Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Not Sending syslogs from 60F to different segment

I have a branch office 60F at this address: ( BO segment is 192.168.99.x )

HQ is 192.168.90.x

I have a Syslog server sitting at


config log syslogd setting
  set status enable
  set server ""
  set facility user
  set source-ip ""


I CANNOT telnet to port 514 on the Syslog server from the Fortigate, though I can from any other computer within the BO network.  I suspect this is why logs aren't coming through.  


I can ping IP addresses from the BO Fortigate, I just can't seem to connect/send data to them.

Community Manager
Community Manager

Hello NGG,


Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.



Anthony-Fortinet Community Team.



You can run debug commands on both FGT and check the traffic flow on src and dst fortigate devices

diag debug reset 
diag debug en 
diag debug console timestamp enable 
diag debug flow filter clear 
diag debug flow filter addr <syslog server IP>
diag debug flow filter dport 514
diag debug flow trace start 999 

After executing them, wait for few seconds. To stop:

diag debug disable 
diag debug reset 



Hey NGG,

the log settings themselves look ok, but there is a lot of information missing, so a few questions first:

- how are the branch and HQ connected? IPSec VPN?

-> if yes, please make sure that is part of the phase2 selectors

-> also make sure that on HQ site, there is routing back to in place, and policies that allow this traffic

- I assume you have a route on the branch office to

- telnet might not work from FortiGate if traffic is going through a  VPN because you can't define a source IP, and FortiGate would use the IP of the physical interface with lowest index if no IP is set on tunnel interface

- you could try traceroute command (exe traceroute) to see at what point the connection fails, but same issue as with telnet, no source IP can be defined. source IP can only be defined for ping, meaning you can generate a ping with source and destination on the FortiGate to see if it can reach the syslog server

- you can trace for traffic from with source port 514 on the HQ firewall to determine if the branch logging traffic even makes it to HQ

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
Top Kudoed Authors