FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Interface logging and traffic logging in FortiOS 3.0
Components
FortiGate units running FortiOS 3.0 MR1 and up
Steps or Commands
The following are examples which explain the different types of traffic logging and interface logging in FortiOS 3.0 MR1 and up.
In FortiOS 3.0 MR7, you can only configure logging in firewall policies through the web-based manager. However, you can enable interface traffic logging for troubleshooting, if required, through the CLI. Do not enable both firewall and interface logging because it may severely degrade performance.
If you are running FortiOS 3.0 MR7, only examples 1 and 2 are relevant.
Traffic pattern example 1: No logging enabled
Packet comes into an interface.
Packet passes and is sent out an interface.
Traffic pattern example 2: Traffic and Profile logging enabled
Packet comes into an interface.
A possible log packet is sent regarding an event, such as URL filter.
Traffic log packet is sent, per the firewall policy.
Packet passes and is sent out an interface
Traffic pattern example 3: Traffic, profile and interface logging enabled
Packet comes into an interface
Interface log packet is sent to traffic log, if enabled on that particular interface.
Possible log packet sent regarding the event, such as URL filter.
If packet is sent in step 3, the interface log packet is then sent to the traffic log if it is enabled on that particular interface.
Traffic log packet is sent per the firewall policy.
Interface log packet sent to the traffic log if enabled on that particular interface.
Packet passes and is sent out an interface.
Interface log packet is sent to traffic log, if enabled on that particular interface.
Traffic pattern example 4: Profile and Interface logging enabled
Packet comes into an interface.
Interface log packet is sent to the traffic log is enabled on that particular interface.
Possible log packet is sent regarding the event, such as URL filter.
Interface log packet is sent to the traffic log if enabled on that particular interface.
Packet passes and is sent out an interface.
Interface log packet is sent to traffic log if enabled on that particular interface.
