What are the implications of not using interfaces when defining policies on fortigate firewalls?
Policy would be
edit 1 set srcintf "any" set dstintf "any" set srcaddr "ip-192.168.1.10" set dstaddr "ip-172.16.1.254 set status enable set schedule "always" set service "TCP-8080" set logtraffic disable next
Is there any benefits of specifying the interface?
My understanding is the fortigate firewalls apply RPF checks against traffic when it enters the firewall.
For example if packet from 192.168.1.0/24 via port1, It would expect a route in the routing table to exist for that prefix if not RPF would block it.
We are looking at automating how we populate firewall rules and removing the interface logic would make it a a lot simpler to implement.
Any thoughts or experiences would be good.