Configuring the firewall and Security Profile settings

Chapter 20 Virtual Domains : Inter-VDOM routing : Example of inter-VDOM routing : Configuring the firewall and Security Profile settings

With the VDOMs, physical interfaces, and VDOM links configured the firewall must now be configured to allow the proper traffic. Firewalls are configured per-VDOM, and firewall objects must be created for each VDOM separately.

For this example, the firewall group of services allowed between the internal networks and the Internet are the basic services for web browsing, file transfer, and email. These include: HTTP, HTTPS, SSL, FTP, DNS, NTP, POP3, and SMTP.

The only services allowed between Sales and Accounting are secure web browsing (HTTPS) and email (POP3 and SMTP)


	The limited number of services ensures security between departments. The list of services can be expanded in the future if needed.

Security profile settings will block all non-essential business websites while logging all web traffic, scan and file filter all web and email protocols, and block game and peer-to-peer applications using application control.

For added security, FortiClient is required on internal computers with AntiVirus scanning configured. This is enforced by Endpoint NAC in firewall policies.

Using firewall addresses makes the firewall policies easier to read. Also if any changes need to be made in the future, you can simply update the addresses without changing the firewall policies. The addresses required are:

• AccountingLocal - all traffic from the internal accounting network

• AccountingVlnk - all traffic from the VDOM link between accounting and management VDOMs

• SalesLocal - all traffic from the internal sales network

• SalesVlnk - all traffic from the VDOM link between sales and management VDOM.

The Accounting VDOM requires AccountingLocal, AccountingVlnk, and SalesLocal. The Sales VDOM requires SalesLocal, SalesVlnk, and AccountingLocal.

The firewall policies required on the Accounting VDOM are:

• AccountingLocal to Internet

• Internet to AccountingLocal

• SalesLocal to AccountingLocal

• AccountingLocal to SalesLocal

The firewall policies required on the Sales VDOM are:

• SalesLocal to Internet