Filtering by interfaces in policy

[Kempniu]

Greetings, I' d like to correctly understand how traffic filtering functions on a Fortigate 60C firewall. The specific matter I' d like to discuss is how filtering by source/destination interfaces in firewall policy influences security. Consider the following example: I have a unit with 4 tunnel interfaces - A, B, C, D - connecting it to remote networks. Each interface has a static route assigned to it: 10.0.1.0/24 via interface A 10.0.2.0/24 via interface B 192.168.1.0/24 via interface C 192.168.2.0/24 via interface D Let' s assume tunneling and routing already works properly. Now, I want all IPv4 traffic from A and B to C and D to be allowed. Please consider two alternate scenarios: SCENARIO 1. Each network has a firewall object created with the relevant interface assigned: NET_A: 10.0.1.0/24 (interface A) NET_B: 10.0.2.0/24 (interface B) NET_C: 192.168.1.0/24 (interface C) NET_D: 192.168.2.0/24 (interface D) Because objects belonging to different interfaces cannot be grouped into a firewall address group, four separate allow policies have to be created: a) source interface: A source address: NET_A destination interface: C destination address: NET_C b) source interface: A source address: NET_A destination interface: D destination address: NET_D c) source interface: B source address: NET_B destination interface: C destination address: NET_C d) source interface: B source address: NET_B destination interface: D destination address: NET_D SCENARIO 2. Each network has a firewall object created without assigning it to a specific interface: NET_A: 10.0.1.0/24 (interface any) NET_B: 10.0.2.0/24 (interface any) NET_C: 192.168.1.0/24 (interface any) NET_D: 192.168.2.0/24 (interface any) Because these objects aren' t assigned to a specific interface, two firewall address groups can be created to group networks together: NET_AB: NET_A, NET_B NET_CD: NET_C, NET_D With these firewall address groups, I can enforce the same traffic filtering rules as in scenario 1 with only one policy: source interface: any source address: NET_AB destination interface: any destination address: NET_CD The question. Is scenario 2 any less secure than scenario 1? As far as I understand, the firewall will perform reverse path checks for every packet traversing it, so even though we don' t specify source/destination interfaces in scenario 2, any invalid packets (e.g. packet with source address 10.0.2.1 received on interface A) will still be dropped as they will fail the reverse path check.

[Kempniu]

All clear now. Thanks for an interesting discussion.

[ede_pfau]

My pleasure! Discussions do not often get so deep in the forums. More like " fix my problem" situations... Good luck with your hub.