Fortinet Gate 60D, Administration Manual

Page: 658 / 706

Log types Log&Report
FortiGate Version 4.0 Administration Guide
658 01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
Example configuration: logging all FortiGate traffic
You can use the following procedure to configure your FortiGate unit record traffic log
messages for all traffic. This procedure enables traffic logging for all FortiGate interfaces
that receive traffic. However, traffic logging may not log traffic that would otherwise be
dropped by the FortiGate unit. To record log messages for this traffic, you can add an IPS
Sensor that includes predefined IPS signatures that can detect and log traffic that would
otherwise be dropped by the FortiGate unit.
To log all traffic received by a FortiGate unit
1 Enter the following CLI command to enable logging of failed connection attempts to the
FortiGate unit that use TCP/IP ports other than the TCP/IP ports configured for
management access:
config system global
set localdeny enable
end
2 Enter the following CLI command to set global header checking to strict.
config system global
set check-protocol-header strict
end
Strict header checking detects invalid raw IP packets by validating packet checksums
and also checks IP headers to make sure they adhere to current standards. The
default setting is loose which is usually appropriate for most environments. Loose
header checking improves performance while meeting most organizations’
requirements.
3 Enter the following CLI commands to enable traffic logging for all of the FortiGate
interfaces that receive traffic. The following commands enable traffic logging on port1
and port2. You should repeat these commands for all other FortiGate unit interfaces
that receive traffic.
config system interface
edit port1
set log enable
next
edit port2
set log enable
end
4 Use the following command to enable logging of other traffic. This option is only
available when logging to an external syslog server.
config log syslogd filter
set other-traffic enable
end
5 Go to UTM > Intrusion Protection > IPS Sensor and select Create New to add an IPS
Sensor.
Edit the IPS Sensor and select Add Pre-defined Override to add the following
predefined IPS signatures to the sensor.
• Invalid.Protocol.Header
• TCP.Bad.Flags
• TCP.Invalid.Packet.Size
Enable each of these signatures, set Action to Block and enable Logging .