FortiGate firewall policies are evaluated top-to-bottom, and traffic matches the first policy that fits — a broader rule placed above a new, more specific one will silently intercept the traffic first.
Common Symptoms
- A newly created allow/deny rule seems to have no effect
- Traffic that should be blocked still passes
- Traffic that should be allowed is still blocked
Possible Causes
- Rule order — an earlier, broader policy matches first
- Incorrect source/destination address objects
- Service/port definition not matching the actual traffic
- NAT settings interfering with expected source/destination matching
Before You Begin
Method 1 — Check policy order
Review policies top to bottom
Confirm no earlier, broader policy matches the same traffic before your intended rule is reached.
Method 2 — Verify address and service objects
Double-check object definitions
Confirm the source/destination address objects and the service/port definition genuinely match the real traffic pattern you’re trying to control.
Method 3 — Check the policy log
Review logged traffic
FortiGate’s log & report section shows which policy actually handled a given session — use this to confirm which rule is really matching.
Frequently Asked Questions
Does policy order really matter that much?
Yes — it’s the single most common cause of a seemingly correct rule having no visible effect. FortiGate stops evaluating as soon as it finds the first matching policy.
Conclusion
Checking policy order and confirming address/service objects against real traffic resolves the majority of “my firewall rule doesn’t work” cases.
Related Articles
