Stealth rule

[moumoumatt]

I come from a Check Point background, and the first rule is always the Stealth rule allowing specific IP's/Subnets to the firewalls's on http/https/ssh etc, then dropping all other traffic.  I'm not seeing the firewalls as objects in the objects list to configure this. 

I know I'm probably doing something stupid - any help at all?

Thanks.

[ede_pfau]

Hi,

and welcome to the forums, and to the Fortinet realm!

In FortiSpeak this is called "local-in" policies. These are not normally visible in the policy table but you can enable them (depending on the firmware version). FortiOS v5 at least, that is.

Have a look into the "CLI Reference" for your version and search for "local-in" to get to the (CLI) commands.

I think (don't nail me on this, it's a rare feature) local-in policies are only configured in the CLI ("config firewall local-in-policy").

As for "local-out", there are only options to enable logging of local-out traffic. CLI only, of course.

[moumoumatt]

This is great, thanks. 

Is there a way of configuring from the Fortimanager?  we manage the firewalls from Fortimanager and I don't want to configure locally on the firewall and it causes a conflict when I update the configuration via Fortimanager.

Thanks again.

[Dave_Hall]

moumoumatt wrote:

Is there a way of configuring from the Fortimanager?  we manage the firewalls from Fortimanager and I don't want to configure locally on the firewall and it causes a conflict when I update the configuration via Fortimanager.

You could try creating a script for that local-in-policy, setting it to be applied directly to the Fortigate, policy package, or on the DB. 

[Shawn_W]

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/central_mgmt.101.06...

[emnoc]

That's a great link but I believe you still can't configure local-in from the fortimanager webinterface.

OP, I haven't been on a fortimanager in ages, but check the config and and then see if you can change the policies viathe interface or if you change it via the "local" access on the FGT does it get overriden?

I believe it will not ( just my hunch )