Oddities in Firewall polices

[twjw7110]

FortiGate vdom is configured to NGFW Policy mode (EDIT: version 5.6.9).

In the GUI, a policy denying all traffic (Policy ID 59) in the proxy application category appears correct.

While attempting to review how traffic is flowing, I can't find any log information for this interface (wireless network).  Strange.

I jump into the CLI, and notice all traffic is being allowed by policy 59.  I check the policy and find this:

edit 59         set name "No-Proxy"         set srcintf "iap305"         set dstintf "wan2"         set srcaddr "WifiClients"         set dstaddr "Internet"         set schedule "always"         set service "ALL"         set logtraffic disable         set app-category 6

Action (deny / accept) is missing.  I'm not sure how that happened.  Should this be possible?  The GUI clearly says "DENY".

I've also had issues with QUIC traffic being dropped, despite the application being allowed.  Even allowing the network service application category does not work.  The FortiGate denies all QUIC traffic when application control is applied.

NGFW Policy mode seems to be half-baked, or my understanding needs a re-adjustment.  I haven't changed anything other than re-adjusting firewall policies to make sense for NGFW policy mode.

[brycemd]

I'm not sure about any exact issues you may be having. But, default entries typically don't appear in cli. Deny would be considered a default entry

Do a 'show full' when in the 'edit 59' to see all settings. You should see 'set action deny'

[twjw7110]

Hi!  Thank you for letting me know.  I did not know about the default action behavior.

# show full config firewall policy     edit 59         set name "No-Proxy"         set srcintf "iap305"         set dstintf "wan2"         set srcaddr "WifiClients"         set dstaddr "Internet"         set internet-service disable         set rtp-nat disable         set learning-mode disable         set action deny         set status enable         set schedule "always"         set schedule-timeout disable         set service "ALL"         set dscp-match disable         set logtraffic disable         set logtraffic-start disable         set app-category 6         set session-ttl 0         set vlan-cos-fwd 255         set vlan-cos-rev 255         set wccp disable         set natip 0.0.0.0 0.0.0.0         set diffserv-forward disable         set diffserv-reverse disable         set tcp-mss-sender 0         set tcp-mss-receiver 0         set comments ''         set block-notification disable         set replacemsg-override-group ''         set srcaddr-negate disable         set dstaddr-negate disable         set service-negate disable         set ssl-mirror disable         set scan-botnet-connections disable         set dsri disable         set radius-mac-auth-bypass disable         set delay-tcp-npu-session disable         set send-deny-packet disable     next

Hmmm...it says deny.  This is a sample trace log:

2019-08-12 15:55:45 id=20085 trace_id=914 func=print_pkt_detail line=5296 msg="vd-wireless received a packet(proto=6, x.x.x.x:38368->185.151.204.12:443) from iap305. flag , seq 421692874, ack 0, win 65535"
2019-08-12 15:55:45 id=20085 trace_id=914 func=init_ip_session_common line=5455 msg="allocate a new session-007f0029"
2019-08-12 15:55:45 id=20085 trace_id=914 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-x.x.x.x via wan2"
2019-08-12 15:55:45 id=20085 trace_id=914 func=fw_forward_handler line=737 msg="Allowed by Policy-59: SNAT"

Hmmm...does blocking a category in NGFW policy mode mean "allow everything else"?

[twjw7110]

Disabled the explicit deny policy (policy 59), traffic now flows to other policies for processing, as expected.

This doesn't make much sense to me.