Troubleshooting Tip : How to troubleshoot traffic matched to the Implicit Deny policy not logged despite Policy Logging enabled

[mriswan]

Description

This article describes how to troubleshoot traffic matched to the Implicit Deny policy not logged despite Policy Logging enabled.

Scope

FortiProxy.

Solution

It is expected to see below WAD debug if the traffic matches the implicit deny:

[p:1824][s:855764559][r:50738258] __wad_fw_policy_match_user :4829 matched cached grp:NA
[p:1824][s:855764559][r:50738258] wad_fw_policy_async_match :6405 pol_ctx:xhcf|Acud|7?|=d
[p:1824][s:855764559][r:50738258] wad_http_req_policy_set :10411 match policy-id=0(pol_ctx:xhcf|Acud|7?|=d) vd=0(ses_ctx:x|Phx

If the logs are not appearing in the forward traffic logs despite logging being enabled, verify the following settings:

config log setting
    set fwpolicy-implicit-log enable <----- Should be enabled to log implicit rules when configuring a Transparent Policy.
    set expolicy-implicit-log enable <----- Should be enabled to log implicit rules in an Explicit Policy.
end