|
FortiOS introduces a logical 'and' operator for Security Tags for full proxy policies.
See the documentation.
When configuring a proxy policy on FortiGate, it is possible to combine Security Tags with Security Tag groups.
config firewall address
edit "EMS_A"
set type dynamic
set sub-type ems-tag
next
edit "EMS_B"
set type dynamic
set sub-type ems-tag
next
edit "EMS_C"
set type dynamic
set sub-type ems-tag
next
edit "EMS_D"
set type dynamic
set sub-type ems-tag
next
edit "TAG_group"
set category ztna-ems-tag
set member "EMS_C" "EMS_D"
next
end
config firewall proxy-policy
edit 1
set proxy access-proxy
set access-proxy "Test_Proxy"
set srcintf "any"
set srcaddr "all"
set dstaddr "all"
set ztna-ems-tag "EMS_A" "EMS_B" "TAG_group"
set ztna-tags-match-logic and
set action accept
set schedule "always"
set logtraffic all
next
end
In this case, 'EMS_A', 'EMS_B', and 'TAG_group' will be logically connected with a logical 'and' operator, but the members ('EMS_C' and 'EMS_D') of the Security Tag Group will not: they will be connected with a logical 'or'.
This means that if only one or more members match in this Security Tag group, the logical state of TAG_group would be true, and FortiGate would allow access even if only one member matches (for example: EMS_C is applied to the client, but EMS_D is not).
diagnose test application fcnacd 7
[...]
2024-08-27 12:25:55 idx:0, ttdl:1 name:EMS_A
2024-08-27 12:25:55 idx:3, ttdl:1 name:EMS_B
2024-08-27 12:25:55 idx:6, ttdl:1 name:EMS_C
[...]
If Security Tags must have been applied to the client requesting access to the proxy (for example EMS_A, EMS_B, EMS_C, and EMS_D)...
diagnose test application fcnacd 7
[...]
2024-08-27 12:25:55 idx:0, ttdl:1 name:EMS_A
2024-08-27 12:25:55 idx:3, ttdl:1 name:EMS_B
2024-08-27 12:25:55 idx:6, ttdl:1 name:EMS_C
2024-08-27 12:25:55 idx:12, ttdl:1 name:EMS_D
[...]
It would then be, necessary to use them directly in the proxy_policy:
config firewall proxy-policy
edit 1
set proxy access-proxy
set access-proxy "Test_Proxy"
set srcintf "any"
set srcaddr "all"
set dstaddr "all"
set ztna-ems-tag "EMS_A" "EMS_B" "EMS_C" "EMS_D"
set ztna-tags-match-logic and
set action accept
set schedule "always"
set logtraffic all
next
end
Related articles:
Technical Tip: Logical 'AND' for tag matching between primary and secondary ZTNA Tags in a firewall ...
ZTNA HTTPS access proxy example - FortiGate administration guide
Full versus simple ZTNA policies - FortiGate administration guide
|
