Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ujemvi
New Contributor

Source address filtering problem

Hello! I' m having trouble with a firewall policy. Here' s my config:
config firewall vip
     edit " 100.100.100.100" 
         set extip 100.100.100.100
         set extintf " wan1" 
         set mappedip 10.1.250.135
     next
 end
 
 config firewall address
 	edit " Crossfone-1-ALT" 
         set subnet 66.66.66.64 255.255.255.240
     next
 end
 	
 config firewall policy
 	edit 103
         set srcintf " wan1" 
         set dstintf " port1" 
         set srcaddr " Crossfone-1-ALT" 
         set dstaddr " 100.100.100.100" 
         set action accept
         set schedule " always" 
         set service " SIP"  " RTP"  " PING" 
         set logtraffic all
     next
 end
 	
Now, let me show you my session log for policy 103.
date=2013-11-11 time=18:56:06 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=31745 srcintf=" wan1"  dstip=100.100.100.100 dstport=11587 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11587 service=SIP proto=17 duration=185 sentbyte=288 rcvdbyte=92 sentpkt=2 rcvdpkt=1
 date=2013-11-11 time=18:55:41 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=27215 srcintf=" wan1"  dstip=100.100.100.100 dstport=16159 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=16159 service=SIP proto=17 duration=190 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:55:24 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=35090 srcintf=" wan1"  dstip=100.100.100.100 dstport=15852 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=15852 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:55:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=31744 srcintf=" wan1"  dstip=100.100.100.100 dstport=11586 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11586 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:54:32 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=27214 srcintf=" wan1"  dstip=100.100.100.100 dstport=16158 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=16158 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:56 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=204.101.27.220 srcport=5067 srcintf=" wan1"  dstip=100.100.100.100 dstport=5060 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Canada"  trandisp=dnat tranip=10.1.250.135 tranport=5060 service=SIP proto=17 duration=351 sentbyte=429 rcvdbyte=0 sentpkt=1 rcvdpkt=0
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.68 srcport=5060 srcintf=" wan1"  dstip=100.100.100.100 dstport=5060 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=5060 service=SIP proto=17 duration=298 sentbyte=10634 rcvdbyte=12038 sentpkt=16 rcvdpkt=19
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=40263 srcintf=" wan1"  dstip=100.100.100.100 dstport=17903 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=17903 service=SIP proto=17 duration=185 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=47735 srcintf=" wan1"  dstip=100.100.100.100 dstport=11287 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11287 service=SIP proto=17 duration=142 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=54846 srcintf=" wan1"  dstip=100.100.100.100 dstport=13520 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=13520 service=SIP proto=17 duration=99 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=54847 srcintf=" wan1"  dstip=100.100.100.100 dstport=13521 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=13521 service=SIP proto=17 duration=99 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:51:41 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=47734 srcintf=" wan1"  dstip=100.100.100.100 dstport=11286 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11286 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:50:58 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=40262 srcintf=" wan1"  dstip=100.100.100.100 dstport=17902 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=17902 service=SIP proto=17 duration=120 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:50:15 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=23465 srcintf=" wan1"  dstip=100.100.100.100 dstport=12549 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=12549 service=SIP proto=17 duration=190 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
So, the red line in the log. Why? Please help me to understand why is that traffic passing my policy.
0 REPLIES 0
Labels
Top Kudoed Authors