Help With Traffic Hitting Implicit Deny

Forum|Forum|1 year ago
October 10, 2024
4 replies
3266 views

Hello,

I have some traffic hitting Implicit Deny, even tho the Allow Policy seems to be correct:

Logs:

Rule:

Found this: Traffic dropped by 'implicit deny pol... - Fortinet Community, but everything shown is ok here.

This might be relevant: I recently changed my FortiGate from standalone to Fabric Root.

Could you please help diagnose this? Thanks in advance.

AEK

SuperUser

Hi

Try check in quarantine monitor if the spurce IP addresses are not quarantined.

Also check in the above log if the outgoing interface is the right one in the policy.

AEK

NoneEngAuthor

Explorer II

Hi @AEK!

No quarantined IP or devices.

In the logs the outgoing interface is the right one.

One thing I noticed is the blocks happen only with my WLANs.

Created a new Policy "TEMP_TEST", added it on the top with one of them:

Logs:

PS: This WLAN has a captive portal and is from a FortiAP. Users just need to accept the terms to login in.

I don't have a clue :grinning_face_with_sweat:
Any ideas how to further look into it?

AEK

SuperUser

Hi NoneEng

So can you disable the active portal and try again?

AEK

rahul_p1

Staff

Hi,

Please share the debug logs:-

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter addr X.X.X.X -------->>x.x.x.x is your destination IP
diagnose debug flow show function-name enable
diagnose debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug enable

Note:- Run this to stop the debug

diagnose debug disable