Troubleshooting Tip: FortiGate did not reply with TCP RST when 'set send-deny-packet' is enabled

[mle2802]

Description	This article describes how to troubleshoot the issue when FortiGate did not reply with TCP RST packets when 'set send-deny-packet' is enabled.
Scope	FortiGate.
Solution	On firewall policy, the command 'set send-deny-packet' is enabled. This option will generate a TCP RSP packet when traffic matches a deny policy instead of silently dropping the packet. Checking packet capture, no TCP RST is being sent back from FortiGate, and the connection time out after some time. This issue happens due to the command 'set deny-tcp-with-icmp' being enabled under 'config system settings'.  Disable that option and try to re-connect. This time. TCP RST package is sent and the connection is refused instead of time out. Related articles: Technical Tip: Block-notification replacement message with 'Deny' policy  Packet Capture on FortiOS GUI - Fortinet Community