FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
yangw
Staff
Staff
Article Id 299994
Description This article describes that the the option 'source-ip' will be unset under syslogd setting when 'ha-direct' is enabled and how to enable it.
Scope FortiGate v7.0.
Solution

When the HA setting 'ha-direct' is disabled (default setting), the option 'source-ip' can be configured as below:

 

config log syslogd setting
    set status enable
    set server ''
    set mode udp
    set port 514
    set facility local7
    set source-ip ''   <-----
    set format default
    set priority default
    set max-log-rate 0
    set interface-select-method auto
end

 

Once the HA setting 'ha-direct' is enabled as below, the option 'source-ip' under syslogd will be removed by design:

 

config system ha
    set group-name "re"
    set mode a-p
    set hbdev "port9" 50

    set ha-mgmt-status enable
        config ha-mgmt-interfaces
            edit 1
                set interface "port8"
            next
        end
            set override disable

    set ha-direct enable    <----- Using 'ha-mgmt' interface for Syslog.
    end

 

 

A warning message is given after the ha-direct command is enabled.

 

ha-direct is enabled, so source-ip settings are not used in certain management services (e.g., remote logging, netflow and sflow).
We recommend to unset all these source-ip.
Do you want to unset them now? (y/n)y

 

The option under syslogd setting 'interface-select-method' and 'source-ip' will be removed as below.

 

get log syslogd setting
status : enable
server : 10.15.9.12
mode : udp
port : 514
facility : local7
format : default
priority : default
max-log-rate : 0

 

Note:

  • By design, when the HA-Direct is enabled, the traffic will flow through the MGMT interface (for example, port 8).
  • Enable 'ha-mgmt-status' under the 'config system ha' command to make 'ha-direct settings' visible.