cant find access log for non succesful connection

[MORAMADAN]

Hello Team,

                In my network with fortigate firewall with fortios 7.2.7 I am having an issue that I cant find a resolution when inverstigating my firewall logs.

all access logs are stored no problems with action accept/deny, when that is according to a policy role.

But when ever I try to connect to server to a non opened port then we supposed to rejected by the server but the log still logged with the action accept or Deny when is not happening.

how to find these logs that was not successful "from my destination" but allowed from the side of the firewall it self.

knowing that I am running  my firewall in policy-based mode.

And, when checking the logs, what does policy Name "Default" means that I see in the logs received alot?

TIA.

[sjoshi]

Hi,

You can simply create a deny rule for those not allowed ports on the FGT then it comes under policy violation rule else on the allowed rule only allow required services and by default for not allowed ports it will match the implicit rule and logs will be captured.

[slovepreet]

Hi Ramadan, 

Usually, there is an option to save all logs or the security Events in the firewall policy. So if you keep the configuration to the default, which is only security events, then it will only save those events, but if you like to see all the traffic, make sure to change that to ALL.

Ref- https://community.fortinet.com/t5/FortiGate/Technical-Tip-Difference-between-Security-Events-and-All...

I hope this helps. 

Regards

[MORAMADAN]

Applied to save all logs, not just security logs

[AEK]

Hi Ramadan

Your firewall will log the traffic even if your server rejects the connection request. That's the normal behavior, because the firewall sees the request and sees the connection closure, so it just logs what it sees.

[MORAMADAN]

When I connect to opened port the firewall log well, but when i connect to closed port on the server but allowed through the firewall, it doesnt log !!!

[pminarik]

I wanted to point you to https://community.fortinet.com/t5/FortiGate/Technical-Tip-ip-conn-traffic-action-in-logs/ta-p/198452, expecting action=ip-conn, but when I tested this with 7.2.10, I observed the following instead:

(A TCP session that is allowed by a firewall policy, but no response from destination side)

flow-mode: action=timeout

proxy-mode (with active UTM): action=close

Additional clear markers for flow mode are 0 bytes received and 0 packets received. Proxy-mode session isn't as easy to identify as the packet counts include the proxied TCP handshake, so there is a non-zero number of packets sent/received.

[MORAMADAN]

Thank you so much @pminarik for the link, useful one.

But :( :( in my case and using wireshark i could see the syn packet from my client and received the rst ack from the server' closed port.

[pminarik]

If a SYN-ACK is received, then from the reciever's perspective the server's port is actually open.

Is that true from the server's perspective as well? The only way to find out is to make a packet capture on the server at the same time as well.

If the results differ, that means someone on the path is proxying the TCP connection. (presumably some firewall or proxy in-between)

If you can't make a capture on the server, you can try taking a capture somewhere else as close to the server as possible to get an "approximate result", but seeing what the server does itself is the best option.

If you are curious specifically about whether the FortiGate is doing this proxying, do a packet capture over all interfaces and analyze the flow and order of packets.

> diag sniffer packet any "host <server-ip> and port <server-port>" 4 0 a

(note: for this to work clearly, the server's destination IP and port must remain unchanged as it passes over the FortiGate, i.e. no VIP/DNAT applied to it)

[MORAMADAN]

I am receiving RST ACK "on the closed port" , not SYN ACK.