Technical Tip: Troubleshoot and verify if traffic is hitting a Firewall Policy

[rmetzger]

Description

This article describes when there are many Firewall Policies for a specific interface pair, an easy way to see if a policy is actually hit by some traffic is to add the counter field in the GUI.

Scope

FortiGate, FortiOS.

Solution

1. From the GUI, navigate to  Policy & Objects -> Firewall Policy.
2. Select the 'Configure Table' option as shown in the screenshot below:

3. Select 'Hit Count' as well as 'Bytes' and then Apply:
    

   

    

4. Now verify that some packets hit this Policy will show the number of policy hits and Bytes as shown in the screenshot below:

Note: For accelerated traffic (ex. NP2 ports), only the start of the session packet will be counted, and this counter does therefore not reflect the real traffic count. For non-accelerated traffic, all packets will be counted.

Related articles:

Technical Note : Configuring a Firewall Policy which is valid only at certain days or hours by using...

Technical Tip: Information about traffic log counters for NP2 or NP4 offloaded sessions

Technical Tip: How to clear Firewall Policy counters