Technical Tip: How to check whether the firewall policy is oversized

[kwcheng__FTNT]

Description	This article describes how to check whether the firewall policy is oversized.
Scope	FortiGate.
Solution	A policy can potentially become oversized when modifying a variety of objects. It can cause the policy to malfunction when it is oversized. Hence, the following command can be used to check whether a firewall policy is oversized: diagnose firewall iprope show 00100004 X Note: Replace 'X' with policy ID. The ID can be checked from the GUI. For more information: Technical Tip: How to find policy ID Here is the sample output from the debug command above: Tiara-kvm05 # diagnose firewall iprope show 00100004 1 idx:1 pkts:74121908 (40288 125777 43045 79472 83932 155936 206080 1105960) bytes:66758665762 (28356926 117292649 17679078 35315888 31601911 87534695 156952603 1222883616) asic_pkts:0 (0 0 0 0 0 0 0 0) asic_bytes:0 (0 0 0 0 0 0 0 0) flag:0x0 hit count:1923549 (2272 4897 4933 5480 6769 8998 8738 9523) first hit:2023-07-25 14:26:06 last hit:2024-12-02 09:35:26 established session count:7 first est:2023-07-25 14:26:06 last est:2024-12-02 09:35:26 From the output above, check 'flag' output: 0x0 means it is NOT oversized. 0x40 means it is oversized.