Fortigate 90D v6.0.9 no filter enabled to icmp

Question

current F 90D version is 6.0.9 build0335, this FW works as UTM, wan primary ip is private and secondary ip is the public routed throughout the private ip to reach internet, all filters to current public ip (set as secondary) are enabled to allow only from our network and if no allow rule is enabled by default all sessions to Fortigate Iitself should be dropped ( but some how icmp is still available from everywhere) . Following is debug output:

2024-05-10 15:19:10 id=20085 trace_id=58 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, xxxPublicIcmpSourceIp:6164->xxxPublicWanIpxxx:2048) from wanvlanxxx. type=8, code=0, id=6164, seq=1."
2024-05-10 15:19:10 id=20085 trace_id=58 func=init_ip_session_common line=5619 msg="allocate a new session-00767dad"
2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_dnat_check line=4921 msg="in-[wanvlanxxx], out-[]"
2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_dnat_tree_check line=812 msg="len=0"
2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_dnat_check line=4934 msg="result: skb_flags-00800000, vid-0, ret-no-match, act-accept, flag-00000000"
2024-05-10 15:19:10 id=20085 trace_id=58 func=vf_ip4_route_input line=1604 msg="find a route: flags=80000000 gw-xxxWanPublicIPxxx via root"
2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_in_check line=423 msg="in-[wanvlanxxx], out-[], skb_flags-00800000, vid-0"
2024-05-10 15:19:10 id=20085 trace_id=58 func=__iprope_check line=1989 msg="gnum-100011, check-f8af5940"
2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_policy_group_check line=4333 msg="after check: ret-no-match, act-drop, flag-00000000, flag2-00000000"
2024-05-10 15:19:10 id=20085 trace_id=58 func=__iprope_check line=1989 msg="gnum-100001, check-f8af50f8"
2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_policy_group_check line=4333 msg="after check: ret-no-match, act-accept, flag-00000000, flag2-00000000"
2024-05-10 15:19:10 id=20085 trace_id=58 func=__iprope_check line=1989 msg="gnum-10000e, check-f8af50f8"
2024-05-10 15:19:10 id=20085 trace_id=58 func=__iprope_check_one_policy line=1747 msg="checked gnum-10000e policy-4294967295, ret-no-match, act-accept"

10 15:11:45 id=20085 trace_id=56 func=__iprope_check_one_policy line=1747 msg="checked gnum-10000f policy-4294967295, ret-matched, act-accept"
2024-05-10 15:11:45 id=20085 trace_id=56 func=__iprope_check_one_policy line=1960 msg="policy-4294967295 is matched, act-accept"
2024-05-10 15:11:45 id=20085 trace_id=56 func=__iprope_check line=2008 msg="gnum-10000f check result: ret-matched, act-accept, flag-00000000, flag2-00000000"
2024-05-10 15:11:45 id=20085 trace_id=56 func=iprope_policy_group_check line=4333 msg="after check: ret-matched, act-accept, flag-00000000, flag2-00000000"
2024-05-10 15:11:45 id=20085 trace_id=57 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, xxxPublicSecondaryIpxxx:31976->xxxIcmpTestSource:0) from local. type=0, code=0, id=31976, seq=1."
2024-05-10 15:11:45 id=20085 trace_id=57 func=resolve_ip_tuple_fast line=5535 msg="Find an existing session, id-007678c3, reply direction"

AEK · Accepted Answer

Traffic that is destined to FortiGate itself is not managed by firewall policies, but by local-in-policies.

So you can create a local-in-policy to allow specific sources to ping your FortiGate.

E.g.:

config firewall local-in-policy
 edit 1
  set intf "wan1"
  set srcaddr "g-allowed-group"
  set srcaddr-negate enable
  set dstaddr "all"
  set service "PING"
  set schedule "always"
  next
end

Ref:

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/363127/local-in-policy

AEK · Answer

If I'm not wrong this debug log shows a ping from outside to your WAN interface.

If I understand your concern you want your FG not to reply to external echo requests, right? Then you just need to disable "Ping" on your WAN interface. Or did I misunderstand your concern?

Sign up

Login with SSO

Login to the community

Login with SSO