FortiGate session table explainer

How to read a FortiGate session

• Paste the output of `diagnose sys session list` (filter it first with `diagnose sys session filter dst <address>` so you get the session you mean).
• The session table is the authoritative record of what the FortiGate did: which policy admitted the flow, what was translated, and whether the far side replied.
• The most useful field is the statistic line. org traffic with reply=0 means the packets left and nothing came back, which is not the firewall blocking anything.
• policy_id names the rule that actually matched, which settles arguments the policy list alone cannot.
• hook=post dir=org act=snat carries the post-NAT source; hook=pre dir=reply act=dnat carries the pre-NAT destination.