Firewall policy matching: incoming/outgoing interface, source (address, user, ISDB), destination, service, schedule; top-down first match; implicit deny (policy 0)

Firewall policies are the heart of a FortiGate, and understanding exactly how a session is matched to a policy is the single most tested concept in the firewall domain. A policy is an ordered rule that says: for traffic entering on this interface and leaving on that interface, from these sources to these destinations, using these services during this schedule, take this action (accept or deny) and apply these settings.