Fortigate Firewall - UTM Crash Course

Set up a Fortigate UTM with a VM that has 4 GB RAM and profiles: antivirus, web filter, DNS filter, application control, intrusion prevention; explore blocking sites with flow-proxy inspection.

Discover how to achieve full visibility with deep SSL inspection by downloading and importing the deep inspection certificate into browsers, enabling Fortigate UTM to decrypt traffic to cloud apps.

Configure antivirus security profiles, web and DNS filters, and intrusion prevention, and compare flow-based versus proxy-based inspection modes in FortiOS 6.2 policies.

Enable and configure antivirus databases in Fortigate by selecting a default database and toggling between normal, extended, and extreme databases, including zoo viruses.

Compare flow-based and proxy-based inspection modes on Fortigate firewall, detailing packet processing, antivirus and eyepiece engines, and how block replacement messages arise during virus detection.

Navigate flow inspection mode on the Fortigate firewall, where traffic flow is analyzed, packets are cached for internal scanning, and buffering occurs only after final file packet finishes the scan.

Discover proxy inspection mode in a Fortigate UTM setup, where a transparent proxy uses two tcp connections between clients and internet resources for analysis, with higher resource use and latency.

Discover grayware and heuristic detection by examining signatures and behavior, such as registry changes, and configure antivirus restrict mode to balance monitoring, blocking, and zero-day protection.

Compare default and legacy flow inspection modes in Fortigate, noting feature differences and scan mode options, including virus outbreak prevention and mobile malware database.

Explore the Fortiguard encyclopedia to learn about virus signatures and behavior, and see how to apply recommended actions for trojan threats across active, extended, and mobile databases.

Increase the http oversize file size limit from 10 MB to 15 MB via the command line in the firewall profile protocol options for Fortigate UTM, enabling virus scanning.

Learn how Fortigate firewall UTM decompresses layered archives in memory by file headers, with the default uncompressed nest limit of twelve configurable up to 100 via firewall protocol options.

Override the antivirus timeout, default 0, allowing the engine to scan files to completion; the value can range from 30 to 3600 seconds, but avoid changing it.

Discover content disarm and reconstruction, which strips malicious content from office files, macros, and embedded media in proxy-based inspection, delivering originals and enabling quarantine to FortiSandbox on FortiGate 48 devices.

Enable content disarm and reconstruction for CVR in proxy-based inspection, choose discard or quarantine, enable sandbox inspection, and tune content types via the antivirus profile.

Explore how to configure Fortigate UTM to use external virus hash databases, including VirusTotal sources, by enabling the external malware blacklist in the virus outbreak prevention profile.

Create a ssl deep inspection that includes ssa deep scan, configure protocol options and antivirus limits for ssa, and enable the ssl filter profile to block fcp file transfers.

Fortigate web filtering profiles, including the default and monitor profiles, allow logging or blocking user access via proxy or flow based inspection, with category based filtering, warning pages, and authentication.

Explore how web filtering activates during the DNS request and response and the ensuing HTTP GET exchange, with the web filter applying when the HTTP 200 response arrives.

Learn how category override and user group based overrides in Fortigate Firewall UTM control web access, including blocking new sites with a security profile and applying overrides for specific users.

Create a new security profile to override a blocked news subcategory. Override CNN.com to a non-blocked general interest category and test in a browser.

Explore Fortigate firewall UTM crash course: set up site authentication with flow-based inspection, create an allow all user group, configure a web filter with authenticate action, and verify sessions.

Create a new security profile with a flow mode warning action for streaming media, set 30 minutes, and apply it to policy for YouTube internet usage violations.

Block specific file formats with Fortigate UTM by creating a web filter and configuring the file filter to block, then applying it to a policy and testing the block.

Configure Fortigate firewall UTM log search phrases in proxy inspection mode, create a log search profile, enable keywords in search engines and policy, and apply via the web filter config.

