FortiGate 7.0.14 - A lot of blocks after update

[Satory]

Today we updated all our FortiGate devices to 7.0.14 due to the security concerns with the ongoing attacks worldwide.

Unfortunately after the upgrade we are facing a lot of blocked connection to applications which were working without problems before.

What I have noticed is the type of block -> local-in-policy.

Is there some new feature that I am missing or is there a way to enable such traffic.

One of the blocked connection is video surveillance system, running on HTTPS: 

Action

Action Policy violation

Firewall Actiondeny

Policy ID0

Threat262144

Application

Application HTTPS

Application Category unscanned

Protocol 6

Service HTTPS

Data

Duration 0 seconds

Received

Received Packets0

Sent

Sent Packets0

.....

FortiClient UUID

Policy Type local-in-policy

[Satory]

Just to clarify - the VSS system uses two servers with a virtual IP address, managed by them.
The problem is accessing the virtual address.

[AEK]

Can you share the following:

show firewall local-in-policy 

[Satory · Accepted solution]

I found the issue - possibly a bug in 7.0.14.

A had an old Virtual IP, which was not used in any firewall rule on the same IP source address. After updating from 7.0.12 to 7.0.14 the firewall defined this address as an internal, thus preventing the proper routing and enforcing local in policy.

After removing the VIP -> everything works normally and as expected. I raised a ticket to report this bug.

[Walde]

This is not a bug, it's intended VIP and IP-Pool behavior from 7.0.13 onwards.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-ARP-reply-setting-in-Virtual-IP-IP-Pool/ta...

Before FortiOS 6.4.9 / 7.0.1 all IP addresses in the IP pool and VIP are considered as local IP if arp-reply is enabled (following the FortiOS logic one IP can be bound to one interface). In FortiOS 6.4.9-6.4.14 / 7.0.1-7.0.12 / 7.2.0-7.2.5 / 7.4.0, the IP pool / VIP IP addresses are no longer considered local.

This change was reverted in versions 6.4.15, 7.0.13, 7.2.6 and 7.4.1. From these versions onwards, IP pools and VIPs will again be considered as local IP addresses. 

If ARP-reply is enabled on an IP-pool, the assigned IPs will be considered as being local-in, even if the IP-pool is not in use anywhere.