Difference between &#39;Security Events&#...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 206881

Description

This article describes the difference between 'Security Events' and 'All session' in Log Allowed Traffic in Firewall Policy.

Scope

FortiGate.

Solution

Log 'Security Events' will only log Security (UTM) events (e.g. AV, IPS, firewall web filter), providing one of them has been applied to a firewall (rule) policy.

'Log all sessions' will include traffic log include both match and non-match UTM profile defined.

To edit the firewall policy logging in the web GUI:

To edit the firewall policy logging on the CLI:

config firewall policy
    edit 1
       set logtraffic {all | utm | disable}
    next
end

all Log all sessions accepted or denied by this policy.
utm Log traffic that has a security profile applied to it.
disable Disable all logging for this policy.

11726

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: Difference between 'Security Events' and 'All session' in Log Allowed Traffic in Firewall Policy

You are leaving our website