2.1 Firewall Policy Matching & Object Management

2.1 Firewall Policy Matching & Object Management

At the core of FortiOS network security is the stateful firewall engine. Every packet entering a FortiGate interface undergoes stateful inspection against the firewall policy table. To manage security posture effectively and pass the Fortinet FCP - FortiGate 7.6 Administrator exam, candidates must master the precise architecture of firewall policy evaluation, policy ordering, implicit deny handling, and reusable firewall objects.

---

1. Top-Down Policy Matching Architecture

FortiOS evaluates firewall policies using a strict top-down, first-match algorithm. When a host initiates a new connection (SYN packet), FortiGate extracts six core tuples from the ingress packet:

1. Incoming Interface (srcintf)
2. Outgoing Interface (dstintf)
3. Source Address (srcaddr)
4. Destination Address (dstaddr)
5. Service / Port (service)
6. Schedule (schedule)

FortiGate scans its active policy table starting from the top (Sequence Number 1) and evaluates each policy sequentially down the list. The very first policy that matches all criteria simultaneously handles the connection. Once a match is established, FortiGate stops checking subsequent policies.

[ Ingress Packet ] ---> ( Extract 6-Tuples )
                             |
                             v
                +--------------------------+
                | Policy Sequence #1 Match?|
                +--------------------------+
                 /                        \
               YES                         NO
               /                             \
   [ Execute Policy Action ]       +--------------------------+
   ( Accept / Deny / Profile )     | Policy Sequence #2 Match?|
                                   +--------------------------+
                                    /                        \
                                  YES                         NO
                                  /                             \
                      [ Execute Policy Action ]              ...
                                                                |
                                                                v
                                                   +--------------------------+
                                                   |   Policy ID 0 Match?     |
                                                   |     (Implicit Deny)      |
                                                   +--------------------------+
                                                                |
                                                      [ Silent Drop / Deny ]

Stateful Session Creation

Firewall policies in FortiOS are directional with respect to session initiation, but stateful with respect to traffic flow. When a policy allows traffic initiated from port2 (LAN) to port1 (WAN), FortiGate creates an entry in its stateful session table (diagnose sys session list). Return traffic originating from the remote server on port1 back to port2 is automatically permitted as part of the established session without requiring a separate inverse firewall policy.

---

2. Policy ID vs. Sequence Number

A critical distinction tested on the FCP FortiGate Administrator exam is the difference between a policy's ID and its Sequence Number.

The Implicit Deny Rule (Policy ID 0)

At the bottom of every FortiGate policy list resides Policy ID 0, known as the Implicit Deny.

• Behavior: Any traffic that fails to match all user-defined policies hits Policy ID 0 and is dropped (denied).
• Properties: Policy ID 0 cannot be edited, moved, or deleted from the policy table.
• Logging: By default, Implicit Deny traffic does not generate log messages. Administrators can enable logging of implicit drops in the GUI or CLI using set logtraffic-start enable or set logtraffic all within global setting structures.

---

3. Firewall Address Objects & Object Types

Firewall objects decouple IP addresses and network ranges from policy logic, allowing administrators to update network infrastructure without altering policy definitions. FortiOS 7.6 supports several primary address object types under config firewall address:

Address Object Types

1. Subnet (type ipmask): Standard IPv4 network defined by an IP address and netmask (e.g., 192.168.10.0 255.255.255.0 or 10.0.0.0/8).
2. IP Range (type iprange): Explicit start and end IP addresses (e.g., start 10.0.1.50, end 10.0.1.100). Useful when subnets cannot cleanly represent non-CIDR aligned pools.
3. Fully Qualified Domain Name (type fqdn): Hostnames or domain patterns (e.g., windowsupdate.microsoft.com or *.fortinet.com).
   • Engine Mechanics: FortiGate's internal DNS daemon dynamically resolves the FQDN to IP addresses using configured system DNS servers and injects those resolved IPs into kernel firewall lookup tables.
4. Wildcard Subnet (type wildcard): Matches non-contiguous IP addresses using an IP address and wildcard netmask (e.g., 192.168.1.0/255.255.0.255 matching 192.168.1.X across multiple /16 ranges).
5. Dynamic / Fabric Connector Addresses: Populated via SDN connectors (AWS, Azure, GCP, VMware ESXi, Kubernetes tags) or FortiClient EMS zero-trust posture tags.

Address Groups

Address objects can be aggregated into Address Groups (config firewall addrgrp). An address group can contain multiple subnets, ranges, FQDNs, or nested address groups, simplifying policy administration across complex networks.

---

4. Service Objects & Schedule Objects

Service Objects (config firewall service custom)

Service objects define protocols and port numbers. FortiOS includes pre-defined services (HTTP, HTTPS, SSH, DNS, RDP) and allows custom service creation matching:

• TCP / UDP / SCTP: Destination port ranges (e.g., 80-88, 443) and optional source port ranges.
• ICMP / ICMP6: Specific ICMP Type and Code integers (e.g., Type 8 Code 0 for Echo Request).
• IP Protocol Number: Raw IP protocol values (e.g., Protocol 50 for ESP, Protocol 47 for GRE).

Schedule Objects

Schedules control when a firewall policy is active:

• Always: Active 24/7/365.
• Recurring (config firewall schedule recurring): Active on specific days of the week and designated time intervals (e.g., Mondays through Fridays from 08:00 to 17:00).
• One-Time (config firewall schedule one-time): Active between an explicit start date/time and expiration date/time. Once expired, FortiGate bypasses the policy during top-down matching.

---

5. CLI Configuration & Diagnostic Workflows

Creating Address Objects & Groups

config firewall address
    edit "Corp_LAN_Subnet"
        set type ipmask
        set subnet 192.168.10.0 255.255.255.0
    next
    edit "Sales_IP_Range"
        set type iprange
        set start-ip 10.0.1.50
        set end-ip 10.0.1.100
    next
    edit "MS_Update_FQDN"
        set type fqdn
        set fqdn "windowsupdate.microsoft.com"
    next
end

config firewall addrgrp
    edit "Internal_Trusted_Networks"
        set member "Corp_LAN_Subnet" "Sales_IP_Range"
    next
end

Configuring a Firewall Policy & Reordering

config firewall policy
    edit 10
        set name "LAN_to_WAN_Access"
        set srcintf "port2"
        set dstintf "port1"
        set action accept
        set srcaddr "Internal_Trusted_Networks"
        set dstaddr "all"
        set schedule "always"
        set service "HTTPS" "HTTP"
        set utm-status enable
        set ssl-ssh-profile "certificate-inspection"
        set av-profile "default"
        set webfilter-profile "default"
        set nat enable
    next
end

# Reordering policy execution sequence
config firewall policy
    move 10 before 2
end

Diagnostic & Session Lookup Commands

• Check Policy Evaluation Order: show firewall policy or get firewall policy
• Inspect Active Session Table: diagnose sys session filter src 192.168.10.15 followed by diagnose sys session list
• Simulate Packet Matching: diagnose firewall iprope lookup port2 6 TCP 192.168.10.15 49152 8.8.8.8 53