FortiOS 7.4.2 Base Firewall Config

If you need to get up and running quickly with some basic visibility then this is the video for you. Take your new FortiGate that is running FortiOS 7.4.2 and get it up and running in a manner that will open visibility of your network to you.
From here, you can slowly tighten the vice grip and get the visibility and security you desire!
Buy Hardware: bit.ly/2QZVeqh
Get Consulting: bit.ly/36FinSU
My Other Projects:
Office Of The CISO: bit.ly/3HGMH1o
Packet Llama: bit.ly/3SEX3H4
###### SOCIAL LINKS ######
Twitter: bit.ly/2WXiRAv
Facebook: bit.ly/3eigz4D
Instagram: bit.ly/3cZneAz
######################

[@FortinetGuru]

The initial configuration you put on your SOHO FortiGate is critical. FortiOS 7.4.2 brings some new features and approaches to things. Follow this video to get a basic foundational configuration live that will give you the starting point you need.

[@RaviChinasamy]

Can't wait for the heavy hitters episodes 😅 but it's always great to get back to basics. This episode could be called Fortigate 101 😂

[@A1N0]

Very helpful. Been using Fortigate for 2+ years and still learning. A big problem is WRONG things can MOSTLY work which can provide a false sense that its all good. But still holding off of 7.4.3. They say SD-WAN isn't really working.

[@buldozzer3456]

I am using Fortigates for my MSP customers for quite some time now and have automated all the steps (and more of cause) using the API and a config script. It's always nice to see the basics again. 👍

[@FortinetGuru]

The API is making things sooo much smoother

[@kevindylla1528]

Hey there, im tinkering with the API as well. Do you mind sharing? Would greatly appreciate

[@mikezero7422]

mind sharing the script? 😢

[@thesollys9540]

Hi Mike, always liked your videos, thank you. Just a couple of points to note about your basic setup, that few new fortigate guys might not have noticed. You were administrating over the WAN interface with https ON, make sure you tell everyone to close that off and you didnt put any administrative protocols on the LAN, maybe use local-in policies to trusted hosts?, also I noticed you were using flow inspection policies instead of proxy, which I might add has caused a few issues with Lets Encrypt certs of late. Perhaps you could explain the difference to folks about best practice on inspection modes are with protocols to use them with.

[@FortinetGuru]

All excellent points. And all will make excellent videos. Thank you sir!

[@xDefq0n1x]

Can't you leave https and restrict to specific hosts?

[@FortinetGuru]

@xDefq0n1x you can. A lot of ways to approach it. Next video will cover locking a unit down.

[@Nimitz_oceo]

Fantastic content. I think the best way will be for you to make an entire course. However long at least you will lay out all the details. KZbin is ok but we have to search through to specific videos.

[@jaywill1978]

Always enjoy your content and way of explaining things. Keep it coming! 🙌🏼

[@RichardDePas]

Merry Christmas Mike! Thanks for another informative video.

[@izoka1828]

Merry Xmas for you and your family !

[@HC19200]

Thanks for your video Mike !

[@---tr9qg]

c'mon man, where is your beard? Thanks for tutorial!!! 🙃

[@FortinetGuru]

lol. Baby face in the housee

[@jeremypeterson8002]

Great video it helped me alot, small problem though...when i remove all polices youtube is still blocked? i have no clue why. and ssl inspection is still on police in monitoring mode

[@popescusilviu9948]

HI! Can you do an updated video on the profile based vs policy based NGFW of fortigate. I would like to know if the policy based mode have improved

[@TechNicoe]

Great video

[@bandido428]

In iptables, I can redirect traffic to any DNS I choose, including internal without the user knowing. To them it's the one they put in DNS. How do I do that in FortiGate? I can't figure it out!

[@RCSubmarinevideo]

I would love to look over your shoulder on what you do after. You mention running a report and chipping away....how? Thank you for your channel.

[@FortinetGuru]

Sir. It’s coming 😊

[@daviddavila9581]

@@FortinetGuru I'll "second" the request to see how you generate reports to chip away at the outbound allow all rule. Also, I noticed on your firewall, under the list of Security Profiles, I did not see IPS. Where'd it go? It's my understanding, though I could be wrong, that the most basic support plan, the Essential plan, includes licensing for Application Control and IPS security profiles, right? Thanks for the great vids! Been following you for years!

[@JaZzDeOliveira]

Would you recommend the same inside zone if I am setting up a LACP with multiple VLAN's and will be looking to do policies that allow some VLAN's to talk between one another and for some to not have internet breakout

[@FortinetGuru]

You would add the VLANs to the zone not the aggregate interface. If you block intra-zone communication you can use policy to allow vlan to vlan communication.

[@JaZzDeOliveira]

@@FortinetGuru Thank you , I suppose then if I have a Local IP on the aggregate interface and wanted to use it as "Native" then that too would be added to the zone?

[@jeffrey8859]

Why not use the Internet Services database which is build in Fortinet for known destinations / services (like Google DNS)?

[@FortinetGuru]

That is briefly mentioned in the video. When I’m talking about building more specifics higher up you can use the database for destinations that may be dynamic. Absolutely right.

[@bl7937]

Mike, can you please explain the differences between Fortigate and Ubiquiti udm-pro? I’m more custom to Fortigate but recently looked into ubiquiti and their GUI is outstanding. But wanted to ask if there is a way to put each device through a series of benchmark tests if you will to determine which one is more secure.

[@daviddavila9581]

Hey @bl7937, years ago I ran USGs with Unifi APs. But, I found the feature set of USGs to be lacking, along with Unifi's support. I switched over to Fortigate firewalls with Unifi APs (Fortigate's APs are still too pricey IMO)... and haven't looked back since... especially since Unifi released the CloudKey v2 with built in 1TB drive for video camera support. To be fair, I've heard Unifi support has improved. But, I'm not sure their firewall is up to Fortigate's maturity level.