Category Archives: FortiOS 5.6

Recurring schedule object

Leave a reply

Recurring schedule object

Recurring schedules are in effect repeatedly at specified times of specified days of the week. The Recurring schedule is based on a repeating cycle of the days of the week as opposed to every x days or days of the month. This means that you can configure the schedule to be in effect on Tuesday, Thursday, and Saturday but not every 2 days or on odd numbered days of the month.

If a recurring schedule has a stop time that is earlier than the start time, the schedule will take effect at the start time but end at the stop time on the next day. You can use this technique to create recurring schedules that run from one day to the next.

Configuring a Recurring schedule object in the GUI

  1. Go to Policy & Objects > Schedules.
  2. Select Create New. A drop down menu is displayed. Select Schedule.
  3. From the Type options, choose Recurring.
  4. Input a Name for the schedule object.
  5. If you which to add a Color to the icon in the GUI, you can click on the Change link to choose 1 of 32 color options.
  6. From the Days options, choose the day of the week that you would like this schedule to apply to. The schedule will be in effect on the days of the week that have a check mark in the checkbox to the left of the name of the weekday.
  7. If the scheduled time is the whole day, leave the All Day toggle switch enabled. If the schedule is for specific times during the day, disable the All Day toggle switch.
  8. If the All Day option is disabled, choose a Start Time.

The Start Time is composed of two fields, Hour and Minute. Think of setting the time for a digital clock in 24 hour mode. The Hour value can be an integer from 0 and 23. The Minute value can be from 0 to 59. 0 and 0 would be midnight at the start of the day and 23 and 59 would be one minute to midnight at the end of the day. The value can be entered by keyboard or by using the up and down arrows in the field to select the value.

  1. Choose a Stop Time.

Configuration is the same as Start Time.

  1. Press OK.

Because recurring schedules do not work with DENY policies, the strategy when designing a schedule should not be to determine when users cannot access a policy but to build the schedules around when it is possible to access the policy.

Example: Firewall Schedule – Recurring

The Company wants to allow the use of Facebook by employees, but only during none business hours and the lunch break.

  • The business hours are 9:00 p.m. to 6:00 p.m. l The Lunch break is 12:00 p.m. to 1:00 p.m.
  • The plan is to create a schedule to cover the morning business hours and the afternoon business hours and block access to the Facebook web site during that time.

Configuration in the GUI

  1. Go to Policy & Objects > Objects > Schedule.
  2. Select Create New > Schedule.
  3. Fill out the fields with the following information:
Type Recurring
Name Morning_Business_Hours
Days Monday, Tuesday, Wednesday, Thursday, Friday
Start Time Hour = 9, Minute = 0
Stop Time Hour = 12, Minute = 0
  1. Select OK.
  2. Create a second new schedule.
Type Recurring
Name Morning_Business_Hours
Days Monday, Tuesday, Wednesday, Thursday, Friday
Start Time Hour = 13, Minute = 0
Stop Time Hour = 18, Minute = 0
  1. Select OK.

To verify that the schedule was added correctly:

  1. Go to Policy & Objects > Objects > Schedule.
  2. Check that the schedule with the name you used has been added to the list of recurring schedules and that the listed settings are correct.

Configuration in the CLI

  1. Enter the following CLI command:

config firewall schedule recurring edit Morning_Business_Hours set day monday tuesday wednesday thursday friday set start 09:00 set end 12:00

end

  1. Enter the following CLI command:

config firewall schedule recurring edit Afternoon_Business_Hours set day monday tuesday wednesday thursday friday set start 13:00 set end 18:00

end

To verify that the schedule was added correctly:

  1. Enter the following CLI command:

config firewall schedule recurring

edit <the name of the schedule you wish to verify> show full-configuration

 

Schedule

One-time schedule object

Leave a reply

One-time schedule object

One-Time schedules are in effect only once for the period of time specified in the schedule. This can be useful for testing to limit how long a policy will be in effect in case it is not removed, or it can be used for isolated events such as a conference where you will only need a temporary infrastructure change for a few days.

The time frame for a One-time schedule is configured by using a start time which includes, Year | Month | Day | Hour | Minute and a Stop time which includes the same variables. So while the frequency of the schedule is only once it can last anywhere from 1 minute to multiple years. Configuring a One-time schedule object in the GUI

  1. Go to Policy & Objects > Schedules.
  2. Select Create New. A drop down menu is displayed. Select Schedule.
  3. From the Type options, choose One-time.
  4. Input a Name for the schedule object.
  5. If you which to add a Color to the icon in the GUI, you can click on the Change link to choose 1 of 32 color options.
  6. Choose a Start Date.

Selecting the field with the mouse will bring up a interactive calendar graphic that will allow the user to select the date. The date can also be typed in using the format YYYY/MM/DD.

  1. Choose a Start Time.

The Start Time is composed of two fields, Hour and Minute. Think of setting the time for a digital clock in 24 hour mode. The Hour value can be an integer from 0 and 23. The Minute value can be from 0 to 59. 0 and 0 would be midnight at the start of the day and 23 and 59 would be one minute to midnight at the end of the day. The value can be entered by keyboard or by using the up and down arrows in the field to select the value.

  1. Choose an End Date.

Configuration is the same as Start Date.

  1. Choose a Stop Time.

Configuration is the same as Start Time.

  1. Enable/Disable Pre-expiration event log.

This configures the system to create an event log 1 to 100 days before the End Date as a warning in case the schedule needs to be extended.

  1. If the Pre-expiration event log is enabled, set the value for Number of days before.
  2. Press OK.

Example: Firewall Schedule – One-time

The company wants to change over their web site image to reference the new year. They have decided to take this opportunity to do some hardware upgrades as well. Their web site is business oriented so they have determined that over New Year’s Eve there will be very limited traffic. l They are going to need a maintenance window of 2 hours bracketing midnight on New Year’s Eve.

Configuration in the GUI

  1. Go to Policy & Objects > Objects > Schedule.
  2. Select Create New > Schedule.
  3. Fill out the fields with the following information:
Type   One-time
Name   NewYearsEve_Maintenance
Start Date   2014/12/31 <use the built in calendar>
End Date   2015/01/01 <use the built in calendar>
Start Time   Hour: 23, Minute: 0
Stop Time Hour: 1Minute: 0
Pre-expiration event log <disable>
  1. Select OK.

To verify that the schedule was added correctly:

  1. Go to Policy & Objects > Objects > Schedule.
  2. Check that the schedule with the name you used has been added to the list of recurring schedules and that the listed settings are correct.

Configuration in the CLI

  1. Enter the following CLI command:

config firewall schedule onetime edit maintenance_window set start 23:00 2012/12/31 set end 01:00 2013/01/01

next

end

To verify that the schedule was added correctly:

  1. Enter the following CLI command:

config firewall schedule onetime edit <the name of the schedule you wish to verify> show full-configuration

Services

Leave a reply

Services

While there are a number of services already configured within FortiOS, the firmware allows for administrators to configure there own. The reasons for doing this usually fall into one or more of the following categories:

  • The service is not common enough to have a standard configuration l The service is not established enough to have a standard configuration l The service has a standard port number but there is a reason to use a different one:
  • Port is already in use by another service l For security reasons, want to avoid standard port

When looking at the list of preconfigured services it may seem like there are a lot, but keep in mind that the theoretical limit for port numbers is 65,535. This gives a fairly good sized range when you are choosing what port to assign a service but there are a few points to keep in mind.

  • Most of the well known ports are in the range 0 – 1023 l Most ports assigned by the Internet Corporation for Assigned Names and Numbers (ICANN) will be in the 1024 –

49151 range l Port numbers between 49,152 and 65,535 are often used for dynamic, private or ephemeral ports.

There are 3 Service objects that can be added and configured:

l Categories l Services l Service Groups

Categories

In order to make sorting through the services easier, there is a field to categorize the services. Because selecting a category is part of the process for creating a new service, the configuration of categories will be explained first.

The services can be sorted into the following groups:

  • General l Web Access l File Access l Email l Network Services l Authentication l Remote Access l Tunneling l VoIP, Messaging and Other Applications l Web Proxy
  • Uncategorized

The categories are for organization purposes so there is not many settings when creating a new one.

Creating a new Service Category

  1. Go to Policy & Objects > Services.
  2. Select Create New. A drop down menu is displayed. Select Category
  3. Input a Name for the category.
  4. Input any additional information in the Comments
  5. Press OK.

