Technical Tip: FortiProxy - Packets pass though via a Transparent Policy with the action 'DENY' and 'set log-http-transaction enable'

The feature called 'Log HTTP Transaction' is used to log HTTP transactions.

When this feature is enabled in the Transparent Policy where the action 'DENY', the policy lets packets pass through until it sees 'HTTP Transactions'.

CLI Configurations:

config firewall policy
    edit 45
        set name "DENY_cmtinfo.co"
        set srcintf "port2"
        set dstintf "port1"
        set srcaddr "all"
        set dstaddr "cmtinfo.co.kr_183.111.182.241" "http://www.cmtinfo.co.kr"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set logtraffic-start enable
        set log-http-transaction enable
        set extended-log enable
        set ssl-ssh-profile "no-inspection"
    next

Forward Traffic Log:

This has been identified as a bug and will be fixed in the upcoming v7.0.21, v7.2.14, v7.4.9, and v7.6.3.

Workaround:

Disable 'Log HTTP Transaction' in the policy with the action 'DENY'.

config firewall policy
    edit 45
        set name "DENY_cmtinfo.co"
        set srcintf "port2"
        set dstintf "port1"
        set srcaddr "all"
        set dstaddr "cmtinfo.co.kr_183.111.182.241" "http://www.cmtinfo.co.kr"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set logtraffic-start enable
        set log-http-transaction disable
        set extended-log enable
        set ssl-ssh-profile "no-inspection"
    next

Related article:

Troubleshooting Tip: No logs are appearing in HTTP Transaction Log