Fortigate firewall training for beginners

to hardening your firewall one of them is when you have unused interfaces disable them disable them if you have interfaces that you want to disable different protocol so just disable them using config system interface edit the interface that you want to disable and there you can unset dhcp relay services you can unset pptp client arp forwarding and so on um another thing that is uh quite common to any 48 out there and there is something that i'm not familiar with other firewalls which have maybe yes or no the same functionality is what is known as the maintainer account the maintainer account is actually a backdoor to your photogate if your admin has lost its password then it allows you to actually put into your photogate using what is known as the maintainer account which is actually the serial number of your 48 with the maintainer user so you can actually disable it in most 40 gates i believe that is it is enabled by default set admin maintainer account disable so you've got your new four gate how do you configure it coming up [Music] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything so you've got your new photogate and your new 248 firewalls what do you need to do you have probably connected your 48 using a network cable um to your computer and configured it and fortigate appliances comes with at least port one one of the ports which is usually port one that is already configured with the ip address of 192 168 199 you need to configure your pc subnet to be on the same subnet get to the ip address of the interface of the port 1 interface and from there you're actually starting to configure your 48 now you can configure a photogate using the graphical user interface which has many features it even has a feature visibility feature in the system settings so that you can disable or enable new features which are not available over here now you can configure your photogate using the graphical user interface and you can configure it using the command line photogate experts use the command line almost all of the time we will look at the command line but we will make our way using the graphical user interface uh to get to the command line you need to click here it is actually a javascript app that runs on top the admin web app probably the first thing that you want to do is to write down get system status so you can see uh your 48 serial number um which assets which uh um accelerated hardware does its support are you using a hard disk or a flash drive uh the current security profile database and so on now we went into the interfaces you probably have one interface uh that you're connected to which will be the management interface now you need to connect one of your one interface to your isp either through a modern router or you can use your 48 as the router itself each interface each interface has a physical switchboard that you can connect to different subnets in your network now let's just um edit one interface let's see what's inside you can name your interface according to the subnet um in your local area network let's assume that we have a management subnet all right now you can uh define it a specific rule it can be a one dmz an undefined rule or uh a when so let's uh use the land so now we know that we have a management plan connected to port 8 on our photogate now the addressing mode can be manual it can be dhcp let's use the manual option and let's configure it to be 192.168. 2.1 slash 24 since we're using um 24 subnet now this address is the gateway interface address so any computer that will connect to one of the to the to port 8 will get an ip address in that subnet that is the 192.168.2.0 subnet but its gateway address will be 2.1 now we will also open the dhcp server so anyone that is connected there's a pool of ip address that it will grab uh we'll look at dhcp server very soon before that we need to configure administrative access which protocol will support administrative access we'll just use https and http for now we can also use ssh we can also uh configure it to support pings from host in that subnet or from a 4d manager but we will not do it right now ldp is a protocol that enables discovery between devices in the network it doesn't really matter you can disable or keep it for now now we have a dhcp server as i said any client that connects to that port will receive one of the ip addresses from the pool you don't have to use all the pool you can use only 20 ip addresses you can keep the dns server the same as configured here or you can specify your own dns server let's just specify google's dns server uh you can control the list time and if you click on the advanced if you have a dhcp server that is part of your domain uh which is not your 48 or your 48 interface you can configure its ip address here and then whenever a packet arrives on that interface it will head over to the dhcp server but for now we use we're using the gateway interface as the dhcp server you can configure an mtp server you can configure and this option is for more advanced users dhcp scopes or options and you can assign different ips to different devices based on their mac address another option is device detection device detections allows your photogate to detect which device and which operating system uh devices on the networks belongs to this is one of the things that you should keep enabled um don't bother with the explicit web proxy um you can enable a captive portal so if you have outsourced employees and you wish to jump a landing page with user credentials you can also do that but we will skip it for now so this is the basic configuration of the interface okay so now we have a management interface we have another interface which is the one interface that you connect it you connect it to your isp router we will call it when one the role is when we will we can use dhcp and if we want to make it more reliable we will use a static ip address so my gateway interface is 10. 0.3 and my router is actually 10.0.3.1 i've enabled http and https and as you can see uh you don't have a dhcp server whenever the role of your interface is when that is one of the best practices when using an interface as a when interface okay so we have a management interface we have a when interface now we want to make our uh managers and that are connected to that port which is port 8 to get out to the internet so the next thing to do is to configure a policy now we will configure a very basic policy which is a full access policy let's name it let's name it managers one and the incoming interface is management that's the lan interface of our managers the outgoing interface is when one that is the interface that is connected to our isp router that is the interface that takes them outside of the land towards the internet now when it comes to source let's for this video let's make it um very generic anyone can go anyone we can configure user groups and and different users we can also configure sets of parameters that control the different users but for now as for source anyone can get out as for destination they can go just about anywhere we can also create specific objects that will allow them to go to specific places but for now they can go just about anywhere as for scheduling we're not limiting them to specific hours or days so as for scheduling again they can get out to the internet any time of the day as for service we can deny them from getting out in specific services such as ftp but for now for our specific policy we will let them use just about any service now the action is accept we can also create a policy that will deny specific services or specific users from getting out or from doing specific things for now the action is accept inspection mode is uh is another topic that we will look into that is the inspection uh that is done to our networks when we're using security profiles such as antivirus or ips for now we will keep it at flow based mode now we will use net net is network address translation that is our private ip address which can be 192 168 2.6 will be translated to your 48 or to your isp public internet address um now we will not use security profiles you know what let's use antivirus let's use the default profile the default antivirus profile we will use certificate inspection when we use certificate inspection your fortigate checks the different fields that are coming from um servers certificates to see if they're valid if it doesn't have any mismatches and so on the last thing is to use our logging options we can log only security events but we will log all sessions so later on we can look at the login report and see what our users or what our host did okay so we have a manager's one policy we have two interfaces the when one which connects us to the outsides and the management uh interface which um managers in our company can connect to and get their ip addresses that was the second step now the third step is to configure a static route a static route is actually for our usage will be a default route that is i've already configured one so let's just look at it if you want to create new you just create new so default route actually tells your photograph that whenever he sees a packet uh any packet that is destined to any place which doesn't have a route at the routing table it will route it towards the when interface and the when interface address is a 10. 0.3.1 remember my isp router has that address now you can use specific parameters as distance uh you can use a priority it just tells me that i already have that static route which i do and once we have a static crowd a policy and interfaces that are configured correctly we can now connect our host to the management interface and those hosts can now get onto the internet let's just move to the rcli and let's see how do we configure interfaces using the cli so for the sake of our purpose let's let's configure port 7. so using the cli we will use the config system interface now let's edit port 7 as we said let's set its ip to 192.168.4.1 with a subnet of 24. let's set the management the management protocols to http and https and what else we can use many more if you will look at the let's end it now i want to show you something when you when you config system interface let's just get out here config system interface and if we look at ports port one for example we can use the show full config and as you can see there are dozens of features of configurations that you can add for our sake we have only enabled the ip address on the on that interface and let's look at it let's just refresh our page four seven and there it is now we can also configure the dhcp server and so on we have not done so on our cli um the last thing i want to show you once you get into your 48 you're actually the 40 gate administrators now you have two types of administrators on actually you have more than two types but the two most common types is a super admin which is you you have privileges to just about anything you can read and write and you can create another type of administrator which is the professional admin and where you can actually enable it different read and write privileges on the different places on your fortigate if you will head over to the cli and use the config system admin and you can edit the admin name i have two admins i have one which is the super admin and the second one which is offer test which is my second admin uh so now let's look at the different configurations that you can add to your admin again lots of configuration that's not the only place where you can configure different things you can also configure it on a globally which is the config system global but one of the things that i wanted to show you is that you can strength your admin account by using a trusted host so you can also look at it here sorry here you can configure a trusted host that is a trusted ip address that only your admin can get from so you can configure the ip address on your office at your work and you can configure another trusted host which is the ip address at your home only from those two ip addresses your admin can get into the fortigate uh you can also configure two-factor authentication which is also a very common security procedure you can use 40 token and you can also use your email as a two-factor authentication let's just show you how to do so let's clear that out so we can use the config system admin set now let's edit the profile before and set two factor email set email two and let's set it to one of my gmail accounts let's end it and now if we'll go back to our admin profile let's view it again and you can see that you can now use an email-based two-factor authentication so let's create a system interface and a dhcp server using the command line [Music] the following is part of the basic firewall training we will set up an interface and a dhcp server let's do it on port 4 we will do it using the command line so let's just use the config system interface all right let's edit port four let's just make it port four let's set the ip to 10.0.7.1 slash 24 and let's set the allow access the management protocol access to ping http https we can also set the weight for that interface let's just give it a weight of 250 we can we can set different settings for that interface but we will end with that that will be our local area network interface for our finance department now the second thing that we can do is to actually configure dhcp server on that interface so config system dhcp server let's edit that server let's create an entry a new entry and let's set the default gateway for that dhcp server to the 10.0.7.1 and let's also set the interface we're creating that on the port 4 interface now let's configure the ip range the pool of ip addresses that it will list for the clients that connect through that interface and for that we will use the config ip range and let's also use edit one and let's set the uh start ip at the 10.0.7.2 and let's set the and ip210.0.7.11 all right next and and let's set the net mask to 255 or 255 or 255.0 that's less 24 and let's set the dns service to default all right now let's end it and let's just refresh our page remember port 4 let's refresh it there it is and here we can see that we have our lan at port 4 that's our finance lan that's the ip of the lan gateway that's the administrative access and here's our dhcp server that starts with the 10.0.702 up to 10.07.11 and the dns server is the same as this system dns two minutes cli comments and this time the diag sniffer coming up [Music] dyke sniffer packet is one of my favorite commands why because it actually allows you to package capture the traffic sniff the traffic just as tcp dump or wireshark does so the syntax goes like that dag sniffer packet and then you need to uh include the interface so we will do any but you can choose port one or port two after that you actually filter filter the traffic you can filter it using the source destination protocol we'll use the host so we'll use the host 10.0.3.1 which is my gateway next comes the verbosity that is the amount of data that you want to include i will choose four and we can also add up the count that is the packet count so let's add up ten packets and if you want a timestamp you can add the a letter so let's start and there we have it now you can play around with the different filters and the different verbosity levels do that if you want a packet capture not using the diag sniffer but using the graphical user interface you can do it in network packet capture and in packet capture you will find that you can choose the interface and use the different filters we have already learned how we can list system processes and show their output on the command line now on this video we will look at how we can kill different processes that consumes too much memory or too much cpu power and how we can list the highest demanding processes on our fortigate to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything so you're using a high level encryption in your vpn you're using ips to scan different patterns and anomalies you're using antivirus and you keep logging of just about anything well all of that consumes lots and lots of cpu resources and memory let's take a look at the diag system command let's make an interval of 20 and with 10 processes all right now using the m character you just need to type the m character we can sort of the processes that consumes the highest memory and in our case it is the dns proxy if we press the p character that p is for cpu we will see the different processes that consume the highest cpu resources and in our case it is https demon now the next step