Is the seq# that determines the order in which the policy are applied?
Thanks
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Yes and no.
Only the order within an interface pair is relevant. Policies are ordered by their appearance in the config file, top down.
The sequence number is just an optical aid in the GUI - you won't find it anywhere in the config. It is numbered consecutively from the first to the last policy. So, it is not determining the order but adjusted to the order. Say, you drag a policy in the GUI to the top - it's sequence number will change.
There's an unambiguous ID for each policy by which you can edit it in the CLI. The ID column can be shown in the GUI as well. But it is not relevant for the order of execution but the order of creation.
why you cannot see the in the gui ?
rules are aplied exactly like they are in the gui, and as long as you don't have policies with multiple interfaces, it's fairly easy to determine wich one is before other.
You can drag-and-drop policies to reorder them in the gui and this will be the order next connection will be"classified".
It is always a good idea to show both sequence# and policyID#. You just don't need to look at the numbers but the order - top to bottom (assuming your monitor is upright ;))
nikolaj wrote:Yes. Simply top-down, and in ascending sequence number, as you would expect.So, in essence, I can see the order in which the rules are applied not in the GUI but in the config file, where I can see the interface pair and the order is from top down. Correct?
This explains why you are encouraged to order the policies from most explicit to most general, regarding the matching fields (source addr, dest addr, service, schedule). If a more general policy is placed before (on top of) a more specific one, the specific one will never be hit.
Yes and no.
Only the order within an interface pair is relevant. Policies are ordered by their appearance in the config file, top down.
The sequence number is just an optical aid in the GUI - you won't find it anywhere in the config. It is numbered consecutively from the first to the last policy. So, it is not determining the order but adjusted to the order. Say, you drag a policy in the GUI to the top - it's sequence number will change.
There's an unambiguous ID for each policy by which you can edit it in the CLI. The ID column can be shown in the GUI as well. But it is not relevant for the order of execution but the order of creation.
So, in the Fortigate GUI, in the policy section with section view checked, I can see the interface pair.
The numbers in ascending order in the first column represent the sequence in which the policy are executed?
nikolaj wrote:The numbers in ascending order in the first column represent the sequence in which the policy are executed?
As long as Sequence# is the first column in your gui. You can right click on the column heading to add/remove columns. The tell-tale is that the sequence# does not have a clickable link whereas the policy id does. I use both the sequence# and the policy ID as the first two columns because i need to refer to the ID for change tracking.
CISSP, NSE4
I have to agree with the other ken ;) in thw gui set the policyid and seq# , from the cmd_sli the show firewall policy and the resulting output is the top-2-bottom that Ede mentioned earlier
YMMV but beaware the policy-id HAS NOTHING TODO WITH THE SEQUENCE
e.g
FGTLONUK01 (custM) $ show firewall policy policyid Policy ID. (0-4294967294)
10288
12333
18
111 19 17 15 14
234
490 13 11 8 1 2 3
82
190
189 4 5 6 12 7
PCNSE
NSE
StrongSwan
So, in essence, I can see the order in which the rules are applied not in the GUI but in the config file, where I can see the interface pair and the order is from top down. Correct?
why you cannot see the in the gui ?
rules are aplied exactly like they are in the gui, and as long as you don't have policies with multiple interfaces, it's fairly easy to determine wich one is before other.
You can drag-and-drop policies to reorder them in the gui and this will be the order next connection will be"classified".
It is always a good idea to show both sequence# and policyID#. You just don't need to look at the numbers but the order - top to bottom (assuming your monitor is upright ;))
nikolaj wrote:Yes. Simply top-down, and in ascending sequence number, as you would expect.So, in essence, I can see the order in which the rules are applied not in the GUI but in the config file, where I can see the interface pair and the order is from top down. Correct?
This explains why you are encouraged to order the policies from most explicit to most general, regarding the matching fields (source addr, dest addr, service, schedule). If a more general policy is placed before (on top of) a more specific one, the specific one will never be hit.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
446 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.