Firewall Policy 0 Blocking all outgoing traffic from LAN

[eberrick]

Dear All, My company recently purchased a new FG 200E, my first Fortigate Box . I am having a challenge getting the box to work . My traffic flows from the internal network through through the 192.168.5.1/255.255.255.0 on the LAN interface (port1) with IP : 192.168.5.5 The outgoing WAN traffic is on the WAN 1 : x.x.x.x/25 network on interface wan 1 with IP x.x.x.x Wireless Guest users are on the 172.10.0.0 network on interface port5 . ( the wireless interface is set as the dhcp server for wireless users. On the Wifi interface, there is internet partially to some users and others also get blocked. Troubleshooting so far : I have created Internet, Mobile, Admin , Wireless policies . But traffic from the LAN is blocked by Policy0 Implicit Deny - Violation I have also changed the lan port to other ports and the behavior is still the same . Upgraded device firmware . I would really appreciate your suggestions . Thank you. Ernest - Certified Fortigate Newbie :)

[ShawnZA]

If it's hitting policy 0 then it skipped the policies you created.... can you paste the cli config of said policies here?

[ede_pfau]

some hints:

- policies are checked from top to bottom. First policy matching source interface, destination interface, source address, dest. address, service and schedule is followed, all policies below are skipped.

Thus, if your traffic hits policy 0, no policy matched.

- outbound policies need to have NAT enabled (simple NAT to interface address will do).

[emnoc]

I have to agree with  Shawn,

Change policyid2

config firewall policy edit 2   set name "LAN-WAN"   set srcintf "port2" "port1" "port5"

end

And test, it should work

Ken Felix

[eberrick]

Please see below config of firewall policy

FG200ETK18919297 # show firewall policy config firewall policy edit 2 set name "LAN-WAN" set uuid 47894160-4d72-51ea-c7e1-b3c06cb7f32e set srcintf "port2" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set utm-status enable set logtraffic all set auto-asic-offload disable set fsso disable set av-profile "default" set webfilter-profile "Parliament Web Filter" set application-list "Parliament Application Profile" set ssl-ssh-profile "certificate-inspection" set nat enable next edit 5 set name "Wireless" set uuid d78312f0-4d8b-51ea-b239-f184939e4d36 set srcintf "port5" set dstintf "wan1" set srcaddr "Wireless_Guests" set dstaddr "all" set action accept set schedule "always" set service "DNS" "HTTP" "HTTPS" set utm-status enable set logtraffic all set fsso disable set devices "Mobile Devices" set av-profile "wifi-default" set webfilter-profile "Parliament Web Filter" set dnsfilter-profile "default" set application-list "Parliament Application Profile" set ssl-ssh-profile "certificate-inspection" set nat enable next edit 4 set name "Mobile" set uuid 11dcfd52-4d79-51ea-044e-8fec29ede457 set srcintf "port2" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "DNS" "HTTP" "HTTPS" set utm-status enable set logtraffic all set fsso disable set devices "Mobile Devices" set webfilter-profile "default" set ssl-ssh-profile "certificate-inspection" set nat enable next end

FG200ETK18919297 #

[ShawnZA]

In your first post you said "My traffic flows from the internal network through through the 192.168.5.1/255.255.255.0 on the LAN interface (port1) with IP : 192.168.5.5"

So is port1 your internal interface?

Your policies shows port 2 and not port 1.... except the wireless one where it shows port5 to wan1

So if port1 is your internal interface then change the policies to reflect port1 as the incoming port... so fix that first, then it should work. Both those rules allows "all" as source, you need to lock them down to the ranges or else only one policy will be used as well, lock them down to source IP ranges on incoming port1

FG200ETK18919297 # show firewall policy config firewall policy edit 2 set name "LAN-WAN" set uuid 47894160-4d72-51ea-c7e1-b3c06cb7f32e set srcintf "port2" set dstintf "wan1" set srcaddr "all" set dstaddr "all"

[eberrick]

Hi Guys,

Thanks so much for your input. I would like to inform you that following your recommendations I was able to get the box up and running fully.

The only question I have to ask now is, with Forti OS 6.2.3 how are device policies configured ? because I cant seem to find that device tab anymore.