Skip to main content
eberrick
eberrick
New Member
February 13, 2020
Question

Firewall Policy 0 Blocking all outgoing traffic from LAN

  • February 13, 2020
  • 2 replies
  • 11542 views
Dear All, My company recently purchased a new FG 200E, my first Fortigate Box . I am having a challenge getting the box to work . My traffic flows from the internal network through through the 192.168.5.1/255.255.255.0 on the LAN interface (port1) with IP : 192.168.5.5 The outgoing WAN traffic is on the WAN 1 : x.x.x.x/25 network on interface wan 1 with IP x.x.x.x Wireless Guest users are on the 172.10.0.0 network on interface port5 . ( the wireless interface is set as the dhcp server for wireless users. On the Wifi interface, there is internet partially to some users and others also get blocked. Troubleshooting so far : I have created Internet, Mobile, Admin , Wireless policies . But traffic from the LAN is blocked by Policy0 Implicit Deny - Violation I have also changed the lan port to other ports and the behavior is still the same . Upgraded device firmware . I would really appreciate your suggestions . Thank you. Ernest - Certified Fortigate Newbie :)

    2 replies

    ShawnZA
    ShawnZA
    New Member
    February 13, 2020

    If it's hitting policy 0 then it skipped the policies you created.... can you paste the cli config of said policies here?

     

     

     

     

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    February 13, 2020

    some hints:

    - policies are checked from top to bottom. First policy matching source interface, destination interface, source address, dest. address, service and schedule is followed, all policies below are skipped.

    Thus, if your traffic hits policy 0, no policy matched.

    - outbound policies need to have NAT enabled (simple NAT to interface address will do).

    emnoc
    emnoc
    New Member
    February 13, 2020

    I have to agree with  Shawn,

     

    Change policyid2

     

    config firewall policy edit 2   set name "LAN-WAN"   set srcintf "port2" "port1" "port5"

    end

     

    And test, it should work

     

    Ken Felix

    eberrick
    eberrickAuthor
    New Member
    February 13, 2020

    Please see below config of firewall policy

     

    FG200ETK18919297 # show firewall policy config firewall policy edit 2 set name "LAN-WAN" set uuid 47894160-4d72-51ea-c7e1-b3c06cb7f32e set srcintf "port2" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set utm-status enable set logtraffic all set auto-asic-offload disable set fsso disable set av-profile "default" set webfilter-profile "Parliament Web Filter" set application-list "Parliament Application Profile" set ssl-ssh-profile "certificate-inspection" set nat enable next edit 5 set name "Wireless" set uuid d78312f0-4d8b-51ea-b239-f184939e4d36 set srcintf "port5" set dstintf "wan1" set srcaddr "Wireless_Guests" set dstaddr "all" set action accept set schedule "always" set service "DNS" "HTTP" "HTTPS" set utm-status enable set logtraffic all set fsso disable set devices "Mobile Devices" set av-profile "wifi-default" set webfilter-profile "Parliament Web Filter" set dnsfilter-profile "default" set application-list "Parliament Application Profile" set ssl-ssh-profile "certificate-inspection" set nat enable next edit 4 set name "Mobile" set uuid 11dcfd52-4d79-51ea-044e-8fec29ede457 set srcintf "port2" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "DNS" "HTTP" "HTTPS" set utm-status enable set logtraffic all set fsso disable set devices "Mobile Devices" set webfilter-profile "default" set ssl-ssh-profile "certificate-inspection" set nat enable next end

    FG200ETK18919297 #

    ShawnZA
    ShawnZA
    New Member
    February 13, 2020

    In your first post you said "My traffic flows from the internal network through through the 192.168.5.1/255.255.255.0 on the LAN interface (port1) with IP : 192.168.5.5"

     

    So is port1 your internal interface?

     

    Your policies shows port 2 and not port 1.... except the wireless one where it shows port5 to wan1

     

    So if port1 is your internal interface then change the policies to reflect port1 as the incoming port... so fix that first, then it should work. Both those rules allows "all" as source, you need to lock them down to the ranges or else only one policy will be used as well, lock them down to source IP ranges on incoming port1

     

     

    FG200ETK18919297 # show firewall policy config firewall policy edit 2 set name "LAN-WAN" set uuid 47894160-4d72-51ea-c7e1-b3c06cb7f32e set srcintf "port2" set dstintf "wan1" set srcaddr "all" set dstaddr "all"

     

     

    Terms & ConditionsAccessibility statement