Identity fall through rules
The fall through rules for policies in 5.2 have changed so that they are more in keeping with the practices of other vendors. This makes it easier for users used to other firewalls to configure the policies and it also makes it simplier to convert the policies of other firewalls to be used on a FortiGate firewall.
Previously, if traffic reached an identity policy and the user or device was not a member of one of the groups specified it would fall through to the implicit deny all policy. This meant that any traffic that reached that policy would have to be authenticated and a member of one of the listed groups. If the 6 required parameters matched, the traffic would not be getting past this policy.
The approach is now to treat the the identity parameters, if they exist, the same as the other parameters, in that if they do not match any listed in the policy, the traffic drops down to the next policy.
Example:
There are three policies where all the parameters are the same except:
• Policy # 1 - Source User Group A is assigned profile A
• Policy # 2 - Source User Group B s assigned profile B
• Policy # 3 - Source User(s) and Source Device Type are empty
Traffic that matches all of the required parameters will be processed as follows:
• Traffic authenticated as being from User Group A will be processed by Policy # 1.
• Traffic authenticated as being from User Group B will be processed by Policy # 2.
• Traffic with no authenticated users will be processed by Policy # 3.
• Traffic authenticated as being from User Group C will be processed by Policy # 3.
In the methodology before FortiOS 5.2, traffic authenticated as being User Group B, User Group C or no authenticated user at all would have been stopped at Policy # 1.
The CLI command “fall-through-unauthenticated” that was added in 5.0.1 attempted to allow a process similar to this, but only applied to unathenticated traffic and not authenticated traffic that didn’t match the list of groups is the the sub-policy. The current methodology is not subject to the same limitation and alleviates the need for the function of this command so the command has been removed from the CLI.