find out what policy is going to be followed

Hello, 

Please find the below reference.

FGT_A # diagnose firewall iprope lookup 10.234.3.55 0 1.1.1.1 53 17 port1
<src [10.234.3.55-0] dst [1.1.1.1-53] proto 17 dev port1> matches policy id: 4

FGT_A #
FGT_A #
FGT_A #
FGT_A # sh firewall policy 4
config firewall policy
edit 4
set name "Inside"
set uuid 94ad437a-8e6a-51ec-1fda-92296035bf7d
set srcintf "port1"
set dstintf "port3"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set inspection-mode proxy
set ssl-ssh-profile "deep-inspection"
set nat enable
set comments " (Copy of Internet)"
next
end

FGT_A #

We also do have a GUI tool for policy lookup:

https://docs.fortinet.com/document/fortigate/6.2.10/cookbook/497952/policy-views-and-policy-lookup

Any other option to make it work through CLI?

I'm still investigating.

Analyzing the types of policies, It seems that these are the codes of the services:

For the service named ALL
service(1):
[0:0x0:0/(0.65535)->(0.65535)] helper:auto
0=all

for ALL_ICMP
service(1):
[1:0x0:0/(0.65535)->(0.65535)] helper:auto
1=ICMP

for HTTP
service(1):
[6:0x0:0/(1.65535)->(80.80)] helper:auto
6=TCP

for SNMP
service(1):
[17:0x0:0/(1,65535)->(161,162)] helper:auto
17=UDP

If I do it via GUI with Policy Lookup:

(Source Interface -> port36
Protocol -> ICMP ping request
Source -> 1.1.1.1
Destination -> 2.2.2.2)

It works fine showing me the rule where I let ping pass.

If I make a show of that policy, it shows me:

Fortigate# show firewall policy XXXX
config firewall policy
edit XXXX
set uuid xxxxxxxxxxxxxxxxxxxxxxxxxxxx
set srcintf "port35"
set dstintf "port36"
set srcaddr "all"
set dstaddr "xxxxxxxxxxxxxxx"
set action accept
set schedule "always"
set service "ALL_ICMP"
set comments "xxxxxxxxxxxxxxxxxxxxx"
next
end

If I list it, the service it indicates is indeed "all_icmp":

policy index=XXXX uuid_idx=XXXX action=accept
flag (8010000): master pol_stats
flag2 (4000): resolve_sso
flag3 (20):
schedule(always)
cos_fwd=255 cos_rev=255
group=00100004 av=00000000 au=00000000 split=00000000
host=0 chk_client_info=0x0 app_list=0 ips_view=0
misc=0 dd_type=0 dd_mode=0
zone(1): 12 -> zone(1): 11
source(1): 0.0.0.0-255.255.255.255, uuid_idx=x,
dest(1): XXX.XXX.XXX.XXX-XXX.XXX.XXX.XXX, uuid_idx=x,
service(1):
[1:0x0:0/(0,65535)->(0,65535)] helper:auto

But I can't get it to point to the same policy when I run with cli:

diag firewall iprope lookup 1.1.1.1 51778 2.2.2.2 any all_icmp port35 (result: another rule)
diag firewall iprope lookup 1.1.1.1 51778 2.2.2.2 0 ALL_ICMP port36 (result: same wrong rule)
diag firewall iprope lookup 1.1.1.1 51778 2.2.2.2 0 1 port36 (result: Command fail. Return code -16)

any other expert?

ICMP is protocol 1 but it does not use ports. The various functions use a type ID inside the packet, for example 'ping request' is protocol 1, type 8.

It looks like the diag command does not cope with subtypes or portless protocols. You can make it work if you add "1:" as protocol, but I will take no responsability for the result.

I have already tried it, and as soon as you enter "1" as protocol, it generates an error. (Command fail. Return code -16)

Interestingly only protocol#=1 doesn't seem to work, while 0, 2, 3, 4... show me a policy ID. Is this a bug? I'm running 6.4.8 on FG60E.

Toshi

Hey guys,

it took some digging, but I found something:

#dia firewall iprope lookup <source IP> 1234 <dst IP> 1/133 icmp <source interface>

-> this returns the correct policy for me.

I couldn't find WHY the iprope lookup command needs to use this exact syntax, I just found an example buried in some old internal documentation, but it does return the correct result at least in my lab (on 7.0); the documentation I found was for a 6.0 setup, so I would assume that any firmware in between should also return a result.

Based on my a little more exhaustive test,

- In case of "icmp" or protocol "1", destination port area needs to be in "xxx/yyy" format. '/' is necessary.

- for the protocol area you can use either name or number like below examples.

xxxx-fg1 # diag firewall iprope lookup 10.68.0.103 1234 8.8.8.8 1/13 icmp internal2
<src [10.68.0.103-1234] dst [8.8.8.8-1/13] proto icmp dev internal2> matches policy id: 2

xxxx-fg1 # diag firewall iprope lookup 10.68.0.103 1234 8.8.8.8 113 icmp internal2
Command fail. Return code -16

xxxx-fg1 # diag firewall iprope lookup 10.68.0.103 12345 8.8.8.8 0/0 1 internal2
<src [10.68.0.103-12345] dst [8.8.8.8-0/0] proto 1 dev internal2> matches policy id: 2

xxxx-fg1 # diag firewall iprope lookup 10.68.0.103 12345 8.8.8.8 53 udp internal2
<src [10.68.0.103-12345] dst [8.8.8.8-53] proto udp dev internal2> matches policy id: 2

xxxx-fg1 # diag firewall iprope lookup 10.68.0.103 55555 8.8.8.8 53 17 internal2
<src [10.68.0.103-55555] dst [8.8.8.8-53] proto 17 dev internal2> matches policy id: 2

<edit>

Above test was not enough to prove protocol number is actually working. So added a new policy 26 above policy 2 then tested below to prove it.

xxxx-fg1 # diag firewall iprope lookup 10.68.0.103 55555 8.8.8.8 53 17 internal2
<src [10.68.0.103-55555] dst [8.8.8.8-53] proto 17 dev internal2> matches policy id: 26

xxxx-fg1 # diag firewall iprope lookup 10.68.0.103 55555 8.8.8.8 53 udp internal2
<src [10.68.0.103-55555] dst [8.8.8.8-53] proto udp dev internal2> matches policy id: 26

Toshi