Description
This article describes when ping is allowed, even though trusted hosts are configured on version 6.0 and onwards; in earlier versions, it was blocked.
Scope
Ping is allowed when trusted hosts are configured
Solution
In v5.x and below, trusted hosts configured by an administrator user only allow access from certain IP addresses configured in trusted hosts, to all services configured on the interface, including ping.
From version 6.0 onwards ping service on management interfaces are not included within the scope of trusted hosts. This means that you will be able to ping the interface from an IP that is not included within trusted hosts.
To restrict ping access to only trusted hosts and deny it for everyone else, you need to configure a Local In Policy as shown below. Be aware that if administrative access for ping is disabled on the external interface of the FortiGate unit, authorization for trusted hosts is explicitly declined, even with the configuration of the local-in-policy below.
CLI configuration:
config system admin
edit "admin"
set trusthost1 172.26.73.48 255.255.255.255
set accprofile "super_admin"
set vdom "root"
next
end
Configuring the address and address group as per the trusted hosts:
config firewall address
edit "trusted-1"
set type ipmask
set comment ''
set visibility enable
set associated-interface ''
set color 0
set allow-routing disable
set subnet 172.26.73.48 255.255.255.255
next
end
config firewall addrgrp
edit "trusted_grp"
set member "trusted-1"
set comment ''
set visibility enable
set color 0
next
end
Configuring Firewall local in policies:
config firewall local-in-policy
edit 2
set intf "port1"
set srcaddr "trusted_grp"
set dstaddr "all"
set action accept
set service "PING"
set schedule "always"
set status enable
set comments ''
next
edit 1
set intf "port1"
set srcaddr "all"
set dstaddr "all"
set action deny
set service "PING"
set schedule "always"
set status enable
set comments ''
next
end
Alternatively, a single local-in policy rule can also be created by using the 'Negate' option and will perform the same task. Here is the configuration when using the srcaddr-negate enable option.
config firewall local-in-policy
edit 0
set intf "port1"
set srcaddr "trusted_grp"
set dstaddr "all"
set srcaddr-negate enable <----- This command will negate the rule and will block all source addresses except those defined in the 'srcaddr' field.
set action deny
set service "PING"
set schedule "always"
set status enable
Before configuring the local in policy:
diagnose sniffer packet any 'host 172.26.73.78 and icmp' 4
interfaces=[any]
filters=[host 172.26.73.48 and icmp]
3.647787 port1 in 172.26.73.78 -> 10.5.22.114: icmp: echo request
3.647850 port1 out 10.5.22.114 -> 172.26.73.78: icmp: echo reply
4.651341 port1 in 172.26.73.78 -> 10.5.22.114: icmp: echo request
4.651383 port1 out 10.5.22.114 -> 172.26.73.78: icmp: echo reply
5.657949 port1 in 172.26.73.78 -> 10.5.22.114: icmp: echo request
5.657992 port1 out 10.5.22.114 -> 172.26.73.78: icmp: echo reply
After configuring the local in policies:
diagnose sniffer packet any 'host 172.26.73.78 and icmp' 4
interfaces=[any]
filters=[host 172.26.73.48 and icmp]
4.264950 port1 in 172.26.73.78 -> 10.5.22.114: icmp: echo request
8.904217 port1 in 172.26.73.78 -> 10.5.22.114: icmp: echo request
13.906576 port1 in 172.26.73.78 -> 10.5.22.114: icmp: echo request
18.893835 port1 in 172.26.73.78 -> 10.5.22.114: icmp: echo request
trace_id=22 func=print_pkt_detail line=5497 msg="vd-root:0 received a packet(proto=1, 172.26.73.78:1->10.5.22.114:2048) from port1. type=8, code=0, id=1, seq=335."
id=20085 trace_id=22 func=init_ip_session_common line=5657 msg="allocate a new session-00874fe6"
id=20085 trace_id=22 func=vf_ip_route_input_common line=2591 msg="find a route: flag=80000000 gw-10.5.22.114 via root"
id=20085 trace_id=22 func=fw_local_in_handler line=409 msg="iprope_in_check() check failed on policy 1, drop
Reply for the trusted host:
diagnose sniffer packet any 'host 172.26.73.48 and icmp' 4
interfaces=[any]
filters=[host 172.26.73.48 and icmp]
7.239647 port1 in 172.26.73.48 -> 10.5.22.114: icmp: echo request
7.239743 port1 out 10.5.22.114 -> 172.26.73.48: icmp: echo reply
8.261081 port1 in 172.26.73.48 -> 10.5.22.114: icmp: echo request
8.261122 port1 out 10.5.22.114 -> 172.26.73.48: icmp: echo reply
9.276261 port1 in 172.26.73.48 -> 10.5.22.114: icmp: echo request
9.276321 port1 out 10.5.22.114 -> 172.26.73.48: icmp: echo reply
10.294536 port1 in 172.26.73.48 -> 10.5.22.114: icmp: echo request
10.294588 port1 out 10.5.22.114 -> 172.26.73.48: icmp: echo reply
