Fortinet NSE4_FGT-7.2 — FortiGate Firewall — Section 1: FortiGate Firewall V6.4 1 Part 33

45. Lecture-45: Policy-Based Mode for Default Services.

Policy is more defined, said, which is, you know, there is defined services as well. If I click on this one, we already the mode, by the way. This one services, I told you, I need to show you what this means by far and specify we know this incoming interface means from where the traffic will come. It will come from lane, where the traffic will go.

So, it’s a real source. What is the source? I believe I will do a bit later. This commission, will they want to rule? In both cases I say I mean, zero zero zero and destination means zero zero zero. And if you do, it means you can put the timetable. as well right now, any time, any day in any of their services. Now, this the question. To the services, they said they. And define and specify what is if Befana means.

So, any policy based more than ever before, I mean, there elite services has to use the find gold. No. And we know No. Six, five, five, six. What is important and what I should ask him is there are so many imports. No water. No. Well, no 026 yeah, no, I. True, for many time, zero two six five five three five, every obligation is using their own phone number and there is a full list and I don’t know, ten, twenty three is registered for. And so, so many things I told you.

So, every application like it should be is using LDN 443, that is using 23 as such as using 22. NSA is using 53 year, BHP is using 66, 67 and 68 and so on.

So, I can put restriction through policy that if some like a boat hoping that not somebody can do so, you can restrict those implications.

So, how can I show you? So, I have a few far outside looking.

So, would say this is my old site, XP, which is using one nine to do 160 and one one for 150. How I know this is outside, so I have to interfaces basically outside something that I have one one for my one is one one three and XP is using one one for one fifty and they are Diffa over one one three, which is our outside interface, this one.

So, how I make them so basically and four didjeridu how to interface is okay if I want to interface.

So, the first one is najin which is also the second one is our land, which is in Lansing statement.

So, I would want to expand the more the older ones automatically as Commander Najran one, this is in Najid one and I put the other. XP is a Lancy.

So, it’s become underlain. This one L.A. woman, so when XP is inserted, which I see is one two inch. One hundred and sixty one, which is this range land range, and the other one is one one four one one three so far outside XP is one three three, but inside XP again to is one hundred. This is an interface. This is Len segment.

So, this is the best you can do it for outside XP. What I will do, I will run them server on a normal board. Unending war and peace is for for three.

So, if I check from inside, it will work because I’m using different.

So, let me remove the policy on the policies. And let’s create a new one.

So, let me do them. And now everything anyway, let’s do it, this one modified this one so from land to in an application be for. You and I can build the space if you are in as well and elsewhere, you can put the space, if you will, the voters will like HDTV is. This one, if you want to make the most educated about me, the oh. Four for three and also 18 bodies to be stewardesses will be there as well. HDTV, because it has to be. This one.

So, in the long run, this one point eighty one, this one is enough, it will work for both.

So, I say. I want to create a policy, but it shouldn’t be a trophy for four, for three DCB and Bowl and four for three. But. This has to be on there’d be far more and far between 80 and 443. And let’s clear this policy.

So, my only single policy is to take them so that I can show you and love everything for specificly HHTTP, which is for the Indian for for three.

So, if I. From here, excuse my old Saturday expe IP. Reaches 18, so 150. In the browser, one name to do, 160 years from inside, 192, 168, one one four, not 150.

So, server will be accessible.

So, this this is a server five, this is hosting an XP, this one, this one, and I hope this year, by the way.

So, this one is showing me and Zim’s what you can go to. You know, this might be. Let me bring them in for something is. This is. With someone control is Sarah and Sarah, let me show you again, we’ll see say this is so this is your solo choice accessible because we’re using Biffa called. And so the policy is totally different for.

So, we are using energy and fortunately I can excuse my SUV about as well because both are available, HHTTP is. It will give me a warning, but it will be accessible by both peaceful for free and deport because it’s, you know, okay. Well, somebody is an. It has to be, by the way, for four, three.

So, let’s hear it has should be accessible right away. And, Wolf. Now, I suppose if I had what implication we shouldn’t ignore that a standard for.

So, let me change this one, by the way. Let me show you why it is not reachable. It has to water, by the way. Maybe it’s not an amplifier to somebody and is stopping and starting. Let me start again. Yes, no, it’s okay and let’s do it. By the way, will work on both. It shouldn’t be either. Anyway, let me give this symbol on GDP.

So, this is obviously it’s okay if I change my import duties to non-standard for let me go to a party and change the board to suppose AT&T, normally you will see this type of thing. Ensue. And let me stop and start again. Now I’m listening. To New Jersey, Illinois GDP, do you think I will be able to access this again? Let me try them. No. Because I’m losing your dear, dear, dear. It will give me an application, look at it for the application NBC application is being blocked because the application should be Brossette. And we are using this rule, you remember this story I told my student brawls. Because I’m coming the implication inside. But I said services has to be deferred one, so they block them that no application is being blocked you on this thread or nothing, is there just like the for how I can see it.

