Custom services

[bbache99]

Hi all, I have observed that when using the creating 2 custom services using the same port number, the firewall will recognise that port number globally with only one of the custom services, therefore if anything else arrives on at a policy on that port number it does not work correctly. For example, two custom services exist, HTTP and WebBrowsing, both with TCP 80 as the configured port. If I create firewall policy 1 with the HTTP service allowed from host A, and firewall policy 2 with the WebBrowsing service allowed from host B, only one of them will be allowed through. Looking at the logs I can see that all TCP 80 traffic will be classified with service HTTP, and thus when traffic hits policy 2 and HTTP is not allowed (because WebBrowsing has been selected in this policy) the traffic is dropped. Is this expected behaviour? Is it not possible to have services classified multiple times? Thanks BenHi Support, I have observed that when using the creating 2 custom services using the same port number, the firewall will recognise that port number globally with only one of the custom services, therefore if anything else arrives on at a policy on that port number it does not work correctly. For example, two custom services exist, HTTP and WebBrowsing, both with TCP 80 as the configured port. If I create firewall policy 1 with the HTTP service allowed from host A, and firewall policy 2 with the WebBrowsing service allowed from host B, only one of them will be allowed through. Looking at the logs I can see that all TCP 80 traffic will be classified with service HTTP, and thus when traffic hits policy 2 and HTTP is not allowed (because WebBrowsing has been selected in this policy) the traffic is dropped. Is this expected behaviour? Is it not possible to have services classified multiple times? Cheers!

[Istvan_Takacs_FTNT]

It seems to be an issue with the product. I just tried to replicate and ended up having exactly the same issue. Than I compared the default HTTP service to the new custom one and figured that when you build the custom service, it creates the value of the " tcp-portrange" attribute incorrectly. HTTP: set tcp-portrange 80 WebBrowsing: set tcp-portrange 80:0 Then edited the object and removed the :0 in CLI than it worked as expected. I' d suggest to log a ticket with Fortinet Support as it appears to be a bug in version 5.2 (not sure what version you are using, though) BTW # config firewall service custom (custom) # edit WebBrowsing (WebBrowsing) # set tcp-portrange 80 (WebBrowsing) # next And voilà, it' s back to normal again.

[bbache99]

I have seen the issue with the appended :0 already and have raised a ticket with Fortinet on this - I will let you know the response. I am running 5.0.8 at the moment. So when you had both WebBrowsing AND HTTP, did the firewall pass both, regardless of which was in the policy?

[Istvan_Takacs_FTNT]

No, it blocked the access with WebBrowsing service just like in your case, until I fixed the service definition in CLI.

[bbache99]

OK, but once you changed it, did it pass both?

[Istvan_Takacs_FTNT]

Yes, it did.