Example

You plan on adding a number of devices such as web cameras that will allow the monitoring of the physical security of your datacenter. A number of non-standard services will have to be created and you would like to keep them grouped together under the heading of “Surveillance”

Example of a New Category in the GUI

  1. Go to Policy & Objects > Objects > Services and select Create New > Category.
  2. Fill out the fields with the following information
Field   Value
Name   Surveillance
Comments   For DataCenter Surveillance Devices
  1. Select

Example of a New Category in the CLI

Enter the following CLI command:

config firewall service category edit Surveillance set comment “For DataCenter Surveillance Devices” end

To verify that the category was added correctly:

  1. Go to Policy & Objects > Objects > Services. Select the Category Settings icon . A listing of the categories should be displayed.
  2. Enter the following CLI command:

config firewall service category show

This should bring up all of the categories. Check to see that the new one is displayed.

Configuring a new service

Occasionally, the preconfigured list of services will not contain the needed service. There are a few variations in the creation of a service depending upon the protocol type, but the first steps in the creation of the service are common to all the variations.

To create a new service:

  1. Go to Policy & Objects > Services.
  2. Select Create New. A drop down menu is displayed. Select Service
  3. Enter a name in the Name field for the new service
  4. Include any description you would like in the Comments field
  5. In the Service Type field choose between Firewall and Explicit Proxy.
  6. Enable the toggle in the Show in Service List. If you can’t see the service when you need to select it, it serves very little purpose.
  7. For the Category field, choose the appropriate category from the Category drop down menu. If none is chosen, the Uncategorized option will be chosen by default.

Protocol Options

This is the section where the configuration options of the service will differ depending on the type of protocol chosen. (The Step numbers will all continue on from the common step sequence).

The protocol options for Firewall service type are: l TCP/UDP/SCTP l ICMP l ICMP6 l IP

The protocol options for Proxy service type are: l ALL l CONNECT l FTP l HTTP l SOCKS-TCP l SOCKS-UDP

TCP/UDP/SCTP

  1. For the Protocol Type field, choose TCP/UDP/SCTP from the drop down menu
  2. For the Address field, choose IP Range or FQDN (Fully Qualified Domain Name) if there is to be a specific destination for the service. Depending on which type of address is selected, the field value needs to be filled with a FQDN string or an IP address in one of the 3 standard IPv4 address formats: l x.x.x – for a specific address l x.x.x.x/x – for a subnet l x.x.x.x-x.x.x.x – for a range of specific addresses
  3. Configure the Destination Port by:
  • Select from the drop down menu, TCP, UDP or SCTP l Enter the low end to the port range in the field indicated by grayed out Low.
  • Enter the high end of the port range in the field indicated by grayed out High. If there is only a single port in the

range High can be left empty

  • Multiple ports or port ranges can be added by using the “+” at the beginning of the row l Rows can be removed by using the trash can symbol at the end of the row
  1. If required, you can Specify Source Ports for the service by enabling the toggle switch. l The Src Port will match up with a Destination Port l Src Ports cannot be configured without there being a value for the Destination Port l The same rules for configuring the Destination Ports applies to the Src Ports
  2. Select OK to confirm the configuration

Example

Example settings for a TCP protocol service. In this case, it is for an administrative connection to web servers on the DMZ. The protocol used is HTTPS which would normally use port 443, but that is already in use by another service such as Admin access to the firewall or an SSL-VPN connection.

Field Value
Name Example.com_WebAdmin
Comments Admin connection to Example.com Website
Service Type Firewall
Show in Service List enabled
Category Web Access
Protocol Options  
Protocol Type TCP/UDP/SCTP
IP/FQDN <left blank>
Destination Port l  Protocol: TCP l Low: 4300

l  High: <left blank>
Specify Source Ports <disabled>

Creating a new TCP/UDP/SCTP service in the CLI

The following is the creation of the same service using the command line.

config firewall service custom edit Example.com_WebAdmin set comment “Admin connection to Example.com Website”

set category Web Access set protocol TCP/UDP/SCTP set tcp-portrange 4300

end

end

ICMP / ICMP6

  1. For the Protocol Type field, choose ICMP or ICMP6 from the drop down menu
  2. In the Type field enter the appropriate type number based on the information found in “ICMP Types and Codes” on page 1 or in “ICMPv6 Types and Codes” on page 1, depending on whether the Protocol Type is ICMP or ICMPv6
  3. In the Code field enter the appropriate code number for the type, if applicable, based on the information found in

“ICMP Types and Codes” on page 1 or in “ICMPv6 Types and Codes” on page 1, depending on whether the Protocol Type is ICMP or ICMPv6

  1. Select OK to confirm the configuration

Example

Example settings for an ICMP.service.In this case it has been set up for some special testing of ICMP packets.

Field Value
Name ICMP test #4
Comments For testing of proprietary network scanner
Service Type Firewall
Show in Service List enabled
Category Network Services
Protocol Options  
Protocol Type ICMP
Type 7
Code <left blank>

Creating a new ICMP service in the CLI

The following is the creation of the same service using the command line.

config firewall service custom edit ICMP test4 set comment “For testing of proprietary network scanner” set category Network Services set protocol ICMP set icmptype 7 end

end

IP

  1. For the Protocol Type field, choose IP from the drop down menu
  2. In the Protocol Number field enter the numeric value based on the information found in “Protocol Number” on page 1
  3. Select OK to confirm the configuration

Example

Example settings for an IP.service.In this case it has been set up to communicate via an old protocol called QNX

Field Value
Name QNX
Comments For QNX communications to the Development Lab
Service Type Firewall
Show in Service List enabled
Category Uncatagorized
Protocol Options  
Protocol Type IP
Protocol Number 106

Creating a new ICMP service in the CLI

The following is the creation of the same service using the command line.

config firewall service custom edit ICMP test4 set comment “For QNX communications to the Development Lab ” set protocol IP set icmptype 106

end

end

In the CLI examples, the fields for Show in Service List, Service Type and in the example for IP, Category were net set because the values that they would have been set to were the default values and were already correctly set.

ALL/CONNECT/FTP/HTTP/SOCKS-TCP/SOCKS-UDP

These options are available only if the Service Type is set to Explicit Proxy.

  1. For the Protocol Type field, choose one of the following from the drop down menu:
    • ALL l CONNECT l FTP l HTTP l SOCKS-TCP l SOCKS-UDP
  2. For the Address field, choose IP Range or FQDN (Fully Qualified Domain Name) if there is to be a specific destination for the service. Depending on which type of address is selected, the field value needs to be filled with a FQDN string or an IP address in one of the 3 standard IPv4 address formats: l x.x.x – for a specific address l x.x.x.x/x – for a subnet l x.x.x.x-x.x.x.x – for a range of specific addresses
  3. Configure the Destination Port by:
    • Enter the low end to the TCP port range in the field indicated by grayed out Low.
    • Enter the high end of the TCP port range in the field indicated by grayed out High. If there is only a single port in the range High can be left empty
    • Multiple ports or port ranges can be added by using the “+” at the beginning of the row l Rows can be removed by using the trash can symbol at the end of the row
  4. If required, you can Specify Source Ports for the service by enabling the toggle switch. l The Src Port will match up with a Destination Port l Src Ports cannot be configured without there being a value for the Destination Port l The same rules for configuring the Destination Ports applies to the Src Ports
  5. Select OK to confirm the configuration

Specific Addresses in TCP/UDP/SCTP

In the TCP/UDP/SCTP services it is also possible to set the parameter for a specific IP or Fully Qualified Domain Name address. The IP/FQDN field refers to the destination address of the traffic, not the source. This means for example, that you can set up a custom service that will describe in a policy the TCP traffic over port 80 going to the web site example.com, but you cannot set up a service that describes the TCP traffic over port 80 that is coming from the computer with the address 192.168.29.59.

Service Groups

Just like some of the other firewall components, services can also be bundled into groups for ease of administration.

Creating a ServiceGroup

  1. Go to Policy & Objects > Services.
  2. Select Create New. A drop down menu is displayed. Select Service Group
  3. Input a Group Name to describe the services being grouped

 

  1. Input any additional information in the Comments
  2. Choose a Type of group.The options are Firewall or Explicit Proxy.
  3. Add to the list of Members from the drop down menu. Using the + sign beside the field will allow the addition of multiple services.
  4. Press OK.

Example

Example of a New Service Group:

Field Value
Group Name Authentication Services
Comments Services used in Authentication
Type Firewall
Members l Kerberos l LDAP l LDAP_UDP l RADIUS

Firewall schedules

Firewall schedules control when policies are in effect. When you add a security policy on a FortiGate unit you need to set a schedule to determine the time frame in which that the policy will be functioning. While it is not set by default, the normal schedule would be always. This would mean that the policy that has been created is always function and always policing the traffic going through the FortiGate. The time component of the schedule is based on a 24 hour clock notation or military time as some people would say.

There are two types of schedules: One-time schedules and recurring schedules.

