What do Fortigate interface roles (eg WAN, LAN, DMZ) actually do in terms of firewall behaviour?

[fry35]

When creating a Fortigate interface, I have to select an interface role as per the title (WAN/LAN/DMZ)

What behaviour does this role actually change https://omegle.onl/ ?

Thanks!

[dbhavsar]

Good day @fry35 

you can find more on this: https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/574723/interface-settings 

[Sheikh]

Hello @fry35 

FortiGate interface roles, such as WAN, LAN, and DMZ, play a significant role in how the firewall treats traffic passing through these interfaces. Each role is associated with certain default behaviors and security policies that help streamline the configuration process and enhance security.

WAN:

• Typically, strict security policies are applied to traffic entering through the WAN interface to protect the internal network from external threats.
• Connects the FortiGate to the external internet or other external networks.
• Outgoing traffic from the LAN to the WAN is often allowed, while incoming traffic from the WAN to the LAN is typically restricted unless specific policies are defined.
• Common use cases include managing public IP addresses, NAT (Network Address Translation), and applying security measures like IPS (Intrusion Prevention System) and antivirus.

LAN:

• By default, the LAN interface is configured to allow internal devices to communicate freely with each other.
• Traffic from the LAN to the WAN is usually permitted to allow internal users access to external resources.
• Security measures such as firewall policies, endpoint protection, and traffic shaping can be applied to manage internal traffic and control access to external networks.

DMZ:

• Provides a buffer zone between the WAN and the LAN, limiting direct exposure of the internal network to external threats.
• Traffic from the WAN to the DMZ is allowed based on specific policies to ensure only necessary and secure access.
• Traffic from the DMZ to the LAN is usually highly restricted to prevent potential security breaches.
• Security policies typically include rigorous monitoring, access control, and intrusion prevention to safeguard the DMZ-hosted services

I hope this clarifies your question.

regards,

Sheikh

[wmjosiah]

Hi there - you say "usually" - this all seems like best practices, but are any of these things applied by default when you set the predefined roles? That's not clear to me. For instance, I still had to create a rule to let LAN traffic out to the WAN, it seems.

[Toshi_Esumi]

This is more than one year old thread, but I doubt about the real restrictions of functions. I think it only affects to GUI config options.

For example, the 7.4.3 admin guide says below:
"Role
    ....
    - DMZ: Used to connected to the DMZ. When selected, DHCP server and Security mode are not available."
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/574723/interface-settings

However, when I configured below on my test FG60F:
config system interface
  edit "dmz"
    set vdom "root"
    set ip 10.10.111.1 255.255.255.0
    set allowaccess ping https fabric
    set type physical
    set device-identification enable
    set device-user-identification disable
    set lldp-reception enable
    set lldp-transmission enable
    set role dmz
    set snmp-index 3
  next
end
config system dhcp server
<snip>
  edit 3
    set default-gateway 10.10.111.1
    set netmask 255.255.255.0
    set interface "dmz"
    config ip-range
      edit 1
        set start-ip 10.10.111.101
        set end-ip 10.10.111.199
      next
    end
  next
end

not only my laptop on the DMZ port can pull an IP 10.10.111.101, but also I was able to login the 60F's admin GUI with the interface IP. Definitely "DHCP Server" section doesn't exist in GUI menu though.

It's running 7.4.8. And we regularly remove "unset role" in those config since if it's there it might create an address object automatically when we configure an IP/subnet, which caused some issue when we need to remove the interface config or recreate.

Toshi

[wmjosiah]

Yup, that matches my observations as well. Thanks for the clarification.