New Member

Solved

Fortigate 200F with multiple firewall policies on 1 interface port

12 replies
3054 views

Hi we are new to fortigate's and need a little help/advice. We are currently adjusting the security level of our firewalls to a higher level. i.e we setup up the firewall rules first, next we implemented the IPS-sensor on a interface policy. After this we added the web-filter profile to the same policy. so far so good, but when we added the AV-profile also to this interface policy a important application stopped working. We checked the security logs but there are not active blocks/messages regarding what is being blocked. We made a second interface profile and only added the AV-profile and enabled it ... the applicationn is no longer being blocked but we are thinking that second profile is not being used (see config information under)

config firewall interface-policy
edit 1
set uuid xxxxxxxx
set logtraffic all
set interface "port1"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
set ips-sensor-status enable
set ips-sensor "xxxxx all_default"
set webfilter-profile-status enable
set webfilter-profile "xxxxx-default"
next
edit 2
set uuid xxxxxxxxx
set logtraffic all
set interface "port1"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
set av-profile-status enable
set av-profile "xxxxxx-default"
next
end

Can somone please confirm that a) the firewall process's both policy 1 & 2 or only policy 1 ?
Many thanxs for any assistance in the matter

HavenstederAnswer

New Member

Hi all, the problem we have has been resolved. The issue what had was do with the definition of ALLOW vs EXEMPT. The application that was being blocked showed up earlier when we building up the rules ie the first week we turned on the IPS, the next week the web filter and the last where the issue occured the AV-profile. When we truned on the web filter the URL showed up as blocked, here we gave it a ALLOW (which have been EXEMPT) on the URL traffic. After we adjusted the setting this morning we could apply the av-oicy and the application did not break.
Thnxs to all for the use of your time (and brains)

funkylicious

SuperUser

hi,

the firewall processes the rules top to bottom, according to the flow.

src interface, dst interface, src address, dst address, port , whatever rule it will match first according to this pattern of traffic.

in your case it's most likely that the 2nd rule will never be processed since all traffic will hit and match the first one.

"jack of all trades, master of none"

HavenstederAuthor

New Member

Then if you dont mind i have another question (also to do with above).

Our first attempt with had 1 policy with also the av-profile enabled, but when we added the av-profile the application lost contact with the internet and stopped working. Usually this wouldt be a problem, just check the logs and fix whats broken. But with the enabeling for the av-profile the application stops working but we cant find in any of the security logs a reason for this (under was the original firewall interface policy)

config firewall interface-policy
edit 1
set uuid xxxxxxxx
set logtraffic all
set interface "port1"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
set ips-sensor-status enable
set ips-sensor "xxxxx all_default"
set webfilter-profile-status enable
set webfilter-profile "xxxxx-default"
set av-profile-status enable
set av-profile "xxxxxx-default"
next

Same again any help / tips are welcome..thnxs

funkylicious

SuperUser

can you share the AV profile settings?

show antivirus profile NAME that you used/applied in the policy and maybe we can figure it out.

also, you say you dont have any logs in GUI: Log & Report > Security Events > Logs > AntiVirus ?

"jack of all trades, master of none"

dingjerry_FTNT

Staff

Hi @Havensteder ,

Not sure why you are using the Interface Policy, not the regular Firewall Policy.

Anyway, they are doing the same thing: Matching policies from top to bottom. Once one firewall policy is matched, the rest of the policies will not be checked. And UTM profiles are not the elements for matching a policy. That means the Interface Policy #2 will not be matched for any traffic.

HavenstederAuthorAnswer

New Member

Hi all, the problem we have has been resolved. The issue what had was do with the definition of ALLOW vs EXEMPT. The application that was being blocked showed up earlier when we building up the rules ie the first week we turned on the IPS, the next week the web filter and the last where the issue occured the AV-profile. When we truned on the web filter the URL showed up as blocked, here we gave it a ALLOW (which have been EXEMPT) on the URL traffic. After we adjusted the setting this morning we could apply the av-oicy and the application did not break.
Thnxs to all for the use of your time (and brains)

Sign up

Login with SSO

Login to the community

Login with SSO