Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Satory
New Contributor III

FortiGate 7.0.14 - A lot of blocks after update

Today we updated all our FortiGate devices to 7.0.14 due to the security concerns with the ongoing attacks worldwide.

 

Unfortunately after the upgrade we are facing a lot of blocked connection to applications which were working without problems before.

What I have noticed is the type of block -> local-in-policy.

 

Is there some new feature that I am missing or is there a way to enable such traffic.

One of the blocked connection is video surveillance system, running on HTTPS: 

 

Action
Action Policy violation
Firewall Actiondeny
Policy ID0
Threat262144
 
Application
Application HTTPS
Application Category unscanned
Protocol 6
Service HTTPS
 
Data
Duration 0 seconds
Received
Received Packets0
Sent
Sent Packets0
.....
FortiClient UUID
Policy Type local-in-policy
 
 
1 Solution
Satory
New Contributor III

I found the issue - possibly a bug in 7.0.14.

 

A had an old Virtual IP, which was not used in any firewall rule on the same IP source address. After updating from 7.0.12 to 7.0.14 the firewall defined this address as an internal, thus preventing the proper routing and enforcing local in policy.

After removing the VIP -> everything works normally and as expected. I raised a ticket to report this bug.

View solution in original post

4 REPLIES 4
Satory
New Contributor III

Just to clarify - the VSS system uses two servers with a virtual IP address, managed by them.
The problem is accessing the virtual address.

AEK

Can you share the following:

show firewall local-in-policy 

AEK
AEK
Satory
New Contributor III

I found the issue - possibly a bug in 7.0.14.

 

A had an old Virtual IP, which was not used in any firewall rule on the same IP source address. After updating from 7.0.12 to 7.0.14 the firewall defined this address as an internal, thus preventing the proper routing and enforcing local in policy.

After removing the VIP -> everything works normally and as expected. I raised a ticket to report this bug.

Walde
New Contributor

This is not a bug, it's intended VIP and IP-Pool behavior from 7.0.13 onwards.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-ARP-reply-setting-in-Virtual-IP-IP-Pool/ta...

 

Before FortiOS 6.4.9 / 7.0.1 all IP addresses in the IP pool and VIP are considered as local IP if arp-reply is enabled (following the FortiOS logic one IP can be bound to one interface). In FortiOS 6.4.9-6.4.14 / 7.0.1-7.0.12 / 7.2.0-7.2.5 / 7.4.0, the IP pool / VIP IP addresses are no longer considered local.

This change was reverted in versions 6.4.15, 7.0.13, 7.2.6 and 7.4.1. From these versions onwards, IP pools and VIPs will again be considered as local IP addresses. 

 

If ARP-reply is enabled on an IP-pool, the assigned IPs will be considered as being local-in, even if the IP-pool is not in use anywhere.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors