Firewall Rule for AV/IPS

[dasilva13]

Have any of you guys made a rule for internal to internal that scans for virus/botnet/ips? for example, if someone gets cyrptolocker, the virus tries to jump on every available networked drive or ip on your scheme to look for shares it has access to. does internal to internal scanning work? block that sort of thing?

[Istvan_Takacs_FTNT]

If internal to intenal is passing the firewall then it should work. You have 2 different physical or virtual interfaces connecting to those 2 networks and you create a policy with the required proxy/flow-based scanning enabled. Just like from external to internal.

[norouzi]

If you do not using ZONE, Internal to Internal can not work until using Virtual IP.

For example create a VIP for your client or server on your internal network and then create a policy with NAT enabled.

You should call VIP not real address of the server.

The better way is moving your server to another interface of FortiGate.

[ede_pfau]

The answer is 'No' for 99% of all cases.

Usually hosts on your LAN belonging to the same subnet determine that a peer is on the same subnet (by masking the destination address with their netmask) and use the ARP protocol to directly contact it on layer 2. Only if the peer has to be reached by routing, and if the FGT is the default gateway of your subnet, then the FGT "sees" that traffic and can scan it. One example of this given is 2 different subnets on the same physical LAN. You would use an 'internal' > 'internal' policy for this to be allowed.

One workaround would be to create a zone of all internal interfaces, allow 'intra-zone' traffic and create an 'internal' > 'internal' policy. That should see all internal traffic but I haven't tested this yet.

The drawback is that member interfaces of a zone cannot be used as single interfaces in policies. This is to avoid ambiguities when traffic is facing a zone policy and an interface policy for both the same interface.