Oddities in Firewall polices

Author
twjw7110
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/05/22 15:48:44
  • Status: offline
2019/08/12 11:24:41 (permalink)
0

Oddities in Firewall polices

FortiGate vdom is configured to NGFW Policy mode (EDIT: version 5.6.9).
 
In the GUI, a policy denying all traffic (Policy ID 59) in the proxy application category appears correct.
 
While attempting to review how traffic is flowing, I can't find any log information for this interface (wireless network).  Strange.
 
I jump into the CLI, and notice all traffic is being allowed by policy 59.  I check the policy and find this:
 
edit 59
        set name "No-Proxy"
        set srcintf "iap305"
        set dstintf "wan2"
        set srcaddr "WifiClients"
        set dstaddr "Internet"
        set schedule "always"
        set service "ALL"
        set logtraffic disable
        set app-category 6
 
Action (deny / accept) is missing.  I'm not sure how that happened.  Should this be possible?  The GUI clearly says "DENY".
 
I've also had issues with QUIC traffic being dropped, despite the application being allowed.  Even allowing the network service application category does not work.  The FortiGate denies all QUIC traffic when application control is applied.
 
NGFW Policy mode seems to be half-baked, or my understanding needs a re-adjustment.  I haven't changed anything other than re-adjusting firewall policies to make sense for NGFW policy mode.
post edited by twjw7110 - 2019/08/12 11:35:54
#1

3 Replies Related Threads

    brycemd
    Silver Member
    • Total Posts : 75
    • Scores: 4
    • Reward points: 0
    • Joined: 2016/12/03 11:24:30
    • Status: offline
    Re: Oddities in Firewall polices 2019/08/12 12:35:00 (permalink)
    0
    I'm not sure about any exact issues you may be having. But, default entries typically don't appear in cli. Deny would be considered a default entry
     
    Do a 'show full' when in the 'edit 59' to see all settings. You should see 'set action deny'
    post edited by brycemd - 2019/08/12 12:36:46
    #2
    twjw7110
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/05/22 15:48:44
    • Status: offline
    Re: Oddities in Firewall polices 2019/08/12 13:03:01 (permalink)
    0
    Hi!  Thank you for letting me know.  I did not know about the default action behavior.
     
    # show full
    config firewall policy
        edit 59
            set name "No-Proxy"
            set srcintf "iap305"
            set dstintf "wan2"
            set srcaddr "WifiClients"
            set dstaddr "Internet"
            set internet-service disable
            set rtp-nat disable
            set learning-mode disable
            set action deny
            set status enable
            set schedule "always"
            set schedule-timeout disable
            set service "ALL"
            set dscp-match disable
            set logtraffic disable
            set logtraffic-start disable
            set app-category 6
            set session-ttl 0
            set vlan-cos-fwd 255
            set vlan-cos-rev 255
            set wccp disable
            set natip 0.0.0.0 0.0.0.0
            set diffserv-forward disable
            set diffserv-reverse disable
            set tcp-mss-sender 0
            set tcp-mss-receiver 0
            set comments ''
            set block-notification disable
            set replacemsg-override-group ''
            set srcaddr-negate disable
            set dstaddr-negate disable
            set service-negate disable
            set ssl-mirror disable
            set scan-botnet-connections disable
            set dsri disable
            set radius-mac-auth-bypass disable
            set delay-tcp-npu-session disable
            set send-deny-packet disable
        next
     
    Hmmm...it says deny.  This is a sample trace log:
     
    2019-08-12 15:55:45 id=20085 trace_id=914 func=print_pkt_detail line=5296 msg="vd-wireless received a packet(proto=6, x.x.x.x:38368->185.151.204.12:443) from iap305. flag , seq 421692874, ack 0, win 65535"
    2019-08-12 15:55:45 id=20085 trace_id=914 func=init_ip_session_common line=5455 msg="allocate a new session-007f0029"
    2019-08-12 15:55:45 id=20085 trace_id=914 func=vf_ip4_route_input line=1599 msg="find a route: flags=00000000 gw-x.x.x.x via wan2"
    2019-08-12 15:55:45 id=20085 trace_id=914 func=fw_forward_handler line=737 msg="Allowed by Policy-59: SNAT"



    Hmmm...does blocking a category in NGFW policy mode mean "allow everything else"?
    post edited by twjw7110 - 2019/08/12 13:05:20
    #3
    twjw7110
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/05/22 15:48:44
    • Status: offline
    Re: Oddities in Firewall polices 2019/08/14 08:57:46 (permalink)
    0
    Disabled the explicit deny policy (policy 59), traffic now flows to other policies for processing, as expected.
     
    This doesn't make much sense to me. 
    #4
    Jump to:
    © 2019 APG vNext Commercial Version 5.5