Create a Firewall Policy on FortiGate

A detailed guide to creating and managing firewall policies on FortiGate devices, covering GUI and CLI methods, policy structure, NAT, inspection, and best practices.

FortiGate firewalls operate on a policy-based system to control network traffic flow. A firewall policy defines the rules for allowing or denying traffic between different network interfaces, zones, or specific IP addresses. Properly configured policies are fundamental to network security, ensuring only authorized communications occur.

This article provides a comprehensive guide to creating and managing firewall policies on FortiGate devices, covering both the graphical user interface (GUI) and command-line interface (CLI) methods, essential policy components, and advanced considerations.

Understanding FortiGate Firewall Policy Structure

Each FortiGate firewall policy comprises several key components that dictate its behavior. These components work in conjunction to match and process network traffic.

Policy ID: A unique identifier (integer) for the policy. Policies are evaluated in order of their ID (lowest to highest).
Name: A descriptive name for the policy, aiding in management.
Source Interface (srcintf): The interface(s) or zone(s) from which traffic originates.
Destination Interface (dstintf): The interface(s) or zone(s) to which traffic is destined.
Source Address (srcaddr): The source IP address(es) or address group(s) of the traffic.
Destination Address (dstaddr): The destination IP address(es) or address group(s) of the traffic.
Service (service): The network service(s) (e.g., HTTP, HTTPS, SSH, custom ports) or service group(s) being used.
Action (action): What to do with matching traffic (accept, deny, ipsec, ssl-vpn, web-proxy).
Schedule (schedule): When the policy is active (e.g., always, specific times).
NAT (nat): Controls Network Address Translation for outbound traffic.
Security Profiles: Advanced inspection (e.g., Antivirus, Web Filter, IPS, Application Control).

Creating a Policy via the GUI

The FortiGate GUI offers an intuitive way to configure firewall policies. Navigate to Policy & Objects > Firewall Policy.

Basic Policy Creation (GUI)

Click Create New.
Name: Enter a descriptive name (e.g., LAN-to-WAN-Web).
Incoming Interface: Select the source interface or zone (e.g., internal).
Outgoing Interface: Select the destination interface or zone (e.g., wan1).
Source: Choose all or specific address objects/groups (e.g., LAN_Subnet).
Destination: Choose all or specific address objects/groups (e.g., all).
Service: Select specific services (e.g., HTTP, HTTPS) or ALL.
Action: Set to ACCEPT.
Schedule: Keep as always unless time-based access is required.
NAT: If traffic is leaving a private network for the internet, ensure NAT is enabled (usually selected as Use Outgoing Interface Address).
Click OK.

Adding Security Profiles (GUI)

After creating the basic policy, you can enhance security by adding inspection profiles:

Edit the created policy.
Under Security Profiles, enable and select appropriate profiles:

Antivirus: Detect and block malware.
Web Filter: Control access to websites based on categories or URLs.
DNS Filter: Block malicious or unwanted DNS queries.
Application Control: Identify and control specific applications (e.g., Skype, BitTorrent).
IPS: Intrusion Prevention System to detect and block exploit attempts.
SSL Inspection: To inspect encrypted traffic (requires certificate installation on clients for full inspection).

Click OK to save changes.

Creating a Policy via the CLI

The CLI provides granular control and is often preferred for automation or complex configurations. The following snippet expands on the provided stub.

config firewall policy
  edit 0 
    set name "LAN-to-WAN-Internet"
    set srcintf "internal"       <-- Source interface (e.g., VLAN, physical port)
    set dstintf "wan1"         <-- Destination interface (e.g., ISP uplink)
    set srcaddr "all"          <-- Source address object (e.g., internal-subnet, all)
    set dstaddr "all"          <-- Destination address object (e.g., all, internet-facing-server)
    set service "ALL"          <-- Service object (e.g., HTTP, HTTPS, ALL)
    set schedule "always"      <-- Schedule object
    set action accept          <-- Policy action (accept, deny, ipsec, ssl-vpn, web-proxy)
    set nat enable             <-- Enable Network Address Translation
    set logtraffic all         <-- Enable logging for all sessions (important for visibility)
    set utm-status enable      <-- Enable UTM profiles for this policy (requires license)
    set av-profile "default"   <-- Apply Antivirus profile
    set ips-sensor "default"   <-- Apply IPS sensor
    set webfilter-profile "default" <-- Apply Web Filter profile
    set application-list "default" <-- Apply Application Control profile
    set ssl-ssh-profile "certificate-inspection" <-- Apply SSL/SSH Inspection profile
  next
end

CLI Details and Considerations

edit 0: When creating a new policy, edit 0 creates the policy at the top of the list. FortiGate assigns a unique numerical ID upon saving. You can also use edit <ID> to modify an existing policy.
set logtraffic all: Highly recommended for visibility and troubleshooting. Options include utm (only UTM logs) or all (all session logs, including UTM).
set utm-status enable: This general flag enables UTM inspection for the policy. Individual UTM profiles are then applied.
set ssl-ssh-profile "certificate-inspection": For basic SSL inspection without decrypting all traffic. For deep inspection, use deep-inspection, which requires certificate deployment.
Object Referencing: For srcaddr, dstaddr, service, schedule, and security profiles, you reference existing objects. Ensure these objects are already defined (e.g., config firewall address, config firewall service custom).

NAT and IP Pools

When nat enable is set, the FortiGate performs source NAT. By default, it uses the IP address of the outgoing interface.

For more specific NAT requirements, such as using a different public IP or a pool of IPs, you can configure IP pools:

config firewall ippool
  edit "My_Public_IP_Pool"
    set startip 203.0.113.10
    set endip 203.0.113.20
  next
end

config firewall policy
  edit <Policy ID>
    set nat enable
    set ippool enable
    set poolname "My_Public_IP_Pool"
  next
end

This instructs the FortiGate to use an IP address from My_Public_IP_Pool for outbound NAT instead of the wan1 interface's primary IP.

Policy Ordering

FortiGate processes policies sequentially from top to bottom (lowest ID to highest ID). The first policy that matches the traffic flow is applied, and no further policies are evaluated for that specific session. This means the order is critical:

Specific policies first: Policies with more specific source/destination addresses or services should be placed higher in the list.
General policies last: Broad policies (e.g., LAN to WAN, all services) should be at the bottom to act as a catch-all.
Deny policies: If you have explicit deny rules, place them strategically before any accept rules they are intended to override.

You can reorder policies in the GUI by dragging and dropping, or via CLI using move <policy_id> before/after <another_policy_id>.

Common Pitfalls and Troubleshooting

Incorrect Policy Order: Traffic might be hitting an unintended policy higher in the list. Use the GUI's policy order view or diagnose debug flow to trace traffic.
Missing NAT: Outbound internet access fails because NAT is not enabled on the correct policy, or the wrong IP pool is selected.
Incorrect Address/Service Objects: Typos or misconfigurations in address/service definitions prevent policies from matching. Verify object configurations.
Interface Mismatch: Source or destination interfaces are incorrectly defined, leading to traffic not matching any policy.
Security Profile Interference: Aggressive Web Filtering, IPS, or Application Control profiles might block legitimate traffic. Check FortiGate logs (Log & Report > Traffic > Forward Traffic and Security Events) for blocks.
Implicit Deny: If no policy matches traffic, the FortiGate's implicit deny rule at the very end of the policy list will block it. Always ensure a catch-all policy if intended.
License Expiry: UTM features (AV, IPS, Web Filtering) will cease to function if their licenses expire, effectively making the policy less secure.