Objects, services and naming

Policies refer to address and service objects. When FireSight deploys a rule it reuses objects that already match exactly, and creates new ones only where needed. Every object, policy and normalised-interface mapping it writes is recorded, so a back-out restores exactly what was there.

The request reference

Every request gets a reference such as FS-00042 (its number, padded to five digits). The policies a request creates are named after it:

one new policy: FS-00042;
several targets: FS-00042-1, FS-00042-2 and so on.

Each policy's comment reads FireSight #42: <title>, with the change ticket in brackets if there is one.

Address objects

For each source and destination network, FireSight:

reuses an existing address object in the management domain (Fortinet: ADOM) that matches the network exactly (subnet objects for IPv4, prefix objects for IPv6);
otherwise creates one named FS-<network>, for example FS-10.10.5.0_24, with the comment FireSight FS-00042.

any becomes the built-in all object.

An existing object is never overwritten because of a name clash: if the name is taken by a different object, FireSight adds a number (-2, -3 and so on).

Objects named after DNS

With Convert entries to DNS names if available on (see DNS names), single-host objects are named after the host's DNS name instead of its address. DNS-named objects match on decides what they contain:

Choice	What FireSight creates
IP address (recommended) (default)	An address object named after the host, still matching exactly the approved address. A host with several addresses gets one object per address.
FQDN (follows DNS)	An FQDN object for the host name, so the firewall follows DNS. One FQDN object covers every address of the host. An existing FQDN object for the same name is reused.

Service objects

Protocol	Service used
TCP or UDP	For each port or range, an existing custom service matching exactly that protocol and port range is reused; otherwise `FS-tcp-443`, `FS-udp-53` and so on is created.
ICMP	The built-in `ALL_ICMP` (and `ALL_ICMP6` when IPv6 addresses are involved).
Any protocol	The built-in `ALL`.

The policy

Each new policy has:

Field	Value
Name	`FS-00042` (or `FS-00042-N`)
Incoming and outgoing interface	From the target, or `any`
Sources and destinations	The address objects above, IPv4 and IPv6 separately
Service	The services above
Action	Accept or Deny
Schedule	`always`
Logging	All sessions, or off if the requester turned logging off
Status	Enabled (on a standalone FortiGate, added disabled and enabled once in position)

A request whose sources and destinations share no IP version can't be deployed: sources and destinations share no IP version.

Back-out of objects

On back-out, objects FireSight created are deleted. An object that something else now uses is kept, and the log says so (kept … (still in use …)). Objects FireSight changed are restored to their previous values.