FortiOS 5.6.1 - Logging to disk Disabled?!

[myrdin]

Hi,

i have 2 new units (FG100E) which i am trying to run 5.6.1. It looks like the local disk is disabled for logging, so i have like 2-3 seconds worth of logs in memory, no reports and no 24 hours span for Fortiview.

Ideas?

thanks

[storaid]

100E has no SSD storage..

http://docs.fortinet.com/...MTX-561-201707-R22.pdf

[myrdin]

what??

FG100D is reported NOT to have disk but on 5.2 you can create reports and have 24 hours of logs...

This seems to me a software lock to push people to use the bloody Forticloud

[SMabille]

FG100D have disk, FG100E don't (FG101E are disk variant). What is I think scandalous is charging $1000 for a small SSD. (Making the 101E RRP 50% more expensive than 100E).

[myrdin]

we might argue where is the system is booting from...

i think this is just stupid and confusing on the fortinet side...since they normally replace 100d with 100e and omit to say they are not exaclty 1:1

[myrdin]

I feel the need to apologies but i was pretty pissed off at that time...

anyway, turns out FortiCloud has made huge improvments since last time and it can actually integrate well with 5.6 , so i can actually see older logs even without hard drives.

I will make sure tho i will start selling 101E instead (hope the price different won't be huge)

[MikePruett]

Yeah, it wasn't a push to force FortiCloud though. Logging to disk is no bueno in general as it causes premature disk failure. They disabled it on smaller models for that reason.

Newer E model FortiGates have two versions as well. The 0 model is the non disk version (only enough flash for FortiOS). The 1 model is the one with on board storage.

So for example, the FortiGate 60E has no on board storage where as the FortiGate 61E does

[FGTuser]

SMabille wrote:
FG100D have disk, FG100E don't (FG101E are disk variant). What is I think scandalous is charging $1000 for a small SSD. (Making the 101E RRP 50% more expensive than 100E).

SSD version is overpriced and if you log a lot, it will die anyway at some point (in 1-2-3 years).

But what is absolutely ridiculous, you pay more for UTM subscription just because it's percentage of box price.

For the same box, same performance.

FAZ-VM makes much more (not only) financial sense for logging, even with couple of FGT's.

The only issue of non-SSD boxes is missing packet capture. I can't understand, why it's not possible to capture to RAM.

[MikePruett]

+1 at a VM FAZ. Awesome bang for the buck instead of doing something like forticloud or a 1 model of the Gate

[bartman10]

I had a long rant about why they should enable logging to a USB device... but then again that does not make them money $$$ and it only wrecked the internal drives because Fortinet used the cheapest, ****, 3rd shift, B rated, flash from China they could find in those units. 

Found it..

https://forum.fortinet.com/tm.aspx?m=135704

These guys keep getting hung up on lack of CPU.. but this is proved to be wrong as many models have had this feature in the past. It was the Wang Lo flash that was the issue.