7-3 Vlan and Security Profile

Hamid Talebi

Chapter 7 – Security

7-3 Vlan and Security Profile

Learning Objectives

Configure Vlans in FortiGate firewall
Configure a Security Policy for Vlans

Scenario: In this lab, we are going to learn how to set Vlan on Port2 of the firewall. WebTerm1 is belong to Vlan10 and WebTerm2 is belong to Vlan20. We will set different policies on each Vlan and try to verify configuration.

Figure 7-23: main scenario

Table 7-2: Devices configuration
Device	IP address	Access
FortiGate	Port 1: DHCP Client Port 2: Vlan 10: 192.168.10.1/24 Vlan 20: 192.168.20.1/24	ICMP-HTTP-HTTPS
Web Term1	DHCP Client	–
Web Term2	DHCP Client	–

Step 1- Switch Configuration

Right-click on the Switch> Configure, configure eth0,eth1, and eth 2 as table 7-3:

Table 7-3: Switch configuration
Port	Vlan	Type
0	1	Dot1q
1	10	Access
2	20	Access

Step 2

You should create two sub-interfaces on port2 of the firewall.

Figure 7-27: Vlan10 and Vlan20 IP addresses

Step 3: Block YouTube and Social Media on Vlan 20

1- Create an application profile as Figures 7-28.

Figure 7-28: Block Social Media and Video/Audio

2- Configure Firewall Policy from Vlan 20 to Port1 and assign application control to the Firewall Policy.

Figure 7-29: Vlan20 Firewall Policy and assign Application Control Profile

3- Verify your configuration by visiting Twitter.com or YouTube.com website.

Step 4: Filter .zip, .pdf files on Vlan 10

1- Create a File filtezr profile. File filter only works on the unencrypted protocol. Set traffic for both and finally set the action to block.

2- Make sure to set the feature set as flow-based.

Figure 7-32: Block profile

3- Create a Firewall Policy in the firewall from vlan10 to port1, inspection mode should be Proxy-based, and assign the profile you have created to File Filter.