Fortinet NSE4_FGT-7.2 — FortiGate Firewall — Section 1: FortiGate Firewall V6.4 1 Part 32

43. Lecture-43: FortiGate Firewall NGFW Modes.

The next generation fight one more.

So, 40 grand firewall is a next generation far one can be deployed in two different more. Is the next generation flood wall more now, is the inspection more? And those two are profiled, based and policy base, the one which we discussed was Flaubert’s and proxy base, that was inspirational. This is the more the next generation how we can deploy them. Not to change the policy and reach more.

So, the two of them, one is profile this and the other one is. All the sea bass.

So, what is profile bass? If you reply, you forget for a while and profile this next generation for one more.

So, you have to attach all the profile here. Security profile has to be articulator. It means you create and here you attach them there they look at time when somebody is coming from land to land and sources indicating destination is anything. Always when you check on this thing, please also check their fight and fight antivirus for filtering, for DNS, for replication control, for IP is for the filter. An e-mail filter. And big beef inspections are to begin and check them inside what they would be a hill and gentlemen and logs for me that I can see.

So, it means I helped to create a policy, then I have to let her attach the profile one by one. Why? Because I’m using profile, miss means profile, a profile has to be our policy. Also, another thing in profile, this nerd is enabling every policy. This is the one policy I created. Okay, let me go to another one. Again, that is an error in this policy, nor does anyone there any come from inside glotzer connecting them. If I can create that policy again, I hope to create and implement again to in every policy you help to find out what to do next. Plus.

So, in foreign policy, you will find it again and again. No, no, no, no, no, no. And every policy you have to a security profile, security profile, security profile, I suppose this is our money going from land to the embassy.

So, I will say, if somebody’s coming or going, coming from land, going to be an easy source from land is anything, I suppose, and voyage to destination DMZ, anything all the time, but also services except inspection. What I did, you told you now we are talking about the next generation farm more.

So, nag them if you don’t want to disable them. And check for any Duross, Jennifer, Jennifer, check for business, but i.p is freedom. I don’t have an e-mail for you. We here are things to read on it. Yeah. And apply on station and to music in a policy I held to order Chinese food for the celebrity here, then here, then here and also in all these three rule marriages only be in every policy. Not a centralized note. But towards the use of this night, if we are not making any Naida statement, I suppose like a little Demsey, maybe in that case you don’t need this disabler. Yeah, we want to discuss this need, but I’m just dealing with disadvantages. Oh, okay, fine. Because otherwise you will disable this and really when we will do their part.

So, this is called profiling based and also the name suggests. In every policy, you have to adapt your endurance, you are well-trained, your IBS, your ability to fight to the policy, and also you have to enable source and urban policy everywhere, just about. And then also, if required, I will say this. And maybe it will give you unexpected reserve.

So, this is going to provide a base, okay, this is that now we know profiling is do you have any alternative to their discarded policy? Best new generation firewall.

So, what is the advantages rather than to attachment, an alien policy we can create central are the source superbly. Rather than to attach a neighboring policy, one time creation in a centralized location, this is the first two advantages. Second thing, I don’t need to attack on the profile again and again. Can when Inside the police directly rather than to attatched them? And you can control a single application through policy as well. And then when we me to create, you know, you’re the boss, therefore you want to control any profit.

So, first I helped to create Revelator, which I created last year. And then I held, what, this year? Then it will start. What do you have anything that I can call directly the implication? Yes. Then you can use policy based more. I can control single implication, I can control multiple application, I will call the application, insert the policy, which I will show you right now. Just give me two minute after. Also, through policy, you can control board hopping or take. Either poor coordination or we can control their donors. And this is also an advantage. A policy based between Condoleezza services implication you are ill, it means you are ill to insert the policy rather than to attach them. Yet we are taking, you know, let’s change them so you will see the difference, how we can change the more next generation for one or more another inspection more than building again.

So, global system concerting. And go down, you will find here system operation at Operation Show, which Next-Generation Firewall more you need to based on policy based.

So, I don’t know if this is a profile of the green one. We selected one, but no, I said no, I need a policy. But before applying the policy, it will delete all the policies. And it will bring to the central narrative will enable central estimate as well. They didn’t really know how it operates, provided most of the time we are using policy base, okay, because three or four guys who are working also in a company, we can ask them later on, which they are using, maybe they will share their experiences and our infrastructure. We are using policy based.

So, but it depends again on the requirement of our organization to a policy based. Now I need to confirm, but, you know, you will lose all the policy so you have you can take your vehicle.

So, if you don’t need either for some reason.

