Action field values

The following table shows the most common log occurrences for the Action field.

Table 1. Action field values
Action Description
Allow A connection was allowed through the engine. This can be:
  • A new connection.
  • Related connection (for example, an FTP data connection).
  • Related packet (for example ICMP error messages related to an earlier TCP connection).
  • New connection through an existing VPN tunnel.
Discard A connection or packet was discarded by the engine.
Permit A connection was allowed through according to the Inspection Rules on the engine.
Refuse A connection was refused by the engine.
Terminate A connection was terminated by the engine.
Terminate (failed) An attempt to terminate a connection failed.
Terminate (passive) A connection matched a rule with the passive Terminate action, and a log entry indicating that the connection would have been terminated was produced.
Terminate (reset) A connection was terminated by the engine and TCP resets were sent to both communicating hosts.
Wait for Authentication A connection was waiting for successful user authentication before it could continue.
Wait for Further Actions A connection was waiting for some other action before it could continue.
Wait for RPC Reply A connection was waiting for an RPC reply before it could continue.