- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fortigate Logging Problem
Hi, I have an strage error with logging.
I have two Test VMs (10.244.15.41 and 10.244.14.109) in AWS segmented by an Fortigate 7.2.2
- First I did an SSH connection from 10.244.15.41 to 10.244.14.109
- As next step I ping 8.8.8.8 from 10.244.14.109
But the Fortigate Logging shows the connection in an wrong order with 3 Minutes delay!
Date Time | Source IP | Destination IP | Protocol | Action | Rule |
2022/11/09 09:44:47 | 10.244.15.41 | 10.244.14.109 | SSH | ACCEPT | AWS-Internal |
2022/11/09 09:41:38 | 10.244.14.109 | 8.8.8.8 | PING | ACCEPT | AWS-External |
Has anyone an explanation for this?
ThX Mag
Solved! Go to Solution.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unless you change the setting in the policies, the data is logged when the session closes. So with ICMP, it is opened and then closed right away. An SSH will stay in the session list longer and will be added to the forward traffic logs after the session ends.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unless you change the setting in the policies, the data is logged when the session closes. So with ICMP, it is opened and then closed right away. An SSH will stay in the session list longer and will be added to the forward traffic logs after the session ends.
