Firewall Policies created not working

[Giovanna]

I did a simple exercise where I connected the two PCs to the physical FortiGate (to port1 and port2). Then I created a rule where I set the incoming traffic to port1 and outgoing traffic to port2 (with all other parameters set to 'all'). I also created another rule to permit the reverse traffic. However, all traffic is being denied due to the implicit deny rule. Does anyone have a suggestion regarding this configuration? I can ping the FortiGate from the PCs. The FortiGate is not registered yet (I did the same configuration in VMware Workstation with the FortiGate running on a VM, and it worked).

[esalija]

Dear @Giovanna ,

Please run the debug command to check the traffic flow and the firewall policy that is matching:

# diagnose debug disable

# diagnose debug flow filter addr <Source_IP> <Destination_IP> and

# diagnose debug flow show function-name enable

# diag debug flow show iprope enable

# diagnose debug console timestamp enable

# diagnose debug flow trace start 1000

# diagnose debug enable

Best regards,
Erlin

[Giovanna]

Thank you! Debug didn't show any issues, looks like fortigate takes time to load the configuaration modifications, do you mabye know why this happends? It takes more then 1 hour

[esalija]

Dear @Giovanna,

Thank you for the reply!

Did you notice the traffic that is flowing into FGT from Sniffer commands?

# diag sniffer packet any "host <Source_IP> and host <Destination_Ip>" 4 0 l

Best regards,

Erlin

[dingjerry_FTNT]

Hi @Giovanna ,

You need to tell us the details about your traffic:  

Ping or HTTP or something else?  

Source IP / Destination IP?

The outputs of the debug flow.

And/or the outputs of the sniffer packets capture.

[AEK]

Hi Giovana

Jerry and Salija are right, if you share "diag debug flow" output it will help us to help you.