Finding applicable Fortigate rules from hits in FortiAnalyzer logs - Help needed

Forum|Forum|3 years ago
June 14, 2023
3 replies
2604 views

Hi all,

Is it possible to find the relevant Fortigate FW and Security Policy Rule being used when some traffic is logged ?

The log entries obviously contain the Data Source ID which identifies the Device, but I can be difficult to then identify the VDOM and FW Policy Rule

saneeshpv_FTNT

Staff

Once you find the matching logs in FAZ, if you click on the logs for more details you can find the VDOM details as well as policy ID as attached

championc1Author

Explorer

Great thanks. I was looking under Fabric > All rather than under Fortigate > Traffic
The traffic I have is showing as Virtual Domain "root" and a Policy ID of 0 (Zero) - which, if I understand correctly, is the implicit deny rule - and when I look at it, it does indeed show as being a DENY, so I'm a bit confused