SNAT Policy Log Allowed in FGT VDOMs

[johnlloyd_13]

hi,

i'll be creating multiple (a lot) SNAT policy in a multi-VDOM FGT which is an "F" series (1000 plus model)

my question, do i enable/allow log "all sessions" or just "security events"?

can my current platform (1000 plus F model) can handle such log?

i just want to prevent any high CPU/memory due to lots of NAT processing/cache.

[funkylicious]

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Difference-between-Security-Events-and-All... 

Since the 1000F does not have a local disk to store the logs, all logs will be held in memory for a rather short duration of time or until a reboot.

It would be recommended to use a external syslog server or FortiAnalyzer to send the logs to relieve the FGT from any 'stress' .

[dingjerry_FTNT]

Not true. 

FGT 1001F does have a Local Disk. It should be the same for FGT 1000F.

Version: FortiGate-1001F v7.4.7,build2731,250120 (GA.M)
......
Log hard disk: Available

@johnlloyd_13 ,

It should be fine to enable NAT and logs in multiple policies.

[funkylicious]

as far as I know, only models ending with xxx1 have local storage, maybe on higher models/chassis this rule doesn't apply but in the product matrix 1000F is not listed with storage but rather, Local Storage 960 GB (1001F)

[dingjerry_FTNT]

Hi @funkylicious ,

I don't have FGT 1000F in hand to verify and confirm.  But it seems you are right.

[Toshi_Esumi]

Yes, it is.

Toshi

[funkylicious]

(global) # get system status | grep Version
Version: FortiGate-1000F v7.2.7,build1577,240131 (GA.M)
Release Version Information: GA

(global) # get system status | grep disk
Log hard disk: Not available

[johnlloyd_13]

hi,

i didn't specifically mentioned 1000/1001F, it's a bigger chassis/platform.

to my knowledge "F" models have disk on them.

i just want to know if i can "safely" enable syslog on NAT policy on the VDOMs in a single device. no plan to send to a remote syslog at the moment.

[johnlloyd_13]

hi,

thanks for the reply!

do you have a fortinet link/tech guide or tip that will confirm this?

[dingjerry_FTNT · Accepted solution]

Hi @johnlloyd_13 ,

Technically, it's hard to cause high CPU/Memory usage issues due to NAT usage.

1) The following doc is talking about possible reasons causing high CPU:

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/232929/troubleshooting-high-...

2) The KB is talking about something for conserve mode (Memory usage issue)

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-conserve-mode-is-triggered/ta-p/198580...