OVERVIEW

IN THIS LESSION WE LEARN

Describe FortiGate

Explain Key features of FortiGate

Understand FortiGuard Labs

What is FortiGate

 FortiGate is a Next generation firewall which consolidated various

security functions (Unified Threat management) such as Firewalling,
Intrusion prevention, Antivirus, Web filtering and VPN services into a
single platform to reduce complexity and cost.

Benefits

 FortiGate is built on its own hardware processors to accelerate security

and network performance. High Performance
SPU - security processing units, FortiASIC processors.
 FortiGate offers protection for both on-premises and cloud
environment.
o IPS: Detects and blocks malicious network traffic.
o Anti-Malware: Protects against virus, malware and botnets.
o Web Filtering: Block unwanted or malicious websites.
o SD-WAN: Optimized and secure application traffic routing
across various networks.
o Application control: Manages and controls network based
on the application.
o VPN: it allows users to securely access private networks or
resources over internet.
 FortiGate inspects encrypted traffic to find and block the hidden
threats - SSL inspection
 FortiGate creates secure VPN tunnels to connect different locations or
remote users. VPN services.
 FortiGate offers virtual firewall options for public and private cloud
environments.
 FortiGate offers cloud-native firewall (CNF) as a service
 FortiGate leverages FortiGuard AI-Powered security services for
Realtime updates on threats, vulnerabilities and attack vectors.
  FortiGate offers improved visibility into network, user and application
traffic and provides granular control.
 FortiGate available in various model from large enterprises to small
business and offers cloud-based options for scalability.
 FortiGate offers centralized management via FortiGate cloud to simplify
the administration.
 FortiGate provides multi-layered security against a wide range of
cyberattacks.
 FortiGate offers excellent user experience with user-friendly graphical
interface which simplifies complex configurations and management.
 FortiGate enhances operational efficiency and supports automated
workflows through Security Fabric Automation (SFA).

FortiGate platform

 FortiGate platform combines FortiGuard subscription services, security

features, FortiOS operating system and SPUs which provides more
strength and flexibility.

FortiGate Models

 FortiGate VM is a virtual appliance which offers same level of

protection for private and public cloud as physical appliance.
o Entry level - FG-80F, FWF-80F
o Mid-range - FG-100F, FG-1000F, FG4200F
o High-end - FG-4800F, FG-7081F, FG-7121F, FG-5114C.

Features

 FortiGate also provides features

o Firewall authentication both local and remote
o Anti-virus
o Monitoring and logging
 FortiGate firewall authentication is the process of validating user
identities to control access to the network resources through local user
accounts or External servers (remote users) or Fortinet single sign-on
(FSSO).
 Local user accounts can be created and managed directly on the
FortiGate firewall.
 Remote user accounts will be created on external authentication
servers such as Active directory or RADIUS servers.
  FSSO allows for seamless single sign-on, detecting user log-on events
to automatically identify users and their workstations without requiring
to enter their passwords.
 FortiGate Antivirus is a security feature that protects network from
virus, spyware, ransomware and other malware by blocking malicious
content and files.
 FortiGate monitoring is the continuous observation of network and
firewall to maintain visibility into its security and health status.
 FortiGate Logging is the process of capturing detailed records of
network activity and security events that occur in the FortiGate
firewall.
 FortiGate is also part of a Fortinet security fabric.

FortiGuard labs

 FortiGuard labs is Fortinet’s specialized cybersecurity threat

intelligence and research organization.
 FortiGuard labs partnering with law enforcement agencies, government
organizations and security vendor alliances worldwide to fight
emerging global security risks.
 FortiGate devices receive updates from FortiGuard security services
powered by FortiGuard labs to stay up-to-date with the emerging
threat landscape.
 FortiGuard labs maintains real-time threat intelligence and innovative
prevention tactics and tools across the Fortinet security fabric. it has
three key features to accomplish this task.
 Trusted Machine learning (ML) and Artificial intelligence (AI) that stops
unknown threats faster on large-scale, cloud driven data lakes.
 Real-time threat protection to provide a proactive security posture
through continuous security updates based on in-house research and
collaboration.
 Threat hunting and outbreak alerts allows for faster remediation with
alerts, analysis, detection, and prevention.
 Fortinet security fabric is an integrated cyber security platform that
connects and co-ordinates all of Fortinet’s security solutions and third-
party products to provide end-to-end protection across an
organizations entire attack surface.
FIREWALL POLICIES

IN THIS LESSON WE LEARN

Describe firewall policies

How firewall policies work

How inspection modes work

configure firewall policies

 FortiGate firewall policies are set of rules that determine how network
traffic is allowed or denied by a firewall.
 firewall policies are crucial for network security. it blocks unauthorized
access and allows only legitimate communication through the network.
 firewall policies control network traffic by matching elements like
source/destination IP, user identities, services and schedules.
 Each firewall policy has match criteria which can configure using the
o Source and destination address (IP address or subnets)
specifies originating and target IP address or network
objects for the traffic.
o incoming and outgoing interfaces/Zones
Determines which interfaces or logical zones the policies
are applied to.
o Service and schedules
Defines the type of communication such as HTTP, DNS or
other protocols.
Policies can be set to be active only during specific times or
periods.
o Action
When traffic matches to the firewall policy FortiGate
applies the action such as Allow or Deny the traffic
(Accepts or drops the session).
o NAT
used to translate private IP addresses to public for
outgoing internet traffic.
o Status
Policies can be disabled or enabled as needed.
o Security profiles
Advanced security features such as web filtering,
application control and threat intelligence integration can
be applied to the policies for deeper inspection and control
  Source field defines Originating IP addresses, users, or devices that are
initiating the network traffic.
 Destination field defines the targeted IP address, devices or services
that the traffic is intended to reach.
- These two fields can be IP subnets or the internet services.
 IP subnet is an address object represents range of IP addresses created
by admin and use it in security policy,
 this allows administrator to control traffic by grouping multiple hosts
rather than creating separate policy for each IP addresses.
 Default all option is available for source and destination that matches
all possible IP addresses.
 to set a source user, we must configure firewall authentication and the
select specific user or user groups.
 Internet service database can be used as source or destination address
object, provides granular control over predefined internet services.
 Internet service database (ISDB) contains IP subnets of commonly used
web service providers such as YouTube, Amazon-AWS, Meta and so on.
 Administrator can also add custom service to the list and use as source
or destination.
 it is used as destination to control outbound traffic from your internal
network to specific internet services or categorize destinations to block
or allow.
 used in source field to identify and control inbound traffic based on its
source internet service.
 FortiGate firewall policy table contains all policies that controls network
traffic flow by defining what is allowed or denied based on criteria

like source/destination IP, ports, users and applications.

FortiGate firewall policy processes incoming traffic by sequentially each rule

from top to bottom, stopping at the first matching rule to apply its

defined action and then discarding the packet.

If there no match found in the policy table, FortiGate drops packet by

applying the default implicit deny firewall policy, located bottom of the table.

