PSM
FORTIGATE TRAINING
Contents
Intro and Initial Config
Firewall Policies
NAT
Firewall Authentication
logging & Monitoring
Certificate Operations
Security Profiles
Security Fabric
Network
VDOM
SSO
ZTNA
VPN
High Availability
Diagnostics
Agenda
Logging and Monitoring
Certificate Operations
Web filtering
Application Control
Introduction and Initial
Configurations
Firewall Policies
NAT
Firewall Authentication
Day
05
IPSec VPN
SSL VPN
High Availability
Diagnostics
Day
03
Day
04
Day
01
Day
02
Anti-virus
Intrusion Prevention
and Denial of Service
Security Fabrics
Routing
Virtual Domains
Fortinet Single Sign-On
ZTNA
DAY-01
Introduction
Traditional Firewall Vs NGFW
Traditional Firewall
Next-Generation Firewall
A traditional firewall typically
provides stateful inspection
of incoming and outgoing
network traffic.
A next-generation firewall
includes additional features
like
⮚application awareness and
control,
⮚integrated intrusion
prevention, and
⮚cloud-delivered threat
intelligence.
Stateful Inspection
UTM
What is FortiGate
FortiGate is a Next Generation Firewall(NGFW)
Provides a single platform for high performance end-to end
network security
Optimized for internal segmentation, cloud, data center,
perimeter, distributed and small business deployments
FortiGate Operational Modes
•
FGT operates in one of the two modes:
 Transparent
 NAT/Router
•
In Transparent mode, the FortiGate is installed between the internal network and the router. In this mode,
the FortiGate does not make any changes to IP addresses and only applies security scanning to traffic.
•
When FortiGate operates in NAT mode, FortiGate behaves as an IP router.
•
An IP router is a device that forwards packets between IP networks. For that, a router performs IP routing,
which is the process of determining the next hop to forward a packet to based on the packet destination IP
address.
Initial Configuration
Deployment
•
Registering the FortiGate-VM
•
Downloading the FortiGate-VM deployment package
•
Deploy an OVF or OVA Template
Initial Settings
•
Configure port 1
•
Configure Gateway
•
Configure DNS
FIREWALL POLICIES
Firewall Policies
•
Policies define
 Which traffic matches them
 How to process matching traffic
•
When a new IP session packet arrives, FGT
 Starts at the top of the list to look for a policy match
 Applies the first matching policy
How Firewall Policy Operates
FortiGate looks for the matching firewall policy from top to bottom.
If a match is found, the traffic is processed based on the firewall
policy.
If no match is found, the traffic is dropped by the default Implicit
Deny firewall policy.
Firewall Policies
Firewall Policies
When a packet arrives, how does FortiGate find a matching policy?
•
Each policy has match criteria, which you can define using the following objects:
 Incoming Interface
 Outgoing Interface
 Source
 Destination
 Service
 Schedule
•
•
In each policy, you must set a source and
destination interface even if one or both are set to any.
•
•
Both interfaces must match the policy’s interface
criteria in order to be a successful match.
Firewall Policies
What happen when traffic matches firewall policy?
If traffic matches the firewall policy , FortiGate applies the action
configured in firewall policy
•
If action is set to deny, FortiGate drops the session.
•
If action is set to accept, FortiGate allow the session and apply other
configured settings for packet processing such as user authentication,
Anti-virus scanning and web filtering etc.
NATTING
NAT
•
Changes the IP layer address of a packet
⮚ SNAT
⮚ DNAT
•
For outgoing connections: The NAT option in a central SNAT,
IP pool, and central SNAT table are used, which is known as
source NAT.
• For incoming connections: Virtual IPs (VIPs) and DNAT are
used, which are known as destination NAT.
SNAT
There two ways to configure firewall policy SNAT:
Use the outgoing interface address
Use the dynamic IP pool
Firewall Policy SNAT Using the Outgoing Interface
IP Pool
•
SNAT Objects
•
An IP pool defines a single IP address or a
range of IP addresses to be used as the
source address for the duration of the session.
•
These assigned addresses are used instead of
the IP address assigned to that FortiGate
interface.
Types of IP Pools
There are four types of IP pools that you can configure on the FortiGate firewall:
Overload
If you use an IP pool, the source address is translated to an address
from that pool, rather than the egress interface address
One-to-One
In the one-to-one pool type, an internal IP address is mapped with an
external address on a first-come, first-served basis.
