[FortiOS 6.4.2] icmp any any

Question

Hello,

I have some Fortigate 200E in my lab for testing.

Instead of putting several lines of policy, I use "set srcintf any" and "dstintf any" to configure the icmp policy.

As a result, only one line is enough.

In GUI, ANY didn't appear in incoming/outgoing interface, so I did it using CLI.

But after that, the "INTERFACE PAIR VIEW" was unavailable.

I'd like to know:

- is it a best practice using ANY instead of selecting a particular interface?

- ANY does appear in another Fortigate with the same firmware and model, why it didn't in this one?

- is it a normal behavior that INTERFACE PAIR VIEW becomes grayed? I found this VIEW helpful sometimes.

Thank you for your reply.

lobstercreed · Answer

fat wrote:I'd like to know:- is it a best practice using ANY instead of selecting a particular interface?- ANY does appear in another Fortigate with the same firmware and model, why it didn't in this one?- is it a normal behavior that INTERFACE PAIR VIEW becomes grayed? I found this VIEW helpful sometimes.  [ul]I would not say that that is a best practice, no.  In my opinion it is far more confusing BECAUSE it causes the behavior you are also unhappy with (you lose interface pair view).In the other FortiGate you have probably enabled Multiple Interface Policies under System -> Feature Visibility See also: https://kb.fortinet.com/kb/documentLink.do?externalID=FD46771 Yes, this is a direct consequence of using multiple interfaces (or any) as a source or destination in a single policy.  What you save in multiple policies you lose in ease of looking at interface pairs.  I guess it depends on your use case, but I am currently happier to duplicate policies than to lose interface pair view.[/ul]

Sign up

Login with SSO

Login to the community

Login with SSO