Config firewall policy

[gnawsti]

Hi guys, 

New in using Fortinet firewall and getting familiar with configurations. 2 VIPs configured for external proxy and this has been configured under config firewall policy as dstaddr. I would like to know what does the dstaddr means is there are 2 two objects stated.

edit 11 set srcintf " internal"  set dstintf " wan1 "  set srcaddr " any"  set dstaddr "VIP1""VIP2 " 

set action accept

Thanks in advance

[emnoc]

The  word dstaddr  means "destination address", in this case it's the 2x VIPS that where configured

Ken

[gnawsti]

Thank you for the reply.

How will be the operation when there are two dstaddr, primary/secondary? It is good to clarify.

[emnoc]

NO that does not do that or work in that way,  that's a fwpolicy, it looks at the VIP1 or VIP2 addres being allowed by that policy, nothing more. If traffic matches VIP1 or VIP2 address it will pass  ( depending on the fwpolicy action of "accept" in your example )  

Multiple  src or dst addr applied to a fwpolicy reduce the total amount of rules and management. It can simplify  design.

You could have more or less methods of achieving the same outcome;

examples

config firewall policy

edit 11 set srcintf " internal"  set dstintf " wan1 "  set srcaddr " any"  set dstaddr "VIP2" set action accept  blah blah blah

next

edit 12 set srcintf " internal"  set dstintf " wan1 "  set srcaddr " any"  set dstaddr "VIP1"" set action accept  blah blah blah

next

Or you could even done

config firewall  vipgrp

     edit myvips

           set member VIP1 VIP2

end

config firewall policy

edit 13 set srcintf " internal"  set dstintf " wan1 "  set srcaddr " any"  set dstaddr myvips set action accept  blah blah blah

next

And had  accomplished the same thing.

Ken

[gnawsti]

Can I say that if VIP1 will be changed, sample change of IP address under config fw vip, there'll be short disruption as it is in the fwpolicy?