Use web filtering to limit education category sites with a five-minute usage quota in a security profile, enabling monitoring and blocking after expiry.

Configure the Fortigate url filter in web filtering, create and name a filter, and block sites with exact-match rules, then learn wildcard and regular-expression methods using hashtag patterns.

Master regular expressions to find text patterns across languages and tools. Build skills with character classes, ranges, escaping, and quantifiers to match domains and emails.

Demonstrates building a regex to match multiple domains and top-level domains, escaping the dot, and applying a block url filter on a firewall to block those sites.

Explain how the dns filter processes domain requests by querying dns servers and returning the website's IP address and category, blocking at the initial domain-level connection.

Block the BBC domain using Fortigate's UTM DNS filter by blocking the news and media category, applying a block portal, and reviewing DNS query logs to confirm the denial.

Create a DNS filter sensor to block botnets, apply it to the firewall policy, and test with a browser to confirm blocked botnet access and dropped DNS connections.

Enforce safe search with a DNS filter, apply it to the policy, and verify results on an Ubuntu host, noting cert inspection is required and deep SSL inspection is not.

Learn to track and control network applications with Fortigate UTM, create a policy to block remote access such as Team Viewer, and observe how the security profile affects the connection.

Override a blocked application by applying an allow action in the remote security profile's application control. Verify the profile and confirm the application works under the override.

Override a group of apps that share behavior, block risky protocols like Telnet with a filter override, apply to policy, and verify access to a local server is blocked.

Monitor filter overrides and signature overrides using logon, then review login attempts to the FTB server via application control reports, with graphical views showing session destinations and affected users.

The ideas engine identifies Netflix by its unique IP and blocks the video and audio category with an application control profile, verified at the command line.

Create an application control sensor to monitor Gmail attachments using deep SSL inspection, add cloud application signatures, set the monitor action, and apply to policy.

Enable network protocol enforcement in Fortigate's application control, create a new enforcement to map ports to protocols, block violations, or monitor and log traffic before applying it to your policy.

Discover how the QUIC protocol, a Google‑developed transport protocol, is detected in Chrome flags and developer tools, and why Fortigate UTM blocks it due to SSL inspection issues.

Create a new IPS sensor, select signatures or filters, target high-severity servers running Windows with specified protocols and apps, and apply the signature to block threats.

Explore how a Fortigate intrusion prevention system (ips) detects and blocks threats by distinguishing known attacks from anomalies, including zero-day activity.

Explore default IPS templates in Fortigate UTM, including protect web servers, protect email servers, protect the client, and a high security profile with signatures for higher severity.

Fortigate ips uses two signature databases, regular and extended; the extended database holds over 13,000 signatures, while the regular has about 7,000, with a command line setting to choose.

Configure signature types on a Fortigate firewall using rate based, pattern, and custom made signatures; assess severity and vulnerabilities like buffer overflow, and set rate thresholds and actions.

Explain how deep ssl inspection works as the firewall impersonates the recipient of an ssl session, presents a certificate to the client, and signs new keys as a certificate authority.

Identify how botnets unite compromised devices, including ip cameras and busybox-based systems, to perform denial of service and credential leaks, and how they are controlled by command-and-control servers.

Block botnet connections with the intrusion prevention default profile, review the botnet site list, and apply a block action in policy; verify by testing a botnet IP and checking logs.

Configure a denial of service policy on the Fortigate firewall by setting the incoming interface, source/destination addresses, and service; monitor anomalies with thresholds, log, alert, and act on DoS events.

Create a custom Fortigate UTM signature to block ICMP ping to the router by defining the ICMP protocol and destination address, apply it to the policy, and verify the block.

Create IPA signatures to block CNN, using pattern text CNN, set context head, use the HDP service with the GSP protocol, enable SSL deep inspection, and verify blockage.

Understand Fortigate logs across policies and security profiles, filter by source IP, destination IP, or policy, and save or download logs locally or to cloud or an analyzer.