Troubleshooting Tip: Missing logging of private access traffic to hubs despite successful connectivity

Description

This article describes the issue where traffic initiated through Private Access to Hubs is successful (for example, ICMP, HTTP), but the corresponding logs are not visible in the Analytics Traffic Logs. It also outlines possible causes and troubleshooting steps.

Scope

FortiSASE.

Solution

Some user-initiated traffic towards Private Access to the Hub is not being logged.
Traffic flow is functioning correctly, but the logs for this traffic do not appear in FortiSASE.

For example user belonging to level 2 groups logs are appearing.

But for users belonging to level 4 groups, logs are not appearing.

Go to the Private Access policy and check that Log Allowed Traffic is set to All sessions or Security Events.

For the Level 2 user group policy, 'Log Allowed Traffic' is set to 'All Sessions', which results in logs being visible for their traffic.

For the Level 4 user group, 'Log Allowed Traffic' is set to 'Security Events', which does not allow their traffic logs to be visible unless any security profile event is triggered.