Designs Fortigate (FireWall / Proxy)

[rzahraoui]

Hi All, My company has purchased FortiGate 100D, with the aim of using them as proxy. Except that I also want to enjoy the Firewalling and IDS roles of that range ==> I want to use as the first level Firewall keeping existing firewalls (ASA). Could you help me by telling me what design/architecture to implement for both cases, knowing that we already have to keep ASA Firewall Case 1: Fortigate as proxy + Firewall ASA. Case 2: Fortigate as Proxy/Firewall/IDS + ASA Firewall (in this case the DMZ already created in the ASA Firewall will be moved to Fortigate) Thanks for all, Rachid

[emnoc]

Do you have a business case for keeping the ASA? In your two proposals that could be done, but in reality your making this more complex. But I will give it a stab, what mode where you planning on running the fortigate is ( transparent or routed )? What mode is the ASA in ( we can only assume it' s routed but.....)? how does your inside topology look like? How maybe interfaces in used or vlans ? Do you have vpn terminates webvpn or ipsec ? Once again, why do you need the ASA?

[rzahraoui]

Thanks for your reply, as I said, the fortigate are purchased mainly to play the role of proxy, hence the reason to keep the ASA. In fact, we have several sites (and each of them has its own specifity), but basically the fortigate will be used in transparent mode if it plays only the role of proxy and routed mode for both roles (you can of course disagree with me, it is the purpose of my question, the architecture to implement :) ) I confirm that the ASA is in routed mode. LAN is managed by Switch level 3\Backbone, so normally the Inside interfaces Forrtigate and ASA will be connected to the backbone. We have ipsec and webvpn on central sites, this will be keep on ASA.

[emnoc]

Okay fair, the only thing I would research and maybe some one can answer here. Can a fortigate operate as explicit proxy in transparent mode? And one last area you should be concern with, do you have any HA requirements at the ASA or FGT?

[rzahraoui]

No HA required for the moment.

[Warren_Olson_FTNT]

FortiGate can do explicit proxy in transparent mode, users will need to specify the management address of the unit for their proxy. Reference: http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/web_proxy.199.01.html

[lightmoon1992]

FortiGate can be configured as explicit proxy in transparent mode. the proxy IP would be the same as management IP. Mohammad

[rzahraoui]

Thanks For your Help; I return to my first question, What is your Architechture proposition to use Both FGT and ASA as Firewalls (FGT 1st level, and ASA 2nd directly connected to Internet) Rachid

[lightmoon1992]

Hi Rachid, There are many scenarios you may go with: you may apply your ASA in routing mode, and FortiGate in NAT/Route mode, by which you position the ASA as pure stat full firewall, while maintaining the other security policies on the FortiGate Second scenario would be applying NAT/Route functionality on the ASA it self, and creating new private network in between. same story for the security engines at both scenarios. lets start with your network architecture, current needs, future needs, etc. lets know more about it if possible Mohammad

[rzahraoui]

Hi, Actually, in each site, i have an ASA as Firewall, there is no Filter of web trafic (http/https), this function is played by our actual proxies (squid). These Squid are placed on dmz, and we have other dmz (other subnets partitioned behind Firewall/ASA). So, FGT will replace Proxy/Squid with the aim to use some other functions of fortigate (like inspection of trafic...). Is it better to place the FGT in a DMZ too? if we use FGT as Firewall (1st level) Is it better to let the others dmz on ASA or migrate them to FGT? Thanks!