Fixed Port
Range
For the fixed port range type of IP pool, you can define both the
internal IP range and external IP range.
Port Block
Allocation
Assigns a block size and number per host for a range of external IP
addresses
DNAT
For incoming connections, virtual IPs (VIPs) and DNAT are used, which are known as destination NAT.
VIP
•
DNAT Objects
•
For sessions matching a VIP, the destination address is translated; usually a public internet address
is translated to the private network address of a server.
 VIPs are selected in the firewall policy’s Destination field.
⮚ Default VIP type: Static NAT
•
This is a one-to-one mapping, which applies to incoming and outgoing connections.
VIP Example
Firewall Authentication
Firewall Authentication Methods
• Active Authentication Methods
 User receives a login prompt
 Must manually enter credentials to authenticate
• Passive authentication Methods
 User does not receive a login prompt from FortiGate
 Credentials are determined automatically
 Applies the first matching policy
Firewall Authentication Methods
1. Local Password Authentication
 Username and password stored on FortiGate
 Works well for single FortiGate installations
Firewall Authentication Methods
2. Server-Based Password Authentication
⮚ Password stored on remote authentication server
like RADIUS
⮚ Suitable when multiple FortiGate devices need to
authenticate the same users or user group.
Firewall Authentication Methods
3. Two-Factor Authentication
⮚ Enabled on top of an existing method
⮚ Require something you know and something you have.
⮚ Available on both user and administrator accounts
Authentication Using Firewall Policies
How FortiGate authenticate user using Firewall policies?
•
Firewall policies also includes instructions that deals with
authentication.
•
Can use Source and Service of firewall policy for this
purpose.
DAY-02
LOGGING & MONITORING
Log Settings
Forward Traffic
Events
Certificate Operations
Certificate Operations
Why Does FortiGate Use Digital Certificates?
Inspection
Privacy
Authentication
Certificate Operations
How FortiGate uses certificates to authenticate users and devices?
•
Subject and Subject Alternative Name fields in the
certificate identify the devices or person associated with
certificate
Certificate-Based User Authentication
•
Each FortiGate does the following check against
certificate before trusting it and using it:
⮚ Revocation Check
⮚ CA certificate possession
⮚ Validity dates
⮚ Digital signature validation
Security Profiles
Security Profiles
Web
Filtering
Application
Control
Anti-Virus
IPS
Web Filtering
Inspection Modes
•
Flow-based
⮚ Default Inspection Mode is flow (in policy)
⮚ Only supports flow-based security profiles
•
Proxy-based
⮚ Allow both inspection modes in security profiles
⮚ Covers more protocols than flow-based
Flow-based
•
Default Mode
•
Faster Scanning
•
Uses DFA to match possible threats
•
Takes fewer processing resources
Proxy-based
•
More Thorough Inspection
•
Adds Latency
•
Two TCP connections
⮚ From Client to FGT acting as proxy server
⮚ From FGT to server
•
Provides a higher level of threat protection
Configure Inspection Mode in FGT
NGFW Mode
•
Profile based
⮚ Requires application control and web filtering profile
⮚ Apply the profiles to the policy
⮚ Applicable to proxy-based and flow-based inspection modes
•
Policy based
⮚ Application Control and Web Filtering applied direct to the policy
⮚ Doesn’t require Application Control and Web Filtering profiles
⮚ Applicable only to flow-based inspection mode
Web Filtering
Application Control
Detects and acts on Network Application traffic
How does it work?
•
Uses the IPS engine
•
Uses flow-based scan (not proxy-based)
•
Compresses traffic to known application patterns
⮚ Only reports packets that match that match an enabled pattern
⮚ Can detect even if users try to circumvent through an external proxy
Application Control Signatures
•
Requires a FortiGuard subscription
•
The application control database is separate from IPS database
•
Application control uses the IPS engine, which uses flow-based inspection, so the inspection is
always flow-based
•
Must be applied to a Firewall Policy
Application Control
DAY-03
Antivirus
•
An antivirus is a database of virus signatures that is used to identify infections.
•
During an antivirus scan, in order to be detected as a virus, the virus must match a defined pattern
called a signature.
Techniques
FortiGate uses many techniques to detect viruses:
Antivirus Scan
Grayware Scan
Machine Learning (AI)
Scan
This is the first, fastest, simplest way to detect malware. It
detects viruses that are an exact match for a signature in the
antivirus database.
