capirca/policies/pol/sample_fortigate_localin_ipv6.pol at master · google/capirca · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
header {
  target:: fortigatelocalin
}

term accept-https-requests-v6{
  destination-interface:: loopback-1
  source-address:: HTTP-PROXY6-NETS
  destination-address:: REGIONAL-LOOPBACKS6
  destination-port:: HTTPS
  protocol:: tcp
  comment:: "accept-https-requests-v6"
  action:: accept
}

term accept-ssh-requests-v6{
  destination-interface:: loopback-1
  source-address:: SSH-RELAY6-NETS
  destination-address:: REGIONAL-LOOPBACKS6
  destination-port:: SSH
  protocol:: tcp
  comment:: "accept-ssh-requests-v6"
  action:: accept
}

term accept-snmp-requests-v6{
  destination-interface:: loopback-1
  source-address:: SNMP-SERVER6-NETS
  destination-address:: REGIONAL-LOOPBACKS6
  destination-port:: SNMP
  protocol:: udp
  comment:: "accept-snmp-requests-v6"
  action:: accept
}

term accept-bgp-to-loopbacks-v6{
  destination-interface:: loopback-2
  source-address:: REGIONAL-LOOPBACKS6
  destination-address:: REGIONAL-LOOPBACKS6
  destination-port:: BGP
  protocol:: tcp
  comment:: "accept-bgp-to-loopbacks-v6"
  action:: accept
}

term accept-esp-ah-tunnel-wan1-v6{
  destination-interface:: x1.15
  source-address:: P2P-RANGE6
  destination-address:: ANY_V6
  destination-port:: HTTPS
  protocol:: tcp
  comment:: "accept-esp-ah-tunnel-wan1-v6"
  action:: accept
}

term accept-ike-tunnel-wan1-v6{
  destination-interface:: x1.15
  source-address:: P2P-RANGE6
  destination-address:: ANY_V6
  destination-port:: IKE
  protocol:: udp
  comment:: "accept-ike-tunnel-wan1-v6"
  action:: accept
}

term accept-esp-ah-tunnel-wan2-v6{
  destination-interface:: x3.1
  source-address:: P2P-RANGE6
  destination-address:: ANY_V6
  destination-port:: HTTPS
  protocol:: tcp
  comment:: "accept-esp-ah-tunnel-wan2-v6"
  action:: accept
}

term accept-ike-tunnel-wan2-v6{
  destination-interface:: x3.1
  source-address:: P2P-RANGE6
  destination-address:: ANY_V6
  destination-port:: IKE
  protocol:: udp
  comment:: "accept-ike-tunnel-wan2-v6"
  action:: accept
}

term accept-bgp-wan-v6{
  destination-interface:: x6.15
  source-address:: ANY_V6
  destination-address:: ANY_V6
  destination-port:: BGP
  protocol:: tcp
  comment:: "accept-bgp-wan-v6"
  action:: accept
}

term accept-fgm-v6{
  destination-interface:: v6.15
  source-address:: REGIONAL-FGMS6
  destination-address:: ANY_V6
  destination-port:: HTTPS
  protocol:: tcp
  comment:: "accept-fgm-v6"
  action:: accept
}

term accept-test-v6{
  destination-interface:: v6.15
  source-address:: REGIONAL-FGMS6
  destination-address:: ANY_V6
  destination-port:: HTTP
  protocol:: tcp
  comment:: "TESTING"
  action:: accept
}