Getting Started with FortiGate: This book will take you from complete novice to expert user in simple, progressive steps. It covers all the concepts you need to administer a FortiGate unit with lots of examples and clear explanations.

The checks performed by a Fortigate unit can be summarized in four different levels of control. If any step inside the different layers containing a blocking rule is met, the data package would be discarded. These levels are as follows:

The primary use of a FortiGate unit is to protect our networks from attacks with its firewall features. The security policies will define the allowed network traffic. Now, let's us take a look at a set of base objects that we will use to create and manage the policies.

Unified Threat Management (UTM) creates additional control layers that examine the contents of the network traffic already permitted by the rules related to addresses, services, and schedules as mentioned previously. The UTM options can be grouped into a profile that we are able to apply to one or more firewall policies. In the following screenshot, we have the UTM menu of a FortiGate unit with the different UTM features shown.

Inside a security policy we are able to assign a Traffic Shaping configuration. The parameters include minimum as well as maximum levels of bandwidth to be able to guarantee QOS (Quality of Service). Traffic shaping is configured by navigating to the Firewall Objects | Traffic Shaper pane (shown in the following screenshot):

Security policies will define which session matches with one or more rules in a set and the actions the FortiGate unit will perform. The list of elements that a FortiGate will check includes:

Based on the policies, a packet can be accepted or denied. Security policies are managed by navigating to the Policy | Policy | Policy menu. In the following screenshot we can see the screen used to edit a security policy:

After we have defined a firewall policy, it will look like the following screenshot. Inside a single policy firewall, the controls will be applied in the order we have selected. The firewall policies are evaluated in order from top to bottom. The first rule to match a packet will perform the action specified by the matched rule.

FortiClient is an endpoint management software available in the following two versions:

Up to ten managed clients are available for free, then the number of clients that we are able to license depends on the type of FortiGate unit we are using. The client software is available for Microsoft Windows (Windows 8, Windows 7, Windows Vista, and Windows XP) and for Mac OS X (10.8, 10.7, and 10.6). On the FortiClient page (http://www.forticlient.com/) we also have apps for iOS (for iOS 5.1 or higher) and Android (Android 4.0 or higher). FortiClient can also be downloaded from the Fortinet Customer Service & Support page ...

The policies and configurations we have explained for the FortiClient software can be seen as a part of a larger management scope, dedicated to controls on personal mobile devices connected to our network. The full list of controls includes:

We have already seen the option (inside the interface configuration) to enable device monitoring. The resulting data is included in the Device definition menu under the Device tab in the User & Device option. In the following screenshot, we have an Android tablet and a Windows laptop connected to our FortiGate unit:

MAC filtering is useful to limit access to our Wi-Fi network. If we enable a DHCP server on our interface, the default value is to assign an IP address to any MAC. We are able to apply a stricter control changing the option for Unknown MAC...

During this chapter we have introduced the firewall features of FortiGate and the tools dedicated to device management. UTM and the related security and profiles have been presented, and we have seen also a short explanation of the FortiClient software, that adds many administrative mechanisms for endpoint control. In the next chapter we will talk about expanding our network in a secure manner using VPNs and tunnelling.