It is best practice to use most specific policies located at top of the table and
more general policies at bottom of the table.

This makes sure that FortiGate applies the correct policy to the traffic.

FortiGate firewall process accepted traffic in distinct stages

 Ingress checks - DoS Policy and IP integrity

Session lookup - to find an established connection or to create new

connection via the slow path

in new connection FortiGate firewall performs

stateful inspection and routing (Including destination NAT) followed by policy
and source NAT checks and logs traffic.

finally, UTM/NGFW inspection before the

session is installed in the session table. once the session is created the
subsequent packets are handled by the

fast path for forwarding.

Firewall also performs security scanning such

as antivirus, application control, web filtering. security scanning could block
the traffic if it contains virus.

There are two inspection modes in firewall policy

Flow-based inspection

- examines traffic as it passes, without any buffering.

- it won’t wait for complete file or web page

- it processes and forward once each packet arrives

- it offers high speed and low latency.

- it is generally used for performance-sensitive traffic such as voice,

video which require low latency, high bandwidth, high network quality of
service and low packet loss.

- Flow based inspection does not alter the original information such as
content modification and safe search enforcement is not supported in this
mode.

Proxy based inspection

- FortiGate buffers the traffic and examines it as a whole before

determining an action.

- Firewall establishes a proxy connection and reconstructs the full

content of file, web pages or emails before performing deep packet
inspection.
 - it requires more processing power and memory.

- it provides advance security features like SSL decrytpion, detailed

content filtering, IPS and more.

- prefers for the environments where the highest security and control is
required such as healthcare and finance.

- Due to the traffic buffering and reconstruction process adds high

latency and greater impact on resources.

-------------------------------------------------- AUTHENTICATING NETWORK USERS

----------------------------------------------------------

In this lesson we learn

Importance of using firewall authentication

How authentication on FortiGate firewall works.

configure Authentication

Monitor Authentication

FortiGate firewall authentication is the process os verifying the users identity

to grant or deny network access.

Authentication can be done through local user accounts or by integrating

with external authentication servers like active directory or RADIUS.

authentications controls user access to the network and internet based on

their credentials using

capative portal that prompts users for login on a webpage or

with transparent single sign-on (SSO)

This helps to enfore security policies, allows for granular control over
network resources, and can integrate two-factor authentication for enhanced
security.

with out firewall authentication the only FortiGate can read users source IP
address which it can not use to check users identity.
configuring firewall authentication is the process of setting up the firewall to
verify users identity before granting access to the network resources or the
internet.

To configure firewall authentication we need to add a source user or user

group to the firewall policy.

This involves defining user groups or users and authentication methodes like
LDAP or local accounts and creating rule that trigger the authentication

request via capative portal or SSO.

this provides centralized access control, enhance security by enforcing

authentication, granular control over user permissions.

it works as follows

users enter their credentials

FortiGate then verifies users identity along with the rules in the firewall
policy

then firewall grants access to the traffic based on the matching firewall
policies, denies access if authentication fails.

FortiGate firewall authentication methodes includes

Local authentication - User credentials are stored on FortiGate. this

methode works well for a single FortiGate installation.

Server-based authentication - credentials are stored on a remote

servers like RADIUS,LDAP,TACACS+.

TWO-Factor authentication using Forti token or certificates.

VPN - Pre-shared keys, PKI,XAUTH , or EAP

Fortinet single sign-on - integrates with active directory for user

information.

Local user accounts contains username and passwords.

administrator need to create individual user accounts for every user who
need access to the network.

local user groups are used to group users together who require same level of
access.
we can group users by bussiness area, employee type.

it is recommended to used user groups instead of individual users in firewall

policy.

Administrator can also create the guest groups which contain temporary user
accounts that expire after a predetermined amount of time and apply local
authentication.

Administrator can manually create guest accounts or create many guest

accounts at once using randomly generated user IDs and passwords.

once created we can add user accounts to the user groups and associate the
group with the firewall policy.

Guest accounts grant vistors limited network access for a set period.

Guest accounts are typically provisioned through a capative portal.

Administrators can easily provide network access for events or visitors.

FortiGate firewall remote authentication is a system where the FortiGate

firewall offloads the process of verifying the user identity to an external,
dedicated

authentication server such as forti authenticators.

FortiGate grant secure network access by communicating with servers like

RADIUS,TACACS+ or LDAP and then applies the matching firewall policy to
the traffic.

in remote authentication FortiGate doesnot store user information locally.

Remote authentication is preffered when multiple FortiGate devices need to

authenticate the same users or user groups, or

when adding FortiGate device to the network that already have

authentication server.

To add firewall authentication to the policy we must create user or user group
that can be locally created or integrated with remote authentication servers

like LDAP, active directory etc.

assign this group to the firewall policy user feild.

when traffic matches the policy, user must authenticate before FortiGate
grants access to the service.

Local Authentication

configure user on FortiGate

create user group based on the users role or type and then add user to
the group

Add user group as a source of a firewall policy

Verify the configuration by user authentication and monitor logs and

dahsboards for successfull logins.

Remote Authentication

Add remote user in FortiGate

create user groups and map authenticated remote users to the group.

Add user group as the source of a firewall policy.

Verify the configuration by having the user successfully authenticate

and monitor using FortiGate logs and dashboards.

--------------------------- INSPECT SSL TRAFFIC

-----------------------------------------------

In this lesson we learn

What is SSL traffic

Why SSL traffic should be inspected

How SSL inspection works in FortiGate

Configure SSL inspection in FortiGate firewall policy.

SSL (Secure socket layer) traffic is reffered to data transmitted over secure,
encrypted network connection, Typically using transport layer security to

ensure privacy, authentication and integrity.

secure traffic use HTTPS protocol and passes through secure tunnel where
data is encrypted that prevents evesdropping and tamperring.

used to protect sensitive information like passwords and financial

information.

HTTPS is hyper text transfer protocol that encrypts web traffic

SSL inspection is the process of intercept, decrept, and analyze for threats
and re-encrypt and sent it on its way.

this is crucial to ensure high security by detecting malware, prevent data

exfilteration, enfore security policies.

SSL inspection is used because attackers may attempt to use encrypted

traffic to get access to the corporate network.

SSL inspection is works as follows

once the user started browsing a website

site has a certificate issued by a legitimate certificate authority.

a valid certificate in user certificate list and a browser stated SSL

session with the website.

if the website is infected by virus and it is present in the encrypted

formated and passes through the FortiGate which is not confgured with SSL
inspection,

Virus enter to the user computer and cause damage.

SSL ispections is configured to inspect these kind of encrypted

malicious traffic.

There are two types of SSL inspections in the FortiGate

certificate inspection

- FortiGate ispects the SSL/TLS handshake when session begins.

FortiGate verifies the identity of the web server.

- make sure HTTPS protocol is not used as a work around to access

websites that are blocked by web filtering.
 - Only web filtering feature can be used with certificate inspection
mode. this method does not introduce certificate error. it is an alternative

method to deep inspection when using web filtering.

