I have a branch office 60F at this address: 192.168.99.1 ( BO segment is 192.168.99.x )
HQ is 192.168.90.x
I have a Syslog server sitting at 192.168.90.50
config log syslogd setting
set status enable
set server "192.168.90.50"
set facility user
set source-ip "192.168.99.1"
end
I CANNOT telnet to port 514 on the Syslog server from the Fortigate, though I can from any other computer within the BO network. I suspect this is why logs aren't coming through.
I can ping IP addresses from the BO Fortigate, I just can't seem to connect/send data to them.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello NGG,
Thank you for using the Community Forum.
I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Regards,
Hi NGG
You can run debug commands on both FGT and check the traffic flow on src and dst fortigate devices
diag debug reset
diag debug en
diag debug console timestamp enable
diag debug flow filter clear
diag debug flow filter addr <syslog server IP>
diag debug flow filter dport 514
diag debug flow trace start 999
After executing them, wait for few seconds. To stop:
diag debug disable
diag debug reset
Thanks
Hey NGG,
the log settings themselves look ok, but there is a lot of information missing, so a few questions first:
- how are the branch and HQ connected? IPSec VPN?
-> if yes, please make sure that 192.168.99.1 is part of the phase2 selectors
-> also make sure that on HQ site, there is routing back to 192.168.99.1 in place, and policies that allow this traffic
- I assume you have a route on the branch office to 192.168.90.0/24?
- telnet might not work from FortiGate if traffic is going through a VPN because you can't define a source IP, and FortiGate would use the IP of the physical interface with lowest index if no IP is set on tunnel interface
- you could try traceroute command (exe traceroute) to see at what point the connection fails, but same issue as with telnet, no source IP can be defined. source IP can only be defined for ping, meaning you can generate a ping with source 192.168.99.1 and destination 192.168.50.90 on the FortiGate to see if it can reach the syslog server
- you can trace for traffic from 192.168.99.1 with source port 514 on the HQ firewall to determine if the branch logging traffic even makes it to HQ
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.