How to block social media application in fortigate 100D

This is the simple tips to block social media application in Fortigate 100D Firewall

• First check your fortigate license, is there your fortigate have future web filtering? if yes then continue the next step
• Login to your fortigate firewall
• Enter the "Security Profile" window, Fortigate already have social media application list by default. you can see it in "Security Profile --> Application List"

• Then go to "Security Profile --> Application Sensors"

• Creat new sensor by click "Create New"

• Choose by category "social media"

•  then choose action to "Block" right the bottom "Application Filter" windows

• then click "OK" to apply the rule
• you can check under the log & system if the new rule is working or not. if it is working you will see the log the traffic destination to facebook will blocked.

How to create NAT in Palo Alto Firewall

This is tips how to create a static NAT in Palo Alto Firewall

Example NAT:

Create NAT and firewall rule for the following

Public IP	Internal IP
X.X.X.X	10.109.100.102

How to:

  Allocate Public IP addresses

1.      In Palo Alto Firewall ,  create Objects  for the respective NAT Mapping

• Login to https://X.X.X.X/php/login.php  --> Palo Alto Firewall
• Go to window “Objects --> addresses”

• Klik "Add"

• Fill in the Name, Discription and IP Address
•  Go to "Policies --> NAT"

  

• Click “Add”, go to window general then fill in the name of description

 

• Then go to window Original Packet 

•    Choose Source Zone with “Any”
•   Choose the Destination Zone, Destination Interface and Service  
•     Choose Source Addess with the object you have created before, example   10.109.100.102
•    Choose Destination Address with “Any” 
•   Then go to window Translated Packet  

 

• Choose Translation Type with “Static IP”
• Choose Translation Address with the IP Public that have been created in “Objects”  
• Choose Bi-directional with “yes” 

Noted : if you choose Bi-directional with "no" that is mean your ip private server for outgoing and incoming not use same Public IP.

•  Go to “Policies --> Security”, Click “Add

• In Window General Fill in the Name/Description

•  Then go to window Source, Choose the Source Zone with the interface incoming
•  Choose the Source Address with the IP address source  

•  Go to window “Destination”, in this section you must choose the Destination Zone that mean your Destination Interface and The Destination Address, you can choose with “Any” if you destination want able to access all network. Or you can specify the destination address by click “Add”

• Go to window Action, in this section you can choose the rule “allow” or “ deny”

•  Then Click "Save"
• "Commit" the change to enable it

You can manage the service in NAT Policy Rule or Firewall Policy Rule the port TCP/UDP you want open or allow.