- Gathers basic information like website name, issuer and validity

period.

- it verifies the legitimacy of SSL certificates by reviewing SSL

certificate headers (expiry data and issuer) without decrypting the actual
traffic.

- It is used for monitoring network activity, enforcing access control

based on certificate information, and blocking connection if a certificate

is deemed untrsuted or malicious.

Deep inspection (SSL/TLS deep inspection or man-in-the-middle)

- Deep inspection is also known as full inspection.

- Deep inspection decrypts the entire SSL-encrypted traffic

- Acts as a man-in-the-middle by intercepting SSL/TLS traffic,

decrypting it with a certificate, inspecting the content for threats like
malware, virus, and unauthorized application

using security profiles and re-encrypting it with FortiGates own

certificate before sending it to destination.

- Deep inspection performs all types of security scanning including

web filtering.

- Deep inspection protects traffic from from many types of attacks that
use SSL-encrypted protocols such as HTTPS, SMTPS, POP3S, IMAPS, and
FTPS.

Apply SSL inspection to the FortiGate firewall policy to use SSL inspection.

FortiOS has four pre-loaded SSL inspection profiles

Certificate-inspection

Deep-Inspection

No-Inspection
Fourth pre-loaded profiles is Custom-deep-inspection can be editable.

we can clone any of the read-only profile or create our own custom profile.

these modes offere different level of security and visibility into traffic.

Certificate-inspection

inspects initial SSL/TLS handshake between the client and server.

this examines servers public key certificate. but it does not decrypt the
encrypted data.

device checks the certificate for fundamental information such as

the issuer (ensuring it as a valid certificate authority)

expiration date

servers common name or subject alternative name to ensure it

matches the requested domain.

it provides less security than deep inspection, can not detect threats that are
hidden in the encrypted traffic, such as malware and data exfilteration.

it is a faster and less resource-intensive method for verifying that users not
visiting sites with expired or invalid certificates.

there will be not performance interruption for the user in this method.

it causes certificate warnings only when FortiGate displays an encrypted

replacement message.

Deep-Inspection

The security device acts as man-in-the-middle

It intercepts the encrypted connection, decrypts the traffic, scans the data
for the threats, and then re-encrypt the data and sends towards the
destination.

- security device acts as a web server to the client

- FortiGates uses its own certificate authority (CA) certificate to

generate new temporary certificate for each website.

- CA certificate must be installed and trusted on client machine to

avoid browser warning.
it provides highest level of security, firewall performs full scan of all
encrypted traffic using security features like

- intrusion prevention system (IPS)

- Antivirus scanning

- Advanced web filtering

- Data leakage prevention

Applied to high-risk or outbound policies where destinations or unknown

prevent malware or other threats that are hiding in encrypted traffic.

required administrative setup for installing trusted CA certificate on all client

device

resource-intencive process that can add latency.

SSL certificate warning appears when a web browser detects issues with
website security certificate, indicating connection may not secure, which can
expose

data to risks like interception, identity theft, or phishing attacks.

common causes includes expired certificates, untrsuted issuer, incorrect

domain configurations, mix of secure and insecure content in the page.

------------------------------------------- BLOCKING MALWARE

-----------------------------------------------------------------

In this lesson we learn

why antivirus protection is needed

How antivirus blocks malware.

configure FortiGate antivirus.

Malicious risk refers to threat that causes with malicious software, that leads
to data loss and theft, operational disruption, financial losses, reputational
harm,

regulatory consequences for individuals and organizations.

risks includes losing sensitive information, system-lock up by ransomware,

identity theft, service outages in critical infrastructure.

occurs through email attachments, malicious websites, infected Apps.

Mitigation involves using security software, keeping systems updated, safe

browsing habbits.

- Data loss and theft : malware can steal personal details, financial
data, intellectual property, and customer records.

- Operational disruption : Ransomware can lock systems and encrypt

files, halting bussiness operations and demand money for recovery.

- Financial damage : paying ransoms, recovering systems, restoring

data, potential lost revenue due to downtime.

- Reputation harm : data breach and service disruption can cause

damage to company reputation by ruining trust with partners and customers.

- Regulatory and legal consequences : Malware attack can lead to non-

compliance fines, lawsuits and other legal issues related to data protection.

- System damage : Some malware can destroy data, corrupt files,

destabilizing the operating system, rendering devices unusable.

Malware causes

data breaches

extort money

steal intellectual property

disrupt bussiness and destroy systems.

FortiGuard labs provide a database of signatures that allow FortiGate to

identify malware.

To keep database up-to-date, we can schedule FortiGate updates at regular

intervals.
this helps maintain protection against latest malware variants and previously
unknown threats.

FortiGate techniques to detect malware.

Antivirus scan : FortiGate detects virus that are exact match for a signature
in the FortiGuard antivirus datatbase. antivirus scan detects known malware.

it is first, fastest, and simplest way to detect malware.

Grayware scan : this scan detects unsolicited program that have been
installed with out user knowledge or consent, is known as grayware.

graware technically is not a virus but it can casue

unwanted behaviour, so it is considered as a malware by FortiGate. FortiGate
detects

grayware using FortiGuard graware signature.

Machine learning/ AI scan : this scan uses artificial intelligence and machine
learning techniques to detect zero day attack containing malware that is

new, unknown, doesnot yet have a matching associated

matching associated signature.

when FortiGate detects new virus, it logs the file as suspicious but does
not block it.

we can choose the option to block or allow suspicious files.

FortiGate antivirus profile is a set of security settings that define how

FortiGate firewall inspects network traffic for malicious files and what actions

to take when a threat is found. By creating profiles and applying them to

firewall policies, administrators can enable comprehensive antivirus
protection for

various protocols, ensuring that potentially harmful files are blocked,

monitored, or quarantined before they can enter into network.

in antivirus profile, we can define what FortiGate should do if it detects

infected file.
setting up a security profile with a specific antivirus scanning rules to detect
and prevent malware from entering into the network.

Navigate to security profiles > antivirus >

create new profile > build a custom profile or select existing profile to
editable

add unique name to profile and add a comment to describe its

purpose.

Enable antivirus scan option to activate inspection engine.

inspection mode - flow based or proxy based

specify to which protocols antivirus protection need to apply for like

HTTP, FTP,SMTP.

set actions Block, Monitor, Quarantine, Replace.

enable malware outbreak protection databse and configure the use of

an external malware block list from FortiGuard for advanced threat
protection.

this databse provides additional protection from FortiGuard to keep

network safe from newly emerging malware.

Apply to relavant firewall policy to start inspecting traffic that matches

policy.

Enable SSL deep inspection for encrypted HTTPS traffic in the firewall
policy, for the antivirus to effectively scan the content.

choose how windows excutable files are handled. by default FortiGate

considers files to be virus and blocks any if it detects.

send files to fortisandbox for inspection. we can configure the antivirus

profile to send malicious files to fortisandbox for behavious analysis.

configure default antivirus profile

enable antivirus scanning on a firewall policy

verify the configuration by attempting to download test

file.

