Hello, I've been experiencing an issue with FortiGate firewall where sometimes, even though the source IP address, user, or MAC address is correctly specified at the topmost rule, traffic still manages to match and pass through a rule lower down. I can't seem to understand why this is happening. Does anyone have any insights regarding this issue? For example, when I write a rule based on both user and IP address, or user and group, it seems like the firewall doesn't recognize it and proceeds to match traffic against rules below it as if the rule wasn't there at all. Regards.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi @N_W,
If you want to specify users/groups in the policy, you need to configure FSSO: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-FSSO-in-DC-Agent-mode/ta-p/25299...
Regards,
Hello, thank you for your response, but I think there might have been a misunderstanding. In my current setup, I'm using FSSO and LDAP, and I can view my users. My issue is that when I write a rule, even though it's the same as the one above it, it matches the one below instead of the one above. Is there any method to control this behavior?
Hi,
I'm having a similar problem. I have configured FSSO, and although the traffic of most of my team in the same OU in DC goes out of the upper rule, the traffic of me and a few people goes out of the lower rule.Did you find a solution to this? Also, if there was a working rule, write a new rule and move it over the working rule. Is it necessary to do something like resetting the connections at regular intervals in the sub-rule?
Hello, I really couldn't find it either. It's a very strange problem. I can't technically understand how it works. If I reach a solution to this request, I will definitely inform you. I've tried the old Turkish method of turning it off and on a few times, but I still experience difficulties from time to time
My company uses a proxy, I would show that there is no need for this and that it can be used by configuring authorization with FSSO. I couldn't show it :)
Hi @N_W ,
This issue could be related to a two general potential factors in the FortiGate firewall's configuration or the way rules are being processed. Here are some possible reasons and troubleshooting steps you can consider:
1-Firewall Policies and Configurations:
2-Session Persistence:
If the session clear operation in the above suggestion does not give results, I kindly ask you to perform the troubleshoot steps below and share the relevant outputs so that the problem can be analyzed in more detail.
Troubleshooting Steps:
Use Debug Flow:
diagnose debug disable
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug reset
diag debug console timestamp enable
diagnose debug flow filter saddr x.y.z.t
diagnose debug flow filter daddr a.b.c.d
diagnose debug flow show function-name enable
diagnose debug flow trace start 9999
diagnose debug enable
By following these steps, you should be able to pinpoint why traffic is not matching the expected rule and make necessary adjustments. If the problem persists, you may need to consult Fortinet support for a deeper analysis.
BR.
If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.