How FortiGate Evaluates Firewall Policies: Top-to-Bottom First Match
What is the order of evaluation for firewall policies on a FortiGate?
Quick Answer
The answer is from top to bottom, first match. FortiGate evaluates its firewall policy list sequentially, starting at the top and moving downward, applying the first policy whose source, destination, and service criteria match the traffic. This deterministic order is critical because once a match is found, no further policies are checked, meaning a more specific rule placed below a broader one will never be reached. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept is tested directly in questions about policy configuration and troubleshooting, often with a trap where a deny policy is placed above an allow policy for the same traffic, causing unintended blocks. The key memory tip is “first match wins,” so always place your most specific or most restrictive policies at the top of the list to ensure they are evaluated before general rules.
⚠ Common exam trap
It's easy for candidates to confuse policy ID with evaluation order, assuming policies are processed by ascending ID, but FortiGate evaluates based on the visual list order, which can be manually rearranged independently of the ID numbers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
From top to bottom, first match
FortiGate firewall policies are evaluated sequentially from the top of the policy list downward. The first policy that matches the traffic's source, destination, service, and schedule is applied, and no further policies are checked. This top-down, first-match behavior ensures deterministic traffic handling and is fundamental to FortiGate's policy-based architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Random order
Why it's wrong here
No.
- ✗
From bottom to top
Why it's wrong here
Incorrect; it's top-down.
- ✓
From top to bottom, first match
Why this is correct
Correct.
- ✗
By policy ID in ascending order
Why it's wrong here
Policy ID does not determine order; the position in the list does.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which firewall policy matching parameter is evaluated FIRST when a packet arrives at a FortiGate interface?
easy- A.Source address
- B.Service
- C.Schedule
- ✓ D.Incoming interface
Why D: When a packet arrives at a FortiGate interface, the firewall policy lookup begins by matching the incoming interface. This is because the interface is the first parameter evaluated in the policy-matching sequence, as defined by FortiGate's session-based architecture. Only after the interface match is successful does the FortiGate proceed to evaluate source address, destination address, service, and schedule.
Variation 2. Given the exhibit, a user in the internal network tries to SSH to a public server (203.0.113.10). What will happen and why?
medium- ✓ A.The SSH connection will succeed because policy 1 allows all services before policy 2 is evaluated.
- B.The SSH connection will succeed because policy 2 is evaluated first.
- C.The SSH connection will be blocked because policy 2 explicitly denies SSH.
- D.The SSH connection will be blocked because policy 1 does not include SSH service specifically.
Why A: Policy 1 is an implicit allow-all rule that matches all traffic before policy 2 is evaluated. Since FortiGate processes policies in sequential order from top to bottom, the SSH connection to 203.0.113.10 matches policy 1 first, which permits all services, including SSH. Therefore, the connection succeeds without ever reaching policy 2.
Variation 3. A FortiGate has two firewall policies: Policy 1 (from port1 to port2, source all, destination 10.0.1.0/24, schedule always, action accept) and Policy 2 (from port1 to port2, source all, destination all, schedule 'Business Hours', action accept). A user attempts to connect from port1 to 10.0.1.5 at 8 PM on a Saturday. The traffic is denied. What is the most likely reason?
medium- A.Policy 1 only matches destination 10.0.1.10, and Policy 2's schedule is not active at this time
- B.The source address is not included in either policy
- ✓ C.Policy 1 is placed below Policy 2 in the policy order, so Policy 2 is evaluated first
- D.Policy 2 has an implicit deny action
Why C: Policy 2 is evaluated before Policy 1 because it is placed higher in the policy order. At 8 PM on a Saturday, the 'Business Hours' schedule of Policy 2 is inactive, so Policy 2 does not match. FortiGate then evaluates Policy 1, which matches the destination 10.0.1.0/24 and should accept the traffic. However, the traffic is denied, indicating that Policy 1 is actually below Policy 2, and due to the evaluation order, Policy 2's schedule inactivity causes a mismatch, but Policy 1 still matches. The denial likely results from an implicit deny after all policies are evaluated, but among the options, only option C correctly identifies the policy order as relevant to the scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.