Configuring IP pools

Leave a reply

Configuring IP pools

An IP pool is essentially one in which the IP address that is assigned to the sending computer is not known until the session is created, therefore at the very least it will have to be a pool of at least 2 potential addresses. A quick example would be an IP pool for users of a VPN. IP pools are based upon the version of IP determined by the interface that they are associated with so as expected there are two types of IP pools that can be configured:

l “Creating a IPv4 Pool” on page 189 l “Creating a IPv6 Pool” on page 193

Because of the differences in the configuration for the two types of pools, instructions for configuring them will be done separately.

Creating a IPv4 Pool

  1. Go to Policy & Objects > IP Pools.
  2. Select Create New.
  3. In the IP Pool Type field choose IPv4 Pool
  4. Enter a name in the Name field for the new service Include any description you would like in the Comments field
  5. In the Type field choose between:

l Overload l One-to-One l Fixed Port Range l Port Block Allocation

At this point the configurations can start to differ based on the type of type of pool.

For more information on the different types of IP pools, check IP Pools in the Concepts section.

Overload

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Enable the ARP Reply field by making sure there is a check in the box
  3. Select OK

Configuring IP pools

Overload Example for GUI

In this example, the Sales team needs to connect to an Application Service Provider that does the accounting for the company. As a security measure, the ASP only accepts traffic from a white list of IP addresses. There is 1 public IP address of the company on that list.The Sales team consists of 40 people, so they need to share.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Name Sales_Team
Comments For the Sales team to use to connect to the Accounting ASP
Type Overload (This is the default)
External IP Range 10.23.56.20 – 10.23.56.20
ARP Reply enabled

Overload Example for CLI

config firewall ippool edit Sales_Team set comments “For the Sales team to use to connect to the Accounting ASP” set type overload set startip 10.23.56.20 set endip 10.23.56.20 set arp-reply enable set arp-intf wan1 end

One-to-one
  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Enable the ARP Reply field by making sure there is a check in the box.
  3. Select OK

One-to-one Example for GUI

In this example, the external IP address of the mail server is part of a range assigned to the company but not the one that is assigned to the Internet facing interface. A VIP has been set up but in order to properly resolve

Reverse DNS lookups the mail server always has to use a specific IP address.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Field Value
Name Mail-Server
Comments So the the correct IP address is resolved on Reverse DNS look ups of the mail server.
Type One-to-one
External IP Range 10.23.56.21 – 10.23.56.21
ARP Reply enabled

One-to-one Example for CLI

config firewall ippool edit Mail-Server set comments “So the the correct IP address is resolved on reverse DNS look ups of the mail server.”

set type one-to-one set startip 10.23.56.21 set endip 10.23.56.21 set arp-reply enable set arp-intf wan1 end

Fixed Port Range
  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Fort the Internal IP Range fields, enter the lowest and highest addresses in the range.
  3. Enable the ARP Reply field by making sure there is a check in the box
  4. Select OK

Fixed Port Range Example for GUI

In this example, the company has a range of 10 IP address that they want to be used by employees on a specific subnet for NATing.The external interface is wan1.

Field   Value
IP Pool Type   IPv4 Pool
Name   IPPool-3
Comments   IP range to be used by outgoing traffic
Type   Fixed Port Range
External IP Range   10.23.56.22 – 10.23.56.31

Configuring IP pools

Field Value
Internal IP Range 192.168.23.1 – 192.168.23.254
ARP Reply enabled

Fixed Port Range Example for CLI

config firewall ippool edit IPPool-3 set comments “So the the correct IP address is resolved on reverse DNS look ups of the mail server.”

set type fixed-port-range set startip 10.23.56.22 set endip 10.23.56.31 set source-startip 192.168.23.1 set source-endip 192.168.23.254 set arp-reply enable set arp-intf wan1 end

Port Block Allocation
  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. In the Block Size field, either type in the value or use the up or down arrows to set the value of the block size.
  3. In the Blocks Per User field, either type in the value or use the up or down arrows to set the value for the number of blocks per user.
  4. Enable the ARP Reply field by making sure there is a check in the box
  5. Select OK

Port Block Allocation Example for GUI

In this example,an small ISP is setting up NATing for its clients, but to be fair it is putting some restrictions on the number of connections each client can have so that no one hogs all of the possible ports and addresses.The external interface is port12.

Field Value
IP Pool Type IPv4 Pool
Name Client-IPPool
Comments IP Pool for clients to access the Internet
Type Port Block Allocation
External IP Range 10.23.75.5 – 10.23.75.200
Block Size 64
Field Value
Blocks Per User 8
ARP Reply enabled

Port Block Allocation Example for CLI

config firewall ippool edit Client-IPPool set comments “IP Pool for clients to access the Internet”

set type port-block-allocation set startip 10.23.75.5 set endip 10.23.75.200 set block-size 64 set num-blocks-per-user 8 set permit-any-host disable set arp-intf wan1 set arp-reply enableset arp-intf port12 end

Creating a IPv6 Pool

  1. Go to Policy & Objects > IP Pools.
  2. Select Create New.
  3. In the IP Pool Type field choose IPv6 Pool
  4. Enter a name in the Name field for the new service
  5. Include any description you would like in the Comments field
  6. For the External IP Range fields, enter the lowest and highest addresses in the range.

IPv6 Example for GUI

In this example,there is a similar situation to the One-to-one example earlier.There is a mail server that needs to be resolved to a specific IP address in Reverse DNS look-ups. The difference in this case is the company is an early adopter of IPv6 connectivity to the Internet.

Field Value
IP Pool Type IPv6 Pool
Name Mail-svr-ipv6
Comments Registered IPv6 address for mail server
External IP Range fd2f:50ec:cdea:0663::1025 – fd2f:50ec:cdea:0663::1025

Port Block Allocation Example for CLI

config firewall ippool6 edit Mail-svr-ipv6

 

set comments “Registered IPv6 address for mail server”

set startip fd2f:50ec:cdea:663::102 set endip fd2f:50ec:cdea:663::1025 end

Virtual IPs

12 Replies

Virtual IPs

The mapping of a specific IP address to another specific IP address is usually referred to as Destination NAT.

When the Central NAT Table is not being used, FortiOS calls this a Virtual IP Address, sometimes referred to as a VIP. FortiOS uses a DNAT or Virtual IP address to map an External IP address to an IP address. This address does not have to be an individual host, it can also be an address range. This mapping can include all TCP/UDP ports or if Port Forwarding is enabled it will only refer to the specific ports configured. Because, the Central NAT table is disabled by default the term Virtual IP address or VIP will be used predominantly.

Virtual IP addresses are typically used to NAT external or Public IP addresses to internal or Private IP addresses. Using a Virtual IP address between 2 internal Interfaces made up of Private IP addresses is possible but there is rarely a reason to do so as the 2 networks can just use the IP addresses of the networks without the need for any address translation. Using a Virtual IP address for traffic going from the inside to the Internet is even less likely to be a requirement, but it is supported.

Something that needs to be considered when there are multiple Public IP addresses on the external interface(s) is that when a Virtual IP address is used without Port Forwarding enabled there is a reciprocal effect as far as traffic flow is concerned. Normally, on a firewall policy where NAT is enabled, for outgoing traffic the internal address is translated to the Public address that is assigned to the FortiGate, but if there is a Virtual IP address with no port forwarding enabled, then the Internal IP address in the Mapped field would be translated to the IP address configured as the External Address in the VIP settings.

Example

  • The assigned External address (WAN1) of the FortiGate unit is 172.12.96.3 with a subnet mask of 255.255.255.128 l There is a Virtual IP address set up to map the external address 172.12.96.127 on WAN1 to the internal IP address of 192.168.1.127
  • Port Forwarding is not enabled because you want all allowed traffic going to the external IP address to go to this server.

In this case any outbound traffic from 192.168.1.127 will go out on WAN1 with the IP address of 172.12.96.127 as the source IP address.

In terms of actually using the Virtual IP address, they would be using in the security policies in the same places that other addresses would be used, usually as a Destination Address.

UUID Support for VIP

UUID is now supported in for virtual IPs and virtual IP groups. This includes virtual IPs for IPv4, IPv6, NAT46, and NAT64. To view the UUID for these objects in a FortiGate unit’s logs, log-uuid must be set to extended mode, rather than policy-only (which only shows the policy UUID in a traffic log). UUID can only be configured through the CLI

Syntax

config sys global set log-uuid {disable | policy-only | extended}

end

There is another type of address that the term “virtual IP address” commonly refers to which is used in load balancing and other similar configurations. In those cases, a number of devices share a separately created virtual IP address that can be sent to multiple possible devices. In FortiOS these are referred to as Virtual Servers and are configured in the “Load Balance” section.

If Central-NAT is enabled in the CLI the GUI will be different.

Instead of VIP Type, the field lable will be DNAT & VIP Type

Instead of IPv4 the option will be IPv4 DNAT

There will also be the addition setting of Source Interface Filter.

