topic Re: "Connection terminated before detection" in log reason for Unified Rulebase in Firewall and Security Management

"Connection terminated before detection" in log reason for Unified Rulebase

Arturxr — Fri, 21 Oct 2022 11:51:42 GMT

we see in the accept logs the message Connection terminated before detection and at the same time it is visible in the reject logs to the same source, destination, port. However, we tried to telnet to the resource and port, which is supposedly dropped and we get access. It turns out that access is open and the connection is not reset, but we need to close it. What can we do about it?

Re: "Connection terminated before detection" in log reason for Unified Rulebase

_Val_ — Fri, 21 Oct 2022 11:57:42 GMT

Please refer to sk113479 for the answer. Let me know if you need any further assistance.

Re: "Connection terminated before detection" in log reason for Unified Rulebase

Chris_Atkinson — Fri, 21 Oct 2022 12:00:56 GMT

Read and understand sk113479 then reorder / restructure your rules accordingly to match and drop the traffic if that is your objective.

Re: "Connection terminated before detection" in log reason for Unified Rulebase

PhoneBoy — Fri, 21 Oct 2022 18:11:11 GMT

What precise rule is allowing the traffic in question?
If it is not a simple TCP service, some packets must pass to properly classify the traffic before a final determination is made.
See also: https://phoneboy.org/2016/12/14/which-comes-first-the-ports-or-the-application-id/