Newbie on FortiOS 6.4.5

[Viggen73]

Hi I'm new to FortiOS 6.4.5 and I've been asked to block internet access from a group of pc's on our network.

Attached is the policy, the address group and the adress.

What am I missing here?

[Toshi_Esumi · Accepted solution]

Did you place the deny policy at the top above the others with the same interface pair (src to dst)?

[Toshi_Esumi · Accepted solution]

Did you place the deny policy at the top above the others with the same interface pair (src to dst)?

[lobstercreed · Accepted solution]

I would also say you need to change the service from "Web Access" to "ALL"

[Viggen73]

Thanks to both. Had to change to all and move it to the top. It's working perfectly. 

[Viggen73]

Hi again. Now I've got a new nuance... Been asked to block web access but allow POP and SMTP. If I use all will it also block e-mail functions?

[ppalace86]

Hi,

The 'ALL' service will block access to all ports.

Add a new policy copying the one attached, allowing the 'Email Access' service (which will contain all relevant email ports) or if you wanted to explicitly allow POP3/POP3S and SMTP/SMTPS you can select these services individually, remember you will also need DNS if you are selecting individual services.

Remove the 'ALL' service and change Action to 'Allow' instead of 'Deny'.

Ensure the new policy is above your blocking Internet access policy.