Policies

The FortiProxy's primary role is to secure your network and data from external threats. It accomplishes this using policies and security profiles. Policies control what kind of traffic is allowed where, and security profiles define what to look for in the traffic.

FortiProxy allows proxy address to match applications and URL categories directly in the policies without the need to define security profiles.

Use security policies to secure the different types of traffic that the FortiProxy processes:

• Security policies control the flow of traffic and the security features that are applied to the traffic flow. They are the most commonly used policy type.

• Each policy should have a unique name and there should not be any unused policies.

• Policies that allow traffic should apply to a specific interface, and not the any interface.

• Only the security profiles that are necessary for the traffic matching policy should be enabled.

• Security policies are evaluated in order. When traffic matches a policy, further policies are not processed. Put the most specific policies at the top of the list, and follow the least privilege access principle.

• Interface aliases

  • It might not be possible to use the same interface on each FortiProxy for the same function. Add aliases to the interfaces so that policies are easier to understand. For example, a policy that controls traffic between you network and your phones switch is clearer if it shows LAN to Phones, instead of port4 to port2.

• Zones

  • Zones are used to group multiple interfaces or subinterfaces into a single interface object that can be used in policies.

  • Grouping interfaces and VLAN subinterfaces into zones simplifies security policy creation by allowing multiple network segments to use the same policy settings and protection profiles.

  • Interfaces in a zone can also still be used individually and still route normally.

• Policies

  • Put the most specific, or narrow, policies at the top of the policy list.

  • Do not use the all or any objects in a policy, except when routing to the internet.

  • Do not override the implicit deny policy.

  • Use users in policies. This makes the policy more specific and reduces the chances of unintended traffic matching.