Technical Tip: 'Deny: policy violation logs even after matched policy'

[SAJUDIYA]

Description	This article describes that there are a few reasons why even after there is a firewall policy, logs are not matching. It could be device IP banned, threat score high or SNAT configured with one-to-one NAT.
Scope	FortiGate.
Solution	First, verify which traffic is having an issue, Based on that check the matching policy and verify the below information to confirm what is the actual issue. Check if the source IP is added as 'BAN IP' or quarantined in FortiGate as the below solution: Troubleshooting Tip: 'Deny: policy violation' in logs, IP denied in an allow policy If not, then check if  Threat ID 131072 is seen in traffic logs for denied traffic as below solution: Troubleshooting Tip: Threat 131072 is seen in logs when traffic is denied by a firewall policy Check if incoming traffic needs user authentication such as FSSO, or LDAP as below: Technical Tip: FortiGate - Deny: policy violation logs with authentication FSSO and LDAP Make sure that traffic is not doing hairpin nat where traffic goes from LAN to WAN and then VIP from WAN to DMZ or internal interface: Technical Tip: Configuring Hairpin NAT (VIP) Make sure that there is no SNAT configured with a one-to-one dynamic pool so it will not accept new traffic as the pool is filled up. In this scenario, it is necessary to change SNAT from one-to-one NAT to overload or another option: Troubleshooting Tip: Traffic is getting denied by SNAT IP pool check Dynamic SNAT