Create New Security Policy
The section describes how to create a new Security Policy. A Security Policy consists of rules related to proxy, antivirus, IPS, Email, and DLP sensor.
|
The Security Policy is visible only if the NGFW Mode is selected as Policy-based in the policy package. |
|
|
On the Policy & Objects tab, from the Tools menu, select Display Options. In the Policy section, select the Security Policy check box to display this option. |
To create a new Security Policy:
- Ensure that you are in the correct ADOM.
- Go to Policy & Objects > Policy Packages.
- In the tree menu for the policy package in which you will be creating the new policy, select Security Policy.
- Click Create New, or, from the Create New menu, select Insert Above or Insert Below. By default, policies will be added to the bottom of the list, but above the implicit policy. The Create New Security Policy pane opens.
- Enter the following information:
ID
Enter a unique number as the policy ID, or use the default (0) to automatically assign a policy ID. Policy IDs can be up to a maximum of 9 digits in length.
Once a policy ID has been configured it cannot be changed.
Name
Enter a unique name for the policy. Each policy must have a unique name.
Incoming Interface
Click the field then select interfaces from the Object Selector frame, or drag and drop the address from the object pane.
Select the remove icon to remove values.
New objects can be created by clicking the Create New icon in the Object Selector frame. See Create a new object for more information.
Outgoing Interface
Select outgoing interfaces.
Source
Select source addresses.
Destination Address
Select destination addresses, address groups, virtual IPs, and virtual IP groups.
Service
Select the service. Select App Default or Specify. Select the Service from the Objector Selector if Specify is selected.
Schedule
Select schedules, one time or recurring, and schedule groups.
Application
Select applications.
URL Category
Select URL categories.
Action
Select an action for the policy to take: ACCEPT or DENY.
Log Traffic
When the Action is DENY, select Log Violation Traffic to log violation traffic.
When the Action is ACCEPT or IPSEC, select one of the following options:
- No Log
- Log Security Events
- Log All Sessions
Generate Logs when Session Starts
Select to generate logs when the session starts.
Security Profiles
Select to add security profiles or profile groups.
This option is available when the Action is ACCEPT.
The following profile types can be added:
- Proxy Options
- AntiVirus Profile
- IPS Profile
- Email Filter Profile
- DLP Sensor
Comments
Add a description of the policy, such as its purpose, or the changes that have been made to it.
Advanced Options
Configure advanced options, see Advanced options below.
For more information on advanced option, see the FortiOS CLI Reference.
- Click OK to create the policy. You can select to enable or disable the policy in the right-click menu. When disabled, a disabled icon will be displayed in the Seq.# column to the left of the number.
Advanced options
|
Option |
Description |
Default |
|---|---|---|
|
application-list |
Select from the drop-down list. |
None |
|
cifs-profile |
Enable or disable authentication-based routing (IPv4 only). |
None |
|
dnsfilter-profile |
Select from the drop-down list. |
None |
|
icap-profile |
Select from the drop-down list. |
None |
|
custom-log-fields |
Select the custom log fields from the drop-down list. |
none |
|
internet-service-negate |
When enabled, Internet services match against any Internet service except the selected Internet service (IPv4 only). |
disable |
|
internet-service-src-negate |
Enables or disables the use of Internet Services in source for this policy. If enabled, |
disable |
|
service-negate |
Enable or disable negated service match. |
disable |
|
ssh-filter-profile |
Select an SSH filter profile from the drop-down list. |
None |
| ssl-ssh-profile |
Select an SSL SSH profile from the drop-down list. |
no-inspection |
|
utm-status |
Enable or disable the Unified Threat Management status. |
disable |
|
voip-profile |
Select the VOIP profile. |
None |
|
webfilter-profile |
Select the web filter profile. |
None |