Technical Tip: How to verify/view which logs from ...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 406572

Description

This article explains how to verify which logs from FortiGate are sent to the syslog server via Wireshark.

Scope

FortiGate.

Solution

Example:

Run the following command to find out the IPs used for packet sniffing:

config log syslogd setting

set status enable

set server "173.31.45.76"

set source-ip "173.28.70.2"

end

Run the following command (make sure to use the value 6 0 on the sniff):

diagnose sniff packet any "host 173.31.45.76 and host 173.28.70.2" 6 0 l

Convert the packet capture, refer to this KB ARTICLE: Technical Tip: How to import 'diagnose sniffer packet' data to WireShark
Refer to this KB article to collect packet capture from the GUI: Troubleshooting Tip: Packet Capture on FortiOS GUI

Verification:

164

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: How to verify/view which logs from FortiGate are sent to syslog server

You are leaving our website