is to kill the process that causes you lots of issues that is the last step before you reboot your 48 to let's do a control c to kill a process you use the diagnosis kill now you enter what is called a signal that is a term that comes from linux and unix which is actually a light way to ask your system to stop the process and it can be a more aggressive way to tell your system it depends on the number to tell your system to kill the process now um we can use different uh signal numbers we will use 15 which is a an aggressive way to tell your system kill that process and we will list the process id now the process id as we know is the second column so let's use the dns proxy uh process which is 94. all right now we have just killed that process and here we can see that the dns proxy process has actually been terminated we saw that we can list processes sort them out and even terminate them whenever they demand too much resources on our last part of knowing your processes we will see how we can in one cli command see the topmost cpu demanding [Applause] processes to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything one of the features that we saw using the dag system command is that we can list the most demanding processes either cpu and memory using the m and the p character when it is pressed now there is another command which is the get system performance top which lists only uh the most demanding cpu processes let's see it in action so we use the get sis sorry for that get assist performance top now you will see the most demanding processes the most cpu demanding processes at the second most tried column that's the cpu column the most right column is as we know the memory column now you will see different processes such as the ips engine or the antivirus scanner new cli or even the sshd the ssh daemon now whenever a process is too demanding in terms of cpu you may need to kill that process and we saw how to do it using the diag cis kill with a signal level and the process id firewall rules are basically the bread and butter of every firewall out there it doesn't really matter if your firewall is the next generation firewall whenever you head out to the internet and you're using a firewall then you're obliged to firewall rules what are firewall rules and how are they made coming up [Music] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything a firewall rule is nothing more than a set of criterias that your traffic needs to match whenever an ips session happens in your network a set of rules are being matched against that traffic if your firewall doesn't find a match at the first rule then it goes to the next rule rules are handled from top to bottom now let's look at how a policy rule is being configured and what objects are used to create that match in every rule there's always the implicit deny rule that sits beneath every other rules that is if your firewall doesn't find any match in the traffic then the traffic goes to the implicit deny rule and it is being dropped so when we start to configure our file rule we have as we said an implicit deny rule at the bottom and from there we start to configure our different criterias that will be matched against your traffic now we start we start with the name of the rule itself as for naming conventions don't use too many characters don't use spaces between words uh try to use underscores the second thing is the incoming interface what is the incoming interface well that's the interface that your local area network is connected to your dmz is connected to whatever interface that the traffic is coming from the second criteria is the outgoing interface so that usually in a full access rule for access policy that is your when interface when you configure your rule to allow traffic from the land towards the when and the internet but it can also be another segment of your um enterprise another lan it can be the dmz the incoming interface is known as the ingress interface the outgoing interface is known as the egress interface so we have two interfaces the incoming interface the outgoing interface and from there we move to the source what is the source that makes the traffic well that can be your clients that can be just about any source that is any ip address or you can use what is known as firewall objects a specific ip addresses within your local area network it can also be a user or a user group that is saved on your firewall internal database or a remote authentication server such as ldap or a radius server another criteria is the destination what is the destination that your traffic is heading towards it can be any destination that is any ip address out there it can be a specific ip that you can configure or it can be a domain or maybe an internet service amazon service so be sure to be granular don't just use any or all be specific if you're configuring a full access policy that will allow anyone to get out towards the internet then it will probably be all if you're configuring specific destination then be sure that to configure them ahead and use them in your rule the next thing is scheduling do you want your policy to work out 24 7 or do you want it to work on specific hours specific days reoccurring days so you will probably have cases where you will be asked to open a file rule for specific appliances in your local area network it could be a backup device it could be a network attached storage be sure to know what times are those appliances need that firewall rule the next thing is service service that is which protocols are being used in your firewall rule are you using only http https and dns that is uh port 80 port 443 port 53 or are you allowing your employees to get out to just about anywhere using any protocol out there including ftp ssh and so on so again be careful with the service usage rights and the last thing is the action are you denying or are you allowing traffic based on that match now this was actually only the part one of your policy or rule creation the next thing once that is um once you have a match is to go through security profiles that is going through anti-virus application control ips and so on the other thing that you will have to take care is are you using network address translation are you logging all sessions or only security events if you look at my channel you will find dozens of videos related to security profiles and other features of your firewall so please check out subscribe and see you soon there are times when we need to customize our own ips and application signatures the quick guide to creating your own signatures is coming up don't go anywhere [Applause] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything when we speak of the intrusion prevention systems we speak of an engine that compares traffic against signatures signatures of known threats and anomalies now whenever the ips engine alerts us it's in our responsibility to either block monitor or allow the traffic signatures allows us to identify malicious attacks and the question that arises is why do we need to create our own customized signatures fortinet has already provided us with thousands of signatures there are two main reasons the first one sometimes we use a specific application we use our own set of tools or our own topology that is customized to our need and we need to create a customized signatures that will match and the second reason is for tracks that somehow doesn't have any signatures yet so how do we create one let's head over to our ips sensor page signatures view and then create new the following signature is probably the most basic one if you want more advanced signatures please leave a comment in the comments page our first signature will allow us to block the cnn.com website there are dozens of ways using a web filter or application controls to do it but we are here to learn how we customize our own signature and that's a good start now every signature starts with a header the header for every signature starts with f s bid that's the header text and then we open parenthesis in the parenthesis within them we enter the signature matching criterias criterias of that signatures are described using a keyword and a value and different keywords if you're using a different keywords you can use only one keyword and a value you will divide different or separate different keywords using a semi colon the first keyword is usually the name of the signature we have to give our signature a clear description of the attack and then we define the signature triggering what makes it active in the attack which type of protocols are we looking into the flow of packets the amount of packet we are looking for matches matches in the traffic itself we match based on specific headers specific patterns thresholds as in rate-based engines for that we use keywords two types of keyword example is service and protocol now in service we determine as in our case the the that the service is http since we wish to block a website in protocols we can specify if we will use tcp as most websites use or maybe we plan to block our site not only to users that go through tcp in their browser but also users that may connect to that website using different protocols such as ftp each keyword must start with a pair of dashes another keyword is flow that is the flow of the traffic does it come from the server towards a client or from clients towards a server or maybe it is bidirectional in our case we wish to block any users from that our clients from going to a web server that is the cnn.com web server and there are many more parameters and patterns that we can add but this is the basic syntax that we use to customize our signature so let's try one right now let's name our ips signature let's add some comments so we will start with the f hyphen s bid and we will open the parenthesis now let's choose a name for the custom signature and our name will be block cnn.com the next thing to do is to add a pattern we will use a regular expression pattern that is cnn.com and now our 48 will detect the url and as we add up the service which is http it will know that it will only look up for that specific signature over http protocol make note that we divide the different keywords with a semi colon and now we will set up the protocol which is actually the traffic type 48 will only detect this signature in a tcp traffic that is if we will send a mail to that url which runs over uh smtp or if we will connect to that url over ftp it will not do anything it will only block the website over http traffic by default patterns are case sensitive so if we wish that 48 will block uh any any attempt to get into that url using uppercase or lowercase we will use the hyphen hyphen no underscore case and now let's limit the scanning only to traffic that is sent from the client we can also use b directional but in our case we will use the hyphen hyphen flow from client and the last thing to do is to add up the hyphen hyphen context host which makes the domain name to appear in the host field as it being resolved by the dns so that was our basic signature now if you wish that we will create a more detail the more complicated signatures just leave a comment in the comments page and i will do so in this video we are going to show you the top 5 ips commands for your 48 and we are starting right now the inclusion of ips in your 48 is one of those things that makes your 48 and next generation firewall it deals with exploits it deals with anomalies ips engine is just about everywhere so let's start with our first command that is config ips global there are some 48 models that supports also the extended database which includes much more signature so to check it out set database and you can use the regular and you can also use the extended so if you have the extended don't hesitate to use it when we create or configure ips sensors we need to plan them carefully why because they consume a lot of resources from your photogate in terms of cpu and memory now whenever you head up to your ips signatures page and add signatures think of two main things the first one operating systems if you're using a windows based network don't choose any signatures that are related to mac os or linux the second thing is the direction of the traffic now if you're protecting clients use only signatures that are meant to protect clients if you're protecting server do the same the next command is for those who runs a 48 with multiple processors you can actually run several ips engines simultaneously so how do you do it you head over to your cli configure ips global now set engine count now if you set the integer into 0 then 48 will choose how many engines are to use simultaneously but you can also change it according to your needs your ips engine needs as much power as it can get there are many 48 models that supports hardware acceleration either using the np asic or the cp asic mine uses the cp asic so why not giving it to him use the config ips global and then set in my case it's the cpu set cp acceleration mode with those that supports the np just use the set np acceleration mode and set it to basic or to none or in this cp case to an advanced mode which supports more ips patterns your ips engine consumes lots and lots of memory and cpu cycles now if you see spikes in your 40 gauge due to cpu high usage and so on you can diagnose test application ips monitor and there you will see different tests that you can uh do on your ips engine you can disable it totally using option two or you can toggle bypass status which actually means that the ips engine works but doesn't scan any traffic so play around with those options whenever you have issues with your ips engine and before we end please subscribe to get more videos like that so you have decided to take the nsc 4 exam now what do you do how do you practice what do you need to know well in this coming video we will look at the best tips to make you prepared coming up the first tip is to be practical leave aside the dumps liver side these study guides head over to a fortinet support site download one of the vm images of the latest builds open it in your browser of choice and start playing around create new interfaces configure the different services on that interface create new policies even if you don't have any other machine to play around think or dream of different use cases such as anyone in your land is forbidden to use ftp traffic beside a specific device how do you configure that policy how do you create a firewall object of that device so think around and play around with different use cases the third thing play around with security profiles configure new profiles understand how they work and apply them to your policies apply them to your policies and understand how they actually work either in a flow based or a proxy based inspection mode the theory behind those two is crucial to understanding how the security profiles work the second tip is understand the terms head over to your command line diaxis session list now once you do so you see in the output so many terms that may be frightening at the first time what is proto number six what is state number six what does it mean origin shaper what is the serial of that session what is an npu get around with the terms understand how sessions work on your fortigate your 48 is a session where firewall and just understand the different numbering for different protocols tcp protocol is protocol number six the udp protocol is protocol number 17. icmp is protocol number one each have different states understanding numbering and you will see more more terms such as fail open or made dirty many terms that you need to walk over in in the fortinet documentation understand them since you will probably in the exam itself you will probably see outputs with the following terms understanding the basic actually means that you need to know how different components on your photogate actually work if you play around with an anti-virus you have different databases let's just clear the screen configure anti-virus settings now you can set the different databases using the command line are those databases being downloaded locally to your photogate or are you using any cloud repository the same goes for web filter if you're creating a new profile you have the bodyguard category based filter is that a database that is being downloaded or is it a cloud repository another example is the routing table if you look at the routing table using the cli with the get router in for audit table o does it have precedence over the policy route or maybe the policy route have precedence over the regular routing table so these are the basics