Stackvora.tech

Enable and Read FortiGate Traffic Logs

Effective network traffic logging is foundational for security auditing, troubleshooting connectivity issues, and ensuring compliance. FortiGate firewalls…

Effective network traffic logging is foundational for security auditing, troubleshooting connectivity issues, and ensuring compliance. FortiGate firewalls offer robust logging capabilities, but proper configuration and interpretation are crucial. This article details how to enable, configure, and analyze traffic logs directly on FortiGate devices, covering both GUI and CLI methods, log storage considerations, and practical filtering techniques.

Enabling Traffic Logging on Policies

Traffic logs are generated per policy. By default, new policies often have logging enabled for security events, but not always for all traffic. To ensure comprehensive logging, you must explicitly enable it on each relevant firewall policy.

GUI Method (FortiOS 7.x)

  1. Navigate to Policy & Objects > Firewall Policy.
  2. Select the policy you wish to modify and click Edit.
  3. Scroll down to the Logging Options section.
  4. For Log Traffic, select All Sessions. The default is often "Security Events" which will only log sessions that trigger an IPS signature, antivirus, or web filter block. "All Sessions" captures both allowed and denied traffic.
  5. For Log Violation Traffic, select Log violation traffic. This is crucial for detecting attempts to bypass policies.
  6. Click OK to save the policy.

CLI Method (FortiOS 7.x)

For bulk changes or scripting, the CLI is more efficient. The key command is set logtraffic all within the policy configuration.

config firewall policy
    edit 123  <-- Replace 123 with your policy ID
        set logtraffic all
        set logviolaton enable <-- This option is available from FortiOS 6.2+
        set status enable
    next
    edit 124
        set logtraffic all
        set logviolaton enable
        set status enable
    next
end

It's important to note that set logtraffic all applies to both allowed and denied traffic by that specific policy. If you have a deny policy (e.g., an explicit deny-all at the bottom), ensure it also has logtraffic all enabled to capture attempts to reach prohibited destinations.

Understanding Log Storage and Retention

FortiGate devices have limited local storage for logs. The amount varies significantly by model:

  • Entry-level (e.g., FortiGate 40F, 60F): Typically 16 GB to 32 GB eMMC storage. This fills rapidly, often within hours or days, depending on traffic volume.
  • Mid-range (e.g., FortiGate 100F, 200F): May include 240 GB to 480 GB SSDs. Can retain logs for weeks.
  • High-end (e.g., FortiGate 1800F, 2600F): Often have multiple terabytes of SSD storage, capable of storing logs for months.

When local storage is full, the FortiGate typically overwrites the oldest logs. For any serious logging retention requirements (e.g., compliance, incident response), offloading logs is mandatory.

Recommended Log Offloading Destinations

  • FortiAnalyzer: The preferred solution for FortiGate. Offers centralized logging, comprehensive reporting, advanced analytics, and long-term storage with data compression. Supports FortiGate's proprietary log format for richer detail.
  • Syslog Server: A standard, open protocol. Can send logs to any compatible syslog server (e.g., Splunk, ELK stack, Rsyslog, Nxlog). Syslog typically sends logs in plain text or a structured format (e.g., CEF, JSON). Some FortiGate log fields might be truncated or less detailed compared to FortiAnalyzer's native format.
  • FortiCloud (Cloud Logging): For smaller deployments or organizations that prefer a cloud-managed logging solution. Offers similar features to FortiAnalyzer but in a hosted environment.

Configuring Log Settings (FortiOS 7.x)

Navigate to Log & Report > Log Settings.

  • GUI:
    • Local Log: Enable/Disable local disk logging. Set 'Disk logging' to 'All events'. Adjust 'Max Log Age' (FortiOS 7.2+) if available.
    • Send Logs to FortiAnalyzer/FortiManager: Enable, specify IP address, and select desired upload options (Realtime, Every minute, etc.).
    • Send Logs to Syslog: Enable, specify IP address, port (default TCP/UDP 514), and select a log format (e.g., CEF, CSV, JSON).
    • Send Logs to FortiCloud: Enable and authenticate with your FortiCloud account.
  • CLI:
config log disk setting
    set status enable
    set level information
end

config log fortianalyzer setting
    set status enable
    set server "192.168.1.100"
    set upload-option realtime
    set enc-algorithm high
    set reliable enable
    set port 514
end

config log syslogd setting
    edit 1
        set status enable
        set server "192.168.1.200"
        set mode udp
        set port 514
        set format cef <-- Options: default, csv, cef, json
        set facility local7
        set level information
    next
end

The set level information setting determines the verbosity of logs sent to each destination. "Information" is generally a good balance for traffic logs.

Reading and Filtering Traffic Logs

Traffic logs can be accessed and filtered directly from the FortiGate GUI or CLI.

