# System Configuration This section explains **System Configuration** step-by-step, starting with **Device Initialization** and covering each subtopic in detail. ### **1.1 Device Initialization** #### **1.1.1 Setting up FortiGate for the First Time** When you power on a FortiGate device for the first time, it requires some initial configurations to make it operational. Let’s break it down into manageable steps: ##### **Step 1: Connect to FortiGate** 1. **Physical Connection**: - Use a console cable to connect your computer’s serial port to the console port of the FortiGate device. - Alternatively, connect your PC to one of the LAN ports (default IP is `192.168.1.99` for FortiGate) and use a web browser or SSH client. 2. **Access the CLI (Command Line Interface)**: - Use terminal software (e.g., PuTTY or Tera Term) to access the CLI. - Default credentials: - Username: `admin` - Password: (blank, press Enter). ##### **Step 2: Configure Management IP Address and Default Gateway** - To allow remote management via HTTP/HTTPS or SSH, assign an IP address to the management interface: ```plaintext config system interface edit # e.g., port1 set ip # e.g., 192.168.1.1/255.255.255.0 set allowaccess ping https ssh # Allow secure management access set alias "Management" # Optional description end ``` - Configure the default gateway for internet access: ```plaintext config router static edit 1 set gateway # e.g., 192.168.1.254 set device # e.g., port1 end ``` ##### **Step 3: Set Hostname, DNS, and System Time** 1. **Set Hostname**: - A descriptive hostname helps identify the device: ```plaintext config system global set hostname # e.g., FortiGate_Main end ``` 2. **Set DNS Servers**: - Configure the device to resolve domain names: ```plaintext config system dns set primary # e.g., 8.8.8.8 set secondary # e.g., 8.8.4.4 end ``` 3. **Configure System Time**: - Either manually set the time: ```plaintext config system time set time # e.g., 12:30:00 set date # e.g., 2024/12/25 end ``` - Or, use an NTP server for automatic time synchronization: ```plaintext config system ntp set status enable set server "pool.ntp.org" end ``` ##### **Step 4: Enable Secure Management Access** - To enhance security, enable HTTPS and SSH management: ```plaintext config system global set admin-https enable set admin-ssh enable end ``` ### **1.2 Interface and VLAN Management** #### **1.2.1 Configuring Physical and Virtual Interfaces** Interfaces on FortiGate devices act as the connection points for networks. Here's how to set them up: ##### **Step 1: Assign Roles (LAN, WAN) to Interfaces** - Configure each interface based on its function (e.g., internal LAN, external WAN): ```plaintext config system interface edit # e.g., port2 for LAN, port3 for WAN set role lan # LAN interface set ip # e.g., 192.168.10.1/255.255.255.0 set allowaccess ping http https ssh # Allow management if needed end ``` ##### **Step 2: VLAN Configuration** - VLANs (Virtual Local Area Networks) are used for segmentation. To create a VLAN interface: ```plaintext config system interface edit # e.g., VLAN100 set type vlan set vlanid # e.g., 100 set interface # e.g., port1 set ip # e.g., 192.168.100.1/255.255.255.0 set allowaccess ping https end ``` ##### **Step 3: Trunking** - If the FortiGate is connected to a switch with trunking enabled, configure VLAN interfaces for all tagged VLANs. Ensure the physical interface supports multiple VLANs. ##### **Step 4: Configuring DHCP Services** - To automatically assign IPs to devices in a network, enable DHCP: ```plaintext config system dhcp server edit 1 set interface # e.g., port2 set default-gateway # e.g., 192.168.10.1 set netmask # e.g., 255.255.255.0 set range # e.g., 192.168.10.100 192.168.10.200 end ``` ### **1.3 High Availability (HA)** #### **1.3.1 Establishing HA** High Availability ensures redundancy and fault tolerance. Here's how to configure it: ##### **Step 1: Enable HA Mode** - Access the HA configuration: ```plaintext config system ha set mode # Active-Passive (a-p) or Active-Active (a-a) set group-name # e.g., FortiHACluster set password set hbdev # e.g., port4 end ``` ##### **Step 2: Configure Cluster ID and Priority** - The Cluster ID identifies the HA group, and Priority determines the primary unit: ```plaintext config system ha set clusterid # e.g., 1 set priority # Higher value = higher priority end ``` ##### **Step 3: Enable Session Synchronization** - Synchronize session tables between cluster members: ```plaintext config system ha set session-pickup enable end ``` ### **1.4 Virtual Domains (VDOMs)** Virtual Domains (VDOMs) allow a single FortiGate device to function as multiple independent logical units. This is especially useful for multi-tenant environments or networks requiring logical segmentation. #### **1.4.1 VDOM Modes** FortiGate supports two VDOM modes: 1. **Split VDOM Mode**: - Divides the FortiGate into two logical domains: one for NAT/Firewall operations and the other for Transparent Layer 2 operations. - Suitable for simple network scenarios. 2. **Multi-VDOM Mode**: - Enables multiple independent VDOMs on the same device. - Ideal for multi-tenant environments where different departments or clients require separate configurations. To enable VDOM mode: ```plaintext config system global set vdom-admin enable end ``` #### **1.4.2 Creating and Configuring VDOMs** 1. **Create a New VDOM**: - Add a VDOM and allocate resources: ```plaintext config vdom edit # e.g., HR_VDOM set operation-mode # NAT or Transparent end ``` 2. **Assign Interfaces to VDOMs**: - Allocate physical or VLAN interfaces to the VDOM: ```plaintext config system interface edit # e.g., port2 set vdom # e.g., HR_VDOM end ``` 3. **Configure Inter-VDOM Links**: - For traffic between VDOMs, create a virtual link: ```plaintext config vdom-link edit # e.g., vdom_link_1 set src # e.g., HR_VDOM set dst # e.g., Finance_VDOM end ``` 4. **Switching Between VDOMs**: - Use the CLI to switch to a specific VDOM for management: ```plaintext config vdom edit # e.g., HR_VDOM end ``` ### **1.5 NAT and Firewall Policies** Network Address Translation (NAT) and Firewall Policies are key to managing traffic flow in FortiGate. #### **1.5.1 Source NAT (SNAT)** SNAT modifies the source IP address of outbound traffic to match the FortiGate’s public IP address. 1. **Basic SNAT Configuration**: - Add a NAT rule within a firewall policy: ```plaintext config firewall policy edit 1 set srcintf # e.g., port2 set dstintf # e.g., port1 set srcaddr # e.g., 192.168.10.0/24 set dstaddr all set action accept set nat enable end ``` 2. **Central NAT Table**: - For complex environments, use the Central NAT Table: ```plaintext config firewall central-nat edit 1 set orig-addr # e.g., 192.168.10.0/24 set orig-port 0-65535 set trans-addr # e.g., 203.0.113.1 end ``` #### **1.5.2 Destination NAT (DNAT)** DNAT redirects inbound traffic from an external IP to an internal server. 1. **DNAT in Firewall Policies**: - Add a DNAT rule within a firewall policy: ```plaintext config firewall vip edit # e.g., Web_Server_VIP set extip # e.g., 203.0.113.10 set mappedip # e.g., 192.168.10.10 end config firewall policy edit 1 set srcintf # e.g., port1 set dstintf # e.g., port2 set srcaddr all set dstaddr # e.g., Web_Server_VIP set action accept end ``` ### **1.6 Logging and Monitoring** Logging and monitoring help administrators track and troubleshoot network activity. #### **1.6.1 Local and Remote Logging** FortiGate can store logs locally or forward them to external systems like FortiAnalyzer or Syslog servers. 1. **Configure Local Logging**: - Enable logging on specific policies: ```plaintext config firewall policy edit 1 set logtraffic all # Log all sessions end ``` - View logs using the Web GUI or CLI: ```plaintext execute log filter device-id execute log display ``` 2. **Configure Remote Logging**: - Forward logs to FortiAnalyzer: ```plaintext config log fortianalyzer setting set status enable set server # e.g., 192.168.1.100 set source-ip # e.g., 192.168.1.1 end ``` - Forward logs to a Syslog server: ```plaintext config log syslogd setting set status enable set server # e.g., 192.168.1.101 end ``` #### **1.6.2 Monitoring Tools** FortiGate provides several tools to monitor system health and traffic. 