Webinar Fortinet Italia 12/09/2013 Novità Soluzioni Wireless Fortinet Dr Aldo Di Mattia, CISSP Systems Engineer Fortinet 1 September 13, 2013
Agenda Introduzione: - FortiGate Wireless Controller - Implementazione soluzione wireless Mai Wireless più sicuro: - Rilevazione, classificazione e risoluzione attacchi rogue - Wireless Intrusion Detection System - UTM completo Dall'AntiVirus alla nuova Protezione Avanzata delle minacce: - Nuovo sistema ATP (Advanced Threat Protection) - Sandbox Locale e in Cloud Autenticazione: - WPA, WPA2, 802.1X, PSK - Single Sign On, NTLM e portale autenticazione - Gestioni utenti Guest Modelli Access Point Fortinet: - Per uso interno ed esterno - Per l'accesso da remoto 2
3 Fortigate
Ubiquitous Access Unified Access Layer Remote Access (RAP, VPN Client) Wired Access User Identification Access Control DIGITAL ASSET Content Inspection Attack Mitigation Wireless Access 4
Wireless Solutions: Thick vs. Thin Fortinet APs FortiWifi FortiAP 5
FortiGate Wireless Controller 20+ FortiGate Platforms 5 AP/100user to 10,000 AP / 32K user capacity 6
7 Adding Access Points
8 Create New SSIDs
9 Automatic Interface creation per SSID
10 Edit Access Points and SSID association
FortiAP CAPWAP & CAPWAP encrypted Traffic flows to controller Increased control No trunking No VLAN management No Layer-3 roaming, just fast Layer-2 switching No need to re-dhcp Controller Redundancy 11
FortiAP Bridging (Local and Remote application) Headquarter Internet Branch Bridges WiFi trafic to FortiAP Ethernet port No u-turn to HQ to access local network Resiliency in case of WAN failure WAN 12
Signal optimizations AP Handoff o Balancing Access point Frequency Handoff o Balancing between Radio Auto TX Power Control o Changes radio transmission power settings automatically Automatic Radio Resource Provisioning o Automatically assigns non-overlapping channels o Changes channel and TX power to avoid RF interference impacting Wireless LAN o Selects channels with least noise and interference Beamforming (FAP-221B/FAP-223B/FAP-320B) o Radio beams add at the device to enhances the signal and link-rate 13
Wireless Mesh Dynamic Multi-hop Mesh with resiliency Point-to-point / Multipoint Bridging 14
Agenda Introduzione: - FortiGate Wireless Controller - Implementazione soluzione wireless Mai Wireless più sicuro: - Rilevazione, classificazione e risoluzione attacchi rogue - Wireless Intrusion Detection System - UTM completo Dall'AntiVirus alla nuova Protezione Avanzata delle minacce: - Nuovo sistema ATP (Advanced Threat Protection) - Sandbox Locale e in Cloud Autenticazione: - WPA, WPA2, 802.1X, PSK - Single Sign On, NTLM e portale autenticazione - Gestioni utenti Guest Modelli Access Point Fortinet: - Per uso interno ed esterno - Per l'accesso da remoto 15
Fortinet Secure WLAN Approach No additional licenses needed Captive Portal, 802.1x Radius /shared key Corporate Wi-Fi Assign users and devices to their role Examine wireless traffic to remove threats Identify applications and destinations Apply policy to users/devices and applications Ensure business traffic has priority Report on policy violations, application usage, destinations and PCI DSS 16
Layer 1: Rogue AP Detection & Suppression Rogue AP Detection» Determines whether an AP is indeed a Rogue device connected to your physical wired LAN network Rogue AP suppression» DeAuthentication Frames are sent to render unauthorized Rogue AP s unusable by clients 17
Layer 2: WIDS Wireless Intrusion Detection System WiFi protocol & RF level attack detection Detection includes attacks & vulnerabilities such as:» Weak WEP Encryption Usage» Null SSID Probes» Deauth Broadcasts» Various Management, EAP, Auth & Beacon floods 18
Layer 3-7: FortiGate UTM features Firewall VPN IPS App. Ctrl AntiVirus Web Filter AntiSpam DLP NAC Vuln Mgmt Traffic Shaping WAN opt. 2,500+ Application control signatures 12,000 Vulnerability management signatures 70 Terabytes Of Threat Samples 900 Web application firewall attack signatures 250 Million Rated websites in 78 categories 19