understand them as you will probably have some questions related to those topics in your exam you will probably face some network troubleshooting questions so look very closely at the topology also some available such as the diag debug flow or the direct sniffer packet analyze what is the reason it may be a networking issue it may be a policy issue it may be that you just don't have any static crowd to the destination so look around closely and understand the topology before answering we tend to forget but your photigate can actually work in a transparent mode and act as a switch a device with only one broadcast domain its management ip so you can set the up mode the operation mode either to nac that is a layer 3 device or to a transparent which is a layer 2 device we you will be asked questions regarding two vlans you will be asked questions regarding to virtual wire pair you will be asked questions regarding your 48 as a appliance that sits between two segments of the network it doesn't do any routing but it only scans the traffic that passes through so know your way when your 48 works in a transparent mode as a layer 2 device only u48 is part of a security fabric with multiple components that are on the network itself you will not have to answer questions regarding 40 analyzer or 40 manager those are different components and have their own certification but you will need to understand how load balancing works what is an sd1 is software defined when how to prioritize traffic based on load balancing algorithms or based on different slas service level agreements that you create you will also need to know what is an h a an h a high availability is the way that you actually create a redundant 40 gate along with your primary 40 gate you can create it either in an active active mode or active passive mode understand the priority of creating a master photogate and a slave fortigate understand how sessions are distributed between those components remember that your photogate is a network device and as such it will have its load balancing and redundancy algorithms in place which you need to excel in one of the main rules or main jobs that your fortigate does is to authenticate users while entering the network now you will need to understand how a user is created how to connect to air remote authentication servers such as ldap or radios what is a single sign-on how do you create a proxy what is an explicit proxy and what is a transparent proxy how do you transfer your proxy settings using a pack file what is an authentication rule understand the aim of authentication understand what does it take to authenticate different users using passive authentication or active authentication those will be probably asked throughout the exam be sure to understand the whole nature of authentication fully whenever a ping an icmp request is being sent from one of your 48 interfaces or sources the defaults are five times that is the packet is being sent five times it has a data size of 56 bytes it is being sent in a one second interval and you have a two second timeout let's see how we can unleash your pink settings [Music] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything using ping an icmp request is probably one of the most used yet simple network troubleshooting tools so let's unleash our ping setting and see what can be done we will start with the execute ping and then we will use the view settings so we can see what is our ping default settings so we can see that we have a repeat count of five times we have a data size of 56 bytes we have a timeout of two seconds currently the interface is auto which means that it actually goes to our routing table and sees the best route out we have an interval of one second that is your ping will be sent one second after the echo response received you can use an adaptive settings which we will do very soon to see that you can actually send the second or the third icmp request immediately as the ping response comes back the time to leave is 64 hops let's see if we have any interesting more interesting stuff here no the second thing that we can do is to set the uh ping options and see what are the ping options and we can see that we can set an adaptive ping we can set different data size we can set df bit which is a parameter at the ip header we will look at it we can set the interface that the ping will be sent from we will use our marketing interface and send ping from there we can set the hex format of the ping we actually can uh add uh different characters to our uh empty hex space in our ping we will look at it also and yes we can set the source the timeout time to leave and more so let's start with a simple ping towards towards google okay that's google.com that works now we'll use the same thing towards google dns server and see if we have a dns resolve that also works great now let's um let's close that for a minute let's move to my ubuntu device all right all right now my ubuntu device sits on the actually it sits on the marketing interface let's just get back let's log in all right all right so let's start by pinging my ubuntu device which is at the 10.0.4.9 everything goes well you can see that i have a very big icmp uh packet let's see what is the reason execute ping options you know what let's do another thing let's once you have um settings that are not your default settings remember the default settings is 56 bytes you can reset them using the execute ping options and reset now let's send the same ping again and let's see what is this side that's 64 bytes remember that your um data size your icmp data size is 56 bytes you have an eight byte header for the icmp packet what you see here is actually the payload itself plus the header that is 56 plus the eight byte header let's um let's see again how we change the data size that's the way that we change the data size let's set it to 128 bytes and let's now um change another settings which is the adaptive ping your icmp request is being sent in an interval of one second now you can change it so that it will be sent immediately as soon as the icmp response gets back to do so you have to choose enable another setup is the df df bit what is the dfb df stands for don't fragment that is don't fragment the uh packet even if it's bigger than the interface that is supposed to accept it so if you have on the other side an interface with an mtu uh of x values and your icmp packet is bigger than that so your icmp packet can actually be dropped so be careful how you use the df bit let's keep it at no now let's see what is the effect of adaptive ping versus the regular settings so let's just execute ping let's use a repeat count of 20 packets and let's execute our ping towards google sorry google.com all right so you can see that we have an interval of one second now if we will use the uh adaptive ping option let's just enable it let's send the same ping and you can see that you're actually having a sort of an icmp fluid uh it's not hundreds of uh of packets a second but it is it is still much faster than the usual interval so you've got your new 48 and you need to set it up so here's a quick setup guide your new fortigate comes with a pre-configured port one at the 192 199 ip address so you can actually manage your photogate using the command line or using the graphical user interface we will do it using the graphical user interface with a web-based manager so take up your client that is your pc or your mac change the subnet to something in the 192.168.1 subnet it could be 1.10 1.11 connect your client to your port 1 on your 48 and just open up your web browser at the 192 168 199 address when you will do so let's just move on and see what happens all right so you get into your browser you type the address the port one ip address and you enter your administrator credentials now if you have an older model you would just use admin as a username with no password on the latest firmwares you will need to enter a password and i've i've already entered one so let's just get in into r48 and from here let's just move to system settings the very first thing you need to do is to change your host name now it may sound not important but if you have several photogates one of them is protecting your data center and one of them is blocking users on another department you will need to know which fortigate did what so let's just name our photogate marketing so we will know that it protects our marketing division the second thing to do system time the best practice is to use 40 guard ntp so every appliance will be synchronized now you can set up different a administrator settings such as the http port which you will probably keep at port 80 and https which is 443 the other thing that you can do is customization you can change your um language either to english french spanish and so on and you can also change the theme of your 48 and you will see the different theme change immediately now let me just use this one since it looks much more modern in my opinion we will not get into the ngfw mode either profile based or policy based that will have to wait for another video um let's just move on email service you can use the custom settings which are fortiguards smtp email server or you can use your own or whichever smtp server that you will use and you will see that you will use your email smtp server more and more as you practice your photogate the other thing that you can do is to head over to forty yard and in forty guard and in antivirus and ips updates enable the accept push updates so you will not miss any signature that is being pushed by the 40 guard servers the other thing that you can do server location use lowest latency locations it is a good practice to do so if you're not in the us all right so those are the default settings now if you move to administrator remember you're the administrator of your fortigate you can edit your administrator profile add up your email add up two-factor authentication and you can also add up what is known as a trusted host that is only administrators that connect to the fortigate management interface through one of those ip address that you will configure will be permitted to enter so you can set up your trusted host to your ip address at work and your ip address at your home location you can also set up new administrator and you can actually add up a professional administrator that will take care of different areas on your photogate once you configure your settings and your administrator profile you can add up more interfaces ones that are connected to your when interface and to your other lens i have a bunch of videos that will show you how to do so and the other thing that you will need to do is to create a static route a default route that will connect the traffic the packets that needs to get out to the interface to your gateway that is the interface that is connected to your when interface all right so this was a quick setup guide from there you will probably move to policies and object create your own policies uh customize your interface customize your settings your logs and reports uh create security profiles and so on this video is all about setup tips for your photogate and we are starting right now [Applause] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything one of the most common questions that i get every time is how do i set up my fortigate i'm not interested currently in any intrusion prevention system sensors i'm not interested in ipsec vpns i just have several interfaces connected to different clans and i need to set up my fortigate for a truly a basic operation so in this video we will look at the basic basic setup configuration as you know in my channel you have tons of videos that deals with different aspects of your 48 so the very first thing is to set up your administrative profile you are probably the superior admin of your fortigate so make sure that you connect through trusted host uh if you need up to set up a new admin maybe a professional admin that will be responsible for another virtual domain or different aspects of your photigate do it so the next thing to do is to move over to network interfaces you probably have different clans connect to different interfaces in your 48 in each interface don't forget to write down an alias it will help identifying which lan belongs to which interface use a specific rules for specific interfaces use administrative protocols carefully don't just let anyone ping from that interface if it is not needed use dhcp server and use dhcp server scopes so you can create different dhcp options for that local area network you can block specific mac addresses from receiving ip addresses and use device detection and active scanning you want to know which devices initiate traffic on that interface now the next thing to do is to create or configure static route that will lead to your isp now it is usually uh created using the default route which actually means that any packet that is destined to anywhere and it does not have any entry in the routing table should head up towards the specific gateway which is usually the one gateway the next thing to do is policy and objects that is the bread and butter of your 48 firewall it is where you create rules rules that match any traffic that comes in or gets out of your 40 gate assuming that it matches the traffic you have two decisions the first one is to accept the second one is to deny now you can create different policies according to different topologies the basic the basic policy is the full access policy which allows local area network to get out to the internet through the when interface so incoming interface can be just about any lan in your network the outgoing is the when interface source can be different users devices but let's assume that we deal with just about anyone destination also can be specific destination but let's assume that any destination is allowed you can set up different scheduling and services now again you can deny specific protocols but for our case we will allow any service now the learned policy is another topic that i have made a video specifically on that but that's not the issue right now now whenever 40 gate matches the traffic the next decisions are are we going to lock the traffic are we going to net the traffic and that is also very i would say not difficult but it is a tough topic to understand and then it implies these security profiles which can be anti-virus web filtering ips and so on and their last setup is actually moving on to the login report and see whatever happens in your 40 now there's a lot of happening whenever a traffic comes in and gets out whenever an admin logs in into one of the interfaces whenever there's a vpn tunnel that initiates or stops working you need to maximize your understanding on what is happening on your network and the best thing to do is to look at the login report and understand your network baseline your connection starts with a dns request a dns response and there comes the tcp three-way handshake and when it's done you send an http get request the basic denial of service attack works on the tcp 3-way handshake that starts when the client sends a tcp scene the server sends a tcp cnac and then again the client sends an ack a tcp packet with the ack flag on now on a denial of service a hacker sends a tcp scene the server sends back a tcp cnac and the hacker doesn't send back the tcp ack that connection is known as half open connection now it has limitations in terms of time it has limitations in terms of buffering the server's buffer but when that happens quite fast our server will not accept any more connections so what do you do and how do you protect your servers from sin float attack have open connections are happening all the time it can happen due to congestion in the network due to bad connectivity it even happens due to different application that behave so but you can limit the timers the time that your server will wait for a tcp syn ack so let's just see how we do it we go to the rcli config system global and now you can set the tcp have closed timer and half open timer the have closed timer actually tells our photogate you can terminate sessions that are waiting for tcp packets with the fin flag that is set to on now the half open timer is what we have just saw our photigate actually waits for the tcp act that is coming from the client and is actually the last step in the three-way handshake so you can set different timers that is according to your network behavior another thing you can do is actually go to the policy and objects ipv4 denial of service policy just choose your interface it will probably be the when