User is a member of Multiple Groups

I really never seen fall-thru but have you ran diag debug flow  and follow the policy execution & selection

mwkirk wrote:

So.... 

 

Two FSSO groups General Users and Social Medial.  I have two identical Firewall Policies except that one has a filter profile that references the General users and the General Filtering Policy.  The other references the Social Media group and policy....

 

So...The way it works is that once it gets a User Group match then it processes that policy. It's a firewall and that's the way it works....  So, basically the policies need to be arranged from least restrictive to most restrictive. You can only really support a single match.

 

The only question I have is I thought there was a concept called Fall-through rules or something like that introduced in 5.2 which could support multiple group matches.  Is that something that does exist and/or my expectations of what it actually does are incorrect?

Mostly adding these notes for others that may come across this question. These two Technical Notes/Tips provide information on fall through behavior for unauthenticated users.

• https://community.fortinet.com/t5/FortiGate/Technical-Note-Implicit-fall-through-feature-for-user/ta-p/198731
• https://community.fortinet.com/t5/FortiGate/Technical-Tip-Active-authentication-firewall-policy-fall-through/ta-p/192567