local-in denied UDP multicast traffic flooding logs

[FortiAdam]

I prefer to log all my local-in denied traffic but it seems that fortinet has changed the way they log this. On earlier versions of 5.0.x I never had all this denied UDP multicast traffic in the logs. Does anyone have an idea of how I can block this local-in multicast denied traffic silently instead of having thousands of extra lines of log? I would prefer not to have to completely disable local-in-deny logging. date=2014-08-12 time=09:44:39 itime=1407854679 logid=12 type=traffic subtype=multicast level=notice vd=root devid=xxx status=deny trandisp=noop srcip=192.168.x.x srcport=17500 dstip=255.255.255.255 dstport=17500 service=17500/udp proto=17 duration=0 policyid=0 sentbyte=426 rcvdbyte=0 sentpkt=3 srcintf=internal dstintf=wan1 sessionid=0 dstcountry=Reserved srccountry=Reserved

[Benoit_Rech_FTNT]

Hello, this is a known issue on FortiOS 5.2 and an enhancement should be introduced in Forti 5.2.1. New CLI commands will be added to differentiate the traffic: unicast or broadcast (include multicast). Bug reference is 231272. Unfortunately, there is workaround except disabling the ' local-in-deny' Benoit

[FatalHalt]

Ben10, The same issue is happening in 5.0.x for us, will there be a patch to 5.0.x to fix this?

[Schuler]

Hello Adam, with version 5.0.x the following settings helped me a lot. It' s a bit strange that " multicast" logging affects broadcasts, but it works.

 config log fortianalyzer filter
    set multicast disable
 end
 
 or
 config log disk filter
    set multicast disable
 end
 

Regards, Sebastian

[FortiAdam]

Thanks for the suggestion Sebastian! I' m testing this in a few places and getting good results.

[FortiAdam]

Is anyone aware of any dependencies for the fortianalyzer filter function? I have some firewalls that don' t seem to have that option although I am using a fortianalyzer. Running 5.0.7 in all instances.

[FortiAdam]

In working with Fortinet support it was determined that you must have the first fortianalyzer in the config set to enabled and have upload option set to " realtime" in order to see filter options even if they aren' t related to the first fortianalyzer in the config. I was working in an environment where I had fortianalyzer2 enabled but not fortianalyzer and didn' t get the option for filtering until fortianalyzer was enabled as well.