Description
This article explains why to observe local traffic logs to port 9980 from source and destination 127.0.0.1.
Scope
FortiOs.
Solution
The following logs are observed in local traffic logs.
TCP port 9980 is used for local traffic related to security fabric features and handles some internal rest API queries. These logs are normal, and it will not cause any issue.
To disable such logging of local traffic:
# config log setting
set local-out disable
end
The address 127.0.0.1 will always be pointing to localhost, simply means the traffic will not go anywhere but looping inside the FortiGate itself.
