Fortigate 80E Policy not being recognized

[SoleCipher]

Hi Everyone. I have a Fortigate 80E on v6.0.12. I'm using 4 interfaces, interface 1 is incoming traffic going to interfaces 2, 3, and 4. If i click create new interface and put all 4 interfaces in a software/hardware switch interface, traffic flows between them automatically. When i separate them out and try to route traffic from interface 1 to interface 2 or interface 1 to interface 3 or interface 1 to interface 4 it doesn't work which is weird. They are all on the same subnet using same gateway ip, just 3 different webservers interfaces 2,3,4. I made a policy to allow all traffic between interface 1 (incoming int./source) and interface 2 (outgoing int./destination) as a test and it doesn't show any traffic going through the policy at all. I've tried creating multiple policies and none of them get used no matter what i do and the implicit deny isn't blocking any traffic, yet connection to the web server sites through interfaces 2, 3, and 4 are still happening (if i put all 4 interfaces in an interface switch group) haha so I'm all confused and feel like I'm missing something.

Ultimately when I get this thing recognizing policies I want to limit access on the subnet by IP but first i just want to get it to recognize any policy at all i make. 

Thank you so much in advance! I'm new to the fortinet world and so far i love it but hopefully it's just something small i'm missing.

[hjezzapaula]

Hi,
Based on your details, you wanted to allow connection from Internal 1 to all other interfaces

Can you confirm how did you separate Internal 2,3,4 interfaces if they are using the same gateway? what subnets did you apply on the interfaces?

Please also provide below:

get router info routing-table all

Thanks.

[SoleCipher]

Hi, that is correct, i would like traffic coming in through the int. 1 ip 8.8.8.2/32 to go to the other 3 ports (corresponding web servers). int. 2 is ip 8.8.8.10/32, int. 3 is 8.8.8.11/32, int. 4 is 8.8.8.12/32. Their role is set to LAN and i have device detection and fortitelemetry for each. If i set that up wrong or if there's a better way please let me know =)

the routing table command produced:

S   8.8.8.0/24 [10/0] via 8.8.8.1, port1, [1/0]

S   8.8.8.10/32 [10/0] via 8.8.8.1, port2, [1/0]

S   8.8.8.11/32 [10/0] via 8.8.8.1, port3, [1/0]

S   8.8.8.12/32 [10/0] via 8.8.8.1, port4, [1/0]

C   10.10.1.0/24 is directly connected, wan1

the wan1 connection is just the network i manage it from. Not sure if those routes are correct but was trying multiple things.

below is a policy i have just to try to test to catch all traffic between int. 1 and int. 2:

name: test

incoming interface: port1

outgoing interface: port2

source: all

destination: all

schedule: always

service: all

action: accept

nat: off

security profiles: off (for the moment)

logging options: all sessions

comments:

enable this policy: yes

under logging settings i have it set to memory, no remote or cloud logging.

The traffic coming through int. 1 is a pc with ip 16.160.1.10 using gateway 8.8.8.1 to connect to one of the web servers on int. 2, 3, or 4 is the data flow.

what did i mess up?

[hbac]

Hi @SoleCipher,

Why are you using the same subnet for different physical interface?

Regards, 

[SoleCipher]

Hi @hbac, 

I'm not sure? Just how i figured things might work. A friend gave me an old fortigate to learn. As i stated before I'm new to all of this so trying to figure out a best/better way. ultimately just want to route traffic through port 1 to 3 different web servers ports 2, 3, or 4 using a policy and be able to see traffic in log files. I'm sure i probably messed that up so trying to understand and get it right =)

[Genobaseball10 · Accepted solution]

So here is what I would do in your situation:
Create a wan interface in your case it would be connected to the network you are managing the FortiGate from. You can assign this interface an IP or let it receive a DHCP address depending on how the network is configured.
Create an 802.3 aggregate interface and assign ports 2, 3 and 4. Assign the port an IP address of your choosing, in my scenario it will be 192.168.10.254/24. Enable DHCP on this interface and plug in your webservers and allow them to get an IP address. This will allow you to not have to manually configure a default gateway on your web servers. 
Create policies allowing traffic sourcing from the WAN interface and destination be the webserver interface.  Clone the policy to allow traffic from the webservers to your wan interface as well so you can originate traffic from either the webserver or your network on the other side of the lan interface.
From here you should be able to see traffic going from the wan interface to the webservers.
Please let me know if this helps or if you need something more tailored to your specific scenario.

[SoleCipher]

Hi @Genobaseball10, 

Thanks! I didn't have the aggregate type for interfaces on v6.0.12 so i upgraded to v6.4.14, setup wan interface, and made the 802.3 aggregate for the servers as you stated, created my policies again, and started seeing traffic! idk if it was software version or my routes/subnet setup being funky but I'm g2g now. Thank you all for the assist, I really appreciate it being a new person to this community!

[Genobaseball10]

I can't tell you the exact reason why it wasn't working in the beginning without diving deep into what was going on but I'm glad I was able to get you a solution that worked! Thank you for the feedback. As someone who is also new in the community, its great to see and be apart of this kind of collaboration. Best of luck to you SoleCipher!