Application Policy Fall-Through

[rockychan]

Hi, Fortinet!

Recently one of my customers is asking me about this question below:

Can Fortigate trigger policy fall-through when one session doesn't match a policy on the top? He means, when the srcint/dstint/srcip/dstip/service/schedule are matched, but application profile not matched, will we be able to fall through down policies till the end, or till one that matches.

I think he is referring to Palo Alto policy configs when asking this. I have searched a lot but can not get an obvious answer, so I'd like to post it here to leave a mark. Thanks a lot!

[neonbit · Accepted solution]

You can do this with the newest version of FortiGate (5.6 and 6.0) where the policies are like Palo Altos. You create NGFW policies. More info here: [link]https://cookbook.fortinet.com/ngfw-policy-56/[/link]