FortiGate installation; The address and routing plan of the network, access policies, necessary security features and commissioning tests are prepared and carried out together. Just because the device is online does not indicate that all of the security needs of the institution have been met.
What information should be collected prior to installation?
Start with the device model and FortiOS version used. Internet lines, VLANs, critical servers, published applications and existing VPNs should be recorded. The model and license scope of the features to be used must be verified in the relevant version.
When migrating from the old firewall, review the business justification instead of copying all the rules as they are. A permission whose owner or purpose is unknown continues the uncertainty on the new device.
How to describe security policy?
The source, target, service, interface, and permission needs for a rule must be described. The Fortinet documentation demonstrates these elements used in matching traffic to policy. The definition of “anywhere permission” is not a substitute for understanding the need of a particular application.
Technical reference: Fortinet — FortiOS 7.6.3 firewall policies.
What backups are prepared before changes?
Configuration backup, version information and rollback method should be kept ready. Whether the certificate and other components are included in the backup is also checked from the document of the version used. Fortinet recommends preserving the configuration before changes and updates.
Technical reference: Fortinet — Configuration backups.
Possibility of restoring by taking a backup is not the same. Record where the file is stored, who has access to it, and who returns it.
What functions are verified during go-live?
- Access of staff and guest networks to permitted targets.
- Outsourced services and their access from expected sources.
- VPN, second internet line and required authentication flows.
- Behavior of critical applications with security profiles.
- Creating incident records and reaching the responsible team.
Record each finding with its on-off status; Implement fallback condition on failed test. By device model and network plan FortiGate management service You can evaluate its scope.
Related resources
Official sources
Technical documentation and legislation may change; The relevant version and current text should be checked before application.
Frequently Asked Questions
Can the sample rules on the Internet be used directly?
Instances depend on version and topology. It should not be applied to the live system without verifying addresses, interfaces and access purpose.
Does getting FortiGate solve all security risks?
No. Account security, endpoints, backup, and incident response should also be addressed together.