General Policy Question

Forum|Forum|6 years ago
January 13, 2020
8 replies
6215 views

Hi there,

I'm trying to learn the policy setup of fortigate product. Can anyone tell me why I need some specific policy for allowing traffic? I saw some allowing policies in my current environment has specific source and destination ip address (assuming all settings are same except source and destination). Why cannot allowing "all" source to "all" destination policy take care of the traffic? Thank you.

neonbit

New Member

You can certainly create an all > all policy to match everything, but in the security world this is not best practice. Ideally should only create policies/enable access for as specific IP and services as possible.

polarpandaAuthor

Explorer

neonbit wrote:
You can certainly create an all > all policy to match everything, but in the security world this is not best practice. Ideally should only create policies/enable access for as specific IP and services as possible.

Thank you for the answer Neonbit. Now I'm confused that an issue I encountered. We need a v server connects to an external ip address. We do have the policy of "all" to "all" from inside to outside. The traffic flow wasn't stable, it's on and off, and super slow. But as soon as I created a specific policy for this task. The issue was gone. Do you know the reason?