Proper Firewall Setup

[anon]

I recently purchased a FortiGate 60D and I got it setup, but I wanted to make sure I set it up properly, or better said securely. I just want to make sure I set it up from a base standpoint, I know " securely" is a lose term. Internal - WAN1 SOURCE: all DESTINATION: all SERVICE: all ACTION: accept SECURITY PROFILE: AV, IPS, ProxyOptions(default) Implicit SOURCE: any DESTINATION: any SERVICE: all ACTION: DENY SECURITY PROFILE: none I setup the following to allow me to browse the web, without being blocked. But I know having a configuration with ultimate convenience comes at a cost. How do others configure there firewall at home? Do you guys have all your protocols specifically setup such as DNS, HTTP, FTP ect... I' m new to firewalls, so I' m looking to learn and do this the right way. Thanks.

[Istvan_Takacs_FTNT]

Not sure if I did it the right way or the wrong way, but I have mine running with all the devices that I don' t control, but with wireless/LAN configured to be blocked to access the Internet (TV, media player, NAS, etc.). When I want to firmware update any of them than I can still temporarily enable only to access the specific remote sites and than disable it again. Also have access enabled for PC and mobile devices but with web filter turned on and some of the categories disabled. SSL offload is also configured to log the encrypted traffic and filter for inapporpriate access and safe search turned on for the kids' devices. Also enabled specific access only, not all services. Most of the time you need only HTTP/HTTPS/SMTP/IMAP/SSH access. If I need anything else, than I find out first why, then enable it if I really need to. Another thing was I used Geolocation to disable access from specific countries as I found many strange traffic patterns in the log coming from places that I unlikely will visit in the future anyway. Full access blocked to all cloud providers, too (including the infamous iCloud from all devices on the home network). All the mobile devices configured to have access over wireless only, not paying for any data plan. For mobile calls still my trusty Nokia 3310 is the best, not some fancy (and chatty) smartphone. It might sound a bit extreme and like being a control nazi for only a home network, but what' s the point to have a firewall at home if not to have a better understanding and control over what' s happening on your LAN and to protect your own privacy. Otherwise you can use a dumb modem to connect to your ISP and don' t bother about what exactly happening on your LAN, right?

[ede_pfau]

I fully agree with all of Istvan' s setup. Usually, you start out with a simple policy set or even just one policy and refine later. For instance, I have separated DNS traffic from the mainstream in order to be able to watch which DNS is queried (I only allow my ISP' s DNS) and how much volume is used. I get a feeling for a typical baseline so that I would notice if traffic doubled over night. That was only introduced after I learned that web traffic can be tunneled over DNS. A big part of my policy table are dedicated VPN connections all of which are route-based. One feature helping me to keep an eye on the VPNs is to create a custom dashboard and populate it with traffic gauge widgets, one per VPN. I can check traffic load on 6-10 VPNs at a glance this way. And like Istvan I have " allow all services" policies dormant which I manually enable for maintenance operations. Lately, they are even labelled " Maintenance" for clarity :)

[emnoc]

OP Ss you as can see you will have numerous methods to fwpolicy setup. Keep these other items in member. If you need to rate or apply QoS classification, you might have policies ahead of others with prioritization The same for if end up IPS protection or application controls. Just keep in mind to order most specific policies first before any broad policies.