Local-in-Policy

[Allan_Lago1]

Hello! How can i apply utm filters to Locan-in-Policies? I really need to apply a QoS filter to a Local traffic but i not really sure how can i do this. Best regards

[oheigl]

Hello Allan, I don' t think you are able to apply UTM features in local-in policies.

 config firewall local-in-policy
 *intf                 source interface name
 *srcaddr              source address name
 *dstaddr              destination address name
 action               local in policy action
 *service              service name
 *schedule             schedule name
 auto-asic-offload    policy traffic ASIC offloading
 status               policy status
 end
 

Can you explain your problem in more detail? Kind regards

[Allan_Lago1]

Hello Oheigl, Firts of all thanks for the reply =) My Cenario: VOIP SYSTEM 1 - 192.168.40.1 Located at City 1 VOIP SYSTEM 2 - 192.168.41.1 Located at City 2 Those VOIP system are located in differente Citys and they can communicate with other trought a MPLS connecton. So in the City 1 i have a MPLS router with a internal IP address 192.168.40.3 It ONLY knows the 192.168.41.0/24 route In the City 2 i have a MPLS router with a internal IP address 192.168.41.3 It ONLY knows 192.168.40.0/24 I have to put a fortigate between the VOIP SYSTEMS and the MPLS ROUTERS. OK thats easy, i made a fortigate with and IP adress 192.168.40.254 and another one with IP Address 192.168.41.254, i' ve changed the VOIP systems default gateways to those fortigates IP and created the static routes on fortigate so if i want to talk to 192.168.41.1 the City 1 fortigate will route the packets to 192.168.40.3 and if i want to talk to 192.168.40.1 the City 2 fortigate will route the packets to 192.168.41.3. I can comunicate like this, but cant apply a QoS to this traffic because its ALL a internal traffic and sice this MPLS link it' s not exclusive to the VOIP systems u can imagine my problem... Any clue? Thanks in Advance!

[ejhardin]

Your using two physical fortigates? I don' t know the rest of your setup but I would use one fortigate with VDOM enabled. Create two transparent vdoms and apply dscp/qos to all in/out traffic.

[ede_pfau]

What has a ' local-in' policy to do with your setup? Local-in denotes traffic where the destination is the management interface of a FGT - traffic for administration of the unit, like HTTPS or SSH. What you describe is plain vanilla regular traffic, controlled by regular policies. If I don' t get you right, would you please post a sketch of your setup?

[oheigl]

Why you don' t configure Traffic Shaping on both FortiGate for your VoIP devices? You could create one with guaranteed traffic, that should get rid of your problems