✅Fortigate Firewall
Lab Tasks:
Lab Task 1: Restrict Internet Access
Objective: Modify the existing firewall policy to allow only HTTP and HTTPS traffic from the LAN to the WAN, enhancing security by limiting unnecessary traffic.
Steps:
Log in to the Fortinet firewall’s web interface.
Go to Policy & Objects > Firewall Policy.
Find the policy named LAN_to_WAN_Access and click Edit.
In the Service field, replace ALL with DNS, HTTP and HTTPS.
Ensure Action is ACCEPT and NAT is enabled.
Click OK to save.
Verification:
From a PC (e.g., PC1), open a browser and visit a website (e.g., www.example.com). It should load.
From the same PC, open a command prompt and type ping 8.8.8.8. The ping should fail, as ICMP is no longer allowed.
You can also check the logs to see the failed ping commands.
How and Why:
How: The firewall policy is updated to filter traffic by service, allowing only HTTP (port 80) and HTTPS (port 443) while blocking others like ICMP (ping).
Why: Restricting traffic to essential services reduces the attack surface, a common security practice in real networks. This task teaches policy specificity, a fundamental firewall skill.
Lab Task 2: Set Up Port Forwarding
Objective: Allow external access to the Remote Desktop Protocol (RDP) service on PC1 (e.g., IP 192.168.1.101) via the WAN IP, simulating remote access.
Steps:
Go to Policy & Objects > Virtual IPs.
Click Create New > Virtual IP.
Configure:
Name: RDP_PC1
Interface: port1 (WAN)
External IP Address/Range: Enter the WAN IP (assume static, e.g., 203.0.113.1)
Mapped IP Address/Range: 192.168.1.101
Port Forwarding: Enable
Protocol: TCP
External Service Port: 3389
Map to Port: 3389
Click OK.
Go to Policy & Objects > Firewall Policy.
Click Create New and configure:
Name: WAN_to_LAN_RDP
Incoming Interface: port1 (WAN)
Outgoing Interface: port2 (LAN)
Source: all
Destination: Select RDP_PC1
Schedule: always
Service: RDP
Action: ACCEPT
NAT: Disable
Log Allowed Traffic: Enable
Click OK.
Verification:
From an external device in EVE-ng (e.g., another VM), use an RDP client to connect to 203.0.113.1:3389. You should access PC1’s desktop.
Check logs in Log & Report > Forward Traffic for RDP connections.
How and Why:
How: A Virtual IP maps the WAN IP’s port 3389 to PC1’s internal IP and port, and a policy allows this traffic without NAT since it’s inbound.
Why: Port forwarding is used in real networks to expose internal services (e.g., RDP for remote work). This task demonstrates NAT control and policy creation for inbound access, critical for service hosting.
Lab Task 3: Implement Web Filtering
Objective: Block social media websites from the LAN to simulate content control policies.
Steps:
Go to Security Profiles > Web Filter.
Click Create New.
Configure:
Name: Block_Social_Media
Categories: Find “Social Media” and set to Block
Click OK.
Go to Policy & Objects > Firewall Policy.
Edit LAN_to_WAN_Access.
Under Security Profiles, select Block_Social_Media in the Web Filter dropdown.
Click OK.
Verification:
From a PC, try accessing www.facebook.com. It should be blocked (e.g., a Fortinet block page appears).
Access www.google.com. It should work normally.
How and Why:
How: A web filter profile blocks the “Social Media” category, applied to the outbound policy.
Why: Web filtering is common in workplaces to boost productivity or security. This task introduces security profiles, a key Fortinet feature, though some advanced options might be limited in the trial.
Lab Task 4: Monitor Traffic Logs
Objective: Analyze firewall logs to verify policy enforcement and understand network activity.
Steps:
Ensure Log Allowed Traffic is enabled on LAN_to_WAN_Access and WAN_to_LAN_RDP.
Go to Log & Report > Forward Traffic.
Use filters (e.g., source IP, service) to view logs.
Generate traffic (e.g., browse from a PC, attempt RDP from outside).
Verification:
See allowed HTTP/HTTPS traffic from LAN IPs (e.g., 192.168.1.100).
Confirm denied traffic (e.g., ICMP pings or social media attempts).
Check RDP logs if tested externally.
How and Why:
How: Logs record allowed and denied traffic based on policy settings, viewable in the GUI.
Why: Logging is vital for auditing, troubleshooting, and security monitoring in real networks. This task builds skills in traffic analysis, essential for network administration.
Lab Task 5: Restrict Access for Specific IPs
Objective: Limit internet access for IPs 192.168.1.150–192.168.1.157 to HTTP and HTTPS, simulating a restricted user group.
Steps:
Go to Policy & Objects > Addresses.
Click Create New > Address.
Configure:
Name: Restricted_IPs
Type: Subnet
IP/Netmask: 192.168.1.3-192.168.1.3
Click OK.
Go to Policy & Objects > Firewall Policy.
Click Create New and configure:
Name: Restricted_Access
Incoming Interface: port2 (LAN)
Outgoing Interface: port1 (WAN)
Source: Restricted_IPs
Destination: all
Schedule: always
Service: HTTP, HTTPS
Action: DENY
NAT: Enable
Move this policy above LAN_to_WAN_Access in the list.
Click OK.
Verification:
Open the PC with the IP like 192.168.1.3, browse the web (doesn't work).
From 192.168.1.2 or other, browse the web (should work).
How and Why:
How: A specific policy for the IP range takes precedence due to top-down matching, overriding the broader policy for those IPs.
Why: IP-based restrictions are used to differentiate access levels (e.g., guests vs. staff). This task shows policy prioritization and address objects, useful for network segmentation without extra interfaces.
Last updated