Configure DMZ

[ZiPPy]

I' m looking to configure a DMZ port on my Fortigate, but I' m not exactly sure how to configure it properly. I' ve done some searching online and to my surprise I haven' t found to many articles regarding the topic on Fortigate firewalls. Can somebody point me in the right direction on how to configure a DMZ on the Fortigate 300 & 800. In the Fortigate user guide they talk about creating VDOM' s and assigning the internal LAN to one VDOM, and the DMZ network to another VDOM. Is this the correct way of setting up a DMZ?

[ede_pfau]

There' s nothing special here: just a VIP declared on the external interface, and policies WAN -> DMZ DMZ -> WAN and internal -> DMZ

 VIP
 config firewall vip
     edit " VIP_DMZ_dns" 
         set extip 11.22.33.44
         set extintf " port2" 
         set mappedip 192.168.7.84
     next
 end
 
 
 -------------
 config firewall policy:
 
 WAN->DMZ
 -------------
     edit 56
         set srcintf " port2" 
         set dstintf " port5" 
         set srcaddr " all"              
         set dstaddr " VIP_DMZ_dns" 
         set action accept
         set schedule " always" 
         set service " DNS"              
         set logtraffic enable
     next
     edit 215
         set srcintf " port2" 
         set dstintf " port5" 
         set srcaddr " ITcompany"              
         set dstaddr " DMZ_LAN"              
         set action accept
         set status disable   # activate ONLY if necessary!
         set schedule " always" 
         set service " sshservices"              
         set logtraffic enable
         set comments " 4 maintenance from ext service" 
     next
 
 
 DMZ -> WAN
 -------------
     edit 87
         set srcintf " port5" 
         set dstintf " port2" 
         set srcaddr " DMZ_LAN"              
         set dstaddr " EXT_ntpservers"              
         set action accept
         set schedule " always" 
         set service " NTP"              
         set logtraffic enable
         set comments " external NTP servers" 
         set nat enable     # necessary
     next
 
 internal->DMZ
 -------------
     edit 96
         set srcintf " port1" 
         set dstintf " port5" 
         set srcaddr " nameservers"              
         set dstaddr " DMZ_nameservers" 
         set action accept
         set schedule " always" 
         set service " DNS"  " sshservices"              
         set logtraffic enable
         set comments " 4 dns sync" 
     next

[ZiPPy]

That helps so much! So much!! My only question is for: edit 215 set srcintf " port2" set dstintf " port5" set srcaddr " ITcompany" set dstaddr " DMZ_LAN" What source address is defined in ITcompany? I believe that would be your ext IP address right?

[ede_pfau]

no, not quite, it' s the external IP of an IT service company which maintains the DMZ servers. I do firewalls, they do servers :)

[ZiPPy]

Ah I see. I just wanted to make sure I understood what exactly was going on. Obviously I won' t understand all the naming, but I tried hehe :)

[rwpatterson]

The important aspect is that 99% of the traffic is into the DMZ, and only a small bit (NTP) is outbound.

[ZiPPy]

I finally got traffic passing out the DMZ. How does this look? Am I on the right track? The purpose of this DMZ is to place our Exchange 2010 Edge Transport server, that is when I get the DMZ configured properly. VIP config firewall vip edit " DMZ_VIP" set extip 12.x.x.x set extintf " port2" set mapping 192.168.7.70 next end WAN -> DMZ ----------------- edit 6 set srcintf " port1" set dstintf " port3" set srcaddr " all" set dstaddr " DMZ_VIP" set action accept set schedule " always" set service " ANY" next DMZ -> WAN edit 7 set srcintf " port3" set dstintf " port1" set srcaddr " DMZ_LAN" set dstaddr " all" set action accept set schedule " always" set service " ANY" set nat enable next INT -> DMZ edit 8 set srcintf " port2" set dstintf " port3" set srcaddr " 10.x VLAN" set dstaddr " DMZ_LAN" set action accept set schedule " always" set service " ANY" next end

[ede_pfau]

Some hints: a) the VIP has to be defined on the WAN interface, port 1. You' ve got the internal port, port2. b) what is policy 7 for? if absolutely necessary, then restrict the services allowed to the fewest possible. Imagine someone has hacked your server. If you allow everything outgoing, he could make it a spam server and send out thousands of emails per hour. c) for the same reasons, in policy 6 restrict the services to the ones used for accessing the Exchange server (probably HTTPS only). d) If you' ve found out the service(s) you could go one step further and make the VIP port-forwarding. This is not for security but to free up your external IP for other services you may host.