allow—session permitted by policy

deny—session permitted by policy

reset both—session terminated and a TCP reset is sent to both the sides of the connection

reset client—session was terminated and a TCP reset is sent to the client

reset server—session terminated and a TCP reset is sent to the server.

threat—The firewall detected a threat associated with a reset, drop, or block (IP address) action.

policy-deny—The session matched a security rule with a deny or drop action.

decrypt-cert-validation—The session terminated because you configured the firewall to block when the session uses client authentication or when the session uses a server certificate with any of the following conditions: expired, untrusted issuer, unknown status, or status verification timeout. This session end reason also displays when the server certificate produces a fatal error alert of type bad_certificate, unsupported_certificate, certificate_revoked, access_denied, or no_certificate_RESERVED (SSLv3 only).

decrypt-unsupport-param—The session terminated because you configured the firewall to block SSL Forward Proxy decryption or SSL Inbound Inspection when the session uses an unsupported protocol version, cipher, or SSH algorithm. This session end reason is displayed when the session produces a fatal error alert of type unsupported_extension, unexpected_message, or handshake_failure.

decrypt-error—The session terminated because you configured the firewall to block SSL Forward Proxy decryption or SSL Inbound Inspection when firewall resources were unavailable. This session end reason is also displayed when you configured the firewall to block SSL traffic that has SSL errors or that produced any fatal error alert other than those listed for the decrypt-cert-validation and decrypt-unsupport-param end reasons.

tcp-rst-from-client—The client sent a TCP reset to the server.

tcp-rst-from-server—The server sent a TCP reset to the client.

resources-unavailable—The session dropped because of a system resource limitation. For example, the session could have exceeded the number of out-of-order packets allowed per flow or the global out-of-order packet queue.

tcp-fin—Both hosts in the connection sent a TCP FIN message to close the session.

tcp-reuse—A session is reused and the firewall closes the previous session.

decoder—The decoder detects a new connection within the protocol (such as HTTP-Proxy) and ends the previous connection.

aged-out—The session aged out.

n/a—This value applies when the Traffic log type isn’t end.