Introduction To Fortigate Firewall

Fortinet security platforms offer complete protection for a wide range of security functions - Stateful Firewall, IPSec VPN, Antivirus, IDS & IPS, Web Content Filtering, Anti-Spam, and Bandwidth Shaping. Functionality is consistent across all FortiGate units ranging from the economical SoHo products to the carrier class service provider and large enterprise systems.

FortiGate Architecture

ASIC Based Purpose-Built Architecture
ASIC Accelerated FW, VPN, AV, IPS
Dedicated Hardened Operating System
Fortinet Software Ownership - no OEM or 3rd Party integrated products

The FortiOS operating system serves as the foundation for the FortiGate® network security platform, and includes the widest range of security technologies of any network security solution:

Firewall, VPN, and Traffic Shaping
Intrusion Prevention System (IPS)
Antimalware/Antivirus/Antispyware
Integrated Wireless Controller
Application Control
Data Loss Prevention (DLP)
Advanced Threat Protection
Contextual Visibility Management
Feature Select with Presets
Vulnerability Management
IPv6 Support
Web Filtering
Antispam
VoIP Support
Layer 2/3 Routing
WAN Optimization & Web Caching

A FortiGate unit screens network traffic from the IP layer up through the application layer of the TCP/IP stack. This chapter provides a general, high-level description of what happens to a packet as it travels through a FortiGate security system.

The FortiGate unit performs three types of security inspection:

• stateful inspection, that provides individual packet-based security within a basic

session state

• flow-based inspection, that buffers packets and uses pattern matching to identify

security threats

• proxy-based inspection, that reconstructs content passing through the FortiGate unit

and inspects the content for security threats.

Each inspection component plays a role in the processing of a packet as it traverses the

FortiGate unit en route to its destination.

Stateful inspection

With stateful inspection, the FortiGate unit looks at the first packet of a session to make a security decision. Common fields inspected include TCP SYN and FIN flags to identity the start and end of a session, the source/destination IP, source/destination port and protocol. Other checks are also performed on the packed payload and sequence numbers to verify it as a valid communication and that the data is not corrupted or poorly formed.

The FortiGate unit makes the decision to drop, pass or log a session based on what is

found in the first packet of the session. If the FortiGate unit decides to drop or block the first packet of a session, then all subsequent packets in the same session are also

dropped or blocked without being inspected. If the FortiGate unit accepts the first packet of a session, then all subsequent packets in the same session are also accepted without being inspected.

Flow inspection

With flow inspection, the FortiGate unit samples multiple packets in a session and multiple sessions, and uses a pattern matching engine to determine the kind of activity that the session is performing and to identify possible attacks or viruses. For example, if application control is operating, flow inspection can sample network traffic and identify the application that is generating the activity. Flow-based antivirus can sample network traffic and determine if the content of the traffic contains a virus, IPS can sample network traffic and determine if the traffic constitutes an attack. The security inspection occurs as the data is passing from its source to its destination. Flow inspection identifies and blocks security threats in real time as they are identified.

Flow-based inspections typically require less processing than proxy-based inspection, and therefore flow-based antivirus performance can be better than proxy-based antivirus performance. However, some threats can only be detected when a complete copy of the payload is obtained so, proxy-based inspection tends to be more accurate and complete than flow-based inspection.

Proxy inspection

With flow inspection, the FortiGate unit will pass all the packets between the source and destination, and keeps a copy of the packets in its memory. It then uses a reconstruction engine to build the content of the original traffic. The security inspection occurs after the data has passed from its source to its destination.

Proxy inspection examines the content contained a content protocol session for security threats. Content protocols include the HTTP, FTP, and email protocols. Security threats can be found in files and other content downloaded using these protocols. With proxy inspection, the FortiGate unit downloads the entire payload of a content protocol sessions and re-constructs it. For example, proxy inspection can reconstruct an email message and its attachments. After a satisfactory inspection the FortiGate unit passes the content on to the client. If proxy inspection detects a security threat in the content, the content is removed from the communication stream before the it reaches its destination.

For example, if proxy inspection detects a virus in an email attachment, the attachment is removed from the email message before its sent to the client. Proxy inspection is the most thorough inspection of all, although it requires more processing power, and this may result in lower performance.

If you enable ICAP in a security policy, HTTP traffic intercepted by the policy is transferred to the ICAP servers in the ICAP profile added to the policy. The FortiGate unit is the surrogate, or “middle-man”, and carries the ICAP responses from the ICAP server to the ICAP client; the ICAP client then responds back, and the FortiGate unit determines the action that should be taken with these ICAP responses and requests.