FGT VIP and Firewall Policy Order

Hello John

For VIP configuration, you can follow below kb articles:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

Fortigate performs Destination NAT lookup first then do a policy match and then only source NAT rules comes in to picture, so ideally the order based on the DNAT/SNAT based policies are not going to make any difference.

You may place the policies that is expected to have high number of hits on top , this can help in scenarios where a session re-validation is required.

Below document explains the packet flow in FGT.
https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/86811/packet-flow-ingress-and-egress-fortigates-without-network-processor-offloading

hi,

thanks for your responses! appreciate it.

one last question, if i got 2x interfaces (using private IP) in FGT that would need to communicate, do i just create 2x FW policy (only allowing specific service, i.e. 443, 53, icmp): one outbound and one inbound WITHOUT NAT?

i.e, port 1: 192.168.1.0/24 <> FGT <> port 2: 172.16.1.0/24