Commands to set central-nat:

config system settings set central-nat [enable | disable] end

Creating a Virtual IP

  1. Go to Policy & Objects > Virtual IPs.
  2. Select Create New. A drop down menu is displayed. Select Virtual IP.
  3. From the VIP Type options, choose an applicable type based on the IP addressing involved. Which is chosen will depend on which of the IP version networks is on the external interface of the FortiGate unit and which is on the internal interface.

The available options are:

l IPv4 – IPv4 on both sides of the FortiGate Unit. l IPv6 – IPv6 on both sides of the FortiGate Unit. l NAT46 – Going from an IPv4 Network to an IPv6 Network. l NAT64 – Going from an IPv6 Network to an IPv4 Network.

  1. In the Name field, input a unique identifier for the Virtual IP.
  2. Input any additional information in the Comments
  3. The Color of the icons that represent the object in the GUI can be changed by clicking on the [Change] link and choosing from the 32 colors.

Because the configuration differs slightly for each type the next steps will be under a separate heading based on the type of the VIP

Configuring a VIP for IPv4

In the Network section:

  1. If an IPv4 type of Virtual IP, select the Interface

Using the drop down menu for the Interface Field, choose the incoming interface for the traffic.

The IPv4 VIP Type is the only one that uses this field. This is a legacy function from previous versions so that they can be upgraded without complicated reconfiguration. The External IP address, which is a required field, tells the unit which interface to use so it is perfectly acceptable to choose “any” as the interface. In some configurations, if the Interface field is not set to “any” the Virtual IP object will not one of the displayed options when choosing a destination address.

  1. Configure the External IP Address/Range.

There are two fields. If there is a single IP address, use that address in both fields. This will be the address on the outside of the network that is usually the public address of the server. The format of the address will depend on the VIP Type option that was selected.

  1. Configure the Mapped IP Address/Range. This will be the address that the traffic is being directed to.

There are two fields. If there is a single IP address, use that address in both fields. The format of the address will depend on the VIP Type option that was selected. In the Optional Filters

  1. Disable/Enable the Optional Filters.

If only specific IP addresses and/or services are allowed to be the source for traffic using the VIP, enable the Optional Filters.

  1. To specify an allowed address enter the value in the field labeled Source Address. The value can be formatted in three different ways.

l Source IP – Use the standard format for a single IP address l Range – Enter the first and last members of the range l Subnet – Enter the IP address of the broadcast address for the subnet.

To add additional addresses, click on the “+” below the last field with an address. To subtract an address, click on the “X” next to the field you wish to delete.

  1. To specify an allowed Service, toggle the Services option to enabled. Set the Services parameter by selecting the field with the “+” in the field. This will slide a window out from the right. Single or multiple options can be selected by highlighting the services wanted, unless the ALL option is chosen, in which case it will be the only option. For more information on services, check the Firewall Objects section called Services and TCP ports.
  2. Disable/Enable Port Forwarding. If only the traffic for a specific port or port range is being forwarded, enable this setting.
  3. Select the Protocol from l TCP l UDP l SCTP l ICMP
  4. Configure the External Service Port. This is the port(s) on the external interface of the FortiGate (the destination port in the header of the packets). The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
  5. Configure the setting Map to Port.This will be the listening port on the device located on the internal side of the network. It does not have to be the same as the External Service Port. The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
  6. Press

Example

This example is for a VIP that is being used to direct traffic from the external IP address to a web server on the internal network. The web server is for company use only. The company’s public facing web server already used port 80 and there is only one IP external IP address so the traffic for this server is being listened for on port 8080 of the external interface and being sent to port 80 on the internal host.

Field Value
VIP Type IPv4
Name Internal_Webserver
Comments Web server with Collaboration tools for Corporate employees
Interface Any
Field Value
External IP

Address/Range

 172.13.100.27 <this would normally be a public IP address>
Mapped IP

Address/Range

 192.168.34.150
Optional Filters enabled
Source Address

Filter

 <list of IP addresses of remote users>
Services enabled with HTTP in the list
Port Forwarding enabled
Map to Port 80 – 80

Configuring a VIP for IPv6

In the Network section:

  1. Configure the External IP Address/Range.

There are two fields. If there is a single IP address, use that address in both fields. This will be the address on the outside of the network that is usually the public address of the server. Enter the address in the standard IPv6 format.

  1. Configure the Mapped IP Address/Range. This will be the address that the traffic is being directed to.

There are two fields. If there is a single IP address, use that address in both fields. Enter the address in the standard IPv6 format.

In the Optional Filters

  1. Disable/Enable the Optional Filters.

If only specific IP addresses and/or services are allowed to be the source for traffic using the VIP, enable the Optional Filters.

  1. To specify an allowed address enter the value in the field labeled Source Address. The value can be formatted in three different ways.

l Source IP – Use the standard format for a single IP address l Range – Enter the first and last members of the range l Subnet – Enter the IP address of the broadcast address for the subnet.

To add additional addresses, click on the “+” below the last field with an address. To subtract an address, click on the “X” next to the field you wish to delete.

  1. Disable/Enable Port Forwarding. If only the traffic for a specific port or port range is being forwarded, enable this setting.
  2. Select the Protocol from l TCP l UDP

l SCTP

  1. Configure the External Service Port. This is the port(s) on the external interface of the FortiGate (the destination port in the header of the packets). The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
  2. Configure the setting Map to Port.This will be the listening port on the device located on the internal side of the network. It does not have to be the same as the External Service Port. The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
  3. Press

Configuring a VIP for NAT46

In the Network section:

  1. Configure the External IP Address/Range.

There are two fields. If there is a single IP address, use that address in both fields. This will be the address on the outside of the network that is usually the public address of the server. Enter the address in the standard IPv4 format.

  1. Configure the Mapped IP Address/Range. This will be the address that the traffic is being directed to.

There are two fields. If there is a single IP address, use that address in both fields. Enter the address in the standard IPv6 format.

In the Optional Filters

  1. Disable/Enable the Optional Filters.

If only specific IP addresses and/or services are allowed to be the source for traffic using the VIP, enable the Optional Filters.

  1. To specify an allowed address enter the value in the field labeled Source Address. The value can be formatted in three different ways.

l Source IP – Use the standard format for a single IP address l Range – Enter the first and last members of the range l Subnet – Enter the IP address of the broadcast address for the subnet.

To add additional addresses, click on the “+” below the last field with an address. To subtract an address, click on the “X” next to the field you wish to delete.

  1. Disable/Enable Port Forwarding. If only the traffic for a specific port or port range is being forwarded, enable this setting.
  2. Select the Protocol from l TCP l UDP
  3. Configure the External Service Port. This is the port(s) on the external interface of the FortiGate (the destination port in the header of the packets). The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
  4. Configure the setting Map to Port.This will be the listening port on the device located on the internal side of the network. It does not have to be the same as the External Service Port. The first field is for the first port in the

range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.

  1. Press

Configuring a VIP for NAT64

In the Network section:

  1. Configure the External IP Address/Range.

There are two fields. If there is a single IP address, use that address in both fields. This will be the address on the outside of the network that is usually the public address of the server. Enter the address in the standard IPv6 format.

  1. Configure the Mapped IP Address/Range. This will be the address that the traffic is being directed to.

There are two fields. If there is a single IP address, use that address in both fields. Enter the address in the standard IPv4 format.

In the Optional Filters

  1. Disable/Enable the Optional Filters.

If only specific IP addresses and/or services are allowed to be the source for traffic using the VIP, enable the Optional Filters.

  1. To specify an allowed address enter the value in the field labeled Source Address. The value can be formatted in three different ways.

l Source IP – Use the standard format for a single IP address l Range – Enter the first and last members of the range l Subnet – Enter the IP address of the broadcast address for the subnet.

To add additional addresses, click on the “+” below the last field with an address. To subtract an address, click on the “X” next to the field you wish to delete.

  1. Disable/Enable Port Forwarding. If only the traffic for a specific port or port range is being forwarded, enable this setting.
  2. Select the Protocol from l TCP l UDP
  3. Configure the External Service Port. This is the port(s) on the external interface of the FortiGate (the destination port in the header of the packets). The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
  4. Configure the setting Map to Port.This will be the listening port on the device located on the internal side of the network. It does not have to be the same as the External Service Port. The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
  5. Press

FQDN in VIPs

Instead of mapping to an IP address a VIP can use a FQDN(Fully Qualified Domain Name). This has to be configured in the CLI and the FQDN must be an address object that is already configured in the address listing.

The syntax for using a FQDN is:

config firewall vip edit <VIP id> set type fqdn

set mappped-addr <FQDN address object> end

Dynamic VIP according to DNS translation

When a dynamic virtual IP is used in a policy, the dynamic DNS translation table is installed along with the dynamic NAT translation table into the kernel. All matched DNS responses will be translated and recorded regardless if they hit the policy. When a client request hits the policy, dynamic NAT translation will occur if it matches a record, otherwise the traffic will be blocked.

