FortiManager and partially shadowed policies
Hi guys,
In our FMG I'm using policy package consistency check to check for inconsistency's withn our policies.
As for now I have troubles with one polcy where I'm getting errour about partially shadowed policies
So what did I do:
Because we wanted to block FTP and ICMP from Subnet 1 to two different hosts in our MGMT I created a rule where I'm blocking both services to those hosts...
The rules looks like this at the moment:
config firewall policy
edit 1
set srcintf "LAN"
set dstintf "MGMT"
set srcaddr "SUBNET1"
set dstaddr "IP3" "IP4"
set schedule "always"
set service "FTP""ICMP"
set logtraffic disable
set action deny
next
end
config firewall policy
edit 2
set srcintf "LAN"
set dstintf "MGMT"
set srcaddr "SUBNET1"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set action accept
next
end
Now every time I do a policy check I get an error that policy 2 is partially shadowed by rule 1
Something I don't understand.... In my first rule I'm using two host with action deny for two services while the second one allowes the all other traffic.
I know that I can disable the policy check but is there way to get around this?
Why does the FMG doesn't see that the first rule is an deny rule with two different hosts and services?
In my eyes every deny statement on top of the policy wil create partially shadowed policies.