So, let’s go to user logs and report and go to so we can really find forwarding traffic as well. He said they’re the one that reaches out, insert a speed limit to one one four one 50, okay, so to speak, for people that browser been denying them. And why they denied them so listed, what is the issue? Bonus humiliation, but is to be mentioned in the bonus you lation midterm.

So, let’s really find from other places application control. Maybe they can give us some more detail.

So, now we can to application control one or two, it ought to be inside one one four one 150 is outside, is being black and go to detail.

So, this is nine different Port Hughes, AT&T.

So, we can control board helping our take on non-standard by policy as well. Now, you may be thinking and maybe Japan is thinking, most of all, the implications of using non-standard fault as in our infrastructure, Mihail, most of the application we are using non-standard.

So, what we can do then, you have to specify I gemological such type of things would be a.

So, if you want to be loud and you know that, ignore the board, then using non-standard board, then you have to go back to policy and object to border security policy and the policy which you created for different board. Okay, this one. What do you need to say if the father is stood up, if they are paying them to specify? So, now you got the idea. What does it mean by if it means every implication is using the term defined or specified means I will specify my own, which is not here, so which I can do. I will create a new one with certain it will open.

So, he says, I will tell you services. Maybe if you find that I’m supposed to DCB 80. Normally, when you create an object, it’s better to give them you would be better to give commands if you want to give them any color of color and joined the service list.

So, when you click on this policy, it will show you the name, the list. If you say unchecked, it will not show up. But we need to see the category. You can put them in any community support network services. And it is not easy. But, you know, AT&T, AP and AT&T, sorry to. If you have more, you can click more and we will discuss new services in detail, but I just created okay, sort of for the always random as we know.

So, no need to put the source for an okay.

So, now it’s suing me here and choose this one. Rather than I told them that we know where somebody is going to hear.

So, we have a specific service and destination, you will be looking for them. Normally we do like this. What is my cell? What I’ll be looking at? I’m like, oh, we’re so. Certainly, if you want to give them any some and leave out 192, 168, one one for 150 is myself, what I’d be trying to do before in any interface and okay, normal is like this one. And let me put this to this tension always. You can restrict their time as well so you can put your lens on rather than to. We will begin slowly when we reach the enemy. Right now, I say loud and okay. Before it was not so simple. Let’s try again now this time and refresh. Look at it now is coming. And it will not generate any locks because now we tell them that we are using non-standard import, so that’s why we use a specified rather than if before if we make them like this, it will not be specified then the border which they are using. You have to specify. And as we bring some more restriction for the specific IP. Of the. And as you can see in the Liberian subnet as well, it’s up to you to make the policy more control means to bring more control.

So, let me go there. This was our insider.

So, see going to El Salvador, which they are using ADA there for four, three. Okay, so we use Diffa one and we check out our Naseby and when we change the border number. Okay, so it’s Denias from application control now.

So, we really fire from some other places as well. Okay. And then we created our own board and we test them, okay. And now it’s working.

46. Lecture-46: FortiGate Firewall Modes (Transparent).

40 gig for one more now than that was was inspection more than then next generation firewall mode. This is for the Great Firewall. It means you can leave before begin for a while. And two more narrative mode, which we call them modest win and try to spin in a more transparent would like to try and spin it like a bridge. Like shrewish. And it just will be hard to call them Bruskin and more. In Palo Alto for what we call them, we wait here, we call them transparent, more so you can display what most of their time, 99 percent you will see naked and brought in more legislative, far more. But if somebody is in some organization need transparent more than you can join, the more Najid around it, more means. There during the middle between two different subnet. You’re taking their toll free from land and forwarding to when you are checking the borders. You are the danger for everything. And you are in the middle between two zone, either more than two zone and you are working as a. Broker between the different Southern, there you are providing the Internet, you can provide random Internet link, it’s also possible to indulge in more. You are not interested in nature. What you can do, policy based routing, you can do routing, you can do lieben, you can do sophisticated would be in everything. And that’s why this is the preferred one, and most of the time you will see them if you want to fully utilize your 40 doing for a while, then you have to deploy them and brought in more. And it would have firewalled by the father coming in this morning. But for some reason, if some organization need and it’s part of the requirement, then you can join them to try to spin and mold and the more you will lose so many capability, you will work like a ladder to reach. You will work like a bridge. You will work like a transport in. You can read configurator Sylvie, PNB keeps water and so many things you will lose. But still, you can apply the policy, you can cure it to John using drugs that are not the only advantages of transport and more. There is no need to change anything. And you want an end to it, just like a plug and play.

