Technical Tip: Logs regarding Source and Destination IP 127.0.0.1 with UDP port 12121

[sdabhade]

Description

This article describes how to interpret logs involving Source and Destination IP 127.0.0.1 with UDP port 12121.

Scope

FortiGate.

Solution

The following logs may appear for Source and Destination IP 127.0.0.1 using UDP port 12121.

When FortiGate is configured with the below configuration, a log subscriber named 'tap-device' sends the miglogd logs to a local UDP port 12121 for WebSocket usage.

The address 127.0.0.1 always points to localhost, meaning the traffic remains within the FortiGate and does not leave the device, effectively looping internally. These logs do not cause any problems.

config log tap-device
    edit "custom"
        set status enable
        set port 12121
        set format json
    next
end