Troubleshooting Tip: Unable to see implicit deny l...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 232345

Description

This article describes how to troubleshoot missing implicit deny logs.

Scope

FortiGate.

Solution

If implicit deny logs are missing in FortiGate and if it is necessary to view them, go under Log and report section:

'Right-click' on 'Implicit' deny policy and check whether 'log violation traffic is enabled or not'.
Enable this option in CLI:

config log setting
set fwpolicy-implicit-log enable
end

If it is memory logging, execute this command:

config log memory filter
set severity information
end

If it is disk logging, execute this command:

config log disk filter
set severity information
end

Enable the logging in to deny the firewall policy:

config firewall policy

edit 0
set name "Implicit Deny"
set srcintf "any"
set dstintf "any"
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
next

end

Go to Log & Report -> Forward Traffic, and the deny logs will be visible over here.

8718

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Troubleshooting Tip: Unable to see implicit deny logs

You are leaving our website