Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fjulianom
New Contributor III

When does FortiGate generate traffic logs?

Hi guys,

 

According to NSE4, FortiGate will generate traffic logs once a firewall policy closes an IP session. What does that mean? Does that mean when FortiGate sends a FIN packet to the server? Or does that mean when FortiGate sends an ACK packet after it has received a SYN-ACK from the server? I guess is the second option. Could you confirm?

 

Regards,

Julián

3 Solutions
emnoc
Esteemed Contributor III

I  would look at the set logtraffic-start enable  option, but in normal operation the log category traffic is not written till after the session has closed. This is  the only way to get duration and bytes sent/received

 

Ken

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
emnoc
Esteemed Contributor III

If you are not setting the  cmd , than the log is written when the policy session is closed. How else would you expect it to log the session?

 

Since the  traffic logs contains numerous values &  it can only write those at the session completion time.

 

e.g

 

bytes sent/received

duration

etc....

 

Keep in mind  devices like FAZ might have a small delay before the details are review and depends on upload  variables ( realtime or delayed )

 

 

 

Ken

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
emnoc
Esteemed Contributor III

with logtraffic start , YES!. If you open a new session like a SSH  and keep it open.query the logs

 

 

e.g

create a new policy for some control traffic and set it top of the sequence

 

Now doe the following

;

 

execute log filter category 0

execute  log filter device 0 (??? check the number for the  MEM FAZ or DISK )

execute log filter field policyid <#>

execute log display

 

Now do you see any thing for that traffic ?

 

Now close  the session and re-execute  the "execute log display" and now you will have the record in the log.

 

ken

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
15 REPLIES 15
emnoc
Esteemed Contributor III

I  would look at the set logtraffic-start enable  option, but in normal operation the log category traffic is not written till after the session has closed. This is  the only way to get duration and bytes sent/received

 

Ken

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fjulianom
New Contributor III

Hi Ken,

 

I have found this post which confirms what you say

 

https://forum.fortinet.com/tm.aspx?m=124864

 

But this part of documentation doesn't mention that a log is generated once the session is closed, but always a packet matches a firewall policy

 

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-logging-reporting/logs.htm

 

Traffic

Traffic logs record the traffic that is flowing through your FortiGate unit. Since traffic needs firewall policies to properly flow through the unit, this type of logging is also referred to as firewall policy logging. Firewall policies control all traffic that attempts to pass through the FortiGate unit, between FortiGate interfaces, zones and VLAN sub-interfaces.

Logging traffic works in the following way:

[ul]firewall policy has logging enabled on it (Log Allowed Traffic)packet comes into an inbound interfacea possible log packet is sent regarding a match in the firewall policy, such as a URL filtertraffic log packet is sent, per firewall policypacket passes and is sent out an interface[/ul]

Traffic log messages are stored in the traffic log file. Traffic logs can be stored any log device, even system memory.

  

 

Regards,

Julián

emnoc
Esteemed Contributor III

review this  article ( search on traffic-start  and the logging section )

 

http://help.fortinet.com/cli/fos50hlp/54/Content/FortiOS/fortiOS-cli-ref-54/config/firewall/policy.h...

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fjulianom
New Contributor III

Hi,

 

Well, that article just says that "set logtraffic-start enable" will cause a log message be generated when the session starts, which I already knew.

My question about when a log message is generated takes into account this command is not applied, or it is in its default value (disabled).

 

Regards,

Julián

emnoc
Esteemed Contributor III

If you are not setting the  cmd , than the log is written when the policy session is closed. How else would you expect it to log the session?

 

Since the  traffic logs contains numerous values &  it can only write those at the session completion time.

 

e.g

 

bytes sent/received

duration

etc....

 

Keep in mind  devices like FAZ might have a small delay before the details are review and depends on upload  variables ( realtime or delayed )

 

 

 

Ken

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fjulianom
New Contributor III

Hi Ken,

 

I would swear I have seen session logs in the Forward Traffic section while having open sessions for those logs, I would check again. Thanks very much for your clarification.

 

Regards,

Julián

emnoc
Esteemed Contributor III

with logtraffic start , YES!. If you open a new session like a SSH  and keep it open.query the logs

 

 

e.g

create a new policy for some control traffic and set it top of the sequence

 

Now doe the following

;

 

execute log filter category 0

execute  log filter device 0 (??? check the number for the  MEM FAZ or DISK )

execute log filter field policyid <#>

execute log display

 

Now do you see any thing for that traffic ?

 

Now close  the session and re-execute  the "execute log display" and now you will have the record in the log.

 

ken

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
fjulianom
New Contributor III

Hi Ken,

 

I have just tested this point about the logs. I have open a RDP session through the FortiGate to a server. While the session was open, the first log appeared (#44). After a few minutes I closed the session and then the second log appeared (#32). And few minutes later I closed the session two more logs appeared (#26 and 27). Here you are the evidence:

 

 

 

I didn't use the command "set logtraffic-start enable". Then my questions are:

 

1. Why the first and second logs where generated if FortiGate generates logs when the session is closed?

2. Why few minutes later FortiGate generated two logs with the bytes transmitted and not just one log?

 

Regards,

Julián

 

emnoc
Esteemed Contributor III

Don't have the answer but looking at what you posted

 

1: looks like those are multiple sessions

 

2:  RDP and udp/3389 is probably not the same

 

3: execute show full firewall policy <###>  | grep log   to see what' enabled for that fw.policy.id

 

4: a firewall can't write total time and bytes sent/received until the session closed ( they can't see into future ;)  )

 

 

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors