FortiGate Administration Guide - FirewallShop.com

Firewall policy examples
Firewall Policy
The first firewall policy for main office staff members allows full access to the
Internet at all times. A second policy will allow direct access to the DMZ for staff
members. A second pair of policies are required to allow branch staff members
the same access.
The staff firewall policies will all use a protection profile configured specifically for
staff access. Enabled features include virus scanning, spam filtering, IPS, and
blocking of all P2P traffic. FortiGuard web filtering is also used to block
advertising, malware, and spyware sites.
A few users may need special web and catalog server access to update
information on those servers, depending on how they’re configured. Special
access can be allowed based on IP address or user.
The proposed topography has the main branch staff and the catalog access
terminals going through a Fortigate HA cluster to the servers in a DMZ. The public
access terminals first go through a ForitWiFi unit, where additional policies can be
applied, to the HA Cluster and finally to the servers.
The branch office has all three users routed through a ForitWiFi unit to the main
branch via VPN tunnels.
Figure 175:Proposed library system network topology
Policies are configured in Firewall > Policy. Protection Profiles are configured in
Firewall > Protection Profile.
FortiGate Version 3.0 MR5 Administration Guide
286 01-30005-0203-20070830