1. **Dashboard Monitoring**: - Use the Web GUI to check widgets for: - System Resource Usage (CPU, Memory). - Session Counts. - Interface Bandwidth. 2. **CLI Monitoring Commands**: - Monitor system performance: ```plaintext diag sys top ``` - View active sessions: ```plaintext diag sys session list ``` - Analyze packet flow for troubleshooting: ```plaintext diag debug flow diag debug enable ``` --- # Central Management This section provides a detailed walkthrough of **Central Management**, focusing on **FortiManager**, **FortiAnalyzer**, and **Security Fabric Integration**. ### **2.1 FortiManager** FortiManager is a centralized management solution for Fortinet devices, including FortiGate. It simplifies configuration, policy management, and device monitoring in complex environments. #### **2.1.1 Centralized Policy Management** FortiManager allows administrators to create and deploy consistent policies across multiple devices. ##### **Step 1: Create Policy Packages** - Policy packages are collections of firewall rules, NAT configurations, and security profiles that can be applied to devices or device groups. 1. **Log into FortiManager**: - Use a web browser to access the FortiManager GUI. - Default credentials: Username: `admin`, Password: (blank). 2. **Create a New Policy Package**: - Navigate to **Policy & Objects > Policy Packages**. - Click **Create New** and define a package name (e.g., `Corporate_Policies`). 3. **Add Firewall Policies**: - Within the package, define rules for traffic filtering: - Source, destination, services, and actions (e.g., allow, deny). - Attach security profiles like antivirus or IPS. ##### **Step 2: Deploy Policies** 1. **Select Devices**: - Map the policy package to a FortiGate device or ADOM (Administrative Domain). 2. **Install Policies**: - Review changes and click **Install** to push the policies to selected devices. 3. **Verify Installation**: - Check the deployment status for errors or conflicts. ##### **Step 3: Use Administrative Domains (ADOMs)** - **ADOMs** allow segmentation of devices into logical groups based on function, location, or department. - Enable ADOMs in **System Settings > Admin Settings**. - Create ADOMs and assign devices to their respective ADOMs for role-based access control. #### **2.1.2 Configuration Backups and Rollbacks** FortiManager can schedule regular configuration backups and rollbacks to ensure device consistency and disaster recovery. ##### **Step 1: Automate Backups** 1. **Schedule Backups**: - Go to **Device Manager > Device Settings**. - Set up a backup schedule for selected devices (e.g., daily, weekly). 2. **Choose Backup Types**: - Full configuration or incremental changes. ##### **Step 2: Rollback Changes** - If a misconfiguration occurs, rollback to a previous version: - Navigate to **Device Manager > Revision History**. - Select a backup and click **Restore**. #### **2.1.3 Script Automation** FortiManager enables administrators to automate repetitive tasks across multiple devices using scripts. ##### **Step 1: Create a CLI Script** 1. **Access the Script Manager**: - Navigate to **Scripts** in the FortiManager GUI. - Click **Create New** and choose **CLI Script**. 2. **Write the Script**: - Example: Configure interface IPs on multiple devices: ```plaintext config system interface edit port1 set ip 192.168.1.1/24 set allowaccess ping https ssh end ``` 3. **Save and Test**: - Test the script on a single device before applying it globally. ##### **Step 2: Execute the Script** 1. **Select Target Devices**: - Assign the script to specific devices or groups. 2. **Schedule Execution**: - Run immediately or set a future execution time. ### **2.2 FortiAnalyzer** FortiAnalyzer is a log management and analysis platform that works seamlessly with FortiGate to provide insights into network activity. #### **2.2.1 Centralized Logging and Analysis** ##### **Step 1: Log Collection** 1. **Connect FortiGate Devices**: - In the FortiGate GUI, configure log forwarding to FortiAnalyzer: ```plaintext config log fortianalyzer setting set status enable set server set source-ip end ``` 2. **Enable Logging on Policies**: - On FortiGate, ensure firewall policies have logging enabled: ```plaintext config firewall policy edit 1 set logtraffic all end ``` ##### **Step 2: Use Filters and Queries** 1. **Access Logs**: - In the FortiAnalyzer GUI, navigate to **Log View**. 