Fortigate Monitor/Log/Resport

-ForiView is moniitor &logging tool made up of a number of dashboards that show real time and historical logs.

-Configure Log/Report
-Enable Logging in Security Policy that you want to monitor
-Monitor using FortiView

Fortigate Port Forwarding

- port Forwarding is used to remote from outside to inside network without using VPN but not secure

Configure Port Forwarding :
-Configure Virtual IP
-Create Security Policy to allow outside access to local VIP
-incoming Interface -outgoing interface : WAN - LAN
-Source Address - Destination Address : Internet -VIP (local Web server)
-Service : HTTP,HTTPS

Fortigate IPSec/SSL VPN Configuration

- It's used to remote from public to private network to access local resource: Service & DATA
- It's secure tunnel connection by authentication & encrytion
- Type of VPN: IPSec & SSL

7.1 Configure IPSec VPN
- (Create VPN User)VPN-> User device-> create new -> user name : VPN1
- (Create VPN group) VPN->Group -> create New name - > group name : test -> add user VPN 1 to group test
- Create Policy to allow VPN user access to Internet
- Incoming Interface - Outgoing Interface : VPN -WAN មកពីក្រៅមកក្នុង Pre-share-key : password : Ex :12345
- Source Address  -Destination Address : VPN IP Range - Internet
- Service: HTTP, HTTPS, DNS
- Configure IPSec VPN -> VPN->IPSec-wizard->name : IPSec VPN -> Temple Type: remoteAcess ->Fortigate VPN

- Configure VPN Client (FortiClient)

7.2 Configure SSL VPN
- Create VPN User & Group
- Configure SSL VPN:
-SSL VPN Portal
-Edit Full Access
-Disable Split Tunneling
-Source IP Pool
-Configure Bookmark to remote to local server
-SSL VPN Setting:
-Listen Interface: WAN
-Restrict Access : Allow access from any host
-Server Cerfiticate : Fortinet Factory
-Tunnel Mode Client Setting : SSL VPN IP Range
- Authentication/Portal Mapping: VPN User Group: Full Access
-Create Policy to allow VPN access to LAN
-Incoming interface - Outgoing Interface: VPN - LAN
-Source Address -Destination Address: VPN IP Range/Group: -LAN
-Service : ALL
-Create Policy to allow VPN access to Internet
-Incoming interface - outgoing interface: VPN _WAN
-Source Address : Destonation Address : VPN IP Range/Group -Internet
-Service: HTTP ,HTTPS,DNS
-Configure VPN Client
-Tunnel mode : Forticlient
-Web mode : https://203.1.2.3:10443 : Public IP

FortiGate Firewall/NGFW Configuration

- Firewall : filter incoming & outgiing traffic by using Security Policy to allow or deny traffic

- Firewall Policy Process:
1. Check which Incoming & Outgoing Interface to filter
2. Check which Source & Destination IP address to filter
3. Check what Service to filter
4. Check When the policy to run
5. Check Action to allow or deny
Note : - Incoming Interface : is the interface that receive packet from ( ពីក្រៅមកក្នុង )
- Outgoing Interface :  is the interface that forward packet to  ( ពីក្នុងទៅក្រៅ )
Default Policy
  - Allow all network /Service + NAT
- Deny all Network /Service
- It search policy list from top to down for matching policy -> First match will apply first

FortiGate Traffix Shaping Configuration

5.1 Allow LAN access to Internet with only Web Access
- By Defult Policy : Allow all Network & Services from Internal to External ( Not Secure ) -> policy & Object
IPv4 policy -> create new -> Name : LAN Access , Incaming : client ( Internal )
Source : LAN, Descrition : 192.168.1.0/24

5.2 Allow Sys Admin access to Internet
- Usually Sys Admin need full access to Internet
- Policy&object - > Create new Policy to allow all network/ Services
- Incoming Interface - Outgoing Interface : LAN, WAN
- Source Address - Destination Address : 192.168.1.100 - Internet
- Service: ALL

5.3 Block User access to Internet
- policy&Object -> Create new Policy to block user access to Internet
- Incoming Interface -Outgoing Interface : LAN- WAN
- Source Address - Destination Address : 192.168.1.100 - Internet
  - Service : All

5.4 Block User access to Website using IP-Based
- Create New policy to block user access to specific website : test.com with IP address
- Incoming Interface - Outgoing Interface : LAN - WAN
- Source Address - Destination Address : 192.168.1.100 - test.com IP address
- Service: HTTP, HTTPS,DNS
 policy & object -> Name : block website
- Incoming : Internal LAN
- Outgoing : WAN 1

5.5. Block User access to Website using NGFW-based
- Create New Policy to block user access to specific website: facebook.com with NGFW
- Enable NGFW Policyp-based mode in System Setting
- Create Policy to block Facebook.com
- Incoming Interface -Outgoing Interface: :LAN -WAN
- Source Address -Destination Address : 192.168.1.100 - Internet
- Service : HTTP, HTTPS,DNS
- Application: Facebook
- Create SNAT
- Incoming to remote from public to private network to access local resources: Service & Data
- Source Address - Destination Address : 192.168.1.100 - Internet

Fortigate DMZ Configuration

4. Fortigate DMZ Configuration
-it's network that separate from untrusted network(internet) & trust network(LAN)
-it's used allow untrusted network to access servers in DMZ. Web server,ftp server, mail server...
-it's used to secure trust network(LAN) from untrusted network (Internet)
-Configure DMZ Network
-Configure Virtual IP for Web Server.
-Configure Policy for DMZ to forward from WAN to Web Server
-Configure Policy for DMZ to forward from LAN Web Server