system firewall local-in-policy

While security profiles control traffic flowing through the FortiWeb, local-in policies (named as Firewall Admin Policy in GUI) control inbound traffic that is going to a FortiWeb interface.

Administrative access traffic (HTTPS, PING, SSH, and others) can be controlled by allowing or denying the service in the interface settings. Trusted hosts can be configured under an administrator to restrict the hosts that can access the administrative service.

To further restrict access, you can use Local-in policies to granularly define the source and destination addresses, interface, and services.

Traffic destined for the all the network interfaces of FortiWeb is subject to the local-in firewall policy.

The firewall local-in policy uses address and service configurations that you create separately. For details, see system firewall address and system firewall service.

Syntax

config system firewall local-in-policy

config firewall-local-in-policy-match-list

edit <entry_index>

set in-interface "<incoming_interface_name>"

set src-address "<firewall-address_name>"

set dest-address "<firewall-address_name>"

set service "<firewall-service_name>"

set action {deny | accept}

end

Variable	Description	Default
<entry_index>	Enter the index number of the policy rule in the table.	No default.
in-interface "<incoming_interface_name>"	Enter the name of the interface (for example, port1) on which FortiWeb receives packets it applies this firewall policy rule to.	No default.
src-address "<firewall-address_name>"	Enter the name of the firewall address configuration that specifies the source IP address or addresses to which this policy applies. For details about creating firewall address configurations, see system firewall address.	No default.
dest-address "<firewall-address_name>"	Enter the name of the firewall address configuration that specifies the source IP address or addresses to which this policy rule applies. For details about creating firewall address configurations, see system firewall address.	No default.
service "<firewall-service_name>"	Enter the name of the firewall service configuration that specifies the protocols and ports to which this policy rule applies. For details about creating firewall address configurations, see system firewall address.	No default.
action {deny | accept}	Enter either: deny—Firewall blocks traffic that matches this policy rule. accept—Firewall allows traffic that matches this policy rule.	deny

Related topics

• system firewall address
• system firewall service