FortiGate Debug IPsec: The Ins and Outs of Configuring Local-in Policies

When dealing with FortiGate devices and configuring IPsec policies, it's essential to understand the concept of local-in policies. These policies are crucial in controlling traffic flow between internal networks and the internet. In this article, we'll delve into the intricacies of configuring local-in policies on your FortiGate device.

The default action for rules is deny, which means that when you see no action in the show output, it's essential to configure the correct policies to allow or block traffic accordingly. One common misconception is that the auto-created rules by Fortigate cannot be disabled or deleted. However, this is not entirely true.

You can disable or delete services that opened up these auto-created rules. This is a crucial aspect of configuring local-in policies on your FortiGate device. It's also important to note that you have separate ipv4 and ipv6 local-in policies.

To configure local-in policies effectively, it's recommended to work on the CLI rather than relying solely on the GUI. The GUI can be confusing, especially when trying to understand how configured rules work. When enabling services on your FortiGate device, ensure that you do so through the CLI.

One crucial aspect of local-in policy configuration is the inability to configure it directly in the GUI. To access this feature, you need to navigate to System → Feature Visibility → Local-in Policy. This will allow you to view and configure local-in policies on your FortiGate device.

In older versions of FortiOS (prior to 7.x), local-in policy was not visible by default. You had to manually enable it through the CLI or GUI settings. However, starting from FortiOS 7.x, local-in policy is visible in the GUI by default.

In conclusion, configuring local-in policies on your FortiGate device requires a deep understanding of how these policies work and interact with other network configurations. By working on the CLI and disabling or deleting auto-created rules as necessary, you can create a secure and efficient IPsec configuration for your network.

Fortigate debug ipsec