Technical Tip: Logging traffic violation on VIP

Description

This article describes how to log traffic violation on a Virtual IP.

Scope

All FortiGate units.

Solution

To log unauthorized traffic, see Technical Tip: configuring a Firewall Policy with action = DENY to log unauthorized traffic, also called 'Violation Traffic'.

To log traffic violation on the Virtual IP (VIP), use a clean-up deny rule in the end of the firewall policy list, with the destination address as the VIP. When using 'all' instead of a VIP, no log will be shown.

The following is an example CLI configuration.

config firewall vip     edit "MY_VIP"         set extip 192.168.1.1         set extintf "external"         set mappedip 10.0.0.1    next end

config firewall policy     edit 1         set srcintf "external"         set dstintf "internal"         set srcaddr "all"         set dstaddr "My_VIP"         set schedule "always"         set service "ANY"         set logtraffic enable     next end

Related article:

Technical Tip: configuring a Firewall Policy with action = DENY to log unauthorized traffic, also called 'Violation Traffic'