Support dynamic Fabric address in security policies 7.4.1

This information is also available in the FortiOS 7.4 Administration Guide: Dynamic address tags

The FABRIC_DEVICE object, which is a dynamic address consisting of several types of Fabric devices (including FortiManager, FortiAnalyzer, FortiClient EMS, FortiMail, FortiAP, and FortiSwitch), can be used as the source or destination address in security policies. The diagnose ips pme fabric-address list command can be used to check what device address is set in the security policy after FABRIC_DEVICE is applied.

Tags for dynamic addresses, including EMS (normal and local EMS tags), FortiPolicy, FortiVoice, and FortiNAC can be used as the source or destination address in security policies. Once these tags are used in security policies, run diagnose ips pme dynamic-address list to show the addresses that are used in the policy.

Example 1: FABRIC_DEVICE object

To apply the FABRIC_DEVICE object to a security policy in the GUI:

1. Go to Policy & Objects > Security Policy.

2. Click Create new or edit an existing policy.

3. In the Source field, click the + and select FABRIC_DEVICE.

4. Configure the other settings as needed.

5. Click OK.

To apply the FABRIC_DEVICE object to a security policy in the CLI:

1. Configure the policy:

   config firewall security-policy
       edit 1
           set name "ddd"
           set srcintf "port8"
           set dstintf "port7"
           set srcaddr "FABRIC_DEVICE"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set logtraffic all
       next
   end

2. Verify which IP addresses are used in the policy:

   # diagnose ips pme fabric-address list
   VDOM 0:
   - builtin [mask=0x1e]:
     - type=4: 172.18.62.213
     - type=4: 172.18.62.219
     - type=2: 172.18.70.82
   - query:
     - 168.254.1.2
     - 0.0.0.0
     - 168.254.1.2

Example 2: EMS tag

To apply an EMS tag object to a security policy in the GUI:

1. Go to Policy & Objects > Security Policy.

2. Click Create new or edit an existing policy.

3. In the Source field, click the + and select EMS1_ZTNA_ZT_OS_WIN.

4. Configure the other settings as needed.

5. Click OK.

To apply an EMS tag object to a security policy in the CLI:

1. Configure the policy:

   config firewall security-policy
       edit 1
           set name "ddd"
           set srcintf "port8"
           set dstintf "port7"
           set srcaddr "EMS1_ZTNA_ZT_OS_WIN"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set logtraffic all
       next
   end

2. Verify which IP addresses are used in the policy:

   # diagnose ips pme dynamic-address list
   EMS1_ZTNA_ZT_OS_WIN [vdom=0 type=IP]:
     172.16.200.136-172.16.200.136