Firewall Policies - Needed Services

Question

Hello forum,I would like to know what is the best approach on restricting firewall policies as much as possible.How to plan everything, which services are needed where, how to be sure that I will not left any services, etc.Currently all services are allowed.I will do a network segmentation to create more smaller broadcast domains then to have nearly everything in one VLAN, and while I'm going to do that I want to implement most secured way for firewall policies also.Any advices are welcomed.

mpftnt · Accepted Answer

Default/standard ports are usually used. For instance, RDP uses TCP port 3389.

The sniffer command may be of help. You can play around with the filters.

https://docs.fortinet.com/document/fortiadc/7.0.0/cli-reference/395933/diagnose-sniffer-packet (I can't find the one for FortiGate, but they are the same as per checking)

https://github.com/yuriskinfo/cheat-sheets/blob/master/cheat-sheets/Fortigate-debug-diagnose-complete-cheat-sheet.adoc#packet-sniffer-diagnose-sniffer-packet

mpftnt · Answer

1. When creating a firewall policy, allow only the necessary inbound and outbound traffic. Limit traffic to specific addresses or subnets (principle of least privilege). This is also beneficial to minimize the resource utilization on the FortiGate.

2. Know the service/ports needed. For instance, if the policy is for internet access, you can only allow DNS, HTTP, and HTTPS (FortiGate has a service group named 'Web Access'). For email, you can allow email-related ports (There is a service group named 'Email Access' on Fortigate).

3. Add only the security profiles that you need.

https://docs.fortinet.com/document/fortigate/7.4.0/best-practices/889496/security-profiles

More information from the following links:

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/656084/firewall-policy

Sign up

Login with SSO

Login to the community

Login with SSO