Monitor the FortiGate to check antivirus protection.

---------------------------------------------------- WEB FILTERING
-------------------------------------------------------

In this lesson we learn

use of web filtering

FortiGuard categories

configuring web filtering

FortiGate webfiltering is used to block malicious websites, prevent web

based attacks like phishing and malware and control access to inappropriate
or

unproductive content.

It is a FortiGuard service that uses AI-driven analysis and large,constant URL

database.

it operates as a security profile in firewall, leveraging FortiGuard labs threat

intelligence to catagorize and manage internet traffic, provides

granular control over organizations to improve security and employee

productivity.

webfiltering controls or track websites accessed by users.

Administrators apply web filtering for

To limit access to distracting websites.

To prevent network congestion (should not use bandwidth for non-

bussiness purpose)

To decrease exposure web-based threats by limitting access to the

malicious websites.

To limit liability, if users attempt to download inappropriate or offensive

material.

To prevent users from viewing inappropriate material.

FortiGuard category filters are a core component of fortinet web filtering
service that classifies web sites into broad categories.

Category filters helps administrators to block or control access to the

websites to ensure compliance, security and better usage of internet with in
the

organization.

FortiGate uses FortiGate category filters to control web access. Filters are
derived from the FortiGuard web filtering service.

FortiGuard web filtering service is a threat protection service that uses

FortiGuard threat intelligence service to block access to malicious, hacked
and

inappropriate websites.

this service also includes URL categories database, which sorts millions of
URLs into over 90 categories.

this helps organization to create granular control over web and enfore
acceptable usage policy.

FortiGate URL categories are pre-defined groupings of websites based on

their content, used by the FortiGuard web filtering service to apply security
policies.

Access to these categories can be blocked or permitted depending on thier

content.

The database sorts web content based on how suitable it is for three types of
users

enterprises

schools

home and families

FortiGate firewall query the FortiGuard distribution network for a website

category and can the block, allow or monior access based on custmizable
policy.

FortiGate URL sub categories are more specific classifications with in a broad
FortiGuard URL categories that provide granular control over web filtering.

website categories are determined by both automatic and manual method.

 categories example - The general interest - sub categories such as
social networking, news, media.

Bandwidth consuming - file sharing and storage, streaming media and

download.

FortiGate works with FortiGuard categories to determine how websites are

filtered.

FortiGuard category filtering looks at the category for its rating instead of
blocking websites individually.

FortiGate blocks are allows website access based on actions defined for
FortiGuard web filter category in FortiGate, not based on URL.

FortiGuard web filter category actions like

Allow - permit access to the websites in the category

Block - Prevents access to the websites in the category. see a message

website is blocked. security log is generated in FortiGate.

Monitor - Monitor access to the websites in the category and records

access data, such as URL, destination, IP, to the FortiGate logs.

Warning - informs user that the requested website can not be accesses
by internet policies. users will be provided chance to continue or go back

we can configure warning interval to display page at

specific times.

Authenticate - permits access to the websites in the category if the

user provides valid username and [Link] can

configure authentication based on user or user

groups

customize the interval of time to allow access.

users are not prompted for credentials for other

websites in the same category until timer expires.

Configure web filterning on FortiGate based on FortiGuard categories.

Ensure FortiGate has a valid FortiGuard security subscription licence.

 Identify how the FortiGuard service categorizes the website that needs
to be blocked or allowed.

Configure web filtering security profile to use FortiGuard category

based filters.

apply web filtering security profile to the firewall policy to start

inspecting web traffic. enable logging in the policy for logs.

test the webfiltering security profile configured for the specified

FortiGuard category-based filters.

------------------------------------ INTRUSION PREVENTION SYSTEM

------------------------------------------

In this lesson we learn

what is IPS (Intrusion prevention system)

How IPS detect and block malicious activity on a network.

configure IPS (FortiGate intrusion prevention system).

Common best practices when working with an IPS.

IPS is a network security feature built into the FortiGate next generation
firewall that proactively monitors network traffic to detect and block known
and

unknown attacks, including malware, exploit targeting vulnerabilities, and

other malicious activities.

it uses combination of signature based, behaviour based and anomly based

detection methods to identify and prevent threats in real time before they
can harm

your network and devices.

IPS plays very important role in preventing cyber attacks and protecting
networks from various threats.

IPS can detect and block malicious network activity by analyzing the traffic
and identifying and blocking potential threats.
FortiGate uses IPS engine and IPS sensors to identify the malicious traffic.

IP engine : it is designed to inspect network traffic in real time, looking for

patterns that match known attack signatures or anomalous behaviour.

it uses Deep packet inspection (DPI) to analyse network

traffic in different layers not just headers but payload too.

IPS engine is built to operate at high throughput using

hardware acceleration and intelligent traffic handling to minimize the latency.

IPS sensors : contains predefined or custome rule set (Collection of IPS

signatures and filters) that determine what type of threats the IPS engine

should look for.

IPS sensors is also provide ability to bolck known

malicious URLs and IP addresses linked to botnet command control servers.

sensors can be tuned to detect for

malware and exploits

DOS attacks

suspicious protocol usage.

vulnerability-based threats.

Once IPS detects malicious activity it can take many actions like simply
creating logs to blocking the threat entirely.

IPS engine follows following detection techniques

Protocol decoders

atackers can make target system work abnormally or even stop

working by sending malformed packets.

FortiGate uses protocol detectors to detect anomalous traffic

patterns that donot conform to established protocol standards and
requirements.

this allows FortiGate to identify any HTTP packets that deviate

from the HTTP protocol standard.

Protocol decodes can identify most protocols even when they use
nonstandard port numbers.
 Signatures

once the FortiGate identify the protocol, uses signatures to check

malicious traffic.

Signatures are entries in a database that include very specific

details about known threats.

IPS examines the traffic and looks for matches in the database.

when IPS engine finds a match, IPS takes action configured for
that [Link] signature includes a default action, but we can change it
to any other as needed.

FortiGate firewall contains thousands of signatures and receive

daily updates from FortiGuard .

FortiGate uses signatures that we specify to examine the traffic.

signatures detect know threats effectively but doesnot detect

new or unknown threats.

Anomly based detection

IPS establishes baseline of normal network traffic and then uses

this to identify unusual or anomalous behaviour.

when traffic deviates from normal baseline IPS flagged as a

potential threat.

this methode cal help detect zero-day attacks but may generate
false-possitive.

Configuring IPS

three steps

first, select IPS sensor, that will be used to analyze

[Link] has several predefined sensors or additionaly we can create
custom sensor to meet our requirement.

second, review or edit signatures and filters included in the

[Link] can enable sensor to block malicious URLs and botent C&C traffic.

Third, once the sensor is ready apply it to firewall policy.

FortiGate IPS takes possible actions when it detects a network intrusion.

