Hello @Sanjay_Ramaiah
in a Firewall a session is defined by two unidirectional flows each uniquely identified by a 6 tuple key: source IP address, destination IP address, source port, destination port, protocol, and source zone. If traffic has match for policy and the action of the policy is set to deny, then there is no further inspection and traffic is blocked with the log recorded as action: "deny" session end reason: "policy-deny".
In the case, the policy action is set to allow, then there is further L7 inspection where traffic can be eventually dropped based on further inspection. Here is the KB with more details. If you want to deep dive into exact reason for traffic being blocked click on magnifying glass icon on left hand side.
Kind Regards
Pavel
... View more