Firewall deployment, IP addressing and Forticloud

[acsuser]

Hi I am looking to support a new implementation and management of a 60d NGFW for another company - they already have a port based firewall on their router so i am planning to put this in behind and just use the NGFW feature. and have a couple of questions:

1) As this is sitting behind existing firewall it wont need any public IP addressing so i was planning to use static private addresses - is there any issues with this?

2) I want to use Forticloud for management, reporting etc and wondering how this will work with just private IP addressing, how can i get connectivity from the Forticloud to the device?

thanks

[Christopher_McMullan]

The FortiGate can function properly whether or not it is configured as an edge router, so using private address spaces is fine.

The FortiGate will maintain outbound connectivity with FortiCloud, so it can be placed behind other devices successfully, so long as TCP/UDP port 53 and TCP port 443 are allowed out.

One option you may want to consider is configuring the FortiGate in transparent mode, so that it acts more like a UTM-enabled switch than a router, if you already have an extensive existing addressing scheme. Otherwise, you would need to segment subnets between those directly off the existing router, and those that would be off the FortiGate. Better to simply assign an IP for management within an existing subnet.

[acsuser]

Hi Christopher,

Great information and thank you for your swift response.

1) Sounds like Forticloud connectivity should be fine, I guess we can only monitor not change rules etc from the cloud then?

2) Transparent mode sounds OK, but they are currently a small company with a flat network with the Router performing DHCP and I was thinking of trying to segment the network by creating the following 4 zones (leaving IP addressing intact)

Trust - standard employee subnet

Untrust - WWW

Internal server - separate range for AD server and payment server, it only needs to communicate internally and we are trying to limit access to just a couple of users 

Guest - Zone that only routes direct to Untrust

Does this make sense, and what implementation would be best for these requirements

Thanks

Christopher McMullan_FTNT wrote:

The FortiGate can function properly whether or not it is configured as an edge router, so using private address spaces is fine.

The FortiGate will maintain outbound connectivity with FortiCloud, so it can be placed behind other devices successfully, so long as TCP/UDP port 53 and TCP port 443 are allowed out.

One option you may want to consider is configuring the FortiGate in transparent mode, so that it acts more like a UTM-enabled switch than a router, if you already have an extensive existing addressing scheme. Otherwise, you would need to segment subnets between those directly off the existing router, and those that would be off the FortiGate. Better to simply assign an IP for management within an existing subnet.

[Christopher_McMullan]

More what I meant about FortiCloud is that it connects to FortiGates much in the same way LogMeIn or Chrome Remote Desktop would: an outbound session from the client using the well-known (and rarely blocked) TCP port 443  punches a hole through any intervening firewalls. The server can then send responses periodically, in some cases in response to keep-alive packets, other times simply in response to an open-ended packet from the client.

The FortiGate should be manageable from FortiCloud in the same way whether it is given a public IP and placed at the edge or not.

For us, zones are a loaded term. Zones bundle interfaces together for the purposes of defining firewall policies to avoid duplicating effort. For instance, if you have two WAN links, and want the same UTM and NAT rules applied to both, you could combine the two links (WAN1 and WAN2) into a 'WAN' zone, and create one policy instead of two: internal > WAN, action accept, NAT and WF enabled.

[Christopher_McMullan]

Looking again at the way you're segmenting hosts into four zones within a flat subnet in your last comment, you could go about this in a variety of ways: aliases on four ports, where the ports face clients or switches facing clients; VLANs segmenting one broadcast domain.

I think my comment about zones should help, but I don't really have further guidance than that: I don't know of any official Fortinet best practices as far as segmenting by host or network function goes. But it still does sound as if a transparent-mode FortiGate makes sense: you place it as near to the edge as possible, but keep it as a 'hidden' UTM appliance, and configure port rules accordingly (firewall policies) to allow traffic between zones (single or groups of interfaces), and apply UTM profiles as necessary.

[acsuser]

Sorry for any confusion with "Zones", I was trying to indicate separate network segments with policies between each segment (from my legacy knowledge i thought Zone Based policy was a standard Cisco term for this). It sounds like I have a few options and can achieve what i need to do so i will just pickup a 60 series device this week.

Thank you.

Christopher McMullan_FTNT wrote:

Looking again at the way you're segmenting hosts into four zones within a flat subnet in your last comment, you could go about this in a variety of ways: aliases on four ports, where the ports face clients or switches facing clients; VLANs segmenting one broadcast domain.

I think my comment about zones should help, but I don't really have further guidance than that: I don't know of any official Fortinet best practices as far as segmenting by host or network function goes. But it still does sound as if a transparent-mode FortiGate makes sense: you place it as near to the edge as possible, but keep it as a 'hidden' UTM appliance, and configure port rules accordingly (firewall policies) to allow traffic between zones (single or groups of interfaces), and apply UTM profiles as necessary.

[emnoc]

1:  this should not be a issue

2: will obviously your FortiGate will need public internal access ( nat, etc....). So your upwind device must allow traffic from  the unit thru the management interface that you define to the forticloud.

And lastly, it will ONLY report on traffic that passes thru the unit. I'm assuming this is a transparent install? If it is than your concept of zones would not be applicable. If your install it as l3 mode behind the cisco than you can call these interfaces whatever name  you want.

Do you have a topology layout of what your trying to do build similar to the jpg attached?