Skip to main content
LarW63
LarW63
New Member
September 12, 2017
Question

Intermittent Policy Deny with Destination Interface Unknown

  • September 12, 2017
  • 1 reply
  • 5689 views

Hi,

We have several Fortigates, all running v5.4.5, that are showing the following problem.

 

In the Traffic log we see intermittent Policy Violations with Deny as the Firewall Action. The Destination Interface is listed as Unknown-0 and the Message is "no session matched".

 

Yet, in this same log, there are entries with the exact same Source / Destination IPs and Service as above but show Accepted with the proper destination interface.

 

The traffic happens to be firewall management https traffic to the loopback.0 interface, if that makes a difference.

 

Does anyone have an idea what's going on here?

 

Thanks for your time.

Larry

 

1 reply

emnoc
emnoc
New Member
September 12, 2017

provide a snippet of the log message.

 

(Qs)

With destination not being know is that learned thru a dynamic routing protocol?

Did you have flapping  or instability in the network going on?

 

Ken

 

LarW63
LarW63Author
New Member
September 12, 2017

Hi,

 

Attached is a log snippet from LogView in Fortimanager.

 

The loopback IP is indeed advertised through OSPF, however no state changes or flapping occurred.  These Policy Violations occur fairly regularly in the log, in between Accepts.

 

Thanks,

Larry 

 

 

Terms & ConditionsAccessibility statement