Explorer III

Solved

Wan to Lan policy

5 replies
5433 views

Hi

What is the best practise to create a policy from wan to lan?

FortiGate

NchandanAnswer

Staff

Hi Team,

Here are some best steps:

*Document your firewall policies, including the reasoning behind each rule. This documentation is valuable for troubleshooting and auditing purposes.

*Clearly define the objectives of your policy. Understand the types of traffic you want to allow and those you want to deny.

*Be specific about the source and destination addresses. Avoid using broad ranges when possible. Specify the IP addresses, subnets, or FQDNs (Fully Qualified Domain Names) that are relevant to your organization.

You can refer to the below document:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practices-for-policy-configuration/ta-p/193255

ebilcari

Staff

Usually the host in the LAN will be behind NAT. The access from WAN to LAN will be limited to the VIP and port forwarding configurations unless the hosts have public IPs and are directly routed through the WAN.

Emirjon

AEK

SuperUser

Hi

It depends on what you are publishing, e.g.: Web server, email server, DNS server, ...

And whether you have dedicated protection or not, e.g.: WAF, SMTP gateway and so...

AEK

mle2802

Staff

Hi @rezafathi,
In addition to previous reply, you may want to take a look at virtual server if it is for server load balance https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/713497/virtual-server-load-balance

Regards,
Minh

aabdhadi

Staff

Hi @rezafathi

If this is a limited access for certain of your known users or client, you can consider to allow only certain public IP address to access from WAN to LAN.

VIP configuration will also help you to map a certain custom port if needed.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

regards.

NchandanAnswer

Staff

Hi Team,

Here are some best steps:

*Document your firewall policies, including the reasoning behind each rule. This documentation is valuable for troubleshooting and auditing purposes.

*Clearly define the objectives of your policy. Understand the types of traffic you want to allow and those you want to deny.

*Be specific about the source and destination addresses. Avoid using broad ranges when possible. Specify the IP addresses, subnets, or FQDNs (Fully Qualified Domain Names) that are relevant to your organization.

You can refer to the below document:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practices-for-policy-configuration/ta-p/193255

Sign up

Login with SSO

Login to the community

Login with SSO