Security Profiles (AV, Web Filtering etc.)

Authentication

  • You must add a valid user group to activate the Authentication check box on the firewall policy configuration page.
  • Users can authenticate with the firewall using HTTP or FTP. For users to be able to authenticate, you must add an HTTP or FTP policy that is configured for authentication.

 

Antivirus

  • Enable antivirus scanning at the network edge for all services.
  • Use FortiClient endpoint antivirus scanning for protection against threats that get into your network.
  • Subscribe to FortiGuard AntiVirus Updates and configure your FortiGate unit to receive push updates. This will ensure you receive antivirus signature updates as soon as they are available.
  • To ensure that all AV push updates occur, ensure you have an AV profile enabled in a security policy.
  • Enable only the protocols you need to scan. If you have antivirus scans occurring on the SMTP server, or use FortiMail, it is redundant to have scanning occur on the FortiGate unit as well.
  • Reduce the maximum file size to be scanned. Viruses usually travel in small files of around 1 to 2 megabytes.
  • Do not quarantine files unless you regularly monitor and review them. This is otherwise a waste of space and impacts performance.
  • Examine antivirus reports and log messages periodically. Take particular notice of repeated detections. For example, repeated virus detection in SMTP traffic could indicate a system on your network is infected and is attempting to contact other systems to spread the infection using a mass mailer.

 

Antispam

  • If possible use, a FortiMail unit. The antispam engines are more robust.
  • Use fast DNS servers.
  • Use specific security profiles for the rule that will use antispam.
  • DNS checks may cause false positive with HELO DNS lookup.
  • Content analysis (banned words) may impose performance overhead.

 

Intrusion Prevention System (IPS)

Your FortiGate’s IPS system can detect traffic attempting to exploit this vulnerability. IPS may also detect when infected systems communicate with servers to receive instructions. Refer to the following list of best practices regarding IPS.

  • Enable IPS scanning at the network edge for all services.
  • Use FortiClient endpoint IPS scanning for protection against threats that get into your network.
  • Subscribe to FortiGuard IPS Updates and configure your FortiGate unit to receive push updates. This will ensure you receive IPS signature updates as soon as they are available.
  • Because it is critical to guard against attacks on services that you make available to the public, configure IPS signatures to block matching signatures. For example, if you have a web server, configure the action of web server signatures to Block.
  • Create and use security profiles with specific signatures and anomalies you need per-interface and per-rule.
  • Do not use predefined or generic profiles. While these profiles are convenient to supply immediate protection, you should create profiles to suit your network environment.
  • If you do use the default profiles, reduce the IPS signatures/anomalies enabled in the profile to conserve processing time and memory.
  • If you are going to enable anomalies, make sure you tune thresholds according to your environment.
  • If you need protection, but not audit information, disable the logging option.
  • Tune the IP-protocol parameter accordingly.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To Buy Your Fortinet Hardware From The Fortinet GURU

2 thoughts on “Security Profiles (AV, Web Filtering etc.)

  1. Could you help me with the following?
    About the security profiles, if on a firewall policy one or all of the profiles are disabled, does this mean that the Fortigate will drop the packet?
    I know that whatever is not explicity allowed is automatically categorised as deny, but I wasn’t sure if this also meant the same for disabled security profiles.

    • You mean if you have security profiles created but not applied to a policy? If that is the case, as long as they aren’t applied to a policy the policy will operate in standard firewall format.

Leave a Reply

Name *
Email *
Website

This site uses Akismet to reduce spam. Learn how your comment data is processed.