Technical Tip: FortiGate Explicit proxy per policy hit count

Firewall policy and explicit proxy policy operate on different levels. The same applies to statistics and how to read them.

A very useful guide on how to check firewall policy hit counts can be found on this link: Technical Tip: How to check the Hit Count, First hit, last hit, and established session count for single or multiple Firewall Policies through CLI and GUI.

An explicit proxy is a service that is handled by the WAD process. Knowing this, to get statistics for these types of policies, WAD needs to be dumped.

To navigate through this, a simple proxy-policy is taken into account:

config firewall proxy-policy
    edit 1
        set name "Internet-Access-Hits"
        set proxy explicit-web
        set dstintf "port1"
        set srcaddr "all"
        set dstaddr "all"
        set service "webproxy"
        set action accept
        set schedule "always"
        set logtraffic all
     next
  end

Note that policy ID is 1.

Using the command 'diagnose wad worker policy list' will list all proxy-policies currently active in the FortiGate.

FGT # diagnose wad worker policy list
explicit-web policy, vdom:root p_id:1 p_uuid:fd9c6632-cf61-51ef-c0a2-ca574d06cc04
Client In: 1688352, Out:218582251 server In: 218580739, Out: 1649386
active_sessions: 3, n_hits: 151
first access: Fri Jan 10 07:13:02 2025
last access: Fri Jan 10 07:22:38 2025

implicit proxy allow policy, vdom:root p_id:0 p_uuid:
Client In: 0, Out:0 server In: 0, Out: 0
active_sessions: 0, n_hits: 0
first access: never last access: never

implicit proxy deny policy, vdom:root p_id:0 p_uuid:
Client In: 0, Out:0 server In: 0, Out: 0
active_sessions: 0, n_hits: 0
first access: never last access: never

3 of 3 proxy policies have been displayed, 0 remaining.

Policy ID from this output is found at entry p_id:1, where number 1 is the policy ID.

To filter specific policies, use the grep command: 'diagnose wad worker policy list | grep p_id:1'.

To get 5 lines of output, -A switch with value 5 should be used.

FGT # diagnose wad worker policy list | grep p_id:1 -A 5
explicit-web policy, vdom:root p_id:1 p_uuid:fd9c6632-cf61-51ef-c0a2-ca574d06cc04
Client In: 1966365, Out:434010596 server In: 434011556, Out: 1913790
active_sessions: 5, n_hits: 219
first access: Fri Jan 10 07:13:02 2025
last access: Fri Jan 10 07:26:43 2025

The number of hits for this proxy-policy from CLI is 219 (n_hits: 219). The same thing can be seen via the GUI:

This is useful if scripts are configured to get the correct number of hits and other session information data.

Related document:

Seven-day rolling counter for policy hit counters