interface and there you can set the rate of the tcp syn float that is set the maximum syn packets rate for one second currently the threshold is 2 000 you can set it to 1 000 packets you can set it to 500 packets you can set it to more it all depends on your network behavior on your server's behavior you know it better than anyone two minutes cli and this time how to configure your interface using the command line coming up [Music] this is probably one of the most used commands that is my most used command now config system interface actually configures the physical interfaces or the virtual interfaces on your 40 gig you can do it either on the graphical user interface and you can do it also on the command line and that is exactly what we will do right now so let's just use the config system interface the second thing to do is to pick up the interface the port number that you wish to configure currently my vm has only 10 ports so let's use port 3. now from here you can set the different parameters of your interface so we will start with the mode will it get its ip address from the dhcp server or maybe we will set it statically so let's use static now once we use static we can set the ip itself so let's use the 10.0.5.6.6 and slash 24 since we are using a class 3 ip address now the other thing that you will need to set up is the allow access that is the protocols that you will use to administrate your interface so we will use http and https you can also use ping which is not a best practice unless you need it for different purposes but the most used is https and ssh ssh to enter your interface through the command line https to enter it through the graphical user interface the next thing you can do is you can set the mac address of that interface you can actually configure yourself the mac address for that interface you can also use the mtu override currently the mtu is 1500 bytes which is the standard so don't change it unless you really need to but if so you can set the mtu override now you can also use set weight from 0 to 255 weight is used in different scenarios such as load balancing and preferring one route over the other you can also use the uh you can also set your interface to a specific video and currently our video is the root video let's just end it and let's refresh the page and there we have it portrait with the new configuration one of the techniques to block applications like tick-tock is to get hold of ips that are related to tick-tock or list of domains that are related to tick-tock and block them on your dns filter how do you do it coming up [Music] tick tock has gained a lot of attention recently due to the fact that it probably gets hold of your private and sensitive data now i'm not taking any uh position on either if it does so or not but if you want to block then one of the techniques that you can try and block any domains or ips that are related to tick tock is the following you start with a text file where you enter all ips that are related to ticktock just google tick tock ips domains how to block and you will find a list of ips that are related to tick-tock once you do so save your text file uh put it in a web server in a place that is accessible and move over back to your photogate on your photogate dashboard fabric connectors create new connector of type threadfits ip address now name your connector let's just name mine tik tok and enter the address of that text file so i will just use an address that doesn't really exist but for our purposes if you need to authenticate that you then you can you enter your credentials on the following fields if not just disable it okay now once you have a new threadfit with a list of ips that are related to tick tock move over to your security profile dns filter create new dns filter let's just name my dns block external ip block list and add up the external thread feeds okay now move over to your policy and objects and on your policy just enable the tick tock block security profile now this is not bulletproof and uh ips are changing frequently but this is one method that may be of help when you need to block ticktack connection with clients that are connected to your network and are monitored by your 48 firewall [Music] welcome to our 48 top five tips and this time we are dealing with the ping command tip number one when we use the ping command we use the execute command so we'll use the execute ping and we'll choose our destination as 888 which is google's dns server now we can see that our ping size is 56 bytes and 48 cents five packets at a time now we can change the size of our ping how do we do it we use the execute pin options let's view the settings all right and now if we will use the execute ping options data size we can choose icmp packets to be in different size uh let's choose 90. so now our ping size is 90 bytes let's choose the same target execute ping towards 888 and you can see that our ping size is 90 bytes and to our second tip now if you do networking for a long time you probably send continuous ping packets towards different destination different interface so you have to change the amount of packets to be continuous or to be at a different size than the five packets that are sent by default how do we do it we use the execute ping options and we use a different repeat count currently the repeat count is five now let's change it to 15 and now let's ping again and let's ping the google dns server and let's see how many packets are being sent and we can see that we have 15 packets that are sent and now for our third tip let's clear that out now we have different interfaces in a 48 and sometimes we wish to send ping packets from different interfaces so how do we do it i have currently a an interface at the 10.0.4.1 so let's let's use the same execute ping options and now let's choose a different source in my case it's the 10.0.4.1 and now if i'll use the same ping command the packets will be sent from the 10.0.4.1 moving on to tip number four usually a ping command is being discarded after 64 hopes now we can choose a different integer we can choose an integer between 1 and 255 hopes how do we do it we use the same sorry for that we use the same execute ping options time to leave and let's choose 220 hopes 220 hopes and now our ping packet will be discarded only after 220 hopes all right and now let's move over to our fifth tip sometimes as an administrator you use different settings let's change the settings of our ping command let's use a repeat count of 8 let's use a different data size let's make our ping size 80 bytes and let's use a different source all right let's use the 10.0.4.1 as our source now if we will use the view settings we will see that our repeat count is eight our data size is 80 and our source address is the 10.0.4.1 now you want to reset this those settings what do you do you use the reset command and now if we'll take a look at the view settings we will see that it all came back to the default settings which are five packets 56 bytes and the source is the according to the interface that you work within now if you like our channel please subscribe the following video is dedicated to beginners who are just starting to administrate their fatigue this is a free 15 minutes master class so let's start [Music] so here we have the 48 administrator page you can configure the different settings either by using the graphical user interface or by using the command line we will mix between the two i can tell you that using the command line you will have access to much more advanced settings now as for methodology we will start with the administrator account we will move into creating new interfaces creating a static route creating a policy a policy that will match the traffic and we'll choose either to deny the traffic or to allow it then we will move to our security profiles we will see how we can configure the antivirus the web filter application control and so on and from there we will move into different settings that will make figuration much more strict into our purposes so let's start all right so the very first thing to remember is that you're the administrator of that you have lots of responsibilities starting from backing up the configuration and creating policies interfaces different settings different authentication rules for your users now if you will go over to system administrator the very first thing that you will need to do is to harden make your account much more strict by using either a 40 token and trusted host so you can actually configure specific ip addresses that you will log only from there you can do it either using the graphical user interface or by moving into the command line here we will use the config system admin and let's just edit the relevant profile which is admin now here we can set different configurations to our admin profile if we use the show full config we will see the full configuration either setting up trusted host or even setting up a two-factor authentication by using an email account that is possible only on the command line alright so we have our admin account so now let's move over to network interfaces and this is the topology that we need to configure this is a very basic smb topology you have your lan which is connected to one interface on your 48 and you have your dmz where your server switch which is connected to another interface and you have your isp router which is connected to your one interface on your 48 which is this one interface so let's start by configuring the lan interface and the dmc interface so choose your interface of choice edit now name your interface i will name it lan and choose its role different roles means different settings but are really currently islam we will configure the um the ip address of the gateway itself that is 10.0.4.1 slash 24. another thing that we need to configure is the administrative access we will use https to connect to that interface we will also allow ping and we need a service a dhcp service that will run on our interface so that hosts that will connect to our interface can ask for ip addresses and we will apply that using the pool which currently is up to 254 we will set it to only 50 ip addresses you can head over to the more advanced dhcp server and assign scopes assign specific ips to match your host's mac address but we will not do so device detection allows your 48 to actually detect the type of devices that runs on your network that is either an android a windows pc a mac computer and so on it does so by looking at its mac address user agent tcp fingerprint and other methods you can also enable captive portal on your interface will not do so so that's it for our lan interface and now let's configure our dmz interface so let's edit it name it dmc now the role will be dmz and once you do so you will see that you don't have a dhcp server on that interface since as a best practice do not allow dhcp service on your dmz so let's configure its ip address 10.0.5.1 5.1 24 we will only use https as our administrative access and that's it now we have two interfaces one is dedicated to our lan and the other one is dedicated to our dmz our when interface let's just edit and name it when so it will be easier when we configure our policy later on all right so now we have our interfaces set up and the next thing to do is to manually configure a route entry that will allow all packets to flow towards the uh gateway interface that is our when interface and from there to the internet so we'll move to network static route let's configure a new default route our gateway interface sits on the when interface and its ip address is the 10.0.3.1 we can determine the priority of our static crowd uh and its distance using the following configuration but we will not get into it you can see i have dozens of videos that are dedicated to the different routing attributes of your 48. okay so now we have one static route which actually tells different packets that if you wish to go to just about any destination that doesn't have its own routing entry in the routing table move to the gateway at the 10.0.3.1 using the when interface and now let's move and see our new entry our new route entry that we have just configured we will do so using the command line although you can do so also using the graphical user interface so get router info routing table all and there you see you have a new static route that actually points to the default route via the 10.0.3.1 ip address all right so we have our interfaces we have a static route and the next thing to do is actually to create the policy itself that policy that will allow packets to flow from interface to interface by matching the traffic and seeing if it is denied or allowed so to create a policy we will move over to policy and objects ipv4 policy and create new the first policy that we wish to create is a policy that will allow everyone in our land to get out to the internet using any service at any time so let's just name our policy full access the incoming interface is our lan interface the outgoing interface is our when interface the source we will not limit uh we will not limit users so we will just allow anyone to get out of course if you need more granular control over your policy you will create firewall address objects and you will define which one can get out and which one cannot you can also create user groups and users destination all we are not limiting the traffic to a specific place anyone can get out to anywhere scheduling always service again we can limit it to specific protocols but we will keep it to all now the action is accept the other thing to note is the inspection mode which will which we will look at when we create security profiles we want our traffic to be netted that is our traffic currently happens on our private ip addresses but when we go out to the public internet we need to translate our ip addresses to the public front interface of our photigate so that's what we will do and we can configure the different security profiles we will do it very soon now in terms of logging we don't want only security events to be logged we want all sessions to be logged so we will enable all sessions okay so now we have our first policy which is the full access policy all right so now let's create our second policy for the dmz and from the dmz point of view let's just allow a traffic that comes from the internet towards the dmz from for our purposes let's just make it from anyone but in your environment just configure it based on your needs security policy events and so on um destination all we can of course configure a specific that's you know what let's just configure an address for our server let's assume that we have a web server that anyone can access using http and https so let's name it web server we will use the 10.0.5 dot um for slash 32 so we will um so it will point out exclusively to that web server now the service can only be http and https we will use the different security profiles and we will log all sessions okay so we have a second policy that is towards our dmz but now the traffic comes from outside towards a specific web server and we have only allowed uh the http and http service now once you finish up with your different policies you will need to apply the different security profiles for that you will move over to security profiles choose the one that suits your security needs you will probably choose anti-virus web filter maybe application control if you want to control applications that your users are using and once you create a security profile and name it you can enable it in your policy by going to the policy page and select which profile is needed all right now the last thing to do is to move to your system settings and choose the appropriate settings that will make you feel good while you administrate your photigate either in terms of how much time do you want your idle timeout to be how do you want to customize the look and feel of your photogate and do you want to use any other email service other than the bodyguard email service so you can do all that now we have actually looked at the basics of putting up your 48 in a typical scenario if you want to learn more please subscribe to my channel i regularly upload two to three videos every week 6.4 is one of the latest releases of fortinet and they're doing a great job from release to release adding new features and up until now there were dozens of videos all over describing the new features of 6.4 well i've decided to create one that will focus on the more friendly features of 6.4 so let's start [Music] the first feature friendly feature is the execute sp test that you can do on your one interface to do so you'll have to have the um sd1 network monitor license once you have one you can jump up to your when interface and execute a speed test now when you do so the results will be added to your estimated bandwidth the estimated when bandwidth but you will have to be connected to 40 yards and to i believe google's or aws speed test servers the second friendly feature is a fantastic one i've been always asked when dealing with security profiles which is supported either in flow based inspection mode or in proxy based inspection mode and it seems that you up until 6.4 you had to remember which feature is supported and where so from now you can actually create a new security profile and if you wish to see which feature or which capability is supported under the proxy inspection mode the only thing that you need to do is to click on the proxy base and there you will see that you can only use content disarm and reconstruction under the proxy based mode the same goes to web filter just click on the proxy base and you will see the features that are supported only on a proxy based inspection mode the next friendly feature is actually not a feature it is a way of describing things much more clearly so when you go to a network sd-wan and you add up new interfaces to be part of the sd-wan interface and the next thing is to create an sla a performance sla where you configure the sla server and the sla target the next thing is to go to sd-wan rules now in sd-wan rules at the end you actually create your sd-wan strategy the st1 strategy can be manual best quality maximized bandwidth and lowest cost i can tell you that every student asked me what does it mean what is best quality what is maximized bandwidth so finally fortinet actually describes each strategy and what it does the next friendly feature is a cool feature which is the ip address tooltip whenever you hover with your mods over an ip address it will show up more information on that ip address so let's go to login report and application control and let's see what happens when we hover towards that ip address well we can see that the owner is google we can see their location which is england we can also see the latitude longitude and the running services let's go to another ip address and that ip address also is owned by google let's find uh an ip address which may not be owned by google alright so we have an ip address that the owner is amazon and it seems as the local cdn here in israel tel aviv another friendly feature is the add widget which is now much more organized than it was before you have dozens of widgets some of them are new i believe that the ipsec and the ssl vpn widgets are new and you have a bunch of wi-fi widgets that shows you the channel utilization of the access point clients per access point interfering access points and so on and the last friendly feature is the fact that you now don't have an ipv4 policy and an ipv6 policy you only have a firewall policy you can add up an ipv6 or an ipv4 address object to be added to the source and destination fields in your one policy you're a small business very small six employees six computers one switch one access point an isp router one subnet and a network attached storage that serves as a file server that's right no domain controller servers no clustering everything is flat and simple but you still want to protect your network assets you still want to be able to connect to your file servers from remote give permissions to the management to specific domains and you decided to buy a firewall a small firewall not too fancy so here are the seven things you must do in order to start and work with your firewall [Music] all right so the following is um are the basic steps that you as a small business will need to do once you get your 48 or any other firewall in your business now the very first thing remember once you uh configure your firewall you're the administrator of that firewall you're the super admin so you will need to hardening your um admin account you can use two-factor authentication you can also use an email-based mean to get a token in your email i have done a video on that before and you can just click the link above and go straight to it another thing is trusted host you will need to configure either one two or three ip addresses that the admin can actually connect from to the management interface of your 48 so configure your office address configure your home address don't let anyone get into your photogate from outside the second thing that you can do is to segment your network now even if you have only six or ten employees and three of them are in the marketing department and four of them are doing sales create a new interface you have lots of switch ports on your 48 and even if you don't you can create virtual uh lens so let's create an interface let's just name our interface sales the role of that interface is local area network just assign specific subnet to that interface this is a private ip address use for management https and ssh https to get uh to that interface through the gui and ssh is through the command line and just configure a dhcp server now you probably have only about five to six employees so don't use the full pool you can use uh if in our case it's 10.0.9.2 so let's use it up until dot 10. now um you can do many other things uh we will not get into it right now but this is the basics of just creating a new interface and be sure to connect those uh employees through their computers to that specific switch on your photogate either using a switch or directly all right now once you've built the interfaces you can actually start to configure some rules let's just use basic rules for now uh we head over to policy and objects ipv4 policies create new and let's just create a sales policy now we're not limiting no one in our sales department so the incoming interface is sale the outgoing interface is our when interface the interface that is connected to our isp router as for source currently we will use all but we will create a firewall address object very soon and we can actually use it in our firewall policies in terms of service we will allow any service any protocol to uh go through this firewall policy uh we will enable net we will uh not use currently our security profiles we will do it soon and we will log just about every session not only security events session all right so that's our sales policy let's create a new policy let's name it marketing and incoming interfaces our marketing outgoing is our win source o destination all service all let's just enable logging for all sessions all right the next thing to do is to actually create a virtual lan for our access point now there are times when you need to create another broadcast domain which is on top of physical ports so if your photogate has eight ports you can actually create on top of each port vlans virtual lens that you can connect to that switch and from there to outsource employees or other employees so let's just uh use the sales port to create another interface which is our vlon interface let's name it um outsource to and we will use a tagging of 300 let's also use it here and the interface as we said is the sales interface now let's configure an ip address as we do in just about every subnet every land that we have so we'll use the 192 168.2.1 slash 24 and we'll use administrative access https and ssh and we will actually list the full pool in our dhcp server we will not limit it to um only specific number of ip addresses okay now once we have that villain on our sales interface that's vlan 300 we need to create a policy a policy that will allow any traffic that is coming from that villain to get out to the internet so we will again create a new policy let's name it outsource to the incoming interface is our vlan is outsource to and the outgoing is our when interface now anyone can connect to that filament anyone can go anywhere anywhere but in terms of service we will not allow any service out there we will use https http alright and dns all right now let's just apply that and now we have a new policy that allows anyone that connects to it uh to get out to the internet only using http https and dns all right now let's create a firewall address object why do we need a firewall address object well sometimes we have different computers on our um on our subnet that we want to limit or to grant access to specific services and that's a good way to create a policy that is more granular so to create a file address object we'll go to policy and objects addresses now let's decide let's decide that our firewall address object will be uh for the marketing division that's at the 10.0.5.0 subnet and we know that we have a user that has the 10.0.5 ip address and we want to limit it from sending pings sending icmp protocol pings so how do we do that we go to the pulsing objects addresses create new address now let's name our computer limited icmp that's a nice name let's use the ip range and let's use the 10.0.5.2 up to 10.0.5.2 or have no we said that it will be 3. and the interface is the marketing interface okay we can also use static rod configuration if we want to use it in a specific static rock but we don't need it for now let's just apply that and now let's create a new policy and in our new policy we will name it no icmp for that specific device so the incoming interface is marketing the outgoing is the web interface and the source is the new limited isp source that we have just created destination all service icmp we want to limit it from sending icmp ping so we'll choose all icmp and ping and in the action we will choose deny okay so now we have a policy that denies icmp or the united pings from that specific users now for that policy to work we need to actually move that policy before the marketing policy so our file will look at that policy will understand that that specific device which belongs to the marketing division doesn't have full access the same as the other user it limits him from sending icmp now the next thing you will need to do is to create a static route so that all packets from different interfaces will know where to go in order to get out to the internet so to do so you go to network static route create new static route now i have already created one here that's my static route the destination is all zeros that is every packet that is destined anywhere and doesn't have a route in the routing table will go through that static route you will need to choose the interface in our case that's the when interface which is connected to our isp router we will not look at the administrative distance or the priority of that route but know that you can actually prioritize different static routes on your photogate firewall alright so we actually reached our final step final configuration which is applying security profiles to your policies now you can find security profiles just beneath policy and objects and you have different security profiles each security profile have its own knowledge base and you you can find dozens of videos in my channel that explains how to work with anti-virus web filter dns filter the idea here the idea is now you the idea is that you actually create a security profile and then you apply it on your policy so let's just open one policy let's edit it and here you can find the different security profiles once you enable it it actually scans the traffic and looks for viruses malware spam domains that are not permitted and other things auditing your firewall is a major task that you need to do from time to time now there are companies that release tools that will allow you to audit your firewall but here is the 10 best practices that you can start with [Music] the following best practices are not in a specific order so just use them as you wish now another thing i'm showing it on a 40-git file but you can also do it on checkpoint file on the palo alto fire or any next generation firewood quite obvious but we do it on any device any servers that we have on our organization be sure that your firmware is up to date always use the latest firmware usually the latest firmwares are much more secure your firewall vendor will always make sure that you have the latest patches on the latest firmware so back up your configuration look at the release path and update your firmware encryption and high encryption is fundamental in your file so be sure that you always use the strongest algorithms now it's not always possible but assuming that the other side all also supports the strongest algorithms just find out the appropriate cli command on your firewall and enable it so in a 48 firewall it is config system global now it may change from firm to firmware set crypto strong and just be sure to enable it always make sure that your administrator is connecting to your fortigate through a trusted host that is a trusted ip address as the ip address at its home or in the office now you can do it using the graphical user interface you can do in using the cli let's do it using the cli config system admin let's edit the admin and from here set trusted host and just write down the trusted ip address if possible on your web interface your external facing interface don't allow any administrative management so let's just use the config system interface edit port one which is my internet facing interface and unset allow access [Music] on your lan interface administrative access try always to use https and ssh that is https to the graphical user interface and ssh to the command line now try to avoid ping and try to avoid other protocols unless needed the following is probably one of the first audits that you need to do look for unused rules rules that were asked time ago and configured on your file look for them and if they're not relevant anymore just delete them now a side note document any rule that is asked document who asked the specific rule and the time that it was configured your administrator should always log into your 48 or any other firework using https so be sure that even if it tries to do it over http your file will redirect the request over https so let's do it here config system global set admin https redirect another setting that you should be aware of is the admin lockout and the admin local duration now that should comply with your organization policy config system global and now let's set the admin you can set the admin lockout duration the default is 60 seconds but but you can set it to five minutes or more that should comply to your organization policy now another setting is the threshold itself that is the lockout threshold is actually the number of failed attempts the number of failed attempts when your admin tries to log into the system the default is tree and it is a best practice to keep it at three logs should be part of your auditing that is when you audit a firewall be sure that logs are there for at least seven days now look at the proper documentation of your firewall let's just do it here config log disk setting set maximum age now you can set it to seven days you can also set it to 30 days it depends a lot where you save the logs either on your hard disk or towards assist log or any other device that has a proper storage at last let's look at some more best practices to hardening your firewall one of them is when you have unused interfaces disable them disable them if you have interfaces that you want to disable different protocol so just disable them using config system interface edit the interface that you want to disable and there you can unset dhcp relay services you can unset pptp client arp forwarding and so on another thing that is uh quite common to any 48 out there and there is something that i'm not familiar with other firewalls uh which have maybe yes or no the same functionality is what is known as the maintainer account the maintainer account is actually a backdoor to your photogate if your admin has lost its password then it allows you to actually put into your photogate using what is known as the maintainer account which is actually the serial number of your 48 with the maintainer user so you can actually disable it in most 40 gates i believe that is it is enabled by default set admin maintainer account disable so you've got your new four gate how do you configure it coming up to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything so you've got your new photogate and your new to 48 firewalls what do you need to do you have probably connected your 48 using a network cable to your computer and configured it and fortigate appliances comes with at least port one one of the ports which is usually port one that is already configured with the ip address of 192 168 199 you need to configure your pc subnet to be on the same subnet get to the ip address of the interface of the port 1 interface and from there you're actually starting to configure your 48 now you can configure photogate using the graphical user interface which has many features it even has a feature visibility feature in the system settings so that you can disable or enable new features which are not available over here now you can configure your photogate using the graphical user interface and you can configure it using the command line 48 experts use the command line almost all of the time we will look at the command line but we will make our way using the graphical user interface uh to get to the command line you need to click here it is actually a javascript app that runs on top the admin web app um probably the first thing that you want to do is to write down get system status so you can see uh your 48 serial number which essex which accelerated hardware does it support are you using a hard disk or a flash drive the current security profile database and so on now we went into the interfaces you probably have one interface that you're connected to which will be the management interface now you need to connect one of your one interface um to your isp either through a modern router or you can use your 48 as the router itself each interface each interface has a physical switchboard that you can connect to different subnets in your network now let's just um edit one interface let's see what's inside you can name your interface according to the subnet in your local area network let's assume that we have a management subnet all right now you can define it a specific role it can be a one dmc an undefined rule or uh a when so let's uh use the land so now we know that we have a management plan connected to port 8 on our 40 gate now the addressing mode can be manual it can be dhcp let's use the manual option and let's configure it should be 192.168. 