| Description | This article describes a scenario where all the traffic hitting a specific policy will be dropped by Implicit Deny Policy ID 0 if email filter profile is enabled on this firewall policy. |
| Scope | FortiGate, Email Filter. |
| Solution |
It is possible that the traffic is dropped by the Implicit Deny Policy ID 0, instead of hitting the firewall policy created for this traffic specifically.
The firewall policy will look like seen below:
config firewall policy edit 1 set name "Port3_to_internet" set uuid f547bc88-af22-51f0-5880-56805a8200a9 set srcintf "port3" set dstintf "port1"
The firewall policy is on proxy mode. The Security Profiles are on proxy mode as well, and are part of a profile-group:
config firewall profile-group
The logs will show as follows:
The Log Details will show the traffic denied with Threat 131,072.
If the security profile group is removed from the firewall policy, then the traffic will start passing:
In these cases, what can be done is to eliminate the security profiles one by one and understand which one is causing the drop on the traffic.
In this scenario, the security profile that blocks the traffic is the e-mail filter profile:
config emailfilter profile edit "Proxy-Email-Filter"
As seen on this configuration, the following option is enabled:
set external enable
By default, this option is disabled. If no email server is configured on the infrastructure, it is recommended to leave it as it is. This option is used to enable or disable external email inspection.
As soon as the option is set to the default value (disable), the traffic will be allowed again. |
