Forti

• fortinet notes

interfaces

• device detection - passively collects network info such as MAC address, IP address, OS, hostname, when it was detected, on which interface...
• interface role - hides/reveals parts of the configuration in the GUI based on what is appropriate for the role; { LAN | WAN | DMZ | Undefined }
  • LAN - interfaces that are used for local networks and internal endpoints
  • WAN - interfaces that connect to the Internet
  • DMZ = DeMilitarized Zone - interfaces that are hosting servers, especially those that are exposing services to the Internet (i.e. separating publicly reachable servers from the rest of the corporate network/LAN)
  • Undefined - all options in the GUI are shown and configurable unless noted otherwise
• zone - a group of one or more physical or virtual interfaces that you can apply security policies to, to simplify the config; apply 1 policy to 1 zone, instead 3 policies to 3 different interfaces; individual interfaces must not be referenced in the existing policy config if they are to be assigned to a zone
• redundant interface - traffic goes only over one interface at a time; differs from an aggregated interface where traffic goes over all interfaces for increased bandwidth; this difference means redundant interfaces can have more robust configurations with fewer possible points of failure
  • priority-override - priority is the order in which the interfaces are configured (the first one frome the left is the highest priority); if it's enabled, the primary interface takes over the traffic from the secondary when it becomes available again
• software switch - virtual switch that is implemented at the software or firmware level and not at the hardware level; e.g. interface with wired internal network on the same subnet as wireless interfaces, or the use wan1/2 or DMZ as additional LAN ports
• virtual wire pair - two interfaces that do not have IP addressing and are treated like a transparent mode VDOM; all traffic received by one interface in the virtual wire pair can only be forwarded to the other interface, provided a virtual wire pair firewall policy allows this traffic; e.g. to protect a server without changing the network topology

services

• fortigate can be used as a DNS server in small deployments