Technical Tip: Understanding Action='Close', 'Reset', and 'Timeout' in FortiGate Forward Traffic Logs

1. Action=Close:

The session ended normally. This typically happens when the client or server sends a TCP FIN to close the connection.

For example, the user browses to a website, the page loads fully, client closes the session.

Log Example:

date=2025-08-18 src=10.21.4.3 dst=172.217.163.110 service=HTTPS action=close

2. Action= Reset:

The session was terminated using a TCP RST (reset) packet. The source of the TCP RST packet may originate from:

• Client application (browser closed tab, plugin crash).
• Server (rejecting malformed request).
• FortiGate (if security profile blocks traffic or policy denies mid-session).

Key point: Not always a block: resets often originate from the endpoint, not the firewall.

Log example:

date=2025-08-18 src=10.21.4.3 dst=10.200.150.19 service=HTTPS action=reset

3. Action= Timeout: The session remained idle or unresponsive longer than FortiGate's session timeout threshold.

    

4. Action= Pending: FortiOS is still processing the traffic against the policy, which means it was not allowed or denied yet.

 Possible Causes:

1. No FIN or RST received before the idle timer expired.
2. Session expired in Half-Open (no SYN/ACK received) or Half-Closed state (no FIN/ACK received).
3. Application froze or client disconnected unexpectedly.
4. Default session timeout values:
   • TCP: 3600 seconds (1 hour).
   • TCP half-close timer: 120 seconds.
   • TCP half-open timer: 10 seconds.
   • UDP: 60 seconds (configurable).
   • :Timeout values location (in order of precedence):

config system session-ttl.

    set session-ttl <----- For a custom services object defined under 'config firewall service custom'.

    set session-ttl <----- When defined in a firewall policy under 'config firewall policy'.

Log example:

date=2025-08-18 src=10.21.4.3 dst=192.168.1.20 service=HTTPS action=timeout

• Use the following command to verify whether RST comes from the client or the server:

diagnose sniffer packet any "host <ip>" 4 0 l

• Check debug flow:

• Close, reset, and timeout in Forward Traffic logs do not necessarily mean a firewall block.
• They indicate how the session ended: normal closure, reset, or timeout.
• For security enforcement decisions, always cross-check UTM/Security logs (Web Filter, IPS, AV).