https://community.checkpoint.com/t5/Firewall-and-Security-Management/Action-Accept-Reason-Connection-terminated/m-p/190308#M35116 <P>Hello everybody,</P><P>The question is very simple and it was asked many times and answered many times, but no answer was really satisfying.<BR />My question is entirely seen on the picture: I have simple explicit access rule (not application rule) that allows access to certain node by very simple and common protocol. And I see in the LOG records saying <STRONG>Action: "Accept"</STRONG> and below the <STRONG>Reason:"Connection terminated before detection: insufficient data passed"</STRONG></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Accept terminated.png" style="width: 969px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/22188i20A76A83E92B7C9A/image-size/large?v=v2&amp;px=999" role="button" title="Accept terminated.png" alt="Accept terminated.png" /></span></P><P>What can I conclude (if I do not see any other records from this source):<BR />- the session was accepted or terminated finally?<BR />- if it was finally accepted and continue, I do not want to see "Connection terminated"<BR />- if it was finally terminated, I do not want to see "Accept" here.&nbsp; What difference for me that action was not "Deny" or "Drop" but "Terminated" if result is same?<BR />- If it was terminated finally - it was terminated <STRONG>by who?? by Checkpoint Gw or by the Source or by the Destination? It's critical to understand!<BR /><BR /></STRONG>If the connection was terminated before detection <STRONG>by source or destination node</STRONG> - please write this in the reason field.<BR />If the connection was terminated by Gw - please, You should understand that ''Insufficient data passed" just not reasonable to terminate session that explicitly defined as allowed</P><P>&nbsp;</P> Wed, 23 Aug 2023 14:11:23 GMT evlad 2023-08-23T14:11:23Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Action-Accept-Reason-Connection-terminated/m-p/190308#M35116 <P>Hello everybody,</P><P>The question is very simple and it was asked many times and answered many times, but no answer was really satisfying.<BR />My question is entirely seen on the picture: I have simple explicit access rule (not application rule) that allows access to certain node by very simple and common protocol. And I see in the LOG records saying <STRONG>Action: "Accept"</STRONG> and below the <STRONG>Reason:"Connection terminated before detection: insufficient data passed"</STRONG></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Accept terminated.png" style="width: 969px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/22188i20A76A83E92B7C9A/image-size/large?v=v2&amp;px=999" role="button" title="Accept terminated.png" alt="Accept terminated.png" /></span></P><P>What can I conclude (if I do not see any other records from this source):<BR />- the session was accepted or terminated finally?<BR />- if it was finally accepted and continue, I do not want to see "Connection terminated"<BR />- if it was finally terminated, I do not want to see "Accept" here.&nbsp; What difference for me that action was not "Deny" or "Drop" but "Terminated" if result is same?<BR />- If it was terminated finally - it was terminated <STRONG>by who?? by Checkpoint Gw or by the Source or by the Destination? It's critical to understand!<BR /><BR /></STRONG>If the connection was terminated before detection <STRONG>by source or destination node</STRONG> - please write this in the reason field.<BR />If the connection was terminated by Gw - please, You should understand that ''Insufficient data passed" just not reasonable to terminate session that explicitly defined as allowed</P><P>&nbsp;</P> Wed, 23 Aug 2023 14:11:23 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Action-Accept-Reason-Connection-terminated/m-p/190308#M35116 evlad 2023-08-23T14:11:23Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Action-Accept-Reason-Connection-terminated/m-p/190312#M35117 <P>The connection was terminated by either the client or the server participating in it. FW action is Accept. The message is referring that data passing through the connection was not sufficient to determine an actual application.&nbsp;</P> Wed, 23 Aug 2023 14:09:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Action-Accept-Reason-Connection-terminated/m-p/190312#M35117 _Val_ 2023-08-23T14:09:24Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Action-Accept-Reason-Connection-terminated/m-p/190314#M35118 <P>Thank You so much! If it so, Your answer make the issue very clear.<BR />I just want to mention that could be the brilliant improvement from CheckPoint to add at the reason:<BR /><STRONG>"</STRONG>Connection terminated<STRONG> by souce/destination</STRONG>/... before detection<STRONG>"</STRONG><BR /><BR /></P> Wed, 23 Aug 2023 14:25:25 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Action-Accept-Reason-Connection-terminated/m-p/190314#M35118 evlad 2023-08-23T14:25:25Z