Fortinet FortiGate FortiGate-500A Administration Manual Download

Page: 225 / 394

Firewall

Protection profile

FortiGate-500A Administration Guide

01-28006-0100-20041105

225

IP Pools for firewall policies that use fixed ports

Some network configurations do not operate correctly if a NAT policy translates the
source port of packets used by the connection. NAT translates source ports to keep
track of connections for a particular service. You can select fixed port for NAT policies
to prevent source port translation. However, selecting fixed port means that only one
connection can be supported through the firewall for this service. To be able to
support multiple connections, you can add an IP pool to the destination interface, and
then select dynamic IP pool in the policy. The firewall randomly selects an IP address
from the IP pool and assigns it to each connection. In this case the number of
connections that the firewall can support is limited by the number of IP addresses in
the IP pool.

IP pools and dynamic NAT

You can use IP pools for dynamic NAT. For example, your organization might have
purchased a range of Internet addresses but you might have only one Internet
connection on the external interface of your FortiGate unit.

You can assign one of your organization’s Internet IP addresses to the external
interface of the FortiGate unit. If the FortiGate unit is operating in NAT/Route mode, all
connections from your network to the Internet appear to come from this IP address.

If you want connections to originate from all your Internet IP addresses, you can add
this address range to an IP pool for the external interface. Then you can select
Dynamic IP Pool for all policies with the external interface as the destination. For each
connection, the firewall dynamically selects an IP address from the IP pool to be the
source address for the connection. As a result, connections to the Internet appear to
be originating from any of the IP addresses in the IP pool.

Protection profile

Use protection profiles to apply different protection settings for traffic that is controlled
by firewall policies. You can use protection profiles to:

• Configure antivirus protection for HTTP, FTP, IMAP, POP3, and SMTP policies
• Configure web filtering for HTTP policies
• Configure web category filtering for HTTP policies
• Configure spam filtering for IMAP, POP3, and SMTP policies
• Enable IPS for all services

Using protection profiles, you can customize types and levels of protection for different
firewall policies.

For example, while traffic between internal and external addresses might need strict
protection, traffic between trusted internal addresses might need moderate protection.
You can configure policies for different traffic services to use the same or different
protection profiles.

Fortinet FortiGate FortiGate-500A, Administration Manual

Search results

Summary of Contents for FortiGate FortiGate-500A

Reviews:

Related manuals for FortiGate FortiGate-500A

Brands by name

Popular brands