FortiGate Firewall Policy

Overview

Firewall policies define which traffic may cross FortiGate interfaces and what security treatment is applied. A policy commonly includes incoming/outgoing interfaces, source, destination, service, schedule, action, logging, security profiles and NAT behavior.

Policy matching

Policy order matters. FortiGate evaluates applicable policies in sequence and uses the first matching policy. When troubleshooting, confirm interfaces, source/destination objects, service, schedule and policy order before assuming the session engine is wrong.

NAT

Source NAT may be enabled directly on a policy or implemented using central SNAT depending on the design. Destination NAT normally involves a virtual IP (VIP) mapped in a policy. Confirm which NAT mode the deployment actually uses before reading the policy in isolation.

CLI quick reference

show firewall policy
config firewall policy
    edit <policy-id>
        show
    next
end

diagnose debug flow filter clear
diagnose debug flow filter addr <ip-address>
diagnose debug flow show function-name enable
diagnose debug enable
diagnose debug flow trace start 20
# stop:
diagnose debug disable
diagnose debug reset

Use debug flow carefully in production and filter it tightly. Command behavior can vary by FortiOS release.

Deep dive