1. Configuring IPsec VPN on the Head Office FortiGate

In a real world scenario, a Remote Office’s ISP or something in their local Internet may be blocking access to Google, or any other site for that matter.

On the Head Office FortiGate, go to VPN > IPSec > Wizard.

Name the VPN, select Site to Site – FortiGate, and click Next.

Set the Remote Gateway to the Remote Office FortiGate IP address

The Wizard should select the correct Outgoing Interface when you click anywhere else in the window. Depending on your configuration, you may have to manually set the outgoing interface.

Select Pre-shared Key for the Authentication Method.

Enter a pre-shared key then click Next.

Under Policy & Routing, set the Local Interface to the interface connected to the Head Office internal network.

For Local Subnets, enter the subnet range of the Head Office internal network. Depending on your configuration, this may be set automatically by the wizard.

For Remote Subnets, enter the subnet range of the Remote Office internal network then click Create.

The VPN Wizard informs you that a static route has been created, as well as two two security policies and two address objects, which are added to two address groups (also created).

Create a security policy to allow the Remote Office to have Internet access. Go to Policy & Objects > Policy > IPv4 and select Create New.

Set Incoming Interface to the VPN interface created by the VPN wizard and set Source Address to the remote office address group created by the VPN wizard.

Set Outgoing Interface to the Internet-facing interface and set Destination Address to all.

Enable NAT and (optionally) enforce any company security profiles.

2. Adding a route on the Remote Office FortiGate

On the Remote Office FortiGate, create a static route that forwards traffic destined for the Head Office FortiGate to the ISP’s Internet gateway.

(In this example, the Head Office FortiGate IP address is 172.20.120.154 so the destination IP/Mask is 172.20.120.154/255.255.255.0 and the ISP’s gateway IP address is 10.10.20.100.)

3. Configuring IPsec VPN on the Remote Office FortiGate

On the Remote Office FortiGate, go to VPN > IPSec > Wizard.

Name the VPN, select Site to Site – FortiGate, and click Next.

Set the Remote Gateway to the Head Office FortiGate IP address.

The Wizard should select the correct Outgoing Interface.

Select Pre-shared Key for the Authentication Method and enter the same Pre-shared Key as you entered in Step 1.

Under Policy & Routing, set the Local Interface to the interface connected to the Remote Office internal network.

For Local Subnets, enter the subnet range of the Remote Office internal network.

For Remote Subnets, enter the subnet range of the Head Office internal network then click Create.

The VPN Wizard informs you that a static route has been created, as well as two address groups and two security policies.

Allow Internet traffic from the remote office to enter the VPN tunnel.

On the Remote Office FortiGate, go to Policy & Objects > Policy > IPv4.

Edit the outbound security policy created by the VPN Wizard.

Change the Destination Address to all so that the policy accepts Internet traffic.

4. Establishing the tunnel

On either FortiGate, go to VPN > Monitor > IPsec Monitor.

Right-click the newly created tunnel and select Bring Up.

6. Results

With the tunnel up, you can now visit google.com without being blocked, since the Internet traffic is handled by the Head Office FortiGate and the access restrictions on the remote FortiGate have been bypassed.

1. Enabling web filtering and multiple profiles

Go to System > Config > Features and make sure that Web Filter is turned ON.

Select Show More and enable Multiple Security Profiles.

Apply the changes.

2. Creating a user group and two users

3. Creating a web filter profile and override

Go to Security Profiles > Web Filter and create a new profile (in the example, block-bandwidth-consuming).

Enable FortiGuard Categories, then right-click Bandwidth Consuming and select Block.

Go to Security Profiles > Advanced > Web Profile Overrides and create a new override.

Set Scope Range to User Group, User Group to the web-filter-override group, Original Profile to the block-bandwidth-consuming profile, and New Profile to the default profile.

Set an appropriate Expires time to control how long the override can be used (in the example, 100 hours after the override is created).

4. Adding the new web filter profile to a security policy

Go to Policy & Objects > Policy > IPv4 and edit the policy that allows connections from the internal network to the Internet.

Set Source User(s) to allow both the web-filter-override group and user bwayne.

Under Security Profiles, turn on Web Filter and use the new profile.

5. Results

Browse to blip.tv, a website that is part of the Bandwidth Consuming category.

Authenticate using the bwayne account. The website is blocked.

Go to User & Device > Monitor > Firewall and De-authenticate bwayne.

Browse to blip.tv again, this time authenticating using the ckent account. You can access the website until the override expires.

