Technical Tip: Internet Service Grouping in relation to direction

[pdelapena]

Description	This article describes how to properly group Internet Service Objects based on their direction and organize them into Internet Service Groups.
Scope	FortiGate.
Solution	Creating an Internet Service Group simplifies creation of FortiGate policies so that there is only a single object to be selected instead of referencing a lot of Internet Service objects.  Direction defines how the Internet Service may be used. The direction can be verified by searching for the specific Internet Service Object in the FortiGate GUI by going to Policy & Objects -> Internet Service Database -> Searching for keywords of Internet Services. Below are three different conditions that should be considered in relation to direction when creating an Internet Service Group: When the direction for the group is set to 'source', it is possible to add members of Internet Service objects with the directions set to 'source' or 'both'. The same goes for when the direction for the group is set to 'destination': Internet Service objects with directions 'destination' or 'both' can be grouped. However, when the direction set for the Internet Service group is 'both', only Internet Service Objects with the 'both' direction can be included in the group. Before v7.4, it is only possible to create Internet Service Groups via the CLI. However, as of v7.6.0, it is now possible to create and view the Internet Service Groups via the GUI. To aid in understanding, the Internet Service Objects in this article that are members of the group are differentiated by color based on their direction. Internet Service Direction color coding: Source, Destination, Both. config firewall internet-service-group edit "test-Source" set comment "Use Internet Service Group as SOURCE" set direction source set member "Shodan-Scanner" "Google-Google.Bot" "Google-Gmail" "Microsoft-Skype_Teams" next edit "test-Destination" set comment "Use Internet Service Group as DESTINATION" set direction destination set member "Microsoft-Office365" "Meta-Whatsapp" "Akamai-CDN" "Zoom.us-Zoom.Meeting" next edit "test-Both" set comment "Use Internet Service Group as BOTH" set member "Shopify-Shopify" "GitHub-GitHub" "Apple-APNs" next end In v7.6+: Note:  For 'test-Source' and 'test-Destination' Internet Service Groups, it is possible to mix the group members with Internet Service Objects that have the 'both' direction. Related article: Technical Tip: Grouping ISDB objects