1. Configuring the FortiGate unit’s DMZ interface

2. Adding virtual IPs

3. Creating security policies

4. Results

Protecting a web server on the DMZ networkIn the following example, a web server is connected to a DMZ network. An internal-to-DMZ security policy allows internal users to access the web server using an internal IP address (10.10.10.22). A WAN-to-DMZ security policy hides the internal address, allowing external users to access the web server using a public IP address (172.20.120.22).

Internet

WAN 1172.20.120.22

FortiGateDMZ

DMZ Network

Web Server10.10.10.22

LAN

Internal Network

Configuring the FortiGate unit’s DMZ interfaceGo to System > Network > Interfaces.

Edit the DMZ interface. A DMZ Network (from the term ‘demilitarized zone’) is a secure network connected to the FortiGate that only grants access if it has been explicitly allowed. Using the DMZ interface is recommended but not required.

Adding virtual IPsGo to Firewall Objects > Virtual IPs > Virtual IPs.

Create two virtual IPs: one for HTTP access and one for HTTPS access.

Each virtual IP will have the same address, mapping from the public-facing interface to the DMZ interface. The difference is the port for each traffic type: port 80 for HTTP and port 443 for HTTPS.

Creating security policies Go to Policy > Policy > Policy.

Create a security policy to allow HTTP and HTTPS traffic from the Internet to the DMZ interface and the web server.

Create a second security policy to allow HTTP and HTTPS traffic from the internal network to the DMZ interface and the web server.

Adding this policy allows traffic to pass directly from the internal interface to the DMZ interface.

ResultsExternal users can access the web server on the DMZ network from the Internet using http://172.20.120.22 and https://172.20.120.22.

Internal users can access the web server using http://10.10.10.22 and https://10.10.10.22.

Go to Policy > Monitor > Policy Monitor.

Use the policy monitor to verify that traffic from the Internet and from the internal network is allowed to access the web server. This verifies that the policies are configured correctly.

Go to Log & Report > Traffic Log > Forward Traffic.

The traffic log shows sessions from the internal network and from the Internet accessing the web server on the DMZ network.