FortiGate Policy Implicit Deny: diagnose debug flow When the Allow Rule Never Hits

FortiGate · Techclick CLI troubleshooting lab

Policy 12 is allow. Packet never matches it. Hit count stays 0. User is on the right VLAN.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on FortiGate for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

diagnose debug flow shows the real incoming interface, NAT, and the policy that actually matched — often implicit deny or a different policy.

Why this ticket shows up

FortiOS matches on incoming interface + 5-tuple. A wrong interface, VIP, or central NAT skips the policy you are staring at.

Symptoms operators actually see

• Hit count 0 on the intended policy

• implicit deny in logs

• Works from another VLAN

• VIP configured but unused

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

diagnose debug reset
diagnose debug flow filter addr 10.10.10.50
diagnose debug flow show function-name enable
diagnose debug flow trace start 50
diagnose debug enable
diagnose firewall iprope lookup 10.10.10.50 443 203.0.113.10 443 tcp

How to read that output

The flow print names the incoming interface and policy id. If policy is 0, it is implicit deny. Compare that interface to policy 12.

Triage order

1. Filter debug flow on the client IP

2. Generate one connection

3. Read incoming interface and policy id

4. Fix the interface or the address object

5. Disable debug

Classic traps

What you see	Real cause	Fix
Add another allow	Traffic enters a different interface	Fix zoning
Leave debug on	CPU will climb	diagnose debug disable
Trust the GUI hit count	It updates slowly	Trust the flow trace

Proof the ticket is closed

• Flow matches policy 12

• Hit count increments

• Application works

Say this in an interview

I do not argue with implicit deny. debug flow tells me the interface and the policy id in one shot.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/