Explicitly deny access for devices with Critical Vulnerabilities

Just like ZTNA access, a Deny rule should be set up to explicitly deny traffic when a device is detected and tagged with Critical Vulnerabilities. In our example, we enable user authentication in order to identify the specific users that are detected, and we’ll limit this rule to destination servers defined in ZTNA.

To create a Deny rule for On-net users from port1 (Clients_LAN) to port2 (DMZ):

1. In FortiOS, go to Policy & Objects > Firewall Policy. Click Create New.

2. Name the rule Deny-vuln-on-net.

3. In the Incoming interface, select port1.

4. In the Outgoing interface, select port2.

5. In the Source list:

   • Select the Address all.

   • Add the User Groups LDAP-Administrators, LDAP-Finance and LDAP-Sales.

6. In the IP/MAC Based Access Control field, add the Critical_Vulnerabilities tag.

7. In the Destination list, add the EMS, FAC, FAZ, Finance and Webserver address objects.

8. Set the Service to ALL.

9. Set the Action to DENY.

10. Enable Log Violation Traffic.

11. Click OK to complete.

    

12. Place this rule in front of the existing to_DMZ_webservers firewall policy.