Technical Tip: Configure syslog logging for managed FortiSwitch to send FortiSwitch logs to syslog server

Description

Solution

Below is a configuration example:

1. Create a custom command on FortiGate.

config switch-controller custom-command

(custom-command)edit syslog   <----- Where ‘syslog’ is a custom command profile name.

New entry 'syslog' added.

(syslog)set command "config log syslogd2 setting %0a set status enable %0a set server x.x.x.x %0a end %0a"                <----- Where x.x.x.x the IP address the syslog server IP address. 
(syslog)end

config switch-controller custom-command
(custom-command)edit syslog_filter

New entry 'syslog_filter' added.

(syslog_filter)set command "config log syslogd2 filter %0a set severity debug %0a end %0a"
(syslog_filter)end

2. Push the commands to all the switches (the serial number is the switch(s) serial number):

execute switch-controller custom-command syslog <serial# of FSW>
execute switch-controller custom-command syslog_filter <serial# of FSW>

config switch-controller managed-switch
    edit "S124EN591801029"
        config custom-command
            edit "1"
                set command-name " syslog"
            next
            edit "2"
                set command-name " syslog_filter"
            next

3. Create a policy from FortiGate CLI with the incoming interface as the FortiLink interface and the outgoing interface where the Syslog server is connected:

config firewall policy
    edit 1
        set srcintf <fortilink interface name>
        set dstintf <interface name where syslog server is located>
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "SYSLOG" "ALL_ICMP" "PING"
        set nat enable
    end

• Setting severity to debug means that it will send debug, information, notification, warning, error, critical, alert, and emergency messages.
  
  

• Note that the FortiLinkinterface (interface used to manage FSWs) is not visible in the GUI policy, source/destination interface; that is why creating the policy from CLI is necessary.
  
  
• Custom Commands for Managed FortiSwitch can be found in any managed FortiSwitch guide.
  

Example:
page 49: FortiSwitch Devices - Managed by FortiOS 6.0