Hostname field in logs of VPN connection by Forticlient.

[cccvvveee0235]

Hi all! How to extend VPN connection events via Forticlient, I need to add the hostname field to the logs.

[AEK]

Hi CVE

Do you mean you want to see client hostname on the FortiGate logs?

[cccvvveee0235]

Hello AEK! Yes sir, right, i wanna to see client hostname in FortiGate logs. because I need client hostnames to correlate with other logs in SIEM system.

[AEK]

Hi CVE

FGT can get the hostname by reverse DNS lookup for the IP address.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Add-source-hostname-to-forward-traffic-log...

When a client is on-fabric usually the hostname/IP record is updated on the DNS server, I think is it done via LDAP's DHCP server.

But with VPN by default the IP address is provided by FGT, not AD's DHCP server. So for VPN you need something to update the related DNS record on your (corporate) DNS server from which your FGT is resolving the addresses, or simply use LDAP's DHCP to provide your client host with the dynamic IP.

I hope I'm not wrong but it should be something like that. I think you should dig on this side.