Issue with scheduling

[dtrotman]

I'm pretty new to setting firewall policies and I'm not sure if I'm looking in the right places to solve this problem. I have the below configs in my Fortigate 90D. For policy 6 I defined a group of schedules to cover all after-hour periods. However no one can access the internet on weekends. They can ping as far as the firewall, but not any external addresses. My question is, did I set the schedules correctly? Everything else appears to work fine, including "morning hours" and "evening hours".

# show firewall policy
config firewall policy
    edit 1
        set srcintf "internal"
        set dstintf "wan"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "working hours"
        set service "ALL"
        set utm-status enable
        set logtraffic all
        set comments "Web filter and application policy for during working hours"
        set av-profile "default"
        set webfilter-profile "default"
        set ips-sensor "default"
        set application-list "default"
        set profile-protocol-options "default"
        set nat enable
    next
    edit 6
        set srcintf "internal"
        set dstintf "wan"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "afterhour_weekend"
        set service "ALL"
        set utm-status enable
        set logtraffic all
        set comments "Web filter and antivirus policy for outside working hours"
        set av-profile "default"
        set ips-sensor "default"
        set application-list "after hours"
        set profile-protocol-options "default"
        set nat enable
    next
end

# show firewall schedule group
config firewall schedule group
    edit "afterhour_weekend"
        set member "after hours" "morning hours" "weekend"
    next
end

# show firewall schedule recurring
config firewall schedule recurring
    edit "always"
        set day sunday monday tuesday wednesday thursday friday saturday
    next
    edit "after hours"
        set day monday tuesday wednesday thursday friday
        set start 16:30
    next
    edit "working hours"
        set day monday tuesday wednesday thursday friday
        set end 16:30
        set start 08:00
    next
    edit "weekend"
        set day sunday saturday
    next
    edit "morning hours"
        set day monday tuesday wednesday thursday friday
        set end 08:00
    next
end
 

[bobm]

Hi,

What worked for me was setting a more open "non work hours" policy above the more restrictive "work hours" policy.  Also, going through the GUI you can specify days of the week in the schedules to keep weekends out of the mix if you need to.

[emnoc · Accepted solution]

Firewall SEQ ordering is critical but have you double check the policies and the schedules that you craft?  Also have you taken considerationg of using the "set schedule-timeout enable" from the cli on the policies in question.

Tips ensure  specific polices are before broader policies. use the session timeout, double check the device clock/time

Ken

[dtrotman]

emnoc wrote:

Firewall SEQ ordering is critical but have you double check the policies and the schedules that you craft?  Also have you taken considerationg of using the "set schedule-timeout enable" from the cli on the policies in question.

Tips ensure  specific polices are before broader policies. use the session timeout, double check the device clock/time

Ken

The device clock is accurate, I enabled schedule-timeout for both the "working hours" and "non-working hours" policies and I moved the "non-working hours" policy to be above the "working hours" policy. Is there any way to test this out without waiting until the weekend?