This scan detects unsolicited programs, known as grayware,
that have been installed without the user’s knowledge or
consent.
These scans are based on probability, so they increase the
possibility of false positives, but they also detect zero-day
attacks.
Antivirus Signature Database
•
Fortigate requires a subscription to FortiGuard AntiVirus
AntiVirus DBs:
•
Extended
⮚ Available on all models
⮚ The default AV database setting
•
Extreme
⮚ Available only on selected FGT models.
Antivirus
Inspection Modes
Flow-based
Proxy-based
❑ Uses extended AV database
❑ Used extended or extreme AV
by default
database
❑ Optimized performance
❑ Buffers the whole file
compared to Proxy-based
❑ More thorough and easy to
❑ FGT buffers the whole file but
configure
transmits to the client
❑ Provides granularity above
simultaneously
performance
Flow-Based Inspection Mode Packet Flow
Proxy Inspection Mode Packet Flow
Intrusion Prevention System (IPS)
An intrusion prevention system (IPS) monitors a network for malicious activity and takes action to
prevent it, including reporting, blocking, or dropping it, when it does occur.
Increased volume and sophistication of attacks on
organizations
Why use IPS?
More attacks against clients and cloud applications
BYOD & Remote Workers increase risk of exposure
IPS
Flow-based detection and blocking
• Known exploits that match signatures
• Network errors and protocol anomalies
IPS Components
• IPS Signature DBs
• Protocol Decoders
• IPS Engine
– Application Control
– AntiVirus
– Web Filter
– Email Filter
– Data Leak Prevention
IPS
Full SSL Inspection
•
Enable a Full SSL Inspection Profile to ensure you are inspecting encrypted traffic
•
Most Fortigate features won’t work without SSL Inspection.
Security Fabric
What is Security Fabric
It is a Fortinet enterprise solution that enables a holistic approach to network
security
The network landscape is visible through a single console
All network devices are integrated into a centrally managed and automated
defense
Attributes
The Security Fabric has the following attributes:
⮚Broad: It provides visibility of the entire digital attack surface to better manage risk
⮚Integrated: It provides a solution that reduces the complexity of supporting multiple point products
⮚Automated: Threat intelligence is exchanged between network components in real-time allowing for
automated response to threats
Security Fabric
Physical Topology
Security Rating
External Connectors
External Connectors
DAY-04
NETWORK
SD-WAN
• SD-WAN is a software-defined wide-area network architecture.
•
SD-WAN solutions transform an organization's capabilities by leveraging the corporate WAN as well as
multi-cloud connectivity to deliver high-speed application performance at the WAN Edge of branch sites.
SD-WAN Solution
Policy Route
•
Provides more granular matching than static routes
⮚ Protocol
⮚ Source Address
⮚ Source Ports
⮚ Destination Ports
⮚ Destination Internet Service
•
Have precedence over routing table entries
•
Separate policy route table
•
Narrow down matching criteria
Dynamic Route
•
Routes are automatically learned
•
FGT exchanges routes with trusted adjacent routers
•
No need to configure manual routes
•
FortiGate supports several dynamic routing protocols:
⮚ RIP,
⮚ OSPF,
⮚ BGP, and
⮚ IS-IS.
VIRTUAL DOMAIN
VDOM
VDOM
A VDOM splits FortiGate into multiple logical devices and
divides one security domain into multiple security domains
Each VDOM has independent security policies and routing
tables
By default, traffic from one VDOM cannot go to a different
VDOM.
Fortinet Single Sign-On
FSSO Function & Deployment
•
SSO is a process that allows identified users access to multiple applications without having to reauthenticate.
•
Users who are already identified can access applications without being prompted to provide
credentials.
FSSO Deployment & Config
FSSO is typically used with directory services, such as Windows Active Directory.
