Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

Can't see one-armed sniffer logs FTG-60D

I'm helping a customer migrate from a Cisco router w/ACL legacy security solution to a FTG w/UTM solution. They would like me to do a little discovery before the migration so they have configured a FTG 60D (unlicensed) in one-arm sniffer mode monitoring traffic both rx/tx to the router.


Doing a packet sniff on the CLI I can see the all the traffic being sent from the cisco span port properly, but nothing is showing up in any of the logs on the Fortigate. I'm running 6.0.X on the Fortigate and my sniffer port doesn't have any security profiles applied since the device is not licensed. I really just want to see the traffic itself and not looking for any IPS sensor functionality.


My suspicion is that even though I'm not applying any UTM to the traffic being sniffed a license still may be required, but wanted to bounce this off the community just to make sure. 


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors