Fortigate Logging Problem

1 reply
1355 views

Hi, I have an strage error with logging.

I have two Test VMs (10.244.15.41 and 10.244.14.109) in AWS segmented by an Fortigate 7.2.2

First I did an SSH connection from 10.244.15.41 to 10.244.14.109
As next step I ping 8.8.8.8 from 10.244.14.109

But the Fortigate Logging shows the connection in an wrong order with 3 Minutes delay!

Date Time	Source IP	Destination IP	Protocol	Action	Rule
2022/11/09 09:44:47	10.244.15.41	10.244.14.109	SSH	ACCEPT	AWS-Internal
2022/11/09 09:41:38	10.244.14.109	8.8.8.8	PING	ACCEPT	AWS-External

Has anyone an explanation for this?

ThX Mag

FortiGate

distillednetworkAnswer

Explorer II

Unless you change the setting in the policies, the data is logged when the session closes. So with ICMP, it is opened and then closed right away. An SSH will stay in the session list longer and will be added to the forward traffic logs after the session ends.

distillednetworkAnswer

Explorer II

Unless you change the setting in the policies, the data is logged when the session closes. So with ICMP, it is opened and then closed right away. An SSH will stay in the session list longer and will be added to the forward traffic logs after the session ends.

Sign up

Login with SSO

Login to the community

Login with SSO