How to Run a Pre-Flight Firewall Policy Safety Check in FortiPortal
Before clicking "Save" or submitting a change request for approval to your Change Advisory Board (CAB), running a pre-flight audit prevents accidental perimeter exposure, compliance violations, and unlogged ghost rules.
Eliminate manual operational errors, decipher complex telemetry in 1 second, and save hours every single week.
📋 Step-by-Step Execution Guide
Open the Policy Creation or Edit Drawer
In FortiPortal 7.4, go to "Policy & Objects" > "Firewall Policy" and click "Create New" or select an existing rule.
Verify Source, Destination, and Interface Scope
Never use "all" or "any" on public WAN interfaces with Action: ACCEPT. Bind specific address groups (e.g., CORP-WORKSTATIONS to DMZ-SERVERS).
Expand Logging Options (Avoid Collapsed Ghost Rules)
The "Logging Options" accordion is collapsed by default in FortiPortal 7.4. Always expand it and confirm "Log Allowed Traffic" is set to "All Sessions".
Generate Paired FortiOS CLI Rollback Syntax
Ensure your change ticket includes an exact reversal command (e.g. "purge" or "delete
⚡ Hardened FortiOS Policy Configuration & Rollback Spec
# Commit Spec (Hardened with All Sessions Logged):
config firewall policy
edit 0
set name "PERMIT-RESTRICTED-DB-SYNC"
set srcintf "port2"
set dstintf "port1"
set srcaddr "DB-CLIENT-SUBNET"
set dstaddr "CORP-SQL-CLUSTER"
set action accept
set schedule "always"
set service "MSSQL"
set logtraffic all
set comments "CAB Change #8401 - Pre-flight validated"
next
end
# Paired Rollback Spec (Instant Reversal):
config firewall policy
delete [POLICY_ID]
end❓ Frequently Asked Questions
Why are ghost rules dangerous in FortiPortal?
Ghost rules are firewall policies committed without logging enabled (due to FortiPortal's default collapsed accordion). When breaches or connection drops occur, zero audit trail exists in FortiAnalyzer.
How does PortalPilot automate pre-flight policy audits?
PortalPilot runs locally in your browser to inspect policy fields before you commit. It flags unrestricted Any/Any rules, checks logging state, and outputs ITIL-ready CAB change templates with 1 click.
Experience Zero-Friction Operations with PortalPilot
Built for engineers, sellers, and makers who value their time. Zero telemetry leakage, 100% on-device execution.