How to enable a "Log violation traffic" in DENY policy

[fortinetforumfiokom]

Hi,

I created a DENY policy (see. picture below). I tried to enable log violation traffic, but after click OK, and than reedit the policy it is switched off again. This is a normal behaviour?

[AEK]

Hi

This is not normal. Probably a bug.

Which FortiOS version?

Also you may try edit your firewall policy from CLI and enter the following.

set logtraffic all

[fortinetforumfiokom]

I have fortigate 201F and a 81F with v7.4.3 build2573 firmware. The same thing happens on both. I tried it from another browser, but the result is the same. 

I had already set in the policy : 

set logtraffic all

[AEK]

What you see when you edit the policy and type "show full | grep logtraffic"?

[fortinetforumfiokom]

FortiGate-81F (utibvd) # show full | grep logtraffic
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable
set logtraffic all
set logtraffic-start disable

[AEK]

I mean edit the affected policy first:

config firewall policy
 edit XX
  show full | grep logtraffic

[AEK]

No worries, it means it is "all", so @AnthonyH is right about the cosmetic issue, the logging is enabled but GUI simply doesn't show that it is enabled.

[hbac]

Hi @fortinetforumfiokom,

It is a bug and it will be fixed in 7.4.4. 7.4.4 should be released next week if there is no delay. 

Regards, 

[AnthonyH]

Hello fortinetforumfiokom,

This may be a cosmetic issue in the GUI. When you edit the policy in the CLI are you see the logging enabled here? Or do you see any traffic being denied in the logs?

[fortinetforumfiokom]

1. if I create a new rule and don't set the logging, it won't log

2. turn on Log violation traffic on the gui in the policy, it starts logging, but next time if l edit the policy the Log violation traffic switch indicates that it is off. 

3. From now on I can only turn off logging from cli :set logtraffic disable