#DAY 5: Firewall Policies, NAT & Logging

Securing Communication Through Policies and NAT

Introduction

The foundation of a secure network is its firewall rules, which specify which traffic across various interfaces and zones is permitted or prohibited. These policies enable access control, security rule enforcement, and communication prevention in a FortiGate firewall. Network Address Translation (NAT), in conjunction with policies, is essential because it allows internal devices to access external networks while concealing private IP addresses.

Logging is equally crucial since it offers insight into traffic patterns, the application of rules, and possible dangers. Issues may go unreported without logging, making it challenging to identify harmful behavior or troubleshoot problems.

This phase involved using NAT to enable secure internet access, setting up firewall settings to control communication between LAN and WAN, and turning on thorough logging for auditing and monitoring. As a crucial line of protection for the deployment as a whole, these actions made sure that network traffic was both safe and traceable.

Understanding default behavior

Firewall policies, NAT, and logging are essential components of network security. Understanding their default behavior is critical for effective configuration and troubleshooting. Firewall has a default policy called implicit deny, which is to deny every traffic.

Creating a basic internet access policy
Establish the categories of permitted and limited access, set up user authentication if necessary, and make sure that appropriate logs and compliance monitoring are in place in order to establish a basic internet access policy.

How to create a simple policy for the firewall to allow the device to get connected to the internet → Name, Schedule, and action → Schedule → Source & Destination → Logging option

Name, Schedule and action

Schedule

Source & Destination

Logging option

Verifying new policy operation

• Simulate event traffic.
• Review Traffic Records.
• Confirm matching logs to verify successful rule application.

Back to my VM

Trafic Records after I refresh the page

To View the matching logs

Adding a new network interface

Configure the new interface in the GUI.
Assign to Internal Network port3 with proper IP setup.
Verify changes from the overview page.

Open the GUI and refresh the page

Internal Network port3 configuration

Overview of the new interface added

Conclusion

In order to reinforce the firewall's function as a gatekeeper and an enabler of secure communication, Day 5 was an essential step. I was able to turn the FortiGate from a passive system into an active security enforcer by putting firewall regulations into place, turning on NAT for internal-to-external access, and setting up thorough logging. In addition to controlling network traffic, this made sure that it was constantly monitored for compliance and threat visibility.

Success Goal Achieved

• successfully developed and implemented firewall rules to control communication between LANs and WANs.
• NAT was enabled to conceal private IPs and give internal hosts safe access to the internet.
• Set up logging to monitor, examine, and diagnose all important network operations.
• Real-time traffic simulation and log examination were used to confirm the efficacy of the regulation.
• Added a third interface (port 3) to the configuration in order to segment the internal network.

Lessons Learned

• Implicit deny is always in use. Traffic will be prohibited unless each new policy is clearly established.
• In order to safeguard private networks, NAT is a must for real-world internet access.
• Without logging, troubleshooting and auditing are practically impossible. Logging is the firewall's memory.
• The order in which the rules are set up has a direct impact on how traffic is handled.
• In order to prevent conflicts, proper IP assignment and consistent documentation are necessary when planning for network expansion and adding new interfaces.