Internet service groups in policies

Groups of internet services can be created using the GUI or CLI. Once created, you can use the group with traffic shaping and firewall policies as criteria to match and shape traffic. The shaper is applied when the traffic matches.

Internet service groups can be used as the source and destination of the policy. When using the CLI, internet-service must be enabled to use an internet service group as a destination, and internet-service-src must be enabled to use an internet service group as a source.

The following CLI variables are available in the firewall policy and firewall shaping-policy commands:

Variable	Description
internet-service-group <string>	Internet service group name.
internet-service-custom-group <string>	Custom internet service group name.
internet-service-src-group <string>	Source internet service group name.
internet-service-src-custom-group <string>	Custom source internet service group name.

To create an internet service group in the GUI:

1. Go to Policy & Objects > Internet Service Database, select the Internet Service Group tab, and click Create New.

2. Configure the settings as needed, and click OK.

   

To clone an internet service group:

1. Go to Policy & Objects > Internet Service Database, and click the Internet Service Group tab.

2. Select an internet service group, and click Clone.

   

   The Edit Internet Service Group pane opens.

3. Edit the options.

   

4. Click OK. The clone is created.

To apply the internet service group to a firewall policy:

1. Go to Policy & Objects > Firewall Policy, and click Create New.

2. Select the internet service group:

   1. Click the Source or Destination field. The Select Entries pane opens.

   2. Select Internet Service, and select one or more internet service groups, such as NS_Grp2.

   3. Click Close.

      

3. Configure the remaining options as needed, then click OK.

Examples

The following examples use the below topology.

Example 1

In this example, the PC is allowed to access Google, so all Google services are put into an internet service group.

To configure access to Google services using an internet service group using the CLI:

1. Create an internet service group for Google services.

   In this example, the internet service group is named Google_Group.

   config firewall internet-service-group
       edit "Google_Group"
           set direction destination
           set member Google-Other Google-Web Google-ICMP Google-DNS Google-Outbound_Email Google-SSH Google-FTP Google-NTP Google-Inbound_Email Google-LDAP Google-NetBIOS.Session.Service Google-RTMP Google-NetBIOS.Name.Service Google-Google.Cloud Google-Gmail
       next
   end

2. Create a firewall policy and select the internet service group to allow access to all Google services from the PC.

   In this example, internet-service is enabled, and the internet service group named Google_Group is selected to allow access to all Google services from the PC.

   config firewall policy
       edit 1
           set name "PC to Google"
           set srcintf "port2"
           set dstintf "port1"
           set srcaddr "all"
           set internet-service enable
           set internet-service-group "Google_Group"
           set action accept
           set schedule "always"
           set fsso disable
           set nat enable
       next
   end

To configure access to Google services using an internet service group in the GUI:

1. On the FortiGate, create an internet service group.

2. Go to Policy & Objects > Firewall Policy, and create a new policy.

3. Set the Destination to the internet service group.

   

4. Configure the remaining options, and click OK.

5. Go to Policy & Objects > Firewall Policy and hover over the group to view a list of its members.

   

Example 2

In this example, two office FTP servers are put into a custom internet service group, and the PC connection to the FTP servers is limited to 1Mbps.

To put two FTP servers into a custom internet service group and limit the PC connection speed to them in the CLI:

1. Create a custom internet service group for the internal FTP servers in the CLI:

   config firewall internet-service-custom
       edit "FTP_PM"
           config entry
               edit 1
                   config port-range
                       edit 1
                           set start-port 21
                           set end-port 21
                       next
                   end
                   set dst "PM_Server"
               next
           end
       next
       edit "FTP_QA"
           config entry
               edit 1
                   config port-range
                       edit 1
                           set start-port 21
                           set end-port 21
                       next
                   end
                   set dst "QA_Server"
               next
           end
       next
   end

2. Edit a firewall policy and add the custom internet service group to it:

   config firewall internet-service-custom-group
       edit "Internal_FTP"
           set member "FTP_QA" "FTP_PM"
       next
   end

3. Create a traffic shaper to limit the maximum bandwidth:

   config firewall shaper traffic-shaper
       edit "Internal_FTP_Limit_1Mbps"
           set guaranteed-bandwidth 500
           set maximum-bandwidth 1000
           set priority medium
       next
   end

4. Create a firewall shaping policy to limit the speed from the PC to the internal FTP servers:

   config firewall shaping-policy
       edit 1
           set name "For Internal FTP"
           set internet-service enable
           set internet-service-custom-group "Internal_FTP"
           set dstintf "port1"
           set traffic-shaper "Internal_FTP_Limit_1Mbps"
           set traffic-shaper-reverse "Internal_FTP_Limit_1Mbps"
           set srcaddr "PC"
       next
   end

To put two FTP servers into a custom service group and limit the PC connection speed to the in the GUI:

1. Create custom internet services for the internal FTP servers using the CLI.

2. Create a custom internet server group and add the just created custom internet services to it using the CLI.

3. Create a traffic shaper to limit the maximum bandwidth:

   1. Go to Policy & Objects > Traffic Shaping, select the Traffic Shaper tab, and click Create New.

   2. Enter a Name for the shaper, such as Internal_FTP_Limit_1Mbps.

   3. Set the Traffic Priority to Medium.

   4. Enable Max Bandwidth and set it to 1000.

   5. Enable Guaranteed Bandwidth and set it to 500.

   6. Click OK.

4. Create a firewall shaping policy to limit the speed from the PC to the internal FTP servers:

   1. Go to Policy & Objects > Traffic Shaping, select the Traffic Shaping Policy tab, and click Create New.

   2. Enter a name for the policy.

   3. Set Source to the address of the PC.

   4. Set the Destination to the just created custom internet service group.

   5. Enable Apply shaper and apply the just create traffic shaper to the Shared shaper and Reverse shaper.

      

   6. Configure the remaining options as required, then click OK.