Not Sending syslogs from 60F to different segment

[NGG]

I have a branch office 60F at this address: 192.168.99.1 ( BO segment is 192.168.99.x )

HQ is 192.168.90.x

I have a Syslog server sitting at 192.168.90.50

config log syslogd setting
  set status enable
  set server "192.168.90.50"
  set facility user
  set source-ip "192.168.99.1"
end

I CANNOT telnet to port 514 on the Syslog server from the Fortigate, though I can from any other computer within the BO network.  I suspect this is why logs aren't coming through.  

I can ping IP addresses from the BO Fortigate, I just can't seem to connect/send data to them.

[Anthony_E]

Hello NGG,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[ntaneja]

Hi NGG

You can run debug commands on both FGT and check the traffic flow on src and dst fortigate devices

diag debug reset 
diag debug en 
diag debug console timestamp enable 
diag debug flow filter clear 
diag debug flow filter addr <syslog server IP>
diag debug flow filter dport 514
diag debug flow trace start 999 

After executing them, wait for few seconds. To stop:

diag debug disable 
diag debug reset 

Thanks

[Debbie_FTNT]

Hey NGG,

the log settings themselves look ok, but there is a lot of information missing, so a few questions first:

- how are the branch and HQ connected? IPSec VPN?

-> if yes, please make sure that 192.168.99.1 is part of the phase2 selectors

-> also make sure that on HQ site, there is routing back to 192.168.99.1 in place, and policies that allow this traffic

- I assume you have a route on the branch office to 192.168.90.0/24?

- telnet might not work from FortiGate if traffic is going through a  VPN because you can't define a source IP, and FortiGate would use the IP of the physical interface with lowest index if no IP is set on tunnel interface

- you could try traceroute command (exe traceroute) to see at what point the connection fails, but same issue as with telnet, no source IP can be defined. source IP can only be defined for ping, meaning you can generate a ping with source 192.168.99.1 and destination 192.168.50.90 on the FortiGate to see if it can reach the syslog server

- you can trace for traffic from 192.168.99.1 with source port 514 on the HQ firewall to determine if the branch logging traffic even makes it to HQ