Concepts

FireSight uses general terms so that the same ideas work for every firewall vendor. On Fortinet each one maps to a Fortinet term. Many FireSight screens still show the Fortinet words (for example ADOM and Policy packages), so both are given here.

Connection

A connection is how FireSight reaches your firewalls. There are three kinds today:

See Connections.

Firewall

A firewall is one physical or virtual firewall FireSight manages. Firewalls are listed under Regions & devices and Device health, and they are what the license counts.

• A high-availability (HA) cluster is one firewall, because FortiManager lists it as one device.
• Virtual domains (Fortinet: VDOMs) are not separate firewalls. They belong to the firewall they run on.

Management domain (ADOM)

A management domain is a group of firewalls managed together, with its own objects and policy sets. On FortiManager this is an ADOM.

• Each management domain is approved by one approval chain, or by the standard chain.
• On a standalone FortiGate, each VDOM appears as its own management domain, named after the firewall (for example FGT-1), or FGT-1/<vdom> when the firewall has several VDOMs.
• On FortiManager, FireSight reads each ADOM's workspace mode separately. See Connect a FortiManager.

Policy set (policy package)

A policy set is an ordered list of policies, evaluated top-down: the first matching policy wins. On FortiManager it is a policy package.

• A policy set has an installation scope: the firewalls (and VDOMs) it is installed on. The Installs to column shows it.
• On a standalone FortiGate, each VDOM has one policy set called policy.
• Policy packages inside FortiManager folders are supported; their name includes the folder.

See Policy sets and the rule stack.

Objects

Policies refer to address and service objects rather than raw addresses and ports. FireSight resolves every object, including nested groups and ranges, to the real networks and port ranges it stands for, so it knows that a group such as LAN-All covers LAN-Rome.

When FireSight deploys a rule it reuses an existing object that matches exactly, or creates a new one with a recognisable name. See Objects, services and naming.

Zones and interfaces

A policy matches traffic by its incoming and outgoing interface. FireSight works out the interface on each firewall the traffic crosses, then translates it into what the policy must name:

• an interface that belongs to a zone becomes the zone;
• an SD-WAN member becomes the SD-WAN zone;
• on FortiManager, the result is matched to the ADOM's normalised interface (dynamic interface) for that firewall. When a mapping is missing, the deployment adds it and back-out removes it again.

See Automatic placement.

Rule request and targets

A rule request describes traffic: action (accept or deny), sources, destinations, protocol and ports. It gets a reference such as FS-00042, and the policies it creates are named after it.

FireSight turns a request into one or more targets. A target is one policy in one policy set for one pair of incoming and outgoing interfaces. A request that crosses three firewalls in two management domains can have several targets. Each target has a state:

Request status

Finding

A finding is something the rule audit reports about an existing policy, or something the pre-check reports about a new one. Each finding has a type and a severity (Critical, High, Medium, Low, Info). See Finding types.

Roles

Each person has one or more roles: Requester, Team lead, Security, Change board, Implementer, Auditor and Administrator. See Users and roles.