How to Fix FortiPortal Traffic Dropped by Policy 0 (Implicit Deny)
Seeing policyid=0 action="deny" in your FortiPortal or FortiAnalyzer traffic logs? Here is why it happens, how to decipher the exact dropped connection, and how to safely commit a targeted FortiOS fix.
PortalPilot translates cryptic logs and routing tables into plain English in 1 second and generates copy-ready FortiOS CLI change tickets with instant rollbacks.
🔍 Raw Telemetry & What It Means
date=2026-09-07 time=13:19:05 devname="GATEWAY-01" srcip=10.17.210.94 dstip=10.10.10.2 srcintf="port2" dstintf="port1" policyid=0 proto=6 service="HTTPS" action="deny"
An internal client (10.17.210.94) requested HTTPS access on server 10.10.10.2. The packet traversed ingress port2 heading toward port1.
No active firewall rule permitted this flow before reaching rule 0. FortiOS enforced its default drop action, cutting off communication.
⚡ Actionable Solution & Command Specs
Paste this validated FortiOS syntax directly into your management terminal or ITIL change ticket:
config firewall policy
edit 0
set name "PERMIT-INTERNAL-HTTPS-MGMT"
set srcintf "port2"
set dstintf "port1"
set srcaddr "CORP-WORKSTATIONS"
set dstaddr "CORP-MGMT-SERVERS"
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
set comments "Created via PortalPilot from policyid=0 drop telemetry"
next
end❓ Frequently Asked Questions
What does policyid=0 mean in FortiPortal and FortiGate traffic logs?
In Fortinet FortiOS and FortiPortal, Policy ID 0 represents the built-in Implicit Deny rule located at the absolute bottom of the firewall policy list. When connection attempts do not match any earlier permit rule, FortiOS drops the packet and logs action=deny under policyid=0.
Why is legitimate internal traffic being dropped by Policy 0?
Legitimate traffic gets dropped by Policy 0 when: 1) A new server or subnet was deployed without a corresponding firewall policy, 2) The service port changed (e.g., app moved from port 80 to 8443), or 3) Source/Destination interfaces are misassigned in FortiPortal multi-tenant VLAN mapping.
How does PortalPilot help resolve Policy 0 drop logs?
PortalPilot runs directly inside your FortiPortal session. When you click or paste a drop log, PortalPilot translates the raw parameters into plain English, explains the exact failure reason, and generates a syntax-validated FortiOS CLI change block and paired rollback plan ready to paste into your MSP change ticket.
Understand FortiPortal Telemetry in 10 Seconds
PortalPilot installs in 1 click into Google Chrome, Microsoft Edge, and Brave. 100% on-device zero-trust execution.