 Default : Use the default action based on the signature as it received
from the FortiGuard .

Allow : Allow traffic to continue to his destination

Monitor : Allow traffic to continue to his destination and log the activity.

Block : Drop traffic that matches the signature.

Reset : Reset the session whenever the signature is triggered.

Quarantine : Block the matching traffic. Enable packet logging.

quarantine the attacker.

determining and updating correct signature actions is part of the continuous

tuning that must do to improve effectiveness of IPS implementation.

different sensors can use same signature but with different actions
depending on the scenario of the traffic they examine.

Monitoring IPS logs is very important Intrusion Prevention widget displays all
logged information which included in security events section under
logs&reports.

Logs tab displays full information of the detetcted IPS traffic.

Verify the IPS databse is up-to-date : IPS must have latest information about
known attacks. FortiGate receives daily updates from FortiGuard . database
can also be updated manually.

Create Initial custome IPS sensors from default sensors. we should not edit
dafault sensors but we can clone default sensors and create custome from
cloned sensor.

consider using IPS for both incoming and outgoing traffic.

configure SSL inspection in place so that IPS can examine all traffic. without
SSL IPS will not detect threats inside the encrypted traffic.

Evaluate whether we need to tune IPS sensor. start with default actions,
Modify IPS sensors to meet requirements of environment depending on the
results obtained.
------------------------------------------ APPLICATION CONTROL
-----------------------------------------------

In this lesson we learn

what is Application control.

How FortiGate application control works to limit access.

Configure FortiGate Application control

Monitor FortiGate Application control.

FortiGate application control is a layer 7 feature that identifies, controls and

secures applications on a network by using a database of signatures to
detect

and block specific applications or actions within them.

this helps to block risky applications, gain network visibility, and enforce
granular policies to improve security and optimize bandwidth.

FortiGate application control helps enforce acceptable use and resulting

traffic flow or network applications as defined in policy.

Application control can identify the network traffic that is generated from
specific applications and take appropriate actions such as monitor, block
traffic,

apply traffic shaping for all or a specific set of users of a firewall policy.

Allows administrators to create detailed policies to manage access to specific

apps or features in apps such as blocking uploads to a cloud service, or

disabling video playback in a socia media app.

control traffic flow of network applications may not be a priority in traditional

client-server architecture that uses defined connection protocol over a

standard port number.

control application traffic gaining more importance over time in peer-to-peer

architecure where many servers need to send traffic using dynamic ports
such as bittorrent.
FortiGate application control works by comparing known traffic patterns to
those generated by applications during transmission.

FortiGate uses regularly update database of application signatures to detect

and manage applications. these are provided by the FortiGuard labs.

Traffic analysis is performed through the IPS engine, uses flow based
inspection. So pattern match is performed by the entire byte of the packet,
independently

of the protocol or port number.

In the application control security profile application control settings can be

configured that must be applied to the policy.

Application control settings are grouped by category each category can be

set to monitor, allow, block or quarantine.

override option can be used to configure each application signature or group

of application signatures to provide more granularity.

to configure FortiGate application control to limit access to specific

applications

create or modify application control security profile

modify action in the application categories or configure

application override.

add profile to the firewall policy

verify the configuration by attempting to access the

corresponding application

monitor applications access limitation using FortiGate logs.

------------------------------------------ Maintenance and Monitoring

-----------------------------------------------

In this lesson we learn

 Perform common FortiGate maintenance tasks

Backup and restore a FortiGate configuration

upgrade FortiGate firmware

Monitor FortiGate resource use

Examine FortiGate licences.

Monitor FortiGate Logs.

Performing regular maintenance on FortiGate is essential to ensure the

seucirity and optimal performance of network.

Administrators should prioritize these tasks to prevent security breeches,

optimize performamce, meet compliance requirements, and ensure
bussiness continuity and to ensure network availability.

Tasks involves like examining licences, monitoring event logs, backups,

firmware upgrades, ongoing monitoring of system performance, security and
health.

also includes tracking metrics like CPU, Memory, and bandwidth, analyzing
logs for threats, and using tools like fortimanager, fortimonitor for centralized

management and detailed performance visibility.

Backing up the FortiGate configuration is the process of saving a snapshot of

its settings, such as network policies, users, and other parameters to an
external device or file.

this is very crucial task that protects against dataloss, allows for quick
restoration after hardware failure, factory resets, or failed configuration
changes.

Backups can be perfomed manually through GUI or CLI, or automated to a

SFTP server or USB drive or FortiGate cloud.

Administrators should back up their system configuration on a regular basis.

Administrators can store configuration revisions locally on the firewall if

FortiGate has 512MB of flash memeory.
FortiGate firmware upgrade is the process of updating operating system to a
newer version which can include new features, bug fixes and crucial security
patches.

this process is essential for keeping the network secure and for optimal
performamce.

upgrades can be performed through GUI or the CLI.

upgrading firmware helps FortiGate firewall to stay upto date on the latest
security threats and ensure optimal performance.

firmware version 7.2 or later there is a tag to indicate its maturity level

F for features indicates firmware has new features.

M for Mature indicates that firmware release doesnot include any new
major features.

Firewall with firmware upgrade license displays the notification when new
firmware is released and provide option to install [Link] way FortiGate
downloads and

installs the upgrade automatically.

Administrators can also download the firmware manually from the fortinet
support [Link] way it is important to ensure that firmware is compatible
with the FortiGate model.

and follow the supported upgrade path.

it is highly recommended that administrator create a configuration back up

before upgrading the firmware.

FortiGate firmware upgrade path is the officially documented, step-by-step

sequence of firware versions required to move from a current version to a

target version safely and successfully. it is a recommended sequence of

firware upgrades that must follow when updating a FortiGate device.

it ensures that new version is compatibile and guarantees the stability of

FortiGate device.

it is crucial to follow this path to avoid configuration loss, feature

incompatibility, or boot failures. can be found using upgrade path tool or in
GUI.

All Upgrades option follow recommended upgrade path automatically.

upgrade path tool is a utiliti provided by the fortinet to determine the correct
and sequential series of the firmware version required for the safe upgrade.

it is a online service which provides recommended sequence of firmware

versions for specific FortiGate platform.

Monitoring the performance of FortiGate helps to ensure that it is functioning

[Link] also to ensure its hardware is adaquately sized to handle the
network traffic.

it also helps to protect firewal from overloaded and underused.

it involves tracking metrics like CPU and memory usage, concurrent sessions,
and bandwidth utilization to ensure optimal security and network health.

Administrator should always monitor CPU, memory usage, available disk

space to protect firewall from performance issues and to identify potential
bottle necks.

we should also monitor non-hardware parameters for a complete overview of

the firewall performance like number of sessions, logs generated per second,
number VPN users connected.

GUI includes several widgets that can used to monitor these resources,
Admins can add or remove widgets as needed and change settings and
layouts.

