Configure DMZ

[ZiPPy]

I' m looking to configure a DMZ port on my Fortigate, but I' m not exactly sure how to configure it properly. I' ve done some searching online and to my surprise I haven' t found to many articles regarding the topic on Fortigate firewalls. Can somebody point me in the right direction on how to configure a DMZ on the Fortigate 300 & 800. In the Fortigate user guide they talk about creating VDOM' s and assigning the internal LAN to one VDOM, and the DMZ network to another VDOM. Is this the correct way of setting up a DMZ?

[Fullmoon]

insights only, for me DMZ is just a naming convention only, you can assigned Internet or Private network on that particular port. Mostly they used DMZ Port/s to separate your common user to your protected server. Lets say for your Internal Net 192.168.0.0/24 and For DMZ port wherein your Server Farm resides you can assigned 10.10.10.0/24 net. Its a matter of firewall policy if you want to allow you 192.168.0.0 net to access 10.10.10.0 net (Server Farm)

[ZiPPy]

Thanks for the quick response Fullmoon. You mind if I ask what your policy looks like?

[rwpatterson]

ORIGINAL: ZiPPy Thanks for the quick response Fullmoon. You mind if I ask what your policy looks like?

Only one policy? I wish!

[ZiPPy]

Oh dear. Got any examples? It looks like I' ll have to use a Virtual IP in the setup. Not sure. This is my first DMZ setup.

[ZiPPy]

I didn' t find much help regarding the setup of a DMZ in the administration guide.

[rwpatterson]

The basic premise of a DMZ is that any traffic flows into those servers, and if any are compromised, they cannot get out to inflict more damage elsewhere. Place a server in there, and make sure there are minimal policies allowing traffic out from there, especially back to your work stations. None of my DMZ servers can get back to my LAN. Also minimal policies from those to the Internet. If one of those servers needs more, I open the path, do the work and close it back up tight. My two cents

[ZiPPy]

Thanks for the explanation rwpatterson, it definitely helps in the grand scheme of things. I' m still a little confused on how to setup the rules. Here is what I' ve got so far: Create a VIP with an ext. address mapped to my int new subnet for the DMZ. WAN1 to DMZ where my destination is pointing to a VIP I created. I think this is what still is needed: DMZ to WAN1 - to limit what goes out from the DMZ DMZ to LAN - what can get over to the LAN, but still communicate for services needed. Is that correct?

[ede_pfau]

I totally agree with Bob, " consider your DMZ server hacked" should be the way to think. You wouldn' t really want to have firewall policies allowing ANY traffic from the DMZ to your LAN in this event, would you? So, WAN users can open a session on your DMZ located server through the VIP. The return traffic will automatically have the private server' s IP address translated to the VIP. Ideally, the VIP will only translate traffic on specific ports (e.g. HTTP only). The policy DMZ->WAN is (in my setups) only needed for - NTP - OS updates = HTTP to specific destinations And there will never be a policy DMZ->LAN...if you need to pull data from the LAN, then you can always push them as well onto the server, and send a signal for it to pick it up (that was the case with DNS updates).

[ZiPPy]

Could you possibly show an example of your policy and VIP please?