Client MAC Address Absent in Logs

[ISOffice]

Hi all, We recently installed a FortiGate 100D cluster (Active-Active) at the edge of our wireless network. The appliances issue IP addresses via DHCP for client devices connecting to the wireless network. However, when examining the ' Forward Traffic' logs the MAC Address of the client isn' t shown. It isn' t even an additional column which can be selected. The ' Router' Event Log shows the MAC address whenever an IP address is allocated. Is it by design that MAC addrresses are omitted from the ' Forward Traffic' Logs or is there some way I can get them to be shown? Many thanks, JP

[Jessica_G]

I' m running 5.0.4 and don' t see MACs in the traffic logs on any of my FGs or the FAZ. Wasn' t this supposed to be a feature for v5?

[netmin]

We are using a dedicated vdom for clients that has client reputation enabled, device detection on the interfaces and some additional log options. MACs are logged with the app-control traffic merged into the traffic logs (FGT+FAZ). MACs are not logged from webfilter traffic however. 2 sample consecutive tlog entries from FAZ which show the same traffic via webfilter traffic and app-control traffic: itime=1387758029 date=2013-12-23 time=01:20:29 devid=xxxxxxxxxxxxxxxx vd=xxxxxxxxxxx type=traffic subtype=forward catdesc=" Information Technology" dstcountry=" United States" dstintf=" vlink_xxxxx" dstip=65.54.238.213 dstport=80 duration=91 hostname=" stats1.update.microsoft.com" lanin=2660 lanout=636 level=notice logid=0000000008 osname=" Windows" osversion=" XP (x86)" policyid=2 service=HTTP srccountry=" xxx" srcintf=" VLANxxxx" srcip=xx.xx.xx.100 srcname=xxxxxxxxxx srcport=1474 utmaction=passthrough utmevent=webfilter utmsubtype=ftgd-cat wanin=636 wanoptapptype=http wanout=2660 itime=1387758040 date=2013-12-23 time=01:20:40 devid=xxxxxxxxxxxxxxxx vd=xxxxxxxxxxx type=traffic subtype=forward app=" SOAP" appcat=" Network.Service" appid=16730 applist=" Clients_AF" devtype=" Windows PC" dstcountry=" United States" dstintf=" vlink_xxxxx" dstip=65.54.238.213 dstport=80 duration=101 level=notice logid=0000000013 mastersrcmac=xx:xx:xx:6d:d4:1a osname=" Windows" osversion=" XP (x86)" policyid=2 proto=6 rcvdbyte=844 rcvdpkt=5 sentbyte=2928 sentpkt=5 service=HTTP sessionid=2239257 srccountry=" xxx" srcintf=" VLANxxxx" srcip=xx.xx.xx.100 srcmac=xx:xx:xx:6d:d4:1a srcname=xxxxxxxxxx srcport=1474 status=close trandisp=noop A part of a sample screenshot from FAZ/FGT from this traffic is attached.

[ISOffice]

Many thanks for the pointers folks. It appears we may have a ' buggy' installation (not my words!!) which requires an upgrade to the latest version. I will post of any changes/resolution when the upgrade has been carried out.

[netmin]

One or two additional points to note: The displayed ' split logging' of webfilter and app-control traffic on our systems is apparently caused by enabling web cache in the same firewall policies the webfilter profile and application control profile are added. When using webcache in policies of the management (outer) vdom, the client vdom traffic is routed through, it creates nice logging entries for the client vdom containing all the above information. Also, as mentioned in the forums, we have extended-utm-log enabled in the application list settings.