# Firewall policy: the first match is the only match Source: https://ai.techclick.in/blog_fortigate_policy_first_match Markdown: https://ai.techclick.in/blog_fortigate_policy_first_match.md Publisher: Techclick Infosec Pvt Ltd FortiOS matches the first firewall policy that hits. Order is the bug. Dummy LAN 10.20.30.0/24. ## The ticket Auditor: “You blocked Facebook.” Log: policyid=3 accept. Policy 12 never appears. The student who wrote 12 did not look above it. Quick interview answer FortiOS 7.4 Admin Guide: traffic is checked against configured policies for a match. Match fields include incoming/outgoing interface (or zone), source, destination, service, schedule, users. Views: By Sequence , Interface Pair, Sequence Grouping. Nothing matches → implicit deny . There is no “most specific VIP/policy” race — first matching policy wins. Hero · sequence Policy 3 ate policy 12. The deny never saw the packet. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Think of a sieve: first hole that fits, packet is done. Logging on a later deny cannot fire. First match id 3 ACCEPT all id 12 DENY social implicit deny Priya stops here Move 12 above 3, or shrink 3. Do not add policy 40. https://fgt-hq.techclick-lab.in Training mock · not live Admin Dashboard Policy VPN Network Policy & Objects → Firewall Policy ### By Sequence id 3 LAN → WAN ALL ALL ACCEPT NAT (too wide) id 12 LAN → WAN HR Social.Media DENY (never hit) Policy match src 10.20.30.80 dst facebook.com → id 3 Implicit deny shown at the bottom — not a real editable policy Cancel Save FortiOS 7.4 Firewall policy — By Sequence / Policy match. Training mock. ## How to choose Need Do Do not Exception for one user Narrow ACCEPT above the deny Wide ACCEPT above everything Find who wins Policy match tool + log policyid Guess from the name NGFW policy mode Know it changes the GUI (Application in policy) Mix mental models mid-ticket ## Runbook - #### Side A — lookup Policy & Objects → Firewall Policy → Policy match. Source 10.20.30.80, dest, service. Read the id. - #### Side B — order Drag the deny above the wide accept, or split the accept. - #### Side C — prove Forward Traffic log: policyid . Or diagnose debug flow (next lesson). What the log must show # Log & Report → Forward Traffic srcip=10.20.30.80 dstip=… policyid=12 action=deny # If you still see policyid=3, you did not move 12 above 3. ## Four failures ### 1 · Shadowed deny Wide accept above. Classic. ### 2 · Object name ≠ contents Group “HR-only” still contains ALL. Lookup the members. ### 3 · Interface-pair view hides order Switch to By Sequence when the ticket is “wrong policy hit.” ### 4 · Implicit deny with no log Enable logging on implicit deny (or a catch-all deny with log) or you will swear the packet never arrived. ## How to prove it Close only when 1) Policy match and the live log show the same id. 2) You can say which policy is above. 3) You did not add a fifth ACCEPT. ## Traps Symptom Truth Wrong fix Deny never logs Earlier accept New deny at the bottom VIP not working Wrong policy / WAN interface “Most specific VIP should win” ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 FortiOS firewall policy selects by… Most specific prefix First matching policy in sequence Highest policy id Last matching deny Correct: b . Admin Guide first match. Q2 Policy 3 ACCEPT all sits above policy 12 DENY social. Priya hits Facebook. What logs? policyid=12 deny policyid=3 accept implicit deny No session Correct: b . Shadow. Q3 Nothing matches. Result? Accept Implicit deny Send to FMG NAT anyway Correct: b . Guide. Q4 Best first tool on this ticket? Factory reset Policy match + policyid in Forward Traffic Disable NGFW New any-any Correct: b . Runbook. Q5 Interface Pair View is dangerous on an order ticket because… It encrypts logs It can hide the real global sequence It deletes VIPs It disables NAT Correct: b . Failure 3. Q6 A catch-all deny at the bottom is useful when… You want to log implicit drops with a name You want to override policy 1 You disable first match You replace SNAT Correct: a . Failure 4. Check answers Reset FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview ## Sources - FortiOS 7.4 Administration Guide — Firewall policy (match parameters, views, implicit deny) . Related: FortiGate session factory · VPN series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt