FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
hrahuman_FTNT
Article Id 244412
Description This article describes how to enable logging for one-arm filter traffic.
Scope FortiGate.
Solution

Basically, with one-arm sniffer mode, it will examine, and log packets based on the configured IPS sensor and application control list.

 

So, if the UTM features are not enabled in one arm sniffer interface, it will not log anything in FortiGate or forward it to FortiAnalyzer/memory. 

 

Enable the UTM features (IPS, Application Control ) on the firewall policy.

Traffic sent to the interface is examined for matches to the configured IPS sensor and application control list and will be logged to FortiAnalyzer/memory.

config firewall policy
    edit 1
        set srcintf "Port1"
        set dstintf "Port1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "certificate-inspection"
        set application-list "default"
        set ips-sensor "all_default"
        set nat enable
    next
end

 

oas.PNG