Fortinet FortiGate-800 User Manual download pdf (Page 208)

208 Fortinet Inc.

Virtual IPs Firewall configuration

Adding schedules to policies

After you create schedules, you can add them to policies to schedule when the

policies are active. You can add the new schedules to policies when you create the

policy, or you can edit existing policies and add a new schedule to them.

To add a schedule to a policy

1 Go to Firewall > Policy.

2 Create a new policy or edit a policy to change its schedule.

3 Configure the policy as required.

4 Add a schedule by selecting it from the Schedule list.

5 Select OK to save the policy.

6 Arrange the policy in the policy list to have the effect that you expect.

For example, to use a one-time schedule to deny access to a policy, add a policy that

matches the policy to be denied in every way. Choose the one-time schedule that you

added and set Action to DENY. Then place the policy containing the one-time

schedule in the policy list above the policy to be denied.

Virtual IPs

Use virtual IPs to access IP addresses on a destination network that are hidden from

the source network by NAT security policies. To allow connections between these

networks, you must create a mapping between an address on the source network and

the real address on the destination network. This mapping is called a virtual IP.

For example, if the computer hosting your web server is located on your DMZ

network, it could have a private IP address such as 10.10.10.3. To get packets from

the Internet to the web server, you must have an external address for the web server

on the Internet. You must then add a virtual IP to the firewall that maps the external IP

address of the web server to the actual address of the web server on the DMZ

network. To allow connections from the Internet to the web server, you must then add

an external->DMZ firewall policy and set Destination to the virtual IP.

You can create two types of virtual IPs:

Static NAT Used to translate an address on a source network to a hidden address on a

destination network. Static NAT translates the source address of return

packets to the address on the source network.

Port Forwarding Used to translate an address and a port number on a source network to a

hidden address and, optionally, a different port number on a destination

network. Using port forwarding you can also route packets with a specific

port number and a destination address that matches the IP address of the

interface that receives the packets. This technique is called port forwarding

or port address translation (PAT). You can also use port forwarding to change

the destination port of the forwarded packets.

1 2 ... 203 204 205 206 207 208 209 210 211 212 213 ... 335 336

No comments

Fortinet FortiGate-800 User Manual Page 208