Désignation du périphérique Interface Adresse ip

Main leased line 30mb( routeur Interface routeur FAI(F0/1) 213.136.100.153

FAI)
Fortigate Interface Fortigate(F0/0) 213.136.100.99

Fortigate Interface fortigate (F0/1) 10.0.4.1

Switch Interface switch( F0/24) 802.1Q

trunk

Configuration d’un Switch Cisco respectant les règles de sécurité

Switch#conf t

switch#clock set 15:19:00 février 26 2021

Switch(config)#end

Switch#conf t
Switch(config)#hostname 2960-RG
2960-RG(config)#no ip domain-name
2960-RG(config)#end

2960-RG(config)#no ip http server

2960-RG(config)#no ip http secure-server

2960-RG(config)#no cdp
2960-RG(confie)# service password-encryption
2960-RG(config)#enable secret 12345

2960-RG(config)#line con 0
2960-RG(config)#password 6789
2960-RG(config)#login

RG-2960(config)#ip ssh version 2

2960-RG(config)#ip ssh logging events
2960-RG (config)#ip ssh time-out 60
2960-RG (config)#ip ssh authentication-retries 3
2960-RG(config)#username admin secret 6789

2969-RG (config)#line vty 0 4

2960-RG(config-line)#login local
2960-RG(config-line)#transport input ssh

2969-RG (config)#vlan database

2969-RG (vlan)# vlan 10 name management
2969-RG (vlan)# vlan 20 name server vlan
2969-RG (vlan)# vlan 30 name end user devices
2969-RG (vlan)# vlan 40 name wifi access points

2960-RG#conf t
2969-RG (config)#interface vlan 10
2969-RG (config-if)#ip adress 10.0.200.1 255.0.0.0
2969-RG (config)#ip default-gateway 10.0.4.1

2969-RG (config)#interface vlan 20

2969-RG (config-if)#ip adress 10.0.0.1 255.0.0.0

2969-RG (config)#interface vlan 30

2969-RG (config-if)#ip adress 10.0.3.1 255.0.0.0

2969-RG (config)#interface vlan 40

2969-RG (config-if)#ip adress 10.0.5.1 255.0.0.0
2960-RG(config)#interface range fastEthernet 0/22-24
2960-RG(config-if-range)#switchport mode access
2960-RG(config-if-range)#switchport access vlan 10
2960-RG(config-if-range)# spanning-tree portfast
2960-RG(config-if-range)# end

2960-RG(config)#interface range fastEthernet 0/1-7

2960-RG(config-if-range)#switchport mode access
2960-RG(config-if-range)#switchport access vlan 20
2960-RG(config-if-range)# spanning-tree portfast
2960-RG(config-if-range)#end

2960-RG(config)#interface range fastEthernet 0/8-14

2960-RG(config-if-range)#switchport mode access
2960-RG(config-if-range)#switchport access vlan 30
2960-RG(config-if-range)# spanning-tree portfast
2960-RG(config-if-range)#end

2960-RG(config)#interface range fastEthernet 0/15-21

2960-RG(config-if-range)#switchport mode access

2960-RG(config-if-range)#switchport access vlan 40

2960-RG(config-if-range)# spanning-tree portfast
2960-RG(config-if-range)#end

2960-RG(config)#interface 0/24
2960-RG(config)#switchport trunk encapsulation dot1q
2960-RG(config-if)#switchport mode trunk

2960-RG(config)#interface f 0/24
2960-RG(config-if)#switchport trunk allowed vlan add 10,20,30,40 tagged

Configuration du fortigate

les réseaux VLAN 10,20,30,40 communiquent les uns aux autres.

les réseaux VLAN 20,30,40 peuvent accéder au réseau externe.
configurer l’interface physique interne :

config system interface

edit external
set mode static
set ip 213.136.100.99 255.255.255.0
end

Ajouter les sous interface des vlan

config system interface

edit VLAN_10
set vdom root
set internal
set type vlan
set vlanid 10
set mode static
set ip 10.0.200.1 255.255.255.0
set allowaccess https ping
next
edit VLAN_20
set vdom root
set internal
set type vlan
set vlanid 20
set mode static
set ip 10.0.0.1 255.255.255.0
set allowaccess https ping
end

