Fortigate

Overview

Fortigate is a line of firewall devices produced by Fortinet. FortiGate Next Generation Firewalls enable security-driven networking and consolidate industry-leading security capabilities such as intrusion prevention system (IPS), web filtering, secure sockets layer (SSL) inspection, and automated threat protection.

App Function

The Fortigate app performs the following functions:

• Normalize incoming event data
• Set various user tags
• Reformat the event message using all the key/value pairs present in the original message

Fortigate Configuration

To send logs to LogZilla, configure the Fortigate device with the following steps:

Step 1: Access Log Settings

1. Log into the Fortigate web interface
2. Navigate to Log & Report in the left sidebar
3. Click Log Settings

Step 2: Configure Remote Logging

1. In the Remote Logging and Archiving section:
   • Toggle Send logs to syslog to Enabled
   • Enter the LogZilla server IP address or FQDN in the IP Address/FQDN field
   • Leave the default syslog port (514) unless LogZilla is configured differently

Step 3: Enable Local Traffic Log

Critical: The Local Traffic Log must be enabled for the Fortigate app to function properly.

1. In the Log Settings section:
   • Set Local Traffic Log to All (recommended) or Customize based on requirements
   • Set Event Logging to All or Customize as needed

Step 4: Configure UUIDs in Traffic Log (Optional)

For enhanced log correlation:

1. In the UUIDs in Traffic Log section:
   • Enable Policy to include policy UUIDs in logs
   • Enable Address to include address object UUIDs in logs

Step 5: Apply Configuration

1. Click Apply to save the configuration
2. Verify logs are being sent to LogZilla by checking the LogZilla interface

Verification

To verify the configuration is working:

1. Generate some network traffic through the Fortigate
2. Check the LogZilla interface for incoming Fortigate events
3. Verify that user tags are being populated correctly

Note: It may take a few minutes for logs to appear in LogZilla after configuration changes.

Vendor Documentation

• Fortigate Next-Generation Firewall (NGFW)
• Types of logs collected for each device
• Fortinet Document Library - Log and Report
• Sample logs by log type
• Log Message Fields
• Parsing Fortigate logs and other syslog-ng 3.31 news

Log Source Details

Logs can be generated by the following functions:

• Traffic
• Security: Antivirus
• Security: Intrusion Prevention
• Security: Application Control
• Security: Web Filter
• Security: DNS
• Security: Data Leak Prevention
• Security: Email Filter
• Security: Web Application Firewall
• Security: Vulnerability Scan
• Security: VoIP
• Security: FortiClient
• Event: Endpoint
• Event: HA
• Event: Compliance
• Event: System
• Event: Router
• Event: VPN
• Event: User
• Event: WAN Opt
• Event: Cache
• Event: WiFi

Incoming Log Format

Fortigate log messages consist of key/value pairs, with each key/value separated by = and each pair separated by spaces. Keys are not enclosed in quotes, but some values are quoted when they contain spaces or special characters. Log messages are generated for many different event types, and each event type produces distinct keys. Some keys are common across different event types, while others are unique to specific event types.

Parsed Metadata Fields

The following fields (keys) are tagged. The user tag name matches the field key name.

High-Cardinality (HC) Tags

• SrcIP
• DstIP

Example Logs

Block SSL Traffic

text
Wrap: OnCopyFullscreen
action="blocked" dstintf="unknown-0" dstintfrole="undefined"
dstip="172.16.200.99" dstport="8080" eventtype="ssl-anomalies"
level="warning" logid="1700062053" msg="Connection is blocked due
to unsupported SSL traffic" policyid="1"
profile="block-unsupported-ssl" proto="6" reason="malformed input"
service="SMTPS" sessionid="11424" srcintf="port2"
srcintfrole="undefined" srcip="10.1.100.66" srcport="41296"
subtype="ssl" type="utm" vd="vdom1"

Successful Authentication

text
Wrap: OnCopyFullscreen
date=2019-05-13 time=15:55:56 logid="0102043008" type="event"
subtype="user" level="notice" vd="root" eventtime=1557788156913809277
logdesc="Authentication success" srcip=10.1.100.11 dstip=172.16.200.55
policyid=1 interface="port10" user="bob" group="local-group1"
authproto="TELNET(10.1.100.11)" action="authentication"
status="success" reason="N/A" msg="User bob succeeded in
authentication"

Web Access Denied

text
Wrap: OnCopyFullscreen
date=2019-05-13 time=16:29:45 logid="0316013056" type="utm"
subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="vdom1"
eventtime=1557790184975119738 policyid=1 sessionid=381780
srcip=10.1.100.11 srcport=44258 srcintf="port12"
srcintfrole="undefined" dstip=185.244.31.158 dstport=80
dstintf="port11" dstintfrole="undefined" proto=6 service="HTTP"
hostname="morrishittu.ddns.net" profile="test-webfilter"
action="blocked" reqtype="direct" url="/" sentbyte=84 rcvdbyte=0
direction="outgoing" msg="URL belongs to a denied category in policy"
method="domain" cat=26 catdesc="Malicious Websites" crscore=30
craction=4194304 crlevel="high"