FortiGate Administration Guide - FirewallShop.com

Configuring firewall policies
Firewall Policy
Firewall policy options
Service matches the firewall policy with the service used by a communication
session.
Action defines how the FortiGate unit processes traffic. Specify an action to accept
or deny traffic or configure a firewall encryption policy.
You can use the remaining firewall policy options (NAT, Protection Profile, Log
Allowed Traffic, Log Violation Traffic, Authentication, and Traffic shaping) to set
additional features. Log Violation Traffic can be applied to policies that deny traffic.
Differentiated services can be configured through CLI commands (see the
“firewall” chapter of the FortiGate CLI Reference).
Go to Firewall > Policy and select Create New to add a firewall policy. You can
configure the following firewall policy options:
Intra-VLAN
Policy
Source
Interface/Zone
Source Address
(FortiGate model 224B only) This is available only in switch view.
Enable to create a policy governing traffic between switch ports on a
switch VLAN. There must be at least one secure port available. See
“Configuring intra-VLAN firewall policies (FortiGate-224B only)” on
page 275.
Select the name of the FortiGate interface or zone on which IP packets
are received. Interfaces and zones are configured on the System
Network page. See “Interface” on page 79 for information about
interfaces. See “Zone” on page 98 for information about zones.
If Action is set to IPSEC, the interface is associated with the local
private network.
If Action is set to SSL-VPN, the interface is associated with
connections from remote SSL VPN clients.
Select the name of a previously defined IP address to associate with
the source interface or zone, or select Create New to define a new IP
address or address group.
If you want to associate multiple addresses or address groups to the
interface/zone, select Multiple beside Source Address. In the pop-up
window, move the addresses or address groups from the Available
Addresses box to the Members box, then select OK.
A packet must have the associated IP address in its header to be
subject to the policy. Addresses can be created in advance.
See “Configuring addresses” on page 291.
If Action is set to IPSEC, the address is the private IP address of the
host, server, or network behind the FortiGate unit.
If Action is set to SSL-VPN and the policy is for web-only mode clients,
select all.
If Action is set to SSL-VPN and the policy is for tunnel mode clients,
select the name of the address that you reserved for tunnel mode
clients.
FortiGate Version 3.0 MR5 Administration Guide
272 01-30005-0203-20070830