Article| Description | Adding an ‘Encrypt’ firewall policy, prevents Antivirus/NIDS updates and FortiGuard services from working |
| Components | |
| Steps or Commands | IssueUpon creating/adding an ‘Encrypt’ Firewall Policy, the following FortiGate features stop functioning: - FortiGuard services that provide antivirus/NIDS updates, anti-SPAM and URL Category blocking.
- FortiGate generated DNS lookups.
- other FortiGate generated traffic such as Email Alerts and SNMP Traps may also fail, depending on their intended destination. (See the Fortinet Knowledge Base article Traffic types and ports used).
CauseThe ‘Encrypt’ Firewall Policy was created with the external_all (0.0.0.0/0.0.0.0) as a destination subnet. This causes all FortiGate generated traffic to be inserted into the IPSec tunnel, instead of leaving un-encrypted onto the Internet. SolutionModify the ‘Encrypt’ policy to use a specific Destination (and Source) subnet value. |
Related Articles
Technical Note: Traffic Types and TCP/UDP Ports used by Fortinet Products
