Cyber Blog

How to create Fortigate SSL VPN

SSL-VPN provides remote users with access to the corporate network using SSLVPN  client while connecting through the Internet to the corporate FortiGate unit. During the connecting phase, the FortiGate unit will also verify that the remote user’s antivirus software is installed and current…

Step 1. Create an SSL VPN portal for remote users

Go to VPN > SSL > Portals

Step 2. Create a user and a user group

Go to User & Devices > User > User Definition

Step 3. Add an address for the local network

Go to Policy & Objects > Objects > Addresses

Step 4. Configure SSL VPN tunnel

Go to VPN > SSL > Settings and set listen on interface(s) to wan1 (i.e. outside interfaces)

Step 5. Add security policies for access to the internet and internal network

Go to Policy & Objects > Policy > !Pv4

Step 6. Set up Fortigate unit to verify users have current antivirus software

Go to System > Status > Dashboard

On CLI Console type

config vpn ssl web portal

edit full-access

set host-check av

end

Step 7. Verify Results

On your url type https://x.x.x.x (IP of external interface – wan1)

Log into the portal using the credentials you created in step 2

Go to VPN > Monitor > SSL-VPN Monitor

Go to Log & Report > Traffic Log > Forward Traffic

Reference: Keith Leroux

How to configure Wired 802.1x on ISE 1.3…

1. Add an external identity source e.g. AD

If you have multiple identity sources, create an identity source sequence

Add ISE(s) as join points to AD

Add AD OUs as groups

To enable machine authentication; go to Administration, external ID sources, Advance settings – Tick the check boxes for Password change, Machine authentication and Machine access restriction

Under System, make sure you see all the ISE nodes their roles and services status

2. Add network resources.

Simply add the dot1x switches

3. Create authentication policy

From Policy -> Result -> Authentication, create an authentication allowed protocol e.g. “PEAP-TLS”

Now create an authentication policy by duplicating the default wired condition. Rename the authentication policy and allow the protocol “PEAP-TLS” created in (3). Replace “Internal end points” with the authentication sequence you created in (1b).

4. Create authorization profile

Duplicate wired 802.1x authorization profile; rename it for example, “Wired-802.1x-users” save

Now create Condition and result for this rule.

Duplicate Wired 802.1x Condition and rename it for example, “Wired-dot1x-users”. With the AND operator add Domain user group to Frames and Ethernet.

Duplicate an existing result name it “Allowed-WD –Access” under authorisation profile, Create DACL and select the appropriate Data Vlan and Tag. Save configuration.

5. Create Authorization policy
Duplicate 802.1x authorization policy; rename it… e.g. (Wired-Auth-Policy)
Using the Condition and the authorization profile result you created earlier, update the authorization policy you just created.

Note: There are two options in matching policy rules. 1. First match and 2. Multi-Match. User the dropdown at the top to select between both as it suites you environment.

Different types of firewalls… How it works

Packet-Filtering Firewall – ACLs – IPs and Port numbers Operates at layer 3 and 4

Stateful Firewall – Operates at layer 5

Application/Proxy Firewall – Proxy for clients with security app like Websense, McAfee – Layer 7 FWs

Reverse-Proxy Firewall – Proxy for server with security app like Websense, McAfee – Layer 7 FWs

http://www.networkworld.com/article/2255950/lan-wan/chapter-1–types-of-firewalls.html

Summary

Packet filtering alone does not provide enough protection. To effectively block peer-to-peer-related network traffic, you need a firewall that does application filtering, which can be regarded as an extension of stateful packet inspection.

Stateful packet inspection can determine what type of protocol is being sent over each port, but application-level filters look at what a protocol is being used for.

For example, an application-level filter might be able to tell the difference between HTTP traffic used to access a Web page and HTTP traffic used for file sharing, whereas a firewall that is only performing packet filtering would treat all HTTP traffic equally.

Application layer firewalls are generally slower than stateful inspection. Application-layer firewalls are sometimes implemented using application proxies. Two TCP connections are established: one between the packet source and the firewall, another between the firewall and the packet destination. Application proxies intercept arriving packets on behalf of the destination, examine application payload, and then relay permitted packets to the destination. Suspicious data is dropped and the client and server never communicate directly with each other. Proxies necessarily involve more protocol stack overhead than inspecting packets at the network layer. Furthermore, because a unique proxy is required for each application, proxy firewalls can be less flexible and slower to upgrade than stateful inspection firewalls. Nevertheless, because application-level proxies are application-aware, the proxies can more easily handle complex protocols like H.323 or SIP, which are used for videoconferencing and VoIP (Voice over IP).