Firewall configuration | Default firewall configuration |
|
|
Zones
You can add zones to the FortiGate configuration to group together related interfaces and VLAN subinterfaces to simplify firewall policy creation. For more information about zones, see “Configuring zones” on page 133.
To add policies for zones, you must use the following steps to add the zones to the firewall policy grid:
1Add zones to the FortiGate configuration. See “Adding zones” on page 133.
2Add interfaces and VLAN subinterfaces to the zone.
See “Adding interfaces to a zone” on page 134 and “Adding VLAN subinterfaces to a zone” on page 134.
3Add firewall addresses for the zone. See “Adding addresses” on page 179.
Addresses
To add policies between interfaces, VLAN subinterfaces and zones, the firewall configuration must contain addresses for each interface, VLAN subinterface, or zone. By default the firewall configuration includes the addresses listed in Table 5.
Table 5: Default addresses
Interface | Address | Description |
|
|
|
Port1 | Port1_All | This address matches all addresses on the network connected to |
|
| port1. |
|
|
|
Port2 | Port2_All | This address matches all addresses on the network connected to |
|
| port2 |
|
|
|
The firewall uses these addresses to match the source and destination addresses of packets received by the firewall. The default policy matches all connections from the network connected to port1 because it includes the Port1_All address. The default policy also matches all connections to the network connected to port2 because it includes the Port2_All address.
You can add more addresses to each interface to improve the control you have over connections through the firewall. For more information about addresses, see “Addresses” on page 179.
You can also add firewall policies that perform network address translation (NAT). To use NAT to translate destination addresses, you must add virtual IPs. Virtual IPs map addresses on one network to a translated address on another network. For more information about Virtual IPs, see “Virtual IPs” on page 188.
171 |
