Firewall Policy Action DENY Causing Traffic Drop
A FortiGate admin configures a firewall policy to allow HTTP traffic from the internal network (10.0.0.0/8) to the internet. Users report that they cannot access web pages. The admin runs 'diagnose debug flow' and sees packets hitting the policy but being dropped. What is the MOST likely cause?
Quick Answer
The answer is that the firewall policy action is set to DENY, which directly causes the traffic drop. When a FortiGate firewall policy is configured with an action of DENY, any traffic matching that policy’s source, destination, and service criteria will be discarded at that point in the policy evaluation, even if the intended rule was to allow the traffic. In the scenario described, the debug flow shows packets hitting the policy but being dropped because the policy itself is instructing the firewall to deny the HTTP traffic, overriding any implicit allow logic. On the Fortinet NSE 4 Network Security Professional exam, this question tests your understanding of policy evaluation order and the critical difference between explicit deny and implicit deny—a common trap is assuming a policy that matches must be allowing traffic. Remember the memory tip: “If it hits but gets dropped, check the action—allow or deny, don’t get stopped.”
⚠ Common exam trap
Watch out — candidates often assume a policy being 'hit' in debug flow means it is allowing traffic, but in FortiOS, a policy with action DENY will still show as 'hit' before the packet is dropped.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy action is set to DENY
The debug flow output shows packets hitting the policy but being dropped. If the policy action were set to DENY, the firewall would match the traffic and then drop it, which matches the symptom. The fact that the policy is being hit rules out a disabled policy or a higher-priority deny policy (unless the higher-priority policy is also being hit, but the debug indicates the specific policy is the one dropping the traffic).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The interface is not configured as a WAN interface
Why it's wrong here
Interface type does not affect policy matching; the policy references specific interfaces.
- ✗
The policy is disabled
Why it's wrong here
A disabled policy would not show hits in debug flow.
- ✓
The firewall policy action is set to DENY
Why this is correct
If the policy action is set to DENY, even though the traffic matches the source/destination/service, it will be dropped. This is a common misconfiguration.
- ✗
The traffic is being processed by a higher priority deny policy
Why it's wrong here
If a higher priority deny policy matched, the debug flow would not show the packet hitting this allow policy.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator configures a firewall policy with source address 'internal_net' (10.0.0.0/16) and destination address 'server_farm' (10.10.10.0/24). The action is set to ACCEPT with NAT enabled. However, traffic from 10.0.1.100 to 10.10.10.50 is being denied. What is the most likely cause?
medium- A.The destination address 'server_farm' does not include 10.10.10.50
- ✓ B.There is a deny policy above this policy that matches the traffic
- C.The NAT translation is causing the traffic to be dropped
- D.The source address 'internal_net' does not include 10.0.1.100
Why B: The most likely cause is that a deny policy with a higher priority (lower sequence number) exists above the ACCEPT policy in the firewall policy list. FortiGate evaluates policies sequentially from top to bottom, and the first matching policy determines the action. If a deny policy matches the traffic (source 10.0.1.100, destination 10.10.10.50) before the ACCEPT policy is reached, the traffic will be denied regardless of the ACCEPT policy below it.
Variation 2. A FortiGate admin configures a firewall policy to allow outbound HTTP traffic and applies a web filter profile. The admin notices that some users can access a known malicious URL while others are blocked. All users are in the same source subnet (10.0.1.0/24). What is the MOST likely cause of this inconsistent behavior?
hard- A.The FortiGate is using a proxy server that caches different results for different users
- B.The web filter profile is configured to 'allow' but the FortiGuard rating is inconsistent
- C.The firewall policy has an FQDN destination that resolves to different IPs for different users due to DNS load balancing
- ✓ D.Some users have a different web filter profile applied due to a policy ordering issue where a higher-priority policy matches their traffic
Why D: When multiple firewall policies match traffic from the same source subnet, FortiGate uses the first matching policy in order (lowest policy ID). If a higher-priority policy with a different web filter profile matches some users' traffic (e.g., based on source port or application), those users will have different filtering behavior. This is a classic policy ordering issue where the intended web filter profile is not applied consistently to all users in the same subnet.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.