Technical Tip: Troubleshooting FortiGate traffic drops caused by dirty session handler and policy 0

Symptoms.

One or more of the following symptoms may be observed.

1. Traffic worked previously, then started failing after a policy, route, SD-WAN, or interface or path change.
2. Debug flow shows dirty-session-related messages.
3. Debug flow shows 'Denied by forward policy check (policy 0)'.
4. Existing sessions fail while newly created sessions work.
5. Traffic works again after clearing the session.

Root Cause.

This behavior is commonly caused by one of the following conditions.

1. A firewall policy was changed after the session was established.
2. A route or SD-WAN path changed after the session was established.
3. The packet arrived on a different interface than the one referenced in the existing session.
4. VIP, DNAT, or service mismatch.
5. Captive portal or interface authentication affecting policy match.
6. Strict dirty-session validation dropping a revalidated session.

Background.

Dirty session.

A dirty session is an existing session that FortiGate revalidates after a relevant change, such as a policy update, route change, or interface or path change.

Policy 0.

Policy 0 is the implicit deny. It indicates that the packet did not match any valid forward policy under the current conditions.

These two conditions may appear together. A session can be marked dirty, revalidated, and then dropped if it no longer matches a valid policy.

Solution.

Capture flow debug.

Run flow debug for the affected traffic.

diagnose debug reset 
diagnose debug flow filter clear 
diagnose debug flow filter addr 
diagnose debug flow show console enable 
diagnose debug flow trace start 100 
diagnose debug enable

Stop debugging after reproducing the issue.

diagnose debug disable 
diagnose debug reset

Check the session table.

diagnose sys session list

Verify the following values.

1. Source and destination IP.
2. Source and destination port.
3. Ingress interface.
4. Egress interface.
5. Matched policy ID.
6. NAT details.

 Verify routing.

get router info routing-table details

Confirm that the destination is still resolved through the expected egress path.

 Verify policy and VIP match.

show firewall policy show firewall vip

Confirm that traffic matches the intended source interface, destination interface, source address, destination address, schedule, service, and NAT or VIP behavior.

 Test by clearing the affected session.

diagnose sys session filter src 
diagnose sys session filter dst 
diagnose sys session clear

Use caution when clearing sessions in production.

If traffic works after clearing the session, the issue is likely related to session revalidation or stale session state.

 Review dirty-session handling.

config system settings
 show 
end

Relevant setting.

config system settings 
  set firewall-session-dirty {check-all | check-new | check-policy-option}
 end

This setting controls how FortiGate handles existing sessions after policy or routing changes.

 Review strict dirty-session validation.

config system global 
show | grep strict-dirty-session-check 
end

If strict dirty-session validation is contributing to the drop, review whether the revalidated session still matches the original policy and NAT expectations.

Example adjustment.

config system global
 set strict-dirty-session-check disable 
end

Only change this setting after validating the design impact.

Debug Interpretation:

Denied by forward policy check (policy 0).

No active matching forward policy was found for the packet. Review the interface pair, address objects, schedule, service, NAT or VIP handling, and authentication state.

Dirty-session-related messages.

An existing session is being revalidated. Compare the current route, interface path, and policy match with the original session state.

Existing sessions fail, new sessions work.

This usually indicates stale or dirty session behavior rather than a basic firewall policy mismatch.

Expected result.

After correcting the route, policy, interface path, VIP definition, or session-handling condition, the following result is expected.

1. Traffic matches the intended firewall policy.
2. Policy 0 drops stop.
3. New sessions establish normally.
4. Revalidated sessions pass correctly, or are rebuilt cleanly after clearing.

CLI Reference.

diagnose debug reset 
diagnose debug flow filter clear 
diagnose debug flow filter addr 

diagnose debug flow show console enable 
diagnose debug flow trace start 100 
diagnose debug enable 
diagnose debug disable 
diagnose debug reset 
diagnose sys session list 
diagnose sys session filter src 
diagnose sys session filter dst 
diagnose sys session clear 
get router info routing-table details 
show firewall policy 
show firewall vip config system settings 
show end config system global show | grep strict-dirty-session-check end