Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Kenan_Duzdas1
Explorer

SmartMove fails on converting of fortgate's zone

We have FortiGate firewall includes 3000 overrules.In order to convert all of the FortiGate rules, I am using the SmartMove tool. We would like to see all rules as in-line layer after it's converted by the smart move. But instead, it's shown as order layer, not an in-line layer. This is not an option that we can go with it. As we go deeper to figure out what could be the reason converted rules as shown order layer, the smart move gets conflicted if the source or destination zone is set to ALL. If we specify the decent zone as the destination, the smart move does its job fine but if destination zone is set to ALL, then smart move adding all rules are set to ALL as order layer. I am sharing some of the output that can give you an idea about my case.

As you see below, rule numbers 1 and 2 it created automatically, there is no such a rules on the fortigate. On rule numbers 24-25-26 those rules does not make sense because it's converted as order layer by the smartmove tool.

No.

Name

Source

Destination

Service

Action

Time

Track

1

A_ZONE

A_ZONE

A_ZONE

any

Sub-policy: A_ZONE_internal

any

Log

 

1.1

 

any

any

any

Accept

any

Log

2

B_ZONE

B_ZONE

B_ZONE

any

Sub-policy: B_ZONE_internal

any

Log

         

 

24

 

T-11.1.1.12

any

25

Accept

any

Log

25

 

T-12.1.1.12

any

53

Accept

any

Log

26

 

T-13.1.1.12

any

80

Accept

any

Log

 

If I set destination zone to related zone instead of putting ALL, smartmove does its job pretty good.We have onle one options here, we have to replace all zone that is set to ALL to related zone by one by.  Has anyone of you encountered such a problem?

 

best regards

Kenan Duzdas

 

 

 

 

 

0 Kudos
1 Reply
PhoneBoy
Admin
Admin

Might help to see the original policy so we know what it is converted from.

@yael_haker 

0 Kudos
Upcoming Events

    CheckMates Events