1. Enabling application control, web filtering, and device identification

2. Configuring application control and web filtering

Go to Security Profiles > Application Control and edit the default policy.

Under Categories, select Game, and set the category to Block. Under Options, enable Deep Inspection of Cloud Applications.

Go to Security Profiles > Web Filter and edit the default profile.

Enable FortiGuard Categories. Expand the General Interest – Personal category and select the sub-category Games. Set this sub-category to Block.

3. Editing your general policy to block gaming

Go to Policy & Objects > Policy > IPv4 and edit the policy that allows connections from the internal network to the Internet.

Set Source Device Type to all devices types that will be allowed on your network. Do not include Gaming Consoles.

Under Security Profiles, enable both Application Control and Web Filter and set both to use to default profiles. Set SSL/SSH Inspection to deep-inspection.

3. Creating a schedule for when gaming is allowed

Go to Policy & Objects > Objects > Schedules and create a new recurring schedule.

Select all Days and set Start Time to Hour 19 (7PM) and Stop Time to Hour 23 (11PM).

4. Creating a policy that allows gaming between 7-11PM

Go to Policy & Objects > Policy > IPv4 and create a new policy that will allow devices on the LAN to have Internet access.

Set Schedule to use the new schedule.

Go to System > Dashboard > Status and enter the following in the CLI console, substituting the ID for the new policy.

This will make sure that if someone is gaming during the allowed time, their session will be blocked after 11PM.

config firewall policy
  edit
    set schedule-timeout enable
  end
end

6. Ordering the policies  

7. Results  

During the time that gaming is blocked, attempt to browse to a gaming website, such as Yahoo Games. The site is blocked.

Attempt to run an online gaming application, such Steam. The application will be unable to connect to the Internet.

To view information about this blocked traffic, go to System > FortiView > Applications.

Attempt to connect to the Internet using a gaming console. The console will be unable to connect to the Internet.

1. Enabling web filtering

2. Blocking the Adult/Mature Content category and enabling Safe Search

Go to Security Profiles > Web Filter and edit the default profile. Enable FortiGuard Categories.

Select the Adult/Mature Content category and set it to Block.

Under Search Engines, select Enable Safe Search and Search Engine Safe Search – Google, Yahoo!, Bing, Yandex.

3. Adding web filtering to your Internet access policy

Go to Policy & Objects > Policy > IPv4 and edit the policy that allows connections from the internal network to the Internet.

Under Security Profiles, enable Web Filter and set it to use the default profile. 

4. Enforcing Google SafeSearch for all traffic

Because Google search often uses the HTTPS protocol, web filtering alone may not be able to block all adult/mature content. There are two methods that can be used to enforce Google SafeSearch for all traffic: using full SSL inspection so that encrypted traffic is fully inspected (which can cause certificate errors), or changing the DNS records to force search traffic to use forcesafesearch.google.com.

Method 1: Using full SSL inspection

Go to Policy & Objects > Policy > IPv4 and edit the policy that allows connections from the internal network to the Internet.

Set SSL/SSH Inspection to use the deep-inspection profile. Using the deep-inspection profile may cause certificate errors. For information about avoiding this, see Preventing certificate warnings.

Method 2: Changing the DNS records for www.google.com

If you wish to force Google SafeSearch for your entire network, you can set the DNS entry for www.google.com (and another other Google search domains, such as www.google.ca) to be a Canonical Name (CNAME) for forcesafesearch.google.com. This will force all search traffic to use forcesafesearch.google.com.

The method for changing the DNS records using your FortiGate varies, depending on whether your FortiGate is the network’s DNS server, or if an external server is used.

FortiGate is the network’s DNS server

config system dns-server
  edit internal
    set mode recursive
  end

Go to System > Network > DNS Servers. The new server is listed under DNS Service on Interface.

Under DNS Database, select Create New.

Set DNS Zone as Google, Domain Name to google.com, and disable Authoritative.

Under DNS Entries, select Create New.

Set Type to Address (A), set Hostname to www, and IP Address to 216.239.38.120 (the IP address of forcesafesearch.google.com).

If required, create additional DNS Database entries for other Google search domains (entry for www.google.ca shown).

A list of Google search domains can be found here.

The network uses an external DNS server

Go to System > Config > Features and select Show More. Make sure that DNS Database is ON. If necessary, Apply your changes.

Go to System > Network > Interfaces and create an interface to be used for the FortiGate DNS service.

Set Type to Loopback Interface and assign an IP/Network Mask (in the example, 10.10.10.10/255.255.255.255).

Under DNS Database, select Create New.

