Skip to main content
MORAMADAN
MORAMADAN
Explorer III
December 9, 2024
Question

cant find access log for non succesful connection

  • December 9, 2024
  • 5 replies
  • 3905 views

Hello Team,

                In my network with fortigate firewall with fortios 7.2.7 I am having an issue that I cant find a resolution when inverstigating my firewall logs.

all access logs are stored no problems with action accept/deny, when that is according to a policy role.

But when ever I try to connect to server to a non opened port then we supposed to rejected by the server but the log still logged with the action accept or Deny when is not happening.

how to find these logs that was not successful "from my destination" but allowed from the side of the firewall it self.

knowing that I am running  my firewall in policy-based mode.

And, when checking the logs, what does policy Name "Default" means that I see in the logs received alot?

 

TIA.

5 replies

sjoshi
Staff
sjoshi
Staff
December 9, 2024

Hi,

 

You can simply create a deny rule for those not allowed ports on the FGT then it comes under policy violation rule else on the allowed rule only allow required services and by default for not allowed ports it will match the implicit rule and logs will be captured.

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.
    slovepreet
    Staff
    slovepreet
    Staff
    December 9, 2024

    Hi Ramadan, 

     

    Usually, there is an option to save all logs or the security Events in the firewall policy. So if you keep the configuration to the default, which is only security events, then it will only save those events, but if you like to see all the traffic, make sure to change that to ALL.

    Ref- https://community.fortinet.com/t5/FortiGate/Technical-Tip-Difference-between-Security-Events-and-All-session/ta-p/206881

     

    I hope this helps. 

    Regards

      MORAMADAN
      MORAMADANAuthor
      Explorer III
      December 9, 2024

      Applied to save all logs, not just security logs

      AEK
      SuperUser
      AEK
      SuperUser
      December 9, 2024

      Hi Ramadan

      Your firewall will log the traffic even if your server rejects the connection request. That's the normal behavior, because the firewall sees the request and sees the connection closure, so it just logs what it sees.

      AEK
        MORAMADAN
        MORAMADANAuthor
        Explorer III
        December 9, 2024

        When I connect to opened port the firewall log well, but when i connect to closed port on the server but allowed through the firewall, it doesnt log !!!

        pminarik
        Staff
        pminarik
        Staff
        December 9, 2024

        I wanted to point you to https://community.fortinet.com/t5/FortiGate/Technical-Tip-ip-conn-traffic-action-in-logs/ta-p/198452, expecting action=ip-conn, but when I tested this with 7.2.10, I observed the following instead:

        (A TCP session that is allowed by a firewall policy, but no response from destination side)

        flow-mode: action=timeout

        proxy-mode (with active UTM): action=close

         

        Additional clear markers for flow mode are 0 bytes received and 0 packets received. Proxy-mode session isn't as easy to identify as the packet counts include the proxied TCP handshake, so there is a non-zero number of packets sent/received.

          MORAMADAN
          MORAMADANAuthor
          Explorer III
          December 9, 2024

          Thank you so much @pminarik for the link, useful one.

          But :( :( in my case and using wireshark i could see the syn packet from my client and received the rst ack from the server' closed port.

          pminarik
          Staff
          pminarik
          Staff
          December 10, 2024

          If a SYN-ACK is received, then from the reciever's perspective the server's port is actually open.

          Is that true from the server's perspective as well? The only way to find out is to make a packet capture on the server at the same time as well.

          If the results differ, that means someone on the path is proxying the TCP connection. (presumably some firewall or proxy in-between)

          If you can't make a capture on the server, you can try taking a capture somewhere else as close to the server as possible to get an "approximate result", but seeing what the server does itself is the best option.

           

          If you are curious specifically about whether the FortiGate is doing this proxying, do a packet capture over all interfaces and analyze the flow and order of packets.

           

          > diag sniffer packet any "host <server-ip> and port <server-port>" 4 0 a

           

          (note: for this to work clearly, the server's destination IP and port must remain unchanged as it passes over the FortiGate, i.e. no VIP/DNAT applied to it)

            MORAMADAN
            MORAMADANAuthor
            Explorer III
            December 15, 2024

            I cant find this Event Log or VPN Log under Log & Report > Forward Traffic or System Events to to ensure the log level. Fortios 7.2.7

            Terms & ConditionsAccessibility statement