FortiManager
FortiManager supports network operations use cases for centralized management, best practices compliance, and workflow automation to provide better protection against breaches.
alebay
Staff
Staff
Article Id 191181

Description

This article describes how to enable blocking of intra-zone traffic for default mappings in zone objects on FortiManager. By default, intra-zone traffic for default mappings is allowed. It is highly recommended to disable this behavior if not explicitly needed.

 

 

 



Solution

On FortiManager prior to v6.0.2 there is no GUI-option to enable this behavior (see below for example on FMG v5.6.5):

 

intrazone-fmg-v5.png

 

In order to enable the blocking of intra-zone traffic for default mappings, run a script on the Policy Package and ADOM Database:

 

new-script.png

 

The script enables the “defmap-intrazone-deny” setting for the respective zone interface, in this case “Internal”.

Here’s the template for copy-paste:

config dynamic interface
edit <zone interface name>
set defmap-intrazone-deny enable
next
end
 

Run the following command to verify that the setting has been applied successfully after the execution of the script:

exe fmpolicy print-adom-object <adom> “dynamic interface” <zone interface name>

The output from the example above shows:

 
 
fmg-script.png
 

FortiManager v6.0.2 introduced a GUI checkbox to ease the process:

 

screen4.png

 

Contributors