Consensus for Firewall Policy Logging

Question

hi,we have FG-xx "F" in our environmentmy question is, since these FG have internal HDD1. is it "safe" to enable log "all sessions"?2. haven't seen much FG docs regarding syslog, is logging buffer "circular" in a FG, i.e. overwritten by newer logs?3. is there a default threshold or buffer size in the HDD by these "F" models? is there also a "preferred" FW policy sequence based on its specific purpose/criteria? this is to prevent an overlap or "shadow" FW policy. refer sample below1. DNAT using VIP2. SNAT using IP pool3. SNAT using Egress interface

dingjerry_FTNT · Accepted Answer

Hi @johnlloyd_13 ,

1. is it "safe" to enable log "all sessions"?

A: It depends on what your FGT model is. If it is low-end model, such as, FGT 81F, and you have a lot of traffic passing through the FGT, no, enabling "Log all sessions" is not recommended.

2. haven't seen much FG docs regarding syslog, is logging buffer "circular" in a FG, i.e. overwritten by newer logs?

A: I am not sure about the logging buffer for syslog. If there is such buffer stuff, I am pretty sure that the default behavior will be Overwrite.

3. is there a default threshold or buffer size in the HDD by these "F" models?

A: Please check this KB:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-set-the-maximum-age-for-logs-on-disk/ta-p/193116#:~:text=FortiGate.&text=By%20default%2C%20the%20maximum%20age,on%20disk%20is%207%20days.

The default settings for disk logging:

## config log disk setting

# get
status : enable
ips-archive : enable
max-policy-packet-capture-size: 100
log-quota : 0
dlp-archive-quota : 0
report-quota : 0
maximum-log-age : 7
upload : disable
full-first-warning-threshold: 75
full-second-warning-threshold: 90
full-final-warning-threshold: 95
max-log-file-size : 20
roll-schedule : daily
roll-time : 00:00
diskfull : overwrite

ezhupa · Answer

Hello,

Depending on the FGT that you have and resources available you should be able to enable logging on the device. That being said, if the device is a low end device, it is recommended to log only security events (if security profiles are enabled on the policy) and when trying to troubleshoot specific issues enable logging to all sessions so to have a better understanding of the issue.
The max amount of time logs can be kept on the FGT if they are not overwritten is 7 days if not mistaken.

Policy checks on the FGT are done from TOP to BOTTOM, meaning first rule gets checked and so forth. If it matches a specific rule, other rules behind it are not checked anymore.

Hope this helps!

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded