Advanced Network Security with Fortinet Firewalls

In short: a Fortinet FortiGate is a next-generation firewall: besides filtering ports and addresses it inspects applications, blocks intrusions (IPS), filters web content, scans for malware and terminates VPNs. This guide covers what it does and how to bring one into service: physical connection, WAN/LAN setup, policies, security profiles, VPN and monitoring.

What a FortiGate firewall does

• Intrusion prevention (IPS): detects attempts to exploit known vulnerabilities and blocks them before they reach your servers.
• Web filtering: controls which sites users may open and blocks malicious or unwanted categories.
• Application control: identifies applications in the traffic (not just ports) and allows or blocks them.
• VPN: IPsec site-to-site tunnels between offices and SSL-VPN for remote staff.
• Antivirus and content filtering: scans downloads and mail attachments for malware.
• Layered security: each engine handles a different class of threat, and FortiGuard updates the signatures continuously.

Step 1: physical setup and first login

Connect the WAN port to your internet provider and the LAN port to your switch. Open the default management address (usually https://192.168.1.99) in a browser, log in as admin with an empty password and set a strong password immediately; the device will also ask you to register it and accept firmware updates.

Step 2: network and internet access

• WAN interface: choose DHCP if the provider assigns the address automatically, or enter the static IP, subnet mask, gateway and DNS the provider gave you.
• LAN interface: set the internal address (for example 192.168.10.1/24) and enable the DHCP server if the FortiGate should hand out addresses.
• Static routes: add a default route through the WAN gateway if DHCP did not create it.

Step 3: firewall policies

Nothing passes until a policy allows it. The first policy is usually internet access for the office: source LAN, destination WAN, service HTTP/HTTPS/DNS (or ALL for a start), action ACCEPT, NAT enabled. Add separate policies for servers (for example WAN → DMZ on ports 80/443 only) and keep the implicit deny at the bottom. Attach security profiles to each policy:

• Web filter: block malicious sites and chosen categories.
• Application control: block peer-to-peer and anonymiser applications, allow business tools.
• IPS and antivirus: enable on every policy that carries user or server traffic.
• SSL inspection: certificate inspection at minimum; deep inspection where your policy allows it.

Step 4: VPN

For remote staff enable SSL-VPN on the WAN interface, create a user group, and write a policy from the SSL-VPN interface to LAN. For a second office configure an IPsec tunnel with the wizard (site-to-site, pre-shared key, matching phase 1/2 settings on both ends). Pair the VPN with two-factor authentication through FortiToken or an external provider.

Step 5: monitoring and maintenance

• Enable logging to disk or FortiAnalyzer and review the Threats and Traffic dashboards weekly.
• Keep FortiOS updated; security fixes for the management interface are frequent and important.
• Restrict administrative access to trusted hosts and change the management port.
• Back up the configuration after every change (System → Configuration → Backup).

Where FortiGate fits

A FortiGate is the right tool for an office network, several servers behind one edge or a company that needs VPNs and content filtering in one box. For a single VDS, a host firewall such as UFW plus hardened SSH covers most needs, and Fiberserver VDS and dedicated servers already include network-level DDoS protection.