Weird beavior of FortiOS with VIP

Hello,

I just ran into this:

on a FGT I have two policies:

One has a VIP as destination to rewrite an ip into a different subnet

The other matches all traffic between the involved subets and interfaces.

the policies have exactly this order.

In FortiAnalyzer I can see:

- it does the VIP because it shows me the destinatin nat ip

- it didn't match the first policy though because source intf and -address were wrong in it

But

- it also didn't match the 2nd one even though everything in there matches and the traffic got denied (Policy #0 implicit deny).

I understand why it didn't match the first policy but I don't get why it didn't match the other policy then.

Policy #1:

Source Interface: zone2

destination Interface: zone1

source address is in subnet of member of zone2

destination: vip1

action: allow

services: ping,https

vip1:

external IP: ip the traffic originates to

mapped IP: destination ip (which is also on a meber of zone1)

Didn't match because traffic originated from member of zone1 and didn't match the source address.

Policy2:

source and destination interface: zone1

source and destination address: all

service: all

action: allow

Should match this traffic even without the vip but didn't.

I have no clue why.

After correcting policy1 the traffic does match policy1 correctly (including the VIP).

Happend on a FGT100F with FortiOS 7.2.13....

Did anyone else encounter such behaviour?