Basics, where to put firewall in the network

[Baricz]

Hello,

I hope I've chosen right forum department. I'm quite new to the topic and I need some help with understanding the basics of placing firewall in the network.

I have been assigned to a task of creating an example network including FortiGate firewall in GNS3. I managed to get FortiGate VM, gained access to web management by assigning an ip address to one of the ports and I have run out of ideas of what to do next.

My goal is to connect firewall and PC to one router on separate links (?). The PC is supposed to be the protected by the firewall on which I am going to create some example policies, filters etc. Also, PC should be directly accessible from outside of the router.

As far as I know, there is no way to make something like this: PC --- FW --- Router without setting up NAT on FW (PC would be unaccessible then). Because of that, I came up with an idea of connecting FW and PC directly to the router (so PC -- Router -- FW and the rest of the network connected to the router) and the thing is that I don't know how to set it all up now.

In another words, all traffic which comes to the router interfaces with destination ip address set on this PC, should be filtered, and then sent to this PC. And the same with opposite direction. Does it make sense at all? Are there any other ways to do this?

Sorry for asking kind of newbie questions but I've spent lots of time online looking for the solution and didn't find any satisfying one.

Thank you for any tips

Regards

[ede_pfau]

Hi,

and welcome to the forums.

I'd say your first idea is almost all you need. One tiny detail is missing: the FGT itself (in "NAT/routing mode" which is the default) works as a router. In consequence, all distinct interfaces need to be assigned an IP address from distinct subnets. To enable the flow of data you need (at least) to set up static routes on the FGT, either specific ones or a default route. As this is additionally a firewall, you need then to allow the traffic - that's what policies are for.

I think most of these principles are quite well laid out in the 'FortiOS Handbook' especially the first introductory chapters. Get as much infos as you can from docs.fortinet.com.

One more hint: in order to protect hosts the firewall needs to sit in front of them. Other ports on it connect to other interesting subnets, like the internet. Routes and policies determine which traffic can pass and which will not.

Post more when you have explored the Fortigate's potential. This forum is always a good place to ask.

[Baricz]

ede_pfau wrote:

(...)

Thank you for your answer.

I've spent some time on the web todat and I've already found a solution which suits best my needs. I just needed to change the default NAT/routing mode to transparent mode (in PC -- FGT -- Router config).

It allowed me not to assign IP addresses to FGT's ports (which means I don't have to set NAT and routing etc. - it works like a filter) and made PC (protected by the firewall) directly accessible from the rest of the network (everything on the other side of the firewall) which is exactly what I wanted to achieve.

It's time to have some fun with the configuration because there are lots of options.