Inbound vs. Outbound policies

[#1]

In my experience with other firewalls, it seems that you do not need to explicitly create an inbound (Ext->Int) policy that matches an outbound (Int->Ext) policy. But it seems that for the fortigate (FG), this is the case. The reasoning is that the if an internal host can create an outbound connection on a particular port, then it should be implied that it be able to receive on the same port. This seems to work for the most part on FGs. For example, I have an outbound policy for HTTP. So, my users can browse websites with no problems. There' s no inbound policy though. Also, NAT is being used. However, some ports/services will not work this way. Specifically, I have users that want to play yahoo games - so, I thought I would indulge them. I have opened up the outbound port. However the FG is not letting in the packets. I do not want to have a policy that opens up inbound connection on the same port, as my inderstanding is that allows someone on the outside to initiate a connection on this port and possibly connect to any host on the inside that' s referenced in the policy!. On my previous firewall, I did not have to do that. Any ideas?

[UkWizard]

Think you are getting confused somewhere, you would only need the outbound allowed. No INT->EXT rule is needed unless you have incoming traffic (like email or a webserver). Same as most other firewalls. If a game requires an inbound NAT, then i wouldnt allow it anyway, as this would be a serious breach. I am sure that the reason it does not work, is something else.

[#3]

UK, The issue is, it works if I open the said port inbound (to a specific PC), on the FG. Obviously, that' s untenable, so I deleted that policy. In this case, there' s an outbound policy- the first topmost one, that ACCEPTs connections from an IP addr range (internal) to External_All, using a specific schedule (lunch) with NAT enabled. Below that is a policy that allows well known services (HTTP, FTP, SMTP etc) out. Everything else is DENY(ied) Is this an outbound NAT on the FG issue or a limitation of the gaming web app? i.e. the app does not support NAT. Thanks for help.

[UkWizard]

When you say gaming app, are you talking about an online game like ' unreal tournament' or ' medal of honor' ? If so, then they should work behind the firewall, but possibly not for multiple simultaneous players. But any game that requires an internal based rule, shouldnt be used in a company environment. so tell the users ' tough'