What is the difference between implicit deny and explicit deny in FortiGate policy evaluation?

What is the difference between implicit deny and explicit deny in FortiGate policy evaluation?

• A. Implicit deny occurs when a defined rule blocks traffic.
• B. Explicit deny is implicit.
• C. Explicit deny is a clearly defined denial rule; implicit deny occurs when no policy matches, typically resulting in dropped traffic unless a permissive default exists.
• D. Deny rules never drop traffic.

Answer: (C)

In FortiGate policy evaluation, traffic is checked against a list of firewall policies, and the first policy that matches dictates the action taken. An explicit deny is a clearly defined rule that blocks traffic when its specific criteria (such as source, destination, and service) are met. This is a deliberate, rule-based denial applied to matching traffic. Implicit deny, on the other hand, isn’t a single rule. It’s the default outcome when no policy matches the traffic at all—the packet is dropped unless you have a permissive default in place (for example, a catch-all allow policy). This distinction matters because explicit deny gives you a targeted block, while implicit deny is the automatic fallback for unmatched traffic. So the best description is that an explicit deny is a clearly defined denial rule; implicit deny occurs when no policy matches, typically resulting in dropped traffic unless a permissive default exists.

In FortiGate policy evaluation, traffic is checked against a list of firewall policies, and the first policy that matches dictates the action taken. An explicit deny is a clearly defined rule that blocks traffic when its specific criteria (such as source, destination, and service) are met. This is a deliberate, rule-based denial applied to matching traffic.

Implicit deny, on the other hand, isn’t a single rule. It’s the default outcome when no policy matches the traffic at all—the packet is dropped unless you have a permissive default in place (for example, a catch-all allow policy). This distinction matters because explicit deny gives you a targeted block, while implicit deny is the automatic fallback for unmatched traffic.

So the best description is that an explicit deny is a clearly defined denial rule; implicit deny occurs when no policy matches, typically resulting in dropped traffic unless a permissive default exists.