system firewall firewall-policy

Use this command to configure the policies that FortiWeb's built-in stateful firewall uses to determine which traffic to allow and deny.

The firewall policy uses address and service configurations that you create separately. For details, see system firewall address and system firewall service.

Syntax

config system firewall firewall-policy

set default-action {deny | accept}

config firewall-policy-match-list

edit <entry_index>

set in-interface "<incoming_interface_name>"

set out-interface "<outgoing_interface_name>"

set src-address "<firewall-address_name>"

set dest-address "<firewall-address_name>"

set service "<firewall-service_name>"

set action {deny | accept}

set vzone-enable {enable | disable}

set vzone "<vzone_name>"

end

Variable	Description	Default
default-action {deny \| accept}	Select either: `deny`—Firewall blocks traffic that does not match a policy rule. However, administrative access is still allowed on network interfaces for which it has been configured. `accept`—Firewall allows traffic that does not match a policy rule.	`accept`
<entry_index>	Enter the index number of the policy rule in the table.	No default.
in-interface "<incoming_interface_name>"	Enter the name of the interface (for example, `port1`) on which FortiWeb receives packets it applies this firewall policy rule to.	No default.
out-interface "<outgoing_interface_name>"	Enter the name of the interface (for example, `port2`) through which FortiWeb routes packets it applies this firewall policy rule to.	No default.
src-address "<firewall-address_name>"	Enter the name of the firewall address configuration that specifies the source IP address or addresses to which this policy applies. For details about creating firewall address configurations, see system firewall address.	No default.
dest-address "<firewall-address_name>"	Enter the name of the firewall address configuration that specifies the source IP address or addresses to which this policy rule applies. For details about creating firewall address configurations, see system firewall address.	No default.
service "<firewall-service_name>"	Enter the name of the firewall service configuration that specifies the protocols and ports to which this policy rule applies. For details about creating firewall address configurations, see system firewall address.	No default.
action {deny \| accept}	Enter either: `deny`—Firewall blocks traffic that matches this policy rule. However, administrative access is still allowed on network interfaces for which it has been configured. `accept`—Firewall allows traffic that matches this policy rule.	deny
vzone-enable {enable \| disable}	Select to enable a V-zone (bridge). If this option is enabled, select a V-zone to use. V-zones allow network connections to travel through FortiWeb's physical network ports without explicitly connecting to one of its IP addresses. This option is available only when the operation mode is True Transparent Proxy or Transparent Inspection mode.	disable
vzone "<vzone_name>"	Select a configured V-zone. For details about creating a V-zone, see system v-zone.	No default.

Example

This example configures a firewall policy to deny any HTTP services but coming from specified sources.

config system firewall address

edit "alloowed_source"

set type ip-range

set ip-address-value "172.22.203.100-172.22.203.115"

end

config system firewall address

edit "site1"

set type ip-netmask

set ip-netmask "206.11.0.2/24"

end

config system firewall service

edit "http"

set protocol TCP

set destination-port-min 80

set destination-port-max 80

end

config system firewall firewall-policy

set default-action deny

config firewall-policy-match-list

edit 1

set in-interface port1

set out-interface port2

set src-address site1

set dest-address site1

set service http

set action accept

end