•
Domain Controller agent mode
•
Polling mode:
 Collector agent-based
 Agentless
•
Terminal Server Agent
FSSO with Windows AD
•
DC Agent Mode is the recommended mode for FSSO
•
DC Agent requires:
 DC agent
 Collector agent
DC Agent Mode Process
Collector Agent-Based Polling Mode Process
Agentless Polling Mode Process
ZTNA
What is ZTNA
Zero Trust Network Access is access control method that
provides role-based application access
ZTNA uses client device identification, authentication and zerotrust tags
ZTNA has two modes : ZTNA access proxy and IP/MAC-based
access control
ZTNA Workflow
DAY-05
VPN
VPN Types
VPN
IPSEC
Remote
Access
Site-to-Site
SSL
IPsec Tunnel
Joins remote hosts and networks together into one private network
Authentication
Provides
Date Integrity
Data
Confidentiality
IPSec Protocol
IPsec is a suite of separate protocols, which includes:
Internet Key Exchange
(IKE)
Used to authenticate peers, exchange keys, and negotiate the
encryption and checksums that will be used—essentially, it is the
control channel
AH
Contains the authentication header—the checksums that verify
the integrity of the data
Encapsulating Security
Payload (ESP)
The encapsulated security payload—the encrypted payload,
which is essentially the data channel
Phase 1
•
Phase 1 takes place when each peer of the tunnel—the initiator and the responder—connects and
begins to set up the VPN.
•
The initiator is the peer that starts the phase 1 negotiation, while the responder is the peer that
responds to the initiator request.
Phase 1 components
1.
Authentication Peers
⮚ PSK or Digital Signature
⮚ XAuth
2. Negotiate one bidirectional SA (a.k.a IKE SA)
In IKE v1
⮚ Main Mode
⮚ Aggressive Mode
3.
DH exchange for secret keys
Phase 1 Network Configurations
PHASE-2
After phase-1 has established a secure channel to exchange
data, phase-2 begins
1. Negotiates two unidirectional IPSec SAs for ESP
⮚ Protected by phase 1 IKE SA
2. When IPsec SAs are about to expire, it renegotiates
3. Each phase 1 can have multiple phase-2s
SSL VPN
To configure SSL VPN:
1. Configure user accounts and groups.
2. Configure the SSL VPN portal.
3. Configure SSL VPN settings.
4. Create a firewall policy to accept and decrypt packets. This policy is also used to provide access to
internal networks.
5. Optionally, configure a firewall policy to allow traffic from the SSL VPN client to the internet and apply
security profiles. User traffic will go to the internet through FortiGate, where it can be monitored or client
access to the internet can be restricted.
SSL VPN
HIGH AVAILABILITY
High Availability
•
HA is the ability of a system to operate continuously without failing for a designated period of time.
•
HA links and synchronizes two to four FortiGate devices to form a cluster for redundancy and
performance purposes.
•
A cluster includes one device that acts as the primary FortiGate.
•
The primary synchronizes its configuration, session information, FIB entries, FortiGuard definitions,
and other operation-related information to the secondary devices, which are also known as standby
devices.
HA Operation Modes
Two HA operation modes available:
•
•
Active-passive (A-P): In the cluster, the primary FortiGate is the only FortiGate that actively
processes traffic. Secondary FortiGate devices remain in passive mode, monitoring the status of the
primary device.
Active-active (A-A): All cluster members can process traffic. The primary FortiGate can distribute
sessions to the secondary devices.
FortiGate Cluster
Diagnostics
Before a problem occurs
Know what normal is (baseline):
•
CPU Usage
•
Memory Usage
•
Traffic Volume
•
Traffic directions
•
Protocols & Port numbers
•
Traffic pattern and distribution
Network Diagrams
For troubleshooting, a network diagram is essential.
Types of Network Diagrams:
•
Physical
•
Logical
CLI commands for diagnosis
•
get system status
•
get hardware nic
•
get system arp
•
execute ping-options
•
execute ping
•
execute traceroute <dest> IP address or hostname
Debug Flow
Shows what the CPU is doing, step by step, with the packets.
To use debug flow:
1.
Define a filter: diagnose debug flow filter
2.
Enable debug output: diagnose debug enable
3.
Start the trace: diagnose debug flow trace start <xxxx> Repeat number
4.
Stop the trace when it is finished: diagnose debug flow trace stop
CPU & Memory Diagnosis
diagnose sys top
Memory Conserve Mode
If memory usage becomes too high, Fortigate may enter conserve mode
Config system global
set memory-use-threshold-red <percentage>
set memory-use-threshold-extreme <percentage>
set memory-use-threshold-green <percentage>
end
References
https://training.fortinet.com/course/view.php?id=24746
https://training.fortinet.com/course/view.php?id=24747
Thank You