Firewall

Advanced policy options

 

 

In most cases you should make sure that users can use DNS through the firewall without authentication. If DNS is not available users cannot connect to a web, FTP, or Telnet server using a domain name.

Traffic Shaping

Traffic Shaping controls the bandwidth available to and sets the priority of the traffic processed by the policy. Traffic Shaping makes it possible to control which policies have the highest priority when large amounts of data are moving through the FortiGate device. For example, the policy for the corporate web server might be given higher priority than the policies for most employees’ computers. An employee who needs unusually high-speed Internet access could have a special outgoing policy set up with higher bandwidth.

If you set both guaranteed bandwidth and maximum bandwidth to 0 (zero), the policy does not allow any traffic.

Guaranteed

You can use traffic shaping to guarantee the amount of bandwidth available

Bandwidth

through the firewall for a policy. Guarantee bandwidth (in Kbytes) to make

 

sure that there is enough bandwidth available for a high-priority service.

Maximum

You can also use traffic shaping to limit the amount of bandwidth available

Bandwidth

through the firewall for a policy. Limit bandwidth to keep less important

 

services from using bandwidth needed for more important services.

Traffic Priority

Select High, Medium, or Low. Select Traffic Priority so that the FortiGate unit

 

manages the relative priorities of different types of traffic. For example, a

 

policy for connecting to a secure web server needed to support e-commerce

 

traffic should be assigned a high traffic priority. Less important services

 

should be assigned a low priority. The firewall provides bandwidth to low-

 

priority connections only when bandwidth is not needed for high-priority

 

connections.

Differentiated Services

Differentiate Services (DiffServ) describes a set of end-to-end Quality of Service (QoS) capabilities. End-to-end QoS is the ability of a network to deliver service required by specific network traffic from one end of the network to another. By configuring DiffServ you configure your network to deliver particular levels of service for different packets based on the QoS specified by each packet.

DiffServ is defined by RFC 2474 and 2475 as enhancements to the IP networking to enable scalable service discrimination in the IP network without the need for per-flow state and signalling at every hop. DiffServ-capable routers sort IP traffic into classes by inspecting the DS field in IPv4 header or the Traffic Class field in the IPv6 header.

You can use the FortiGate DiffServ feature to change the DSCP (Differentiated Services Code Point) value for all packets accepted by a policy. The network uses these DSCP values to classify, mark, shape, and police traffic, and to perform intelligent queuing. DSCP features are applied to traffic by configuring the routers on your network are configured to apply different service levels to packets depending on the DSCP value of packets that they are routing.

You can configure policies to apply DS values for both forward and reverse traffic. These values are optional and may be enabled independently from each other. When both are disabled, no changes to the DS field are made.

FortiGate-100A Administration Guide

01-28007-0068-20041203

195

Page 195
Image 195
Fortinet 100A manual Traffic Shaping, Differentiated Services, 195

100A specifications

Fortinet 100A is a versatile network security device designed to provide comprehensive protection against various cyber threats while ensuring optimal network performance. As part of the FortiGate series, the 100A combines advanced security features with powerful hardware capabilities, making it suitable for small to medium-sized businesses.

One of the key features of the Fortinet 100A is its deep packet inspection technology. This capability allows the firewall to analyze both the header and payload of packets traversing the network, enabling it to detect and block malicious content effectively. The 100A can identify and mitigate a wide range of threats, including malware, intrusions, and application-layer attacks.

The FortiOS operating system powers the Fortinet 100A, offering a robust and user-friendly interface for configuration and management. With its unified security management console, administrators can efficiently monitor network traffic and enforce security policies across the organization. The system provides centralized logging and reporting features, enabling users to gain valuable insights into their security posture and respond swiftly to incidents.

The 100A supports multiple deployment modes, including transparent, NAT, and route modes. This flexibility allows organizations to integrate the device into their existing network architecture with ease. The firewall's high throughput capabilities ensure that network performance remains unaffected, even under heavy load from multiple users and devices.

Another notable aspect of the Fortinet 100A is its support for various VPN technologies, including IPsec and SSL VPN. This feature facilitates secure remote access for employees, enabling them to connect to the corporate network safely, regardless of their location. As remote work continues to be a norm in many sectors, this capability is critical for maintaining productivity and security.

In addition to these features, the Fortinet 100A provides comprehensive web filtering capabilities, protecting users from harmful websites and inappropriate content. This protection is essential for organizations looking to maintain a secure and productive environment.

With its combination of powerful security features, flexible deployment options, and robust performance, the Fortinet 100A stands out as an ideal solution for organizations seeking to bolster their cybersecurity measures while ensuring seamless connectivity for users. As cyber threats continue to evolve, investing in a capable device like the FortiGate 100A is crucial for maintaining a secure network infrastructure.