DMZ Configuration

[rajeev1963]

I am using Fortigate 100 A Wan1 : 110.234.200.XXX Internal : 192.168.1.0/24 ip: 192.168.0.1 DMZ: 10.10.10.0/24 ip: 10.10.10.1 and my Web Server ip: 10.10.10.2 I am not able to access http/https/ftp on webserver with wan1 ip. Please help me Rajeev Srivastava

[hidayet]

Hi rajeev1963, You' ve directed a webserver with port 80/443/21 VIP?

[rwpatterson]

To be a bit more explicit, you need to create a Virtual IP for each of these servers/services and use them as destinations in their respective policies.

[#4]

I am thinking about also creating a DMZ to host a DMZ DNS server for RDNS on our set of IPs. Our ISP recently changed us to a full class C public address and they SWIP' d the IP block with ARIN in our name. I had asked them to create a PTR record for me but they said per ARIN' s allocation rules once you get a full class C the ISP basically becomes me and I' d have full control of what I do for DNS/PTR/RDNS etc. records. I get the gist of setting up the DMZ but I' m not sure how the policies should be setup to secure the DMZ DNS server as best I could...maybe only allow DNS service in the policies? Internal clients will not be using this DMZ DNS server at all. This is what I' m thinking: 1) WAN2 - public IP of 1.2.3.10 2) DMZ DNS server - DMZ IP of 172.16.105.10 (only node in this DMZ IP space) with GW set to 172.26.105.1 hooked up to port5 3) port 5 - DMZ IP of 172.26.105.1 4) create VIP (call it VIP1) for WAN2/1.2.3.10 mapped to 172.16.105.10 5) create policy for WAN2 ->port5 5a) source of all (0.0.0.0/0.0.0.0) -> VIP1, service of DNS 6) create policy for port5 -> WAN2 6a) source of DMZ DNS server 172.16.105.10 -> destination of all (0.0.0.0/0.0.0.0), service of ANY I could be WAAAYYY off but this is my best guess. Also, I' m not sure what service should be allowed on what policy. Would this work? If so how to secure it as best as I can? If this won' t work then edit my config above if you so kindly would. Thx in advance.

[rajeev1963]

Yes, I ve done VIP for port 80/443/21

[rwpatterson]

What services did you use in the policies? Built in or custom?

[rajeev1963]

I have used http/https/ftp. In 100A there is no built in. I have done Firewall -> VIP Name IP Service Port Map to IP/IP Range Map to Port ftp wan1/110.234.XXX.XXX 21/tcp 10.10.10.2 21/tcp web wan1/110.234.XXX.XXX 80/tcp 10.10.10.2 80/tcp web secure wan1/110.234.XXX.XXX 443/tcp 10.10.10.2 443/tcp Rajeev Srivastava

[rwpatterson]

ORIGINAL: rajeev1963 In 100A there is no built in.

There are always built in services. They are under ' predefined' .

[claumakurumure]

Make sure in the firewall policy Wan1 => DMZ there is no NAT enabled sometimes this may be taken for granted

[rajeev1963]

I ve already done WAN1 -> DMZ in firewall policies