Technical Tip: Configure syslog logging for managed FortiSwitch to send FortiSwitch logs to syslog server

[sachitdas_FTNT]

Description

This article describes how to configure syslog logging for managed FortiSwitch to send FortiSwitch logs to syslog server.

Related link:

https://docs.fortinet.com/product/fortiswitch/6.0

Solution
Below is configuration example:

1) Create a custom command on FortiGate.

# config switch-controller custom-command
(custom-command)edit syslog                                                                                                                                                <----- Where ‘syslog’ is custom command profile name.

New entry 'syslog' added.

(syslog)set command "config log syslogd2 setting %0a set status enable %0a set server "x.x.x.x" %0a end %0a"                <----- where x.x.x.x the IP address the syslog server IP address.
(syslog)end

# config switch-controller custom-command
(custom-command)edit syslog_filter

New entry 'syslog_filter' added .

(syslog_filter)set command "config log syslogd2 filter %0a set severity debug %0a end %0a"
(syslog_filter)end

2) Push the commands to all the switches: (the serial number is your switch(s) serial number).

# execute switch-controller custom-command syslog <serial# of FSW>
# execute switch-controller custom-command syslog_filter <serial# of FSW>

# config switch-controller managed-switch
    edit "S124EN591801029"
        # config custom-command
            edit "1"
                set command-name " syslog"
            next
            edit "2"
                set command-name " syslog_filter"
            next

3) Create a policy from FortiGate CLI with incoming interface as the FortiLink interface and outgoing interface where syslog server is connected:

# config firewall policy
    edit 1
        set srcintf <fortilink interface name>
        set dstintf <interface name where syslog server is located>
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "SYSLOG" "ALL_ICMP" "PING"
        set nat enable
    end

Notes:

- Setting severity to debug means that it will send debug, information, notification, warning, error, critical, alert and emergency messages.

- Note that the FortiLinkinterface (interface used to manage FSWs) is not visible in the GUI policy, source/destination interface, that is why create the policy from CLI is necessary.

- Custom Commands for Managed FortiSwitch can be found on any managed FortiSwitch guide.

Example:

page#49: https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/1d963d5e-2bd4-11e9-94bf-005056...