Firewall policy configuration

The following settings are only examples. Do not consider them as recommended settings.

To allow health checks from FortiSASE security points of presence to access the target SLA, as well as to allow FortiSASE remote users to access protected resources, you must configure these corresponding firewall policies to allow this traffic as demonstrated:

config firewall address
    edit "FSASE-VPN"
        set type iprange
        set start-ip 192.168.10.1
        set end-ip 192.168.10.252
    next
end
config firewall policy
    edit 1
        set name "FSASE-HealthCheck"
        set srcintf "VPN1"
        set dstintf "port2"
        set action accept
        set srcaddr "FSASE-VPN"
        set dstaddr "all"
        set schedule "always"
        set service "PING"
        set logtraffic all
    next
    edit 2
        set name "FORTISASE-To-Protected-Resources"
        set srcintf "VPN1"
        set dstintf "port2"
        set action accept
        set srcaddr "FSASE-VPN"
        set dstaddr "all"
        set schedule "always"
        set service "HTTP" "HTTPS" "SMB" "SSH" "RDP"
        set logtraffic all
    next
end