Log Subtype

Sanjay_Ramaiah — Mon, 20 Mar 2023 12:09:15 GMT

Hi All,

I need some information on checking the logs. I see few things like END, DENY, SPYWARE, INFORMATION etc and in the action we see it as allowed. But the access will not be working. May i know what this Log Subtype means and what information will it give us in troubleshooting? When it says ALLOW as action then why in Subtype it is Deny. How to troubleshoot these issues?

Regards,

Sanjay S

Re: Log Subtype

PavelK — Mon, 20 Mar 2023 23:29:49 GMT

Hello @Sanjay_Ramaiah

in a Firewall a session is defined by two unidirectional flows each uniquely identified by a 6 tuple key: source IP address, destination IP address, source port, destination port, protocol, and source zone. If traffic has match for policy and the action of the policy is set to deny, then there is no further inspection and traffic is blocked with the log recorded as action: "deny" session end reason: "policy-deny".

In the case, the policy action is set to allow, then there is further L7 inspection where traffic can be eventually dropped based on further inspection. Here is the KB with more details. If you want to deep dive into exact reason for traffic being blocked click on magnifying glass icon on left hand side.

Kind Regards

Pavel

topic Re: Log Subtype in Next-Generation Firewall Discussions

Log Subtype

Re: Log Subtype