New Member

Question

Alert for specific Policy ID

Forum|Forum|4 years ago
June 12, 2022
6 replies
3865 views

Hi,

I trying to set alert for only specific policy violation.

I tried to enable

set violation-traffic-logs [enable|disable]

but I receiving a lot of other alerts.

my request can be done?

thanks for the help

Daniel

FortiGate

seshuganesh

Staff

Hi Team,

If you want to view logs for specific firewall policy, click on that policy and enable logging for that policy in the end of that policy.

If you want to view implicit deny firewall policy logs, you can use this article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implicit-deny-logs/ta-p/194602

Please check and keep us posted

its-chainAuthor

New Member

Hi,

thanks for your respone.

I know how to enable logs.

My goal is to set a policy for blocking malicious IP's and receive a notification only for this policy.

A

Anonymous_User

Contributor III

Hi there,

Based on my understanding, you have multiple Policy and would like to enable logging for specific policy only.

Example:
Policy 1-3 : Enable logging
Policy 4-5 : No logging

On policy 4-5, edit each of this policy and turn off "Log Allowed Traffic".

On policy 1-3, enable the "Log Allowed Traffic".

Hope that helps.

its-chainAuthor

New Member

Hi,

thanks for your response.

I know how to enable logs.

My goal is to set a policy for blocking malicious IPs and receive a notification only for this policy.

A

Anonymous_User

Contributor III

Hi its-chain,
I think i understand your requirements now.
If the IP is blocked by IPS, you can send email alert. If you are blocking using policy IPv4, this cannot be done.

Here is the reference: https://docs.fortinet.com/document/fortigate/6.2.7/cookbook/526019/email-alerts

Hope that helps.

pminarik

Staff

As far as I can see, it isn't possible to do what you're looking for with FortiGate alone.

Alertmail configuration is too vague (on/off for "violation traffic"), and automation stitches do not allow triggering events based on forward traffic logs (checked 7.0.5 & 6.4.9, not sure about 7.2).

However, if you have a FortiAnalyzer, you should be able to put something together with its Event Handler. If you're looking for some documentation for that, you can start here .

Sign up

Login with SSO

Login to the community

Login with SSO