When does FortiGate generate traffic logs?

[fjulianom]

Hi guys,

According to NSE4, FortiGate will generate traffic logs once a firewall policy closes an IP session. What does that mean? Does that mean when FortiGate sends a FIN packet to the server? Or does that mean when FortiGate sends an ACK packet after it has received a SYN-ACK from the server? I guess is the second option. Could you confirm?

Regards,

Julián

[emnoc · Accepted solution]

I  would look at the set logtraffic-start enable  option, but in normal operation the log category traffic is not written till after the session has closed. This is  the only way to get duration and bytes sent/received

Ken

[emnoc · Accepted solution]

If you are not setting the  cmd , than the log is written when the policy session is closed. How else would you expect it to log the session?

Since the  traffic logs contains numerous values &  it can only write those at the session completion time.

e.g

bytes sent/received

duration

etc....

Keep in mind  devices like FAZ might have a small delay before the details are review and depends on upload  variables ( realtime or delayed )

Ken

[emnoc · Accepted solution]

I  would look at the set logtraffic-start enable  option, but in normal operation the log category traffic is not written till after the session has closed. This is  the only way to get duration and bytes sent/received

Ken

[fjulianom]

Hi Ken,

I have found this post which confirms what you say

https://forum.fortinet.com/tm.aspx?m=124864

But this part of documentation doesn't mention that a log is generated once the session is closed, but always a packet matches a firewall policy

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-logging-reporting/logs.htm

Traffic

Traffic logs record the traffic that is flowing through your FortiGate unit. Since traffic needs firewall policies to properly flow through the unit, this type of logging is also referred to as firewall policy logging. Firewall policies control all traffic that attempts to pass through the FortiGate unit, between FortiGate interfaces, zones and VLAN sub-interfaces.

Logging traffic works in the following way:

[ul]firewall policy has logging enabled on it (Log Allowed Traffic)packet comes into an inbound interfacea possible log packet is sent regarding a match in the firewall policy, such as a URL filtertraffic log packet is sent, per firewall policypacket passes and is sent out an interface[/ul]

Traffic log messages are stored in the traffic log file. Traffic logs can be stored any log device, even system memory.

Regards,

Julián

[emnoc]

review this  article ( search on traffic-start  and the logging section )

http://help.fortinet.com/cli/fos50hlp/54/Content/FortiOS/fortiOS-cli-ref-54/config/firewall/policy.h...

[fjulianom]

Hi,

Well, that article just says that "set logtraffic-start enable" will cause a log message be generated when the session starts, which I already knew.

My question about when a log message is generated takes into account this command is not applied, or it is in its default value (disabled).

Regards,

Julián

[emnoc · Accepted solution]

If you are not setting the  cmd , than the log is written when the policy session is closed. How else would you expect it to log the session?

Since the  traffic logs contains numerous values &  it can only write those at the session completion time.

e.g

bytes sent/received

duration

etc....

Keep in mind  devices like FAZ might have a small delay before the details are review and depends on upload  variables ( realtime or delayed )

Ken

[fjulianom]

Hi Ken,

I would swear I have seen session logs in the Forward Traffic section while having open sessions for those logs, I would check again. Thanks very much for your clarification.

Regards,

Julián

[emnoc · Accepted solution]

with logtraffic start , YES!. If you open a new session like a SSH  and keep it open.query the logs

e.g

create a new policy for some control traffic and set it top of the sequence

Now doe the following

;

execute log filter category 0

execute  log filter device 0 (??? check the number for the  MEM FAZ or DISK )

execute log filter field policyid <#>

execute log display

Now do you see any thing for that traffic ?

Now close  the session and re-execute  the "execute log display" and now you will have the record in the log.

ken

[fjulianom]

Hi Ken,

I have just tested this point about the logs. I have open a RDP session through the FortiGate to a server. While the session was open, the first log appeared (#44). After a few minutes I closed the session and then the second log appeared (#32). And few minutes later I closed the session two more logs appeared (#26 and 27). Here you are the evidence:

 

I didn't use the command "set logtraffic-start enable". Then my questions are:

1. Why the first and second logs where generated if FortiGate generates logs when the session is closed?

2. Why few minutes later FortiGate generated two logs with the bytes transmitted and not just one log?

Regards,

Julián

[emnoc]

Don't have the answer but looking at what you posted

1: looks like those are multiple sessions

2:  RDP and udp/3389 is probably not the same

3: execute show full firewall policy <###>  | grep log   to see what' enabled for that fw.policy.id

4: a firewall can't write total time and bytes sent/received until the session closed ( they can't see into future ;)  )