Firewall Policies
Configure and manage firewall policies, understand matching order and the implicit deny, reuse objects, and apply best practices for a clean ruleset.
Every transiting packet is matched against the firewall policy table top to bottom, and the FortiGate stops at the first match. If no policy matches, the implicit deny-all at the bottom drops the traffic (and, by default, does not log it unless you enable logging on the implicit deny).
Matching is based on the policy's criteria: incoming and outgoing interface, source and destination address, service (port/protocol), schedule, and (in NGFW policy-based mode) application and URL category. Because the first match wins, more specific policies must sit above more general ones.
In what order are firewall policies evaluated?
What happens to traffic that matches no policy?