When configuring firewall policies which of the following is true regarding the policy ID?

A firewall policy ID is a unique integer that serves as the primary identifier for a policy object within the FortiGate configuration. Once a policy is created, either automatically by the GUI or manually in the CLI, this ID is permanently assigned and cannot be altered. While other attributes of the policy can be modified, the ID itself is immutable. To "change" a policy ID, one would need to delete the existing policy and create a new one with the desired ID, assuming it is available.

A. It is mandatory to provide a policy ID while creating a firewall policy regardless of GUI or CLI.

This is incorrect. When using the GUI, the FortiGate automatically assigns the next available ID. In the CLI, using the command edit 0 instructs the system to create a new policy and assign an ID automatically.

B. A firewall policy ID identifies the order of policy execution in firewall policies.

This is incorrect. Policy execution is determined by the sequence or position of the policy in the list, evaluated from top to bottom. The policy ID is only a unique identifier and has no bearing on the execution order.

C. You can create a policy in CLI with policy ID 0.

This is incorrect. In the CLI, the command edit 0 is a special instruction used to create a new policy entry. The FortiGate then assigns the new policy the next available non-zero ID. A policy cannot have a permanent ID of 0.

1. Fortinet FortiOS 7.6.0 Administration Guide

"Firewall policies > Sequence" section: "FortiGate tests traffic against policies in the order that they appear in the policy list

starting with the policy at the top of the list." This confirms that sequence

not ID

determines execution order

invalidating option B.

2. Fortinet FortiOS 7.6.0 CLI Reference

config firewall policy command section: The documentation specifies that to create a new entry

one should use edit 0. This demonstrates that an ID is not mandatory (invalidating option A) and that 0 is a command for creation

not a final ID (invalidating option C).

3. Fortinet FortiOS 7.6.0 CLI Reference

config firewall policy command section: Within the available set commands for an existing policy

there is no command such as set policyid or set id. This confirms the immutability of the policy ID once created

supporting option D.