what determines the policy ordering

[nikolaj]

Is the seq# that determines the order in which the policy are applied?

Thanks

[ede_pfau · Accepted solution]

Yes and no.

Only the order within an interface pair is relevant. Policies are ordered by their appearance in the config file, top down.

The sequence number is just an optical aid in the GUI - you won't find it anywhere in the config. It is numbered consecutively from the first to the last policy. So, it is not determining the order but adjusted to the order. Say, you drag a policy in the GUI to the top - it's sequence number will change.

There's an unambiguous ID for each policy by which you can edit it in the CLI. The ID column can be shown in the GUI as well. But it is not relevant for the order of execution but the order of creation.

[jpp · Accepted solution]

why you cannot see the in the gui ?

rules are aplied exactly like they are in the gui, and as long as you don't have policies with multiple interfaces, it's fairly easy to determine wich one is before other.

You can drag-and-drop policies to reorder them in the gui and this will be the order next connection will be"classified".

It is always a good idea to show both sequence# and policyID#. You just don't need to look at the numbers but the order - top to bottom (assuming your monitor is upright ;))

[ede_pfau · Accepted solution]

Yes and no.

Only the order within an interface pair is relevant. Policies are ordered by their appearance in the config file, top down.

The sequence number is just an optical aid in the GUI - you won't find it anywhere in the config. It is numbered consecutively from the first to the last policy. So, it is not determining the order but adjusted to the order. Say, you drag a policy in the GUI to the top - it's sequence number will change.

There's an unambiguous ID for each policy by which you can edit it in the CLI. The ID column can be shown in the GUI as well. But it is not relevant for the order of execution but the order of creation.

[nikolaj]

So, in the Fortigate GUI, in the policy section with section view checked, I can see the interface pair.

The numbers in ascending order in the first column represent the sequence in which the policy are executed?

[Kenundrum]

nikolaj wrote:

The numbers in ascending order in the first column represent the sequence in which the policy are executed?

As long as Sequence# is the first column in your gui. You can right click on the column heading to add/remove columns. The tell-tale is that the sequence# does not have a clickable link whereas the policy id does. I use both the sequence# and the policy ID as the first two columns because i need to refer to the ID for change tracking.

[emnoc]

I have to  agree with the other ken ;) in thw gui set the policyid and seq# , from the cmd_sli the show firewall policy and the resulting output is the top-2-bottom that Ede mentioned earlier

YMMV but  beaware the policy-id HAS NOTHING TODO WITH THE SEQUENCE

e.g

FGTLONUK01 (custM) $ show firewall  policy policyid    Policy ID. (0-4294967294)

10288

12333

18  

111 19   17   15   14  

234

490 13   11   8   1   2   3  

82

190

189 4   5   6   12   7 

[nikolaj]

So, in essence, I can see the order in which the rules are applied not in the GUI but in the config file, where I can see the interface pair and the order is from top down. Correct?

[jpp · Accepted solution]

why you cannot see the in the gui ?

rules are aplied exactly like they are in the gui, and as long as you don't have policies with multiple interfaces, it's fairly easy to determine wich one is before other.

You can drag-and-drop policies to reorder them in the gui and this will be the order next connection will be"classified".

It is always a good idea to show both sequence# and policyID#. You just don't need to look at the numbers but the order - top to bottom (assuming your monitor is upright ;))

[emnoc]

You can set the webGui  display filters to show the  seq# and policy ID#

see screenshot

[ede_pfau · Accepted solution]

nikolaj wrote:

So, in essence, I can see the order in which the rules are applied not in the GUI but in the config file, where I can see the interface pair and the order is from top down. Correct?

Yes. Simply top-down, and in ascending sequence number, as you would expect.

This explains why you are encouraged to order the policies from most explicit to most general, regarding the matching fields (source addr, dest addr, service, schedule). If a more general policy is placed before (on top of) a more specific one, the specific one will never be hit.