Technical Tip: How to enable logging of IP reputation logs for Blocklist IPs

Description

This article explains how to enable logging of IP reputation logs for Blocklist IPs.

Scope

FortiADC.

Solution

FortiADC shows the logs for IP reputation Blocklist under Security logs -> Log & Report -> Security Log -> IP Reputation.
These logs are not enabled by default.

To enable these logs, navigate to Network Security -> IP Reputation -> Blocklist and select 'Edit'.

CLI commands:

config load-balance reputation
    edit 6
        set category "Block List"
        set action deny
        set log enable
    next
end

Under Blocklist, toggle the button for log to enable and also set the Severity to Low, Medium, or High. The action can be set as Deny, Pass, Redirect, or Send 403 Forbidden.

The logs can be seen under Security Logs:

Related document:

Managing IP Reputation policy settings