|
If it is necessary to block a specific protocol when it reaches a FortiGate interface without needing to know the port used, follow this method.
The IGMP protocol will be blocked in this example.
First, create a custom firewall service:
config firewall service custom
edit IGMP
set category "Network Services"
set protocol IP
set protocol-number 2
next
end
Find a list of protocols and their corresponding numbers in the FortiGate handbook.
After, it will only be necessary to create the local in policy using the new custom service:
config firewall local-in-policy
edit 1
set intf wan1
set srcaddr all
set dstaddr all
set service IGMP
set schedule always
set action deny
next
end
This method can be used to block some other protocols as well.
|