2. **Apply Filters**: - Filter logs by criteria like date, severity, or source IP. 3. **Run Queries**: - Use query language to identify patterns or specific incidents. #### **2.2.2 Reporting** ##### **Step 1: Generate Reports** 1. **Access the Reporting Module**: - Navigate to **Reports > All Reports**. 2. **Select a Report Template**: - Use predefined templates for traffic analysis, threat detection, or compliance (e.g., GDPR, PCI-DSS). 3. **Customize Reports**: - Add or remove sections as needed, such as bandwidth usage or user activity. ##### **Step 2: Schedule Reports** 1. **Set Frequency**: - Schedule reports to generate automatically (daily, weekly, or monthly). 2. **Delivery Options**: - Send reports via email or download them directly. ### **2.3 Fabric Integration** FortiManager and FortiAnalyzer can integrate with the Fortinet Security Fabric to provide centralized visibility and coordination across Fortinet devices. #### **2.3.1 Security Fabric Integration** 1. **Enable Security Fabric**: - On FortiGate, enable Fabric connectors to link other Fortinet products: ```plaintext config system settings set security-fabric enable end ``` 2. **View Fabric Topology**: - In the FortiAnalyzer or FortiManager GUI, navigate to **Fabric View** to see a visual map of connected devices. #### **2.3.2 Threat Intelligence Sharing** 1. **Enable Threat Feeds**: - Integrate third-party threat intelligence feeds with FortiAnalyzer. - Use dynamic blocklists to enhance security policies. 2. **Automated Responses**: - Configure Fabric automation rules to respond to detected threats, such as isolating infected hosts. --- # Security Profiles Security Profiles are critical for protecting your network from various threats. Below is a step-by-step guide for each aspect of Security Profiles. ### **3.1 Web Filtering** Web filtering allows administrators to control access to web content by blocking malicious or inappropriate websites. #### **3.1.1 Configure Category-Based and URL Filtering** 1. **Category-Based Filtering**: - FortiGate uses FortiGuard services to classify websites into categories (e.g., Gambling, Social Media, Malware). - Steps to enable: ```plaintext config webfilter profile edit # e.g., Office_Web_Filter set webfilter-category enable config categories edit # e.g., 52 (Gambling) set action block end end ``` 2. **URL Filtering**: - Block or allow specific URLs or patterns: ```plaintext config webfilter urlfilter edit 1 set url # e.g., www.example.com set type wildcard # Match partial URLs. set action block end ``` #### **3.1.2 Flow-Based vs Proxy-Based Inspection** - **Flow-Based Mode**: - Faster, uses less memory. - Inspects traffic in real-time without buffering. - Best for high-performance networks. - **Proxy-Based Mode**: - Fully buffers web traffic for deep inspection. - Provides advanced features like SSL decryption. - Use when detailed content inspection is required. - Configure inspection mode: ```plaintext config webfilter profile edit set inspection-mode end ``` ### **3.2 Application Control** Application Control identifies and manages applications on the network, even if they use non-standard ports. #### **3.2.1 Use Application Signatures** 1. **Enable Application Control**: - Create a new profile and enable application detection: ```plaintext config application list edit # e.g., App_Control_Profile set application-category enable end ``` 2. **Block or Allow Specific Applications**: - FortiGate uses a signature database to identify applications like Skype or BitTorrent. ```plaintext config application list edit config entries edit 1 set category # e.g., Social.Media set action block end end ``` #### **3.2.2 Granular Policies** - Restrict specific features of an application (e.g., file sharing in Skype): ```plaintext config application custom edit set protocol TCP set port 443 set action