Skip to main content
leo82
leo82
Explorer
January 3, 2023
Solved

firewall "local-in-policy" default action denied?

  • January 3, 2023
  • 4 replies
  • 6794 views

I understand that the default action is deny unless explicitly declared in the fortigate firewall policy.

Does this apply to 'local-in-policy' as well?

 

Example)

 

config firewall local-in-policy

edit 1

  • set uuid 0000000
  • set int "port1"
  • set srcaddr "Block Address group"
  • set dstaddr "all"
  • set service "TCP_22"
  • set schedule "always"

next

end

Best answer by Toshi_Esumi

If you are asking about the default value in "set action" under edit 1 or any others, you just need to see it with "show full" or "get" in the context. The default value is "deny".

 

But if you are asking the default behavior when you don't have any local-in-policies, it's "allow all" by default. So you have to deny something within a set of local-in-policies to be effective.

 

Toshi

4 replies

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
January 3, 2023

If you are asking about the default value in "set action" under edit 1 or any others, you just need to see it with "show full" or "get" in the context. The default value is "deny".

 

But if you are asking the default behavior when you don't have any local-in-policies, it's "allow all" by default. So you have to deny something within a set of local-in-policies to be effective.

 

Toshi

    leo82
    leo82Author
    Explorer
    January 4, 2023

    Thank you for your answer.

     

    Then, if "local-in-police" is enabled, can I understand that the default action becomes deny even if I do not explicitly declare "set action deny"?

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    January 4, 2023

    See below and you can do the same.

    xxxx-fg1 (local-in-policy) # edit 1

    xxxx-fg1 (1) # show
    config firewall local-in-policy
    edit 1
    set uuid e38fad9c-6058-51ec-c276-40ac6c2faaed
    set intf "LocalInternet"
    set srcaddr "China_sources"
    set dstaddr "Comcast_outside"
    set service "HTTPS" "HTTP" "SSH" "TELNET"
    set schedule "always"
    next
    end

    xxxx-fg1 (1) # show full
    config firewall local-in-policy
    edit 1
    set uuid e38fad9c-6058-51ec-c276-40ac6c2faaed
    set ha-mgmt-intf-only disable
    set intf "LocalInternet"
    set srcaddr "China_sources"
    set dstaddr "Comcast_outside"
    set action deny
    set service "HTTPS" "HTTP" "SSH" "TELNET"
    set schedule "always"
    set status enable
    set comments ''
    next
    end

     

      leo82
      leo82Author
      Explorer
      January 4, 2023

      I understand what you mean.
      Thank you for your kind explanation.

       

      Happy New Year.

      Terms & ConditionsAccessibility statement