unknown icmp log

[dennislo]

I found one of my vdom have many traffic log with the service 3/3/icmp allowed. I only permitted DNS traffic in my policy and icmp should be blocked. Also, I did not enable " log allowed traffic" , so it makes me don' t understand why I would got such traffic log on my fortigate. Can anyone tell us what are those log and why it appears on the traffic log? Below is the one of the raw log as I said: log_id=5 type=traffic subtype=other pri=notice vd=*** status=" accept" dir_disp=" org" tran_disp=" noop" src=" 10.***.***.***" srcname=" 10.***.***.***" src_port=0 dst=" 10.***.***.***" dstname=" 10.***.***.***" dst_country=" Reserved" dst_port=771 tran_ip=" N/A" tran_port=0 tran_sip=" N/A" tran_sport=0 service=" 3/3/icmp" proto=1 app_type=" N/A" duration=0 rule=18 policyid=18 identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 shaper_sent_name=" n/a" shaper_rcvd_name=" n/a" perip_name=" n/a" sent_pkt=0 rcvd_pkt=0 vpn=" n/a" vpn_type=" n/a" vpn_tunnel=" n/a" src_int=" WC-Trust" dst_int=" WC-UnTrust" SN=********** app=" N/A" app_cat=" N/A" user=" n/a" group=" n/a" carrier_ep=" N/A" profilegroup=" N/A"

[ede_pfau]

This is a ' destination network unreachable' ICMP message, type=3, code=3, that is, ' port unreachable' . The host on WC-Trust subnet tried to contact a host on ' WC-UnTrust' on port 771 which was not open for listening. See RFC 792 for details on ICMP.

[dennislo]

Hi Ede, thank you for your explanation!

[LCT]

Do you have sflow enabled and is one of the ip' s the sflow receiver host? Edit: Forget what I asked. I had a similar situation, but with policy id " 0" . My log filled up with this type of log messages 3/3/icmp dst_port 771. But I also have this log messages with a host in a accept rule. It' s a monitoring host which ping devices, it' s strange, the devices are up and reply to the ping but my firewall log show them all the time.

[mdefosse]

Hi, I have the same problem. Have you find any solution to disable / resolve this ? Thanks

[dennislo]

hi mdefosse, As edu_pfau said, the 3/3/icmp log were caused by port unreachable messages. I found those messages are from my clients' DNS server, which their server settings was not completed, after they modified their DNS server settings, the 3/3/icmp log was gone.