Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
hervaltelecom
New Contributor III

Question about policies and policy order

Hello!

I have a question about policies and policy orders. We have CFTV in all of our stores. What i have configured is a policy accepting access during work time but with traffic shape and another policy to accepting access any time and without restrictions because most access are controlled in the outbound policies, not inbound. You can see in the picture attached, policy 100 has the shape (does not show thou), and policy 103 does not have any restrictions. My question is, will the policy 100 that is restricting connection speed be enforced when there is another policy albeit below permiting full speed access? Same case with 101 and 102.

 

Thanks.

4 REPLIES 4
Dave_Hall
Honored Contributor

Can't really tell from the screenshot without the column headers, but assuming traffic hitting policy#100 matches source all, dest "GRP-DVR-TAQI", and time(?) "SCH-COMERICAL-TAQI" then that firewall rule will only be executed without the further rules (below) it being processed.  

 

Firewall rules are execute from top to bottom until a matched rule is found, the rules below the "found" match are not processed.  I think the only time a rule falls through is when you have an identity authentication rule - someone correct me on this if it is not correct.

 

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
sw2090
Honored Contributor

Yes since this is an inbound policy it is like Dave wrote:

 

the first policy that matches the packet wins the packet. And Policies are always exempt on a FGT.

In your case if policy 100 matches then this traffic is handled accoarding to policy 100.

Policy 103 will then never apply.

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
emnoc
Esteemed Contributor III

The only way to make 103 become enforced if you had a time of day or schedule set for policy #100.

 

Ken 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
sw2090
Honored Contributor

indeed beause then #100 will not match outside schedule.

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Labels
Top Kudoed Authors