Technical Tip: Logs regarding port 9980 and local traffic

Description

This article explains why to observe local traffic logs to port 9980 from source and destination 127.0.0.1.

Scope

FortiOs.

Solution

The following logs are observed in local traffic logs.

TCP port 9980 is used for local traffic related to security fabric features and handles some internal rest API queries. These logs are normal, and it will not cause any issue.

To disable such logging of local traffic:

# config log setting
    set local-out disable
end

The address 127.0.0.1 will always be pointing to localhost, simply means the traffic will not go anywhere but looping inside the FortiGate itself.