Syntax

config firewall vip edit “1” set type dns-translation set extip 192.168.0.1-192.168.0.100

set extintf “dmz” set dns-mapping-ttl 604800 set mappedip “3.3.3.0/24” “4.0.0.0/24” end end

Virtual IP Groups

Just like other address, Virtual IP addresses can be organized into groups for ease of administration. If you have multiple virtual IPs that are likely to be associated to common firewall policies rather than add them individually to each of the policies you can add the instead. That way, if the members of the group change then any changes made to the group will propagate to all of the policies using that group.

When using a Virtual IP address group the firewall policy will take into account all of the configured parameters of the Virtual IPs: IP addresses, Ports and port types.

Creating a Virtual IP Group

  1. Go to Policy & Objects > Virtual IPs.
  2. Select Create New. A drop down menu is displayed. Select Virtual IP Group.
  3. Select the Type fo VIP group you wish to create. The options available are:

l IPv4 – IPv4 on both sides of the FortiGate Unit. l IPv6 – IPv6 on both sides of the FortiGate Unit. l NAT46 – Going from an IPv4 Network to an IPv6 Network. l NAT64 – Going from an IPv6 Network to an IPv4 Network.

Which is chosen will depend on which of the IP version networks is on the external interface of the

 

FortiGate unit and which is on the internal interface. The options will be:

  1. Enter a unique identifier for the group in the Name
  2. Enter any additional information in the Comments
  3. If you wish, use the Change link to change the Color of icons in the GUI. There are 32 color options.
  4. If the Type is IPv4, the Interface field will be available. Use the drop-down menu to select the interface if all of the VIPs are on the same interface. If any of the VIPS are on different interfaces or if any of them are associated with the “any” option, choose the any option for the group.
  5. Select anywhere in the Members field to bring forth the pane of potential members for selection to the group.
  6. Press

Address Groups

Leave a reply

Address Groups

Address groups are designed for ease of use in the administration of the device. If you have a number of addresses or address ranges that will commonly be treated the same or require the same security policies, you can put them into address groups, rather than entering multiple individual addresses in each policy refers to them.

The use of groups is not required. If you have a number of different addresses you could add them individually to a policy and the FortiGate firewall will process them just as quickly and efficiently as if they were in a group, but the chances are that if you have used a group once you could need to use it again and depending on the number of addresses involved entering them individually for each policy can become tedious and the likelihood of an address being missed becomes greater. If you have a number of policies using that combination of addresses it is much easier to add or subtract addresses from the group than to try and remember all of the firewall policies that combination of addresses was used in. With the group, you only have to make the one edit and it is used by any firewall policy using that address group.

Because security policies require addresses with homogenous network interfaces, address groups should contain only addresses bound to the same network interface, or to Any.

For example, if address 1.1.1.1 is associated with port1, and address 2.2.2.2 is associated with port2, they cannot be in the same group. However, if 1.1.1.1 and 2.2.2.2 are configured with an interface of Any, they can be grouped, even if the addresses involve different networks. There are 3 Categories of Address groups to choose from:

l IPv4 Group l IPv6 Group l Proxy Group

You cannot mix different categories of addresses within a group, so whether or not it makes sense from an administrative purpose to group certain addresses together, if some are IPv4 and some are IPv6, it cannot be done.

Creating an Address Group

  1. Go to Policy & Objects > Addresses.
  2. Select the down arrow next to Create New, select Address Group.
  3. Choose the Category, that is applicable to the proposed selection of addresses.
  4. Input a Group Name for the address object.

Depending on which Category has been chosen the configurations will differ slightly

IPv4 Group

  1. Select the “+” in the Members You can select members of the group from the window that slides out from the left of the screen. It is possible to select more than 1 entry. Select the “X” icon in the field to remove an entry.
  2. Select the desired on/off toggle setting for Show in Address List.
  3. Select the desired on/off toggle setting for Static Route Configuration .

IPv6 Group

  1. Select the “+” in the Members You can select members of the group from the window that slides out from the left of the screen. It is possible to select more than 1 entry. Select the “X” icon in the field to remove an entry.
  2. Select the desired on/off toggle setting for Show in Address List.

Proxy Group

  1. Select which Type, either Source Group or Destination Group.
  2. Select the “+” in the Members You can select members of the group from the window that slides out from the left of the screen. It is possible to select more than 1 entry. Select the “X” icon in the field to remove an entry.
  3. Select the desired on/off toggle setting for Show in Address List.

Irrespective of the Category the groups all have the same final configuration options:

  1. Input any additional information in the Comments
  2. Press

UUID Support

Syntax:

config firewall {address|addres6|addgrp|addgrp6} edit 1 set uuid <example uuid: 8289ef80-f879-51e2-20dd-fa62c5c51f44> next end

Object Configuration

1 Reply

Object Configuration

As was mentioned earlier, the components of the FortiGate firewall go together like interlocking building blocks. The Firewall objects are a prime example of those building blocks. They are something that can be configured once and then used over and over again to build what you need. They can assist in making the administration of the FortiGate unit easier and more intuitive as well as easier to change. By configuring these objects with their future use in mind as well as building in accurate descriptions the firewall will become almost self documenting. That way, months later when a situation changes, you can take a look at a policy that needs to change and use a different firewall object to adapt to the new situation rather than build everything new from the ground up to accommodate the change.

This chapter includes information about the following Firewall objects:

l Addresses l “Virtual IPs” on page 181 l IP Pools l “Services” on page 194 l “Firewall schedules” on page 201

 

Multicast

UUID Support

A Universally Unique Identified (UUID) attribute has been added to some firewall objects, so that the logs can record these UUID to be used by a FortiManager or FortiAnalyzer unit. The objects currently include:

l Addresses, both IPv4 and IPv6 l Address Groups, both IPv4 and IPv6 l Virtual IPs, both IPv4 and IPv6 l Virtual IP groups, both IPv4 and IPv6 l Policies, IPv4,IPv6 and IP64

A UUID is a 16-octet (128-bit) number that is represented by 32 lowercase hexidecimal digits. The digits are displayed in five groups separated by hyphens (-). The pattern is 8-4-4-4-12; 36 digits if you include the hyphens.

Addresses

Firewall addresses define sources and destinations of network traffic and are used when creating policies. When properly set up these firewall objects can be used with great flexibility to make the configuration of firewall policies simpler and more intuitive. The FortiGate unit compares the IP addresses contained in packet headers with a security policy’s source and destination addresses to determine if the security policy matches the traffic.

The address categories and the types within those categories on the FortiGate unit can include:

  • l IPv4 addresses l IP address and Netmask l IP address range l Geography based address l Fully Qualified Domain Name (FQDN) address l Wildcard FQDN l IPv4 Address Group
  • l IPv6 addresses l Subnets l IP range l IPv6 Address Group
  • l Multicast addresses l Multicast IP range l Broadcast subnets
  • l Proxy Addresses l URL Pattern l Host Regex Match l URL Category l HttpMethod l User Agent l HTTP Header l Advanced (Source) l Advanced (Destination)
  • l IP Pools (IPv4) l Overload l One-to-one l Fixed Port Range l Port Block Allocation
  • l IP Pools (IPv6) l Virtual IP Addresses l IPv4 l IPv6
  • l NAT46 l NAT64

Interfaces

When setting up an address one of the parameters that is asked for is the interface. This means that the system will expect to see that address only on the interface that you select. You can only select one interface. If you expect that the address may be seen at more than one interface you can choose the “any” interface option. Whenever, possible it is best to choose a more specific interface than the “any” option because in the GUI configuration of firewall policies there is a drop down field that will show the possible addresses that can be used. The drop down will only show those addresses that can be on the interface assigned for that interface in the policy.

Example:

  • l You have an address called “XYZ”.
  • l “XYZ” is set to the WAN1 interface because that is the only interface that will be able to access that address.
  • l When you are selecting a Source Address in the Web-based Manager for a policy that is using the DMZ the address “XYZ” will not be in the drop-down menu.

When there are only 10 or 20 addresses this is not a concern, but if there are a few hundred addresses configured it can make your life easier.

Addresses, address groups, and virtual IPs must have unique names to avoid confusion in firewall policies. If an address is selected in a policy, the address cannot be deleted until it is deselected from the policy.

Addressing Best Practices Tip

Don’t specify an interface for VIP objects or other address objects that may need to be moved or approached from a different direction. When configuring a VIP you may think that it will only be associated with a single interface, but you may later find that you need to reference it on another interface.

Example: Some web applications require the use of a FQDN rather than an

IP address. If you have a VIP set up that works from the Internet to the Internal LAN you wont be able to use that VIP object to access it from an internal LAN interface.

