ronutz

FortiGate policy lookup explainer

Paste a FortiGate policy list and a packet, and see which policy matches, why each earlier policy did not, and which policies below the match can never take effect as ordered.

Documentation (Markdown)

Security & WAF
Documentation

Runs entirely in your browser. Nothing is uploaded.

How FortiOS matches a policy

  • FortiOS evaluates firewall policies top to bottom and stops at the FIRST policy whose criteria all match.
  • Every criterion must match: incoming interface, outgoing interface, source address, destination address, service, schedule, and user where configured.
  • A policy that matches nothing shows a hit counter that never increments. Nothing warns you.
  • At the end of the list is an implicit deny, and by default it is not logged.
  • Paste a policy list and add a line such as: packet: srcintf=port1, dstintf=port2, srcaddr=all, dstaddr=WebServer, service=HTTPS
API endpointGEThttps://ronutz.com/api/v1/fortigate-policy-lookup-explainerDocumented, not served. Opens the specification.

References