Skip to main content
Addpeople_James
Addpeople_James
New Member
October 7, 2015
Question

Inaccurate / unhelpful reporting of applications in Forward Traffic log. (QUIC and UNKNOWN

  • October 7, 2015
  • 2 replies
  • 4648 views

Hello,

 

Looking at the "forward traffic" page on my Fortigate110c (v5.2.3,build670) all I really ever see in the Application Name is "QUIC" or "UNKNOWN" (occasionally some "Social Media entries).

 

On previous versions of this page the data displayed would be much more granular, allowing me to see people using all different kinds of categories. Video/Audio, etc...

 

Please can someone suggest what I am doing wrong, and tell me how to get the Application control policies / FortiOS to start correctly reporting the different types of traffic?

 

Thanks

    2 replies

    gschmitt
    gschmitt
    New Member
    October 7, 2015

    QUIC is a "new" protocol created by Google

    https://en.wikipedia.org/wiki/QUIC

     

    So far it only works with Chrome (and Opera lol) while using Google Services

    Addpeople_James
    Addpeople_JamesAuthor
    New Member
    October 7, 2015

    Right, well.... using the following thread:

     

    https://forum.fortinet.com/tm.aspx?m=120305

     

    I have been able to get a much healthier and informative Application Log file. In particular it was the following steps made in the CLI that helped:

     

     

           # config log setting        # set resolve-ip enable         # set resolve-port enable          # config log gui-display        # set location [Gebe an forticloud | memory | disk | fortianalyzer | syslogd]        # set resolve-hosts [enable | disable]        # set resolve-apps [enable | disable]

     

    Sometimes Fortinet baffle me by removing certain features from the GUI of their "updated" firmware versions... i mean....who ISN'T going to want applications to resolve themselves in an application firewall? So why even make that an option? And to bury it in the CLI is just adding insult to injury. They did it with the "Banned Word" email filter too! That's unnecessarily buried in the CLI too, but it used to be a GUI option. 

    Terms & ConditionsAccessibility statement