IPv4 Addresses

When creating an IPv4 address there are a number of different types of addresses that can be specified. These include:

  • l FQDN
  • l Geography l IP Range l IP/Netmask l Wildcard FQDN

Which one chosen will depend on which method most easily yet accurately describes the addresses that you are trying to include with as few entries as possible based on the information that you have. For instance, if you are trying to describe the addresses of a specific company’s web server but it you have no idea of how extensive there web server farm is you would be more likely to use a Fully Qualified Domain Name (FQDN) rather than a specific IP address. On the other hand some computers don’t have FQDNs and a specific IP address must be used.

The following is a more comprehensive description of the different types of addresses.

FQDN Addresses

By using Fully Qualified Domain Name (FQDN) addressing you can take advantage of the dynamic ability of DNS to keep up with address changes without having to manually change the addresses on the FortiGate. FQDN addresses are most often used with external web sites but they can be used for internal web sites as well if there is a trusted DNS server that can be accessed. FQDN addressing also comes in handy for large web sites that may use multiple addresses and load balancers for their web sites. The FortiGate firewall automatically maintains a cached record of all the addresses resolved by the DNS for the FQDN addresses used.

For example, if you were doing this manually and you wanted to have a security policy that involved Google you could track down all of the IP addresses that they use across multiple countries. Using the FQDN address is simpler and more convenient.

When representing hosts by an FQDN, the domain name can also be a subdomain, such as mail.example.com.

Valid FQDN formats include:

  • l <host_name>.<top_level_domain_name> such as example.com
  • l <host_name>.<second_level_domain_name>.<top_level_domain_name>, such as mail.example.com When creating FQDN entries it is important to remember that:
  • l Wildcards are not supported in FQDN address objects l While there is a level of convention that would imply it, “www.example.com” is not necessarily the same address of “example.com”. they will each have their own records on the DNS server.

The FortiGate firewall keeps track of the DNS TTLs so as the entries change on the DNS servers the IP address will effectively be updated for the FortiGate. As long as the FQDN address is used in a security policy, it stores the address in the DNS cache.

There is a possible security downside to using FQDN addresses. Using a fully qualified domain name in a security policy means that your policies are relying on the DNS server to be accurate and correct. DNS servers in the past were not seen as potential targets because the thinking was that there was little of value on them and therefore are often not as well protected as some other network resources. People are becoming more aware that the value of the DNS server is that in many ways it controls where users and computers go on the Internet. Should the DNS server be compromised, security policies requiring domain name resolution may no longer function properly.

Creating a Fully Qualified Domain Name address

  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address. 3. In the Category field, chose Address. (This is for IPv4 addresses.)
  3. Input a Name for the address object.
  4. In the Type field, select FQDN from the drop down menu.
  5. Input the domain name in the FQDN field.
  6. In the Interface field, leave as the default any or select a specific interface from the drop down menu.
  7. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled, the address will appear in drop down menus where it is an option.
  8. Input any additional information in the Comments field.
  9. Press OK.

Example: FQDN address

You have to great a policy that will govern traffic that goes to a site that has a number of servers on the Internet. Depending on the traffic or the possibility that one of the servers is down network traffic can go to any one of those sites. The consistent factor is that they all use the same Fully Qualified Domain Name.

  • l The FQDN of the web site: example.com
  • l The number of ISP connections off of the FortiGate firewall: 2

Configuring the address in the GUI

  1. Go to Policy & Objects> Objects > Addresses and select Create New > Address.
  2. Fill out the fields with the following information:
Category Address
Name BigWebsite.com
Type FQDN
FQDN bigwebsite.com
Interface any
Show in Address List <enable>
Comments <Input into this field is optional>
  1. Select OK.

Configuring the address in the CLI

config firewall address edit BigWebsite.com set type fqdn set associated-interface any set fqdn bigwebsite.com end

Verification

To verify that the addresses were added correctly:

  1. Go to Firewall Objects > Address > Addresses. Check that the addresses have been added to the address list and that they are correct.
  2. Enter the following CLI command:

config firewall address edit <the name of the address that you wish to verify> Show full-configuration

Changing the TTL of a FQDN address

To make sure that the FQDN resolves to the most recent active server you have been asked to make sure that the FortiGate has not cached the address for any longer than 10 minutes.

There is no field for the cached time-to-live in the web-based manager. It is only configurable in the CLI. Enter the following commands:

config firewall address edit BigWebsite.com set cache-ttl 600

end

Geography Based Addresses

Geography addresses are those determined by country of origin.

This type of address is only available in the IPv4 address category.

Creating a Geography address

  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address. 3. In the Category field, chose Address. (This is for IPv4 addresses.)
  3. Input a Namefor the address object.
  4. In the Type field, select Geography from the drop down menu.
  5. In the Country field, select a single country from the drop down menu.
  6. In the Interface field, leave as the default any or select a specific interface from the drop down menu.
  7. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled the address will appear in drop down menus where it is an option.
  8. Input any additional information in the Comments field.
  9. Press OK.

Example: Geography-based Address

Configuring the address in the GUI

Your company is US based and has information on its web site that may be considered information that is not allowed to be sent to embargoed countries. In an effort to help reduce the possibility of sensitive information going to those countries you have be asked to set up addresses for those countries so that they can be block in the firewall policies.

  • l One of the countries you have been asked to block is Cuba
  • l You have been asked to comment the addresses so that other administrators will know why they have been created
  1. Go to Policy & Objects> Objects > Addresses and select Create New > Address.
  2. Fill out the fields with the following information
Category Address
Name Cuba
Type Geography
Country Cuba
Interface any
Visibility <enable>
Comments Embargoed
  1. Select OK.

Configuring the address in the CLI

Enter the following CLI commands:

config firewall address edit Cuba set type geography set country CN set interface wan1

end

Overrides

It is possible to assign a specific ip address range to a customized country ID. Generally, geographic addressing is done at the VDOM level; it coulb be considered global if you are using the root VDOM, but the geoip-override setting is a global setting.

config system geoip-override edit “test”

set country-id “A0” config ip-range edit 1 set start-ip 7.7.7.7 set end-ip 7.7.7.8

next

edit 2 set start-ip 7.7.10.1 set end-ip 7.7.10.255 end

After creating a customized Country by using geoip-override command, the New country name has been added automatically to the country list and will be available on the Firewall Address Country field.

Diagnose commands

There are a few diagnose commands used with geographic addresses. The basic syntax is:

diagnose firewall ipgeo [country-list | ip-list | ip2country | override | copyright-notice]

Diagnose command Description
country-list Listing of all the countries.
ip-list List of the IP addresses associated with the country
ip2country Used to determine which country a specific IP address is assigned to.
override Listing of user defined geography data – items configured by using “config system geoip-override” command.
copyright-notice Shows the copyright notice.

IP Range Addresses

Where the Subnet address is good a representing a standardized group of addresses that are subnets the IP

Range type of address can describe a group of addresses while being specific and granular. It does this by

specifying a continuous set of IP addresses between one specific IP address and another. While it is most common that this range is with a subnet it is not a requirement. For instance, 192.168.1.0/24 and 192.168.2.0/24 would be 2 separate subnets but if you wanted to describe the top half of one and the bottom half of the other you could describe the range of 192.168.1.128-192.168.2.127. It’s also a lot easier that trying to calculate the correct subnet mask.

The format would be:

x.x.x.x-x.x.x.x, such as 192.168.110.100-192.168.110.120

There is a notation that is commonly used and accepted by some devices that follows the format:

x.x.x.[x-x], such as 192.168.110.[100-120]

This format is not recognized in FortiOS 5.2 as a valid IP Range.

Creating a IP Range address

  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address 3. In the Category field, chose Address(IPv4 addresses) or IPv6 Address.
  3. Input a Name for the address object.
  4. In the Type field, select IP Range from the drop down menu.
  5. In the Subnet / IP Range field, enter the range of addresses in the following format: x.x.x.x-x.x.x.x (no spaces)
  6. In the Interface field, leave as the default any or select a specific interface from the drop down menu. (This setting is not available for IPv6 addresses)
  7. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled the address will appear in drop down menus where it is an option.
  8. Input any additional information in the Comments field.

10. Press OK. Example

Example of a IP Range address for a group of computers set aside for guests on the company network.

Field Value
Category Address or IPv6 Address
Name Guest_users
Type IP Range
Subnet / IP Range 192.168.100.200-192.168.100.240
Interface Port1
Field Value
Show in Address

List

 [on]
Comments Computers on the 1st floor used by guests for Internet access.

IP Range addresses can be configured forboth IPv4 and IPv6 addresses. The only differences in creating an IPv6 IP Range address is that you would choose IPv6 Address for the Category and the syntax of the address in the Subnet/IP Range field would be in the format of 2001:0db8:0000:0002:0:0:0:202001:0db8:0000:0004:0:0:0:20

IP / Netmask Addresses

The subnet type of address is expressed using a host address and a subnet mask. From a strictly mathematical stand point this is the most flexible of the types because the address can refer to as little one individual address or as many as all of the available addresses.