deny end ``` ### **3.3 Intrusion Prevention System (IPS)** The IPS module detects and prevents exploitation of vulnerabilities in real-time. #### **3.3.1 Apply Predefined IPS Signatures** 1. **Enable IPS in a Security Profile**: - Apply an existing IPS profile to a firewall policy: ```plaintext config firewall policy edit 1 set ips-sensor # e.g., Default end ``` 2. **Update IPS Database**: - Ensure the IPS signature database is updated regularly: ```plaintext execute update-now ``` #### **3.3.2 Custom IPS Signatures** - Create custom signatures for unique threats: ```plaintext config ips custom edit set signature "alert tcp any any -> any any (msg:'Custom Alert'; content:'malicious_string';)" end ``` ### **3.4 SSL/SSH Inspection** SSL/SSH Inspection decrypts encrypted traffic (SSL/TLS or SSH) for threat inspection. #### **3.4.1 Perform Man-in-the-Middle Decryption** 1. **Enable SSL Inspection**: - Create an SSL/SSH inspection profile: ```plaintext config firewall ssl-ssh-profile edit set ssl-client-inspection enable set ssl-server-inspection enable end ``` 2. **Apply the Profile to a Firewall Policy**: - Attach the inspection profile to the relevant policy: ```plaintext config firewall policy edit 1 set ssl-ssh-profile end ``` #### **3.4.2 Manage Certificates** 1. **Import Certificates**: - Upload trusted CA certificates to FortiGate for HTTPS inspection. 2. **Generate Certificates**: - Use FortiGate as a certificate authority for SSL inspection: ```plaintext config vpn certificate local edit set key-size 2048 set common-name end ``` ### **3.5 Antivirus and Anti-Malware** FortiGate provides robust antivirus and anti-malware capabilities to detect and prevent threats in traffic. #### **3.5.1 Scan Modes** 1. **Proxy-Based Scanning**: - Deeply inspects full files and emails. - Best for comprehensive malware analysis. 2. **Flow-Based Scanning**: - Scans files as they are being downloaded. - Optimized for performance. #### **3.5.2 Integration with FortiSandbox** 1. **Enable FortiSandbox**: - Forward suspicious files to FortiSandbox for deeper inspection: ```plaintext config antivirus profile edit set scan-mode sandbox set inspection-mode proxy end ``` 2. **Monitor FortiSandbox Results**: - View malware analysis reports in the FortiGate GUI or CLI. ### **3.6 Data Leak Prevention (DLP)** DLP identifies and prevents unauthorized transmission of sensitive data. #### **3.6.1 Predefined Patterns** 1. **Enable DLP Profile**: - Apply a DLP profile to firewall policies: ```plaintext config dlp sensor edit set traffic all config filter edit 1 set name "Credit Card Numbers" set action block end end ``` 2. **Customize Patterns**: - Add custom patterns for proprietary data: ```plaintext config dlp sensor edit config filter edit 2 set name "Custom Pattern" set regex "Confidential|Internal Only" set action block end end ``` #### **3.6.2 Set Thresholds and Alerts** 1. **Threshold Configuration**: - Block or log based on predefined thresholds: ```plaintext config dlp sensor edit set threshold 100 # Block after 100 matches end ``` 2. **Enable Alerts**: - Notify administrators of violations: ```plaintext config alertemail setting set server set from set to end ``` --- # Routing Routing is essential for directing traffic between networks. Below is a detailed breakdown of the key concepts and configurations for **Static Routing**, **Dynamic Routing**, **Policy-Based Routing**, and **IPv6 and Multicast Routing**. ### **4.1 Static Routing** Static routing involves manually configuring routes on the FortiGate device, suitable for smaller or less dynamic networks. #### **4.1.1 Configuring Static Routes** 1. **Define Destination Networks, Gateways, and Distances**: - A static route specifies the destination network, the next-hop gateway, and the interface to use. Here’s how to configure it: ```plaintext config router static edit 1 set dst # e.g., 192.168.2.0/24 set gateway # e.g., 192.168.1.1 set device # e.g., port1 end ``` - Example: - Destination Network: 192.168.2.0/24 - Gateway: 192.168.1.1 - Interface: `port1` 2. **Verify the Route**: - Use CLI to check the routing table: ```plaintext get router info routing-table all ``` #### **4.1.2 Prioritize Routes Using Administrative Distance** - Administrative Distance (AD) determines the priority of routes when multiple paths exist to the same destination. - A lower AD value means higher priority: ```plaintext config router static edit 2 set dst set gateway set distance # e.g., 20 (lower than the default 10 for higher priority) end ``` ### **4.2 Dynamic Routing** Dynamic routing protocols automatically update the routing table when network changes occur, suitable for large or complex networks. #### **4.2.1 Configuring OSPF (Open Shortest Path First)** 1. **Enable OSPF on Interfaces**: - OSPF is a link-state routing protocol that calculates the shortest path based on cost. ```plaintext config router ospf config area edit 0.0.0.0 # Backbone area end config network edit 1 set prefix # e.g., 192.168.0.0/16 set area 0.0.0.0 end end ``` 2. **Assign Interface OSPF Parameters**: - Set OSPF parameters like cost and priority: ```plaintext config router ospf config interface edit # e.g., port1 set cost # Lower cost = higher preference set hello-interval # e.g., 10 seconds end end ``` 3. **Verify OSPF Status**: - Check OSPF neighbors: ```plaintext get router info ospf neighbor ``` - View OSPF routes: ```plaintext get router info routing-table ospf ``` #### **4.2.2 Configuring BGP (Border Gateway Protocol)** 1. **Set BGP Parameters**: - BGP is a path-vector protocol used for inter-AS communication. ```plaintext config router bgp set as # Autonomous System Number config neighbor edit set remote-as end end ``` 2. **Advertise Networks**: - Specify which networks to advertise: ```plaintext config router bgp config network edit 1 set prefix # e.g., 10.1.0.0/16 end end ``` 3. **Verify BGP Peers**: - Check the BGP neighbor relationship: ```plaintext get router info bgp neighbors ``` - View BGP routes: ```plaintext get router info routing-table bgp ``` ### **4.3 Policy-Based Routing** Policy-Based Routing (PBR) allows routing decisions based on conditions like source address, service, or application rather than the destination. #### **4.3.1 Direct Traffic Based on Conditions** 1. **Create a Policy Route**: - Define routing conditions: ```plaintext config router policy edit 1 set input-device # e.g., port1 set src # e.g., 192.168.1.0/24 set dst # e.g., 10.0.0.0/8 set gateway # e.g., 192.168.1.254 set output-device # e.g., port2 end ``` 2. **Apply Service-Specific Conditions**: - Route traffic for a specific service (e.g., HTTP): ```plaintext set service # e.g., HTTP ``` #### **4.3.2 Implement Backup Routes** - Use a secondary route with a higher administrative distance: ```plaintext config router static edit 2 set distance 20 # Higher value makes this a backup end ``` ### **4.4 IPv6 and Multicast Routing** #### **4.4.1 IPv6 Readiness** 1. **Enable IPv6**: - Configure IPv6 globally: ```plaintext config system global set ip6-status enable end ``` 2. **Configure Dual-Stack (IPv4/IPv6)**: - Assign both IPv4 and IPv6 addresses to interfaces: ```plaintext config system interface edit set ip6 # e.g., 2001:db8::1/64 end ``` 3. **Add IPv6 Static Routes**: - Define IPv6-specific static routes: ```plaintext config router static6 edit 1 set dst # e.g., 2001:db8:0:1::/64 set gateway # e.g., fe80::1 end ``` #### **4.4.2 Multicast Routing** 1. **Enable Multicast Forwarding**: - Allow multicast traffic on the FortiGate: ```plaintext config system settings set multicast-forward enable end ``` 2. **Configure PIM (Protocol Independent Multicast)**: - Enable PIM on interfaces: ```plaintext config router pim config interface edit set mode sparse-mode end end ``` 3. **Configure IGMP (Internet Group Management Protocol)**: - Manage multicast group memberships: ```plaintext config router igmp edit set version 2 end ``` --- # VPN VPNs (Virtual Private Networks) secure communications over public or private networks, ensuring data confidentiality and integrity. Below is a beginner-friendly, detailed explanation of VPN concepts and configurations. ### **5.1 IPsec VPN** IPsec VPN provides secure, encrypted tunnels for site-to-site or remote