Technical Tip: How to collect local-in policy's hit count

Use the following command to check for local-in policy hit count: 

diagnose firewall iprope show 100001 <policy id>

This command will show the first hit and the last hit as well.

Example output:

Local-in policy configuration:

config firewall local-in-policy
    edit 1
        set intf "WAN"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set service "HTTPS"
        set schedule "always"
    next
end

diagnose firewall iprope show <ID> <stage>

diagnose firewall iprope show 100001 1   
idx:1
pkts:11372 (11372 0 0 0 0 0 0 0)
bytes:8167893 (8167893 0 0 0 0 0 0 0)
asic_pkts:0 (0 0 0 0 0 0 0 0)
asic_bytes:0 (0 0 0 0 0 0 0 0)
flag:0x0
hit count:461 (461 0 0 0 0 0 0 0)
first hit:2025-06-23 09:12:55 last hit:2025-06-23 09:15:12
established session count:1                                  
first est:2025-06-23 09:13:53 last est:2025-06-23 09:14:56

To clear the counter, the following command can be used:

diagnose firewall iprope clear <ID> <stage>

diagnose firewall iprope clear 100001 1 

Output may vary depending on the action and service configured in the local-in policy.

For a comprehensive explanation of iprope policy groups, refer to Technical Tip: iprope policies group.