Technical Tip: Firewall Policy change based on policy view when multiple interface policy is enabled and is in use

[pmeet]

Description	This article describes the Firewall Policy change based on policy view when multiple interface policy is enabled and are in use.
Scope	FortiOS.
Solution	When a firewall policy makes references to more than one interface in either 'Incoming interface' or 'Outgoing interface' (This requires 'Multiple Interface Policies' to be enabled under System -> Feature) the behavior exhibited by the GUI firewall policy table (Policy & Objects -> Firewall Policy) will differ based on if the policy view is 'By Sequence' or 'Interface Pair View'. The behavior is explained in the demonstration below. A policy named test4 is created using multiple interfaces defined in 'Incoming interface', and the policy view is set to By Sequence, which results in the following display on the table. When the Policy view is changed to Interface pair view, the single policy (test4) will be displayed as two separate policies: In the visual demonstration below, when a change is made on one of the two policies, it will be reflected on both policies when the interface pair view is selected. This is an expected behavior in how the GUI displays the interface-pair view when multiple interfaces are selected in the firewall policy. While two entries are shown in the GUI (to display proper interface pairs), modifying either will modify the single policy that is present in the configuration, which is then reflected to 'both' policies in the GUI. config firewall policy     edit 21         set name "test4"         set uuid dc8189d6-4ce6-51ee-7350-17549fc41257         set srcintf "CyberWorld" "Guest"         set dstintf "internal"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"         set utm-status enable         set ssl-ssh-profile "certificate-inspection"         set ips-sensor "default"         set comments " (Reverse of test) ()"     next end If there is a need to treat traffic differently coming from one interface than another, then it is necessary to split up this policy into two separate policies for each interface pair.