FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
cskuan
Staff
Staff
Article Id 195038

Description


This article describes how to trace which firewall policy will match based on IP address, ports and protocol and the best route for it to use CLI commands

Solution


Use the follwing command to trace specific traffic on which firewall policy that it will be matching:

 

diag firewall iprope lookup <src_ip> <src_port> <dst_ip> <dst_port> <protocol> <Source interface>

 

Example scenario:

The FortiGate was configured with 2 specific firewall policies as below:

 

show firewall policy
config firewall policy
    edit 1
        set name "clientToServer"
        set uuid 06f1be4a-fb9f-51e9-ef16-dc4000a2a577
        set srcintf "port2"
        set dstintf "port3"
        set srcaddr "all"
        set dstaddr "VIP1"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
        set ippool enable
        set poolname "IPPool"
    next
    edit 2
        set name "any-allow"
        set uuid 194f0af0-22f7-51ea-c381-c68f1572bea6
        set srcintf "port2"
        set dstintf "port1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL_TCP"
        set nat enable
    next
end


Output of the debug commands:

 

diag firewall iprope lookup 10.187.1.100 12345 8.8.8.8 53 udp port2
<src [10.187.1.100-12345] dst [8.8.8.8-53] proto udp dev port2> matches policy id: 0

diag firewall iprope lookup 10.187.1.100 12345 8.8.8.8 53 tcp port2
<src [10.187.1.100-12345] dst [8.8.8.8-53] proto tcp dev port2> matches policy id: 2


Note that it is possible to trace the different matching of firewall policy with the different protocol.
The first trace traffic hits an implicit deny rule (policy id 0) as firewall policy id 2 will only match traffic with the TCP protocol.

This command makes it possible to easily trace the matching firewall policies even if there are long lists of firewall policies configured.

 

Note: When executing the policy lookup, it is necessary to confirm whether the relevant routes are present in the routing table as it will otherwise fail.
Use the command as below to trace the best route for  a specific traffic:

 

get router info routing-table details <destination ip address>

 

Example:

 

get router info routing-table details 8.8.8.8
Routing entry for 0.0.0.0/0
  Known via "static", distance 10, metric 0, best
  * 10.47.3.254, via port1