I have a basic question: From your experience, what would you recommend as a naming convention for the objects (hosts, networks, ports etc) in a fortigate firewall that is more practical and makes it easier later to support and resolve problems?
Your feedback will be appreciated!
I will typically put the object type in the name to make it easier to distinguish what you are looking at. For example you might have an interface, vlan, and zone all named internal- so the interface would be internal, then internalVLAN, and internalZONE to separate them. I will put VIP at the end of VIPs to distinguish between the original object and the VIP to that object. Sometimes you have a VPN that connects two networks that are similar function, so i'll put VPN at the end of the vpn interface name. Address groups have group at the end to distinguish them.
To put it together in an example you have a network that just connects backup servers in two locations. You have the BackupVLAN which comprises the BackupZONE. It talks over the BackupVPN to another location. You have traffic rules that allow from BackupServersGroup in BackupZONE to BackupVPN.
It sounds redundant, but it makes it easier to distinguish things when looking at the config file since there is no icon coding there- you can easily tell if a policy is going to a vip, or address, or address group.
Definitely agree with emnoc- keep addresses to what the dns/hostnames are for individual devices both for sanity and auditing. Use the comment field to specify that it's a certain user if you want to. I also name addresses that are entire subnets something different to indicate that like servernetwork or usernetwork.
As far as case sensitivity is concerned- the fortigate is case sensitive and Capital letters come before lowercase ones, so if you have an address item with a lowercase letter first, it will appear after all the other capitalized ones in the gui.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