2.1 slash 24 since we're using um a 24 subnet now this address is the gateway interface address so any computer that will connect to one of the 2d to port 8 will get an ip address in that subnet that is the 192 168 2.0 subnet but its gateway address will be 2.1 now we will also open the dhcp server so anyone that is connected there's a pool of ip address that it will grab uh we'll look at dhcp server very soon before that we need to configure administrative access which protocol will support administrative access we'll just use https and http for now we can also use ssh we can also configure it to support pings from host in that subnet or from a 4d manager but we will not do it right now ldp is a protocol that enables discovery between devices in the network it doesn't really matter you can disable or keep it for now now we have a dhcp server as i said any client that connects to that port will receive one of the ip addresses from the pool you don't have to use all the pool you can use only 20 ip addresses you can keep the dns server the same as configured here or you can specify your own dns server let's just specify google's dns server uh you can control the list time and if you click on the advanced if you have a dhcp server that is part of your domain which is not your 48 or your 48 interface you can configure its ip address here and then whenever a packet arrives on that interface it will uh head over to the dhcp server but for now we use we're using the gateway interface as the dhcp server you can configure an ntp server you can configure and this option is for more advanced users dhcp scopes or options and you can assign different ips to different devices based on their mac address another option is device detection device detections allows your photogate to detect which device and which operating system uh devices on the networks belongs to this is one of the things that you should keep enabled um don't bother with the explicit web proxy you can enable a captive portal so if you have outsourced employees and you wish to jump a landing page with user credentials you can also do that but we will skip it for now so this is the basic configuration of the interface okay so now we have a management interface we have another interface which is the one interface that you connect it uh you connect it to your isp router we will call it when one the role is when we will we can use dhcp and if we want to make it more reliable we will use a static ip address so my uh gateway uh interface is 10. 0.3.75 and my router is actually 10.0.3.1 i've enabled http and https and as you can see uh you don't have a dhcp server whenever the role of your interface is when that is one of the best practices when using an interface as a when interface okay so we have a management interface we have a when interface now we want to make our uh managers and that are connected to that port which is port 8 to get out to the internet so the next thing to do is to configure a policy now we will configure a very basic policy which is a full access policy let's name it let's name it managers one and the incoming interface is management that's the lan interface of our managers outgoing interface is when one that is the interface that is connected to our isp router that is the interface that takes them outside of the land towards the internet now when it comes to source let's for this video let's make it um very generic anyone can go anyone we can configure user groups and and different users we can also configure sets of parameters that control uh the different users but for now as for source anyone can get out as for destination they can go just about anywhere we can also create specific objects that will allow them to go to specific places but for now they can go just about anywhere as for scheduling we're not limiting them to specific hours or days so as for scheduling again they can get out to the internet any time of the day as for service we can deny them from getting out in specific services such as ftp but for now for our specific policy we will let them use just about any service now the action is accept we can also create a policy that will deny specific services or specific users from getting out or from doing specific things for now the action is accept inspection mode is uh is another topic that we will look into that is the inspection uh that is done to our networks when we're using security profiles such as anti-virus or ips for now we will keep it at flow based mode now we will use net net is network address translation that is our private ip address which can be 192.168. 2.6 will be translated to your 48 or to your isp public internet address um now we will not use security profiles you know what let's use antivirus let's use the default profile the default antivirus profile we will use certificate inspection when we use certificate inspection your photigate checks the different fields that are coming from um servers certificates to see if they're valid if it doesn't have any mismatches and so on the last thing is to use our logging options we can log only security events but we will log all sessions so later on we can look at the login report and see what our users or what our host did okay so we have a manager's one policy we have two interfaces the when one which connects us to the outsides and the management interface which managers in our company can connect to and get their ip addresses that was the second step now the third step is to configure a static route a static route is actually uh for our usage will be a default route that is i've already configured one so let's just look at it if you want to create new you just create new so default route actually tells your photogate that whenever he sees a packet any packet that is destined to any place which doesn't have a route at the routing table it will route it towards the when interface and the when interface address is a 10. 0.3.1 remember my isp router has that address now you can use specific parameters as distance uh you can use a priority it just tells me that i already have that static route which i do and once we have a static crowd a policy and interfaces that are configured correctly we can now connect our host to the management interface and those hosts can now get onto the internet let's just move to the cli and let's see how do we configure interfaces using the cli so for the sake of our purpose let's um let's configure port 7. so using the cli we will use the config system interface now let's edit port 7 as we said let's set its ip to 168.4.1 with a subnet of 24. let's set the management the management protocols to http and https and what else we can use many more if you will look at the let's end it now i want to show you something when you um when you config system interface let's just get out here config system interface and if we look at ports port one for example we can use the show full config and as you can see there are dozens of features of configurations that you can add for our sake we have only enabled the ip address um on the on that interface and let's look at it let's just refresh our page four seven and there it is now we can also configure the dhcp server and so on we have not done so on our cli um the last thing i want to show you once you get into your uh 48 you're actually the 40 gate administrators now you have two types of administrators on actually you have more than two types but the two most common types is a super admin which is you you have privileges to just about anything you can read and write and you can create another uh type of administrator which is the professional admin and where you can actually enable it different read and write privileges on the different places on your 40k if you will head over to the cli and use the config system admin and you can edit the admin name i have two admins i have one which is the super admin and the second one which is offer test which is my second admin so now let's look at different configurations that you can add to your admin again lots of configuration that's not the only place where you can configure different things you can also configure it on it globally which is the config system global but um one of the things that i wanted to show you is that you can strength your admin account by using a trusted host so you can also look at it here sorry here you can configure a trusted host that is a trusted ip address that only your admin can get from so you can configure the ip address on your uh office at your work and you can configure another trusted host which is the ip address at your home only from those two ip addresses your admin can get into the 40 you can also configure two-factor authentication which is also a very common security procedure you can use 40 token and you can also use your email as a two-factor authentication let's just show you how to do so let's clear that out so we can use the config system admin set now let's edit the profile before and set two factor email set email to and let's set it to one of my gmail accounts let's end it and now if we'll go back to our admin profile uh let's view it again and you can see that you can now use an email-based two-factor authentication so let's create a system interface and a dhcp server using the command line the following is part of the basic firewall training we will set up an interface and a dhcp server let's do it on port four we will do it using the command line so let's just use the config system interface all right let's edit port 4. let's just make it port four let's set the ip to 10.0.7.1 slash 24 and let's set the allow access the management protocol access to ping http https we can also set the weight for that interface let's just give it a weight of 250 we can we can set different settings for that interface but we will end with that that that will be our local area network interface for our finance department now the second thing that we can do is to actually configure dhcp server on that interface so config system dhcp server let's edit that server let's create an entry a new entry and let's set the default gateway for that dhcp server to the 10.0.7.1 and let's also set the interface we're creating that on the port 4 interface now let's configure the ip range the pool of ip addresses that it will list for the clients that connect through that interface and for that we will use the config ip range and let's also use uh edit one and let's set the start ip at the 10.0.7.2 and let's set the um end ip to 10.0.7.1 all right next and and let's set the net mask to 255 for 255 to 255.0 that's less 24 and let's set the dns service to default all right now let's end it and let's just refresh our page remember port four let's refresh it and there it is and here we can see that we have our lan at port 4 that's our finance land that's the ip of the land gateway that's the administrative access and here's our dhcp server that starts with the 10.0.702 up to 10.07.11 and the dns server is the same as the system dns two minutes cli command and this time the diag sniffer coming up [Music] dike sniffer packet is one of my favorite comments why because it actually allows you to package capture the traffic sniff the traffic just as tcp dump or wire shark does so the syntax goes like that dag sniffer packet and then you need to uh include the interface so we will do any but you can choose port one or port two after that you actually filter filter the traffic you can filter it using this source destination protocol we'll use the host so we'll use the host 10.0.3.1 which is my gateway next comes the verbosity that is the amount of data that you want to include i will choose four and we can also add up the count that is the packet count so let's add up 10 packets and if you want a timestamp you can add the a letter so let's start and there we have it now you can play around with the different filters and the different verbosity levels do that if you want a packet capture not using the diag sniffer but using the graphical user interface you can do it in network packet capture and in packet capture you will find that you can choose the interface and use the different filters we have already learned how we can list system processes and show their output on the command line now on this video we will look at how we can kill different processes that consumes too much memory or too much cpu power and how we can list the highest demanding processes on our fortigate to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything so you're using a high level encryption in your vpn you're using ips to scan different patterns and anomalies you're using antivirus and you keep logging of just about anything well all of that consumes lots and lots of cpu resources and memory let's take a look at the diag system command let's make an interval of 20 and with 10 processes all right now using the m character you just need to type the m character we can sort up the processes that consumes the highest memory and in our case it is the dns proxy if we press the p character that p is for cpu we will see the different processes that consume the highest cpu resources and in our case it is https daemon now the next step is to kill the process that causes you lots of issues that is the last step before you reboot your 48 to let's do a control c to kill a process you use the diagnosis kill now you enter what is called a signal that is a term that comes from linux and unix which is actually a light way to ask your system to stop the process and it can be a more aggressive way to tell your system it depends on the number to tell your system to kill the process now we can use different signal numbers we will use 15 which is an aggressive way to tell your system kill that process and we will list the process id now the process id as we know is the second column so let's use the dns proxy process which is 94. all right now we have just killed that process and here we can see that the dns proxy process has actually been terminated we saw that we can list processes sort them out and even terminate them whenever they demand too much resources on our last part of knowing your processes we will see how we can in one cli command see the top most cpu demanding processes [Applause] [Music] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything one of the features that we saw using the dag system command is that we can list the most demanding processes either cpu and memory using the m and the p character when it is pressed now there is another command which is the get system performance top which lists only uh the most demanding cpu processes let's see it in action