How to monitor attacks from the Internet?

[fittan]

Hi, totally newbie here. I came from Cisco background and just deployed my first 100E firewall. Great firewall and I am getting familiar with the firewall now. 

My only gripe is that I cannot find any way to monitor traffic on the "outside" interface. No real time logs and no reports either. Fortigate is excellent showing me all sorts of log from the "inside" (web, antivirus, ips, dns, etc). But as for events on the "outside", I am clueless (feels like I am driving blind). I have called Fortigate support several times and they are somewhat surprised about my request and later concurred that there is no such "functionality". 

Am I missing something here? Or is there really no way to monitor? Thanks in advance. 

[JardaTesar]

Hi, I am kinda newbie too. I deployed my 61E about a month ago, but I found few things that might be helpful. I am using Virtual IPs for connection to my servers, pair with Policies for each VIP group, these policies have Antivirus, Intrusion prevention, DNS filter, Web Application Firewall and SSL inspection enabled (and Anti spam profile for mail server), then these policies are set to Log security violations. This way I can see in Log & Report in each category (AV, Antispam, IPS, etc..) if I filter by Policy what attacks were caught by each security profile, so I can monitor attacks on basic vulnerabilities (like brute forces, and so on) which were blocked, as well as Spam filtering for SMTP and caught viruses coming to my network from outside. If you wanted to monitor attacks pointed directly to Fortigate (like management ports, VPN, ...) you would have to enable feature in Settings to show Local policies and setup these policies the same as those for VIPs to monitor the attacks.

[JNehru]

I use Kasper sky to save my data for hackers around the world. All of us know about the attack after the occurrence, so there is no way you can know before it. 

I also use ivacy vpn to hide my IP address from hackers. Ivacy vpn is offering advance features like NAT Firewall and Dedicated IP which ensures complete security.  For more info on how to save yourself online here is a blog https://www.sgsme.sg/reso...emselves-cyber-attacks

[fittan]

Tanr,

        I finally got it to display external traffic thanks to your suggestion about enabling "local-in-allow". After enabling this, I am able to view logs of outside source (their ip, countries, etc) trying to hit my outside IP and I can clearly see that they are "Deny". This is really counter intuitive...meaning to see outside threat, I have to view "local traffic". Anyway, thanks to you, it was a great help.

[Mertozturk]

Hi Fittan,

Can you help me about enabling Local-In-Allow ?

Thank you so much,

[Debbie_FTNT]

Hey Mertozturk,

if you want to enable logging for local traffic:
#config log setting
#set local-in-allow enable
#end
This doc provides details on what CLI log settings there are, you might need to select the correct firmware version and then browse to 'CLI configuration commands > log > log setting':
https://docs.fortinet.com/document/fortigate/6.2.9/cli-reference/443620/config-log-setting

[Mertozturk]

Hi Debbie,

Actually, i can see internal traffic and Lan-To-Wan traffic.

But i want to monitor Outside connections from Wan-To-Lan. Can you help me about that ?

[Debbie_FTNT]

Hey Mertozturk,

if you have policies from WAN to LAN, just make sure they log all sessions, not just security events.
If the WAN to LAN traffic is a response to an initial LAN to WAN connection and part of that LAN to WAN session, then there will be no separate log, that will also fall under the logs generated for the LAN to WAN traffic.
If you're looking for specific monitoring options:
- FortiGate FortiView/Dashboard widgets provide an overview of active traffic
- logs provide information on historic traffic, just ensure all traffic is logged
- you might want to get in touch with the FortiGate support team if you have very specific monitoring needs.