Internet access by IP

[tetelu]

Hi, I have a strange problem regarding internet access. Here is my setup, on a FG 800C: WAN1: 1.1.1.1 3 VLAN interfaces on port 23 (10Gbps) VLAN1: 172.16.5.253 VLAN2: 172.16.0.61 VLAN3: 172.16.103.252 port23 physical is not configured with any ip. I have 5 IP pools with one ip (didn' t know how else to do) - for assigning external IP to different inside groups IP pool1: 1.1.1.2 IP pool1: 1.1.1.3 IP pool1: 1.1.1.4 IP pool1: 1.1.1.5 IP pool1: 1.1.1.6 I have several addresses (/32) grouped in 4 groups. I have 5 policies to grant access to internet by group with their external IP. config firewall policy edit 1 set srcintf " NET-IT" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " ALL" set utm-status enable set webcache enable set av-profile " AV-flow" set webfilter-profile " flow-monitor-all" set application-list " default" set profile-protocol-options " default" set nat enable set ippool enable set poolname " IP_net_IT" next edit 4 set srcintf " NET-Productie" set dstintf " wan1" set srcaddr " Top Management" set dstaddr " all" set action accept set schedule " always" set service " ALL" set utm-status enable set webcache enable set av-profile " AV-flow" set webfilter-profile " flow-monitor-all" set ips-sensor " default" set application-list " default" set profile-protocol-options " default" set nat enable set ippool enable set poolname " IP_net_Top_Management" next edit 5 set srcintf " NET-Productie" set dstintf " wan1" set srcaddr " Middle Management" set dstaddr " all" set action accept set schedule " always" set service " ALL" set utm-status enable set webcache enable set av-profile " AV-flow" set webfilter-profile " flow-monitor-all" set ips-sensor " default" set application-list " default" set profile-protocol-options " default" set per-ip-shaper " 20 mega EEP" set nat enable set ippool enable set poolname " IP_net_Middle_Management" next edit 3 set srcintf " NET-Productie" set dstintf " wan1" set srcaddr " Administrative" set dstaddr " all" set action accept set schedule " always" set service " ALL" set utm-status enable set webcache enable set av-profile " AV-flow" set webfilter-profile " flow-monitor-all" set ips-sensor " default" set application-list " default" set profile-protocol-options " default" set per-ip-shaper " 5 mega" set nat enable set ippool enable set poolname " IP_net_Administrative" next edit 2 set srcintf " NET-Productie" set dstintf " wan1" set srcaddr " Production" set dstaddr " all" set action accept set schedule " always" set service " ALL" set utm-status enable set webcache enable set av-profile " AV-flow" set webfilter-profile " flow-monitor-all" set ips-sensor " default" set application-list " default" set profile-protocol-options " default" set per-ip-shaper " 5 mega" set nat enable set ippool enable set poolname " IP_net_Production" next end The problem is that everyone has access to internet and none are hitting the 5th rule. Please help, I came from ForeFront, i' m not very familiar with fortios Thanks!!!

[rwpatterson]

Policies are hit in a top down fashion. First valid policy gets the traffic. From your list it appears that the source " all" is the first in the list (policy #1). Nothing after will ever see a single packet. Change the order putting that at the end, and see if that works better.

[tetelu]

It is all, but the source interface is different. The first rule is OK (from that interface only hitting that rule) , and from the other network are hitting next 3 but not the last one. More, I have IPs that are not in any list and still hitting the 4th rule. Should I provide any more info? Thanks a lot!

[rwpatterson]

Show us the output of

 show firewall address " Top Management" 
 show firewall address " Middle Management" 
 show firewall address " Administrative" 
 show firewall address " Production" 
 

[ede_pfau]

Plus, you list 3 VLANs but the policies only use 2 - NET-IT and NET-Productie. Which is which?

[tetelu]

@ede_pfau: Yes, I have one VLAN for IT with no shaping, and in VLAN for production I have 4 address groups, different external IP for each and different shaping @rwpatterson: Those 4 are address groups, it gives e this: FortiGateICE # sh firewall address " Top Management" Address group name and address name can not be the same node_check_object fail! for name Top Management value parse error before ' Top Management' Command fail. Return code -163 Thanks,

[tetelu]

No ideeas? ' Cause now everyone in my organization has access to internet... Thanks

[ede_pfau]

This probably resolves to address overlap. Please post " sh fi address" AND " sh fi addrgrp" Next, how do you determine that policy 2 (the last one) is not hit by any traffic? And your problem is not that everyone can access the internet but that some do so without getting the traffic shaper, right?

[tetelu]

I attached the addresses/groups. The last policy for production has 0 packets/0 Bytes count, and the PCs from producton group has external IP from administrative group, that' s how I figured. The problem is that everyone from that VLAN (172.16.100.0/22) are accessing the internet, even if is not in any group. Thank you!

[rwpatterson]

Your address entity " DMC-MunteanuD" is set as 0.0.0.0/0 and is in the administrative group. ANYONE will fit into this address entity and hit the Internet. Correct this, and you' ll be looking better.