How can I make my public facing interface secure on Fortigate?

[shido321]

We have a CCTV network which is on a separate vlan. There’s a server with static IP address that is on the same vlan and has the software that manages the cameras etc. This CCTV vendor has a mobile app too, which lets you connect remotely to this server via a public IP address which we got from our ISP. Owner and some managers want to view the live feed from the CCTV cameras from home on their phones if needed. I have mapped one of our public IPs to the server’s private IP address via Virtual IPs (NAT) in Fortigate. It works as intended but I am concerned about its security.

In the policy I have Web Access (HTTPS, HTTP, DNS) services enabled and have enabled Security Profiles for this policy. I can set specific sources (IP addresses) to be able to connect but then cell phone IP addresses (from phone carriers) change because they are not static. Currently the source is set to “all” which concerns me.

Is it not a safe approach from cybersecurity perspective?

[Anthony_E]

Hello shido321,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[aionescu]

Hi @shido321 ,

Have you considered the use of SSL VPN for remote acces? This way it is not necessary to use VIPs.

[RinoBroer]

To reduce the risk, you could geoblocking and allow only certain countries.

[gfleming]

You need to know more about the software you are exposing to the internet. Is the CCTV software regularly updated and patched for vulnerabilities? Does it have any vulnerabilities currently? I assume you are protected using username and passwords but if that can easily be bypassed by leveraging a weakness in the software or brute force then you're out of luck.

As others have mentioned, VPN is a very good way to secure resources but can cause headaches for users to configure and use. Geo blocking is very useful in that you can only allow connections from your home country and reduce attackers.

Best step would be to understand the software running on the camera server and set up a comprehensive IPS profile for it to block attacks that target it as well as brute force login attempts.

It may also be appropriate to set up a WAF profile as well.

https://docs.fortinet.com/document/fortigate/7.2.2/administration-guide/565562/intrusion-prevention

https://docs.fortinet.com/document/fortigate/7.2.2/administration-guide/64335/web-application-firewa...

[RinoBroer]

In addition, be aware that you also filter traffic from the CCTV server to the Internet so that a hacker cannot simply call home to download additional malware or perform malicious tasks. Keep your CCTV server up-to-date and use strong passwords

In summary:
- Only use VIPs if SSL-VPN is not an option
- Restrict and secure the incoming connection as much as possible via geo blocking, IPS, WAF and AntiVirus
- To give UTM profiles full insight into traffic, I recommend applying deep inspection. Without full ssl inspection, IPS cannot detect some attacks because it simply cannot inspect the traffic
- Keep your CCTV server up to date
- Use only strong passwords
- Filter (DNS, web and IPS) also traffic from the CCTV server to the internet so that it is not possible to connect to a C&C server or download additional malware when a hacker did manage to break in and access the CCTV server