Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Calvin777
New Contributor II

Traffic implicitly denied. Why?

Hi all!

Maybe a simple question, but I don't see it: Why is the traffic to Cloudflare-Web implicitly denied while the traffic to Xbox is allowed? 

 

image.png

 

Both connections use port 443...

Policy 44:

 

config firewall policy
edit 44
set srcintf "Name1"
set dstintf "wan1"
set action accept
set srcaddr "Name1 address"
set dstaddr "all"
set schedule "always"
set service "HTTPS" "HTTP"
set utm-status enable
set ssl-ssh-profile "deep-inspection"
set av-profile "default"
set webfilter-profile "block some & monitor-all"
set dnsfilter-profile "default"
set ips-sensor "high_security"
set application-list "block-high-risk"
set logtraffic all
set nat enable
next
end

 

 

I guess, that it has something to do with the item "Action" and "Security" below:

 

image.png

 

What engine performs this deny? Why is the security log empty?

 

Thanks for your help!

 

Oliver

 

1 Solution
smaruvala
Staff
Staff

Hi, 

 

- In the policy you are allowing "HTTP" and "HTTPS" services. But the traffic logs shows the denied traffic is using protocol UDP as protocol number shown as 17. Hence it does not match the Policy. That's why it could be getting denied by the Policy

- I suspect the communication is using QUIC protocol as the communication is over UDP port 443.

 

Regards,

Shiva

 

View solution in original post

3 REPLIES 3
Calvin777
New Contributor II

Well, I just found this article:

 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Threat-131072-is-seen-in-logs-when-t...

 

thus the info about threat id and threat level is meaningless. But why is the https traffic not accepted?

smaruvala
Staff
Staff

Hi, 

 

- In the policy you are allowing "HTTP" and "HTTPS" services. But the traffic logs shows the denied traffic is using protocol UDP as protocol number shown as 17. Hence it does not match the Policy. That's why it could be getting denied by the Policy

- I suspect the communication is using QUIC protocol as the communication is over UDP port 443.

 

Regards,

Shiva

 

Calvin777
New Contributor II

Thanks! I didn‘t see that, maybe it was too late yesterday ;)

Top Kudoed Authors