FortiGate Administration Guide - FirewallShop.com

Configuring firewall policies
Firewall Policy
Figure 167:Creating an intra-VLAN firewall policy
Intra-VLAN Policy
Source/Destination
Interface/Zone
Source and Destination
Port
You must enable this to create a policy between switch
ports. The dialog box changes to show the fields
described below.
Select native or a switch VLAN. For information about
creating switch VLANs see “Configuring a switch VLAN”
on page 212.
Select Any or a specific switch port. If you select a nonsecure
port as source, you must select a secure port as
destination.
Address
Select All or specify an IP address range.
Set other firewall options as needed. See “Firewall policy options” on page 272.
Adding authentication to firewall policies
Add users and a firewall protection profile to a user group before selecting
Authentication. For information about adding and configuring user groups, see
“User groups” on page 386. Authentication is available if Action is set to Accept or
SSL VPN.
When you enable user authentication on a firewall policy, the end users using the
firewall policy will be challenged to authenticate before they can use the policy.
In case of user ID and password authentication, the end users will be prompted to
input their user name and password.
In case of certificate authentication (HTTPS or HTTP redirected to HTTPS only),
you can install customized certificates on the FortiGate unit and the end users can
also have customized certificates installed on their browsers. Otherwise, the end
users will see a warning message and have to accept the default FortiGate
certificate, which the end users’ web browsers may deem as invalid. For
information about how to use certificates, see “VPN Certificates” on page 369.
FortiGate Version 3.0 MR5 Administration Guide
276 01-30005-0203-20070830