So, what do you think will be do? But before removing, let me show you. You see on the profile out of here. Keep in mind in is here. Insert the policy so it is better to take a snapshot.

So, we need to change so that I can show you the difference.

So, let me move to Ban and. Okay. Why is. On screen and here. For some reason, it’s not working. Let me take a sleeping toll.

So, let me take this one. It’s enough for us to. Now, let’s go to systemin, Jane, the mall showing. And we’ll make a change next generation, foreign policy based and apply now is give you the one than what I said, that we will bring everything to a it will be a nimble and on the policy will be removed.

So, we know you will remove them.

So, anybody converting from one to the other, so keep in mind, all the policy will be removed if we want to, policy and security policy. Again, nothing is there is we expected we got this far one year where everything is deleted. Now you will see the difference.

So, we have the same name Lane, too, and there is no such difference coming land and going to win sources, we’ve done this in the last four years when this situation is on schedule, as I said, which is is, you know, it’s they far to specify. And also implication. It was not here, okay, don’t snap snap of the one duplication is now here in the borders and you are encouraging results. We are not equally rather than as a provider.

So, from here, they remove something. And the House is referring to the is not the application and control was before it was shipped here. It’s been a year now about this year filtering e-mail. But this one. His you know, you are alkadiri, they give them you are entitled to, you know, an application is being changed from here to here now. And also services is got to be radically more control.

So, this is gonna wanna see this more next generation reaching the mold of 40 year to warrant. Is a policy more? Now, let me also also yes, the other thing that it is named is the. Before it was, you know, Natasia, knowing the policy and said this is the same policy I’m creating, but I cannot see the narrative now, which was before like this one. Because Central is enable here. Now look at it before it was not, you know, I mean, create an area separately rather than to colonial policy. One change and yes, another thing I left. It’s an inspiration inspection, it was fun. Now it’s not more immediate, it’s, you know. It’s a silly inspection and dedication is being separated, these two Baban been able to now before it was not the. Application control was used to be Aatish now is currently here. Inserting the policy. One thing that was used to be our age differently now is the. And we have a control of sundresses that will give you one layer above said, which is what does that means by far? Didn’t specify. And I was raised as an inspiration, as you know, and made what was needed was continuity. Policy now is being separated and Jamie is the central ethnic. These are the difference between. Next-Generation Firewall, more profile based and policy more. Now, I will say I need to allow Facebook. Suppose, I have Facebook here. Suppose, I choose Facebook application only, so this policy will only allow Facebook either. You can deny it’s up to you. You are rejecting can tell you are in a category like gaming, dating either. We not only know social media.

So, let me go to social media or something in. I then Web hosting social media to Satyajit.

Social networking, so you can choose their is inside the borders, you know, rather than to advise them, yes, we have something today, but we have control here now and okay.

So, now the policy is being different, the mood has been different, how we know now I need to create a symbol and I will give you one them, but I’m just showing you to now, rather than to insert a man to create, then we have to create symbology next year.

So, this fiscal policy is more. And policy based more. Okay, should I deny that either we need to start the nearby SLIDIN? So, they’re doing more and how we can we can train again if you are an the system sitting so all you want for some reason, but you do all you have to take because otherwise you will lose everything. You can click on this one profile and central and will be disabled or domestically when you click central and is enable the new high profile this to really say one. Okay. And when you click so I don’t want to do because I want to give you one lemon policy best either two or three lib. That’s a theoretical part of the next generation fight one more.

44. Lecture-44: Policy-Based Mode to Block Facebook App.

Let’s do a policy based model and blog or Facebook or any other Web site is up to. But using policy is more. Can we do such a thing that we want to blog? Facebook only? So, in policy with sort suits them, our target is to block Facebook so that nobody from inside Google Facebook. How we can do it.

So, let’s go to policy, energy security policy. Let me tell this one.

So, we will deny you can deny everything and deny you cannot be that we can. Do most of the changes to first list created a policy to deny Facebook? Denied Facebook. Okay. Incoming interface traffic will go down four more lane than we are in the to win source from inside. It can be any IP and they want to bring in the Facebook as well. Anyway, I will say the station is on alert and they will go and application. He had to retire Facebook and such.

So, choose a Facebook multiple, you can choose Facebook, any application. I want to be nine. I think that’s the only thing we who you can this is from Wessinger, this one is the more these under the chat room, the other thing you can in on Facebook and deny the videos and also the workplace and so many things you can do. But anyway, just to feel I want to deny them, you know, this is. Policy is more if it is the Automator denial, to create a profile first, then I to come here in this year. Now I’m cutting vertically this disability policy more so than when and rather than action to accept. I want to deny. And love relations, love relations, perfect. If somebody violated this rule, generate a lawsuit that we can see logs, I mean, these just logs enable this policy and no new documents if you want to come in and okay.

