FortiOS firewall policy selects by…

Correct: b. Admin Guide first match.

Fortinet · FortiOS 7.4 · Lesson 3 of 12

Firewall policy: the first match is the only match

Priya is in HR. Policy 12 denies social media. Policy 3 above it is LAN-to-WAN ALL ACCEPT. Policy 12 never runs. FortiOS is not “most specific wins.” It is By Sequence first match, then implicit deny.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Read a policy list the way FortiOS does — top to bottom.
Use Policy match / lookup before you add another ACCEPT.
Prove the hit with policy id in traffic log or debug flow.
Stop stacking duplicate ACCEPTs “just in case.”

The ticket

Auditor: “You blocked Facebook.” Log: policyid=3 accept. Policy 12 never appears. The student who wrote 12 did not look above it.

Quick interview answer

FortiOS 7.4 Admin Guide: traffic is checked against configured policies for a match. Match fields include incoming/outgoing interface (or zone), source, destination, service, schedule, users. Views: By Sequence, Interface Pair, Sequence Grouping. Nothing matches → implicit deny. There is no “most specific VIP/policy” race — first matching policy wins.

FortiGate policies stacked, first match wins — Policy 3 ate policy 12. The deny never saw the packet.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Think of a sieve: first hole that fits, packet is done. Logging on a later deny cannot fire.

First match

Move 12 above 3, or shrink 3. Do not add policy 40.

https://fgt-hq.techclick-lab.in

Training mock · not live

Admin

DashboardPolicyVPNNetwork

Policy & Objects → Firewall Policy

By Sequence

id 3

LAN → WAN ALL ALL ACCEPT NAT (too wide)

id 12

LAN → WAN HR Social.Media DENY (never hit)

Policy match

src 10.20.30.80 dst facebook.com → id 3

Implicit deny

shown at the bottom — not a real editable policy

FortiOS 7.4 Firewall policy — By Sequence / Policy match. Training mock.

How to choose

Need	Do	Do not
Exception for one user	Narrow ACCEPT above the deny	Wide ACCEPT above everything
Find who wins	Policy match tool + log policyid	Guess from the name
NGFW policy mode	Know it changes the GUI (Application in policy)	Mix mental models mid-ticket

Runbook

Side A — lookup
Policy & Objects → Firewall Policy → Policy match. Source 10.20.30.80, dest, service. Read the id.
Side B — order
Drag the deny above the wide accept, or split the accept.
Side C — prove
Forward Traffic log: policyid. Or diagnose debug flow (next lesson).

What the log must show

# Log & Report → Forward Traffic
srcip=10.20.30.80 dstip=… policyid=12 action=deny
# If you still see policyid=3, you did not move 12 above 3.

Four failures

1 · Shadowed deny

Wide accept above. Classic.

2 · Object name ≠ contents

Group “HR-only” still contains ALL. Lookup the members.

3 · Interface-pair view hides order

Switch to By Sequence when the ticket is “wrong policy hit.”

4 · Implicit deny with no log

Enable logging on implicit deny (or a catch-all deny with log) or you will swear the packet never arrived.

How to prove it

Close only when

1) Policy match and the live log show the same id. 2) You can say which policy is above. 3) You did not add a fifth ACCEPT.

Traps

Symptom	Truth	Wrong fix
Deny never logs	Earlier accept	New deny at the bottom
VIP not working	Wrong policy / WAN interface	“Most specific VIP should win”

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview

Sources

FortiOS 7.4 Administration Guide — Firewall policy (match parameters, views, implicit deny).