Traffic implicitly denied. Why?

[Calvin777]

Hi all!

Maybe a simple question, but I don't see it: Why is the traffic to Cloudflare-Web implicitly denied while the traffic to Xbox is allowed? 

Both connections use port 443...

Policy 44:

config firewall policy
edit 44
set srcintf "Name1"
set dstintf "wan1"
set action accept
set srcaddr "Name1 address"
set dstaddr "all"
set schedule "always"
set service "HTTPS" "HTTP"
set utm-status enable
set ssl-ssh-profile "deep-inspection"
set av-profile "default"
set webfilter-profile "block some & monitor-all"
set dnsfilter-profile "default"
set ips-sensor "high_security"
set application-list "block-high-risk"
set logtraffic all
set nat enable
next
end

I guess, that it has something to do with the item "Action" and "Security" below:

What engine performs this deny? Why is the security log empty?

Thanks for your help!

Oliver

[Calvin777]

Well, I just found this article:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Threat-131072-is-seen-in-logs-when-t...

thus the info about threat id and threat level is meaningless. But why is the https traffic not accepted?

[smaruvala · Accepted solution]

Hi, 

- In the policy you are allowing "HTTP" and "HTTPS" services. But the traffic logs shows the denied traffic is using protocol UDP as protocol number shown as 17. Hence it does not match the Policy. That's why it could be getting denied by the Policy

- I suspect the communication is using QUIC protocol as the communication is over UDP port 443.

Regards,

Shiva

[Calvin777]

Thanks! I didn‘t see that, maybe it was too late yesterday ;)