Set DNS Zone as Google, Domain Name to google.com, and disable Authoritative.

Under DNS Entries, select Create New.

Set Type to Address (A), set Hostname to www, and IP Address to 216.239.38.120 (the IP address of forcesafesearch.google.com). 

If required, create additional DNS Database entries for other Google search domains (entry for www.google.ca shown). 

A list of Google search domains can be found here.

Go to System > Dashboard > Status and enter the following command into the CLI Console to create a new virtual IP:

Set src-filter to the IP range of your internal users (in the example, 10.10.80.2-10.10.80.100), extintf to your internal interface, and mappedip to the IP address of the loopback interface.

 config firewall vip
  edit "dns-vip"
    set type load-balance
    set src-filter "10.10.80.2-10.10.80.100"
    set extip 0.0.0.0-239.255.255.255
    set extintf internal
    set portforward enable
    set mappedip "10.10.10.10"
    set protocol udp
    set extport 53
    set mappedport 53
    set arp-reply disable
  end

Go to Policy & Objects > Policy > IPv4 and create a policy to use the virtual IP to intercept DNS queries.

Set the Incoming Interface to your internal interface, the Outgoing Interface to the loopback interface, Destination Address to the virtual IP, and Service to DNS. Make sure NAT is disabled.

Select the Global View of the policy list. Make sure that the new policy is located above the policy that allows connections from the internal network to the Internet.

Results  

If you are using full SSL inspection, go to google.com and attempt to search for adult/mature content. When the results are shown, a message appears stating that SafeSearch is turned on. This cannot be undone.

If you are using Google Chrome for Internet browsing, you may need to disable SPDY protocol in order for SafeSearch to turn on automatically.

1. Enabling the DNS Filter Security Feature

Go to System > Feature Select, and enable DNS Filter under Security Features. Select Apply.

2. Creating the DNS Filter Profile and enabling Botnet C&C database

Go to Security Profiles > DNS Filter, and create a new profile called Botnet&Facebook.

Right-click and block the Social Networking category from the FortiGuard category based filter table.

3. Configuring Static Domain Filter in DNS Filter Profile

Select Create and enter *.facebook.com.

Set Type to Wildcard, and set Action to Block. Make sure Status is enabled. This will block access to Facebook, and all its other affiliated subdomains.

4. Creating a DNS Filtering firewall policy

Go to Policy & Objects > IPv4 Policy, and create a firewall policy that allows Internet access.

Set Incoming Interface to the internal interface and set Outgoing Interface to the external interface.

Set Source to all and set Destination Address to all.

Set Schedule to always, set Services to ALL, and make sure NAT is enabled.

5. Results

To confirm that the DNS Filter Profile has been added, go to Policy & Objects > IPv4 Policy. The policy will now have the DNS filter icon in the Security Profiles column.

To confirm that the known Botnet C&C feature is working correctly, browse to a known Botnet site — the example is nateve.us. Again, the DNS request will be blocked.

Note that the blocked pages may look different on other web browsers.

1. Connecting the FortiSandbox

Connect the FortiSandbox to your FortiGate as shown in the diagram, so that port 1 and port 3 on the FortiSandbox are on different subnets.

FortiSandbox port 3 is used for outgoing communication triggered by the execution of the files under analysis. It is recommended to connect this port to a dedicated interface on your FortiGate (in the example, port 15), to protect the rest of the network from threats currently being investigated by the FortiSandbox.

On the FortiSandbox, go to System > Network > Static Routing and add static routes for both port 1 and port 3. 

The static route for port 3 must have the Destination/IP Mask 0.0.0.0/0.0.0.0, while port 1 is assigned the Destination/IP Mask for traffic in the local network.

Once the FortiSandbox has access to the Internet through port 3, it will begin to activate its VM licenses.

Before continuing with this recipe, wait until a green arrow shows up beside Windows VM in the FortiSandbox’s System Information widget, found at System > Status. This indicates that the VM activation process is complete.

2. Enabling Sandbox Inspection

On the FortiGate, go to System > External Security Devices. Select Enable Sandbox Inspection and select FortiSandbox Appliance.

Set the IP Address (in the example, 172.20.121.128) and enter a Notifier Email, where notifications and reports will be sent.

On the FortiSandbox, go to File-based Detection > File Input > Device. Edit the entry for the FortiGate.

Under Permissions, enable Authorized.

3. Configuring sandboxing in the default AntiVirus profile

Go to Security Profiles > AntiVirus and edit the default profile.

Under Inspection Options, enable both Send Files to FortiSandbox Appliance for Inspection and Use FortiSandbox Database.

