| Description | This article describes how to solve an issue where VIP traffic does not match a firewall policy with the destination set to 'all'. |
| Scope | FortiGate v7.2.2 and below. |
| Solution |
When creating a firewall policy from 'WAN' to 'LAN' with the destination set to 'all', VIP traffic is sometimes not filtered by the policy. For example, it will be allowed even if the action is set to 'deny'.
A regular deny policy does not block VIP traffic because of the way FortiGate processes packets. When a packet is destined for a VIP, it undergoes Destination NAT (DNAT) at the beginning of the packet processing. This means the packet is translated to the VIP's mapped IP before the policy lookup occurs.
By default, a policy will only match VIP object traffic if VIP object traffic is called. It will not match if the destination is 'all'. If central NAT is enabled, it is not necessary to add the VIP object on the policy as a destination address.
To match the policy, enable the 'set match-vip enable' option in the CLI configuration of that policy. Afterward, VIP traffic will match the policy and be denied as intended.
Note: The destination address object should be the 'mapped IP' of the VIP object because FortiGate performs the DNAT check first and then applies the security policy.
Note:
Technical Tip: Firewall does not block incoming (WAN to LAN) connection even though deny policy Technical Tip: Configure firewall policies for a VIP when Central NAT is enabled |
