Fortinet FortiGate 4000 - Manual (Page 196)

196
Fortinet Inc.
Adding firewall policies Firewall configuration
Firewall policy options
This section describes the options that you can add to firewall policies.
Source
Select an address or address group that matches the source address of the packet.
Before you can add this address to a policy, you must add it to the source interface.
For information about adding an address, see
“Addresses” on page 202 .
Destination
Select an address or address group that matches the destination address of the
packet. Before you can add this address to a policy, you must add it to the destination
interface, VLAN subinterface, or zone. For information about adding an address, see
“Addresses” on page 202 .
For NAT/Route mode policies where the address on the destination network is hidden
from the source network using NAT, the destination can also be a virtual IP that maps
the destination address of the packet to a hidden destination address. See
“Virtual
IPs” on page 213 .
Schedule
Select a schedule that controls when the policy is available to be matched with
connections. See
“Schedules” on page 210 .
Service
Select a service that matches the service (port number) of the packet. You can select
from a wide range of predefined services or add custom services and service groups.
See
“Services” on page 205 .
Action
Select how you want the firewall to respond when the policy matches a connection
attempt.
ACCEPT Accept the connection. If you select ACCEPT, you can also configure NAT
and Authentication for the policy.
DENY Deny the connection. The only other policy option that you can configure is
Log Traffic, to log the connections denied by this policy.
ENCRYPT Make this policy an IPSec VPN policy. If you select ENCRYPT, you can
select an AutoIKE Key or Manual Key VPN tunnel for the policy and
configure other IPSec settings. You cannot add authentication to an
ENCRYPT policy. ENCRYPT is not available in Transparent mode. See
“Configuring encrypt policies” on page 249 .