Created on
07-30-2023
09:11 AM
Edited on
03-10-2024
08:42 AM
By
Stephen_G
Description | This article describes how to solve an issue where VIP traffic does not match a firewall policy with the destination set to 'all'. |
Scope | FortiGate v7.2.2 and below. |
Solution |
Occasionally when creating a firewall policy from 'WAN' to 'LAN' with the destination set to 'all', VIP traffic is not filtered by the policy. For example: it will be allowed even if the action is set to 'deny'.
By default, a policy will only match VIP object traffic if VIP object traffic is called. It will not match if the destination is 'all'.
To match the policy, enable the 'set match-vip enable' option in the CLI configuration of that policy. Afterwards, VIP traffic will match the policy and be denied as intended.
Note: The match-vip option is disabled by default until v7.2.3. In versions after 7.2.3, the option is enabled by default. |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.