Skip to main content
johnlloyd_13
johnlloyd_13
Explorer III
February 1, 2025
Solved

Forticonverter Question

  • February 1, 2025
  • 4 replies
  • 1019 views

hi,

i have a licensed forticonverter and converted a cisco ASA config.

the ASA config had only basic LAN, WAN, no NAT, and "inbound" ACL (internet > WAN) applied on the WAN/outside.

my question:

1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?

2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?

 

config firewall security-policy
edit 1
set srcintf "port 1"   <<< WAN/outside
set dstintf "any"
set srcaddr "all"
set enforce-default-app-port disable
set dstaddr "all"
set service "echo-reply"
set schedule "always"
set logtraffic disable
set status enable
set action accept
set comments "access-list acl_outside extended permit icmp any any echo-reply"
next
edit 2
set srcintf "port 1"    <<< WAN/outside
set dstintf "any"
set srcaddr "all"
set enforce-default-app-port disable
set dstaddr "all"
set service "time-exceeded"
set schedule "always"
set logtraffic disable
set status enable
set action accept
set comments "access-list acl_outside extended permit icmp any any time-exceeded"
next

next
edit 3
set srcintf "port 1"   <<< WAN/outside
set dstintf "any"
set srcaddr "h-196.1.1.98"
set enforce-default-app-port disable
set dstaddr "all"
set service "ALL"
set schedule "always"
set logtraffic disable
set status enable
set action accept
set comments "access-list acl_outside extended permit ip host 196.1.1.98 any"

Best answer by Dhruvin_patel

Greetings!

 

1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?

> Yes it is needed to allow the traffic from LAN to WAN and If you want to allow all outbound traffic from the LAN to the WAN, you can create a more general policy that allows all services and all source addresses to any destination. This would cover all outbound traffic without the need for specific policies for each type of traffic.

 

2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?

>  No you don't need reverse policy. It is a statefull firewall, monitors the state of connections and makes determinations on what sorts of data packets belonging to a known active connection are allowed to pass through the firewall.

 

Regards!

4 replies

Dhruvin_patel
Staff
Dhruvin_patelAnswer
Staff
February 1, 2025

Greetings!

 

1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?

> Yes it is needed to allow the traffic from LAN to WAN and If you want to allow all outbound traffic from the LAN to the WAN, you can create a more general policy that allows all services and all source addresses to any destination. This would cover all outbound traffic without the need for specific policies for each type of traffic.

 

2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?

>  No you don't need reverse policy. It is a statefull firewall, monitors the state of connections and makes determinations on what sorts of data packets belonging to a known active connection are allowed to pass through the firewall.

 

Regards!

    dingjerry_FTNT
    Staff
    dingjerry_FTNT
    Staff
    February 1, 2025

    Hi @johnlloyd_13 

     

    1. "do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?"

     

    This depends on your requirements.

     

    If you need to allow a LAN network to access the Internet, yes, you need an outbound firewall policy to allow it. 

     

    And if there is no other devices doing NAT in front of this FGT, you have to enable NAT as well in this outbound firewall policy. 

     

    For Service, you name it.  If you don't know what Services you can allow, you may use "ALL" service object.

     

    2. "do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?"

     

    Again, it depends on your requirements.

     

    For example, if you have an internal web server for Internet users to access, of course, you need an inbound firewall policy.  If this internal web server has a private IP on the LAN network, you may need to apply VIP for this inbound firewall policy.

     

    Here is the KB about VIP configuration on FGT if you don't know how:

     

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

      johnlloyd_13
      johnlloyd_13Author
      Explorer III
      February 2, 2025

      appreciate your feedback! this makes me more confident in my ASA to FGT migration.

      TinaDouglas
      TinaDouglas
      New Member
      February 11, 2025

      Yes, an outbound policy is needed for all traffic, but a reverse policy isn't always required.

      Terms & ConditionsAccessibility statement