Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
user2345312
New Contributor

I don't understand the actions for the type log: LOG_ID_TRAFFIC_END_FORWARD

According to documentation provide for Fortigate exist multiple actions as:

 

The status of the session: deny - Session was denied
accept - Allowed Forward session

start - Session starts (log message was created when the session was created)

dns - DNS query return error

ip-conn - Failed connection attempts
close - Local-traffic session allowed

timeout - Allowed session was timeout

client-rst - Session reset by client
server-rst - Session reset by server

 

I receive a lot of connections with the action "close" and I have a number of doubts:

 

If an incoming traffic has had the action "close", is it a successful connection or has nothing to do with it?

 

That same incoming connection must have a "Firewall Permit" event before or it is not necessary?

 

 

3 REPLIES 3
Jackstorm
New Contributor II

Action "Accept: session close" in traffic log means the firewall received the client fin ack and server ack.


Lucas
Lucas
btan
Staff
Staff

You may refer to below KB to know more about "session close":
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Log-action-messages-Accept-session-close-a...


It is usually just informative and you may ignore if there is no noticeable network impact.

Regards,
Bon
pavankr5
Staff
Staff

Hello @user2345312 ,

 

In logs, you need to consider the entire log entry and the events leading up to the "close" action to determine the nature of the session. Look for additional information, such as source IP, destination IP, and the log sequence to understand the context of the session.

To assess the success or failure of a connection and whether it was permitted by the firewall, you should look for other relevant log entries that provide more details. The "close" action itself doesn't provide sufficient information to make that determination
also check this document for your reference on LOG_ID_TRAFFIC_END_FORWARD


https://docs.fortinet.com/document/fortigate/7.4.1/fortios-log-message-reference/13/13-log-id-traffi...

 

Thanks,

Pavan

Labels
Top Kudoed Authors