Limitations of Connection Logging

You cannot log:

• The outer session of a plaintext, passthrough tunnel whose encapsulated connections are inspected by access control.

• TCP connections if the three-way handshake is not completed, to avoid denial-of-service attacks against your firewalls. To monitor or debug failed connections, you can use the packet capture feature (Packet Capture Overview).