Technical Tip: 'Failed Connection Attempts' or 'IP-Conn' warning logs

[Serxhio]

Description	This article describes the meaning of specific events seen on the logs.
Scope	FortiGate, Log.
Solution	Normally 'Failed Connection Attempts' or 'IP-Conn' events occurs in the following cases.  Wrong DNS Queries - When the DNS query returns an unknown host, the 'action' in the log will be 'dns'. Host not reachable - Upon trying to reach an IP address that does not respond, the 'action' in the log will be 'ip-conn'. Abnormal termination - If a TCP connection was reset or timed out without FIN, the 'status' in the log will be 'timeout'. HTTP Error - if the HTTP response is > 400 (except 401/407), the 'status' in the log will be 'close'.