Firewall Rule hits on layer-2 traffic

[puca]

hello, under what circumstances can layer 2 traffic hit a firewall rule?

Source and destination are the same interface and the same layer-2 subnet. Nevertheless I see hits in the firewall logs for a corresponding rule which doesn't make any sense to me.

How does this happen?

- Normal Layer 3 implementation of fortigate

- FortiOS 6.4.5

Best Regards

p

[akristof]

Hello,

Thank you for your question. For L2 traffic, only if traffic is passing by FortiGate it will be processed and matched by firewall policies. But sometimes ippools and VIPs can interfere with local L2 traffic, if FortiGate will reply with arp-reply for some IPs (especially for ippools IPs) and it can diverge traffic to FortiGate.