| Description | This article describes how to solve an issue where VIP traffic does not match a firewall policy with the destination set to 'all'. |
| Scope | FortiGate v7.2.2 and below. |
| Solution |
Occasionally when creating a firewall policy from 'WAN' to 'LAN' with the destination set to 'all', VIP traffic is not filtered by the policy. For example: it will be allowed even if the action is set to 'deny'.
By default, a policy will only match VIP object traffic if VIP object traffic is called. It will not match if the destination is 'all'.
To match the policy, enable the 'set match-vip enable' option in the CLI configuration of that policy. Afterwards, VIP traffic will match the policy and be denied as intended.
Note: The destination address object should be the 'mapped IP' of the VIP object because FortiGate performs the DNAT check first and then applies the security policy.
Note: The match-vip option is disabled by default until v7.2.3. In versions after 7.2.3, the option is enabled by default. |
