CLI show commands

Hi,

Basically, on the Firewall, all ports are closed by default; afterward, when needed the relevant services are allowed on appropriate IPv4 policies.

Example:

config firewall policy
edit 1
set name "LAN-WAN"
set srcintf "lan"
set dstintf "wan1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "HTTPS" <-- Service
set nat enable
next

end

config firewall service custom
edit "HTTPS"
set category "Web Access"
set tcp-portrange 443 <-- Ports allowed in the service
next
end 

Commands to verify the service:

# sh firewall service custom "HTTPS

I hope this would have been useful.

This might work as a tool for your purpose: "diag firewall iprope lookup".
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Trace-which-firewall-policy-will-match-based-on-IP/ta-p/195038

Thank you for the info, very  useful.