What are the implications of not using interfaces when defining policies on fortigate firewalls?
i.e
Policy would be
edit 1
set srcintf "any"
set dstintf "any"
set srcaddr "ip-192.168.1.10"
set dstaddr "ip-172.16.1.254
set status enable
set schedule "always"
set service "TCP-8080"
set logtraffic disable
next
Is there any benefits of specifying the interface?
My understanding is the fortigate firewalls apply RPF checks against traffic when it enters the firewall.
For example if packet from 192.168.1.0/24 via port1, It would expect a route in the routing table to exist for that prefix if not RPF would block it.
We are looking at automating how we populate firewall rules and removing the interface logic would make it a a lot simpler to implement.
Any thoughts or experiences would be good.