Description
This article describes how to configure a 'custom service' in FortiOS.
In Fortinet terminology, a Custom Service is a user defined service that has not already been created. A service can be thought of as a Traffic type and will include the service protocol type, TCP, UDP or ICMP for example, as well as the logical destination ports.
This article describes the steps required in configuring a new 'custom' service. This includes the destination port as well as the transport layer protocol used (TCP, UDP).
In this example, the new service will be called 'My Service'.
In this example, the new service will be called 'My Service'.
Scope
Applies to FortiGate in NAT mode or Transparent mode.
Solution
To create a custom service using the FortiGate GUI:
-
Go to: Policy & Objects -> Services.
-
Select Create New.
-
Enter a name for the service, choose a Category (if desired), and select a Protocol Type. In this example, TCP/UDP/SCTP is selected.
- Define the IP Range or FQDN. Note that this setting is for destination IP range or FQDN and it is optional.
-
Select TCP, UDP, or SCTP from Protocol.
- Enter the destination ports as the ports for the service.
-
Leave source ports as unspecified or set them as 1-65535. This is a very common mistake.
-
Select OK.
-
With the custom service now created, the option to use this service in a policy now exists.
Note that in FortiOS, a custom service can be created while creating a new policy. This is done using the 'Create' option while selecting a service as part of this policy. See below:
Testing.
Pass the traffic through the FortiGate unit and check the session table from the 'FortiView Sessions' page. Note that in some cases, if the custom service is not properly configured or applied to a Firewall Policy, the corresponding traffic might be blocked or match a wrong Firewall Policy. Hence the procedures that follow is as below:
Go to Dashboard -> FortiView Sessions. Set up a filter based on the port.
Make sure the Policy matches the correct Firewall Policy. It will be useful to make sure that this traffic hits the correct Firewall Policy by ID.
To create a custom service using the CLI, enter the following commands:
config firewall service custom
edit <name>
set protocol TCP/UDP/SCTP or ICMP, ICMP6, IP
set tcp-portrange <destination port range>
set udp-portrange <destination port range>
next
end
For example:
config firewall service custom
edit <name>
set protocol TCP/UDP/SCTP
set tcp-portrange 1-65535
set udp-portrange 1-65535
next
end
Activation.
Once the service is created, apply it to a firewall policy to take effect.
If the Service of the user is not properly configured, traffic will not pass, or will pass in a wrong Firewall Policy.
