Troubleshooting traffic still allowed after removing an FQDN from a firewall policy

1. Confirm that the FQDN is no longer referenced where access was previously permitted. Check the FortiGate FQDN IP mapping and search the configuration, replacing <fqdn> with the actual name:

diagnose firewall fqdn list-ip | grep -A3 <fqdn>

show | grep -f <fqdn>

2. Resolve the FQDN to the destination IP used by the test connection. Determine whether the configured address is a standard FQDN or wildcard FQDN, because wildcard FQDN handling differs from an exact FQDN object.

3. Reproduce the connection from Server A, then filter the session table to identify the matching session. Replace the placeholders with the source IP, resolved destination IP, destination port, and protocol number:

diag sys session filter src XXXXX.XXXXX.XXXX.XXXX

diag sys session filter dst XXXXX.XXXXX.XXXX.XXXX

If the destination port is known, add this filter; otherwise, skip it:

diag sys session filter dport XXX

Set the protocol filter, using 6 for TCP or 17 for UDP:

diag sys session filter proto zzzz

List the matching sessions:

diag sys session list

4. Review the session output to determine which firewall policy allowed the flow. The same information can also be inspected in FortiView by reviewing the session data.

5. Check the traffic logs for the matching source, destination, port, and protocol. Confirm the policy ID recorded for the accepted traffic. The connection may be matching a different firewall policy rather than the policy from which the FQDN was removed.

6. Use the policy finder tool in the Policy Table to determine which firewall policy the traffic follows.

7. If additional packet-level confirmation is required, run a FortiGate CLI sniffer trace or packet capture while reproducing the connection. Use the FortiOS 6.4.2 Administration Guide procedure for a sniffer trace and packet capture or the Fortinet packet-capture technical tip referenced in the source material.

8. Review the identified policy and any existing valid session. Adjust the policy configuration so that only the required FQDN destinations are allowed.

9. For simpler ongoing administration, place all permitted FQDN address objects in one address group and reference that group from the intended firewall policy. Add or remove FQDN members as requirements change.

10. For wildcard FQDN configurations, validate the design against the Fortinet wildcard FQDN guidance and the FortiOS 7.4.1 Administration Guide section titled Using wildcard FQDN addresses in firewall policies.

Initiate a new connection from Server A to the previously removed FQDN. Check the traffic log, FortiView session data, session-table output, or policy finder result. Verify that the flow no longer matches an unintended allow policy and is blocked unless the destination is included in the permitted FQDN address group. For an allowed FQDN, verify that the expected firewall policy ID accepts the session.