Exempt traffic/public IP subnet for FW Policy inspection

Obviously Rule#1's Source and Destination addresses are reversed.

Toshi

To create a top-most firewall policy on a FortiGate to exempt/bypass inspection for a selected public IP host or subnet (e.g., for troubleshooting or logging purposes), your approach can vary depending on the direction of the traffic and whether it is inbound or outbound. Here's a breakdown of the logic:

1. Key Considerations
Inbound traffic: This is traffic initiated from the Internet towards your internal resources.
Outbound traffic: This is traffic initiated from your internal network towards the Internet.
The source address and destination address depend on the direction of traffic you want to exempt from inspection.

2. General Rule Logic
Inbound Traffic Exemption (From Internet to Internal Network)
Source Address: Public IP or subnet of the external client/device initiating the traffic (e.g., exempted-traffic-subnet).
Destination Address: Public IP or internal mapped IP of your FortiGate or servers behind it.
Action: Accept (or deny if needed for troubleshooting).
NAT: Disabled (unless you require SNAT).
Inspection: Set profiles to "None" to bypass inspection.
Example:
Source: exempted-traffic-subnet
Destination: internal-server (mapped public IP or real IP)
Schedule: Always
Action: Accept
Profiles: None
Outbound Traffic Exemption (From Internal Network to Internet)
Source Address: Internal subnet/IP of the device generating the traffic.
Destination Address: Public IP/subnet you want to exempt (e.g., exempted-traffic-subnet).
Action: Accept.
NAT: Enabled (to masquerade internal traffic as the FortiGate's WAN IP).
Inspection: Set profiles to "None" to bypass inspection.
Example:
Source: internal-network
Destination: exempted-traffic-subnet
Schedule: Always
Action: Accept
Profiles: None
3. For Both Directions (Bi-Directional Exemption)
If you need to exempt the same exempted-traffic-subnet for both inbound and outbound traffic:
Create two separate rules:
One for inbound traffic.
One for outbound traffic.
Alternatively, create a single rule covering both directions by defining both source and destination as exempted-traffic-subnet. This works if the same subnet is both the source (outbound) and destination (inbound).
4. Example Rule Placement
Place the exemption rule at the top of the policy list to ensure it is evaluated first.
Subsequent rules will not apply to traffic matching this exemption rule.
5. Verification
Use FortiGate's logging to ensure traffic matches the exemption rule:
diagnose debug flow
Monitor real-time logs in Log & Report > Traffic Logs to confirm the traffic bypasses inspection.