Logging of dropped traffic on external interface

[#1]

Hi all, New to the forum. I recently purchased a fortigate 60C (v4.0,build5352,101007 (MR2) for my home and love it so far. I' m trying to monitor the traffic that is dropped on my external (Untrusted) interface without any luck. I have turned on logging on the implicit (drop all) built in rule but all that is being logged is internal (trusted) traffic that is dropped. I have also attempted to create a new rule with the source being the external interface and the destination the internal one and placed it at the bottom just above the implicit drop policy. Am I missing something? I find it helpful to see what' s actually getting dropped but in the week that its been online not one packet has been dropped and logged from the Internet. Thanks in advance

[abelio]

hello and welcome, use CLI to send the following commands:

 config system global
    set loglocaldeny enable
 end
 

That will enable logging of failed connection attempts to your 60C that use TCP/IP ports other than those for management access It' s a resources consuming setting, so keep an eye on it. regards,

[#3]

set loglocaldeny enable

Perfect!! Thank you. This is on my home network so hopefully it won' t consume too many resources.

[#4]

Is there a CLI command to disable the logging of dropped broadcast traffic? The above command enables me to see dropped external traffic but it also gives me internal netbios broadcasts. Thanks

[ede_pfau]

You may try:

config system interface
     edit " internal" 
         set broadcast-forward disable
         set netbios-forward disable
     next
 end
  

[#6]

Thanks. That doesn' t seem to do anything noticeable. I' m still getting tons of subnet broadcasts advertising netbios. For now, I' ve just set up a filter for a source interface of wan1 but I would like to be able to stop the logging of this traffic if possible.

[#7]

I have same problem. After: config system global set loglocaldeny enable end I' m getting tons of subnet broadcastsnetbios. How I could except this messages from logs?

[Incelli]

Hi, you can try: config log disk set extended-traffic-log disable

[MitchK]

My theory, although I haven' t tried it, is to create a rule permitting netbios broadcasts. In the config for the rule, do not check " log allowed traffic" . This would make the broadcasts allowed, but they would not be logged anymore.

[MitchK]

Unfortunately, you can' t construct the rule I mentioned above. It' s outrageous that Fortinet provides no method to suppress these broadcasts.