Web Filter Log - Allow Traffic?

[jpierre]

Hi Guys, I have a web-filter policy setup with some specific UTM' s enabled and I have " Log Allowed Traffic" enabled on the individual UTM' s and then again under the Web Filter policy' s but I' m not seeing allowed web site traffic in the web filter log. I' m also not seeing it on my FortiAnalyzer. If I look at the traffic logs, I can see the allowed traffic but it only shows IP addreses, not the web URL' s. We have the requirement to report on users Internet habits at the request of managers so I really need to get this going. Any suggestions?

[veechee]

You need to enable logging in the Web Filter profile. Then you can pull host names and URLs out of the Web Filter log, not the Traffic log. In 4.0MR2, this is accessed by going to Web Filter -> Profile -> <profile name here>, select Edit and enable logging for all categories and classifications.

[jpierre]

Already done this veechee. I am using the Fortigate as a proxy with implicit proxy on the interface. Any more ideas?

[Fullmoon]

Aside from steps mentioned above for logging take a look also under Log&Report=>Log Config=>Log Settings=>Local Logging & Archiving=>Memory=>Minimum log level=>Information the hit the Apply button

[Law_Kumar]

You can see logs with web URL' s in FortiAnalyzer -> Log & Archive -> Log Access -> Web Filter tab. Web filter logs with complete URL will not display in Traffic Log. Reg, Law

[veechee]

If you don' t have a FortiAnalyzer, try the new hosted service to do logging and analyzing: https://fams.fortinet.com/. FortiGuard Analysis and Management Service is a hosted logging, reporting and backup solution. It requires no additional hardware, software or facilities and provides the service at the lowest possible cost for all size enterprises. There is a 90-day free trial and after that it' s about $300/year for 10 GB of storage.

[ejhardin]

I use the FAMS hosting and love it.

[jpierre]

I found the problem. I didn' t have an allow * in the URL filter so it wasn' t logging the traffic. I had allow enabled on the web filter itself with certain sites listed as blocked (Facebook etc.). Cheers!