Skip to main content
rzahraoui
rzahraoui
New Member
July 28, 2014
Question

Designs Fortigate (FireWall / Proxy)

  • July 28, 2014
  • 17 replies
  • 22714 views
Hi All, My company has purchased FortiGate 100D, with the aim of using them as proxy. Except that I also want to enjoy the Firewalling and IDS roles of that range ==> I want to use as the first level Firewall keeping existing firewalls (ASA). Could you help me by telling me what design/architecture to implement for both cases, knowing that we already have to keep ASA Firewall Case 1: Fortigate as proxy + Firewall ASA. Case 2: Fortigate as Proxy/Firewall/IDS + ASA Firewall (in this case the DMZ already created in the ASA Firewall will be moved to Fortigate) Thanks for all, Rachid

    17 replies

    emnoc
    emnoc
    New Member
    July 28, 2014
    Do you have a business case for keeping the ASA? In your two proposals that could be done, but in reality your making this more complex. But I will give it a stab, what mode where you planning on running the fortigate is ( transparent or routed )? What mode is the ASA in ( we can only assume it' s routed but.....)? how does your inside topology look like? How maybe interfaces in used or vlans ? Do you have vpn terminates webvpn or ipsec ? Once again, why do you need the ASA?
    rzahraoui
    rzahraouiAuthor
    New Member
    July 28, 2014
    Thanks for your reply, as I said, the fortigate are purchased mainly to play the role of proxy, hence the reason to keep the ASA. In fact, we have several sites (and each of them has its own specifity), but basically the fortigate will be used in transparent mode if it plays only the role of proxy and routed mode for both roles (you can of course disagree with me, it is the purpose of my question, the architecture to implement :) ) I confirm that the ASA is in routed mode. LAN is managed by Switch level 3\Backbone, so normally the Inside interfaces Forrtigate and ASA will be connected to the backbone. We have ipsec and webvpn on central sites, this will be keep on ASA.
    emnoc
    emnoc
    New Member
    July 29, 2014
    Okay fair, the only thing I would research and maybe some one can answer here. Can a fortigate operate as explicit proxy in transparent mode? And one last area you should be concern with, do you have any HA requirements at the ASA or FGT?
    rzahraoui
    rzahraouiAuthor
    New Member
    July 30, 2014
    No HA required for the moment.
    Warren_Olson_FTNT
    Staff
    Warren_Olson_FTNT
    Staff
    July 30, 2014
    FortiGate can do explicit proxy in transparent mode, users will need to specify the management address of the unit for their proxy. Reference: http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/web_proxy.199.01.html
    lightmoon1992
    lightmoon1992
    New Member
    July 30, 2014
    FortiGate can be configured as explicit proxy in transparent mode. the proxy IP would be the same as management IP. Mohammad
    rzahraoui
    rzahraouiAuthor
    New Member
    July 31, 2014
    Thanks For your Help; I return to my first question, What is your Architechture proposition to use Both FGT and ASA as Firewalls (FGT 1st level, and ASA 2nd directly connected to Internet) Rachid
    lightmoon1992
    lightmoon1992
    New Member
    July 31, 2014
    Hi Rachid, There are many scenarios you may go with: you may apply your ASA in routing mode, and FortiGate in NAT/Route mode, by which you position the ASA as pure stat full firewall, while maintaining the other security policies on the FortiGate Second scenario would be applying NAT/Route functionality on the ASA it self, and creating new private network in between. same story for the security engines at both scenarios. lets start with your network architecture, current needs, future needs, etc. lets know more about it if possible Mohammad
    rzahraoui
    rzahraouiAuthor
    New Member
    August 1, 2014
    Hi, Actually, in each site, i have an ASA as Firewall, there is no Filter of web trafic (http/https), this function is played by our actual proxies (squid). These Squid are placed on dmz, and we have other dmz (other subnets partitioned behind Firewall/ASA). So, FGT will replace Proxy/Squid with the aim to use some other functions of fortigate (like inspection of trafic...). Is it better to place the FGT in a DMZ too? if we use FGT as Firewall (1st level) Is it better to let the others dmz on ASA or migrate them to FGT? Thanks!
    emnoc
    emnoc
    New Member
    August 1, 2014
    You could do exactly what you want and in " transparent" mode. Do you really need proxy in a dmz and what other UTM features do you need within the DMZ ( i.e webfilter, email AS, AV detection or DLP, etc......) Transparent will provide the simplest and least impact to any network changes. ANd doesn' t require any l3 re-addressing. If you want to run a tier' d stacked firewalls ( ASA exterior and FGT interior ) and protect your internal lan depts, you could also do this. As a matter of fact your could run mixed-match transparent and routed vdoms to do what you want in each vdom. please see sample drawg
    rzahraoui
    rzahraouiAuthor
    New Member
    August 1, 2014
    Thanks! Yes i want use all of these features (email AS, AV detec...)
    lightmoon1992
    lightmoon1992
    New Member
    August 1, 2014
    Old school: it would be better to have two consecutive firewalls with the DMZ setup. Functionality point of view, ASA will do you nothing more than firewalling, which could be handled by the FortiGate itself, so this will save you extra processing layer with all of its time related consumptions. Do you have any published servers so you may need to consider other security layers? Mohammad
    rzahraoui
    rzahraouiAuthor
    New Member
    August 1, 2014
    Yes i have some published servers, majority of them are on DMZ behind ASA.
    Show more replies
    Terms & ConditionsAccessibility statement