GUI Method (FortiOS 7.x)

Navigate to Log & Report > Forward Traffic.

The log viewer displays recent traffic logs. The real power comes from the filter bar and column customization.

  • Filter Bar Examples:
    • srcip=10.1.1.5: Show all traffic originating from IP 10.1.1.5.
    • dstport=443: Show all traffic destined for port 443 (HTTPS).
    • action=deny: Show all traffic that was explicitly denied by a policy or security profile.
    • policyid=123: Filter by a specific firewall policy ID.
    • srcip=10.1.1.5 and dstport=80 or dstport=443: Combine conditions using and, or, and parentheses for complex queries.
    • duration>600: Show sessions lasting longer than 600 seconds (10 minutes).
    • service=SSH: Filter by well-known services.
    • logid=0000000006: Show all firewall traffic logs (general traffic log ID).
  • Time Range: Use the calendar icon to select predefined ranges (Last 1 hour, Today, Yesterday) or a custom range.
  • Column Customization: Click the gear icon to add or remove columns to display relevant information like policyid, sentbyte, rcvdbyte, duration, etc.

CLI Method (FortiOS 7.x)

The CLI log viewer provides powerful real-time and historical log analysis, especially useful for troubleshooting without GUI access.

execute log display filter
    set logid 0000000006 <-- Traffic log ID (Firewall - Traffic)
    set field msg <-- Target field for keyword search
    set value "timeout" <-- Keyword to search within 'msg' field
    set field srcip
    set value 10.1.1.5
    set field action
    set value deny
execute log display <-- Displays logs matching filters
execute log display <-- Clears current filters and shows all logs
execute log display filter <-- To see current filters
execute log display clear <-- Clears filters
execute log display <-- After clear, will display all local logs

For real-time log monitoring, the diagnose debug commands are invaluable:

diagnose debug reset
diagnose debug application urlfilter -1 <-- Example: Debug web filter
diagnose debug console timestamp enable
diagnose debug enable
diagnose debug flow filter saddr 10.1.1.5 <-- Filter debug flow by source IP
diagnose debug flow show function-name enable
diagnose debug flow trace start 100 <-- Capture 100 packets for debug flow
diagnose debug enable

diagnose debug flow trace start is particularly powerful for understanding how packets are processed (ingress interface, policy matching, NAT, security profiles, egress interface). This is distinct from traffic logs but often used in conjunction for deep dives.

Interpreting Key Log Fields

Understanding the common fields in FortiGate traffic logs is essential:

  • date, time: Timestamp of the log entry.
  • logid: Unique ID for the log type (e.g., 0000000006 for forward traffic).
  • type: Category of the log (e.g., traffic, event, utm).
  • subtype: Specific sub-category (e.g., forward for traffic).
  • policyid: The ID of the firewall policy that matched the traffic. Critical for verifying policy enforcement.
  • policyname: The name of the policy.
  • srcip, dstip: Source and destination IP addresses.
  • srcport, dstport: Source and destination TCP/UDP ports.
  • service: Application-level service (e.g., HTTP, HTTPS, DNS, SSH).
  • action: What the FortiGate did with the traffic (e.g., accept, deny, close, blocked, ip-block).
  • proto: IP protocol number (e.g., 6 for TCP, 17 for UDP, 1 for ICMP).
  • duration: Session duration in seconds.
  • sentbyte, rcvdbyte: Bytes sent and received during the session.
  • utmaction: Action taken by UTM profiles (e.g., blocked by web filter, detected by AV).
  • status: Session status (e.g., close for gracefully terminated, timeout for idle session closure).

Common Pitfalls

  • Local Disk Overflow: Relying solely on local storage for logs, especially on lower-end models, will lead to rapid log rotation and loss of historical data. Always plan for offloading to FortiAnalyzer or syslog.
  • "Security Events" Only Logging: Many administrators forget to change Log Traffic from "Security Events" to "All Sessions" on their policies, resulting in a lack of visibility for allowed traffic or simple denied connections not triggering UTM.
  • Ignoring Deny Policy Logs: If you have explicit deny policies, ensure they also log traffic (set logtraffic all). This is vital for detecting unauthorized access attempts.
  • Incorrect Timezones: Mismatched timezones between the FortiGate and logging destination (FortiAnalyzer/syslog) can make log correlation extremely difficult. Ensure all devices synchronize with NTP.
  • Over-filtering Logs: While filtering is essential, sometimes starting with a broad view and progressively narrowing down can reveal patterns missed by overly specific initial filters.
  • Lack of Policy Naming Conventions: Policies named "Policy_1", "Policy_2" make log analysis via policyid much harder. Use descriptive names like "LAN_to_WAN_HTTPS" or "DMZ_Web_Server_Access".

Back to the knowledge base · Ask the AI assistant