I don't understand the actions for the type log: LOG_ID_TRAFFIC_END_FORWARD

[user2345312]

According to documentation provide for Fortigate exist multiple actions as:

The status of the session: deny - Session was denied
accept - Allowed Forward session

start - Session starts (log message was created when the session was created)

dns - DNS query return error

ip-conn - Failed connection attempts
close - Local-traffic session allowed

timeout - Allowed session was timeout

client-rst - Session reset by client
server-rst - Session reset by server

I receive a lot of connections with the action "close" and I have a number of doubts:

If an incoming traffic has had the action "close", is it a successful connection or has nothing to do with it?

That same incoming connection must have a "Firewall Permit" event before or it is not necessary?

[Jackstorm]

Action "Accept: session close" in traffic log means the firewall received the client fin ack and server ack.

[btan]

You may refer to below KB to know more about "session close":
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Log-action-messages-Accept-session-close-a...

It is usually just informative and you may ignore if there is no noticeable network impact.

[pavankr5]

Hello @user2345312 ,

In logs, you need to consider the entire log entry and the events leading up to the "close" action to determine the nature of the session. Look for additional information, such as source IP, destination IP, and the log sequence to understand the context of the session.

To assess the success or failure of a connection and whether it was permitted by the firewall, you should look for other relevant log entries that provide more details. The "close" action itself doesn't provide sufficient information to make that determination
also check this document for your reference on LOG_ID_TRAFFIC_END_FORWARD

https://docs.fortinet.com/document/fortigate/7.4.1/fortios-log-message-reference/13/13-log-id-traffi...

Thanks,

Pavan