Task 3

Task 3: Create a policy set and apply it to a FortiGate CNF Instance

• 1. At this point, we are using the default allow_all policy set which allows all communication to be allowed without any restriction from a Layer 4 and Layer 7 perspective.

• 2. To customize the actual L4 rules and L7 security profile groups applied, in the FortiGate CNF Console navigate to Configuration > Policy Sets to create your own policy set. Simply click Create New, select Policy Set, and give your policy set a name.

• 3. Before adding in L4 rules within the policy set, create a few simple address objects. Navigate to Configuration > Addresses, click New, and Address. Then create each of the address objects below.

• 4. Next, create an Address Group to include all the RFC 1918 class objects. On the same page, click New, and Address Group. Then create each the address object below.

• 5. In FortiGate CNF you can create different types of address objects to be more flexible and granular in your rules within your policy set. Create an FQDN based address object by clicking New, and Address. Select FQDN for Type, then create the address object below.

• 6. Geography based address objects are available in FortiGate CNF. This allows controlling traffic based on public IPs assigned to countries around the globe. These objects can be used as a source or destination object within policies used in a policy set. Create a geo based address object by clicking New, and Address. Select Geography for Type, then create the address objects below.

• 7. Dynamic metadata based address objects are available in FortiGate CNF. This allows controlling of traffic based on things such as VPC ID, Auto Scale Group, EKS Cluster or Pod, and even Tag Name + Value pairs for a given AWS account and region. Create a dynamic based address object by clicking New, and Address. Select Dynamic for Type, then create the address objects below.

Note: For each object, you will use the same values for these settings:

Here is the list of dynamic objects to create:

• 8. Now you will create a policy set to enforce L4 rules using the address objects you just created in the previous steps. Navigate to Configuration > Policy Sets and click New, Policy Set. Give it a name and click Ok. You will be returned to the list of policy sets. Select your policy set and click Edit.

• 9. Now you can create the policies listed below to control all directions of traffic within the example environment. Click New and create the policies listed below:

• 10. In order to use this policy set, it must be applied to the deployed FortiGate CNF Instance. Navigate to CNF instances and select and edit the CNF Instance then click the Configure Policy Set bread crumb. In the Apply Policy Set, select your policy set then click Save then Exit.

• 11. This concludes this section.