FortiGate licence is a subscription that grants access to fortinets security

services and support for a FortiGate firewall.

involves providing continuous updates against new threats and professional

assistance.

it includes features like antivirus, IPS, web filtering through FortiGuard

security services, as well as technical support and device maintanance via

forticare support [Link] services available depends on the licence

package like Adavanced threat protection or Unified threat protection.

It is important to renew all licences before they expire to avoid disruptions in

network services, legal issues, and maintain compliance.

FortiGate doesnot receive software updates and technical support with no

valid licence.

some features may run during grace period while others stop running
completely.
FortiGate logs provide important information regarding firewall activity,
includes, network traffic, security events and system events.

Monitoring logs regularly helps administrators to identify security threats,

throubleshoot issues and provide insight into network and system
performance.

Logs information can be found from logs and reports section.

system and security events section provide summary page in addition to the
usual log entries.

Log categories used to display the specific logs on filter based.

configuration revision is the saved version of the firewall configuration,

allows administrators to track changes, compare different states, and revert
to a

privious configration if needed.

------------------------------------ IPsec VIRTUAL PRIVATE NETWORKS

----------------------------------------------------------

In this lesson we learn

what is IPsec VPNs and why they used.

How IPsec VPN works

Configure IPsec VPNs

IPsec VPN is a secure, encrypted tunnel over internet created by firewall

using IPsec protocol.

it allows secure communication between FortiGate and the remote user or a

branch office encrypting all transmitted data and protecting it from
unauthorized

access and interception.

this is used to connect remote employees or different office location to a

private network securely.
IPsec is a suite of industry standard protocol that is used to create secure
connection between devices located on different or geographically distant
networks.

known as VPNs.

features of IPsec VPNs are

Data authentication - authenticates end to end of the connection to

ensure that only authorized devices can join the network.

Data integrity - protects the data from tampering during transmission.

Data confidentiality - It encrypts all the data transmitted through the

tunnel to ensure confidentiality.

Anti reply protection to prevent reply attacks

standard protocol - uses standard IPsec protocol which can connect to

a other IPsec-compatible devices and clients like forticlient.

IP sec VPN offers

security, performance, flexibility for connecting networks and remote users.

Advantage of IPsec VPN is that IPsec VPNs do not require intervention of

service providers. The core technology of IPsec VPN can be set and managed
by

an organization own IT staff.

Network level security - secures all traffic at the network layer, not just
specific application.

High Performance - faster than SSL VPNs, it is used efficient protocols

like IKEv2 and L2TP.

Strong encryption - used strong encryption algorithms like AES-GCM,

AES256, AES126.

Reduced overhead - creating IPsec VPN tunnel reduces overhead on

office firewall.

Flexible connectivity -

Auto discovery VPN (AD-VPN) - automatically establishes tunnels

between spokes, creating direct paths for spoke-to-spoke traffic, without
always going through the Hub.
 Centralized management - using fortimanager, administrators can
push VPN configurations to many endpoints at once, efficient for large
number of remote servers.

Remote user access - Allows remotes users to access the office

network and internet through a secure IPsec tunner using clients like
Forticlient.

There are two types of VPN created using IPsec.

Remote-access vpn and site-to-site VPN.

Remote Access VPN :

it is a secure way for remote users to connect to private network over

the internet.

it creates a encrypted tunnel using IPsec or SSL VPN protocols to

protect data and allow remote workers to access internal resources like file
servers and applications.

as if they were on the local network.

it allows client device to connect to a remote network.

these are commonly used by mobile workers who need a secure way to
access files ad services hosted on their company network while they are
traveling or at home.

in remote VPN, client always initiates the [Link] users

authenticates their workspace network with the password.

other factors includes MFA.

FortiGate device acts as VPN server, and a client application like

forticlient on the users device establishes an encrypted tunnel to it.

Once user authenticates workspace network, user can access internal

resources, such as shared drives, internal websites, and other network
services,

through the VPN tunnel.

Site-to-site VPN :
 site-to-site VPN is a secure , encrypted connection created between to
different networks. allows them to share the resources.

it creates virtual tunnel over the public internet, encrypts all traffic that
passes through the tunnel, protects data from unauthorized access.

common solution for connecting branch office, a local office to cloud

provider like AWS and Azure, securing traffic between two different locations.

Tunnel creation : Secure IPsec tunnel is established between two

FortiGate firewall one at each location.

Data encryption : all the traffic sent between the sites is encrypted as
it travels through the publick [Link] data is not intercepted.

Resoource sharing : once the tunnel is up, devices on the network can
communicate with devices on other, accessing shared files, applications and
resources.

Configuration : setting up IPsec tunnel with matching parameters,

create firewall policies to allow traffic through tunnel, defining static routes

to direct traffic to the correct network.

in site-to-site VPN eighter side can initiate the connection. in Multiple

site-to-site VPN hub-and-spoke, partial mesh,full mesh topologies can be
created.

FortiGate can establish site-to-site VPN with other FortiGate devices, as

well as with other vendors including cloud service providers like AWS and
AZURE.

connecting through an VPN means creating an encrypted, secure

tunnel for internet traffic through a remote server, which hides IP address
and protects online privacy and security.

it is also used to access private networks securely from a remote

location.

Through a VPN service, two different networks becomes a same logical

networks.

IKE protocol is a core component of the IPsec security protocol that

establishes a secure, authenticated communication channel between two
parties.
IKE protocol is used to setting up the IPsec tunnels by handling key
management, authentication, and negotiation of security parameters like
encryption algorithm and key lifetimes.

IKE protocol is used to create the tunnel [Link] are two versions
avilable for IKE : they are IKEv1 and IKEv2.

there are two phases, first phase to create a secure channel for control
traffic, and second phase to negotiate the security policies for the actual
data traffic.

IKEv2 is widely used in VPN deployments as it has many security

improvements than IKEv1.

IKE Phase 1 : This is an initial phase sets up a secure, authenticated

channel between two devices.

negotiates security parameters like encryption and

authentication algorithm, using set of predefined policies.

performs mutual authentication using methodes like pre-shared

keys and digital certificates.

Diffie-hellman exchange is performed to securely generate a

shared secret key with out sending it over the network.

two peer devices authenticate with each other and establish a

secure channel that they will use to negotiate the security parameters of
phase2.

This first phase acts as control plane for the VPN connection.

peers can be configured with several combinations or proposals,

consits of several security parameters.

the following parameters must match for successfull phase 1

IKE mode - main or aggressive

Authentication

Encryption algorithm

Hashing algorithm

Diffie helman group

IKE Modes
 Main Mode : this is more secure but slower

it uses six messages to establish the initial

security associations and exchange keys.

it provides peer identity protection. as

identities are exchanged after initial secure tunnel is established.

6 messages follows

establish encryption and authentication algorithms(1-2)

perform diffie-hellman key exchange to create a shared secret

(3-4)

authenticate the end-point identities in an encrypted format (5-6)

Aggressive Mode : this is faster but less secure

It uses three messages to establish the

initial SA.

It does not provide peer identity

protections as identies are sent in the first message, before the secure
tunnel is established.

