Technical Tip: How to find the ordered sequence number of firewall policies from FortiGate CLI

vpalli · ‎05-16-2022

Description

This article provides information about how to display the sequence number of firewall policies in the order that they are arranged on GUI. The sequence number is different from the numeric ID given to the firewall policy.

When policies are moved up or down using drag and drop on GUI, the numeric ID of the firewall policies may be shown out of order or not in sequence.

Scope

FortiGate.

Solution

Firewall policies created on FortiGate using GUI/CLI contain a numeric ID and every new firewall policy gets a number in ascending order fashion.

The output #diagnose firewall iprope list 100004 displays the Kernel iprope rules that are checked in sequence while processing end-user traffic to allow or deny the session.

#diagnose firewall iprope list 100004

policy index=45 uuid_idx=719 action=accept
flag (8050100): nat master use_src pol_stats
flag2 (1004000): resolve_sso ses-persistent
flag3 (a0): link-local best-route
schedule(always)
cos_fwd=255 cos_rev=255
group=00100004 av=00000000 au=00000000 split=00000000
host=0 chk_client_info=0x0 app_list=0 ips_view=0
misc=0
zone(1): 6 -> zone(1): 6
source(1): 0.0.0.0-255.255.255.255, uuid_idx=500,
dest(1): 0.0.0.0-255.255.255.255, uuid_idx=500,
service(1):
[0:0x0:0/(0,65535)->(0,65535)] helper:auto

policy index=44uuid_idx=720 action=accept
flag (8050100): nat master use_src pol_stats
flag2 (1004000): resolve_sso ses-persistent
flag3 (a0): link-local best-route
schedule(always)
cos_fwd=255 cos_rev=255
group=00100004 av=00000000 au=00000000 split=00000000
host=0 chk_client_info=0x0 app_list=0 ips_view=0
misc=0
zone(1): 41 -> zone(1): 6
source(1): 0.0.0.0-255.255.255.255, uuid_idx=500,
dest(1): 0.0.0.0-255.255.255.255, uuid_idx=500,
service(1):
[0:0x0:0/(0,65535)->(0,65535)] helper:auto

policy index=0 uuid_idx=1 action=drop
flag (8010800): d_rm master pol_stats
flag2 (4000): resolve_sso
flag3 (100): last-deny
schedule()
cos_fwd=0 cos_rev=0
group=00100004 av=00000000 au=00000000 split=00000000
host=0 chk_client_info=0x0 app_list=0 ips_view=0
misc=0
zone(1): 0 -> zone(1): 0
source(1): 0.0.0.0-255.255.255.255, uuid_idx=0,
dest(1): 0.0.0.0-255.255.255.255, uuid_idx=0,
service(1):
[0:0x0:0/(0,0)->(0,0)] helper:auto

The 'policy index' value indicates the numeric ID of the firewall policy and the 'uuid_idx' corresponds to the ordered sequence number of the firewall policy.