If FortiSandbox discovers a threat, it creates a signature for that file that is added to the FortiGate’s AntiVirus signature database.

4. Configuring sandboxing in the default Web Filter profile

Go to Security Profiles > Web Filter and edit the default profile.

Under Static URL Filter, enable Block malicious URLS discovered by FortiSandbox.

If the FortiSandbox discovers a threat, the URL that threat came from will be added to the list of URLs that will be blocked by the FortiGate.

5. Configuring sandboxing in the default FortiClient profile

Go to Security Profiles > FortiClient Profiles and edit the default profile.

Under AntiVirus, enable Realtime Protection, then enable Scan Downloads, followed by Scan with FortiSandbox. Enter the IP of the FortiSandbox.

Decide if you want to wait for FortiSandbox results before sending files to the PC running FortiClient, or if you want downloaded files to be sent at the same time as they are being scanned by FortiSandbox.

Enable Use FortiSandbox signatures to make sure new virus signatures and blocked URLs from the FortiSandbox are added to FortiClient’s databases.

This profile will be pushed to any device running FortiClient that is registered to your FortiGate. These settings can also be configured from within FortiClient’s AntiVirus settings.

6. Applying AntiVirus and Web Filter scanning to network traffic

Go to Policy & Objects > IPv4 Policy and view the policy list. If a policy has AntiVirus and web filtering scanning applied, the profiles will be listed in the Security Profiles column.

If scanning needs to be added to any security policy (excluding the Implicit Deny policy) select the + button in the Security Profiles column for that policy, then select the default AntiVirus Profile, the default Web Filter Profile, the appropriate Proxy Options, and the deep-inspection profile for SSL Inspection Options (to ensure that encrypted traffic is inspected). Then select OK.

7. Results 

You can also view results on the FortiSandbox by going to System > Status and viewing the Scanning Statistics widget.

Open FortiClient using a Windows PC on the internal network. Make sure it is registered to your FortiGate.

Go to AntiVirus > Realtime Protection Enabled and edit the settings. You will see that the Realtime Protection settings match the FortiClient Profile configured on the FortiGate. These settings cannot be changed using FortiClient.

The PC is now quarantined by FortiClient and cannot connect to the Internet or other network devices.

A message appears in FortiClient, telling the user to contact the system administrator.

FortiClient cannot be shutdown on the PC. It can also not be uninstalled or unregistered from the FortiGate.

If the PC had downloaded a suspicious file that the FortiSandbox determined was malicious, quarantine would be applied automatically.

The quarantine can only be released from the FortiClient Monitor on the FortiGate.

1. Enabling Web Filtering

Go to System > Feature Select to enable the Web Filter feature.

2. Editing the default Web Filter profile

Go to Security Profiles > Web Filter and edit the default Web Filter profile.

To block Facebook, go to Static URL filter, select URL Filter, and then click Create.

Set URL to *facebook.com. Set Type to Wildcard, set Action to Block, and set Status to Enable.

3. Creating the Web filtering security policy

Go to Policy & Objects > IPv4 Policy, and click Create New. Give the policy a name that identifies its use.

Set Incoming Interface to the internal network and set Outgoing Interface to the Internet-facing interface.

Enable NAT.

The new policy has to be first on the list in order to be applied to Internet traffic. Confirm this by viewing policies By Sequence.

To move a policy up or down, click and drag the far-left column of the policy.

4. Results

Visit facebook.com

HTTPS is automatically applied to facebook.com, even if it is not entered in the address bar. A FortiGuard Web Page Blocked! message appears.

Visit a subdomain of Facebook, for example, attachments.facebook.com.

A FortiGuard Web Page Blocked! message appears, blocking the subdomain.

1. Enabling endpoint control on the FortiGate

2. Enforcing FortiClient registration on the internal interface

Go to Network > Interfaces and edit the interface used for the internal network.

Under Administrative Access, enable FortiTelemetry.

3. Configuring the FortiClient Profile

Go to Security Profiles > FortiClient Profiles and edit the default profile.

Set Non-compliance action to Auto-update, to make sure any non-compliant endpoints will have their configurations updated to become compliant.

Enable AntiVirus, then enable both Realtime Protection and Up-do-date signatures.

Enable both Web Filter and Application Firewall and select the default filters.

Enable System compliance, then enable Minimum FortiClient version. Set both Windows endpoints and Mac endpoints to FortiClient 5.4.1 (or higher).

4. Setting up a compliant FortiClient device

5. Results

1.  Configuring External to connect to Accounting

In this example, the External FortiGate’s port 10 will connect to the Accounting FortiGate’s wan1.

