FortiExpert logoFortiExpert
Sign in
← Back to knowledge base
lowFirewall Policies & NAT

Troubleshooting firewall policy statistics not updating in the GUI

Confirmed 7/30/2026

Problem

A newly created firewall policy processes traffic and generates the expected logs, but its statistics remain empty or do not increase in the FortiGate GUI. The policy may include security profiles such as Web filtering or Application control and may have been moved to the top of the policy list to take precedence during policy lookup.

Symptoms

Traffic logs show that connections match the new firewall policy, and traffic continues to pass normally. However, the GUI displays no values for the policy statistics. The behavior may differ between existing sessions and newly established sessions.

Environment

FortiGate, including multi-VDOM deployments; IPv4 and IPv6 firewall policies.

FortiOS version

FortiOS v7.4 or v7.6 branch

Root Cause

Existing sessions are not evaluated again when a firewall policy is added or reordered. Those sessions can remain pinned to the policy that originally accepted them. If CLI counters increase while the GUI remains unchanged, the problem is limited to the GUI statistics display and does not affect traffic processing. An issue affecting new-policy statistics was investigated and fixed by the development team in the latest FortiOS v7.4 and v7.6 branches.

Solution

  1. Confirm in the traffic logs that the traffic is matching the expected policy and that the policy configuration is correct.

  2. For an IPv4 policy, inspect its policy counters by running:

diagnose firewall iprope show 100004 <policy_ID>
  1. For an IPv6 policy, inspect its policy counters by running:
diagnose firewall iprope6 show 100004 <policy_ID>
  1. In a multi-VDOM environment, enter the VDOM containing the policy before running the applicable counter command:
config vdom
       edit <name>
  1. Check which policy ID owns the live sessions. Compare this result with the policy counters to determine whether existing sessions are still pinned to an earlier policy:
diagnose sys session list | grep policy_id

  1. Determine whether the behavior affects only newly created policies or also occurs on older policies.

  2. Compare existing sessions that previously matched another rule with newly established sessions. Because policy creation and reordering do not trigger session re-evaluation, validate with a new session or clear the affected test session before generating traffic again.

  3. If the issue occurs only with new policies and newly created sessions are not impacted, upgrade to the latest release in the FortiOS v7.4 or v7.6 branch, where the development team fixed the investigated issue.

Verification

Generate traffic through a newly established session, then confirm that the expected policy appears in the logs and that its counters increase with the applicable diagnose firewall iprope command. Use diagnose sys session list | grep policy_id to verify the policy ID assigned to the live session. If CLI counters increase but GUI values remain unchanged, traffic processing is working and only the GUI statistics display is affected.

Tags

No tags yet.

Community rating

— / 5 (0)

Discussion (0)

    No comments yet.