Technical Tip: Whitelist IP addresses and URLs using firewall policies

[Cayazo]

Description	This article describes how to create a rule to whitelist or bypass traffic that is required to not be inspected, namely by using an object group to easily populate the list in the GUI.
Scope	FortiGate.
Solution	Go to Policy & Object -> Addresses: Choose the tab 'Address Group': Create new objects: one for IP addresses and one for URLs:   Go to Policy & Object -> Firewall Policy: Create a new policy, and choose the LAN interface as a source, and set the destination to the WAN or SD-WAN interface: Choose the newly added object groups as the Source: Since the traffic will be forwarded to the Internet, enable Network Address Translation (NAT). To 'whitelist' or bypass the traffic the Security Profiles must be deactivated, and 'no-inspection' for 'SSL Inspection: In the logging section, for monitoring purposes, the option to be chosen is "All sessions", since 'Security Events' will only log Security (UTM) events (e.g. AV, IPS, firewall web filter) that are currently disabled. Once the traffic is confirmed to be matching the policy, the logging can be disabled. Save the new policy. It is necessary to move the firewall policy to the top to avoid matching all the other firewall policies: Now that the firewall policy is in place, edit the object group to add the IP addresses or URLs: In the section 'Select Entries', choose the option to add a new object, then choose address: For URLs, change the type to 'FQDN' and input the URL desired. Adding a wildcard is supported, but it is recommended to make sure that the DNS settings are properly set in order to populate the DNS resolutions to the FQDN objects properly. For IP addresses, choose the type 'Subnet'. This type supports subnets and specific IP addresses. To add a specific range of IP addresses, use the type 'IP Range'. Observe the new address object, added to the whitelist object group: Save the configuration once all of the object addresses are added, and confirm the configuration by hovering the mouse over the whitelist objects: To confirm that the whitelist policy is matched, may utilize the 'Policy Lookup' feature: Technical Tip: Firewall policy lookups

[lpedraza]

Geat article @Carlos !!! Congratulations and thank you so much for your contribution!