So, whose organization need that? I mean, the while. But don’t. Change anything in my name didn’t change the world through transparent more than anyone started work, then you can apply for for one intransparent more. Okay, this is theoretically the difference between multimode and transparent, more rounded, more, whatever we done up to this point from the first lecture to deliver to the lecture of the last election, which we’ve done, everything was in natural mode.

So, the only thing left, how we can change the world more transparent, more this what we will do. In terms put in more, you can not assign a bill to the interfaces, then what the hell is there then? How we can I we will excuse the one if there is no interface, no interface, Abbi, how I will reach to the device.

So, yes, there is a way. Management, I’d be weak and configure, but there will be no be on land interface. There will be no IPN in interface. It’s amazing. And then still, you can access them through management would be, you know, there will be no IP on the land, no IP in the wind, no IP on any interface.

So, how we can do this, let’s move to Lamen, do electron spin and multiply.

So, I need this. Forty here, for one. This is the one which we have an audience media to. Another thing I need. Inside B.C..

So, let me take Randall. And little did Windows seven. And let me change them to RTP so I can just Lendu is a RTP and I need one outside. This is my Internet I will use here. Management is the outside of my. This one.

So, my old side is for one. My insight is for two. Okay, and we will be this the only thing I need to start and start. Normally what we do in nature, the more we are saying I’d be reassigned, I’d be reassigned, I’d be here and report there is a good friend and then say, oh, this land will reach to the old sir and we got there will be near dimmable and roping and there will be a nasty name. Well, this is the normal procedure you do. But this time I’m doing something is is a transparent first let me expose this device is a natural mold because waiting for this coming is a matter more so how I can access the DoubleClick and more to 40 here. Because on board one, it will be automatically is not by default, is getting ugly because DCB is your name and also. Mining companies enable on board one.

So, let me access them. It will take some time.

So, as a sign, I would be reaching angry reviews.

So, one by one I will assign to my windows. One is the IP and because we cannot assign is a transparent before IP, but I need management IP so that I can access this device and do changes to my name and I will meet. I suppose no, this is my money when I built this device, which will not be assigned to any board, by the way, I will show you.

So, it’s come up now and then there is no better new person. One, two, three. One, two, three. And sure, system place. Which model and first of all, David, are you to be a TV and also on first board? Everything is informal, so let me try this. I’ll be here and access this device. What is the IP to the entire around 100 to 160, okay, it should be the HTTP nondestructive. This is I told you this not registered device. Anderman one, two, three. It will ask need to change the name, so let’s change them the name. Otherwise they will tease us all the time. That’s done.

So, I expose them to this interface and let me show you on which more, we are looking at it more as Nate.

So, why do you for this neighborhood monitor, we call them grouted more, but I don’t mean this one and also and more, do you have to assign IP separately to every interface and also different subnet? So, this one is one one four. If I click on Hulu, you will find IP address location here. Look at this year after. This will be not available. Keep in mind.

So, it’s not showing a showing like this because it’s a little more. How I can change them so it’s impossible to graphicly some of the things you have to do at CNN.

So, unfortunately, I will come. Come on, we will do. What you can do, you can feel confident, we can feel free and fair system in the face of what? Fix the system interface. And what happened to. Well, to enable the services, you can do this graphically as well. Service is served and now Alexis, hdb, HHTTP being elected is to stage. It’s the first Saudi air.

So, Sam, like understand the phrase which is being given everything, you know, I know that, too, as well. If I refresh, you will see you can do it. You give me this this this part you can do graphically as well. I’m just showing you from the. Come on, look at this animal now. Now the rest of the thing, you have to do it from just watching the model. How I can change the mold from nature to transport. And keep in mind the showing here and what is the more, Najid? More. Let me show you, CNN did more now come here. And we’ll do config sys starting. And send. Oppression, more oppression, more dissent, Transmuter noted, is unloaded. I want to spend. Because I need the changes now, I need how I can exist, because everything is lost now, I cannot access them anymore from this IP. It’s nothing, it will be Natixis, you will? Oh, yes, because I not from you.

So, I need city management, I see this the ma’am and I have one major to 168 one. This is what we decide for our management. And soon, the gateway. Which is the gateway.

So, our next stop is this one one one four two one nine two two one six one one four. Don’t do this automatically in an instant. Now, it will change the order to ensure your message changing, to be more intuitive, not accessible. And this anymore, because I know it’s not accessible to. You want I can get them from here. Now I need to hear because I allowed one hundred and one hundred is only one or two, I am connected to this device to fourth one, so I cannot exist from here on this device anymore. And let me close this one. I need to here to this device, this money from my land.

