Symptoms:
The following behavior may be observed: Traffic matches the expected firewall policy. The firewall policy action is configured as Accept. The policy has 'set disclaimer enable'. Traffic destined for TCP port 1433 is logged with Threat ID 131072. The log may show a threat score of 30 and threat level High. The traffic may appear to be denied or may not establish successfully even though the firewall policy itself is configured to allow the traffic. For example, a traffic log may contain fields similar to:
action="deny"
dstport=1433
proto=6
score=30
craction=131072
crlevel="high"
The exact log fields can vary depending on the FortiOS version and logging configuration.
Cause:
Threat ID 131072 is not an indication of a security threat detected by IPS or another UTM security profile. It is associated with the FortiGate threat-weight mechanism for a blocked connection. Fortinet documentation identifies '131072' as the value associated with the 'blocked-connection' threat-weight category.
When per-policy disclaimer is enabled, the firewall policy can require the user/session to pass through the disclaimer or authentication flow before the traffic is permitted to continue. FortiOS supports per-policy disclaimers that can display a warning or customized message to the user.
For non-HTTP/HTTPS traffic such as TCP/1433, a browser-based disclaimer cannot be presented in the same manner as it can for web traffic. As a result, the session can remain subject to the disclaimer requirement and packets can be logged as blocked/violation traffic until the required disclaimer state is satisfied.
Therefore, the presence of Threat ID 131072 in this scenario does not necessarily mean that the firewall policy is incorrectly configured or that TCP/1433 has been identified as malicious.
Example configuration:
A firewall policy may contain a configuration similar to:
config firewall policy
edit <policy-id>
set action accept
set service "MSSQL"
set disclaimer enable
set logtraffic all
next
end
Where the 'MSSQL' service allows TCP/1433.
Verification:
Verify the firewall policy.
show firewall policy <policy-id>
set action accept
set disclaimer enable
Also, verify that TCP/1433 is included in the allowed service.
Check the traffic log.
Review the corresponding traffic log and verify:
Source IP. Destination IP. Destination port: 1433. Policy ID. Action. Threat ID. Threat score. Threat level.
If the log shows:
craction=131072
And if the traffic is associated with a policy that has disclaimer enabled, investigate the disclaimer state before concluding that the firewall policy is denying the traffic.
Verify threat-weight configuration.
Check:
show full-configuration log threat-weight
Pay particular attention to:
config log threat-weight
set blocked-connection high
end
When blocked-connection is configured as high, a blocked connection can receive a threat score of 30, with Threat ID 131072 representing the corresponding threat-weight category.
Resolution:
If TCP/1433 traffic is expected to pass without requiring a disclaimer, verify whether the disclaimer is required on the policy handling this traffic.
As a troubleshooting step, temporarily disable the disclaimer on the affected policy:
config firewall policy
edit <policy-id>
set disclaimer disable
next
end
Retest the TCP/1433 connection.
If the traffic succeeds after disabling the disclaimer, this confirms that the disclaimer/authentication requirement is related to the observed behavior.
If the disclaimer is required for web traffic but should not apply to non-web applications such as SQL Server, consider using separate firewall policies so that the disclaimer-enabled policy applies only to the intended traffic.
For example:
Web traffic: Policy with disclaimer enabled. SQL Server/TCP 1433: Separate policy without disclaimer, subject to the organization's security requirements.
Important notes:
Threat ID 131072 does not by itself indicate that TCP/1433 is malicious. The value is associated with the FortiGate blocked-connection threat-weight mechanism. A firewall policy showing Accept does not necessarily mean that every packet in the session will be forwarded if an additional authentication/disclaimer requirement has not been satisfied. Per-policy disclaimers are intended primarily for user-facing warning/authentication workflows. FortiOS documentation describes the feature as a mechanism for displaying customized warning/disclaimer messages associated with firewall policies.
Summary:
When Threat ID 131072 is observed for TCP/1433 traffic that matches an Accept firewall policy with Disclaimer enabled, verify the disclaimer/authentication state before troubleshooting the policy as a conventional firewall deny.
The expected behavior is that the disclaimer requirement can prevent the session from progressing until the required user/session state has been satisfied. The resulting blocked traffic can be recorded with Threat ID 131072 because the FortiGate threat-weight mechanism categorizes the blocked connection accordingly.
| 
