Skip to main content
pccstech
pccstech
New Member
May 5, 2023
Question

Create a DMZ for a set of VMs?

  • May 5, 2023
  • 2 replies
  • 3709 views

Hello 

 

I have several VMs I'd like to protect with a DMZ. They need to be accessible from the Internet and internally. I'm looking for assistance in finding some "howto" docs or general guidance in creating the DMZ.

 

We have a Fortigate appliance with two connections to it. One internet facing the other is internal.

 

Our VMs are of the form 10.10.10.x. We currently have a few Virtual IPs and polices allowing internet traffic to these VMs. I am able to understand the "cookbooks" for wired connection to protect physical servers but I'm lost as where to start to protect a VM.  Thx in advance for any guidance you can provide

 

2 replies

abarushka
Staff
abarushka
Staff
May 5, 2023

Hello,

 

I can not think about the differences between protecting physical servers and VMs. Firewall is treating the same way traffic from/to physical servers and VMs.

pccstech
pccstechAuthor
New Member
May 5, 2023

The traffic filtering being the same I get.  To start building the DMZ I think I need to create a new interface?  What kind?  

pccstech
pccstechAuthor
New Member
May 5, 2023

We are on version 7.0.11

abarushka
Staff
abarushka
Staff
May 5, 2023

Hello,

 

You may consider to set DMZ role for the interface:

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Behaviour-on-the-GUI-of-the-Interface-Role/ta-p/194844

 

Here is a sample topology:

https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/361386

pccstech
pccstechAuthor
New Member
May 5, 2023

Thx for the replies.    The topology example looks to be for a physical server connecting to an open port. 

 

Q: Is creating a new interface the correct first step in creating the DMZ? IF so what type should it be?   My Choices are:

802.3ad Aggregate

EMAC VLAN

Loopback

Redundant

Software Switch

SSL-VPS Tunnel

VLAN

 

Also which interface member should I choose? External or Internal?

 

abarushka
Staff
abarushka
Staff
May 8, 2023

Hello,

 

Interface type selection rather depends on the network topology and requirements (speed, redundancy, etc.) than security. I can not see significant difference between interfaces in terms of security.

Terms & ConditionsAccessibility statement