This procedure explains how to set up a VPN using SSL to connect to any PC from the internet to your organization's LAN. All traffic would be encrypted using SSL. And you only need to have a compatible browser, without installing software. Two parts are explained:
This procedure explains how to connect two separate networks using a VPN between two Fortigate. The example is based on the following image:
This procedure explains how to set up a VPN using IPSec to connect to any PC from the internet to your organization's LAN. All traffic would be encrypted using IPSec. To connect to the VPN we will do it through the software “FortiClient”. Two parts are explained:
First of all, since we have a firewall that allows all these types of services, we will enable or use them. For this, We have to create a “Protection Profile” and enable everything that interests us, later we will have to assign this profile to a firewall rule.
GOOD, This is very simple and straightforward, So it's a basic thing. What I want is for them to connect from the internet to my internal network, to my FTP server (21 TCP), that is, that whoever connects to my public IP address enters my FTP server only through the port 21.
The fortigate firewall has the possibility to save your LOG's and thus be able to see what is happening in our network, We can see the attack attempts we have, What our users do… these LOG's can be stored in different ways, one through another Fortigate product called FortiAnalyzer; another to its own internal memory (when it restarts it is deleted, It's RAM); to a USB pendrive called FortiKey and the most interesting in my case and free to a LOG's server called Syslog.
This document explains how to configure a Fortigate to use LDAP against a directory service, in this case against a Microsoft Windows Active Directory 2003. Learn more about LDAP – HERE.
If we want to integrate the firewall with our Active Directory (Active Directory – AD), so we don't always have to use local users, if not take advantage of those that the domain controllers database has, we'll use a tool called FSAE. This procedure explains, How to install the FSAE, How to configure domain controllers and firewall, Then we'll create a policy and they'll just browse the internet (or the rule that interests us) Active Directory Users.
The most important thing is to have the FW with the most current firmware possible, If it is a new and simple installation we will not have problems, the complex part comes when we have several distributed FWs and they make VPN's between them, since for example a VPN with a firmware FW 2.8 and one with the 3.0 It wouldn't work, they would have to have the same version. There are two ways to update the firmware, one by web that we simply indicate which is the firmware file to update and updates it maintaining the configurations; or another that would be by console cable, a TFTP server that is the one that serves the firmware image over the network. I explain the two ways:
The first thing after unpacking the FW is to assign it a fixed IP for the INTERNAL interface and to be able to manage it via the web, which is more convenient than by commands.. So either we change the IP to our PC or we change it to the FW. The default IP of the FW is the 192.168.1.99, it is best not to connect the FW to the network until it is assigned a fixed IP as it can cause a duplicate IP, and also that it brings the DHCP service enabled by default for the INTERNAL interface. So we connected the console cable to the FW and the PC, we open on our PC the “HyperTerminal” since “Beginning” > “Programmes” > “Accessories” > “Communications” > “HyperTerminal” and create a new connection.
Do Tailor-made training
Windows Server – VMware vSphere – Citrix Virtual Apps & Desktops – Centreon
|
We are a consulting firm that cares and pampers
|
 |
|
With quality and added value
|
 |
|
¡Let's work together!
|
 |