So, click on this one and go to. Windows seven. And when you say when I be a user name is I think so user and password is one, two, three isn’t user name and password and, you know, say one user and there should be capital. One, two, three.

So, first, I need to assign this IP, which will decide how wonderful and then I will be able to manage this device.

So, I am here now. I need to go to. One from inside any any system model properties. Okay. I don’t need to be a before, and I have one and two and six to add one last one and get one and to do one sixty one gartenberg, which is a lot of money when IP and DNS is at it and. Okay, ok, ok. And now I will be able to assist the management IP and fingers. One nine two one hundred.

So, yes, it’s been given and now I will open a browser. I will show you you will not find this IP on any interface because guys become like transorbital, like a bridge between two different networks.

So, the firewall modest change know.

So, 192, I will Dibia 190 to 160 and Wunderkinder. Now, relax, just the firewall, okay, from inside, so named this the IP, which is reachable from inside.

So, and time it meant one, two, three. Okay, so let’s see the modest change to drums, we don’t know how we can really find we can really find from on. For.

So, let them come, because it’s very slow from this side, so it will take some time to show you here, you will find transport and more rather than look at this transport and now are you chasing them all so I can see the difference. Let’s Google network interfaces. What do interfaces? okay, and you will see you there will be no IP addresses and also you cannot assign IP addresses no. Any more, so no physical interfaces. This one is the alternate interface. Let me click on it. Do any IP here. You will see no IP. And also there will be no location to type the IP address. Nothing is here. Is there anywhere to time before it was made me give them at least near Muen so that we know this is our way interface intransparent. When? Unlikely to you can assign and I don’t need to be in this one. This is not any more than. When a human being has to be. And okay is just giving me a say, maybe we are using this interface for our management. Give me a warning, but it’s okay and my always manage when as well and I live in as well.

So, here I will say Lin, but no idea. There is no way you can’t see any anymore. In okay. That’s it.

So, my land is okay, my land is the area, okay? There is no more impetuses because this is intransparent mode again. I still need audience service so that my lempke can go to our side.

So, let me configure DNS just like a normal one to specify. Let me see. And dark haired and I wonder one. Not one of you, okay? And I still need a different robot, which I let you.

So, no need to tie up my game. You know, we need to be far beer.

So, one one four Narada is already configured. The only thing is I need a policy that my insert B C, this is my insert as well and also using for management as well.

So, let me try again. I go to intimate because I’m in transition and I need to go to Intiman.

So, I hope it will be not reachable because we need a policy as well.

So, what do I do for policy and career and a policy is women’s policy is the same, like the naked mole. Click on this one. Okay. And give them minimum land to win. Consumed is the same land, but we’d all be. Outgoing is.

So, there is no Internet is not accessible because there are no policy when source can be anything, destination can be anything, salacious can be anything. And we don’t get them over one and okay. And I also worked on this policy, we will be reasonable to Facebook. You know, there is an Internet, I’m in the same piece. Okay, I’m using this is Lynn B.S. as well and Management as well.

So, I inaudible this email accessible on the Internet. I can sample to see if you see the logs Walding log, you will see the log and forwarding you will see the laws of broilers will come, by the way, in. And also, you can verify from the dash board. And 40 with as well is a source who is the source of so one daughter of one is the source. I hope it will come after a while. This still under one. They were going to Facebook or Twitter and also Facebook tweets here. And also each policy we used.

So, is learn learned to in. And we’ll show you the policy. as well and this and it will show you this nation is doing. Okay, this decision and everything, and if you want to lock them and for now, it will show you four or five. It takes some time to come up anyway, after a while, it will show you. And also from land to DMZ, you can see their trophy. For as well.

So, the more change, but still it’s almost the same consumer, that donation is the source. Okay, so now is trying transformation from here. I’m going here. There is no you be and there is no I’d be okay with this. My management, I believe we need what we can afford them. Using CLIA. There is no graphical way to change from an 18 month old transmitter. And we check here a certain speed and more to basically most of the time you will see Najran more one 99 percent, maybe in one case for some reason.

So, it’s showing me how transparent let me go if I missed some.

So, we’ve done this far reaching. The more issuing you, then we will do our window and then we have been more and more, less transparent. There is no way could be a sign on any interfaces, is on frigidity and is sturdy. Cloud was already been created on policy and rejected the BBC or whatever, and we check on the station and everything for the now.

So, it’s working normally. Yeah, we cannot configure VPN because they are required to you. There is no IP on any interfaces.

So, some of this thing which you will miss them intransparent more. One of them is associated with being BCB and also side to side of being and so many other things which you cannot do it using transparent more beside everything we’ve done that was invented in Baltimore up to this point, we started this live.

So, this the only thing yallock.