all ports enabled - FortiGate

[unknown1020]

Good morning friends, based on your experience:
Why is it important to not have all "ALL" ports enabled in fortigate firewall policies?

I greatly appreciate your comments.

[pminarik · Accepted solution]

In an ideal world, a firewall will strictly block everything that isn't explicitly required for things to function. This is where using the service "ALL" or src/dst address "all" is potentially over-permissive.

In the real world, where process owners don't know what IPs:ports their applications talk to, where service providers don't know where exactly they serve their services from or straight up refuse to provide this information, or where everything is vaguely served from "the cloud", it is not always possible to strictly adhere to this philosophy of "only allow what's required".

You will have to carefully find the right place where there's sufficient balance between "things working" and "unneeded/unwanted traffic blocked", and that is different for each situation.

[AEK]

One of the actual cases I saw is one company has avoided a ransomware propagation to VMware ESXi, just because they were not allowing ALL services from user VLAN to server VLAN.