power off the FortiGate unit Connecting to the networkTurning off the FortiGate unit Turning off the FortiGate unit NAT vs. Transparent mode ConfiguringNAT mode Connecting to the web-based manager Connecting to the FortiGate unitTransparent mode To connect to the web-based managerConnecting to the CLI To connect to the CLIConfigure the interfaces Configuring NAT modeUsing the web-based manager To configure interfaces Go to System Network InterfaceConfigure a DNS server Adding a default route and gatewayTo modify the default gateway Go to Router Static Adding firewall policiesTo set an interface to use a static address Using the CLITo set an interface to use Dhcp addressing To configure DNS server settings To set an interface to use PPPoE addressingTo modify the default gateway Configuring Transparent modeTo add an outgoing traffic firewall policy Switching to Transparent mode To switch to Transparent mode Go to System StatusTo switch to Transparent mode To configure DNS server settings Verify the configuration Backing up the configurationSet the Administrator password Restoring a configurationAdditional configuration Set the time and dateConfigure FortiGuard Updating antivirus and IPS signaturesAdditional configuration Advanced configuration Protection profilesFirewall policies Firewall policiesConfiguring firewall policies Antivirus optionsAntiSpam options Web filtering Logging To install the filler module Installing AMC filler unitsInstalling modules AMC modulesHard disk module Using the AMC modulesRemoving modules To insert a module into a FortiGate chassisTo format the ASM-S08 hard disk enter the following command Log configuration using the web-based managerFormatting the hard disk Viewing logs Log configuration using the CLIChanging interfaces to operate in Sgmii or SerDes mode ASM-FB4 and ADM-XB2 modulesAMC modules Configure the speed Config system interface edit AMC-SW1/1 Set speed auto EndDownloading firmware Using the web-based managerFortiGate Firmware Upgrading the firmwareReverting to a previous version To upgrade the firmwareTo revert to a previous firmware version Backup and Restore from a USB key Using the USB Auto-InstallUsing the CLI To upgrade the firmware using the CLITo revert to a previous firmware version using the CLI Execute restore image namestr tftpipv4Installing firmware from a system reboot using the CLI To install firmware from a system rebootEnter Tftp server address To backup configuration using the CLI Restoring the previous configurationTo restore configuration using the CLI Additional CLI Commands for a USB key Testing new firmware before installingTo configure the USB Auto-Install using the CLI To test the new firmware image FortiGate Firmware Testing new firmware before installing Index Web filtering 37 web-based manager Page Page
Related manuals
Manual 2 pages 28.98 Kb

3016B specifications

The Fortinet 3016B is a robust firewall solution designed to meet the dynamic security needs of modern enterprises. As part of the FortiGate product line, the 3016B combines advanced security features with high performance, catering to organizations that require reliability and efficiency in managing their network security.

One of the primary features of the Fortinet 3016B is its high throughput capabilities. It supports up to 40 Gbps of firewall throughput and an impressive 7.5 Gbps of intrusion prevention system (IPS) throughput. This ensures that even at peak network loads, the firewall can maintain strong performance without compromising security. This feature is particularly important for businesses that handle large volumes of data and require seamless connectivity for their operational efficiency.

The 3016B leverages Fortinet's proprietary FortiOS operating system, which is known for its user-friendly interface and comprehensive security functionalities. FortiOS includes a variety of tools such as a next-generation firewall (NGFW), antivirus protection, web filtering, and application control, all incorporated into a single platform. This consolidation helps in simplifying management while providing extensive security coverage against a wide array of cyber threats.

Moreover, the Fortinet 3016B incorporates advanced threat intelligence capabilities powered by FortiGuard Labs. This allows the firewall to stay updated with real-time threat feeds, enabling the organization to respond proactively to emerging threats and vulnerabilities. The integration of AI-driven analytics enhances anomaly detection and helps in identifying potential breaches before they can escalate.

Another notable characteristic of the 3016B is its scalability. Designed for medium to large enterprises, it can easily integrate into existing infrastructure and scale as business needs grow. With support for multiple virtual domains (VDOMs), organizations can create isolated environments for different departments or functions, maintaining policy separations while optimizing resource utilization.

In terms of connectivity, the Fortinet 3016B offers various interfaces, including multiple 1G and 10G Ethernet ports, ensuring flexible deployment options. The device also supports high availability (HA) configurations, which provide redundancy and minimize downtime.

Overall, the Fortinet 3016B is an exceptional solution that combines superior security features with high performance and scalability, making it a prime choice for organizations looking to strengthen their network security posture without sacrificing efficiency. With its comprehensive capabilities, it empowers businesses to tackle today’s cybersecurity challenges effectively.