Skip to main content
Sozo_Admin
New Member
November 15, 2024
Question

Fortigate not showing Deny logs

  • November 15, 2024
  • 4 replies
  • 4987 views

Howdy all,

I am trying to view Deny traffic logs on a Fortigate 30E
(FortiGate 30Ev6.2.15 build1378 (GA)
and they are not showing up.
Via the CLI - log severity level set to Warning
Local logging

 

Here is the details:
CMB-FL01 # show full-configuration log memory filter
config log memory filter
set severity warning
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set filter ‘’
set filter-type include

 

The Fortigate is getting hammered, with alerts coming in thusly: (Sanitized)

 

Message meets Alert condition
date=2024-11-14 time=15:04:05 devname=CMB-FL01 devid=FGT30E5777885133 logid=“0000000013” type=“traffic” subtype=“forward” level=“notice” vd=“root” eventtime=1731621845329636171 tz=“-0700” srcip=194.264.22.254 srcport=56676 srcintf=“wan” srcintfrole=“wan” dstip=93.22.3.19 dstport=10443 dstintf=“lan” dstintfrole=“lan” sessionid=3808968 proto=6 action=“deny” policyid=0 policytype=“policy” service=“tcp/10443” dstcountry=“Canada” srccountry=“Canada” trandisp=“dnat” tranip=195.137.0.254 tranport=443 duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat=“unscanned” crscore=30 craction=131072 crlevel=“high”

 

Implicit Deny policy in place - set to log violation Traffic:

Sozo_Admin_0-1731685105459.png

 

Firewall11209×756 28 KB

 

However I can find no deny logs:

Sozo_Admin_1-1731685105471.png

 

Firewall21898×879 30.2 KB

 

Nor can I see the Implicit Deny object when trying to search logs by Policy:

Sozo_Admin_2-1731685105476.png

 

firewall5509×648 86.5 KB

 

 

Sozo_Admin_3-1731685105469.png

 

Firewall41914×841 40.3 KB

 

I don’t know if I am missing something obvious, or have configured something incorrectly.
If anyone has any advice it would be appreciated!
Thanks to any takers.
Sozo

4 replies

dingjerry_FTNT
Staff
Staff
November 15, 2024

Run the debug flow commands to see whether your denied traffic is hitting a firewall policy with a log setting enabled.

Sozo_Admin
New Member
November 15, 2024

Hi dingjerry_FTNT, 

Thanks for that, I am doing so now, appreciate the suggestion. I will update with what I can find there though the implicit deny policy is in place with logging set to log all events from Warning and above it should be hitting that policy.

funkylicious
SuperUser
SuperUser
November 15, 2024

If the destination is the wan IP interface and not a VIP/port forward, try looking under Local Traffic.

"jack of all trades, master of none"
dingjerry_FTNT
Staff
Staff
November 15, 2024

Agree. So @Sozo_Admin , what is your interesting traffic?  Is it a passthrough traffic or terminated on FGT?

Sozo_Admin
New Member
November 15, 2024

Hi again dingjerry_FTNT,

It is external attempts to access (attacks) getting denied by the Fortigate.

I am trying to view the deny logs. (Boss request)

parthpatel
Staff
Staff
November 15, 2024

Hello @Sozo_Admin,

Can you please review the below document and confirm that you have all the needed settings enabled on the firewall for implicit deny logs?
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Unable-to-see-implicit-deny-logs/ta-p/232345

wmichael
Staff
Staff
November 15, 2024

Hello @Sozo_Admin

Ensure logging on the implicit deny is enabled.

 

See the following article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implicit-deny-logs/ta-p/194602