FortiGate Rules

[N_W]

Hello, I've been experiencing an issue with FortiGate firewall where sometimes, even though the source IP address, user, or MAC address is correctly specified at the topmost rule, traffic still manages to match and pass through a rule lower down. I can't seem to understand why this is happening. Does anyone have any insights regarding this issue? For example, when I write a rule based on both user and IP address, or user and group, it seems like the firewall doesn't recognize it and proceeds to match traffic against rules below it as if the rule wasn't there at all. Regards.

[hbac]

Hi @N_W,

If you want to specify users/groups in the policy, you need to configure FSSO: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-FSSO-in-DC-Agent-mode/ta-p/25299...

Regards, 

[N_W]

Hello, thank you for your response, but I think there might have been a misunderstanding. In my current setup, I'm using FSSO and LDAP, and I can view my users. My issue is that when I write a rule, even though it's the same as the one above it, it matches the one below instead of the one above. Is there any method to control this behavior?

[AliK]

Hi, 

I'm having a similar problem. I have configured FSSO, and although the traffic of most of my team in the same OU in DC goes out of the upper rule, the traffic of me and a few people goes out of the lower rule.Did you find a solution to this? Also, if there was a working rule, write a new rule and move it over the working rule. Is it necessary to do something like resetting the connections at regular intervals in the sub-rule?

[N_W]

Hello, I really couldn't find it either. It's a very strange problem. I can't technically understand how it works. If I reach a solution to this request, I will definitely inform you. I've tried the old Turkish method of turning it off and on a few times, but I still experience difficulties from time to time

[AliK]

My company uses a proxy, I would show that there is no need for this and that it can be used by configuring authorization with FSSO. I couldn't show it :)

[atakannatak]

Hi @N_W ,

This issue could be related to a two general potential factors in the FortiGate firewall's configuration or the way rules are being processed. Here are some possible reasons and troubleshooting steps you can consider:

1-Firewall Policies and Configurations:

• Ensure the firewall policies are configured correctly with the correct source, destination, and service definitions.
• Double-check the configuration of address objects, user objects, and groups to ensure they are correctly defined and referenced in your rules.

2-Session Persistence:

• FortiGate firewalls use session persistence, meaning once a session is established, subsequent packets for the same session will follow the same path. This could mean that if an initial session was established with a lower-priority rule, it will continue to use that rule until the session times out or is closed.
• Try clearing the session table to see if the rule matches correctly afterwards. Use the CLI command diagnose sys session clear to clear the session table.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-filters-to-clear-sessions-on-a-Forti...

If the session clear operation in the above suggestion does not give results, I kindly ask you to perform the troubleshoot steps below and share the relevant outputs so that the problem can be analyzed in more detail.

Troubleshooting Steps:

Use Debug Flow:

diagnose debug disable
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug reset
diag debug console timestamp enable
diagnose debug flow filter saddr x.y.z.t
diagnose debug flow filter daddr a.b.c.d
diagnose debug flow show function-name enable
diagnose debug flow trace start 9999
diagnose debug enable

By following these steps, you should be able to pinpoint why traffic is not matching the expected rule and make necessary adjustments. If the problem persists, you may need to consult Fortinet support for a deeper analysis.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.