local-in-policy and management interface relation

[marypoppins]

Dear All,

I would like to ask what is the relationship between the local-in-policy and the dedicated management interface? For example if my mgmt interface has allowaccess ssh, https for a trusted host, is a "deny src_ip=all dst_ip=mgmt_ip (or just dst_if=any) dst_port=ssh,https" will block also the access to the mgmt interface and lock out the trusted host from access the ssh https on that mgmt port? Or the mgmt port and its configured access in the network/interfaces is above all? Thank you

[pbangari]

Hi, yes, the above local-in policy will block the access to FGT even from a trusted host as the local-in policy check happens first.