Table Of Content

UTM Security with Fortinet Mastering FortiOS This page is intentionally left blank UTM Security with Fortinet® Mastering FortiOS Kenneth Tam Martín H. Hoz Salvador Ken McAlpine Rick Basile Bruce Matsugu Josh More AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an Imprint of Elsevier Acquiring Editor: Steve Elliot Project Manager: Mohanambal Natarajan Designer: Joanne Blank Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA Copyright © 2013 Elsevier, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of p roducts liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Application submitted British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-747-3 Printed in the United States of America 13 14 15 16 17 10 9 8 7 6 5 4 3 2 1 For information on all Syngress publications visit our werbsite at www.syngress.com The statements made herein are not statements made by Fortinet and cannot be construed as a warranty, guarantee, or commitment on behalf of Fortinet. Fortinet®, FortiGate®, and FortiGuard®, are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance metrics contained herein were attained in internal lab tests under ideal conditions, and performance may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all representations, warranties, or guarantees whatsoever, whether express or implied. Nothing herein shall be considered a waiver by Fortinet of any rights and Fortinet reserves all rights. Dedications Kenneth Tam would like to dedicate his work on this book to his wife Lorna for her patience and support throughout this project. Along with his kids Jessica, Brandon, Ethan, and Sophia for the everyday inspiration that gets him through those stressful days and time away on business trips throughout his career. Martin would like to dedicate his work on this book to his mother Micaela and grandma Guadalupe for the values, education and life example received from both, to his wife Diana for the understanding and support especially while working at nights and weekends on this project, to his daughter Isabella for the inspiration, and to his brothers in arms (the Fortinet Latin American team) for making work a pleasure that he enjoys every day. In-memoriam: Wolfgang Gonzalez. Bruce would like to dedicate his work on this book to M, R and Y, and to the early inhabitants of the Fortiverse Rick would like to dedicate his contributions on this book to his wife Lizette for all the sacrifices she has made over the years supporting his career and and to his children who he hopes will learn from his successes and his failures. v This page is intentionally left blank Contents Dedications ................................................................................................................v Acknowledgements ..................................................................................................xv About the Author ....................................................................................................xvii Foreword .................................................................................................................xix Preface .....................................................................................................................xxi SECTION I GENERAL INTRODUCTIONS CHAPTER 1 Introduction to UTM (Unified Threat Management) ......3 Introduction .....................................................................................4 Internet and Security .................................................................4 Basic Network Security Concepts ............................................4 Unified Threat Management (UTM) Foundations ........................14 The World before UTM ..........................................................14 The History of the Unified Threat Management (UTM) Concept ...............................................................................16 UTM vs Other Security Architectures ....................................17 Solving Problems with UTM ........................................................20 Better Security ........................................................................20 More Efficient Security ...........................................................23 Enhancing Operational Response Times (Meeting and Enhancing SLAs) ................................................................24 Getting a better Support Experience .......................................24 Cost Effectiveness ...................................................................26 Current UTM Market Landscape ..................................................28 UTM a-lá Fortinet ...................................................................28 Other Vendors .........................................................................33 Evolution and Future of UTM ......................................................34 CHAPTER 2 FortiGate Hardware Overview .............................................35 FortiGate Hardware Overview ......................................................36 The Fortinet Way ....................................................................36 Evolution of FortiGate ............................................................39 Current FortiGate Solutions ....................................................40 Virtualized Appliances ............................................................41 FortiGate Custom Hardware Accelerations Overview..................41 Features of the Last Four Generations of Content Processor (CP) ASIC Functionalities ..................................42 vii viii Contents Features of the Network Processor (NP) ASIC Functionalities .....................................................................43 FortiGate Hardware Accelerations Behaviors ........................45 The ‘Black Art’ of FortiGate Sizing .............................................50 Sizing Data Gathering .............................................................51 Assessing the Recommended FortiGate Solution ...................54 Centralized Management Platform Overview ..............................57 Fortinet Product Portfolio .............................................................59 FortiGuard ...............................................................................59 FortiCarrier .............................................................................59 FortiBridge ..............................................................................59 FortiAP....................................................................................60 FortiToken ...............................................................................60 FortiAuthenticator ...................................................................61 FortiMail .................................................................................61 FortiWeb .................................................................................61 FortiScan .................................................................................61 FortiDB ...................................................................................62 FortiBalancer ..........................................................................62 FortiClient ...............................................................................62 References .....................................................................................63 CHAPTER 3 FortiOS Introduction ...............................................................65 FortiOS Architecture .....................................................................65 Multiple Image Support ..........................................................67 Firmware Image Versions .......................................................67 FortiOS Operational Modes ....................................................68 Packet Flow Handling .............................................................69 WebUI Management Interface ................................................70 CLI Management Interface .....................................................71 System Options .............................................................................73 Recommended Configuration Options ...................................73 Dealing with Administrative Operations ................................83 Enabling VDOMS ...................................................................92 SECTION II UTM TECHNOLOGIES EXPLAINED CHAPTER 4 Connectivity and Networking Technologies ..................95 Operating Modes ..........................................................................96 Layer 2 (Transparent) .............................................................96 Layer 3 (NAT/Route) ..............................................................97 Contents ix Connectivity ..................................................................................97 Dynamically Addressed Interfaces .........................................97 VLAN Interfaces.....................................................................97 802.3AD ..................................................................................99 Redundant Interfaces ............................................................101 Wireless.................................................................................102 Modems ................................................................................102 IPv6 Interfaces ......................................................................103 Routing .......................................................................................104 Static Routing .......................................................................104 Policy-Based Routing ...........................................................106 Dynamic Routing ..................................................................109 Servicing users ............................................................................116 DHCP ....................................................................................117 DNS Server ...........................................................................118 Virtual Domains (VDOM) ..........................................................118 High Availability .........................................................................118 CHAPTER 5 Base Network Security........................................................123 Firewall .......................................................................................125 Interface-Based Rules ...........................................................127 Building Blocks of a Rule .....................................................129 Multicast Rules .....................................................................137 IPv6 Rules .............................................................................139 Local-In Firewall Rules ........................................................140 Miscellaneous Firewall Settings ...........................................140 Identity-Based Authentication ..............................................152 VPN ......................................................................................162 Traffic Shaping .....................................................................187 SSL Inspection ......................................................................190 Two-Factor User Authentication ...........................................193 Load-Balancing Capabilities ................................................196 CHAPTER 6 Application Security ............................................................201 FortiGuard ...................................................................................203 Introduction to FortiGuard ....................................................203 FortiGuard Licensing ............................................................205 Configuring FortiGuard on the FortiGate .............................207 Doing UTM Analysis: Concepts ...........................................213 Troubleshooting the FortiGuard Distribution Network (FDN) Connectivity ..............................................................218