03-20-2023 05:09 AM
Hi All,
I need some information on checking the logs. I see few things like END, DENY, SPYWARE, INFORMATION etc and in the action we see it as allowed. But the access will not be working. May i know what this Log Subtype means and what information will it give us in troubleshooting? When it says ALLOW as action then why in Subtype it is Deny. How to troubleshoot these issues?
Regards,
Sanjay S
03-20-2023 04:29 PM
Hello @Sanjay_Ramaiah
in a Firewall a session is defined by two unidirectional flows each uniquely identified by a 6 tuple key: source IP address, destination IP address, source port, destination port, protocol, and source zone. If traffic has match for policy and the action of the policy is set to deny, then there is no further inspection and traffic is blocked with the log recorded as action: "deny" session end reason: "policy-deny".
In the case, the policy action is set to allow, then there is further L7 inspection where traffic can be eventually dropped based on further inspection. Here is the KB with more details. If you want to deep dive into exact reason for traffic being blocked click on magnifying glass icon on left hand side.
Kind Regards
Pavel
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
