Aralin 1Mga prinsipyo sa policy design: least privilege, deny-by-default, explicit allow rulesPag-aralan ang core firewall design principles tulad ng least privilege, deny-by-default, at explicit allow rules. Matututunan kung paano i-structure ang policies para sa clarity, mabawasan ang shadowed rules, at i-document ang business justifications para sa bawat access requirement.
Implementing deny-by-default at the edgeDesigning least-privilege access rulesAvoiding overlapping and shadowed policiesUsing address and service groups wiselyDocumenting and reviewing business rulesAralin 2HQ LAN to Internet policy: sources, destinations, services, NAT settings, loggingMatututunan kung paano bumuo ng secure HQ LAN to Internet policy, kabilang ang address at service objects, NAT configuration, logging options, at policy ordering. Unawain kung paano iwasan ang overly permissive rules habang pinapanatili ang functional user access.
Defining HQ LAN and Internet address objectsSelecting appropriate service objects and groupsConfiguring central or policy-based NATEnabling and tuning traffic logging optionsPlacing the policy correctly in rule orderAralin 3Site-to-site traffic policies: selectors, policy order, at non-NAT para sa tunneled networksMatututunan kung paano lumikha ng policies para sa site-to-site VPN traffic, kabilang ang address selectors, policy order, at non-NAT rules. Unawain kung paano i-separate ang tunneled mula sa direct Internet traffic at iwasan ang asymmetric routing o unintended exposure.
Defining local and remote VPN selectorsCreating non-NAT policies for tunnelsOrdering VPN policies vs Internet rulesSeparating management and user trafficTroubleshooting common VPN policy issuesAralin 4Security profiles: application control—pag-block ng risky apps, bandwidth shaping, at categorizationI-configure ang application control profiles upang makilala at mapamahalaan ang applications anuman ang port. Matututunan kung paano i-block ang risky apps, i-shape ang bandwidth, at i-tune ang categories habang minamonitor ang logs upang i-refine ang policies nang hindi dinidistract ang business traffic.
Selecting base application control profilesBlocking high-risk and unwanted appsApplying per-application bandwidth limitsUsing categories and overrides wiselyReviewing logs to refine app policiesAralin 5BR LAN to Internet policy: sources, destinations, services, NAT settings, loggingI-configure ang secure branch LAN to Internet policy na aligned sa HQ standards. Matututunan kung paano i-reuse ang objects, maglagay ng NAT, at i-enable ang logging habang isinasaalang-alang ang local breakout, limited bandwidth, at iba't ibang compliance o content needs.
Reusing global vs local address objectsDefining branch-specific service policiesConfiguring NAT and IP pools for branchesAligning logging with central reportingHandling local Internet breakout trafficAralin 6Logging at session handling sa loob ng policies: enabling logging, syslog fields, at disk usage implicationsUnawain kung paano i-enable at i-tune ang logging sa policies, kabilang ang log types, severity, at destinations. Matututunan ang key session fields, kung paano naapektuhan ng logs ang disk usage, at strategies para sa log retention, offloading, at compliance reporting.
Choosing log types and severity levelsSelecting local disk vs remote loggingUnderstanding key session log fieldsManaging disk usage and log rotationUsing logs for audits and forensicsAralin 7HQ LAN to HQ DMZ policy: controlled access sa web/mail servers, limited ports, intra-zone inspectionMagdisenyo ng HQ LAN to DMZ policies na mahigpit na kumokontrol sa access sa internal servers. Matututunan kung paano i-restrict ang ports, maglagay ng security profiles, at i-inspect ang intra-zone traffic habang pinapanatili ang server availability at sinusuportahan ang monitoring o backup flows.
Defining DMZ server address objectsRestricting access to required ports onlyApplying security profiles to DMZ trafficAllowing monitoring and backup securelyTesting and validating DMZ access rulesAralin 8Security profiles: web filtering configuration, categories, safe-search, at SSL inspection considerationsI-configure ang web filtering profiles na may category-based controls, safe-search enforcement, at SSL inspection choices. Matututunan kung paano balansehin ang user productivity, privacy, at security habang binabawasan ang certificate warnings at inspection failures.
Building category-based web filter profilesEnforcing safe-search and YouTube controlsConfiguring SSL inspection for web trafficHandling certificate warnings and bypassesReporting and tuning blocked web activityAralin 9Security profiles: IPS policy tuning, signatures, at performance vs. protection tradeoffsGalugarin ang IPS profile design para sa iba't ibang traffic types, i-tune ang signatures upang mabawasan ang noise, at unawain kung paano naapektuhan ng inspection modes at hardware resources ang throughput. Matututunan kung paano balansehin ang detection depth sa acceptable latency at CPU usage.
Choosing IPS default and custom profilesTuning signatures and severity thresholdsUsing flow-based vs proxy-based inspectionHandling false positives and exemptionsMeasuring IPS impact on performanceAralin 10Security profiles: antivirus deployment at recommended scanning optionsUnawain ang FortiGate antivirus profiles, kabilang ang real-time scanning, file type coverage, at heuristic options. Matututunan ang recommended settings para sa web, email, at file services, plus kung paano hawakan ang large files, archives, at performance-sensitive traffic.
Selecting AV profiles for different policiesConfiguring full, quick, and flow-based scanHandling archives, large files, and timeoutsDealing with encrypted and compressed trafficLogging and alerting for malware eventsAralin 11Inter-VDOM o inter-zone policies kung gumagamit ng VDOMs: policy separation at management accessGalugarin ang inter-VDOM at inter-zone policies na ginagamit kapag VDOMs ang nagse-segment ng environments. Matututunan kung paano i-separate ang management at user traffic, kontrolin ang administrative access, at panatilihin ang clear policy boundaries sa pagitan ng security domains.
Planning VDOM roles and trust levelsCreating inter-VDOM link interfacesBuilding policies between VDOMs safelyRestricting management plane accessLogging and auditing cross-VDOM traffic
