Technical Tip: FortiGate Policy ID = 0 (Implicit deny) accepting traffic in FortiAnalyzer logs

[upatel]

Description	This article describes how FortiAnalyzer logs show policy ID = 0 accepting traffic.
Scope	FortiGate/FortiAnalyzer.
Solution	In reality, Policy ID = 0 (Implicit deny) is not allowing traffic but it shows in FortiAnalyzer logs because it is the last policy that gets checked. As seen in the below screenshot, FortiAnalyzer logs show policy ID = 0 accepting traffic. After expanding the FortiAnalyzer log, this traffic is marked as local. This traffic is either generated by FortiGate or terminating on FortiGate itself. In this case, an unknown source was trying to hit FortiGate's external IP on port 4500. When running debug flow and diag sys session, the policy ID = 4294967295 was accepting traffic. This is the default local-in-policy ID number that this traffic was hitting and allowing it. By design, when the local in traffic comes in, it will check multiple policy groups, including implicit and explicit policies. 'config firewall local-in-policy' is just the first group. If it passes, it will check several other implicit groups. It will use the last matched policy number. Default local-in-policy allowing traffic for port 4500. In this case, the traffic was hitting default local-in-policy which accepted the traffic and as designed checks other policies in line. That is the reason why FortiAnalyzer logs show an accepted log with policy ID = 0.