so we use the get sys sorry for that get this performance top now you will see the most demanding processes the most cpu demanding processes at the second most tried column that's the cpu column the most right column is as we know the memory column now you will see different processes such as the ips engine or the antivirus scanner new cli or even the ssh sshd the ssh daemon now whenever a process is too demanding in terms of cpu you may need to kill that process and we saw how to do it using the diag cis kill with a signal level and the process id file rules are basically the bread and butter of every firewall out there it doesn't really matter if your firewall is the next generation firewall whenever you head out to the internet and you're using a firewall then you're obliged to firewall rules what are firewall rules and how are they made coming up [Music] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything a firewall rule is nothing more than a set of criterias that your traffic needs to match whenever an ip session happens in your network a set of rules are being matched against that traffic if your firewall doesn't find a match at the first rule then it goes to the next rule rules are handled from top to bottom now let's look at how a policy rule is being configured and what objects are used to create that match in every rule there's always the implicit deny rule that sits beneath every other rules that is if your firewall doesn't find any match in the traffic then the traffic goes to the implicit deny rule and it is being dropped so when we start to configure our file rule we have as we said an implicit deny rule at the bottom and from there we start to configure our different criterias that will be matched against your traffic now we start we start with the name of the rule itself as for naming conventions don't use too many characters don't use spaces between words try to use underscores the second thing is the incoming interface what is the incoming interface well that's the interface that your local area network is connected to your dmz is connected to whatever interface that the traffic is coming from the second criteria is the outgoing interface so that usually in a full access rule for access policy that is your when interface when you configure your rule to allow traffic from the lan towards the when and the internet but it can also be another segment of your enterprise another lan it can be the dmz the incoming interface is known as the ingress interface the outgoing interface is known as the egress interface so we have two interfaces the incoming interface the outgoing interface and from there we move to the source what is this source that makes the traffic well that can be your clients that can be just about any source that is any ip address or you can use what is known as firewall objects a specific ip addresses within your local area network it can also be a user or a user group that is saved on your firewall internal database or a remote authentication server such as ldap or a radios server another criteria is the destination what is the destination that your traffic is heading towards it can be any destination that is any ip address out there it can be a specific ip that you can configure or it can be a domain or maybe an internet service amazon service so be sure to be granular don't just use any or all be specific if you're configuring a full access policy that will allow anyone to get out towards the internet then it will probably be all if you're configuring specific destination then be sure that to configure them ahead and use them in your rule the next thing is scheduling do you want your policy to work out 24 7 or do you want it to work on specific hours specific days reoccurring days so you will probably have cases where you will be asked to open a file rule for specific appliances in your local area network it could be a backup device it could be a network attached storage be sure to know what times are those appliances need that firewall rule the next thing is service service that is which protocols are being used in your firewall rule are you using only http https and dns that is uh port 80 port 443 port 53 or are you allowing your employees to get out to just about anywhere using any protocol out there including ftp ssh and so on so again be careful with the service usage rights and the last thing is the action are you denying or are you allowing traffic based on that match now this was actually only the part one of your policy or rule creation the next thing once that is once you have a match is to go through security profiles that is going through anti-virus application control ips and so on the other thing that you will have to take care is are you using network address translation are you logging all sessions or only security events if you look at my channel you will find dozens of videos related to security profiles and other features of your firewall so please check out subscribe and see you soon there are times when we need to customize our own ips and application signatures the quick guide to creating your own signatures is coming up don't go anywhere [Applause] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything when we speak of the intrusion prevention system we speak of an engine that compares traffic against signatures signatures of known threats and anomalies now whenever the ips engine alerts us it's in our responsibility to either block monitor or allow the traffic signatures allows us to identify malicious attacks and the question that arises is why do we need to create our own customized signatures fortinet has already provided us with thousands of signatures there are two main reasons the first one sometimes we use a specific application we use our own set of tools or our own topology that is customized to our need and we need to create a customized signatures that will match and the second reason is for tracks that somehow doesn't have any signatures yet so how do we create one let's head over to our ips sensor page signatures view and then create new the following signature is probably the most basic one if you want more advanced signatures please leave a comment in the comments page our first signature will allow us to block the cnn.com website there are dozens of ways using our web filter or application controls to do it but we are here to learn how we customize our own signature and that's a good start now every signature starts with a header the header for every signature starts with f s bid that's the header text and then we open parenthesis in the parenthesis within them we enter the signature matching criterias criterias of that signatures are described using a keyword and a value and different keywords if you're using a different keywords you can use only one keyword and a value you will divide different or separate different keywords using a semi column the first keyword is usually the name of the signature we have to give our signature a clear description of the attack and then we define the signature triggering what makes it active in the attack which type of protocols are we looking into the flow of packets the amount of packet we are looking for matches matches in the traffic itself we match based on specific headers specific patterns thresholds as in rate based engines for that we use keywords two types of keyword example is service and protocol now in service we determine as in our case the the that the service is http since we wish to block a website in protocols we can specify if we will use tcp as most websites use or maybe we plan to block our site not only to users that go through tcp in their browser but also users that may connect to that website using different protocols such as ftp each keyword must start with a pair of dashes another keyword is flow that is the flow of the traffic does it come from the server towards a client or from clients towards a server or maybe it is bidirectional in our case we wish to block any users from that our clients from going to a web server that is the cnn.com web server and there are many more parameters and patterns that we can add but this is the basic syntax that we use to customize our signature so let's try one right now let's name our ips signature let's add some comments we will start with the f hyphen s bid and we will open the parenthesis now let's choose a name for the custom signature and our name will be blockcnn.com the next thing to do is to add a pattern we will use a regular expression pattern that that is cnn.com and now our 48 will detect the url and as we add up the service which is http it will know that it will only look up for that specific signature over http protocol make note that we divide the different keywords with a semi colon and now we will set up the protocol which is actually the traffic type 48 will only detect this signature in a tcp traffic that is if we will send a mail to that url which runs over smtp or if we will connect to that url over ftp it will not do anything it will only block the website over http traffic by default patterns are case sensitive so if we wish that 48 would block any any attempt to get into that url using uppercase or lowercase we will use the hyphen hyphen no underscore case and now let's limit the scanning only to traffic that is sent from the client we can also use b directional but in our case we will use the hyphen hyphen flow from client and the last thing to do is to add up the hyphen hyphen context host which makes the domain name to appear in the host field as it being resolved by the dns so that was our basic signature now if you wish that we will create a more detailed the more complicated signatures just leave a comment in the comments page and i will do so in this video we are going to show you the top 5 ips commands for your 48 and we are starting right now the inclusion of ips in your 48 is one of those things that makes your 48 and next generation firewall it deals with exploits it deals with anomalies ips engine is just about everywhere so let's start with our first command that is config ips global there are some 48 models that supports also the extended database which includes much more signature so to check it out set database and you can use the regular and you can also use the extended so if you have the extended don't hesitate to use it when we create or configure ips sensors we need to plan them carefully why because they consume a lot of resources from your 48 in terms of cpu and memory now whenever you head up to your ips signatures page and add signatures think of two main things the first one operating systems if you're using a windows based network don't choose any signatures that are related to mac os or linux the second thing is the direction of the traffic now if you're protecting clients use only signatures that are meant to protect clients if you're protecting server do the same the next command is for those who runs a 48 with multiple processors you can actually run several ips engines simultaneously so how do you do it you head over to your cli configure ips global now set engine count now if you set the integer into 0 then 48 will choose how many engines are to use simultaneously but you can also change it according to your needs your ips engine needs as much power as it can get there are many 48 models that supports hardware acceleration either using the np asic or the cp asic mine uses the cp asic so why not giving it to him use the config ips global and then set in my case it's the cp set cp acceleration mode those that supports the np just use the set np acceleration mode and set it to basic or to none or in this cp case to an advanced mode which supports more ips patterns your ips engine consumes lots and lots of memory and cpu cycles now if you see spikes in your 40 gauge due to cpu high usage and so on you can diagnose test application ips monitor and there you will see different tests that you can do on your ips engine you can disable it totally using option 2 or you can toggle bypass status which actually means that the ips engine works but doesn't scan any traffic so play around with those options whenever you have issues with your ips engine and before we end please subscribe to get more videos like that so you have decided to take the nsc 4 exam now what do you do how do you practice what do you need to know well in this coming video we will look at the best tips to make you prepared coming up the first tip is to be practical leave aside the dumps live aside these study guides head over to a fortinet support site download one of the vm images of the latest builds open it in your browser of choice and start playing around create new interfaces configure the different services on that interface create new policies even if you don't have any other machine to play around think or dream of different use cases such as anyone in your land is forbidden to use ftp traffic beside a specific device how do you configure that policy how do you create a firewall object of that device so think around and play around with different use cases the third thing play around with security profiles configure new profiles understand how they work and apply them to your policies apply them to your policies and understand how they actually work either in a flow based or a proxy based inspection mode the theory behind those two is crucial to understanding how the security profiles work the second tip is understand the terms head over to your command line the access session list now once you do so you see in the output so many terms that may be frightening at the first time what is proton number six what is state number six what does it mean origin shaper what is the serial of that session what is an npu get around with the terms understand how sessions work on your fortigate your 48 is a session where firewall and just understand the different numbering for different protocols tcp protocol is protocol number six the udp protocol is protocol number 17. icmp is protocol number one each have different states understanding numbering and you will see more more terms such as fail open or made dirty many terms that you need to walk over in in the fortinet documentation understand them since you will probably in the exam itself you will probably see outputs with the following terms understanding the basic actually means that you need to know how different components on your photogate actually work if you play around with an anti-virus you have different databases let's just clear the screen configure anti-virus settings now you can set the different databases using the command line are those databases being downloaded locally to your photogate or are you using any cloud repository the same goes for web filter if you're creating a new profile you have the bodyguard category based filter is that a database that is being downloaded or is it a cloud repository another example is the routing table if you look at the routing table using the cli with the get router infrared table all does it have precedence over the policy route or maybe the policy route have presidents over the regular routing table so these are the basics understand them as you will probably have some questions related to those topics in your exam you will probably face some network troubleshooting questions so look very closely at the topology that is shown look at the different ip addresses look at these subnets look at the classes try to understand if that topology makes sense you will probably face also some outputs such as the diag debug flow or the direct sniffer packet analyze what is the reason it may be a networking issue it may be a policy issue it may be that you just don't have any static crowd to the destination so look around closely and understand the topology before answering we tend to forget but your photigate can actually work in a transparent mode and act as a switch a device with only one broadcast domain it's management ip so you can set the up mode the operation mode either to nac that is a layer 3 device or to a transparent which is a layer 2 device we you will be asked questions regarding two vlans you will be asked questions regarding to virtual wire pair you will be asked questions regarding your 48 as a appliance that sits between two segments of the network it doesn't do any routing but it only scans the traffic that passes through so know your way when your 48 works in a transparent mode as a layer 2 device only your 48 is part of a security fabric with multiple components that are on the network itself you will not have to answer questions regarding 40 analyzer or 40 manager those are different