“match-vip enable” inside Firewall Policies

By Manny Fernandez

September 7, 2026

“match-vip enable” inside Firewall Policies

The Problem This Solves

FortiGate matches policies referencing a VIP (a Virtual IP, i.e. destination NAT) with higher precedence than policies that don’t, regardless of where they sit in the policy list. That means a deny policy placed above an accept policy that references a VIP often does not block traffic destined for that VIP the way an administrator would expect. The VIP-referencing policy still wins.

There are two settings that let you control this behavior, but which one you configure, and what it actually does, depends entirely on whether Central NAT is enabled on the VDOM. They’re easy to confuse since they look almost identical in the CLI and both live under config firewall policy, but they are not interchangeable.

match-vip (Central NAT Disabled)

This is the setting most people learn first, since policy-based NAT (Central NAT disabled) has been the default mode for most of FortiOS’s history.

What it does: tells a policy to also match traffic that has already been DNAT’d by a VIP, even though the policy’s own dstaddr doesn’t reference that VIP object. This is what lets a deny policy sitting above a VIP-referencing accept policy actually catch traffic headed for that VIP.

Action requirement: match-vip is only configurable when the policy’s action is deny. It cannot be enabled on an accept policy. This restriction has been in place since FortiOS 6.4.3.

Default behavior: as of FortiOS 7.2.4 and later, newly created deny policies get match-vip enabled automatically. Because this matches the field’s default value, it will not appear in a plain show, only in show full-configuration. Don’t mistake its absence from a normal config dump for it being disabled.

config firewall policy
    edit 10
        set name "deny-blacklist"
        set srcintf "wan1"
        set dstintf "lan1"
        set srcaddr "MYBLACKLIST_GROUP"
        set dstaddr "all"
        set action deny
        set schedule "always"
        set service "ALL"
        set match-vip enable
    next
end

match-vip-only (Central NAT Enabled)

This is a different setting with a different job, introduced for Central NAT mode.

What it does: in Central NAT mode, the DNAT translation is injected at the kernel level before a firewall policy lookup even happens. A policy no longer needs to reference the VIP object as its destination at all, it can just use the real internal address. match-vip-only controls whether that policy should match only traffic that has already been through DNAT (traffic that arrived addressed to the external, VIP address) or match regardless of whether DNAT occurred.

Action requirement: none. match-vip-only is available on both accept and deny policies, since the problem it solves isn’t precedence, it’s traffic scoping. It has nothing to do with the deny-above-accept precedence issue that match-vip addresses.

config firewall policy
    edit 5
        set name "web-server-external-only"
        set srcintf "wan1"
        set dstintf "lan1"
        set srcaddr "all"
        set dstaddr "192.168.1.60"
        set action accept
        set schedule "always"
        set service "HTTP"
        set match-vip-only enable
    next
end

Side by Side

Setting	Appears When	Action Req.	What It Controls	Default
`match-vip`	Central NAT disabled	Deny only	Lets a non-VIP-referencing deny policy still match VIP-translated traffic, fixing the precedence bug	Enabled by default on new deny policies since 7.2.4
`match-vip-only`	Central NAT enabled	Any action	Restricts a policy to matching only traffic that has already been DNAT’d	Disabled

When to Use Which

Policy-based NAT (Central NAT disabled): you have a blacklist or geo-block deny policy sitting above an accept policy that references a VIP. Without match-vip enable on that deny policy, the VIP policy keeps winning no matter where the deny policy sits in the list. Enable match-vip on the deny policy to fix it.

Central NAT enabled: you want a single policy to apply only to traffic that arrived via a specific DNAT mapping, external IP traffic, not traffic addressed directly to the internal IP from somewhere that can already route to it. Enable match-vip-only to scope the policy that way.

Quick Check: Which Mode Are You In?

Central NAT is a per-VDOM setting under config system settings:

config system settings
    show
end

Look for set central-nat enable in the output. To toggle it:

config system settings
    set central-nat enable
end

If you don’t see match-vip as an option when editing a deny policy, check central-nat status before you assume something is broken, it likely just means you’re in Central NAT mode and should be looking for match-vip-only instead.

The Gotcha

Two things trip people up in the field:

1. Because match-vip matches its own default value on new deny policies since 7.2.4, it’s invisible in a normal show. If you’re auditing configs, use show full-configuration or you’ll miss policies that already have it set.

2. Toggling Central NAT on or off does not migrate this setting between the two fields. Existing policies keep whatever precedence behavior they had. Re-verify VIP-priority behavior on your policy set any time Central NAT status changes.

“match-vip enable” inside Firewall Policies

The Problem This Solves

match-vip (Central NAT Disabled)

match-vip-only (Central NAT Enabled)

Side by Side

When to Use Which

Quick Check: Which Mode Are You In?

The Gotcha

Recent posts