Technical Tip: UDP-based sessions exhibit a discrepancy of 3 minutes between the timestamps in the forward traffic logs and the security event logs

Description

This article describes why a 3-minute timestamp discrepancy between the Forward Traffic and Security Event logs is expected for UDP-based sessions that are blocked by a UTM profile.

Scope

FortiGate.

Solution

The default idle timer for a UDP session in FortiGate is 180 seconds (3 minutes), and it is a configurable parameter in the global settings:

config system global
    set udp-idle-timer 180
end

When a session is blocked by a DNS filter, the following traffic is logged in the DNS query security events. This log is created right away when the security violation is detected.

Note: To observe the event below, security event logging should be enabled in the firewall policy at the very least.

However, in the forward traffic logs, the timestamp of the blocked session will appear approximately 3 minutes after the DNS query event, as shown below.

This is expected behavior because FortiGate generates forward traffic logs by default after a session is closed. To log traffic when the session starts, see Technical Tip: How to enable the session to start logging to the FortiGate firewall.

Once the DNS filter blocks a UDP session, the session remains in the session table for 180 seconds (3 minutes). When the session expires or closes, the firewall generates the corresponding forward traffic log.