Fortinet black logo

Policies

Copy Link
Copy Doc ID 3b0843e9-aada-11ec-9fd1-fa163e15d75b:862226
Download PDF

Policies

The FortiGate's primary role is to secure your network and data from external threats. It accomplishes this using policies and security profiles. Policies control what kind of traffic is allowed where, and security profiles define what to look for in the traffic.

FortiGate also has an NGFW mode in which you can allow applications and URL categories directly in the policies, and do not need to define security profiles.

Use the different policy types to secure the different types of traffic that the FortiGate processes.

DoS policies

DoS policies are checked before security policies to prevent attacks from overwhelming your network and FortiGate by triggering more resource intensive security protection. These policies should be adjusted based on your business traffic rates (see Performance monitoring).

Local-in policies

Local-in policies control access to the FortiGate interfaces. They are often used to block unauthorized access to management ports or other well known ports, and to limit access from specific sources. They should be used to further enable or restrict access to the FortiGate based on your security requirements.

Note that extra care should be taken when configuring a local-in policy, as an incorrect configuration could inadvertently deny traffic for SSL VPN, dynamic routing protocols, HA, and other FortiGate features.

Security policies
  • Security policies control the flow of traffic and the security features that are applied to the traffic flow. They are the most commonly used policy type.

  • Each policy should have a unique name and there should not be any unused policies.

  • Policies that allow traffic should apply to a specific interface, and not the any interface.

  • Only the security profiles that are necessary for the traffic matching policy should be enabled.

  • Security policies are evaluated in order. When traffic matches a policy, further policies are not processed. Put the most specific policies at the top of the list, and follow the least privilege access principle.

  • Interface aliases

    • It might not be possible to use the same interface on each FortiGate for the same function. Add aliases to the interfaces so that policies are easier to understand. For example, a policy that controls traffic between you network and your phones switch is clearer if it shows LAN to Phones, instead of port4 to port2.

  • Zones

    • Zones are used to group multiple interfaces or subinterfaces into a single interface object that can be used in policies.

    • Grouping interfaces and VLAN subinterfaces into zones simplifies security policy creation by allowing multiple network segments to use the same policy settings and protection profiles.

    • Interfaces in a zone can also still be used individually and still route normally.

  • Policies

    • Put the most specific, or narrow, policies at the top of the policy list.

    • Do not use the all or any objects in a policy, except when routing to the internet.

    • Do not override the implicit deny policy.

    • Use users in policies. This makes the policy more specific and reduces the chances of unintended traffic matching.

Virtual IPs

Policies that include VIPs, or that have match-vip enabled, have priority over other policies.

For example, with the following policies, where policy 1 comes first in the list, and policy 2 has a VIP for its destination:

Policy 1

Policy 2

Source

10.3.3.3

all

Destination

all

WEB_SERVER

Action

deny

accept

Match VIP

disable

n/a

Traffic from 10.3.3.3 to the WEB_SERVER VIP is not blocked, because policy 2 takes priority because it uses a VIP.

If policy 1 is edited to enable match-vip, then it will have a higher priority and traffic from 10.3.3.3 to the WEB_SERVER VIP will be blocked.

config firewall policy
    edit 1
        set match-vip enable
    next
end

Conversely, a VIP could be used in policy 1 to give it higher priority.

Note

The match-vip command can only be enabled in deny policies. It is not available in accept policies.

In FortiOS 7.2.4 and later, match-vip is enabled by default in new deny policies.

Policies

The FortiGate's primary role is to secure your network and data from external threats. It accomplishes this using policies and security profiles. Policies control what kind of traffic is allowed where, and security profiles define what to look for in the traffic.

FortiGate also has an NGFW mode in which you can allow applications and URL categories directly in the policies, and do not need to define security profiles.

Use the different policy types to secure the different types of traffic that the FortiGate processes.

DoS policies

DoS policies are checked before security policies to prevent attacks from overwhelming your network and FortiGate by triggering more resource intensive security protection. These policies should be adjusted based on your business traffic rates (see Performance monitoring).

Local-in policies

Local-in policies control access to the FortiGate interfaces. They are often used to block unauthorized access to management ports or other well known ports, and to limit access from specific sources. They should be used to further enable or restrict access to the FortiGate based on your security requirements.

Note that extra care should be taken when configuring a local-in policy, as an incorrect configuration could inadvertently deny traffic for SSL VPN, dynamic routing protocols, HA, and other FortiGate features.

Security policies
  • Security policies control the flow of traffic and the security features that are applied to the traffic flow. They are the most commonly used policy type.

  • Each policy should have a unique name and there should not be any unused policies.

  • Policies that allow traffic should apply to a specific interface, and not the any interface.

  • Only the security profiles that are necessary for the traffic matching policy should be enabled.

  • Security policies are evaluated in order. When traffic matches a policy, further policies are not processed. Put the most specific policies at the top of the list, and follow the least privilege access principle.

  • Interface aliases

    • It might not be possible to use the same interface on each FortiGate for the same function. Add aliases to the interfaces so that policies are easier to understand. For example, a policy that controls traffic between you network and your phones switch is clearer if it shows LAN to Phones, instead of port4 to port2.

  • Zones

    • Zones are used to group multiple interfaces or subinterfaces into a single interface object that can be used in policies.

    • Grouping interfaces and VLAN subinterfaces into zones simplifies security policy creation by allowing multiple network segments to use the same policy settings and protection profiles.

    • Interfaces in a zone can also still be used individually and still route normally.

  • Policies

    • Put the most specific, or narrow, policies at the top of the policy list.

    • Do not use the all or any objects in a policy, except when routing to the internet.

    • Do not override the implicit deny policy.

    • Use users in policies. This makes the policy more specific and reduces the chances of unintended traffic matching.

Virtual IPs

Policies that include VIPs, or that have match-vip enabled, have priority over other policies.

For example, with the following policies, where policy 1 comes first in the list, and policy 2 has a VIP for its destination:

Policy 1

Policy 2

Source

10.3.3.3

all

Destination

all

WEB_SERVER

Action

deny

accept

Match VIP

disable

n/a

Traffic from 10.3.3.3 to the WEB_SERVER VIP is not blocked, because policy 2 takes priority because it uses a VIP.

If policy 1 is edited to enable match-vip, then it will have a higher priority and traffic from 10.3.3.3 to the WEB_SERVER VIP will be blocked.

config firewall policy
    edit 1
        set match-vip enable
    next
end

Conversely, a VIP could be used in policy 1 to give it higher priority.

Note

The match-vip command can only be enabled in deny policies. It is not available in accept policies.

In FortiOS 7.2.4 and later, match-vip is enabled by default in new deny policies.