Protecting Web Server app

[Infotech22]

Hello to all,

I would like to get some best practices for securing web server that we are exposing to internet.

I will use Interface with DMZ role, disable everything (ping, http, https...). 
Will create VIP object and map it to our external IP address.
From inside network I will allow only ssh to the server and for external access to the server I will leave only https and dns.

Will use default Web Application Firewall security profile.
Now the question is what else could I do to secure it more, to add some other Security Profiles like IPS etc?

[msolanki]

You can use the other profile and other way is you can use virtual server option which will give additional certificate inspection layer to add more security posture 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Recommended-configuration-for-HTTPS-Virtua...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-multiple-certificates-for-in...

[Infotech22]

Hello,

This is not so clear for me at the moment so I will skip this part.
We need it today so I will consider this a little bit later when I grasp it.

Thank you

[AEK]

Hello

In addition to @msolanki post I'd add the following.

• Add IPS (protect-web-server profile)
• Adding restricted App Ctrl may add security (e.g.: HTTPS.BROWSER)
• Block bad IP (as client) at policy level (CLI only)
• Allow connections from specific region if needed (GeoIP)
• Is there any reason to allow DNS access from outside?

[Infotech22]

Hello,

1. I created web-server profile with next config:

• Severity: High, Critical
• Target: Server
• Protocol: HTTPS
• Action to BLOCK

2. Web Application Firewall Profile with default settings
3. Certificate Inspection

Disabled NAT, All Sesions, Inspection mode set to Proxy.
Service: HTTPS, DNS

To be honest for DNS I'm not sure, what would be the best case for that?

[AEK]

Hi

You don't need to open DNS access from external unless you have a DNS server to publish.