Fortinet

NAT / VIP - Port forward

Lav VIPs for hver port der skal åbnes/forwardes, fx:

public.y.xxx.zz --> 192.168.1.50 (TCP: 3390 --> 3389)

Hvis der er flere porte mod samme server, kan der laves en VIP group.

Herefter er det bare at lave en policy med VIP group som destination og ALL i Service.

Se https://docs.fortinet.com/uploaded/files/1652/using-port-forwarding-on-a-FortiGate-unit.pdf

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-firewall/Object%20Configuration/Virtual%20IPs/Configuring%20a%20VIP%20for%20IPv4.htm

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-firewall/Object%20Configuration/Addresses/Addresses.htm

public ip

DNS translation http://kb.fortinet.com/kb/documentLink.do?externalID=FD34099

config firewall dsntranslation

   edit 1
       set dst 217.pp.pp.pp
       set netmask 255.255.255.255
       set src 192.168.1.100
       next
   end

GeoIP

Slå op hvilket land en IP hører til:

diagnose firewall ipgeo ip2country x.x.x.x

Hairpin

http://cookbook.fortinet.com/configure-hair-pinning-fortigate/

FortiClient

Enforce FortiClient Compliance Check kræver man har 100% styr på alle devices der kræver internet forbindelse på netværket.

FortiClient kan hente indstillinger fra Fortigate, fx Web filer, men man skal selv trykke "Fix non-compliant Settings" knappen for at rette indstillinger så de passer med dem fra Fortigate.

VDOM

config system global
set vdom-admin enable
end