Fortinet NSE 4 7.0 Lesson 3: Firewall Policies
What do firewall policies define?
Which traffic matches them. How to process matching traffic.
Can you select more than one interface for the Incoming Interface?
You can select multiple interfaces by default. This is a feature that can be enabled. The "Any" Interface is available by default.
If Internet Service is selected as the Destination
You cannot use Address in the Destination You cannot select Service in the firewall policy
If Internet Service is selected as Source:
You cannot use Address in the Source
What is Application control shaping?
bandwidth management by application
What is shared policy shaping?
bandwidth management of security policies
What is per-ip shaping?
bandwidth management of user IP addresses
Firewall Policies limit access to
configured networks
Policy Names are mandatory by default. How can you relax this requirement?
enable "Allow Unnamed Policies" in Feature Visibility
How can you reduce the number of log messages generated and improve performance when traffic violates are detected by a security profile?
enable a session table of dropped traffics by using the ses-denied-traffic via CLI.
The scope of a shaper can be per policy or
for all policies referencing that shaper
What two types of traffic shapers can be generated?
shared and per IP
What kind of traffic shaping polices does FortiGate allow you to create?
shared policy shaping per-ip shaping Application control shaping
When creating traffic shaping policies, you must ensure that the matching criteria is the same as
the firewall policies you want to apply shaping to.
A shared shaper applies a total bandwidth to all traffic
using that shaper
What is the purpose of applying security profiles to a firewall policy? A. To allow access to specific subnets. B. To protect your network from threats, and control access to specific URLs.
.B. To protect your network from threats, and control access to specific URLs.
To configure a firewall policy, you must include a firewall policy name when configuring using the A. CLI B. GUI
B. GUI
How do Security profiles protect your network?
Blocking threats Controlling access to certain applications and URLs Preventing specific data from leaving your network
What do security profiles inspect?
Each packet in the traffic flow where the session has already been conditionally accepted by the firewall policy.
How can you manually define a policy ID?
Enable "Policy Advanced Options" which must be enabled in the Feature visibility page.
What are the types of firewall policies?
Firewall Policy (IPv4, IPv6) Firewall Virtual wire pair (IPv4, IPv6) Proxy Multicast Local-in Policy (Origin and destination is in FortiGate itself) DoS(IPv4,IPv5) Traffic Shaping
What happens when FortiGate policy action is set to ACCEPT?
FortiGate applies other configured settings for packet processing such as Anti-Virus scanning, web filtering or source NAT.
What happens when FortiGate policy action is set to DENY?
FortiGate drops the session.
In what order are firewall policies matches?
FortiGate looks for matching firewall policy from top to bottom and the first policy with ANY matching criteria is used.
How can you simply administration for services and address objects?
Group LAN interfaces, source addresses, and/or services such as DNS,FTP,HTTP,HTTPS together when the same combinations are typically used together in policies.
What destinations can be matched on in a firewall policy?
IP address or internet services
You MUST specify at least one source address of what type in a firewall policy?
IP address or range Subnet (IP/Netmask) FQDN Geography Dynamic - Fabric connector address MAC Address Range
What sources can be matched on in a firewall policy?
IP address, Subnet, FQDN, Geography, Dynamic (Fabric Connector). user, internet services
For the service firewall object, what match criteria is used?
IP protocol and port number
What are valid firewall policy match criteria?
Incoming Interface Outgoing Interface Source Destination Service Schedule
What are the objects used by policies?
Interface and zone Address, user, and internet service objects Service definitions Schedules NAT rules Security profiles
What are valid options for incoming interface and outgoing interface?
It can be a logical or physical interface or a zone.
Why should you group your interfaces into Zones?
It helps to simplify policy configuration
What happens to the policy ID as a rule is moved higher or lower in the sequence?
It never changes
Are Policy IDs displayed in the GUI by default?
No
Can you reference an interface directly if it is part of a zone?
No
Where can you view policy usage statistics such as last used, first used, hit count, active sessions, etc.?
Real-Time Policy Status is available from policy & objects > Firewall policy > edit view.
You MAY specify what source types in a firewall policy?
Source user - Individual user or group local firewall accounts Accounts on a remote server (Active Directory, LDAP, RADIUS) FSSO Personal certificate (PKI-authenticated) users
How do you set the duration for blocked session to remain in the table?
The CLI command block-session-timer
What is the ref column used for?
The Ref column provides a simple way to find out where in the Fortigate's configuration an object is being referenced.
What is the purpose of the implicit deny statement?
The implicit deny policy is the last policy that is used. If no matches were found prior to reaching this point in the list, the traffic is dropped.
Where does a Policy IDs come from?
The policy ID is assigned by the system when the rule is created.
What must be selected in the Source field of a firewall policy? A. At least one address object of ISDB B. At least one source user and one source address object.
A. At least one address object of ISDB
What does FortiGate use to match traffic to a firewall policy? A. Source and Destination interfaces. B. Security Profiles
A. Source and Destination interfaces.
If you configure a firewall policy with the any interface, you can view the firewall policy list only in which view? A. The By Sequence View. B. The Interface Pair View
A. The By Sequence View.
True or False? In each policy, you MUST set a source and destination interface.
True however, the interface can bet set to "any".
