Implicit Deny Log Is blank? How to show traffic?

[JJEvans]

Hello All,

Other firewalls I would see the blocking from outside activity all the time. How do I see the traffic that the Fortinet is blocking from the outside via the Implicit deny?

My policy is simple allow all outgoing and block all incoming via implicit deny.

The one person on the forum says that traffic is only logged if the logging level is as low as 'Information'. Where do you set the information level?

Thank you in advance.

[JJEvans]

Thank you Vjoshi for your assistance. Sorry, I have been busy lately. The issue still persists. So I don't get it. It logs and blocks Internal to WAN. But I cannot get the WAN to Internal to log any deny traffic and since its not logging I cannot confirm its blocking anything. Man this is so frustrating since it is so basic what I need it to do.

Here is the output:

# 2016-10-08 17:23:03 id=20085 trace_id=1 func=print_pkt_detail line=4742 msg="vd-root received a packet(proto=1, 192.168.10.2:1->4.2.2.1:2048) from internal. type=8, code=0, id=1, seq=24." 2016-10-08 17:23:03 id=20085 trace_id=1 func=init_ip_session_common line=4893 msg="allocate a new session-006e004a" 2016-10-08 17:23:03 id=20085 trace_id=1 func=vf_ip4_route_input line=1597 msg="find a route: flags=00000000 gw-50.171.242.1 via wan1" 2016-10-08 17:23:03 id=20085 trace_id=1 func=fw_forward_handler line=557 msg="Denied by forward policy check (policy 1)" 2016-10-08 17:23:08 id=20085 trace_id=2 func=print_pkt_detail line=4742 msg="vd-root received a packet(proto=1, 192.168.10.2:1->4.2.2.1:2048) from internal. type=8, code=0, id=1, seq=25." 2016-10-08 17:23:08 id=20085 trace_id=2 func=init_ip_session_common line=4893 msg="allocate a new session-006e0078" 2016-10-08 17:23:08 id=20085 trace_id=2 func=vf_ip4_route_input line=1597 msg="find a route: flags=00000000 gw-50.171.242.1 via wan1" 2016-10-08 17:23:08 id=20085 trace_id=2 func=fw_forward_handler line=557 msg="Denied by forward policy check (policy 1)" 2016-10-08 17:23:13 id=20085 trace_id=3 func=print_pkt_detail line=4742 msg="vd-root received a packet(proto=1, 192.168.10.2:1->4.2.2.1:2048) from internal. type=8, code=0, id=1, seq=26." 2016-10-08 17:23:13 id=20085 trace_id=3 func=init_ip_session_common line=4893 msg="allocate a new session-006e00ba" 2016-10-08 17:23:13 id=20085 trace_id=3 func=vf_ip4_route_input line=1597 msg="find a route: flags=00000000 gw-50.171.242.1 via wan1" 2016-10-08 17:23:13 id=20085 trace_id=3 func=fw_forward_handler line=557 msg="Denied by forward policy check (policy 1)" 2016-10-08 17:23:18 id=20085 trace_id=4 func=print_pkt_detail line=4742 msg="vd-root received a packet(proto=1, 192.168.10.2:1->4.2.2.1:2048) from internal. type=8, code=0, id=1, seq=27." 2016-10-08 17:23:18 id=20085 trace_id=4 func=init_ip_session_common line=4893 msg="allocate a new session-006e00ee" 2016-10-08 17:23:18 id=20085 trace_id=4 func=vf_ip4_route_input line=1597 msg="find a route: flags=00000000 gw-50.171.242.1 via wan1" 2016-10-08 17:23:18 id=20085 trace_id=4 func=fw_forward_handler line=557 msg="Denied by forward policy check (policy 1)" diag debug disable

[JJEvans]

Does anyone from Fortinet have any insight? I have to assume I am not the only person that wants to see what was blocked by the default or custom Implicit deny rule. TIA

[ali40]

Dear, 

I am experiencing the same issue, how did you manage to solve this if it is already solved ? 

Best regards

/Ali 

[sheng99999]

FGT40C3912021928 # config log setting FGT40C3912021928 (setting) # set log-invalid-packet enable

[Rystan]

I have similar problem. I have 60E with 5.6.5. I see the dropped traffic by implicit deny when it traverses the firewall. But I'd like to see also traffic hitting the firewall's WAN1 IP, and being dropped. 

I think I enabled all the options in the CLI and GUI: 

config log setting

set fwpolicy-implicit-log enable set log-invalid-packet enable set local-in-allow enable set local-in-deny-unicast enable set local-in-deny-broadcast enable

end

config log memory setting set status enable set diskfull overwrite end

Is there anything else I can check? 

I'm testing it by sending packets from some host in the internet to the tcp port 12334 on WAN1's IP. I see these packets in diag sniffer packets. But I don't see anywhere these packets in the logs? 

[tanr]

I assume you're sending your logs from the 60E to a remote device, since it doesn't have local storage for logging?  Could they be getting filtered out by that device?

[Rystan]

I found it. In my case, it was filter setting: 

config log memory filter set severity information set local-traffic enable end

By default, there is

set local traffic disable

and it is not displayed by

show log memory filter. 

So this, and the previous snippet allowed me to see the local traffic. None of these settings were available in the GUI. :(

[jbeesley]

You won't see any logs for the implicit rule because there is no traffic hitting the implicit deny.

The any any allow literally allows anything, so the internet traffic is allowed in, I think what you want to do is have your source interface as your LAN port and your destination as WAN, that will allow traffic out, but any traffic coming in is dropped (implicit deny), you can have the destination as 'all' if you want, that will just allow traffic to go to the firewall and back to the LAN if needed.

By default the logging level is informational (level 6), so it should be ok, but if you want to read more about it, you can here:http://docs-legacy.fortinet.com/frec/admin_hlp/1-1-0/index.html#page/FortiRecorder_Help/about_log_se...

Changing the logging information level can be done in the CLI, under 'config log settings'