Upgrading from FortiOS 4 to FortiOS 5, Service ANY/All Problems?

Salamihawk · ‎07-09-2013

Hello, I recently upgraded a Fortigate 40C from FortiOS 4 (the latest release, build 665) to FortiOS 5 build 208. There was an existing configuration with very simple policies (any internal to any over WAN1 using any service with destination interface NAT). Before the upgrade everything worked just fine, however after the upgrade, no communication to the internet was possible because the Fortigate was blocking all traffic. I found the problem: Fortinet decided to rename the service " ANY" to " All" (which makes sense IMHO), but didn' t bother to upgrade my configuration to reflect this change, thereby essentially breaking my Firewall. My question is: Has anyone else noticed this behavior? Is there an official word on this from Fortinet? At work, my team and I manage a larger 3950B Firewall with over 130 Virtual Domains. If this is the normal behavior, upgrading our machine to FortiOS 5 would be a catastrophe, as we would have to go through every single VDOM manually and change service " ANY" to service " All" .

Jan_Scholten · ‎01-22-2015

Had the problem just yesterday.

All Policys using Service "Any" were ignored. Therefore traffic "Denied by forward policy check (policy 0)"

turns out the definition of "Any/All" is missing a line after upgrade

config firewall service custom
    edit "ALL"
        set category "General"
        set protocol IP
    next

but must be

config firewall service custom
    edit "ALL"
        set category "General"
        set protocol IP
        set protocol-number 0
    next

once you edit the service and gibe it back the

" set protocol-number 0"

It works again.

Gave me a mild heartattack with a upgrade in a remote location and a small maintenance window.

View solution in original post

emnoc · ‎01-27-2015

Doing a little more research, I see that IP Protocol 0 is listed as being "IPv6 Hop-by-Hop Option" http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers Not sure what kind of a problem that causes if you are using IPv6.

Just a little background protocol#0 just means ipv4 for ipv4 . Query any unix system /etc/protocols files and you will see the following or similar in your file ( I believe windows stills has this also )

http://www.isi.edu/in-not...ments/protocol-numbers # ip 0 IP # internet protocol, pseudo protocol number

Over the years the change in in the IANA protocols # assignments ( see the link above ) has caused a lot of confusion. But the numbers are misleading;

It should be the interpret as the following;

ProtocolIP = 0 IPv4 encapsulation, pseudo protocol number

ProtocolHOPOPT = 0 IPv6 Hop-by-Hop Option

A now for more fun , if you use tcpdump and proto 0 you will find ipv6 HBH packets, which has nothing to do with ipv4.

03:48:59.665061 IP6 b5bc:4214:8004::1400:200:0:1a1b > ff02::1: HBH ICMP6, multicast listener querymax resp delay: 1000 addr: ::, length 24 03:51:04.671297 IP6 c0d:e0f:1011:1213:1415:1617:1819:1a1b > ff02::1: HBH ICMP6, multicast listener querymax resp delay: 1000 addr: ::, length 24 03:53:09.677661 IP6 4140:4d41:4ca1:1f02:43e:e9e0:8c02:100 > ff02::1: HBH ICMP6, multicast listener querymax resp delay: 1000 addr: ::, length 24

Now are you really confused

PCNSE

NSE

StrongSwan