Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
PCNSE
NSE
StrongSwan
I have the same problem. i would like block trafic between ip range 192.168.10.0/24 to 192.168.20.0/24 in internal.
I set rule :
Source Interface: Internal Source Address: 192.168.10.0/24 Destination Interface: Internal Destination Address: 192.168.20.0/24 Schedule: always Service: ANY Action: DENY
It is 2 distinct IP ranges network. But it's not work. Please give me advices. thanks in advance
The diag debug flow is your friend. I'm surprise to see this thread still around, back to the topic if you want to use one interface "internal" and carry two unique subnets then just use secondaries and then this firewall policy would work. But two hosts on the same subnet ( layer2 ) is not going to be controlled by a simple layer3 firewall-policy this is network 101
PCNSE
NSE
StrongSwan
Jeez. Thread is 3 years old and was ANSWERED.
@emnoc: using secondary IPs is just for implicitely creating routes, to avoid Reverse Path checks/drops. You can create static routes to both subnets as well to achieve this.
If the FGT is the (only) router, and the subnets do not overlap, and there's no policy allowing this traffic then there will be no traffic allowed. You can even leave out the policy altogether - implicit deny / policy 0 will take care of that.
Hi Obi,
If am not wrong, you cannot do this.
If your Fortigate is in Nat/router mode, there is a switch between al ports in Internal.
Firewall policies only work if packes are routed.
I propose to make separate subnets.
gr,
go4it
@go4it:
How is 192.168.10.0/24 and 192.168.20.0/24 not separate subnets??
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.