Page 118
Fine-tuning & best practices
This topic is a collection of fine-tuning and best practice tips and guidelines to help you
configure your FortiRecorder appliances for the most secure and reliable operation.
While many features are optional or flexible such that they can be used in many ways, some
practices are generally a good idea because they reduce complication, risk, or potential issues.
Hardening security
FortiRecorder NVRs are designed to manage IP cameras and store video. While FortiRecorder
does have some security features, its primary focus is surveillance. It always should be
protected by a network firewall, and physically kept in a restricted access area.
Should you wish to protect the appliance from accidental or malicious misuse from people
within your private network, this section lists tips to further enhance security.
Topology
• To protect your surveillance system from hackers and unauthorized network access, install
the FortiRecorder appliance and cameras behind a network firewall such as a FortiGate.
yec hNatecIacfhofne frfihcagrvvl
FortiRecorder appliances are designed specifically to
manage cameras and store video.
• If remote cameras or people will be accessing the appliance via the Internet, through a
virtual IP or port forward on your router or FortiGate, configure your router or firewall to
restrict access, allowing only their IP addresses. Require firewall authentication for
connections from network administrators and security guards.
• Make sure traffic cannot bypass the FortiRecorder appliance in a complex network
environment, accessing the cameras directly.
• If remote access while travelling or at home is not necessary, do not configure
system timeout, ports, and public access”
, and do not configure your Internet firewall to
forward traffic to FortiRecorder. If you do require remote access, be sure to apply strict
firewall policies to the connection, and harden all accounts and administrative access (see
and
) as well as keeping the FortiRecorder
software up-to-date (see
• Disable all network interfaces that should not receive any traffic.
This section includes
only
recommendations that apply to a combination of multiple features, to
the entire appliance, or to your overall network environment.
For feature-specific recommendations, see the tips in each feature’s instructions.
