Technical Tip: How to remove existing local in policies from the FortiGate GUI

Description

This article describes the procedures for deleting the local-in policies currently displayed on the FortiGate GUI.

Scope

FortiGate.

Solution

'Local in policies' regulate the traffic and services that are dedicated to FortiGate interfaces, in contrast to standard firewall policies. To have precise control over the services, source, and destination addresses: administrators can design a custom local-in policy to allow or deny the particular traffic.

Be aware that the creation or editing of custom local-in policies can only be done via the CLI for FortiOS v7.4 and below. 

This article only applies to the existing local in policies that are displayed on the GUI after enabling the additional feature 'Local In Policy' under System -> Feature Visibility. By turning on 'Local In Policy' under System -> Feature Visibility -> Additional Features, administrators can view (with read-only access) the existing local-in policies in the GUI. 

The system generated local-in policies can be viewed from the GUI. It cannot be deleted from the GUI or the CLI since they are bound to corresponding interface-related configuration. 

For instance, port1 is open for PING, HTTP, HTTPS, SSH, and TELNET access. It is possible to view the corresponding local-in policies under the Policy & Objects -> Local In Policy as below.

There is no direct method to remove the existing local in-policies from the GUI. These local-in policies can be removed only by changing their corresponding configuration in port1 interface.

From the GUI, uncheck the enabled protocol under Network -> Interface -> Edit Interface -> Administrative Access.

For example, TELNET has been unchecked from port1 administrative access protocols.

It is now possible to observe that the local-in policy for TELNET application towards port1 has been removed under 'Local In Policy'.

The interface-level administrative access protocols can also be configured via the CLI:

config system interface
    edit port1
        set allowaccess ping http https <---- Removed SSH protocol under port1 interface.

    next

end

It is now possible to observe that the SSH application towards port1 has been removed under 'Local In Policy'.

Note:

Starting from FortiOS v7.6, local-in policy can be configured from both the GUI and CLI: GUI support for local-in policies.

The following is an example of a policy created from the GUI in v7.6 to allow traffic from geo-location on all services traffic from:

• The interface will be the incoming WAN, which is port1 in the example. For the source, choose a specific address or geo-location.

The following is an example of deleting the local in policy:

To delete the local in policy, navigate to Policy&object -> Local-in-policy, choose the desired policy, and select Delete.

Related article:
Technical Tip: Creating a Local-In policy (IPv4 and IPv6) on GUI