Configuring an IPv4 firewall policy
A firewall policy is a filter that allows or denies traffic based on a matching tuple: source address, destination address, and service. By default, firewall policy rules are stateful: if client-to-server traffic is allowed, the session is maintained in a state table, and the response traffic is allowed.
The FortiADC system evaluates firewall policies before other rules. It matches traffic against the firewall policy table, beginning with the first rule. If a rule matches, the specified action is taken. If the session is denied by a firewall policy rule, it is dropped. If the session is accepted, system processing continues.
By default, if firewall rules are not configured, the system does not perform firewall processing; all traffic is processed as if the system were a router, and traffic is forwarded according to routing and other system rules.
Note: You do not need to create firewall rules for routine management traffic associated with the management port or HA ports. The interface “allow access” option enables permitted protocols. The system automatically permits from-self traffic, such as health check traffic, and expected responses.
Before you begin:
- You must have a good understanding and knowledge of firewalls.
- You must have created the address configuration objects and service configuration objects that define the matching tuple in your firewall policy rules.
- You must have Read-Write permission for Firewall settings.
To configure a firewall:
- Go to Network Security > Firewall.
- Click the IPv4 Firewall Policy tab.
- Click Create New to display the configuration editor.
- Complete the configuration as described in Firewall policy configuration.
- Save the configuration.
- Reorder rules, as necessary.
| Settings | Guidelines |
|---|---|
|
Default Action |
Action when no rule matches or no rules are configured:
|
|
Rule |
|
|
Name |
Configuration name. Valid characters are After you initially save the configuration, you cannot edit the name. |
|
Ingress Interface |
Select the interface that receives traffic. |
|
Egress Interface |
Select an outgoing interface from the drop-down list if your FortiADC is configured for link load-balancing and/or traffic routing. In both cases, the system will use this interface to forward traffic to its destination. Note: You MUST leave this option blank (default) if your FortiADC is configured for server load-balancing and/or global load-balancing. Otherwise, server load-balancing and/or global load-balancing packets may not match the firewall policy rule. |
|
Source Type |
Select the source type to use to form the matching tuple.
|
|
Source |
The Source option is available if the Source Type is Address. Specify the Address object to use as the source. |
|
Source Address Group |
The Source Address Group option is available if the Source Type is Address Group. Specify the Address Group object to use as the source. |
|
Source External Address Group |
The Source External Address Group option is available if the Source Type is External Resource. Specify the external IP address list imported through the IP Address connector to use as the source. For details, see IP Address Connector. |
|
Destination Type |
Select the destination type to use to form the matching tuple.
|
|
Destination |
The Destination option is available if the Destination Type is Address. Specify the Address object to use as the destination. |
|
Destination Address Group |
The Destination Address Group option is available if the Destination Type is Address Group. Specify the Address Group object to use as the destination. |
|
Destination External Address Group |
The Destination External Address Group option is available if the Destination Type is External Resource. Specify the external IP address list imported through the IP Address connector to use as the destination. For details, see IP Address Connector. |
|
Service |
Select a service object to use to form the matching tuple. |
|
Action |
|
|
Status |
Enabled by default. Note: This button simplifies the implementation of firewall policy/NAT rules, allowing you to turn a policy rule ON or OFF with a click of the button. When a firewall policy rule is disabled, it will be removed from the relevant IP tables, and will be added to the IP table when the rule is enabled. |
|
Deny Log |
The Deny Log option is available is the Action is Deny. Enable/disable logging for denied action. |
|
Reordering |
|
|
Reorder |
After you have saved a rule, reorder rules as necessary. The rules table is consulted from top to bottom. The first rule that matches is applied and subsequent rules are not evaluated. |