Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
leo82
New Contributor II

firewall "local-in-policy" default action denied?

I understand that the default action is deny unless explicitly declared in the fortigate firewall policy.

Does this apply to 'local-in-policy' as well?

 

Example)

 

config firewall local-in-policy

edit 1

  • set uuid 0000000
  • set int "port1"
  • set srcaddr "Block Address group"
  • set dstaddr "all"
  • set service "TCP_22"
  • set schedule "always"

next

end

1 Solution
Toshi_Esumi
Esteemed Contributor III

If you are asking about the default value in "set action" under edit 1 or any others, you just need to see it with "show full" or "get" in the context. The default value is "deny".

 

But if you are asking the default behavior when you don't have any local-in-policies, it's "allow all" by default. So you have to deny something within a set of local-in-policies to be effective.

 

Toshi

View solution in original post

4 REPLIES 4
Toshi_Esumi
Esteemed Contributor III

If you are asking about the default value in "set action" under edit 1 or any others, you just need to see it with "show full" or "get" in the context. The default value is "deny".

 

But if you are asking the default behavior when you don't have any local-in-policies, it's "allow all" by default. So you have to deny something within a set of local-in-policies to be effective.

 

Toshi

leo82
New Contributor II

Thank you for your answer.

 

Then, if "local-in-police" is enabled, can I understand that the default action becomes deny even if I do not explicitly declare "set action deny"?

Toshi_Esumi
Esteemed Contributor III

See below and you can do the same.

xxxx-fg1 (local-in-policy) # edit 1

xxxx-fg1 (1) # show
config firewall local-in-policy
edit 1
set uuid e38fad9c-6058-51ec-c276-40ac6c2faaed
set intf "LocalInternet"
set srcaddr "China_sources"
set dstaddr "Comcast_outside"
set service "HTTPS" "HTTP" "SSH" "TELNET"
set schedule "always"
next
end

xxxx-fg1 (1) # show full
config firewall local-in-policy
edit 1
set uuid e38fad9c-6058-51ec-c276-40ac6c2faaed
set ha-mgmt-intf-only disable
set intf "LocalInternet"
set srcaddr "China_sources"
set dstaddr "Comcast_outside"
set action deny
set service "HTTPS" "HTTP" "SSH" "TELNET"
set schedule "always"
set status enable
set comments ''
next
end

 

leo82
New Contributor II

I understand what you mean.
Thank you for your kind explanation.

 

Happy New Year.

Labels
Top Kudoed Authors