This article describes that from version 6.2, the IP address might be part of different ISDB objects.
The traffic is matched based on the 3-tuple (protocol, port, IP).
This also introduces the 'singularity' value that means the highest weight, i.e. which ISDB object will be matched based on the 3-tuple.
- Below is the SD-WAN rule configured with two ISDB destination objects:
- ISDB object that will be matched can be checked with the following command:
chameleon-kvm14 # diagnose internet-service info root 6 443 126.96.36.199
- The singularity value is displayed in the output of particular ISDB object, it is possible to verify the same with get command as below:
chameleon-kvm14 # config firewall internet-service 327880
chameleon-kvm14 (327880) # get
chameleon-kvm14 # config firewall internet-service 327791
chameleon-kvm14 (327791) # get
# diagnose sys session filter src 10.100.13.195
session info: proto=6 proto_state=01 duration=1 expire=3598 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
|Scope||FortiGate 6.2 and above,|
|Solution||If two ISDB are present in the SD-WAN rule destination, the ISDB object with the highest singularity value will be selected.|
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2023 Fortinet, Inc. All Rights Reserved.