Forward Traffic and Local Traffic in Log & Report section

[mlourenco]

Hello,

I have a fortigate 100D.

Can you tell me the difference between forward traffic and local traffic in Log & Report section?

[rwdorman]

Local traffic is traffic directed to the Fortigate itself on one of its management interfaces.  Forward traffic is that traffic permitted or denied by a firewall policy. (and "forwarded" to its destination)

[mlourenco]

But, local traffic can be forwarded also? What's the diference between both?

[Debbie_FTNT · Accepted solution]

Hi Mlourenco!

Local traffic is traffic destined for any IP on the FortiGate itself -> management IPs, VIPs, secondary IPs etc.

Any traffic NOT destined for an IP on the FortiGate is considered forward traffic.

Regarding local traffic being forwarded:

This can happen in cases of VIP and similar setups. We have traffic destined for an IP associated with the FortiGate itself (the external IP of the VIP), and the FortiGate will do DNAT to the internal IP and then forward the traffic to the internal IP. It will still be considered local traffic, because the initial traffic (prior to DNAT) is addressed to the FortiGate directly.

Does this clear up the confusion?

[vivianwu_FTNT]

Local traffic includes traffic destined for any IP on the FortiGate itself (such as management traffic ) or traffic initialized from Fortigate itself (such as traffic to Fortiguard)

forward traffic is the traffic through Fortigate