Small policy question

[gilfalko]

Hey, Suppose I have this in my firewall: Port1(internal) -- > ANY interface -- > ANY service Theoretically, doesnt it mean that my internal network should have permission to access all other interfaces? If so, then how come I had to explicitly add " PORT1(internal) --> VPN1_INTERFACE -- > ANY service" and place it above the first rule in order to traverse the tunnel? Thanks, Gil

[Dipen]

I assume Interface as " Any" may only refer to Physical Interfaces where as VPN Interface is a Virtual Interface.

[gilfalko]

Yeah that seems pretty much it. Although that still doesnt explain why when the first policy is above the second it just doesnt work. Must place the 2nd one first.

[Salamihawk]

It seems as though the Fortigate is using the policies in the routing decisions. I' ve never built policy-based VPN Tunnels on a Fortigate before, only interface-based ones, so I don' t really know how a policy-based VPN setup looks on the Fortigate, but if you' ve set up a policy-based VPN (which is the default, I believe), then that would explain why you need to have the VPN policy be evaluated first before anything else.

[gilfalko]

You cant have a Route based VPN just by using routes. How do you allow traffic between the interfaces then? Which is exactly what I' m doing.

[rwpatterson]

With policy based tunnels, there are no ' interfaces' . That' s what makes them a pain in the a$$. From back in the day, the correct setup was to place them before any other policies in the list, and to aid in making everything work, use only the correct subnets in those policies. Using ' all' , although it works, also has the nasty habit of making policies below in the list fail. (due to the fact that the VPN policy takes ALL of the destination traffic, not just what it needs...)

[gilfalko]

Bob, That still doesnt explain why it wont work just by using this 1 policy. If I can reach ANY interface, why cant I reach my VPN?

[rwpatterson]

Actually, it does. Policy based VPNs are not interfaces... Like many things Fortinet, they worked in the past, although they may not have been correct in design. 40Net decides to ' correct' this behavior in newer firmware versions and doesn' t tell anyone. This has happened in the past with spaces in name entities, special characters, name length, etc.

[gilfalko]

What?! But this is a ROUTE based VPN! Read here: http://docs.fortinet.com/fgt/techdocs/fortigate-admin.pdf Under Route-based: " Requires only a simple firewall policy with ACCEPT action. A separate policy is required for connections in each direction" This is EXACTLY what I have.

[bbache99]

My assumption would be that due to the fact VPN interface is a virtually created instance it might not fall into this.