config firewall : config firewall policy
config firewall policy
Use this command to configure firewall policy rules for IPv4 addresses.
A firewall policy is a filter that allows or denies traffic to be forwarded to the system based on a matching tuple: source address, destination address, and service. By default, firewall policy rules are stateful: if client-to-server traffic is allowed, the session is maintained in a state table, and the response traffic is allowed.
The FortiADC system evaluates firewall policies before other rules. It matches traffic against the firewall policy table, beginning with the first rule. If a rule matches, the specified action is taken. If the session is denied by a firewall policy rule, it is dropped. If the session is accepted, system processing continues.
By default, if firewall rules are not configured, the system does not perform firewall processing; all traffic is processed as if the system were a router, and traffic is forwarded according to routing and other system rules.
Note: You do not need to create firewall rules for routine management traffic associated with the management port or HA ports. The interface “allow access” option enables permitted protocols. The system automatically permits from-self traffic, such as health check traffic, and expected responses.
Before you begin:
You must have a good understanding and knowledge of firewalls.
You must have created the address configuration objects and service configuration objects that define the matching tuple in your firewall policy rules.
You must have read-write permission for firewall settings.
config firewall policy
set default-action {deny|accept}
set stateful {enable|disable}
config rule
edit <name>
set action {deny | accept}
set destination-address <datasource>
set in-interface <datasource>
set out-interface <datasource>
set service <datasource>
set source-address <datasource>
Action when no rule matches or no rules are configured:
deny—Drop the traffic.
accept—Allow the traffic to pass the firewall.
Enable/disable stateful firewall. When enabled, server response traffic is permitted automatically when the client-to-server rule allows the connection to be established. When disabled, you must create separate rules for client-to-server and server-to-client traffic. Enabled by default.
config rule
deny—Drop the traffic.
accept—Allow the traffic to pass the firewall.
Destination address object to use to form the matching tuple.
Interface that receives traffic.
Interface that forwards traffic.
Service object to use to form the matching tuple.
Source address object to use to form the matching tuple.
FortiADC-VM # config firewall policy
FortiADC-VM (policy) # set default-action deny
FortiADC-VM (policy) # config rule
FortiADC-VM (rule) # edit fw-allow-http
Add new entry 'fw-allow-http' for node 1871
FortiADC-VM (fw-allow-http) # get
in-interface :
out-interface :
source-address :
destination-address :
service :
action :
FortiADC-VM (fw-allow-http) # set action accept
FortiADC-VM (fw-allow-http) # set in-interface port4
FortiADC-VM (fw-allow-http) # set out-interface port5
FortiADC-VM (fw-allow-http) # set source-address fw-source-addr1
FortiADC-VM (fw-allow-http) # set destination-address fw-dest-addr1
FortiADC-VM (fw-allow-http) # set service fw-http
FortiADC-VM (fw-allow-http) # get
in-interface : port4
out-interface : port5
source-address : fw-source-addr1
destination-address : fw-dest-addr1
service : fw-http
action : accept
FortiADC-VM (fw-allow-http) # end