config system global
    set hostname FGT-CORP-01
    set admintimeout 480
    set admin-https-redirect disable
end

config system admin
    edit "admin"
        set accprofile "super_admin"
        set password admin123
        set trusthost1 0.0.0.0 0.0.0.0
    next
    edit "svc-monitor"
        set accprofile "super_admin"
        set password Welcome1!
    next
end

config system interface
    edit "wan1"
        set vdom "root"
        set ip 203.0.113.20 255.255.255.248
        set allowaccess ping https http ssh telnet
        set type physical
    next
    edit "internal"
        set vdom "root"
        set ip 10.10.0.1 255.255.255.0
        set allowaccess ping https ssh
        set type physical
    next
    edit "dmz"
        set vdom "root"
        set ip 10.20.0.1 255.255.255.0
        set allowaccess ping https ssh
        set type physical
    next
end

config system ntp
    set ntpsync disable
end

config log syslogd setting
    set status disable
end

config vpn ipsec phase1-interface
    edit "TO-BRANCH-OFFICE"
        set interface "wan1"
        set ike-version 1
        set proposal des-md5 3des-sha1
        set dhgrp 1
        set authmethod psk
        set psksecret BranchVPN2024
        set aggressive-mode enable
    next
end

config vpn ssl settings
    set servercert "self-sign"
    set idle-timeout 0
    set port 10443
    set source-interface "wan1"
end

config firewall policy
    edit 1
        set name "Allow-Internal-to-Internet"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 2
        set name "DMZ-to-Internet"
        set srcintf "dmz"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 3
        set name "Allow-RDP-Inbound"
        set srcintf "wan1"
        set dstintf "dmz"
        set srcaddr "all"
        set dstaddr "10.20.0.5"
        set action accept
        set schedule "always"
        set service "RDP"
    next
end

config system snmp sysinfo
    set status enable
end

config system snmp community
    edit 1
        set name "public"
        set query-v1-status enable
        set query-v2c-status enable
    next
end

config firewall address
    edit "Sanctioned-Countries"
        set type ipmask
        set subnet 0.0.0.0 0.0.0.0
    next
end

config webfilter profile
    edit "default"
        set options block-invalid-url
    next
end

# Antivirus profile not applied to internet-facing policies
# Geo-IP / sanctioned country blocking not configured
# IPS profile not applied to any policy
# Two-factor authentication not configured for admin accounts
# Trusted-hosts not configured for admin accounts