Forticonverter Question

[johnlloyd_13]

hi,

i have a licensed forticonverter and converted a cisco ASA config.

the ASA config had only basic LAN, WAN, no NAT, and "inbound" ACL (internet > WAN) applied on the WAN/outside.

my question:

1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?

2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?

config firewall security-policy
edit 1
set srcintf "port 1"   <<< WAN/outside
set dstintf "any"
set srcaddr "all"
set enforce-default-app-port disable
set dstaddr "all"
set service "echo-reply"
set schedule "always"
set logtraffic disable
set status enable
set action accept
set comments "access-list acl_outside extended permit icmp any any echo-reply"
next
edit 2
set srcintf "port 1"    <<< WAN/outside
set dstintf "any"
set srcaddr "all"
set enforce-default-app-port disable
set dstaddr "all"
set service "time-exceeded"
set schedule "always"
set logtraffic disable
set status enable
set action accept
set comments "access-list acl_outside extended permit icmp any any time-exceeded"
next

next
edit 3
set srcintf "port 1"   <<< WAN/outside
set dstintf "any"
set srcaddr "h-196.1.1.98"
set enforce-default-app-port disable
set dstaddr "all"
set service "ALL"
set schedule "always"
set logtraffic disable
set status enable
set action accept
set comments "access-list acl_outside extended permit ip host 196.1.1.98 any"

[Dhruvin_patel · Accepted solution]

Greetings!

1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?

> Yes it is needed to allow the traffic from LAN to WAN and If you want to allow all outbound traffic from the LAN to the WAN, you can create a more general policy that allows all services and all source addresses to any destination. This would cover all outbound traffic without the need for specific policies for each type of traffic.

2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?

>  No you don't need reverse policy. It is a statefull firewall, monitors the state of connections and makes determinations on what sorts of data packets belonging to a known active connection are allowed to pass through the firewall.

Regards!

[Dhruvin_patel · Accepted solution]

Greetings!

1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?

> Yes it is needed to allow the traffic from LAN to WAN and If you want to allow all outbound traffic from the LAN to the WAN, you can create a more general policy that allows all services and all source addresses to any destination. This would cover all outbound traffic without the need for specific policies for each type of traffic.

2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?

>  No you don't need reverse policy. It is a statefull firewall, monitors the state of connections and makes determinations on what sorts of data packets belonging to a known active connection are allowed to pass through the firewall.

Regards!

[dingjerry_FTNT · Accepted solution]

Hi @johnlloyd_13 

1. "do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?"

This depends on your requirements.

If you need to allow a LAN network to access the Internet, yes, you need an outbound firewall policy to allow it. 

And if there is no other devices doing NAT in front of this FGT, you have to enable NAT as well in this outbound firewall policy. 

For Service, you name it.  If you don't know what Services you can allow, you may use "ALL" service object.

2. "do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy?"

Again, it depends on your requirements.

For example, if you have an internal web server for Internet users to access, of course, you need an inbound firewall policy.  If this internal web server has a private IP on the LAN network, you may need to apply VIP for this inbound firewall policy.

Here is the KB about VIP configuration on FGT if you don't know how:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

[johnlloyd_13]

appreciate your feedback! this makes me more confident in my ASA to FGT migration.

[TinaDouglas]

Yes, an outbound policy is needed for all traffic, but a reverse policy isn't always required.