understanding fortigate policies

[CNelson]

I am not 100% sure if this is the correct place to post this question, if not please let me know and I will re-post.

We use a Fortigate 200D with version 5.4.6 firmware. I am trying to get a better understanding on how traffic works when it comes to adding policies - both lan to wan and wan to lan. The trouble I am having is understanding if I need both internal to external as well as en external to internal policy set up for a specific application.

For example: we use lotus notes client for our emails and our mail server is hosted at an external location. I am wanting to set up secure communication to and from the mail server. with required IPs, ports and services, instead of all, all and all.

So here come the questions: 1. Do I set up an out going profile (lan to wan) to allow communication from the client to the mail server externally? (this one is a given) 2. Do I also set up a second profile (wan to lan) to allow external traffic from mail server to client? When lotus notes client requests/send email it uses a replication process to do this. I hope this makes sense as to what I am trying to ask/understand. Thank you

[tanr]

I'm not familiar with Lotus Notes, so bear that in mind.

In general you don't want to and shouldn't need to create wan to lan security policies unless you are hosting publicly accessible servers.  If you are hosting publicly accessible servers you'll usually create VIPs for them with as restrictive as possible wan to lan rules just specific services on those VIPs.  (And have the servers in a dmz, etc.)

Usually just specific lan to wan security policies are best.  This (usually) allows the FortiGate to function as a stateful firewall where once the lan to wan session is created, valid responses back (wan to lan) are allowed (depending your UTM settings and filters, etc.). 

If possible, your outbound policies should restrict which services are allowed to just what is needed.  Note that this can be difficult to implement in the real world.  Logging everything the security policies match, both for what is allowed and what is denied, can be very helpful.

For the mail server, a specific lan to wan rule from the subnet your clients are on to the mail server IP or IPs, allowing just the services your clients need is a good start.  A more secure step would be to add some UTM to the security policy, with certificate inspection and av scanning, etc.

[emnoc]

I think what your main objective is the real question. Is this client -2- server or server -2- client? What services?

Ken