204
01-28011-0254-20051115
Fortinet Inc.
Policy
Firewall
Policy
Go to
Firewall > Policy
to add firewall policies to control connections and traffic
between FortiGate interfaces, zones, and VLAN subinterfaces.
The firewall matches policies by searching for a match starting at the top of the policy
list and moving down until it finds the first match. You must arrange policies in the
policy list from more specific to more general. For example, the default policy is a very
general policy because it matches all connection attempts. When you create
exceptions to that policy, you must add them to the policy list above the default policy.
No policy below the default policy will ever be matched.
This section describes:
•
How policy matching works
•
Policy list
•
Policy options
•
Advanced policy options
•
Configuring firewall policies
•
Policy CLI configuration
How policy matching works
When the FortiGate unit receives a connection attempt at an interface, it selects a
policy list to search through for a policy that matches the connection attempt. The
FortiGate unit chooses the policy list based on the source and destination addresses
of the connection attempt.
The FortiGate unit then starts at the top of the selected policy list and searches down
the list for the first policy that matches the connection attempt source and destination
addresses, service port, and time and date at which the connection attempt was
received. The first policy that matches is applied to the connection attempt. If no policy
matches, the connection is dropped. So, as a general rule, always order your firewall
policies from most specific to most general.
Policy list
You can add, delete, edit, re-order, enable, and disable policies in the policy list.
Figure 86: Sample policy list
Note:
Policies that require authentication must be added to the policy list above matching
policies that do not; otherwise, the policy that does not require authentication is selected first.
Summary of Contents for FortiGate 1000A
Page 80: ...80 01 28011 0254 20051115 Fortinet Inc FortiGate IPv6 support System Network ...
Page 88: ...88 01 28011 0254 20051115 Fortinet Inc Dynamic IP System DHCP ...
Page 122: ...122 01 28011 0254 20051115 Fortinet Inc FortiManager System Config ...
Page 248: ...248 01 28011 0254 20051115 Fortinet Inc Protection profile Firewall ...
Page 260: ...260 01 28011 0254 20051115 Fortinet Inc CLI configuration User ...
Page 380: ...380 01 28011 0254 20051115 Fortinet Inc CLI configuration Log Report ...
Page 392: ...392 01 28011 0254 20051115 Fortinet Inc Glossary ...
