Troubleshooting Tip: VIP traffic not matching the firewall policy with an 'all' destination

[seshuganesh]

Description	This article describes how to solve an issue where VIP traffic does not match a firewall policy with the destination set to 'all'.
Scope	FortiGate v7.2.2 and below.
Solution	When creating a firewall policy from 'WAN' to 'LAN' with the destination set to 'all', VIP traffic is sometimes  not filtered by the policy. For example, it will be allowed even if the action is set to 'deny'. By default, a policy will only match VIP object traffic if VIP object traffic is called. It will not match if the destination is 'all'. If central NAT is enabled, it is not necessary to add the VIP object on the policy as a destination address. To match the policy, enable the 'set match-vip enable' option in the CLI configuration of that policy. Afterward, VIP traffic will match the policy and be denied as intended. Note: The destination address object should be the 'mapped IP' of the VIP object because FortiGate performs the DNAT check first and then applies the security policy.  Note: The match-vip option is disabled by default until v7.2.3. In versions after 7.2.3, the option is enabled by default. The 'set match-vip' option is only available if the policy action is set to 'deny'.  Related article: Technical Tip: Firewall does not block incoming (WAN to LAN) connection even though deny policy Technical Tip: Configure firewall policies for a VIP when Central NAT is enabled