access communication. #### **5.1.1 Secure Tunneling for Site-to-Site and Remote Access** 1. **Phase 1 (IKE Negotiation)**: - Establish a secure channel between peers for further negotiations. - Steps to configure: ```plaintext config vpn ipsec phase1-interface edit # e.g., Site1_to_Site2 set interface # e.g., port1 set proposal # e.g., aes256-sha256 set psksecret # e.g., MySecretKey set ike-version <1|2> # IKEv1 or IKEv2 set remote-gw # e.g., 203.0.113.10 set localid # Optional for advanced use set dhgrp # e.g., 14 (2048-bit Diffie-Hellman) end ``` 2. **Phase 2 (IPsec SA Negotiation)**: - Define encryption and authentication settings for data transmission. - Steps to configure: ```plaintext config vpn ipsec phase2-interface edit # e.g., Site1_to_Site2_Phase2 set phase1name # Link to Phase 1 set proposal # e.g., aes256-sha256 set pfs enable set dhgrp # e.g., 14 set src-subnet # e.g., 192.168.1.0/24 set dst-subnet # e.g., 192.168.2.0/24 end ``` 3. **Firewall Policies**: - Allow VPN traffic: ```plaintext config firewall policy edit 1 set srcintf set dstintf set srcaddr # e.g., 192.168.1.0/24 set dstaddr # e.g., 192.168.2.0/24 set action accept set schedule always set service all end ``` #### **5.1.2 Dead Peer Detection (DPD)** DPD ensures the VPN tunnel is re-established automatically if the remote peer becomes unreachable. - Enable DPD in Phase 1: ```plaintext config vpn ipsec phase1-interface edit set dpd enable set dpd-retryinterval # e.g., 10 set dpd-retrycount # e.g., 3 end ``` ### **5.2 SSL VPN** SSL VPN is ideal for remote users who need secure access to resources, offering both lightweight and full-tunnel options. #### **5.2.1 Flexible Remote Access** 1. **Web Mode**: - Web mode provides browser-based access to internal resources such as file servers and applications. - Steps to configure: ```plaintext config vpn ssl settings set servercert # e.g., FortiGate_SSL set tunnel-ip-pools # e.g., SSL_VPN_Pool set source-interface set source-address set default-portal # e.g., Web_Access end ``` 2. **Tunnel Mode**: - Tunnel mode provides full network connectivity through an SSL VPN client. - Steps to configure: ```plaintext config vpn ssl settings set tunnel-ip-pools set source-interface set source-address set default-portal end ``` 3. **Firewall Policies for SSL VPN Traffic**: - Allow traffic between SSL VPN users and internal resources: ```plaintext config firewall policy edit 1 set srcintf ssl.root set dstintf set srcaddr set dstaddr set action accept set schedule always set service all end ``` #### **5.2.2 User Authentication** 1. **Configure Local Users**: - Add SSL VPN users to FortiGate: ```plaintext config user local edit set type password set passwd end ``` 2. **Enable MFA (Multi-Factor Authentication)**: - Use FortiToken or third-party MFA providers: ```plaintext config user local edit set two-factor enable set fortitoken end ``` ### **5.3 Advanced VPN Features** #### **5.3.1 Hub-and-Spoke Architecture** 1. **Centralized Communication**: - Hub-and-spoke VPN connects multiple branch offices via a central hub (HQ). - Configure IPsec tunnels from each branch to the HQ: ```plaintext config vpn ipsec phase1-interface edit set remote-gw end ``` 2. **Routing Traffic Through the Hub**: - Enable forwarding at the hub to allow inter-branch communication. #### **5.3.2 ADVPN (Auto-Discovery VPN)** 1. **Dynamic Tunnel Creation**: - ADVPN dynamically establishes tunnels between branch offices without routing all traffic through the hub. - Enable ADVPN: ```plaintext config vpn ipsec phase1-interface edit set advpn enable end ``` 2. **Configure Spokes**: - Set ADVPN parameters on each branch: ```plaintext config vpn ipsec phase1-interface edit set advpn enable end ``` #### **5.3.3 Split Tunneling** 1. **Optimize Bandwidth**: - Route only critical traffic through the VPN and send non-essential traffic directly to the internet. - Enable split tunneling: ```plaintext config vpn ssl settings set split-tunneling enable set split-tunneling-routing-address end ```

Shopping cart

Subtotal:

Examination Introduction

Learning Method

Study Plan

Skill Practice Questions