Skip to main content
Spock
Spock
New Member
July 21, 2017
Question

New FortiWiFi 60D setup best practices for multi-zone security monitored home network?

  • July 21, 2017
  • 4 replies
  • 9490 views

I am new to Fortinet, but eager to learn how to deploy my new FortiWiFi 60D in my home lab network.

Goals:

1. Setup different security zones, using VLANs I think, that segregate high risk guest traffic, medium risk production traffic,  and highly secure financial & network admin vlan subnets from each other.

2. Setup a highly secure network admin workstation that can log, monitor & analyze any traffic that appears suspicious, as well as monitor & control traffic QoS and bandwidth utilization.

3. Use security policies to restrict guest wifi access and blacklist inappropriate websites, content or mobile devices that launch detected malware-based network attacks.

4. Use network security best practices at all times to create a stable, secure SOHO network that will support both my creative production work AND my interest in learning more network administration & security theory & practice.

 

My FortiWiFi 60D came with firmware version 5.2.3, build 670.

 

My questions for more experienced users are:

1. Should I upgrade my firmware, and if yes, at what version/build number should I stop in order to get a stable platform that will support my above goals?

2. Is there any good cookbook info online for setting up a network admin workstation that is optimized for real time network monitoring & administration?

 

Thanks in advance for any help offered. Appreciate you taking the time to help someone who is just coming online.

 

Live long & prosper!

4 replies

dbadams
dbadams
New Member
August 8, 2017

Greetings Spock! 

 

Reading over your post, I think you should consider using Virtual Domains or VDOMS. This feature allows you to break up your FortiWifi into multiple virtual devices which goes beyond just using VLANS. This way you can have one VDOM as your stable home network, one for experimenting with, another for your more secure financial network and another for guest. You can even have your VDOMS in different operating modes such as transparent.

 

Just a word of warning though, if I remember right, VDOMS do have to be enabled through the CLI first before they will appear in the GUI. So if you don't see the feature, don't worry, its there! 

 

As for the version, I would definitely upgrade to at least 5.4. They cleaned up the GUI and added many new features compared to 5.2. 

 

Lastly, there are plenty of good videos and cookbooks at support.fortinet.com for you to review. I personally live by my copy of the FortiOS handbook which explains a lot of these features in depth along with an entire chapter dedicated to best practices.

 

Good luck Spock and drop a quick reply sometime to report your progress.

Devin

 

(You cant see it, but I am making the Vulcan "V" hand gesture as I hit the submit button!)  

Spock
SpockAuthor
New Member
August 9, 2017

Greetings Earthling Devin! Thanks for your reply & suggestions.

 

What I'm worried about with VDOMs is I am wondering if they use more system resources than VLANs?

 

I'll want to do some fancy, in-depth network monitoring pretty continuously, including some packet captures & traffic analysis, so I think I'll need to consider the processing limitations of a FortiWiFi 60D platform if I want to maintain throughput performance & QoS.

 

Do you know if VDOMs impose a greater resource utilization than VLANs, and if so, by how much? (if it's not much, then the multiple operating modes scenario could be very useful to me in my network security learning experiments.)

 

P.S. The Federation is watching developments on your planet with increasing alarm. I noticed the other day that the warning beacons at the edge of your solar system have been updated to OffCon 5 - an offensive classification usually reserved for Romulan Space and two steps worse than those pesky Ferengi. Hope you personally have not been adversely affected by recent developments as yet.

 

Spock out...

 

 

 

 

 

 

dbadams
dbadams
New Member
August 10, 2017

Good Morning Spock, 

 

The one of the best part about VDOMs is it's resource allocation. Once enabled, you'll have an additional option in the GUI that allows you to not only monitor the resources that are being consumed by each VDOM, but to also assign resources to each VDOM from a global pool. This way a single VDOM cannot "starve" out the other VDOMs. 

 

As for how much resources does the actual feature consume? I'm not too sure. I can only imagine that VLAN tagging would be the lesser of the two. I'm sure there are VDOM daemons involved that can be monitored, but I personally haven't done so. 

 

VDOMs, from my experience, are pretty cool! It literally feels like creating several fortigates from one, which goes beyond layer 2 segmentation. Either way, let me know what you decide to do. I'm interested. Nothing that is is unimportant, right? 

 

Also, thanks for the heads up about the outer solar system disturbance. I'll stay on red alert until further notice! 

 

Peace and long life. 

 

Devin. 

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.