FireSight docsConditions
A condition adds an approval chain to every request that matches it, on top of the chains of the management domains (Fortinet: ADOMs) the request changes. Conditions only ever add approvers; they can't remove any.
Typical uses: anything reaching the PCI network needs the PCI data owner, or anything inbound from the internet needs a security architect.
Only administrators manage conditions, under Settings, Approval chains, Conditions.
Add a condition
- Click Add condition.
- Enter a Name, such as PCI network.
- Choose the chain under Add this chain. Only standard chains can be added by a condition.
- Set what to match (below). A request matches when all the criteria you set are true; leave anything you don't need empty. At least one must be set.
- Leave Condition is on ticked, and click Save condition.
What a condition can match
| Criterion | Matches a request when |
|---|---|
| Addresses | Its traffic overlaps any of these networks or hosts (up to 100). any in a request overlaps everything. |
| Match the addresses as | Source or destination (default), Source or Destination: which side of the request the addresses are compared with. |
| Interfaces or zones | Any of its targets uses one of these interfaces or zones, as named in the policy or on the firewall, such as dmz or pci. A target that uses any matches every interface. |
| Ports | It is for TCP or UDP on any of these ports or ranges, or for any protocol. |
| Traffic comes from the internet or another network FireSight doesn't manage | A source is outside private address space, or the traced path starts outside the managed firewalls. |
| Traffic goes to the internet or another network FireSight doesn't manage | The same for destinations. |
| The request is for all protocols and ports | Its protocol is Any protocol. |
| Only in these ADOMs (optional) | It changes at least one of the ticked management domains. |
Matching is deliberately generous: any interfaces, any protocol and public address ranges all count, because a condition can only add approvers.
Private address space here means 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, loopback and link-local, and their IPv6 equivalents. Any other address counts as the internet.
The Conditions table
| Column | Shows |
|---|---|
| Condition | The name and a summary, such as When the destination in 10.40.0.0/16 and port 22. |
| Adds | The chain. Chain is off: skipped when that chain is switched off. |
| Status | On or Off. |
Row buttons: Turn off / Turn on, Edit and Delete.
How conditions show on requests
A request matched by a condition shows the added chain with the condition's name as the reason (for example condition: Remote admin ports), both on the draft (When submitted, this goes to:) and in the Approval panel. If the chain is already on the request because of a management domain, the reason is added to that track instead of a second copy.
Conditions are evaluated when a request is submitted. Changing a condition doesn't affect requests already submitted.
Conditions and chains that are off or deleted
- A condition whose chain is off is skipped.
- A chain can't be deleted while conditions add it, unless you delete those conditions with it. Restoring the chain restores them. See Approval chains.