Fortigate: Why traffic is allowed by default in policy based mode?

do you have NAT enabled on some policy? Or is there some policy allowing src any to dst any or similar?

You could do some flow debug to see which policy is being hit.

Hi,

No, I just installed the FG, set the hostname, IP addresses of WAN, LAN1 and LAN2 interfaces, allowed ping on all interfaces but http/https only on the WAN, set the LAN1 as DHCP server, and changed the settings to policy based. The rest is the configuration by default (only the deny all policy exists). If it helps, it's a KVM virtualized FG, but I think it should not be important.

I thought about doing debugging it, but the thing is that it should not match anything. Tomorrow I will if I don't find any logic behind it.

Regards,

Finally I found the issue. I was breaking my head, watching how the matching policy was the default one, and even though the traffic was allowed through the Fortigate.

It was an issue with the memory assigned to the VM, it was less than the recommended, but all this time, the lab worked perfectly with profile-based configurations, now I just assigned more vRAM, and everything started to work as expected.