Fortinet Gate 60D, Administration Manual

Page: 657 / 706

Log&Report Log types
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424
657
http://docs.fortinet.com/ • Feedback
Log types
The FortiGate unit provides a wide range of features to log, enabling you to better monitor
activity that is occurring on your network. For example, you can enable logging of IM/P2P
features, to obtain detailed information on the activity occurring on your network where
IM/P2P programs are used.
Before enabling FortiGate features, you need to configure what type of logging device will
store the logs. For more information, see
“Storing logs” on page 650 .
This topic also provides details on each log type and explains how to enable logging of the
log type.
Traffic log
The Traffic log records all the traffic to and through the FortiGate interfaces. You can
configure logging of traffic controlled by firewall policies and for traffic between any source
and destination addresses. You can also filter to customize the traffic logged:
• Allowed traffic – The FortiGate unit logs all traffic that is allowed according to the
firewall policy settings.
• Violation traffic – The FortiGate unit logs all traffic that violates the firewall policy
settings.
If you are logging “other-traffic”, the FortiGate unit will incur a higher system load because
“other-traffic” logs log individual traffic packets. Fortinet recommends logging firewall
policy traffic since it minimizes the load. Logging “other-traffic” is disabled by default.
Firewall policy traffic logging records the traffic that is both permitted and denied by the
firewall policy, based on the protection profile. Firewall policy traffic logging records
packets that match the policy.
To enable firewall policy traffic logging
1 Go to Firewall > Policy .
2 Select the Expand Arrow to view the policy list for a policy.
3 Select Edit beside the policy that you want.
If required, create a new firewall policy by selecting Create New . For more information,
see “Firewall Policy” on page 319 .
4 Select Log Allowed Traffic .
5 Select OK .
Note: If the FortiGate unit is in Transparent mode, certain settings and options for logging
may not be available because they do not support logging, or are not available in
Transparent mode. For example, SSL VPN events are not available in Transparent mode.
Note: You need to set the logging severity level to Notification when configuring a logging
location to record traffic log messages. Traffic log messages generally have a severity level
no higher than Notification. If VDOMs are in Transparent mode, make sure that VDOM
allows access for enabling traffic logs.