Technical Tip: Traffic does not match the new policy created above the old policy in FortiProxy

The 'Policy Matching Pass-Through' option is a feature that sets the policy as a pass-through policy. It enables traffic to be evaluated against all pass-through policies that match this traffic. The last pass-through policy will be considered as the matching policy.

However, if there is a matching policy without this option, and it is placed above other matching pass-through policies. The policy without a pass-through option will match the traffic and take an action.

This feature can be enabled/disabled from Policy & Objects -> Policy -> Select any policy to edit:

Take, for instance, two distinct policies, Policy ID 1 and 2. Both are a match for all the internet traffic.

When the 'Enable Policy Matching Pass through' option is disabled, the traffic matches policy ID 2.

Once the option is enabled on policy ID 2. The traffic starts matching the policy ID 1, which does not have this option enabled.

If enabled unnecessarily, the feature can cause interruptions with traffic, as an unexpected policy may get matched.

To preserve the standard top-down policy evaluation, the policy Matching pass-through feature must stay turned off.