Identify Matching Firewall Policy: CLI Commands for Traffic Lookup
An admin is troubleshooting why traffic from a specific host (10.0.1.10) to a web server (203.0.113.50:80) is being denied. The FortiGate has several policies. Which TWO CLI commands should the admin use to identify which policy is matching the traffic? (Choose two.)
Quick Answer
The correct commands are `diagnose firewall policy list` and `diagnose firewall iprope`, as these two CLI commands together allow an admin to identify which firewall policy is matching specific traffic in real time on a FortiGate. `diagnose firewall policy list` displays all configured policies with their IDs and sequence numbers, while `diagnose firewall iprope` reveals the actual lookup order and shows which policy ID matches a given source, destination, and service, making it indispensable for troubleshooting denied flows like the one from 10.0.1.10 to 203.0.113.50:80. On the Fortinet NSE 4 Network Security Professional exam, this scenario tests your ability to distinguish between diagnostic commands for traffic analysis and configuration or execution commands—a common trap is confusing `get firewall policy` (which only shows static config) with the live diagnostic tools, or thinking `execute` commands apply here. Remember the mnemonic: "List the policies, then probe the order" to recall that `list` gives you the IDs and `iprope` tells you which one fires.
⚠ Common exam trap
It's easy for candidates to confuse 'diagnose debug flow' (a real-time debugging tool) with 'diagnose firewall iprope lookup' (a static policy lookup tool), or they mistakenly think 'get firewall policy' can identify the matching policy without specifying traffic parameters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80
B is correct because 'diagnose firewall iprope lookup' is the exact CLI command that performs a simulated policy lookup for a given source IP, destination IP, and port, showing which firewall policy matches the traffic. This allows the admin to verify the policy match without generating real traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
execute ping 203.0.113.50
Why it's wrong here
Ping tests connectivity, not policy matching.
- ✓
diagnose firewall iprope lookup 10.0.1.10 -> 203.0.113.50 80
Why this is correct
Simulates the policy lookup for a specific flow, showing which policy matches.
- ✗
diagnose debug flow
Why it's wrong here
`diagnose debug flow` is an active debugging command that generates verbose output for every packet matching its filter, making it inefficient for simply identifying the policy number. It is designed to trace the exact path of a specific packet through the FortiGate in real-time, showing precisely where it is denied or allowed, including the policy ID. This command is invaluable for deep-diving into live traffic issues, analysing the full processing flow to understand *why* a decision was made, rather than just quickly identifying a matching policy.
- ✓
diagnose firewall policy list
Why this is correct
Lists all policies with IDs; helps identify relevant policies.
- ✗
get firewall policy
Why it's wrong here
This command shows the configuration, not real-time matching.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate admin is troubleshooting an issue where internal users cannot access a specific external service over TCP/443. The admin confirms that the firewall policy allows HTTP/HTTPS. Which TWO CLI commands should the admin use to diagnose? (Choose two.)
hard- ✓ A.diagnose firewall iprope list
- ✓ B.diagnose debug flow
- C.diagnose sys session filter dport 443
- D.get system performance status
- E.execute ping 8.8.8.8
Why A: 'diagnose firewall iprope list' displays the kernel's internal firewall rule chains, allowing the admin to verify whether the policy lookup is matching the expected rule for TCP/443 traffic. This command helps confirm that the policy is installed and active in the kernel, which is essential for troubleshooting policy-based access issues.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.