How to create DMZ (Demilitarized Zone) on Fortigate Firewall?

What is DMZ (Demilitarized Zone)?

A DMZ (Demilitarized Zone) in computer networking refers to a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, usually the internet. The purpose of a DMZ is to add an additional layer of security to an organization’s local area network (LAN); an external attacker only has access to equipment in the DMZ, rather than any other part of the network.

Key aspects of a DMZ include:

Isolation: Systems within the DMZ are isolated from the internal network. This is typically achieved using firewalls to create a boundary between the internal network and the DMZ.
Access Control: Strict access controls are implemented, usually through firewalls, to manage the traffic that can flow between the DMZ, the internal network, and the external internet. Only necessary communication is permitted.
Exposure: Services that need to be accessible from the external network, such as web servers, mail servers, and FTP servers, are placed in the DMZ. This ensures that these services are exposed to the internet while keeping the internal network protected.
Security: If a service in the DMZ is compromised, the internal network remains protected due to the isolation provided by the DMZ setup.

Common Use Cases

Web Hosting: Hosting a website that needs to be accessed by the general public.
Email Servers: Allowing external email to be received while protecting the internal email system.
DNS Servers: Providing DNS resolution services to external clients without exposing internal DNS servers.

Firewall Initial configuration CLI

FortiGate-VM64-KVM login: admin
Password:
You are forced to change your password, please input a new password.
New Password:*****
Confirm Password:*****
Welcome !

FortiGate-VM64-KVM # config system interface

FortiGate-VM64-KVM (interface) # edit port1

FortiGate-VM64-KVM (port1) # set alias WAN

FortiGate-VM64-KVM (port1) # set role wan

FortiGate-VM64-KVM (port1) # set mode static

FortiGate-VM64-KVM (port1) # set ip 192.168.178.200 255.255.255.0

FortiGate-VM64-KVM (port1) # set allowaccess ssh ping http https telnet fgfm

FortiGate-VM64-KVM (port1) # next

FortiGate-VM64-KVM (interface) # edit port2

FortiGate-VM64-KVM (port2) # set alias LAN

FortiGate-VM64-KVM (port2) # set role lan

FortiGate-VM64-KVM (port2) # set mode static

FortiGate-VM64-KVM (port2) # set ip 192.168.200.1 255.255.255.0

FortiGate-VM64-KVM (port2) # set allowaccess ssh ping telnet fgfm http https

FortiGate-VM64-KVM (port2) # next

FortiGate-VM64-KVM (interface) # edit port3

FortiGate-VM64-KVM (port3) # set alias

incomplete command in the end
Command fail. Return code -160

FortiGate-VM64-KVM (port3) # set alias DMZ

FortiGate-VM64-KVM (port3) # set role dmz

FortiGate-VM64-KVM (port3) # set mode static

FortiGate-VM64-KVM (port3) # set ip 192.168.100.1 255.255.255.0

FortiGate-VM64-KVM (port3) # end

FortiGate-VM64-KVM #

Configuration Steps

1-) Initial configuration of the firewall

2-)Interface configurations and ipv4 basic policies

3-)DMZ interface configuration (no administrative access)

4-)Adding webserver’s IP address to Addresses as Subnet via /32 CIDR ending and DMZ as interface

5-)Configuring Virtual IP to map WAN to DMZ access. In this example we mapped 192.168.178.200:172 to 192.168.100.100:80 so once someone wants to access our webserver; outside address and port is 192.168.178.200:172 . As we are using 443 and 80 for administrative access we have chosen this specific port. If you change your administrative access port to something else then you can directly define 443 for webserver.