FortiGate Security
The FortiGate Security domain tests how you enforce policy, translate addresses, authenticate users, and attach inspection profiles on a FortiGate running FortiOS. Questions focus on correct policy design and the order in which the FortiGate evaluates and inspects traffic.
Policy evaluation
- Firewall policies are evaluated top-down; the first matching policy is applied and evaluation stops.
- A policy matches on ingress interface, source address/user, destination address, service, schedule, and action. The implicit deny at the bottom drops unmatched traffic.
- Keep specific policies above broad ones. A broad permit above a specific deny makes the deny unreachable.
- Security profiles are applied per policy; traffic accepted by a policy without profiles is not inspected by UTM.
NAT
- SNAT is enabled on an outbound policy with NAT enabled, using the outgoing interface address or an IP pool.
- DNAT uses a virtual IP (VIP) to map a public address/port to an internal address/port; the VIP is referenced as the destination in the inbound policy.
- Central NAT centralizes SNAT rules, but policy NAT remains common.
Inspection
- Flow-based inspection is default for many profiles; proxy-based inspection allows more advanced scanning but changes TCP behavior.
- Certificate inspection versus deep SSL inspection determines whether encrypted traffic can be scanned. Without deep inspection, HTTPS content is largely opaque to web filtering and antivirus.
Worked example
An inbound policy on wan1 permits HTTP to VIP 203.0.113.10, mapped to 10.0.0.10. A second policy on wan1 permits all services to any destination. The VIP policy must sit above the any-any policy; otherwise the broad policy matches first and the VIP is never used. Because the VIP policy references the mapped server, the FortiGate translates the destination before forwarding. Return traffic from the server is allowed by the stateful session, but new outbound sessions from 10.0.0.10 need a separate internal-to-wan1 policy with NAT enabled.
Traps
- Assuming a lower policy will still be checked after a match.
- Enabling a web-filter profile but forgetting deep SSL inspection, then expecting HTTPS categories to be filtered.
- Placing a VIP policy below a broad permit.
- Confusing a VIP (destination NAT) with an IP pool (source NAT).
- Forgetting that changing VDOM mode or interface mode can affect policy behavior.