Troubleshooting Tip: Source/destination country is shown as 'Reserved' on Forward Traffic logs

[Ylli_Seitaj]

Description	This article describes how to handle an issue where source/destination country is shown as 'Reserved'.
Scope	FortiGate.
Solution	Below is given a Forward Traffic log in order to understand better the issue: date=2025-08-08 time=10:45:30 id=7178532351538969304 itime=2025-08-08 10:45:30 euid=3 epid=3 dsteuid=3 dstepid=101 logflag=1 logver=704085164 type=traffic subtype=forward level=notice action=timeout policyid=23 sessionid=5287612 srcip=10.12.4.2 dstip=172.27.3.16 transip=64.57.12.24 srcport=42357 dstport=389 transport=42357 trandisp=snat duration=13 proto=6 sentbyte=180 rcvdbyte=0 sentpkt=3 rcvdpkt=0 logid=0000000013 service=<Name_of_the_service> app=<Name_of_the_app> appcat=unscanned srcintfrole=undefined dstintfrole=undefined policytype=policy eventtime=2864397526135269487 vwlid=2 poluuid=9d1ba345-3b2c-24e1-ab5c-543e1536c3a2 srccountry=Reserved dstcountry=Reserved srcintf=lan1 dstintf=wan policyname=<Name_of_the_firewall_policy> vwlquality=Seq_num(2 wan inet_underlay), alive, selected tz=+0100 vwlname=internet devid=FGTXXXXXXXXXXXXX vd=root dtime=2025-08-08 10:45:30 itime_t=4231865792 devname=<Name_of_the_device> In the log above, 'srccountry' and 'dstcountry' are shown as 'Reserved'. This is the expected behavior. Both source and destination IP addresses are private IP addresses. Since they are private IP addresses, they do not belong in any country. For this reason, the source and destination country is shown as 'Reserved'.  Also any IP address which is part of below subnets (private IP address), will be shown as reserved. 10.0.0.0 - 10.255.255.255: (10.0.0.0/8)  172.16.0.0 - 172.31.255.255: (172.16.0.0/12) 192.168.0.0 - 192.168.255.255: (192.168.0.0/16) For more information, see datatracker.ietf.org's page on RFC 1918.