| Description | This article describes a scenario where policy match lookup is not selecting the correct policy or hit the implicit denied policy. |
| Scope | FortiGate. |
| Solution | Policy lookup is a GUI tool used to lookup which policy will be used to allow or deny specific traffic. The tool is available under Policy & Objects -> Firewall Policy -> Policy Match The following policy example uses a specific source, destination, and specific services.  The SFTP Service has been configured to use a specific source port as follows.  Using the Policy lookup without specifying the source port used in the service will result in hitting the Implicit_Deny Policy.   Even though it is marked as 'Optional' in the GUI, the Service has been set with a specific source port, therefore the only way to match the Service is to specify a source port that is within the range that the Service has been assigned.   |
