Where does the “Sequence Group” live in the FortiGate CLI Config

By Manny Fernandez

July 28, 2026

Where does the “Sequence Group” live in the FortiGate CLI Config

Do you use Sequence Groups In your Firewall Policies? I absolutely love them. I used to use them in Checkpoint. In Checkpoint, they are called Sections.

On the FortiGate, they are called Sequence Group.

If you do not use them today, they are very useful. If you have 5 policies, maybe not so much, but when you have hundreds or thousands of policies, filtering out ONLY what section you want to work with, this is the way to go.

If you right click on the Policy where you want to add the Sequence Group and choose Insert sequence grouping.

Sequence grouping in FortiOS is driven under the hood by an invisible CLI parameter on individual firewall policies.

Where to find and manage sequence groupings depends on whether you are looking in the GUI, the CLI, or a Config Backup:

1. In the CLI (Active Session)

Under config firewall policy, the group header is defined by the global-label setting:

config firewall policy
edit <policy-id>
set global-label "Your-Group-Name"
next
end

The “Gotcha” with CLI Visibility:

It is a hidden command: The global-label parameter will not autocomplete when pressing TAB.
It does not show in standard outputs: Running show firewall policy or show full firewall policy will ommit global-label.

How to see it in CLI: You can verify its existence by explicitly checking the policy or filtering for it:

config firewall policy
edit <policy-id>
get | grep global-label

2. In a Configuration Backup File

If you download a full configuration backup (.cfg) from the GUI or via FTP/TFTP, global-label will be explicitly rendered in plain text inside the policy block:

config firewall policy
edit 10
set name "Allow-Branch-Traffic"
set global-label "Branch Rules"
set srcintf "port1"
set dstintf "port2"
next
end

3. In the GUI

To see sequence groups visually in the FortiOS Web UI:

1. Go to Policy & Objects > Firewall Policy.
2. In the top-right corner, change the view mode from Interface Pair View to By Sequence (or Sequence Grouping View).
3. Firewall policies will display collapsible headers named after the configured global-label.

Note: A sequence group starts at the policy where global-label is set, and it applies to all subsequent policies until another policy sets a new global-label or ends the block.

Where does the “Sequence Group” live in the FortiGate CLI Config

1. In the CLI (Active Session)

The “Gotcha” with CLI Visibility:

2. In a Configuration Backup File

3. In the GUI

Recent posts