New Member

Question

Help adding IP addresses to whitelist of Fortigate 200D and Fortigate 60D

Forum|Forum|8 years ago
August 11, 2017
16 replies
142987 views

I work at a small non profit in New York City. Our network administrator was in a bad accident. I have been asked to help out until a replacement can be found. I have no experience with firewall administration. I need to add IP addresses to the whitelist of a Fortigate 200D and a Fortigate 60D. Where on the interface do I add these IP addresses.

Thank you very much.

EMES

New Member

There is no interface whitelist, It can be in security policy or your web filtering profiles. Are you trying to allow an internal IP bypass the filtering on the firewall?

MikePruett

New Member

Going to need more information.

- Does the Gate already exist in the environment?

- Are you trying to allow traffic outbound?

- Are you trying to allow traffic inbound?

- What services or type of traffic are you wanting to allow?

rwpatterson

New Member

Take a backup of the configuration without encryption. In a text editor, look for an entry that you know is already whitelisted. In that section, the top will start with "config...." Get us that section (command), then we will be able to tell you more (if you cannot figure it out from there).

amanjotsingh_FTNT

Staff

Please follow the following Steps

1) you need to Create address for the IP address you wanted to Whitelisted , To do that please do the following

a) First go to policy & object

b) Click on addresses

c) Click Create new -> Address

d) Name the address like " google "

e) Under Subnet/ Ip range put the Ip address which you want to Whitelist

f) Save it

You can create group of address as well but first you need to create all the address you wanted to whitelist

Then follow all the steps till (b) and click group instead address

Add all the address you created for white list to that group

2) Secondly, Under Policy & Object

a) Right click on the first policy you see

b) Click on insert -> Above ( This will insert the new policy on top )

c) Click on the New policy and edit it.

d) Click on Incoming interface from where the traffic is coming ( In case if the traffic is going out it can be LAN or any internal port)

e) Click on outgoing interface ( It can be WAN interface )

d) Click on source ( you can put all if you are allowing Everyone)

e) Click on destination ( Use the address you created for whitelist or the whole group of address you created above)

Thanks

Amanjot Singh ( TAC )

erika3

Visitor III

Hi amanjot, do you have a reference for this?

acenycAuthor

New Member

Yes, if I understand this correctly, I have to allow two incoming IP addresses and one outgoing IP address. I see the list in web filtering. I have the manual and I will watch some videos. Thank You for your assistance.

acenycAuthor

New Member

Thank you for your assistance. As I said before, I'm just filling in until my organization hires someone that is qualified to administer this system. I have to allow two inbound IP addresses and allow one outbound IP address. I have included a screen shot of the web filter list of the 200D unit. What is it that determines if the IP address is inbound or outbound?

Thank you.

Fortinet web filter.jpg

acenycAuthor

New Member

Thank you, Amanjot Singh. I will follow these instructions when I get to work on Tuesday. I still don't understand how to determine if an IP address is inbound, or outbound.

acenycAuthor

New Member

Thank you Amanjot. I went through the all the steps in your post and I was able to find all the GUI interfaces you described. From here I'm just going to read the user guides and watch as many videos as I can to figure out how to use this firewall.

I have one question. I spoke with another network administrator I know that has some experience with this device, and he told me that to add IP addresses to the whitelist I need to go into:

1.security policies

2.Webfilter

Then add the url from that interface.

Which is the correct method? What are the differences between your way and his way?

I have included a screen shot of the webfilter interface that is already configured on my 200D.

Thank you.

Fortinet web filter.jpg

rwpatterson

New Member

If your goal is to pass traffic through the firewall on certain ports to/from certain entities then you need to create policies as described above. If you wish to filter by application, or A/V or otherwise then follow the other admin's advice. That though is done after the initial policy is created. It is an enhancement to the general policy allowing traffic to flow.

acenycAuthor

New Member

I have one more issue. I am having trouble finding the admin guide for the Fortigate 200D and the Fortigate 60D on the Fortinet document library. Are the admin guides listed by model number or version number? I do have the quick start guide. Can someone give me the link to these manuals.

Thank You very much.

rwpatterson

New Member

Aside from a few features that larger models have that smaller ones don't and port numbering/naming, the way to go is with the version guide.

sylwok

New Member

Configuration Scripts

WEBGUI 
system (config) - advanced - Configuration Scripts (script)

you prepare file.txt    -  my example

-------------------------------
config firewall address
edit black_ip_1115
set type ipmask
set subnet 191.96.249.136  255.255.255.255
next 
edit black_ip_1116
set type ipmask
set subnet 196.52.43.57  255.255.255.255
next 
edit black_ip_1117
set type ipmask
set subnet 206.72.196.175  255.255.255.255
next 
end 
config firewall addrgrp
edit black_ip_grp_1
set member black_ip_1115 black_ip_1116 black_ip_1117
end 

--------------
remember, the group has a maximum of 300


SK

Sign up

Login with SSO

Login to the community

Login with SSO