Troubleshooting Tip: Incorrect firewall policy match on FortiProxy due to partial match

Partial policy match is a feature introduced in FortiProxy v7.6.4. It allows FortiProxy to initially evaluate available information, such as the SNI or host, to determine whether a policy might match. However, this information alone is not always sufficient to fully confirm a policy match because some proxy-address checks rely on HTTP header data, which becomes available only after HTTPS decryption.

With partial matching, FortiProxy places the HTTPS session in an intermediate state when a policy matches the proxy-address host (SNI) but requires deep inspection to extract additional details from HTTP headers or user information. This process allows FortiProxy to complete the policy evaluation and determine the final matching policy.

In the partial match state, FortiProxy performs deep inspection on the traffic using the established SSL connection based on the settings (forward server, isolation server, or destination server) of the partial match policy and then re-evaluates whether a full match exists. Based on the evaluation result, the partial match state transitions to either a successful match or a failed match.

The default configuration for partial policy match is 'enable'.

config web-proxy global

    set policy-partial-match disable

end

In certain scenarios, policies may match traffic incorrectly due to partial matching behavior.

For example, in the configuration below, Policy 166 and Policy 516 are both defined. The destination address includes a firewall proxy address group named 'NoAuth_URLs', which contains a specific URL: 'www.microsoft.com/pki/'.

Due to partial matching, traffic destined for 'microsoft.com' may match Policy 166, even though the policy is intended to apply only to the more specific URL. This occurs because the broader domain partially satisfies the matching criteria, which leads to unintended policy selection.

edit 166
    set type explicit-web
    set dstintf "port9"
    set srcaddr "all"
    set dstaddr "NoAuth_URLs"
    set action accept
    set schedule "always"
    set service "webproxy"
    set explicit-web-proxy "web-proxy"
    set utm-status enable
    set logtraffic all
    set ssl-ssh-profile "SSL-deep-inspection-custom"
    set av-profile "g-AV-custom"
    set webfilter-profile "g-Web-Monitor-NO-Post"
    set application-list "Block POST/PUT"

edit 516
    set type explicit-web
    set dstintf "port9"
    set srcaddr "all"
    set dstaddr "all"
    set action accept
    set schedule "always"
    set service "webproxy"
    set explicit-web-proxy "web-proxy"
    set utm-status enable
    set logtraffic all
    set logtraffic-start enable
    set groups "Domain_Userscustom"
    set ssl-ssh-profile "SSL-deep-inspection-custom"
    set av-profile "g-AV-custom"
    set webfilter-profile "g-Block-With-Appeal-custom"
next

In these scenarios, partial policy match can be disabled using the following configuration:

config web-proxy global

    set policy-partial-match disable

end

Related document:
Policy matching