Fortinet 100 Configuring policy lists

Firewall configuration Policy matching in detail

FortiGate-100 Installation and Configuration Guide 149

Configuring policy lists

The firewall matches policies by searching for a match starting at the top of the policy

list and moving down until it finds the first match. You must arrange policies in the

policy list from more specific to more general.

For example, the default policy is a very general policy because it matches all

connection attempts. When you create exceptions to this policy, you must add them to

the policy list above the default policy. No policy below the default policy will ever be

matched.

This section describes:

•Policy matching in detail

•Changing the order of policies in a policy list

•Enabling and disabling policies

When the FortiGate unit receives a connection attempt at an interface, it must select a

policy list to search through for a policy that matches the connection attempt. The

FortiGate unit chooses the policy list based on the source and destination addresses

of the connection attempt.

The FortiGate unit then starts at the top of the selected policy list and searches down

the list for the first policy that matches the connection attempt source and destination

addresses, service port, and time and date at which the connection attempt was

received. The first policy that matches is applied to the connection attempt. If no policy

matches, the connection is dropped.

The default policy accepts all connection attempts from the internal network to the

Internet. From the internal network, users can browse the web, use POP3 to get

email, use FTP to download files through the firewall, and so on. Ifthe default policy is

at the top of the Int->Ext policy list, the firewall allows all connections from the internal

network to the Internet because all connections match the default policy. If more

specific policies are added to the list below the default policy, they are never matched.

A policy that is an exception to the default policy, for example, a policy to block FTP

connections, must be placed above the default policy in the Int->Ext policy list. In this

example, all FTP connection attempts from the internal network would then match the

FTP policy and be blocked. Connection attempts for all other kinds of services would

not match with the FTP policy but they would match with the default policy. Therefore,

the firewall would still accept all other connections from the internal network.

1Go to Firewall > Policy.

2Select the policy list that you want to rearrange.

3Choose a policy to move and select Move To to change its order in the policy list.

Note: Policies that require authentication must be added to the policy list above matching

policies that do not; otherwise, the policy that does not require authentication is selected first.