How to Fix a Deny Policy Blocking Traffic in FortiGate
A FortiGate administrator observes that traffic from a specific subnet is being denied even though there is an allow policy for that subnet. The administrator checks the policy list and sees an explicit deny policy above the allow policy. What should the administrator do to allow the traffic?
Quick Answer
The answer is to move the allow policy above the deny policy. This is correct because FortiGate firewalls evaluate policies in a strict top-down order, meaning the first matching policy in the list is applied to the traffic. Since the explicit deny policy sits above the allow rule, it matches the subnet first and drops the traffic before the allow policy can ever be considered. On the Fortinet NSE 4 Network Security Professional exam, this scenario tests your understanding of policy sequencing and the common trap of placing a broad deny rule above a specific allow rule. A frequent memory tip is to think of the policy list as a waterfall: the first policy that catches the traffic determines its fate, so always place your most specific allow policies near the top. Remember the mnemonic "Allow Above Deny" to avoid blocking legitimate traffic.
⚠ Common exam trap
Candidates often think adding a new policy with a higher ID (Option A) will override the deny policy, but they fail to understand that FortiGate evaluates policies in order of ID (lowest to highest), so a higher ID policy is evaluated later and will never be reached if a deny policy with a lower ID matches first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Move the allow policy above the deny policy
FortiGate policies are evaluated sequentially from top to bottom (lowest ID to highest ID). The first matching policy is applied. If an explicit deny policy appears above an allow policy for the same subnet, the deny policy will match first and drop the traffic. Moving the allow policy above the deny policy ensures it is evaluated first, allowing the traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a new policy with a higher ID
Why it's wrong here
Adding a policy with higher ID places it lower, making it less likely to match.
- ✓
Move the allow policy above the deny policy
Why this is correct
Changing order ensures the allow policy matches first.
- ✗
Disable the deny policy
Why it's wrong here
Disabling might be acceptable, but reordering is the standard fix.
- ✗
Delete the deny policy
Why it's wrong here
Deleting may not be desired; reordering is better.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator notices that traffic from the internal network (10.0.1.0/24) to the internet is not being matched by the intended firewall policy (ID 10). The policy uses source address 'internal_subnet' (10.0.1.0/24) and destination address 'all'. There is another policy (ID 5) with source 'all' and destination 'all' that also matches this traffic. What is the most likely reason policy 10 is not being matched?
medium- ✓ A.Policy 5 has a higher priority because it is above policy 10 in the policy list
- B.Policy 10 is configured with an expired security certificate
- C.The source address object 'internal_subnet' is incorrectly configured
- D.Policy 10 has a schedule that is not active
Why A: FortiGate firewall policies are evaluated sequentially from top to bottom, and the first matching policy is applied. Since policy 5 with source 'all' and destination 'all' is listed above policy 10, traffic from 10.0.1.0/24 to the internet matches policy 5 first, preventing policy 10 from ever being evaluated. This is the most likely reason the intended policy is not being matched.
Variation 2. A FortiGate is configured with multiple policies. The first policy allows traffic from 10.0.0.0/8 to any destination. The second policy denies traffic from 10.0.1.0/24 to any destination. What happens when a packet from 10.0.1.5 to 8.8.8.8 arrives?
hard- A.The packet is denied by implicit deny
- ✓ B.The packet is allowed by the first policy
- C.The packet matches both policies and is allowed
- D.The packet is denied by the second policy
Why B: FortiGate firewall policies are evaluated in sequential order from top to bottom. The first policy matches source 10.0.0.0/8, which includes 10.0.1.5, and allows the traffic to any destination. Since the packet matches this policy first, it is accepted and the second policy is never evaluated. Therefore, the packet is allowed by the first policy.
Variation 3. A FortiGate has two firewall policies: Policy 1 (ID 1) allows HTTP from any to 10.0.0.0/8, and Policy 2 (ID 2) denies all traffic from 192.168.1.0/24 to any. Traffic from 192.168.1.10 to 10.0.0.5 on port 80 is received. Which policy will match first?
easy- ✓ A.Policy 1 (ID 1) will match and accept the traffic
- B.Both policies will match, and the traffic will be denied
- C.Policy 2 (ID 2) will match and deny the traffic
- D.Neither policy matches, so the traffic is dropped by default deny
Why A: Policy 1 (ID 1) matches first because FortiGate evaluates firewall policies in sequential order from top to bottom (lowest ID to highest ID) until a match is found. The source IP 192.168.1.10 falls within the 'any' source of Policy 1, and the destination 10.0.0.5 is within 10.0.0.0/8, with HTTP (port 80) matching the service. Since Policy 1 matches, it is applied and the traffic is accepted, even though Policy 2 would also match if reached.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.