Layer 3-7: Traffic prioritization and performance Clients and applications on wireless networks compete with each other for shared bandwidth 802.11e Wireless Multimedia Extensions (WME) doesn't solve this problem, as Business applications like Remote Desktop, VNC, Webex, etc. are not be prioritized differently Identify Applications Policy Marking of TOS/DSCP Rate Limit Unwanted Apps FortiGate with Traffic Shaping Policy solve this problem Client #1 Client #2 20
Agenda Introduzione: - FortiGate Wireless Controller - Implementazione soluzione wireless Mai Wireless più sicuro: - Rilevazione, classificazione e risoluzione attacchi rogue - Wireless Intrusion Detection System - UTM completo Dall'AntiVirus alla nuova Protezione Avanzata delle minacce: - Nuovo sistema ATP (Advanced Threat Protection) - Sandbox Locale e in Cloud Autenticazione: - WPA, WPA2, 802.1X, PSK - Single Sign On, NTLM e portale autenticazione - Gestioni utenti Guest Modelli Access Point Fortinet: - Per uso interno ed esterno - Per l'accesso da remoto 21
From AV to ATP (Advanced Threat Protection) Antivirus flow & proxy mode Behavior / Attribute based Heuristic detection Botnet blacklist IP DB FortiOS AV Engine Provides Local Sandbox Still Suspicious Samples Sent for Cloud Sandbox Analysis Results are correlated across all FortiGuard Services Updates pushed out by FortiGuard Network 22
APT Reactive & Proactive Fighting Advanced Persistent Threats >25 VB100 Awards, VB100 RAP Leaders >96% Reactive and Proactive Detection 100% In the Wild Detection 23
Agenda Introduzione: - FortiGate Wireless Controller - Implementazione soluzione wireless Mai Wireless più sicuro: - Rilevazione, classificazione e risoluzione attacchi rogue - Wireless Intrusion Detection System - UTM completo Dall'AntiVirus alla nuova Protezione Avanzata delle minacce: - Nuovo sistema ATP (Advanced Threat Protection) - Sandbox Locale e in Cloud Autenticazione: - WPA, WPA2, 802.1X, PSK - Single Sign On, NTLM e portale autenticazione - Gestioni utenti Guest Modelli Access Point Fortinet: - Per uso interno ed esterno - Per l'accesso da remoto 24
25 Guest User Management Portal - login
26 Guest User Management Portal - New user
Guest Access to Secure Wireless LAN Temporary user Provisioning & Access o Allow non-it staff to create Guest account via web portal o Assign time quota o Generate temporary password o Distribute guest credentials: Print Email SMS o Batch guest users creation option Enables Guest Access to the Secure WLAN via a Captive Portal 27
Local users, remote and Single Sign On Local Users Remote Single Sign On: Microsoft Active Directory Novel edirectory Citrix FortiAuthenticator Radius SSO NTLM 28
BYOD Device Identification and Policy Identification Device User Application Policies Enforcement on Device/User/App 29
30 Granular Visibility and Control Applications
Agenda Introduzione: - FortiGate Wireless Controller - Implementazione soluzione wireless Mai Wireless più sicuro: - Rilevazione, classificazione e risoluzione attacchi rogue - Wireless Intrusion Detection System - UTM completo Dall'AntiVirus alla nuova Protezione Avanzata delle minacce: - Nuovo sistema ATP (Advanced Threat Protection) - Sandbox Locale e in Cloud Autenticazione: - WPA, WPA2, 802.1X, PSK - Single Sign On, NTLM e portale autenticazione - Gestioni utenti Guest Modelli Access Point Fortinet: - Per uso interno ed esterno - Per l'accesso da remoto 31
Remote Telecommuter / Road Warrior Headquarter Automatic connection to HQ Data is encrypted Multiple devices can share WiFi Internet Hotel 32
33 FAP-11C
Single Radio 802.11n 802.11n Dual Radio Dual Band 802.11AC Fortinet 802.11n AP family 3x3 Versatility FAP-320B 2x2 Performance FAP-28C FAP-222B FAP-223B FAP-221B FAP-210B 1x1 Value FAP-14C FAP-11C FAP-112B Remote Outdoor Indoor 34
FortiPlanner Planning tool» Up to 50 APs (Free)» Unlimited (Pro license) Dynamic Heat Map Site-Survey (Upgrade License) Download from: http://planner.fortinet.net/update/publish.htm 35
Why Fortinet, Why Now! Sophisticated Simplicity Unified global management All-in-one appliance Business controls High Security UTM cleansing of wireless Rogue AP control for PCI In-House Security Experts Sensible Use existing FortiGate, No additional Licenses Well rounded wireless features Less devices to manage Lower TCO 36
Webinar Fortinet Italia 12/09/2013 Grazie Dr Aldo Di Mattia, CISSP Systems Engineer Fortinet 37 September 13, 2013