On the External FortiGate, go to Network > Interfaces and edit port 10.

Set an IP/Network Mask for the interface (in the example, 192.168.10.2).

Configure Administrative Access to allow FortiTelemetry, required for communication between FortiGates in the CSF. Configure other services as required.

Go to Policy & Objects > IPv4 Policy and create a policy for traffic from the Accounting FortiGate to the Internet.

Enable NAT.

2. Configuring the Accounting FortiGate

On the Accounting FortiGate, go to Network > Interfaces and edit wan1.

Set an IP/Network Mask for the interface that is on the same subnet as the External FortiGate’s port 10 (in the example, 192.168.10.10).

Configure Administrative Access to allow FortiTelemetry.

Edit the lan interface.

Set Addressing Mode to Manual and set the IP/Netmask to a private IP address (in the example, 10.10.10.1). Configure Administrative Access to allow FortiTelemetry.

Under Networked Devices, enable Device Detection.

Go to Policy & Objects > IPv4 Policy and create a policy to allow users on the Accounting network to access the Internet.

Because OSPF routing will be used, make sure NAT is not enabled.

3. Installing and configuring the Marketing FortiGate

Connect and configure the Marketing FortiGate using the same method as the Accounting FortiGate. Make sure to include the following:

4. Configuring OSPF routing between the FortiGates 

On the External FortiGate, go to Network > OSPF. Set Router ID to 0.0.0.1 and select Apply.

Expand the Advanced Options and set Default Information to Always, to make sure the default route is broadcast from External to the ISFW FortiGates.

In Networks, select Create New. Set IP/Netmask to 192.168.10.0/255.255.255.0 (the subnet that includes Accounting’s wan1) and Area to 0.0.0.0.

Create a second entry with the IP/Netmask set to 192.168.200.0/255.255.255.0 (the subnet that includes Marketing’s wan1).

On the Accounting FortiGate, configure OSPF routing as shown. The Networks in this configuration are the subnet that includes Accounting’s wan1 and the subnet for the Accounting Network.

In the example, the Marketing FortiGate is a 90D, a model that does not support OSPF configuration using the GUI. To add OSPF routing, use the following CLI command:

config router ospf
  set router-id 0.0.0.3
  config area
    edit 0.0.0.0
    next
  end
  config network
    edit 1
      set prefix 192.168.200.0/255.255.255.0
    next
    edit 2
      set prefix 10.10.200.0/255.255.255.0
    next
  end
end

5. Enabling the Cooperative Security Fabric

On the External FortiGate, go to System > Cooperative Security Fabric. Enable Cooperative Security Fabric (CSF) and set a Group name and Group password.

On the Accounting FortiGate, go to System > Cooperative Security Fabric. Enable Cooperative Security Fabric (CSF) and enter the name and password for the fabric.

Enable Connect to upstream FortiGate and enter the IP address of External port 10.

Configure CSF on the Marketing FortiGate, using the IP address of External port 11.

6. Results

On the External FortiGate, go to FortiView > Physical Topology.

This dashboard shows a visualization of all access layer devices in the Cooperative Security Fabric.

On the External FortiGate, go to FortiView > Logical Topology.

This dashboard displays information about the interface (logical or physical) that each device in the CSF is connected to.

Go to Monitor > Routing Monitor. You will see both ISFW FortiGates listed, using OSPF routing.

7. (Optional) Adding security profiles to the fabric

CSF configurations allow you to distribute security functions to different FortiGates in the security fabric. For example, you may want to implement virus scanning on the External FortiGate but add application control and web filtering to the ISFW FortiGates.

This results in distributed processing between the FortiGates in the CSF; reducing the load on each one. It also allows you to customize the web filtering and application control for the specific needs of the Accounting network as other internal networks may have different application control and web filtering requirements.

This configuration may result in threats getting through the External FortiGate which means you should very closely limit access to the network connections between the FortiGates in the CSF.

On the External FortiGate, go to Policy & Objects > IPv4 Policy and edit the policy allowing traffic from the Accounting FortiGate to the Internet.

Under Security Profiles, enable AntiVirus and select the default profile.

Do the same for the policy allowing traffic from the Marketing FortiGate to the Internet.

On the Accounting FortiGates, go to Policy & Objects > IPv4 Policy and edit the policy allowing traffic from the Accounting Network to the Internet.

Under Security Profiles, enable Web Filter and Application Control. Select the default profiles for both.

Do the same on the Marketing FortiGate.