So, my role is really we will deny any Facebook related application and this application. And the action is denied. But what about the other traffic, so let’s create a new policy and allow. Everything perfect will come from land, they they the rain, it can be anything, destination can be anything, it will always implication will be anything.

So, let’s just leave it and you all will be anything a nation will accept. And we don’t want to do any more fine. We will look for the up option later so far to both this one and long as we want to generate opposition as we can see. And we want to enable this coalition, okay.

So, we could to do policy. Now the question is, Denyer has to be on there because, as I told you, in policy is changing from top to bottom.

So, first it will change anybody going anywhere. If the application of Facebook will be nice, if it is not Facebook, it will jump to the front and it will accept.

So, beside Facebook, everything will be accessible on policies. I really don’t think it’s enough. No. Because we need to create a center left before it was used to be called inside. Now I need something.

So, I will come here so far getable. And we will do indeed anything.

So, I will create a central name and I will say, if any, coming from Lenn and they are going to win and sources anything. This information is anything. Nattered them. Use the old search interface. What is our interface. I need to do networking. Is it interface. Just use there. We will do it in detail. Like what is any will discovery will be and use dynamic. But right now I say use the old site interface and nutritive them. What we will do again and in more detail comments and enable so minded policies created no need to create again and again and every policy. One of them is NFR. If any of you coming from Lenine going to win. Let me go to businesses just for the necessary reconfigure them before what is has to be before it’s okay and getting the state to steady out.

So, we do also. And let me show you my interface, the natural interface. I don’t them anything coming from 100 to 160 and wondered how translated them to one one four. One, two, three, three.

So, we created net. Now let’s test them.

So, from inside, I hear a SPE.

So, this is the inside of a system, if you’re going to be, which is 100, 160 or 202 and one hundred is my inside this one. One hundred is my answer to this, become like a gateway for me. We can test them so open in your browser and list a browser, Facebook first and then any other Web site.

So, if we want to fizbo and then we’re let’s go to London.

So, then when It will follow the second rule and it will open.

So, LinkedIn is open. If I go to Instagram.

So, it has to be open and if I go to Twitter. It will one sort of crater is working, Langdon is working, and still Grant will work. But if I click on a Facebook site, it’s not working. It has to show me the man, but unfortunately, it will not reach you. But anyway, we can really find don’t worry.

So, I say this can not. It’s okay. But LinkedIn has written well, this one Instagram individual and Twitter isn’t easy. But how are you. Get ready for.

So, go to log’s and report. I go to be black implication instead of the policy implication control.

So, look, I it say that these two has been what is the Facebook? So, this past quarter is past this, the Facebook today is twenty nine Eastern Time, this one one minute before the blog, Facebook. And we can’t be. Okay, so it will social media, Facebook, and we have a policy. Insert so they blow them. Because we call them inside their policy, so everything is possible. Facebook is blocked, Twitter as as this one. And also, we can see from falling traffic as well. Award winning graphic langbein, okay, and should be Facebook somewhere. Okay.

So, he is not coming up here. By the way, to the show you are denying here and forwarding traffic as well. For some reason, it still maybe some take some time either, but you can verify, yes, come up now just to refresh.

So, it’s a phrase baldie, a policy violation if you want to change in policy violation. Okay, so you can see more detail here. Mr. Maldita.

So, this may be nice from Florida traffic and also from there as so many other option to really fight. And if you say that it is blood related policy, you will get really far from here if you are not sure.

So, let’s go to the board and there is a bonus here. Rich bonus, you deny them.

So, we are a to policy allow everything. Okay, and the other one is blog Facebook, so you can see the station is real for our Facebook station and the things this transition not related to that one, by the way, just to show you. Okay, so let me see if I missed something, so what do you then basically recreating Meridiani deny Facebook? okay. And we created an energy policy because we knew from end to end, okay? And we really if I want to be Sanea, that Army sergeant will be a symbol. But when you go to Facebook, it will be blood and the traffic in B.C. from logs and report application control, either web filter you can see from there. Well. Okay, that’s it.

So, we created this policy using. Policymaker’s more. And if we move to security policy, so now we are using policy, Messmore, more is different. Everything has changed now before it was Nedved and everything now implication is you’re suddenly Susy’s here. You are looking categories inside rather than nothing is the. Okay, listen to.