Description
This article indicates that if running into an issue that IP is denied in an allowed policy, follow this article.
If doing a sniffer check, the traffic comes but there is no forward/exit.
If doing flow debug, notice 'Denied by endpoint check' as mentioned in this article Troubleshooting Tip: Flow filter log message 'Denied by endpoint check'
Let’s consider FortiGate policy is configured to allow the traffic from one interface to another.
Incoming traffic matches all the conditions of the policy.
In the logs, action is showing as 'Deny: policy violation' and Communication from source to destination is getting failed.
This article describes how fix this status.
Scope
FortiGate.
Solution
One of the reasons for this log is source IP is added as 'BAN IP' or quarantined in FortiGate and hence source IP needs to be whitelisted to allow the traffic.
This could be a result of DoS policy.
Go to Monitor -> Quarantine Monitor, select source IP and delete the entry.
Related Article:
Troubleshooting Tip: Flow filter log message 'Denied by endpoint check'
