Skip to main content
James_G
James_G
New Member
December 23, 2019
Question

"Block intra-zone traffic" on SD-WAN interface

  • December 23, 2019
  • 1 reply
  • 5944 views

On a normal zone you have the option to enable or disable "Block intra-zone traffic"

 

Whats the default behavior on an SD-WAN interface and is this configurable?

    1 reply

    emnoc
    emnoc
    New Member
    January 2, 2020

    What do you mean normal zone & SDWAN? If you have a zones  than traffic is allowed by the policies that your create. Can you explain what intra-zone you have? and the issues ? or a topology ?

     

    Ken Felix

    James_G
    James_GAuthor
    New Member
    January 2, 2020

    In a zone you can either allow or deny traffic between interfaces that are a member of the same zone - "set intrazone deny/allow" - this does not hit any policy and is impossible to configure a policy other then the allow / deny.

     

    An example of this would be if you have an "edge networks" zone with interfaces "edge floor 1" and "edge floor 2" *not totally different to my real world*! If you set intrazone allow then network between floor 1 and floor 2 is totally open.

     

    The same is true for SD-WAN interfaces, except the option to set intrazone deny/allow is not valid, I have checked with support and the default option (and only option) is to allow traffic between SD-WAN members without any policy. So for example if you have an ISP and a VPN tunnel as SD-WAN members, the Fortigate will openly route traffic between VPN to ISP and ISP to VPN without any policy checking. it's just an open router, with the only protection being NAT.

    emnoc
    emnoc
    New Member
    January 2, 2020

    So you have a SDWAN and it's in a zone? What traffic are suspecting that is open in that SDWAN members? Can't you craft a policy that says src/dst-zone deny? BTW , never heard anyone calling up a virtaual-wan in a zone to begin with.

     

    Ken Felix

    Terms & ConditionsAccessibility statement