DescriptionThis article provides a sample of firewall policy views. SolutionPolicy views.- In Policy & Objects policy list page, there are two policy views: 'Interface Pair View' and by 'Sequence view'.- 'Interface Pair View' displays the policies in the order that there are checked for matching traffic, grouped by the pairs of Incoming and Outgoing interfaces. For example, all policies referencing traffic from WAN1 to DMZ are in one section. - The policies referencing traffic from DMZ to WAN1 are in another section. The sections are collapsible, like that, look at the sections wanted only is needed.
- By Sequence displays policies in the order that there are checked for matching traffic without any grouping.
- The default display is 'Interface Pair View'. Switch between the two views except if any or multiple-interfaces are applied in the policy.
How Any or multiple-interfaces policy can change the Interface Pair View.
- The FortiGate unit automatically changes the view on the policy list page to by Sequence whenever there is a policy containing any or multiple-interfaces as the Source or Destination interface. If the 'Interface Pair View' is greyed out, it is likely that one or more policies have used the any or multiple-interfaces.
-When the any or multiple-interfaces are used, the policy goes into multiple sections because it might be any one of a number of interface pairings. Policies are divided into sectioned using the interface pairings, for example, port1 to port2.
- Each section has its own policy order. The order in which a policy is checked for matching criteria to a packet’s information is based solely on the position of the policy within its section or within the entire list of policies. If the policy is in multiple sections, FortiGate cannot place the policy in order in multiple sections. Therefore the view can only be By Sequence.