Technical Tip: How to create packet capture on the policy level

Description

This article describes how to create packet capture at the policy level.

Scope

FortiGate.

Solution

This guide shows how to create an automated packet capture.

It is possible to enable packet capture on the firewall policy using the below command:

If not already disabled, this will turn off auto ASIC offloading and display a notification. When packet capture is disabled, auto ASIC offloading is automatically re-enabled.

When a firewall policy with packet capture enabled is matched, FortiGate automatically begins capturing packets.

To download it, select the logs, then select details.

Select Archived Data, then select the download button.

This can be helpful when capturing traffic that cannot be generated on demand.

Note:
This article does not apply to FortiProxy appliances. FortiProxy does not support policy.capture-packet. The GUI will remove this setting in the upcoming release.