Create a DMZ for a set of VMs?

[pccstech]

Hello 

I have several VMs I'd like to protect with a DMZ. They need to be accessible from the Internet and internally. I'm looking for assistance in finding some "howto" docs or general guidance in creating the DMZ.

We have a Fortigate appliance with two connections to it. One internet facing the other is internal.

Our VMs are of the form 10.10.10.x. We currently have a few Virtual IPs and polices allowing internet traffic to these VMs. I am able to understand the "cookbooks" for wired connection to protect physical servers but I'm lost as where to start to protect a VM.  Thx in advance for any guidance you can provide

[abarushka]

Hello,

I can not think about the differences between protecting physical servers and VMs. Firewall is treating the same way traffic from/to physical servers and VMs.

[pccstech]

The traffic filtering being the same I get.  To start building the DMZ I think I need to create a new interface?  What kind?  

[pccstech]

We are on version 7.0.11

[abarushka]

Hello,

You may consider to set DMZ role for the interface:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Behaviour-on-the-GUI-of-the-Interface-Role...

Here is a sample topology:

https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/361386

[pccstech]

Thx for the replies.    The topology example looks to be for a physical server connecting to an open port. 

Q: Is creating a new interface the correct first step in creating the DMZ? IF so what type should it be?   My Choices are:

802.3ad Aggregate

EMAC VLAN

Loopback

Redundant

Software Switch

SSL-VPS Tunnel

VLAN

Also which interface member should I choose? External or Internal?

[abarushka]

Hello,

Interface type selection rather depends on the network topology and requirements (speed, redundancy, etc.) than security. I can not see significant difference between interfaces in terms of security.

[pccstech]

All set. Thx