It is usally used when referring to your own internal addresses because you know what they are and they are usually administered in groups that are nicely differentiated along the lines of the old A, B, and C classes of IPv4 addresses. They are also addresses that are not likely to change with the changing of Internet Service Providers (ISP).

When representing hosts by an IP address with a netmask, the IP address can represent one or more hosts. For example, a firewall address can be:

  • l A single host such as a single computer with the address 192.45.46.45 l A range of hosts such as all of the hosts on the subnet 192.45.46.1 to 192.45.46.255 l All hosts, represented by 0.0.0.0 which matches any IP address

The netmask corresponds to the subnet class of the address being added, and can be represented in either dotted decimal or CIDR format. The FortiGate unit automatically converts CIDR formatted netmasks to dotted decimal format. Example formats:

  • l Netmask for a class A subnet of 16,777,214 usable addresses: 255.0.0.0, or /8 l Netmask for a class B subnet of 65,534 usable addresses: 255.255.0.0, or /16 l Netmask for a class C subnet of 254 usable addresses: 255.255.255.0, or /24 l Netmask for subnetted class C of 126 usable addresses: 255.255.255.128, or /25 l Netmask for subnetted class C of 62 usable addresses: 255.255.255.128, or /26 l Netmask for subnetted class C of 30 usable addresses: 255.255.255.128, or /27 l Netmask for subnetted class C of 14 usable addresses: 255.255.255.128, or /28 l Netmask for subnetted class C of 6 usable addresses: 255.255.255.128, or /29 l Netmask for subnetted class C of 2 usable addresses: 255.255.255.128, or /30 l Netmask for a single computer: 255.255.255.255, or /32 l Netmask used with 0.0.0.0 to include all IP addresses: 0.0.0.0, or /0

So for a single host or subnet the valid format of IP address and netmask could be either:

x.x.x.x/x.x.x.x, such as 192.168.1.0/255.255.255.0

or

x.x.x.x/x, such as 192.168.1.0/24

Static Route Configuration

A setting that is found in the IP/Netmask address type that is not found in the other address types is the enabling or disabling of Static Route Configuration. Enabling this feature includes the address in the listing of named addresses when setting up a static route.

To use in the GUI

  1. Enable the Static Route Configuration in the address.
  2. Go to Network > Static Routes and create a new route.
  3. For a Destination type, choose Named Address.
  4. Using the drop down menu, enter the name of the address object in the field just underneath the Destination type options.
  5. Fill out the other information relevant to the route
  6. Select the OK button

To enable in the CLI:

config firewall address edit <address_name> set allow-routing enable end

Creating a Subnet address
  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address. 3. In the Category field, chose Address. (This is for IPv4 addresses.)
  3. Input a Namefor the address object.
  4. In the Type field, select IP/Netmask from the drop down menu.
  5. In the Subnet/IP Range field, enter the address and subnet mask according to the format x.x.x.x/x.x.x.x or the short hand format of x.x.x.x/x
  6. In the Interface field, leave as the default any or select a specific interface from the drop down menu.
  7. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled the address will appear in drop down menus where it is an option.
  8. Select the desired on/off toggle setting for Static Route Configuration.
  9. Input any additional information in the Comments field.
11. Press OK. Example

Example of a Subnet address for a database server on the DMZ:

Field Value
Category Address
Name DB_server_1
Type IP/Netmask
Subnet/IP Range United States
Interface any
Show in Address List [on]
Static Route Configuration [off]
Comments  

Wildcard FQDN

There are a number of companies that use secondary and even tertiary domain names or FQDNs for their websites. Wildcard FQDN addresses are to ease the administrative overhead in cases where this occurs. Sometimes its as simple as sites that still use www. as a prefix for their domain name. If you don’t know whether or not the www is being used it’s simpler to use a wildcard and include all of the possibilities whether it be example.com, www.example.com or even ftp.example.com.

Wildcard FQDN addresses do not resolve to a specific set of IP addresses in the same way that a normal FQDN addresss does. They are intended for use in SSL exemptions and should not be used as source or destination addresses in policies.

Creating a Fully Qualified Domain Name address

  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address 3. In the Category field, chose Address. (This is for IPv4 addresses.)
  3. Input a Name for the address object.
  4. In the Type fUncategorizedield, select Wildcard FQDNfrom the drop down menu.
  5. Input the domain name in the Wildcard FQDN field.
  6. In the Interface field, leave as the default any or select a specific interface from the drop down menu.
  7. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled the address will appear in drop down menus where it is an option.
  8. Input any additional information in the Comments field.

10. Press OK. Example

Example of a FQDN address for a remote FTP server used by Accounting team:

Field Value
Category Address
Name Example.com_servers
Type Wildcard FQDN
Wildcard FQDN *.example.com
Interface any
Show in Address List [on]
Comments Secondary and tertiary domain names for example.com

IPv6 Addresses

When creating an IPv6 address there are a number of different types of addresses that can be specified. These include:

  • l Subnet
  • l IP Range – the details of this type of address are the same as the IPv4 version of this type

The IPv6 addresses don’t yet have the versatility of the IPv4 address in that they don’t have things like geography based or FQDN address but as IPv6 becomes more mainstream this should change.

Subnet Addresses

The Subnet Address type is one that is only used in reference to IPv6 addresses.It represents an IPv6 address subnet. This means that the address will likely be a series of hexadecimal characters followed by a double colon, followed by a “/”, and then a number less than 128 to indicate the size of the subnet. An example would be:

fd5e:3c59:35ce:f67e::/64

  • l The hexidecimal charaters represent the IPv6 subnet address.
  • l The “::” indicates 0’s from that point to the left. In an actual address for a computer, the hexadecimal characters that would take the place of these zeros would represent the device address on the subnet.
  • l /xx, in this case /64 represents the number of bits in the subnet.This will make a range that can potentially include

18,446,744,073,709,551,616 addresses. For those wanting to use English rather than math, that is 18 Quintillion.

Creating a Subnet address

  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address
  3. In the Category field, chose IPv6 Address.
  4. Input a Name for the address object.
  5. In the Type field, select Subnet from the drop down menu.
  6. In the Subnet / IP Range field, enter the range of addresses in IPv6 format (no spaces)
  7. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled the address will appear in drop down menus where it is an option.
  8. Input any additional information in the Comments field.
  9. Press OK.

Example

Example of a IP Range address for a group of computers set aside for guests on the company network.

Field Value
Category IPv6 Address
Name IPv6_Guest_user_range
Type Subnet
Subnet / IP Range fd5e:3c59:35ce:f67e::/64
Show in Address List [on]
Comments  

Multicast Addresses

Multicast addressing defines a specific range of address values set aside for them. Therefore all IPv4 multicast addresses should be between 224.0.0.0 and 239.255.255.255.

More information on the concepts behind Multicast addressing can be found in the Multicast Forwarding section.

Multicast IP Range

This type of address will allow multicast broadcasts to a specified range of addresses.

Creating a Multicast IP Range address

  1. Go to Policy & Objects > Addresses.
  2. Select Create New.

l If you use the down arrow next to Create New, select Address.

  1. Choose the Category, Multicast Address
  2. Input a Name for the address object.
  3. Select the Type,Multicast IP Range from the dropdown menu.
  4. Enter the value for the Multicast IP Range
  5. Select the Interface from the dropdown menu.
  6. Enable the Show in Address List function
  7. Input any additional information in the Comments field.
  8. Press OK.

Example: Multicast IP Range Address

The company has a large high tech campus that has monitors in many of its meeting rooms. It is common practice for company wide notifications of importance to be done in a streaming video format with the CEO of the company addressing everyone at once.

The video is High Definition quality so takes up a lot of bandwidth. To minimize the impact on the network the network administrators have set things up to allow the use of multicasting to the monitors for these notifications. Now it has to be set up on the FortiGate firewall to allow the traffic.

l The range being used for the multicast is 239.5.5.10 to 239.5.5.200 l The interface on this FortiGate firewall will be on port 9

  1. Go to Policy & Objects> Objects > Addresses and select Create New > Address.
  2. Fill out the fields with the following information
Category Multicast Address
Name Meeting_Room_Displays
Type Multicast IP Range
Multicast IP Range 239.5.5.10-239.5.5.200
Interface port9
Show in Address List <enable>
Comments <Input into this field is optional>
  1. Select OK.
  2. Enter the following CLI command:

config firewall multicast-address edit “meeting_room_display” set type multicastrange set associated-interface “port9” set start-ip 239.5.5.10 set end-ip 239.5.5.200

set visibility enable

next

end

To verify that the address range was added correctly:

  1. Go to Policy & Objects> Objects > Addresses. Check that the addresses have been added to the address list and that they are correct.
  2. Enter the following CLI command:

config firewall multicast-address edit <the name of the address that you wish to verify>

Show full-configuration

 

Broadcast Subnet

This type of address will allow multicast broadcast to every node on a subnet.

