Implicitly denied traffic not logged while using a VIP with external IP matching interface

You need to enable match-vip enable under the deny policy.

Following is the explanation:

If you want to explicitly drop a packet that is not matched with a firewall policy and write a log message when this happens, you can add a general policy (source and destination address set to ANY) to the bottom of a policy list and configure the firewall policy to DENY packets and record a log message when a packet is dropped.

In some cases, when a virtual IP performs destination NAT (DNAT) on a packet, the translated packet may not be accepted by a firewall policy. If this happens, the packet is silently dropped and therefore not matched with the general policy at the bottom of the policy list. To catch these packets, enable match-vip in the general policy. Then the DNATed packets that are not matched by a VIP policy are matched with the general policy where they can be explicitly dropped and logged.

(source and destination address set to ANY)

Thanks for the replies. I think we're headed in the right direction!

I created wan1 > DMZ and wan1 > port1 deny rules with match-vip enabled and I'm still not seeing any denied traffic hitting my wan1 interface.  

I'm viewing the logs on the FAZ so I assume I see both local and forward logs under the traffic logs section.  I see other traffic coming to and from root so I must be seeing local logs too.

I'm going to try this out in lab soon and see if I can replicate the same behavior.