Fortinet FortiGate 400, Installation & Configuration Manual, Page: 171 / 308

Firewall configuration Default firewall configuration
FortiGate-400 Installation and Configuration Guide
171
Zones
You can add zones to the FortiGate configuration to group together related interfaces
and VLAN subinterfaces to simplify firewall policy creation. For more information
about zones, see
“Configuring zones” on page 133 .
To add policies for zones, you must use the following steps to add the zones to the
firewall policy grid:
1 Add zones to the FortiGate configuration.
See
“Adding zones” on page 133 .
2 Add interfaces and VLAN subinterfaces to the zone.
See
“Adding interfaces to a zone” on page 134 and “Adding VLAN subinterfaces to a
zone” on page 134 .
3 Add firewall addresses for the zone.
See
“Adding addresses” on page 179 .
Addresses
To add policies between interfaces, VLAN subinterfaces and zones, the firewall
configuration must contain addresses for each interface, VLAN subinterface, or zone.
By default the firewall configuration includes the addresses listed in
Table 5 .
The firewall uses these addresses to match the source and destination addresses of
packets received by the firewall. The default policy matches all connections from the
network connected to port1 because it includes the Port1_All address. The default
policy also matches all connections to the network connected to port2 because it
includes the Port2_All address.
You can add more addresses to each interface to improve the control you have over
connections through the firewall. For more information about addresses, see
“Addresses” on page 179 .
You can also add firewall policies that perform network address translation (NAT). To
use NAT to translate destination addresses, you must add virtual IPs. Virtual IPs map
addresses on one network to a translated address on another network. For more
information about Virtual IPs, see
“Virtual IPs” on page 188 .
Table 5: Default addresses
Interface Address Description
Port1 Port1_All This address matches all addresses on the network connected to
port1.
Port2 Port2_All This address matches all addresses on the network connected to
port2