  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address.
  3. In theCategory field, choseMulticast Address.
  4. Input a Name for the address object.
  5. In the Type field, select Broadcast Subnetfrom the drop down menu.
  6. In the Broadcast Subnet field enter the address and subnet mask according to the format x.x.x.x/x.x.x.x or the short hand format of x.x.x.x/x.(Remember, it needs to be within the appropriate IP range 224.0.0.0 to 239.255.255.255)
  7. In the Interface field, leave as the default any or select a specific interface from the drop down menu.
  8. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled the address will appear in drop down menus where it is an option.
  9. Input any additional information in the Comments field.
  10. Press OK.

Example

Field Value
Category Broadcast Subnet
Name Corpnet-B
Type Broadcast Subnet
Broadcast Subnet 224.5.5.0/24
Interface any
Show in Address List [on]
Comments Corporate Network devices – Broadcast Group B

Multicast IP addresses

Multicast uses the Class D address space. The 224.0.0.0 to 239.255.255.255 IP address range is reserved for multicast groups. The multicast address range applies to multicast groups, not to the originators of multicast packets. The following table lists the reserved multicast address ranges and describes what they are reserved for:

Reserved Multicast address ranges

Reserved

Address Range

 Use Notes
224.0.0.0 to

224.0.0.255

 Used for network protocols on local networks. For more information, see RFC 1700. In this range, packets are not forwarded by the router but remain on the local network. They have a Time to Live (TTL) of 1. These addresses are used for communicating routing information.
224.0.1.0 to

238.255.255.255

 Global addresses used for multicasting data between organizations and across the Internet. For more information, see RFC 1700. Some of these addresses are reserved, for example, 224.0.1.1 is used for Network Time Protocol (NTP).
239.0.0.0 to

239.255.255.255

 Limited scope addresses used for local groups and organizations. For more information, see RFC 2365. Routers are configured with filters to prevent multicasts to these addresses from leaving the local system.

Creating multicast security policies requires multicast firewall addresses. You can add multicast firewall addresses by going to Firewall Objects > Address > Addresses and selecting Create New > Multicast

Address. The factory default configuration includes multicast addresses for Bonjour (224.0.0.251-224.0.0.251, EIGRP (224.0.0.10-224.0.0.100), OSPF (224.0.0.5-224.0.0.60), all_hosts (224.0.0.1-224.0.0.1), and all_routers (224.0.0.2-224.0.0.2).

Proxy Addresses

This category of address is different from the other addresses in that it is not designed to be used in the normal firewall policy configuration. It is intended to be used only with explicit web proxies.

In some respects they can be like a FQDN addresses in that they refer to an alpha-numeric string that is assigned to an IP address, but then goes an additional level of granularity by using additional information and criteria to further specify locations or types of traffic within the website itself. In depth information on Explicit Proxy Addressing can be found in WAN Optimization, but it is worth laying out the steps of how to create an address object for this category.

Creating an Proxy address

  1. Go to Policy & Objects > Addresses.
  2. Select Create New. A drop down menu is displayed. Select Address.
  3. In the Category field, chose Proxy Address.
  4. Input a Name for the address object.
  5. For the Type field, select one of the options from the drop down menu.

Within the Explicit Proxy Address category there are 8 types of addresses. Each of these types will have associated field(s) that also need to have values entered to make the object specific to it’s address.

Type = URL Pattern

  • l In the Host field, choose from drop down menu l In the URL Path Regex field, enter the appropriate string

Host Regex Match l In the Host Regex Pattern field, enter the appropriate string

URL Category

  • l In the Host field, choose from drop down menu l In the URL Category field, choose from drop down menu

HTTP Method

  • l In the Host field, choose from drop down menu l In the Request Method field, choose from drop down menu The options are: l CONNECT l DELETE l GET l HEAD l OPTIONS l POST l PUT l TRACE

User Agent

  • l In the Host field, choose from drop down menu l In the User Agent field, choose from drop down menu The options are:
  • l Apple Safari l Google Chrome
  • l Microsoft Internet Explorer or Spartan l Mozilla Firefox l Other browsers

HTTP Header

  • l In the Host field, choose from drop down menu l In the Header Name field, enter the appropriate string value l In the Header Regex field, enter the appropriate string value

Advanced (Source)

  • l In the Host field, choose from drop down menu l In the Request Method field, choose from drop down menu (see HTTP Method type for option list) l In the User Agent field, choose from drop down menu (see User Agent type for option list)
  • l In the Header Group table, create, edit or delete Header Name strings and associated Header Regex strings

Advance (Destination)

  • l In the Host field, choose from drop down menu l In the Host Regex Pattern field, enter the appropriate string l In the URL Category field, choose from drop down menu
  1. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled the address will appear in drop down menus where it is an option.
  2. Input any additional information in the Comments field.
  3. Press OK.

Proxy Address Groups

To create a Proxy address group:

  1. Go to Policy & Objects > Addresses.
  2. Click on + Create New to get the drop down menu. Select Address Group.
  3. In the Category field, choose Proxy Group.
  4. Fill in a descriptive name in the Group Name field.
  5. If you wish, use the Change link to change the Color of icons in the GUI. There are 32 color options.
  6. In the Type field, select whether the group will be a Source Group (composed of source addresses) or a Destination Group (composed of destination addresses).
  7. Select anywhere in the Members field to bring forth the pane of potential members for selection to the group.
  8. Select the desired on/off toggle setting for Show in Address List. If the setting is enabled, the address will appear in drop down menus where it is an option.
  9. Input any additional information in the Comments field.
  10. Click on OK.

Internet Services

In FortiOS 5.4, support was added for Internet Service objects which could be used with FortiView, Logging, Routing and WAN Load Balancing. Now they can be added to firewall policies as well.

There is an either or relationship between Internet Service objects and destination address and service combinations in firewall policies. This means that a destination address and service can be specified in the policy OR an Internet service, not both.

CLI

The related CLI options/syntax are:

config firewall policy edit 1 set internet-service 1 5 10 set internet-service-custom test set internet-service-negate [enable|disable]

end

GUI

In the policy listing page you will notice that is an Internet Service object is used, it will be found in both the Destination and Service column.

In the policy editing page the Destination Address, now Destination field now has two types, Address and Internet Service.

 

Multicast Policy

Leave a reply

Multicast Policy

The Multicast Policy GUI page has been updated from previous versions of the firmware to the new GUI look and feel. Some functionality has also been changed.

The DNAT option has been removed from the GUI but is still in the CLI.

To create/edit a multicast policy go to Policy & Objects > Multicast Policy. The Listing window on the right will have buttons along the top that will enable you to l Create New l Edit l Delete

There is also a Search field that will allow you to search or filter the available policies if you have a lot of them.

To configure a new policy left click on the Create New button. This will reveal the New Policy editing window.

  1. Using the drop down menu, fill in the field for Incoming Interface. Only one interface can be chosen.
  2. Using the drop down menu, fill in the field for Outgoing Interface. Only one interface can be chosen.
  3. Set the Source Address parameter by selecting the field with the “+” next to the field label. When the field is selected a window will slide out from the right. In order for a multicast address to available for selection, the address object needs to have been created already. Only useable address options will be available for selection. This means only mutlticast address objects and the more generic all and none The “+” icon next to the Search field is a shortcut for creating a new firewall object. Single or multiple options can be selected unless the all option is chosen in which case, it will be the only option.

Multicast

  1. Set the Destination Address parameter by selecting the field with the “+” next to the field label. This field is similar to the Source Single or multiple options can be selected unless the all option is chosen in which case, it will be the only option.
  2. Set the Action This will be to either ACCEPT or DENY the traffic through the policy.
  3. Toggle the Enable SNAT switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled.
  4. Use the drop down menu to select a Protocol. The options are: l Any l ICMP l IGMP
    • TCP – includes Port Range fields l UDP – includes Port Range fields
    • OSPF
    • Other – includes a field for the protocol number
  5. Depending on which Protocol is defined, the some other fields may appear.
    • Port Range – The first field is for the starting value for the port and the second for the ending value for the port range used by the protocol. Both of these values are inclusive.
    • Protocol field – This appears when the Other option is chosen. Enter the value of the protocol number for the protocol you wish to use.
  6. Toggle the Log Allowed Traffic switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled.
  7. Toggle the Enable this policy switch to the setting you want. If the slider is gray the option is disabled. If it is colored, it is enabled. By default, this should be enabled
  8. Click on the OK button to save the policy.

Multicast