Configure DMZ

Forum|Forum|14 years ago
March 12, 2012
16 replies
13735 views

I' m looking to configure a DMZ port on my Fortigate, but I' m not exactly sure how to configure it properly. I' ve done some searching online and to my surprise I haven' t found to many articles regarding the topic on Fortigate firewalls. Can somebody point me in the right direction on how to configure a DMZ on the Fortigate 300 & 800. In the Fortigate user guide they talk about creating VDOM' s and assigning the internal LAN to one VDOM, and the DMZ network to another VDOM. Is this the correct way of setting up a DMZ?

Fullmoon

New Member

insights only, for me DMZ is just a naming convention only, you can assigned Internet or Private network on that particular port. Mostly they used DMZ Port/s to separate your common user to your protected server. Lets say for your Internal Net 192.168.0.0/24 and For DMZ port wherein your Server Farm resides you can assigned 10.10.10.0/24 net. Its a matter of firewall policy if you want to allow you 192.168.0.0 net to access 10.10.10.0 net (Server Farm)

ZiPPyAuthor

New Member

Thanks for the quick response Fullmoon. You mind if I ask what your policy looks like?

rwpatterson

New Member

ORIGINAL: ZiPPy Thanks for the quick response Fullmoon. You mind if I ask what your policy looks like?

Only one policy? I wish!

ZiPPyAuthor

New Member

Oh dear. Got any examples? It looks like I' ll have to use a Virtual IP in the setup. Not sure. This is my first DMZ setup.

ZiPPyAuthor

New Member

I didn' t find much help regarding the setup of a DMZ in the administration guide.

rwpatterson

New Member

The basic premise of a DMZ is that any traffic flows into those servers, and if any are compromised, they cannot get out to inflict more damage elsewhere. Place a server in there, and make sure there are minimal policies allowing traffic out from there, especially back to your work stations. None of my DMZ servers can get back to my LAN. Also minimal policies from those to the Internet. If one of those servers needs more, I open the path, do the work and close it back up tight. My two cents

ZiPPyAuthor

New Member

Thanks for the explanation rwpatterson, it definitely helps in the grand scheme of things. I' m still a little confused on how to setup the rules. Here is what I' ve got so far: Create a VIP with an ext. address mapped to my int new subnet for the DMZ. WAN1 to DMZ where my destination is pointing to a VIP I created. I think this is what still is needed: DMZ to WAN1 - to limit what goes out from the DMZ DMZ to LAN - what can get over to the LAN, but still communicate for services needed. Is that correct?

ede_pfau

SuperUser

I totally agree with Bob, " consider your DMZ server hacked" should be the way to think. You wouldn' t really want to have firewall policies allowing ANY traffic from the DMZ to your LAN in this event, would you? So, WAN users can open a session on your DMZ located server through the VIP. The return traffic will automatically have the private server' s IP address translated to the VIP. Ideally, the VIP will only translate traffic on specific ports (e.g. HTTP only). The policy DMZ->WAN is (in my setups) only needed for - NTP - OS updates = HTTP to specific destinations And there will never be a policy DMZ->LAN...if you need to pull data from the LAN, then you can always push them as well onto the server, and send a signal for it to pick it up (that was the case with DNS updates).

ZiPPyAuthor

New Member

Could you possibly show an example of your policy and VIP please?

ede_pfau

SuperUser

There' s nothing special here: just a VIP declared on the external interface, and policies WAN -> DMZ DMZ -> WAN and internal -> DMZ

 VIP  config firewall vip      edit " VIP_DMZ_dns"           set extip 11.22.33.44          set extintf " port2"           set mappedip 192.168.7.84      next  end      -------------  config firewall policy:    WAN->DMZ  -------------      edit 56          set srcintf " port2"           set dstintf " port5"           set srcaddr " all"                        set dstaddr " VIP_DMZ_dns"           set action accept          set schedule " always"           set service " DNS"                        set logtraffic enable      next      edit 215          set srcintf " port2"           set dstintf " port5"           set srcaddr " ITcompany"                        set dstaddr " DMZ_LAN"                        set action accept          set status disable   # activate ONLY if necessary!          set schedule " always"           set service " sshservices"                        set logtraffic enable          set comments " 4 maintenance from ext service"       next      DMZ -> WAN  -------------      edit 87          set srcintf " port5"           set dstintf " port2"           set srcaddr " DMZ_LAN"                        set dstaddr " EXT_ntpservers"                        set action accept          set schedule " always"           set service " NTP"                        set logtraffic enable          set comments " external NTP servers"           set nat enable     # necessary      next    internal->DMZ  -------------      edit 96          set srcintf " port1"           set dstintf " port5"           set srcaddr " nameservers"                        set dstaddr " DMZ_nameservers"           set action accept          set schedule " always"           set service " DNS"  " sshservices"                        set logtraffic enable          set comments " 4 dns sync"       next

ZiPPyAuthor

New Member

That helps so much! So much!! My only question is for: edit 215 set srcintf " port2" set dstintf " port5" set srcaddr " ITcompany" set dstaddr " DMZ_LAN" What source address is defined in ITcompany? I believe that would be your ext IP address right?

ede_pfau

SuperUser

no, not quite, it' s the external IP of an IT service company which maintains the DMZ servers. I do firewalls, they do servers :)