FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 192912



This article provides a sample of firewall policy lookups.







Policy lookups.


  • Firewall policy lookup is based on the Source_interfaces/Protocol/Source_Address/Destination_Address that matches the source-port and dst-port of the protocol.
  • Use this tool to find out which policy matches specific traffic from a number of policies. After completing the lookup, the matching firewall policy is highlighted on the policy list page.

The Policy Lookup tool has the following requirements:

  • Transparent.
  • When executing the policy lookup, it is necessary to confirm whether the relevant route required for the policy work already exists.


Sample Configuration.

This example uses the TCP protocol to show how policy lookup works:


  • In Policy & Objects policy list page, select 'Policy Lookup' and enter the traffic parameters.

  • Select 'Search' to display the policy lookup results.
For the SSL VPN it is possible to follow the same steps, just pay attention that in the source interface, it is necessary to select the SSL VPN interface, and in the source, and an IP of users that are currently online (Authenticated).
In the example below the IP is from an SSL VPN user who is connected to the VPN.

From the 7.4 version, the option is changed to 'policy match'.