Description | This article describes a behavior in FortiManager where, in a Firewall Policy with Source, Destination, and Service all set to 'ALL', removing the Destination field also automatically removes the Service field from the policy. |
Solution | In FortiManager, navigate to Policy & Objects -> Policy Packages, and create or edit a Firewall Policy.
When the policy is configured with Source: all, Destination: all, and Service: ALL, all three fields are populated normally as expected.
Firewall Policy with Source, Destination, and Service all set to 'all'/'ALL'.
Now, remove the Destination field from the policy (select the 'x' next to 'all' under Destination).
Once Destination is removed, the Service field is also automatically cleared/removed from the policy, and the following error is displayed:
'The IP versions in source and destination addresses or Internet Services do not match'
This happens because, in FortiManager, the Service object list is filtered/validated based on the IP version compatibility of the Source and Destination address objects.
When Destination is emptied, FortiManager can no longer validate the IP version match between Source, Destination, and the configured Service (ALL), so it clears the Service field and raises the IP version mismatch error until a valid Destination is re-added.
Solution:
To resolve this, re-add a valid Destination object (e.g., 'all') to the policy. Once a Destination is specified, the Service field can be reconfigured, and the IP version mismatch error will clear.
When editing existing Firewall Policies in a Policy Package, always verify that the Service field is still correctly configured after making any changes to the Source or Destination fields, and check the Preview before installing the Policy Package. |