3 messages follows

Proposes IKE proposal, exchanges diffie-hellman public value and

sends identity information.

Accepts the proposal, sends its public key and identity,

authenticates the intitiator

authenticates the responder, confirms the exchange, completes

the IKE SA negotiation.

Phase 2 can start only after phase 1 completes successfully.

IKE Phase 2 : this is also known as quick mode. in this mode peer
devices determine which traffic must be sent over the VPN and how it will be
authenticated and encrypted.

this phase is acts as data plane.

this phase negotiates the security parameters and keys for the actual
data to be sent over the IPsec tunnel, using the secure channel established
in phase1.
 IPsec security association established in this phase by defining the
encryption and authentication algorithm.

the following parameters must match for successfull Phase2

encryption algorithm

hashing algorithm

Diffie hellman group.

perfect forward secrecy - each new data encryption key is

derived independetly of previous key.

PFS prevents attacker who compromises a single key from

being able to decrypt all past or future communication.

traffic that is to be protected must be indicated by subnets that will

communicate through tunnel.

in remote access VPN,both subnets are configured on server site.

in site-to-site VPN, subnets on each peer must mirror each other.

IKEv2 - this protocols is used to setup and manage secure,

authenticated connections for VPN, works with IPsec to encrypt the date.

it authenticates both VPN client and server and establishes

rules for secure data exchange.

it offers speed, stability,performance and security

particularly on mobile devices, because of its ability to quickly reconnect
after a dropped connection.

it is recommended for new IPsec VPN implementations.

IKEv2 does not include two phases.

IKEv2 benifits over IKEv1

Reduced bandwidth usage - uses less bandwith to establish and

maintain tunnels.

Faster tunnel setup : fewer message exchanges and lower

overhead lead to faster connection establishment.

Reliability - use of sequence numbers and acknowledgements in

its messages.
 supports EAP, adds more flexibility, scalability, and
interoperability during the authentication process.

Supports PPK Postquantum preshared keys

Supports Asymetric authentication - Each peer can choose its

own authentication, allows peers to use different authentication methodes
which increases flexibility.

supports stronger securoty algorithm, FortiGate supports PRF-

SHA for hashing, AES-GCM for encryption, both with several bits lengths
available.

Improved resilience - Responder checks the initiator validity

before establishing the connection. these mechanism helps to mitigate the
DOS attack.

Authentication Header

it is a component of IPsec protocol suite that provided Integrity,

data origin authentication, and optional reply protection for IP packets.

it adds header to each packet that contains a cryptographic hash

or checksum of the packets contents, ensuring the data is not altered and
has come from expected sender.

Encapsulating security payload (ESP)

FortiGate firewall supports ESP protocol for authentication and

encryption of VPN traffic. ESP protocol works with IPsec suite that provides
security services like

data integrity, confidentiality encryption and data origin

authentication for IP packets.

ESP handles encryption protects packets contents from being

read by unauthorized parties.

ESP resolves compatibility issues with NAT devices.

ESP doesnot provide identity authentication, However identity

authentication provided by IKE during phase 1 negotiation.

Encryption and hashing algorithms supported by ESP in FortiGate.

 DES : Data encryption standard, this methode is used to encrypt
the data as cyphertext using [Link] is considerd as week compared to other
algorithms and not

recommended to use in modern systems.

3DES : Triple data encryption standard, it uses three DES

operations in a row to provide a stronger level of encryption. this type of
encryption is not recommended due to

slow performance and its short key length.

AES : Adavanced encryption standard, widely trusted and highly

symetric encryption algorithm used to protect electronic [Link] is available
with several key length.

higher the number of bits in the key, strong the encryption

achieved. it is very secure and widely used encryption [Link] encrypts
pain text into an unreadable

ciphertext using secret key, it uses same key to decrypt

back to original form. it is used for securing everything from internet
communications and financial transactions

to files and wireless network.

MD5 : it is an cryptographic hash function that takes any size

input and produces a fixed-size 128-bit message digest or hash [Link]
ensures data integrity, file or

message has not been accidentally altered or corrupted. it

can be found in some legacy systems and applications. it is not
recommended to use in systems

that require stronger security.

SHA-1 : secure hash [Link] provides 160-bit hash value.

used for data integrity and data signatures. it is not recommended to use in
systems that require

stronger security.

SHA-2 : it is family of cryptographic has functions that take any

size input and creates a fixed size string of character or hash. it ensures data
integrity and
 authenticity by creating unique, irreversible output for
each unique input.

SHA-2 includes six functions : SHA - 224,256,384, 512,

512/224, 512/256.

it is more secure than SHA-1. higher the number of bits

used, resulting hash will be more secure. it is considered as secure option.

Best practices to avoid unexpected issues with VPN.

ensure firewall has latest updates and security patches. upto date
firewall minimizes the risk of cybercrime.

use best encyption and hashing levels that meet requirements. the use
of stronger encryption and hashing algorithm require more CPU resources
and effect device

performance. specialized content processors can offload the

encryption and decryption operations from CPU.

Verify both peers supports same IPsec features. Verify which IPsec
features are supported since they must match to establish an IPsec VPN
connection.

Ensure ports required to configuration are open in all the firewalls in

the traffic path.

IKE uses UDP protocol port 500 by default, and UDP 4500 when VPN
device is behind NAT. make sure these ports are not blocked by firewall for
successfull VPN connection.

select the proper mode when using IKE1

Main mode : more secure but slower, this mode is default for sit-
to-site VPN.

Aggressive mode : less secure but faster. this is default mode for
remote access VPN.

configuring FortiGate IPsec VPN involves setting up secure encrypted tunnels

for site-to-site or remote access connections by defining tunnel parameters,
authentication methodes

firewall policies to manage traffic.

use IPsec wizard to create the tunnel, using name, template type, select local
interface and remote gateway IP address.

setup authentication method(pre-shared key or certificates) and configure

IKE parameters such as encryption, authentication, diffie-hellman group.
ensure they match

on both side of tunnel

Define network objects, create address objects for local and remote subnets
to be used in the VPN and firewall policies.

configure remote users and groups, create a local user and add it to user
group. this group is used to control VPN connection and permissions.

create firewall policies, used to permit traffic between VPN users and the
internal network.

add routes, for site-to-site VPN, add a static route to the remote subnet to
point to the newly created IPsec tunnel interface.

configure the client, configure the connection details on client side such as
tunnel name, gateway, pre-shared key, and use two-factor authentication if
configured.

Monitoring the VPN tunnel includes

tunnel status, traffic volume, status of phase1 and phase2.

this is helpful in troubleshooting

---------------------------------------------------- SSL VPN

---------------------------------------------------------------------------------------------

In this lesson we learn

what is SSL VPN and its benifits

How SSL VPN works

configure SSL VPN

Best practices while using SSL VPN

SSL VPN uses SSL encryption to create a secure and encrypted connection
between client device and VPN server.

