Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Not applicable

Error while moving firewall policy

After upgrading to FortiOS MR3 Patch 2 we have encountered a strange problem while moving policies to different positions. We cannot move any newly created policies to a different position. We get the following error: " Moving a policy from one interface/zone pair to a different interface/zone pair is not permitted" The error msg doesn' t make any sence coz we' re just trying to move a policy to a different position and not edit it. Any help appreciated!!
6 REPLIES 6
Owain_Deagle
New Contributor

You get that error if you try to move a policy in relation to an ID from another grouping. For example, moving a policy from Wan->Lan to Lan->Wan.
Maik
New Contributor II

you try to move your policy by it' s ID. but in 4.3 by default the Firewall Policy page shows the policy order on the left side. (Column Name " Seq.#" ) You need to enable the " ID" column in the column settings to see where to really move the policy.
Paul_Dean
Contributor

Yes that is annoying. I can see why the sequence number is useful but dropping the policy ID in favour of it is not helpful. I was filtering logs for traffic by what I thought was the policy ID. It was instead the sequence number. Took some head scratching to work that out.
NSE4
NSE4
Not applicable

I can confirm that I am using the Policy ID and not the sequence number. Before the upgrade I could move policies in any order irrespective of the interface pair above or below it. Now when I try to move policies below or above a policy ID using a different interface pair it' s throwing an error: Moving a policy from one interface/zone pair to a different interface/zone pair is not permitted But it doesn' t make sense as I am not trying to edit the policy and change the interface pair. I am just changing the rule location!!
ejhardin
Contributor

It is a bug... I have had the same issue since 4.3.2. From what I know it only happens when you have one or more policies that use the " any" interface. You should be able to move the policy from the CLI. This is my only work around right now.
Not applicable

Thanks for that. We have figured that out. The secion views are disabled once you have an any interface in one of the rules
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors