Fortinet black logo

Cookbook

Firewall configuration

Firewall configuration

Centralized access is controlled from the hub FortiGate using Firewall policies. In addition to layer three and four inspection, security policies can be used in the policies for layer seven traffic inspection.

It is best practice to only allow the networks and services that are required for communication through the firewall. The following rules are the minimum that must be configured to allow SD-WAN to function:

Source Interface

Destination Interface

Source Address

Destination Address

Action

Schedule

Service

Comments

<internal interface>

<virtual wan link>

<branch networks>

<datacenter networks>

Accept

Always

<allowed services>

Allow traffic from branch to datacenter

<virtual wan link>

<internal Interface>

<datacenter networks>

<branch networks>

Accept

Always

<allowed services>

Allow traffic from datacenter to branch

For this example, a simple policy that allows all traffic is configured.

To configure a firewall policy:
config firewall policy
    edit 1
        set name "Allow All"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

Firewall configuration

Firewall configuration

Centralized access is controlled from the hub FortiGate using Firewall policies. In addition to layer three and four inspection, security policies can be used in the policies for layer seven traffic inspection.

It is best practice to only allow the networks and services that are required for communication through the firewall. The following rules are the minimum that must be configured to allow SD-WAN to function:

Source Interface

Destination Interface

Source Address

Destination Address

Action

Schedule

Service

Comments

<internal interface>

<virtual wan link>

<branch networks>

<datacenter networks>

Accept

Always

<allowed services>

Allow traffic from branch to datacenter

<virtual wan link>

<internal Interface>

<datacenter networks>

<branch networks>

Accept

Always

<allowed services>

Allow traffic from datacenter to branch

For this example, a simple policy that allows all traffic is configured.

To configure a firewall policy:
config firewall policy
    edit 1
        set name "Allow All"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end