FortiOS processes policies from top to bottom, first match wins. Placing an explicit DENY policy above the more general PERMIT policy ensures traffic destined for the finance servers is blocked before the rule allowing access to the web servers is evaluated. This is a clear and maintainable security practice.

FortiGate policies are interface-based. If the destination interface in the policy does not match the egress interface determined by the routing table, the traffic will not match the policy. The primary issue is routing: the FortiGate needs to know how to reach the new server subnet (via port3). Updating the static route is the fundamental correction; the policy may then match correctly if its destination interface aligns with the new route or is set to ‘any’.

Creating a separate, more specific policy (with higher priority) for the exception is the most secure and manageable approach. This allows the banking traffic to bypass the category-based web filtering that is causing the block, while still allowing you to apply other critical security inspections like AntiVirus. It provides clear audit trails and doesn’t weaken the main security policy for all other traffic.

This is the core function of port forwarding in a VIP. With ‘Port Forwarding’ enabled, you can specify a different external port (e.g., 8080) and map it to a different internal port (e.g., 80). With it disabled, the VIP performs a one-to-one IP mapping, and the port number must be the same for both external and internal traffic (e.g., external port 80 to internal port 80).

Split tunneling is controlled by the ‘Split Tunneling’ setting in the SSL-VPN configuration (where you define which subnets are routed through the tunnel). When split tunneling is disabled, a default route (0.0.0.0/0) is pushed to the client, forcing all traffic through the VPN tunnel (‘tunnel-all’). The firewall policies on the ‘ssl.root’ interface then control what happens to that tunneled internet-bound traffic.

In the FortiGate GUI, a green checkmark icon next to a firewall policy indicates that the policy is administratively enabled. A gray ‘x’ icon would indicate it is disabled. This is a quick visual indicator of the policy’s active status, separate from whether it has logging enabled or security profiles applied.

The FortiGate’s Quarantine feature is designed for this exact rapid-response scenario. You can manually quarantine the host’s IP/MAC, which automatically adds it to the ‘Quarantine’ firewall address group. A pre-existing firewall policy with this group as the source and a ‘Deny’ action will immediately block all traffic from that host. It’s faster and more precise than creating a new policy in the moment.

A core principle of FortiGate HA is configuration synchronization. Nearly all configuration changes made on the active unit (including firewall policies, objects, and settings) are automatically and immediately synchronized to the passive unit(s). This ensures that in the event of a failover, the passive unit can become active with an identical operational state, preventing service disruption.

Using ‘ALL’ for service is overly permissive. While it grants connectivity, it also allows internal hosts to use any IP protocol and port to communicate outward. This could allow malware to call home on a non-standard port, or users to run unauthorized services. Best practice is to specify common services (HTTP, HTTPS, DNS, etc.) to enforce a minimal allowed set of outbound protocols.

FortiOS processes policies from top to bottom, first match wins. Placing an explicit DENY policy above the more general PERMIT policy ensures traffic destined for the finance servers is blocked before the rule allowing access to the web servers is evaluated. This is a clear and maintainable security practice.0