Solution | Take into consideration the following scenario: A new firewall policy is configured on the FortiGate for a specific type of traffic, adding security features like Web filtering or Application control. The policy is then moved to the top of the Firewall Policy view so it matches during the policy lookup process that the FortiGate does. Traffic is generated to match this particular policy, and when checking logs, the traffic is matching the newly configured policy, and everything is working as expected. When checking the policy statistics in the GUI, nothing is shown, and the statistics are not updated. Traffic continues to flow, but the policy statistics keep on showing no value, as if the policy is not processing any traffic.
To troubleshoot this issue, follow these steps:
To check the IPv4 policy statistics, run the command below:
diagnose firewall iprope show 100004 <policy_ID>
To check the IPv6 policy statistics, run the command below:
diagnose firewall iprope6 show 100004 <policy_ID>
If FortiGate is running in multi-VDOM environment, and to find the policy, above mentioned commands need to be run from inside the correct VDOM :
config vdom
edit <name>
Pair the counter check with below mentioned command, that confirms which policy ID a live session is pinned to, which helps to point that existing sessions aren't re-evaluated against the new/reordered policy :
diagnose sys session list | grep policy_id
Verify that the policy is correctly configured and that traffic is matching the policy by checking the logs.
Check if the issue is specific to new policies or if it also occurs with older policies.
Check if the issue is present for older sessions or sessions already matching a previous rule, or for newly established sessions.
If the issue is specific to new policies and does not impact newly created sessions, upgrade to the latest FortiOS v7.4 or v7.6 branch, as this issue was investigated and fixed by the development team.
Note: Existing sessions are not re-evaluated when a firewall policy is created or its position is changed. Perform the validation using a newly established session or clear the affected test session before generating traffic again. If the counters increase in the CLI while the GUI remains unchanged, the issue is limited to the GUI statistics display and does not affect traffic processing.
|
