Technical Tip: Policy Lookup Utility on FortiGate fails with the error 'Unable to find the matching policy given the provided information' for UDP Traffic and FQDN Destination Address Objects

When using an FQDN as the destination object, the policy lookup tool for UDP traffic fails but works fine for TCP traffic.

Sample config:

config firewall address
    edit "example.com"
        set type fqdn
        set fqdn "example.com"
    next
end

config firewall policy
    edit 3
        set name "test"
        set srcintf "port7"
        set dstintf "port1"
        set action accept
        set srcaddr "all"
        set dstaddr "example.com"
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

diagnose firewall fqdn list-ip | grep -A 10 example.com
fqdn_u 0x9faf4ed example.com: type:(1) ID(178) count(6) generation(4) data_len:78 flag: 1
ip list: (1 ip in total)
ip: 23.192.228.80
ip list: (1 ip in total)
ip: 23.192.228.84
ip list: (1 ip in total)
ip: 23.215.0.136
ip list: (1 ip in total)
ip: 23.215.0.138
ip list: (1 ip in total)
ip: 96.7.128.175

GUI lookup for UDP traffic:

CLI lookup for UDP traffic:

diagnose firewall iprope lookup 192.168.2.98 1234 example.com 12345 17 port7 policy

protocol has to be 6(tcp) for HTTP URL!

GUI Lookup for TCP traffic:

CLI lookup for TCP traffic:

diagnose firewall iprope lookup 192.168.2.98 1234 example.com 12345 6 port7 policy
No authentication.
firewall policy id: 3
firewall proxy-policy id: 0
matched policy_type: policy
policy_action: accept

However, policy lookup works fine with the IP address for the UDP protocol.

This issue has been resolved in FortiOS versions 7.4.8 and 7.6.3.

Workaround:
Use the IP address for policy lookup instead of the FQDN.