Technical Tip: How to clear or reset policy counters on the firewall Policy via CLI

[vrajendran]

Description

This article describes the procedure from CLI to clear policy counters.

Scope

FortiGate.

Solution

From GUI.

1. In FortiOS v5.0.

• Select the value of the Count field on the firewall policy under Policy -> Policy -> Policy.
• Select 'Clear Counters' from the list.
  
  

2. In FortiOS v5.2 ,v5.4,v5.6 and v6.0.

• Select the value of the Count field on the firewall policy under Policy & Objects -> IPv4 Policy.
• Select 'Clear Counters' from the list.
  
  

3. In FortiOS v6.4.

• Select the value of the Count field on the firewall policy under Policy & Objects -> Firewall Policy.
• Select 'Clear Counters' from the list.

4. In FortiOS 7.0+.

• First, change the display of Policy & Objects -> Firewall Policy to include hit-counters because they are not visible by default.
• 'Right-click' on the top of Hit Counters and select 'Clear Counters'.

                                   

From CLI.

Run the following CLI command to reset the packet count option for the firewall policy:

diagnose firewall iprope clear 100004 <Policy ID>

Example: resetting the value of the count field for the Policy ID 3.

diagnose firewall iprope clear 100004 3

Clear more than 1 counter just adding policies ID.

diagnose firewall iprope clear 00100004 3 12 48  4

Counters from Policies ID 3, 12, 48, and 4 have been cleared.

The 'groupid' is 00100004, this value is for configurable firewall policies.

There are other groupid's for specific functions as listed below:

diagnose firewall iprope list 100002 <----- This will list static SNAT policies.

diagnose firewall iprope list 100000 <----- This will list VIP firewall policies.

diagnose firewall iprope list 100004 <----- This will list normal firewall policy -- forward policies.

diagnose firewall iprope list 10000e <----- This will list all implicit policies as listed in GUI. 

diagnose firewall iprope list 100015 <----- This will list all Traffic Shaping policies as listed in GUI.

diagnose firewall iprope list 100017 <----- This will list all simple ZTNA policies as listed in GUI.

The Policy ID number is different from the policy sequence number which is shown in the 'Seq#' column on the GUI.
The Policy ID number which is the index number of the firewall policy can be found under the 'ID' column on the GUI.

To reset the count field for all policies simply omit the <Policy ID>:

diagnose firewall iprope clear 100004

Related articles:

Technical Note: How to Reset Count on the Firewall Policy

Technical Note: How to clear policy counters from CLI