FAZ 5.2 - Source Country always blank?

Forum|Forum|9 years ago
March 10, 2017
6 replies
7339 views

I've been configuring our FAZ device on 5.2 and I can't get the source country to show up. Traffic log shows flags on destination IP, detects destination country, but doesn't do it for source IP or source country. This happens whether I import logs backed up from our FAZ 4.3 or a device reports directly to the FAZ 5.2. Our FAZ 4.3 shows source country fine from the same device reporting to it. To be clear, I configured a single device with 2 FAZ destinations (via CLI). FAZ 4.3 shows source country. FAZ 5.2 does not. I can't seem to find a config setting that would affect this on the FAZ. Help?

5.2

SSC_SebAuthor

New Member

I doubt anyone cares but this looks like a firmware bug in 5.2 when receiving logs from 4.3. The 4.3 field dst_country gets remapped properly by FAZ 5.2 as dstcountry, but src_country does not get mapped to srccountry. The log parser for 4.3 logs likely needs to be patched to remap src_country to srccountry.

I'm hoping this will get looked at by engineering and fixed but let's just say my hopes are very dim.

emnoc

New Member

Dumb question but does your FGT ( assuming this is what we are talking about ) has the geoip database

e.g

diagnose firewall ipgeo country-list

Does it report back any srccountry?

SSC_SebAuthor

New Member

FortiGate devices report the source country fine, logs making it to our old unit (operating in parallel right now) have source country set, raw logs on new FortiAnalyzer device shows src_country makes it but field isn't renamed/remapped to srccountry.

I'm 99.9% sure it's a bug in the 4.3 log parser used on FAZ 5.2. It remaps the other fields fine (like dst_country to dstcountry, and status to action), it just skips over src_country and doesn't use it.

Sign up

Login with SSO

Login to the community

Login with SSO