Technical Tip: How to use Clone Reverse in Firewall Policies

[jguerra]

Description	This article describes how to use the clone reverse feature to optimize the Firewall policy creation and configuration.
Scope	FortiGate v7.2.x, v7.4.x.
Solution	To streamline Firewall Policy configuration, it is possible to clone an existing policy with the Incoming and Outgoing Interfaces switched. Furthermore, the Source and Destination addresses are also reversed in the newly cloned policy.  This is useful when traffic can originate from either the source or destination subnets. A clear example of this is configuring Intervlan routing or IPsec Tunnel policies. Note: Clone Reverse is not available for Policies with NAT enabled. V7.2.x: 'Right-click' on a policy and select 'Clone Reverse'.   The policy is cloned with the Incoming and Outgoing Interfaces swapped as the Source and Destination addresses.  Hover over the Name field, select the pencil icon, and type the new policy name: Enable the Policy. 'Right-click' on the policy and select Set Status -> Enable. The new policy is now active and the original one remains unchanged: V7.4.x: The process is similar to the previous example, but for v7.4.x, the feature is named ‘Copy Reverse’. 'Right-click' on a policy and select 'Copy Reverse'. 'Right-click' the policy again and select Paste -> Below. 'Double-click' the newly cloned policy to edit it and enter the Policy Name: Scroll down, select the 'Enable Policy' toggle, and Select OK. The new policy is now active and the original one remains unchanged: Related articles: Technical Tip: Best practices for firewall policy configuration on FortiGate  Technical Tip: How to count the total number of firewall policies

[MaryBolano]

Great article! Keep it up @jguerra !!!