Technical Tip: How to understand the UTM block logs under forward traffic

[rsondal]

Description	This article describes UTM block logs under forward traffic.
Scope	FortiGate.
Solution	Check SSL application block logs under Log & Report -> Forward Traffic. Forward Traffic will show all the logs for all sessions. The procedure to understand the UTM block under Forward Traffic is always to look to see UTM logs for same Time Stamp. Check how many UTM profiles have been applied on the specific policy by which traffic is getting block.  Example: One by one check these UTM logs under log & report -> Security Events (Then select UTM profile one by one). Check UTM logs for the same Time stamps and Session ID as shown in the below example.  First example: Forward Traffic Log: UTM Log: Second example: Forward Traffic Log: UTM Log: In both the examples above, it shows that it is getting blocked by the Web filter profile as the URL belongs to the  denied category.