Fortinet black logo

Administration Guide

Firewall policies

Firewall policies

Centralized access is controlled from the hub FortiGate using Firewall policies. In addition to layer three and four inspection, security policies can be used in the policies for layer seven traffic inspection.

It is best practice to only allow the networks and services that are required for communication through the firewall. The following rules are the minimum that must be configured to allow SD-WAN to function:

Source Interface

Destination Interface

Source Address

Destination Address

Action

Schedule

Service

Comments

<vpn interfaces>

<internal Interface>

<branch tunnel IP addresses>

<hub FortiGate internal interface>

Accept

Always

ICMP

Allow health checks to the hub FortiGate

<vpn interfaces>

<internal Interface>

<branch networks>

<datacenter networks>

Accept

Always

<allowed services>

Allow traffic from branch networks

For this example, a simple policy that allows all traffic is configured.

To configure a firewall policy:
config firewall policy
    edit 1
        set name "Allow All"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

Firewall policies

Centralized access is controlled from the hub FortiGate using Firewall policies. In addition to layer three and four inspection, security policies can be used in the policies for layer seven traffic inspection.

It is best practice to only allow the networks and services that are required for communication through the firewall. The following rules are the minimum that must be configured to allow SD-WAN to function:

Source Interface

Destination Interface

Source Address

Destination Address

Action

Schedule

Service

Comments

<vpn interfaces>

<internal Interface>

<branch tunnel IP addresses>

<hub FortiGate internal interface>

Accept

Always

ICMP

Allow health checks to the hub FortiGate

<vpn interfaces>

<internal Interface>

<branch networks>

<datacenter networks>

Accept

Always

<allowed services>

Allow traffic from branch networks

For this example, a simple policy that allows all traffic is configured.

To configure a firewall policy:
config firewall policy
    edit 1
        set name "Allow All"
        set srcintf "any"
        set dstintf "any"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end