Management Access through Web

[40User]

Hi forti Experts, We have about 13 Forinet Fortigate running in the Company. 1 in the Corp office and 12 in the remote offices. Had a few questions. 1.Do you access the WEB MANAGEMENT (HTTPS)from the external interface and how do you have your policies setup? -Do You ONLY access the INTERNAL web management? -Do You access it through the VPN? (what if VPN is broken and needs to be fixed) -Is is REALLY safe to access the WEB management through EXTERNAL inteface? -You ONLY use telnet, SSH and NOT HTTPS? 2. What is the best method/option to MANAGE all the FORTINETS in the company, meaning through 1 software program, access all the features of the WEB MANAGER of all the devices?? (POLICIES, STATUS etc) Thanks.

[abelio]

Hi, well, this is almost a kind of poll:

1.Do you access the WEB MANAGEMENT (HTTPS)from the external interface and how do you have your policies setup?

Administrative access it is not related with firewall policies You control it through system->admin->settings (ports, serviice, timeouts) etc

-Do You ONLY access the INTERNAL web management?

it depends on the situation; which problem do you trying to solve?

-Do You access it through the VPN? (what if VPN is broken and needs to be fixed)

VPN access is very common way to access the internal lan and admin the box thereafter; obviousy, if Vpn is down or broken this method is broken too.

-Is is REALLY safe to access the WEB management through EXTERNAL inteface?

It depends what the specific organization define as ' safe' ; some organizations has compliance observations about remote access to devices for management purposes, others don' t; your mileage may vary

-You ONLY use telnet, SSH and NOT HTTPS?

Forget telnet access from internet Remember also that you can restrict the ' trusted hosts/subnets' from which you can administrate your boxes; this is a very recommendable setting

2. What is the best method/option to MANAGE all the FORTINETS in the company, meaning through 1 software program, access all the features of the WEB MANAGER of all the devices?? (POLICIES, STATUS etc)

It depends. You have a dozen boxes: if you need to make frequent changes, you' ll hate have to log in each box each time, in this situation, FortiManager is your best option. If your setup will be ' one shot' or with a very few commands, you' ll can live with remore access individually. regards,

[40User]

Thanks Abel, I guess my main concern was the danger of unauthorized access to the Firewall from the Outside throught the Web Config HTTPS External Interface. In simple terms " Hackerguy" types in a random Public IP (ext int of the forti) sees the Web Mangement screen and through Password Break progs, gets in! The Admin Maintanace area with allowed IP' s makes a lot of sense. Havent played with FortiManager...have to check it out.

[iFortify]

Securing Web Management Access to the Fortigate 1) Disable HTTPS, HTTP, SSH access to the external interface when it is not in use (System->Network->Edit WAN1/External Port) 2) Specify trusted hosts on admin profiles when enabling outside access so that only those coming from the trusted IP can access the Fortigate (System->Admin) 3) Change the administration port (System->Admin->Settings) to a non-standard port 4) You can configure the lockout and threshhold from the CLI (config system global) and specify that after ' x' incorrect login attempts the lockout period will be ' x' seconds If you follow these steps you should not have an issue with external access. Do not forget about internal access (you can also specify that only your IP can access the device on the internal network) and direct access (keep the device in a locked location).

[daveywavey]

You might also want to do the following: Close Ident Port 113 http://kc.forticare.com/default.asp?id=1763&Lang=1&SID= Close TCP Port 541 (if you don' t use forti manager) http://kc.forticare.com/default.asp?SID=&Lang=1&id=3724 Or create a custom IPS if you see constant attempts from an ip F-SBID( --name " Detect.Src.IP" ; --src_addr x.x.x.x; ) cheers, Davey

[iFortify]

One step further, you can configure Radius, LDAP, TACACS+ or PKI for authentication For information on configuring administrative access with Radius Authentication, please refer to the MR7 Administration Guide starting on page 198 For information on configuring administrative access with LDAP Authentication, please refer to the MR7 Administration Guide starting on page 199 For information on configuring administrative access with TACACS+ Authentication, please refer to the MR7 Administration Guide starting on page 201 For information on configuring administrative access with PKI Authentication, please refer to the MR7 Administration Guide starting on page 203

[jlingle]

disable all on external enable https/ssh on internal and make available over site to site ipsec tunnel. One option if you don' t use tunnels... 1)create a vip from external ip to internal interface ip 2)enable your internal access (i.e. https ssh) 3)create firewall pol source: trusted ip' s (i.e. admin networks) dest: vip service: https, ssh 4)test then disable access on external int this allows you to hide access to only the ip' s you want plus people scanning will not see your network.

[g3rman]

Incidentally I wrote a post about this very subject a little while ago. When all the admin accounts are configured with the same IP access restrictions the firewall actually locks down outside access except for authorized IPs. In other words you will not even be able to " stumble upon" the web interface if enabled since the firewall will simply throw away https packets from unauthorized IPs. Take a read: http://firewallguru.blogspot.com/2009/02/securing-firewall-administrator-access.html