Hi, Guys,
We found some strange syslog as the following, we have not configured or defined these policies ?
Any recommendation to fix these problems:
uID : 5025117 Date : Today 03:46:51 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : ERR Syslogtag : date=2020-12-23 Checksum : 0 Message time=03:46:50 devname="Forti400e_Fw02" devid="FG4H000000000004" logid="1501054200" type="utm" subtype="dns" eventtype="dns-response" level="error" vd="root" eventtime=1608709611360453548 tz="-0400" policyid=0 sessionid=0 srcport=0 srcintf="unknown0" srcintfrole="undefined" dstip=169.254.0.2 dstport=53 dstintf="unknown0" dstintfrole="undefined" proto=17 xid=47105 qname="login.microsoft.com " qtype="A" qtypeval=1 qclass="IN" msg="A DNS resolution error occurs" action="pass" error="DNS query timeout"
Details for the syslog messages with id '5032066' uID : 5032066 Date : Today 04:03:27 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : WARNING Syslogtag : date=2020-12-23 Checksum : 0
Message time=04:03:27 devname="Forti400e_Fw02" devid="FG4H000000000005" logid="0113022923" type="event" subtype="sdwan" level="warning" vd="root" eventtime=1608710608185897467 tz="-0400" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=3 service="To_01DC" msg="Service disabled caused by no outgoing path."
Many thanks
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello Benson,
this syslog is not related to firewall policy (we can see that is the syslog the policy-id is set to 0) but are generated by the system: * first one: a DNS query haven't received a response * second one: routing issue on SD-WAN, with on path unavailable. There a some filter you can apply on syslog, and also configure filter on event.
#config log syslogd filter
# get severity : information forward-traffic : enable local-traffic : enable multicast-traffic : enable sniffer-traffic : enable anomaly : enable voip : enable gtp : enable filter : filter-type : include
and
# config log eventfilter
# get event : enable system : enable vpn : enable user : enable router : enable wireless-activity : enable wan-opt : enable endpoint : enable ha : enable security-rating : enable fortiextender : enable connector : enable
Best regards, Benoit
OP
Also fortios has log reference on their website that will give you inside details on log structure
e.g
Ken Felix
PCNSE
NSE
StrongSwan
Hello Benson,
this syslog is not related to firewall policy (we can see that is the syslog the policy-id is set to 0) but are generated by the system: * first one: a DNS query haven't received a response * second one: routing issue on SD-WAN, with on path unavailable. There a some filter you can apply on syslog, and also configure filter on event.
#config log syslogd filter
# get severity : information forward-traffic : enable local-traffic : enable multicast-traffic : enable sniffer-traffic : enable anomaly : enable voip : enable gtp : enable filter : filter-type : include
and
# config log eventfilter
# get event : enable system : enable vpn : enable user : enable router : enable wireless-activity : enable wan-opt : enable endpoint : enable ha : enable security-rating : enable fortiextender : enable connector : enable
Best regards, Benoit
OP
Also fortios has log reference on their website that will give you inside details on log structure
e.g
Ken Felix
PCNSE
NSE
StrongSwan
Hi, Benoit,
Thanks for your helpful information, questions for the second log event:
1. It is "WARNING" level, it scares me.
2. The SDWAN zone is created for network traffic, but syslog "Service disabled caused by no outgoing path"; how to identify the root cause and fix it ?
Many thanks
looks to me as if the second one caused the first one ;)
sd-wan stopped working because of "no outgoing path". Sounds to me as if all wans were down at this time.
In consequence afterwards the DNS request to login.microsoft.com timed out because there was no internet available to resolve that.
Oh and Policy #0 exists by default and is the "drop anything that did not match any other policy" one :)
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
I have to disagree the time=stamps are too far apart for those two log events to be even remotely related. The 1st one is surely web-filter or dlp related and dns-resolution failure.
Ken Felix
PCNSE
NSE
StrongSwan
Hi, Guys,
Thanks so much for your plenty of information... the first issue ( uID : 5025117 ) is found due to Fortigate DNS setting ( auto internet SLA detection ); hence no concern.
Were you able to find resolution to second issue? I'm dealing w/the same thing
Hi, secfnd
You may check the system log for this issue
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1529 | |
1027 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.