Skip to main content
michaelshi2006
michaelshi2006
New Member
January 31, 2020
Question

how to use "any" as outgoing interface in firewall poliicy

  • January 31, 2020
  • 9 replies
  • 24306 views

Hi Guys:

I am migrating a Cisco ASA to Fortigate 900D (ver6.2.3). my original ASA has one physical outside interface and 5 sub-interfaces as inside interface. while ASA only defined inbound interface in firewall rules , Fortigate will need to define in/out bound interface in firewall rules. my question is can I use "any" as the outbound interface ? so I copy cisco firewall rule one by one without extra rule needed? because some address group include ip addresses belong to different sub-interfaces.

Thanks a lot

    9 replies

    emnoc
    emnoc
    New Member
    January 31, 2020

    Not sure what you mean but you can write a policy with any as the interface for src or dst.

    e.g

     

    config firewall policy 9909

            set srcintf "any"

            set dstintf "wan1"

            set srcaddr "LOCL_LAN_GROUP"

            set dstaddr "all"

            set action accept

            set schedule all

            set service HTTP HTTPS ICMP SSH

        next

     

    I would avoid using  a "any" unless you had too. So in the above LOCL_LAN_GROUP members are allowed to wan1 for service define. Later if you had mode sub_iinterfaces, you would add te network into that address group

     

    Ken Felix

    michaelshi2006
    michaelshi2006Author
    New Member
    January 31, 2020

    Thanks emnoc for you help, can you explain why you avoid to use "any" as the inbound or outbound interface ? what is the problem if use it like that?

     I do not have NAT in any rules.

    romanr
    romanr
    New Member
    January 31, 2020

    Hey,

     

    i would really agree on not using "any" in firewall policies. Fortigates are zone based firewalls. You group your interfaces in zones and write policies like:

    srcintf INTERNAL

    dstintf EXTERNAL or DMZ and so on...

     

    Just copying rules from a ASA/Pix will bring you an unmaintainable ruleset over time. Migration is the best time for a redesign.

     

    Br,

    Roman

     

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    January 31, 2020

    I think OP was asking multiple interfaces in one policy, not multiple subnets/addresses. The immediate down-side is it would lose "interface pair view" in GUI at the Policy page. 

    While all concerns above are valid, IMO, it's up to how complex the served org is and what the purpose of 5 internal interfaces are. Depending on that, I might user a "zone" for those internal interfaces to aggregate. For example, I have more than 5 internal interfaces at home, I use a zone for some of them because there is no difference in policy. 

     

    harmesh88
    harmesh88
    New Member
    February 3, 2020

    I would suggest to do first analysis of all rule of ASA and then please do migrate to fortigate firewall configuration and do additional security top of it .

     

    If you need help you can reply on this same post

    Heyro
    Heyro
    New Member
    February 3, 2020

    Hi michael,

     

    We had the same situation in our company where we also migrated from asa to fortigate. You can use any interface in both the inbound and the outbound. This all depends on which traffic you're eventually allowing through in the source and destination and if the routes are available. Although the any interface is not recommended for security point of view.

     

    What we did is configure SD-WAN for the outside interface even though you only have 1 outside interface. In the future you can always add more interfaces to the SD-WAN

    By doing this it will automatically create a default route 0.0.0.0/0 with gateway 0.0.0.0 as interface SD-WAN. In case it doesn't create the route, you can always manually create it.

     

    Afterwards you can create multiple policies using the SD-WAN as the outbound interface and all other configured interfaces as inbound.

     

    And if your fortigate is acting as a core router to communicate between internal interfaces, then you can create different policies for each internal communication.

     

    You can also enable the feature multiple interface polcies in the GUI:

    SYSTEM->Feature visibility-> Multiple interface policies.

     

    With this you can combine both internal policies together.

     

    I hope this helps.

     

     

    michaelshi2006
    michaelshi2006Author
    New Member
    February 3, 2020

    Thank you all guys for the comment. I am going to look deeper to the original config and specify the in/out bound interface while migrating them.

    again you guys amazing.

    emnoc
    emnoc
    New Member
    February 3, 2020

     Fortigates are zone based firewalls

     

    I have to disagree, the firewall by default has no concept of a zone. It can be used a ZBFW,but out the box no zones or the requirements of zones are enforced. Zone based are typically  PaloNW, CHKP, Forcepoint ( that's even loose  with these last two ), and SRX,etc........

     

    Back to OP,  using "any" really means "any" and layer if you add specific policies and have "any" everything  will match "any". I try to always reduce the amount of "any" by being specific in rulesets.

     

    proceed with caution and monitor  the logs & hit-counts

     

    Ken Felix

     

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.