Next-Generation Firewall Security Implementation Lab

A secure enterprise network built in GNS3 with FortiGate VM firewalls. The lab demonstrates segmentation, high availability, site-to-site and remote-access VPNs, NAT, next-generation security profiles, a DMZ web service, and centralized FortiGate logging.

What this project demonstrates

• VLAN-based segmentation for HQ users, servers, DMZ, branch users, HA management, and VPN transit networks
• Inter-VLAN routing and least-privilege FortiGate policies between security zones
• Active-passive FortiGate HA with configuration synchronization
• Dynamic NAT/PAT, port-forwarding static NAT, DHCP, and routing
• Route-based IPsec site-to-site VPN between HQ and the branch
• SSL-VPN configuration for remote access
• IPS, Web Filtering, Application Control, and certificate inspection
• FortiGate syslog collection with Splunk on Ubuntu Server

Addressing plan

Zone	Subnet	Key address
HQ users	10.10.10.0/24	Gateway 10.10.10.1
HQ servers	10.10.20.0/24	Splunk 10.10.20.10
HQ DMZ	10.10.30.0/24	Nginx 10.10.30.10
Branch users	10.20.10.0/24	Gateway 10.20.10.1
VPN transit	172.16.255.0/30	HQ .1, branch .2
HA management	192.168.40.0/24	Primary .2, secondary .3
Lab WAN	192.168.133.0/24	HQ 192.168.133.131

Verification evidence

1. HQ primary base configuration

The base configuration provides segmented VLAN interfaces, routing, security policies, NAT, DHCP, IPsec, and NGFW inspection profiles.

2. Enable HA on the primary

The primary is running active-passive HA in group 10 and reports a healthy cluster.

3. Join the secondary to HA

The replacement secondary booted successfully, joined the cluster, and synchronized with the primary.

4. Branch firewall and IPsec

HQ and branch clients obtained DHCP leases. Traffic passed in both directions after the IPsec tunnel negotiated.

5. Splunk syslog

FortiGate sends UDP syslog from 10.10.20.1 to port 5514. The Ubuntu receiver is active and real FortiGate events are arriving for Splunk ingestion.

6. SSL-VPN

The remote-access user group, tunnel address pool, portal, and SSL-VPN-to-HQ policy are configured.

7. DMZ web service

The Ubuntu DMZ server uses 10.10.30.10/24; Nginx is active and returns HTTP 200 OK internally.

8. DMZ static NAT

The VIP maps WAN TCP port 8080 to Nginx on 10.10.30.10:80, and the FortiGate can reach the DMZ host.

Requirements

• GNS3 2.2.x and the GNS3 VM with enough RAM for the selected nodes
• FortiGate VM/KVM 7.0.x appliance installed in GNS3
• Ubuntu Server 24.04 for the DMZ and Splunk nodes
• Splunk Enterprise for Linux

FortiGate, Ubuntu, Splunk, and other appliance images are intentionally not included. Obtain and license them from their official publishers.

Quick start

1. Import project/FortiGate-NGFW-Lab.gns3 into GNS3 and resolve nodes against your installed appliance templates.
2. Start the switches and FG-HQ, then apply configs/01_FG-HQ_PRIMARY_BASE.conf.
3. Apply configs/02_FG-HQ_PRIMARY_ENABLE_HA.conf to the primary.
4. Start FG-HQ-SECONDARY and apply configs/03_FG-HQ_SECONDARY_JOIN_HA.conf.
5. Start the branch nodes and apply configs/04_FG-BRANCH.conf.
6. Configure the HQ and branch VPCS clients with ip dhcp and test the IPsec tunnel.
7. Build the DMZ server with configs/07_DMZ_WEB_SERVER_SETUP.md.
8. Apply configs/08_FG-HQ_DMZ_STATIC_NAT.conf after Nginx responds internally.
9. Install the UDP receiver described in splunk/README.md, then apply configs/05_FG-HQ_Splunk_Syslog.conf.
10. Apply configs/06_FG-HQ_SSL-VPN.conf after VLAN, HA, and IPsec tests pass.

Lab credentials

These are deliberately simple, public, lab-only credentials. Do not reuse them outside an isolated practice environment.

Account	Username	Password
FortiGate administrator	admin	FortiLab123!
Ubuntu servers	labadmin	FortiLab123!
Splunk administrator	admin	FortiLab123!
SSL-VPN user	labvpn	FortiLab123!
HA cluster key	—	FortiLab-HA-2026
IPsec pre-shared key	—	FortiLab-IPsec-2026

Verified status and limitation

HA synchronization, DHCP, bidirectional IPsec traffic, Nginx, internal DMZ reachability, NGFW profiles, and FortiGate syslog delivery were verified. Static NAT and SSL-VPN are configured. A live external Internet/FortiClient test still requires selecting and mapping the correct GNS3 Cloud/NAT adapter on the machine importing the project; that host-specific mapping is not portable in a .gns3 file.

Repository layout

configs/          FortiGate configuration stages and DMZ instructions
docs/screenshots/ Topology plus one verification image for each config stage
project/          Portable GNS3 topology file (no appliance images)
splunk/           UDP 5514 receiver and Splunk monitor configuration