firewall "local-in-policy" default action denied?

[leo82]

I understand that the default action is deny unless explicitly declared in the fortigate firewall policy.

Does this apply to 'local-in-policy' as well?

Example)

config firewall local-in-policy

edit 1

• set uuid 0000000
• set int "port1"
• set srcaddr "Block Address group"
• set dstaddr "all"
• set service "TCP_22"
• set schedule "always"

next

end

[Toshi_Esumi · Accepted solution]

If you are asking about the default value in "set action" under edit 1 or any others, you just need to see it with "show full" or "get" in the context. The default value is "deny".

But if you are asking the default behavior when you don't have any local-in-policies, it's "allow all" by default. So you have to deny something within a set of local-in-policies to be effective.

Toshi

[leo82]

Thank you for your answer.

Then, if "local-in-police" is enabled, can I understand that the default action becomes deny even if I do not explicitly declare "set action deny"?

[Toshi_Esumi]

See below and you can do the same.

xxxx-fg1 (local-in-policy) # edit 1

xxxx-fg1 (1) # show
config firewall local-in-policy
edit 1
set uuid e38fad9c-6058-51ec-c276-40ac6c2faaed
set intf "LocalInternet"
set srcaddr "China_sources"
set dstaddr "Comcast_outside"
set service "HTTPS" "HTTP" "SSH" "TELNET"
set schedule "always"
next
end

xxxx-fg1 (1) # show full
config firewall local-in-policy
edit 1
set uuid e38fad9c-6058-51ec-c276-40ac6c2faaed
set ha-mgmt-intf-only disable
set intf "LocalInternet"
set srcaddr "China_sources"
set dstaddr "Comcast_outside"
set action deny
set service "HTTPS" "HTTP" "SSH" "TELNET"
set schedule "always"
set status enable
set comments ''
next
end

[leo82]

I understand what you mean.
Thank you for your kind explanation.

Happy New Year.