P-2302HW/HWL-P1 Series User’s Guide

Table 113 TCP Reset Logs (continued)

LOG MESSAGE

DESCRIPTION

 

 

Firewall session time

The router sent a TCP reset packet when a dynamic firewall

out, sent TCP RST

session timed out.

 

The default timeout values are as follows:

 

ICMP idle timeout: 3 minutes

 

UDP idle timeout: 3 minutes

 

TCP connection (three way handshaking) timeout: 270 seconds

 

TCP FIN-wait timeout: 2 MSL (Maximum Segment Lifetime set in

 

the TCP header).

 

TCP idle (established) timeout (s): 150 minutes

 

TCP reset timeout: 10 seconds

 

 

Exceed MAX incomplete,

The router sent a TCP reset packet when the number of

sent TCP RST

incomplete connections (TCP and UDP) exceeded the user-

 

configured threshold. (Incomplete count is for all TCP and UDP

 

connections through the firewall.)Note: When the number of

 

incomplete connections (TCP + UDP) > “Maximum Incomplete

 

High”, the router sends TCP RST packets for TCP connections

 

and destroys TOS (firewall dynamic sessions) until incomplete

 

connections < “Maximum Incomplete Low”.

Access block, sent TCP

The router sends a TCP RST packet and generates this log if you

RST

turn on the firewall TCP reset mechanism (via CI command: sys

 

firewall tcprst).

Table 114 Packet Filter Logs

LOG MESSAGE

DESCRIPTION

 

 

[ TCP UDP ICMP IGMP

Attempted access matched a configured filter rule (denoted by

Generic

] packet filter

its set and rule number) and was blocked or forwarded

matched

(set: %d, rule: %d)

according to the rule.

For type and code details, see Table 121 on page 261.

Table 115 ICMP Logs

LOG MESSAGE

DESCRIPTION

 

 

Firewall default policy: ICMP

ICMP access matched the default policy and was blocked

<Packet Direction>, <type:%d>,

or forwarded according to the user's setting.

<code:%d>

 

Firewall rule [NOT] match: ICMP

ICMP access matched (or didn’t match) a firewall rule

<Packet Direction>, <rule:%d>,

(denoted by its number) and was blocked or forwarded

<type:%d>, <code:%d>

according to the rule.

Triangle route packet forwarded:

The firewall allowed a triangle route session to pass

ICMP

through.

Packet without a NAT table entry

The router blocked a packet that didn’t have a

blocked: ICMP

corresponding NAT table entry.

258

Chapter 21 Logs