config system interface

edit VLAN_30
set vdom root
set internal
set type vlan
set vlanid 30
set mode static
set ip 10.0.3.1 255.255.255.0
set allowaccess https ping
next
edit VLAN_40
set vdom root
set internal
set type vlan
set vlanid 40
set mode static
set ip 10.0.5.1 255.255.255.0
set allowaccess https ping
end

ajouter les adresse du firewall :

config firewall address
edit VLAN_10_Net
set type ipmask
set subnet 10.0.200.0 255.255.255.0
next
edit VLAN_20_Net
set type ipmask
set subnet 10.0.0.0 255.255.255.0
end
config firewall address
edit VLAN_30_Net
set type ipmask
set subnet 10.0.3.0255.255.255.0
next
edit VLAN_40_Net
set type ipmask
set subnet 10.0.5.0 255.255.255.0
end

Ajouter les règles de sécurité

Les règles de Pare-feu 1, 2 ,3,4,5,6 pas besoin d’activer le NAT car les Vlan doivent
iniquement communiquer en interne , mais les règles de pare-feu 7,8,9 j’active le Nat
puisque les vlan 20,30 et 40 doivent communiquer avec l’extérieur.

config firewall policy

edit 1
set srcintf VLAN_10
set srcaddr VLAN_10_Net
set dstintf VLAN_20
set dstaddr VLAN_20_Net
set schedule always
set service ALL
set action accept
set nat disable
set status enable
next
edit 2
set srcintf VLAN_20
set srcaddr VLAN_20_Net
set dstintf VLAN_10
set dstaddr VLAN_10_Net
set schedule always
set service ALL
set action accept
set nat disable
set status enable
next

edit 3
 set srcintf VLAN_10
set srcaddr VLAN_10_Net
set dstintf VLAN_30
set dstaddr VLAN_30_Net
set schedule always
set service ALL
set action accept
set nat disable
set status enable
next
edit 4
set srcintf VLAN_30
set srcaddr VLAN_30_Net
set dstintf VLAN_10
set dstaddr VLAN_10_Net
set schedule always
set service ALL
set action accept
set nat disable
set status enable
next

edit 5
set srcintf VLAN_20
set srcaddr VLAN_20_Net
set dstintf VLAN_30
set dstaddr VLAN_30_Net
set schedule always
set service ALL
set action accept
set nat disable
set status enable
next
edit 6
set srcintf VLAN_30
set srcaddr VLAN_30_Net
set dstintf VLAN_20
set dstaddr VLAN_20_Net
set schedule always
set service ALL
set action accept
set nat disable
set status enable
next
edit 7
set srcintf VLAN_20
set srcaddr VLAN_20_Net
set dstintf external
set dstaddr all
set schedule always
set service ALL
 set action accept
set nat enable
set status enable
next
edit 8
set srcintf VLAN_30
set srcaddr VLAN_30_Net
set dstintf external
set dstaddr all
set schedule always
set service ALL
set action accept
set nat enable
set status enable
end
edit 9
set srcintf VLAN_40
set srcaddr VLAN_40_Net
set dstintf external
set dstaddr all
set schedule always
set service ALL
set action accept
set nat enable
set status enable
end

Configuration du serveur dhcp sur le fortigate pour attribuer des adresses ip au vlan 30 et 40

config system dhcp server

edit 1
set dns-service default
set default-gateway 213.136.100.153 set netmask 255.255.255.0
set interface vlan_30
config ip-range
edit 1
set start-ip 10.0.3.2 set end-ip 10.0.3.254

next
edit 2
set dns-service default
set default-gateway 213.136.100.153 set netmask 255.255.255.0
set interface vlan_40
config ip-range
edit 2
set start-ip 10.0.5.2 set end-ip 10.0.5.254
End
Configuration un zone incluant une interface physique et des VLAN

config system zone

edit trust
set interface f0/1 vlan_10 vlan_20 vlan_30 vlan40
set intrazone allow
end

config system zone

edit unTrust
set interface f0/0 vlan_10 vlan_20 vlan_30 vlan40
set intrazone deny
end

config system zone

edit vlan
set vlan_10 vlan_20 vlan_30 vlan_40
set intrazone allow
end

config system zone

edit dmz
set interface dmz vlan_10 vlan_20 vlan_30 vlan_40
set intrazone deny
end