Fortinet black logo

Administration Guide

Create New Security Policy

Create New Security Policy

The section describes how to create a new Security Policy. A Security Policy consists of rules related to proxy, antivirus, IPS, Email, and DLP sensor.

The Security Policy is visible only if the NGFW Mode is selected as Policy-based in the policy package.

On the Policy & Objects tab, from the Tools menu, select Display Options. In the Policy section, select the Security Policy check box to display this option.

To create a new Security Policy:
  1. Ensure that you are in the correct ADOM.
  2. Go to Policy & Objects > Policy Packages.
  3. In the tree menu for the policy package in which you will be creating the new policy, select Security Policy.
  4. Click Create New, or, from the Create New menu, select Insert Above or Insert Below. By default, policies will be added to the bottom of the list, but above the implicit policy. The Create New Security Policy pane opens.

  5. Enter the following information:

    Name

    Enter a unique name for the policy. Each policy must have a unique name.

    Incoming Interface

    Click the field then select interfaces from the Object Selector frame, or drag and drop the address from the object pane.

    Select the remove icon to remove values.

    New objects can be created by clicking the Create New icon in the Object Selector frame. See Create a new object for more information.

    Outgoing Interface

    Select outgoing interfaces.

    Source

    Select source addresses.

    Destination Address

    Select destination addresses, address groups, virtual IPs, and virtual IP groups.

    Service

    Select the service. Select App Default or Specify. Select the Service from the Objector Selector if Specify is selected.

    Schedule

    Select schedules, one time or recurring, and schedule groups.

    Application

    Select applications.

    URL Category

    Select URL categories.

    Action

    Select an action for the policy to take: ACCEPT or DENY.

    Log Traffic

    When the Action is DENY, select Log Violation Traffic to log violation traffic.

    When the Action is ACCEPT or IPSEC, select one of the following options:

    • No Log
    • Log Security Events
    • Log All Sessions

    Generate Logs when Session Starts

    Select to generate logs when the session starts.

    Security Profiles

    Select to add security profiles or profile groups.

    This option is available when the Action is ACCEPT.

    The following profile types can be added:

    • Proxy Options
    • AntiVirus Profile
    • IPS Profile
    • Email Filter Profile
    • DLP Sensor

    Comments

    Add a description of the policy, such as its purpose, or the changes that have been made to it.

    Advanced Options

    Configure advanced options, see Advanced options below.

    For more information on advanced option, see the FortiOS CLI Reference.

  6. Click OK to create the policy. You can select to enable or disable the policy in the right-click menu. When disabled, a disabled icon will be displayed in the Seq.# column to the left of the number.
Advanced options

Option

Description

Default

application-list

Select from the drop-down list.

None

cifs-profile

Enable or disable authentication-based routing (IPv4 only).

None

dnsfilter-profile

Select from the drop-down list.

None

icap-profile

Select from the drop-down list.

None

custom-log-fields

Select the custom log fields from the drop-down list.

none

internet-service-negate

When enabled, Internet services match against any Internet service except the selected Internet service (IPv4 only).

disable

internet-service-src-negate

Enables or disables the use of Internet Services in source for this policy. If enabled, internet-service-src specifies what the service must NOT be (IPv4 only).

disable

service-negate

Enable or disable negated service match.

disable

ssh-filter-profile

Select an SSH filter profile from the drop-down list.

None

ssl-ssh-profile

Select an SSL SSH profile from the drop-down list.

no-inspection

utm-status

Enable or disable the Unified Threat Management status.

disable

voip-profile

Select the VOIP profile.

None

webfilter-profile

Select the web filter profile.

None

Create New Security Policy

The section describes how to create a new Security Policy. A Security Policy consists of rules related to proxy, antivirus, IPS, Email, and DLP sensor.

The Security Policy is visible only if the NGFW Mode is selected as Policy-based in the policy package.

On the Policy & Objects tab, from the Tools menu, select Display Options. In the Policy section, select the Security Policy check box to display this option.

To create a new Security Policy:
  1. Ensure that you are in the correct ADOM.
  2. Go to Policy & Objects > Policy Packages.
  3. In the tree menu for the policy package in which you will be creating the new policy, select Security Policy.
  4. Click Create New, or, from the Create New menu, select Insert Above or Insert Below. By default, policies will be added to the bottom of the list, but above the implicit policy. The Create New Security Policy pane opens.

  5. Enter the following information:

    Name

    Enter a unique name for the policy. Each policy must have a unique name.

    Incoming Interface

    Click the field then select interfaces from the Object Selector frame, or drag and drop the address from the object pane.

    Select the remove icon to remove values.

    New objects can be created by clicking the Create New icon in the Object Selector frame. See Create a new object for more information.

    Outgoing Interface

    Select outgoing interfaces.

    Source

    Select source addresses.

    Destination Address

    Select destination addresses, address groups, virtual IPs, and virtual IP groups.

    Service

    Select the service. Select App Default or Specify. Select the Service from the Objector Selector if Specify is selected.

    Schedule

    Select schedules, one time or recurring, and schedule groups.

    Application

    Select applications.

    URL Category

    Select URL categories.

    Action

    Select an action for the policy to take: ACCEPT or DENY.

    Log Traffic

    When the Action is DENY, select Log Violation Traffic to log violation traffic.

    When the Action is ACCEPT or IPSEC, select one of the following options:

    • No Log
    • Log Security Events
    • Log All Sessions

    Generate Logs when Session Starts

    Select to generate logs when the session starts.

    Security Profiles

    Select to add security profiles or profile groups.

    This option is available when the Action is ACCEPT.

    The following profile types can be added:

    • Proxy Options
    • AntiVirus Profile
    • IPS Profile
    • Email Filter Profile
    • DLP Sensor

    Comments

    Add a description of the policy, such as its purpose, or the changes that have been made to it.

    Advanced Options

    Configure advanced options, see Advanced options below.

    For more information on advanced option, see the FortiOS CLI Reference.

  6. Click OK to create the policy. You can select to enable or disable the policy in the right-click menu. When disabled, a disabled icon will be displayed in the Seq.# column to the left of the number.
Advanced options

Option

Description

Default

application-list

Select from the drop-down list.

None

cifs-profile

Enable or disable authentication-based routing (IPv4 only).

None

dnsfilter-profile

Select from the drop-down list.

None

icap-profile

Select from the drop-down list.

None

custom-log-fields

Select the custom log fields from the drop-down list.

none

internet-service-negate

When enabled, Internet services match against any Internet service except the selected Internet service (IPv4 only).

disable

internet-service-src-negate

Enables or disables the use of Internet Services in source for this policy. If enabled, internet-service-src specifies what the service must NOT be (IPv4 only).

disable

service-negate

Enable or disable negated service match.

disable

ssh-filter-profile

Select an SSH filter profile from the drop-down list.

None

ssl-ssh-profile

Select an SSL SSH profile from the drop-down list.

no-inspection

utm-status

Enable or disable the Unified Threat Management status.

disable

voip-profile

Select the VOIP profile.

None

webfilter-profile

Select the web filter profile.

None