components and have their own certification but you will need to understand how load balancing works what is an sd1 is software defined when how to prioritize traffic based on load balancing algorithms or based on different slas service level agreements that you create you will also need to know what is an h a an h a high availability is the way that you actually create a redundant photogate along with your primary 40 gate you can create it either in an active active mode or active passive mode understand the priority of creating a master photogate and a slave photogate understand how sessions are distributed between those components remember that your photogate is a network device and as such it will have its load balancing and redundancy algorithms in place which you need to excel in one of the main rules or main jobs that your fortigate does is to authenticate users while entering the network now you will need to understand how a user is created how to connect to a remote authentication servers such as ldap or radios what is a single sign-on how do you create a proxy what is an explicit proxy and what is a transparent proxy how do you transfer your proxy settings using a pack file what is an authentication rule understand the aim of authentication understand what does it take to authenticate different users using passive authentication or active authentication those will be probably asked throughout the exam be sure to understand the whole nature of authentication fully whenever a ping an icmp request is being sent from one of your 48 interfaces or sources the defaults are five times that is the packet is being sent five times it has a data size of 56 bytes it is being sent in a one second interval and you have a two second timeout let's see how we can unleash your ping settings [Music] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything using ping an icmp request is probably one of the most used yet simple network troubleshooting tools so let's unleash our ping setting and see what can be done we will start with the execute ping and then we will use the view settings so we can see what is our ping default settings so we can see that we have a repeat count of five times we have a data size of 56 bytes we have a timeout of two seconds currently the interface is auto which means that it actually goes to our routing table and this is the best trout out we have an interval of one second that is your ping will be sent one second after the echo response received you can use an adaptive settings which we will do very soon to see that you can actually send the second or the third icmp request immediately as the ping response comes back the time to leave is 64 hops let's see if we have any interesting more interesting stuff here no the second thing that we can do is to set the uh ping options and see what are the ping options and we can see that we can set an adaptive ping we can set different data size we can set df bit which is a parameter at the ip header we will look at it we can set the interface that the ping will be sent from we will use our marketing interface and send ping from there uh we can set the hex format of the ping we actually can add different characters to our uh empty hex space in our ping we will look at it also and yes we can set the source the timeout time to leave and more so let's start with a simple ping towards towards google okay that's google.com that works now we'll use the same thing towards google dns server and see if we have a dns resolve that also works great now let's um let's close that for a minute let's move to my ubuntu device all right all right now my ubuntu device sits on the actually it sits on the marketing interface let's just get back let's login all right all right so let's start by pinging my ubuntu device which is at the 10.0.4.9 everything goes well you can see that i have a very big icmp uh packet let's see what is the reason execute ping options you know what let's do another thing let's once you have um settings that are not your default settings remember the default settings is 56 bytes uh you can reset them using the execute ping options and reset now let's send the same ping again and let's see what is this side that's 64 bytes remember that your data size your icmp size is 56 bytes you have an 8 byte header for the icmp packet what you see here is actually the payload itself plus the header that is 56 plus the eight byte header let's um let's see again how we change the data size that's the way that we change the data size let's set it to 128 bytes and let's now um change another settings which is the adaptive ping your icmp request is being sent in an interval of one second now you can change it so that it will be sent immediately as soon as the icmp response gets back to do so you have to choose uh enable another setup is the df the df bit what is the dfb df stands for don't fragment that is don't fragment the packet even if it's bigger than the interface that is supposed to accept it so if you have on the other side an interface with an mtu uh of x values and your icmp packet is bigger than that so your icmp packet can actually be dropped so be careful how you use the df bit let's keep it at no now let's see what is the effect of adaptive ping versus the regular settings so let's just execute ping let's use a repeat count of 20 packets and let's execute our ping towards google sorry google.com all right so you can see that we have an interval of one second now if we will use the uh adaptive ping option let's just enable it let's send the same uh ping and you can see that you're actually having a sort of an icmp fluid uh it's not hundreds of uh of packets a second but it is it is still much faster than the usual interval so you've got your new 48 and you need to set it up so here's a quick setup guide your new photogate comes with a pre-configured port one at the 192 168 199 ip address so you can actually manage your photogate using the command line or using the graphical user interface we will do it using the graphical user interface with the web-based manager so take up your client that is your pc or your mac change the subnet to something in the 192.168.1 subnet it could be 1.10 1.11 connect your client to your port 1 on your 48 and just open up your web browser at the 192 168 199 address when you will do so let's just move on and see what happens [Music] all right so you get into your browser you type the address the port one ip address and you enter your administrator credentials now if you have an older model you would just use admin as a username with no password on the latest firmwares you will need to enter a password and i've i've already entered one so let's just getting into our 48 and from here let's just move to system settings the very first thing you need to do is to change your host name now it may sound not important but if you have several photogates one of them is protecting your data center and one of them is blocking users on another department you will need to know which fortigate did what so let's just name our photogate marketing so we will know that it protects our marketing division the second thing to do system time the best practice is to use fortiguard ntp so every appliance will be synchronized now you can set up different a administrator settings such as the http port which you will probably keep at port 80 and https which is 443 the other thing that you can do is customization you can change your language either to english french spanish and so on and you can also change the theme of your 48 and you will see the different theme change immediately now let me just use this one since it looks much more modern in my opinion we will not get into the ngfw mode either profile based or policy based that will have to wait for another video um let's just move on email service you can use the custom settings which are fortiguards smtp email server or you can use your own or whichever smtp server that you will use and you will see that you will use your email smtp server more and more as you practice your photogate the other thing that you can do is to head over to 40 yard and in 40 guard and in antivirus and ips updates enable the accept push update so you will not miss any signature that is being pushed by the 40 guard servers the other thing that you can do server location use lowest latency locations it is a good practice to do so if you're not in the us all right so those are the default settings now if you move to administrator remember you're the administrator of your fortigate you can edit your administrator profile add up your email add up two-factor authentication and you can also add up what is known as a trusted host that is only administrators that connect to the fortigate management interface through one of those ip address that you will configure will be permitted to enter so you can set up your trusted host to your ip address at work and your ip address at your home location you can also set up new administrator and you can actually add up a professional administrator that will take care of different areas on your photogate once you configure your settings and your administrator profile you can add up more interfaces ones that are connected to your when interface and to your other lens i have a bunch of videos that will show you how to do so and the other thing that you will need to do is to create a static route a default route that will connect the traffic the packets that needs to get out to the interface to your gateway that is the interface that is connected to your when interface all right so this was a quick setup guide from there you will probably move to policies and object create your own policies uh customize your interface customize your settings your logs and reports uh create security profiles and so on this video is all about setup tips for your photigate and we are starting right now [Applause] to get more easy setup tips for your 48 firewall subscribe now and don't forget to click on the bell notification and you won't miss anything one of the most common questions that i get every time is how do i set up my 40 i'm not interested currently in any intrusion prevention system sensors i'm not interested in ipsec vpns i just have several interfaces connected to different clans and i need to set up my fortigate for a truly a basic operation so in this video we will look at the basic basic setup configuration as you know in my channel you have tons of videos that deals with different aspects of your 48 so the very first thing is to set up your administrative profile you are probably the super admin of your fortigate so make sure that you connect through trusted host if you need up to set up a new admin maybe a professional admin that will be responsible for another virtual domain or different aspects of your photogate do it so the next thing to do is to move over to network interfaces you probably have different clans connected to different interfaces in your 48 in each interface don't forget to write down an alias it will help identifying which land belongs to which interface use a specific rules for specific interfaces use administrative protocols carefully don't just let anyone ping from that interface if it is not needed use dhcp server and use dhcp server scopes so you can create different dhcp options for that local area network you can block specific mac addresses from receiving ip addresses uh and use device detection and active scanning you want to know which devices initiate traffic on that interface now the next thing to do is to create or configure static route that will lead to your isp now it is usually uh created using the default route which actually means uh that any packet that is destined to anywhere and it does not have any entry in the routing table should head up towards the specific gateway which is usually the when gateway the next thing to do is policy and objects that is the bread and butter of your 48 firewall it is where you create rules rules that match any traffic that comes in or gets out of your 40 gate assuming that it matches the traffic you have two decisions the first one is to accept the second one is to deny now you can create different policies according to different topologies the basic the basic policy is the full access policy which allows local area network to get out to the internet through the when interface so incoming interface can be just about any lan in your network the outgoing is the when interface source can be different users devices but let's assume that we deal with just about anyone destination also can be specific destination but let's assume that any destination is allowed you can set up different scheduling and services now again you can deny specific protocols but for our case we will allow any service now the learned policy is another topic that i have made a video specifically on that but that's not the issue right now now whenever 40 gate matches the traffic the next decisions are are we going to lock the traffic are we going to net the traffic and that is also very i would say not difficult but it is a tough topic to understand uh and then it implies these security profiles which can be anti-virus web filtering ips and so on and our last setup is actually moving into the login report and see whatever happens in your 40 now there's a lot of happening whenever traffic comes in and gets out whenever an admin logs in into one of the interfaces whenever there's a vpn tunnel that initiates or stops working you need to maximize your understanding on what is happening on your network and the best thing to do is to look at the login report and understand your network baseline your connection starts with a dns request a dns response and there comes the tcp three-way handshake and when it's done you send an http get request the basic denial of service attack works on the tcp three-way handshake that starts when the client sends a tcp scene the server sends a tcp synag and then again the client sends an ack a tcp packet with the ack flag on now on a denial of service a hacker sends a tcp syn the server sends back a tcp synag and the hacker doesn't send back the tcp ack that connection is known as half open connection now it has limitations in terms of time it has limitations in terms of buffering the server's buffer but when that happens quite fast our server will not accept any more connections so what do you do and how do you protect your servers from sin float attack [Music] have open connections are happening all the time it can happen due to congestion in the network due to bad connectivity it even happens due to different application that behave so but you can limit the timers the time that your server will wait for a tcp syn ack so let's just see how we do it we go to the rcli config system global and now you can set the tcp half close timer and half open timer the half close timer actually tells our photogate you can terminate sessions there are waiting for tcp packets with the fin flag that is set to on now the half open timer is what we have just waits for the tcp ad that is coming from the client the last step in the three-way handshake so you can set different timers that is according to your network behavior another thing you can do is actually go to the policy and objects ipv4 denial of service policy just choose your interface it will probably be the when interface and there you can set the rate of the tcp syn float that is set the maximum sin packets rate for one second currently the threshold is 2 000 you can set it to 1 000 packets you can set it to 500 packets you can set it to moritz all depends on your network behavior on your server's behavior you know it better than any two minutes cli and this time how to configure your interface using the command line coming up [Music] this is probably one of the most used commands that is my most used command now config system interface actually configures the physical interfaces or the virtual interfaces on your 40 you can do it either on the graphical user in

Channel: Forti Tip

Views: 5,583

Keywords: forti tip, fortigate basic configuration, fortigate, fortinet, training, fortinet firewall, fortigate firewall training, fortinet firewall tutorial, fortigate installation, fortinet firewall videos, fortigate firewall configuration step by step, fortigate cookbook, basic setup, fortigate cli commands, top 5, basic fortigate configuration, basic fortigate setup, firewall policy, firewall rules, fortigate how to, configuration how to, 2019, Beginners tutorial, checkpoint, palo alto

Id: pZif29I6ZdE

Length: 236min 14sec (14174 seconds)

Published: Sat Dec 05 2020