Troubleshooting Tip: Troubleshooting security events

[cmaheu]

Description	This article describes how to verify if the appliance is receiving and processing syslog in integrations where FortiNAC receives security events from a firewall. For configuration example, see Configure Security Incidents in the Document Library.
Scope	FortiNAC-F/FortiNAC-OS 7.2 or greater, FortiNAC/CentOS 9.1 or greater
Solution	Review firewall configuration to verify Syslog messages are configured properly.  For integration details, see the applicable reference manual in the Document Library. Using tcpdump, confirm Syslog messages are reaching the appliance. Save output to a text file. Type the following in the appliance CLI: CentOS: tcpdump -vnni any port 514 | grep -C5 <Firewall IP Address in Inventory> FortiNAC-OS: execute tcpdump -v -i port1 | grep -C5 <Firewall IP Address in Inventory> Generate a security event then  type ctrl-C to stop tcpdump. Syslog messages are not received. Confirm: Syslog is sourced from the same IP used to model the firewall. See Technical Note: Packets not processed when source IP address does not match Device Model. UDP 514 is not being blocked in the network. FortiNAC-OS: 'set allowaccess' option has syslog listed on port1. In the CLI type config system interface show Example: config system interface         (interface) # show             config system interface                 edit port1                     set ip 10.12.242.36/24                     set allowaccess https ping ssh http syslog https-adminui nac-ipc radius                 next Syslog messages are received but FortiNAC is not generating Security Events. Enable debug: CentOS: nacdebug –name SecurityEventManager true nacdebug –name SyslogServer true FortiNAC-OS: diagnose debug plugin enable SecurityEventManager diagnose debug plugin enable SyslogServer Generate a security event. Disable debug: CentOS: nacdebug –name SecurityEventManager false nacdebug –name SyslogServer false FortiNAC-OS: diagnose debug plugin disable SecurityEventManager diagnose debug plugin disable SyslogServer Contact Support for further assistance. Open a support ticket and provide the following: Software version (x.x.x.x). Firewall version. Detailed description of behavior. Troubleshooting steps taken. IP address of test client. Timeframe behavior was reproduced. Results of tcpdump. For system logs see Technical Tip: How to get a debug log report from FortiNAC.