Skip to main content
user2345312
user2345312
New Member
December 15, 2021
Question

I don't understand the actions for the type log: LOG_ID_TRAFFIC_END_FORWARD

  • December 15, 2021
  • 3 replies
  • 37355 views

According to documentation provide for Fortigate exist multiple actions as:

 

The status of the session: deny - Session was denied
accept - Allowed Forward session

start - Session starts (log message was created when the session was created)

dns - DNS query return error

ip-conn - Failed connection attempts
close - Local-traffic session allowed

timeout - Allowed session was timeout

client-rst - Session reset by client
server-rst - Session reset by server

 

I receive a lot of connections with the action "close" and I have a number of doubts:

 

If an incoming traffic has had the action "close", is it a successful connection or has nothing to do with it?

 

That same incoming connection must have a "Firewall Permit" event before or it is not necessary?

 

 

3 replies

Jackstorm
Jackstorm
Visitor III
December 20, 2021

Action "Accept: session close" in traffic log means the firewall received the client fin ack and server ack.

btan
Staff & Editor
btan
Staff & Editor
December 24, 2021

You may refer to below KB to know more about "session close":
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Log-action-messages-Accept-session-close-and/ta-p/194173?externalID=FD48671


It is usually just informative and you may ignore if there is no noticeable network impact.

    pavankr5
    Staff
    pavankr5
    Staff
    November 6, 2023

    Hello @user2345312 ,

     

    In logs, you need to consider the entire log entry and the events leading up to the "close" action to determine the nature of the session. Look for additional information, such as source IP, destination IP, and the log sequence to understand the context of the session.

    To assess the success or failure of a connection and whether it was permitted by the firewall, you should look for other relevant log entries that provide more details. The "close" action itself doesn't provide sufficient information to make that determination
    also check this document for your reference on LOG_ID_TRAFFIC_END_FORWARD


    https://docs.fortinet.com/document/fortigate/7.4.1/fortios-log-message-reference/13/13-log-id-traffic-end-forward

     

    Thanks,

    Pavan

      Terms & ConditionsAccessibility statement