SSL VPN is used to grant the remote access to the users to their corporate
[Link] can access resources from any web browser or forticlient.

SSL VPN can be also configure between two FortiGate firewalls.

SSL VPN have two modes

Web-based mode : no software installation required

Tunnel mode : required forticlient application and creates full tunnel

connection.

SSL VPN benifits

SSL is used to encrypt HTTP trafic uses port 443. generally this traffic is not
blocked by intermidiate firewalls.

SSL VPN use common protocols like SSL/TLS which are already built into web
[Link] gives benifit of ease of access with out client software.

this simplifies deployment and user experience, while still providing

strong encryption to secure data in transit.

SSL VPN is flexible for clients. they use web-browser to access the web
[Link] VPN allows users to securely connect to the network from any
location and on various devices

without requiring to install dedicated client software. this approach

makes easy to enable remote access to employees, mobile workers,
contractors, which offers

scalability and cost effectiveness.

SSL VPN provide granular control over [Link] administrators to

grant access to specific applications rather than an entire [Link]
restricts unauthorized

access to data, network and applications.

SSL VPN provides data integrity checks for windows clients. this ensures that
remote devices connecting to the VPN are compliant with the security
policies of organization.
 this
also ensures that data transmitted between windows client and the VPN
gateway remains unaltered and has not been tampered with in transit.

SSL VPN checks for antivirus, if antivirusis not installed it disables access.

SSL VPN is cost effective. no additional licence is required. Forticlient VPN

can also be download at no cost from SSL portal.

SSL VPNs are available in two modes.

Web-mode :

HIGH AVAILABILITY

Device members share information which is required for the cluster to

function properly. the information as follows,

cluster configuration settings

FIB entries

DHCP leases

ARP table

FortiGuard definitions

IPsec tunnel SAs

information about current sessions

monitored interfaces

there are two HA modes

active-passive
primary device handles all traffic

all other devices remain in standby

if primary fails, new primary is elected from available devices.

active-active

All devices process traffic simultaneously

Primary device assigns and distributes supported sessions to the secondary

devices

this option is resommended for high throughput environments. it offers

redundancy and equal load balancing in high-traffic environment.

FortiGate HA requirements

Same hardware model

must have same firmware version

must run same lecensing model

units must physically connect with atlease one dedicated heartbeat

interface and have the same network topology.

harddrive configuration and operation mode (NAT or transparent mode)

following parameters must match during HA configuration

HA group ID

group name

password

heartbeat interface settings

Best practices when working with HA

use atleast two dedicated heartbeat interfaces for redundancy and fast
failure detection. this prevents split-brain scenario (More than one unit tries
to be primary)

Dual back-to-back connections between HA units are highly

recommended.
 use identical connections for internal and external interfaces. connect
each HA device to the same switch using identical ports and cabling

ensure all units use the same hardware model and firmware version to
avoid compatibility issues.

Always do configuration changes on primary only

enable link monitoring on critical interfaces like WAN and LAN to detect
port failures.

Test regularly, periodically check failover functionality to ensure the

cluster performs correctly in real-world situations.

---------------------------------------------------------- FortiLink
----------------------------------------------------------------

in this lesson we learn

what is fortilink and its benifits

how fortlink works

configure fortilink

best practices while using fortilink

FortiLink is a fortinet proprietary protocol.

FortiLink is a management and tunneling protocol that allows a FortiGate

firewall to manage local fortiswitches and FortiAP wireless APs.

FortiLink simplifies network management by centralizing control on FortiGate

firewall for both security and switching.

FortiLink enhance the fortinet security fabric by enabling LAN devices to

become part of security infrastructure.

FortiLink creates a security tunnel using 802.1Q VLAN tagging, allowing

FortiGate to push the security configurations, security policies, and manage
devices.

FortiGate supports 8 to 300 Fortiswitches depends on model.

Fortilink is used for

Centralized management : Fortilink consolidates the management of

fortiswitches and FortiAP onto FortiGate firewall. Administrators can connect
and manage fortiswitches

from the FortiGate GUI or CLI.

Security policy enforcement (Enhanced security) : Fortilink extends the

security policies configured on firewall to LAN edge. ensures consistent
security across

wired and wireless networks.

simplified deployment : Fortiswitches can be automatically detected

and authorized for management in FortiGate.

Scalability and redundancy : Fortilink supports various configurations

and multiple topologies such as stacking and clustering, uses multiple ports
for

load balancing, uses split interfaces for redundancy.

NAC : network access control feature identifies connected devices

based on MAC, operating system, device type, and automatically assign
them to specific VLAN. this

is useful in securely onboarding devices like IoT sensors.

FortiGate uses several protocols to control fortiswitch

FortiGate uses fortilink protocol for discovering fortiswitches. managed

switches connected directly to FortiGate uses fortilink to send heartbeats.

fortilink discovery frames include information about the switches serial

numbers and ports.

LLDP is also used for switch discovery. it is also used during switch stack set
up.

CAPWAP - control and provisioning of wireless access points is a standard

protocol designed for centralized management of wireless access points.

fortinet CAPWAP implementation performs switch authentication,

authorization, health checks by establishing a secure tunnel between
FortiGate and managed switches.
CAPWAP is also used for sending firmware image file to a switch using
FortiGate GUI firmware upgrade tool.

CAPWAP sends switch logs to FortiGate.

HTTPS is the default protocol used for firmware upgrade operations, in

addition to rest API management.

FortiGate also uses DHCP, NTP, DNS, SSH are used for management tasks.

802.1Q protocol : this protocol is used for carry management information and
all user traffic between the devices. this also helps FortiGate to manage
VLANs and

and apply security policies at network edge.

traffic tunneling

Enable switch controller feature on the FortiGate device

configure the fortilink interface under the WiFi&switch controller

Add the desired physical ports to interface members (Add atleast two ports
for redundancy)

configure IP address for the fortilink [Link] IP serves as the

management IP for the switch controller.

enable DHCP server, automatic switch authrization, split [Link]

interface is used when you need to connect fortilink aggregate interface to
one or more fortiswitches.

connect fortiswitch to FortiGate interface configured for [Link] that

fortiswitches are discovered by FortiGate after few seconds under
WiFi&switch controller.

once authorized, switches become visible and manageble directly from the
FortiGate interface.

new fortiswitches broadcast fortilink discovery frames on all ports by default,

simplifying the connection process.

old fortiswitches require connecting through specific dedicated ports to

initiate fortilink communication.
Fortilink enables FortiGate to centrally manage fortiswitches using a variety
of deployment topologies. they are

Single FortiGate, HA peer, L3 network, standalone dual homed.

Best practices on fortilink deployment

enable link aggregation to ensure redundancy and increase throughput

between FortiGate and fortiswitches.

Keep firware version consistent across fortiswitch and FortiGate to ensure

compatibility.

plan VLAN and ports before deployment. consider future network growth.

regularly monitor switch status and logs to identify problems early. we can
monitor via FortiGate or fortianalyzer.