Firewall configuration
Firewall policies control all traffic passing through the FortiGate unit. Firewall policies are instructions used by the FortiGate unit to decide what to do with a connection request. When the firewall receives a connection request in the form of a packet, it analyzes the packet to extract its source address, destination address, and service (port number).
For the packet to be connected through the FortiGate unit, a firewall policy must have been added that matches the packet’s source address, destination address, and service. The policy directs the firewall action on the packet. The action can be to allow the connection, deny the connection, require authentication before the connection is allowed, or process the packet as an IPSec VPN packet. You can also add schedules to policies so that the firewall can process connections differently depending on the time of day or the day of the week, month, or year.
Each policy can be individually configured to route connections or to apply network address translation (NAT) to translate source and destination IP addresses and ports. You can add IP pools to use dynamic NAT when the firewall translates source addresses. You can use policies to configure port address translation (PAT) through the FortiGate.
Content profiles can be added to policies to apply antivirus protection, web filtering, and email filtering to web, file transfer, and email services. You can create content profiles that perform one or any combination of the following actions:
•Apply antivirus protection to HTTP, FTP, SMTP, IMAP, or POP3 services.
•Apply web filtering to HTTP services.
•Apply email filtering to IMAP and POP3 services.
You can also add logging to a firewall policy so that the FortiGate unit logs all connections that use this policy.
This chapter describes:
•Default firewall configuration
•Adding firewall policies
•Configuring policy lists
•Addresses
•Services
•Schedules
•Virtual IPs
•IP pools
•IP/MAC binding
•Content profiles
141 |
