Description
This article describes how to create a virtual wire pair (consisting of port3 and port4) to make it easier to protect a web server that is behind a FortiGate operating as an Internal Segmentation Firewall (ISFW).
Solution
Diagram:
A virtual wire pair consists of two interfaces that have no IP addresses and all traffic received by one interface in the pair can only be forwarded out the other; as controlled by firewall policies.
Since the interfaces do not have IP addresses, insert a virtual wire pair into a network without having to make any changes to the network.
Virtual wire pair replaces the feature port pairing from earlier firmware versions.
Virtual wire pair replaces the feature port pairing from earlier firmware versions.
Unlike port pairing, virtual wire pair can be used for a FortiGate in NAT/Route mode, as well as transparent mode.
1) Adding a virtual wire pair.
1) Adding a virtual wire pair.
Interfaces used in a virtual wire pair cannot be used for admin access to the ISFW FortiGate.
Before creating a virtual wire pair, make sure to have a different port (in the example, port1) configured to allow admin access using the preferred protocol.
Go to Network -> Interfaces, select 'Create New' -> Virtual Wire Pair.
Add port3 and port4 add to the virtual wire pair.
Add port3 and port4 add to the virtual wire pair.
If the interfaces to use are part of a switch, such as the default LAN/internal interface, remove them before it can be added to the virtual wire pair.
2) Adding virtual wire pair firewall policies.
Go to Policy & Objects -> IPv4 Virtual Wire Pair Policy and create a policy will allow users on the internal network to connect to the server.
Give the policy an appropriate name (in the example, Network-server-access).
Select the direction that traffic is allowed to flow (from port3 to port4).
Configure the other firewall options as needed. In the example, antivirus is enabled to protect the server.
Configure the other firewall options as needed. In the example, antivirus is enabled to protect the server.
Create a second virtual wire pair policy allowing traffic from port4 to exit out of port3.
This policy allows the server to connect to the Internet, in order to download updates.
Result.
To test both virtual wire pair policies, connect to the web server from a PC on the internal network, and also connect to the Internet from the web server.
Go to FortiView -> Policies to see traffic flowing through both policies.
To test both virtual wire pair policies, connect to the web server from a PC on the internal network, and also connect to the Internet from the web server.
Go to FortiView -> Policies to see traffic flowing through both policies.
