Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fortinetforumfiokom
New Contributor II

How to enable a "Log violation traffic" in DENY policy

Hi,

I created a DENY policy (see. picture below). I tried to enable log violation traffic, but after click OK, and than reedit the policy it is switched off again. This is a normal behaviour?

 

Policy.png

 

1 Solution
ebilcari

This issue is already reported and affects the 7.4 firmware branch. It is already fixed and will be included in future releases (#985419). It is classified only as a GUI issue, if logging is enabled through CLI it will log the traffic.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.

View solution in original post

14 REPLIES 14
AEK
SuperUser
SuperUser

Hi

This is not normal. Probably a bug.

Which FortiOS version?

Also you may try edit your firewall policy from CLI and enter the following.

set logtraffic all

 

AEK
AEK
fortinetforumfiokom

I have fortigate 201F and a 81F with v7.4.3 build2573 firmware. The same thing happens on both. I tried it from another browser, but the result is the same. 

I had already set in the policy : 

set logtraffic all

 

 

AEK

What you see when you edit the policy and type "show full | grep logtraffic"?

AEK
AEK
fortinetforumfiokom

FortiGate-81F (utibvd) # show full | grep logtraffic
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable

AEK

I mean edit the affected policy first:

config firewall policy
edit XX
show full | grep logtraffic

 

AEK
AEK
AEK

No worries, it means it is "all", so @AnthonyH is right about the cosmetic issue, the logging is enabled but GUI simply doesn't show that it is enabled.

AEK
AEK
hbac

Hi @fortinetforumfiokom,

 

It is a bug and it will be fixed in 7.4.4. 7.4.4 should be released next week if there is no delay. 

 

Regards, 

AnthonyH
Staff
Staff

Hello fortinetforumfiokom,

 

This may be a cosmetic issue in the GUI. When you edit the policy in the CLI are you see the logging enabled here? Or do you see any traffic being denied in the logs?

Technical Support Engineer,
Anthony.
fortinetforumfiokom

1. if I create a new rule and don't set the logging, it won't log

2. turn on Log violation traffic on the gui in the policy, it starts logging, but next time if l edit the policy the Log violation traffic switch indicates that it is off. 

3. From now on I can only turn off logging from cli :set logtraffic disable

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors