Syslog - Fortinet FortiGate Firewall

TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: SIEM Syslog
ENVIRONMENT: Fortinet FortiGate
SUMMARY: Configuration Guide for Fortinet FortiGate firewalls (CEF format)

• Vendor Information
• Device Configuration Checklist
• Example Log Messages

This page only covers the device-specific configuration, you'll still need to read Huntress Managed SIEM Syslog Guide to complete the Huntress Managed SIEM setup as well as opening a port in Microsoft Defender Firewall.

Vendor Information

1. Configure syslogd (syslog daemon) server config on firewall through CLI (Command Line Interface)

   1. Open CLI console through the GUI, SSH, or physical console port

   2. Log in with a valid administrator account

   3. Enter the following command to enter the syslogd config

      • config log syslogd setting

      • Note: Multiple syslogd configs are supported. If the primary is used for other purposes, adding a number (2,3,4) to syslogd designates other configs. Example: config log syslogd2 setting

   4. Enter the following commands to configure syslogd

      • set status enable

      • set format cef

      • set server <IP of Huntress Agent>

   5. Exit and save config using the following command

      • End

   6. Verify the syslogd configuration with the following command:

      • show log syslogd setting

Some commands below may return an error code similar to "return code -61". This is likely due to that particular feature not being enabled or licensed on your FortiGate device, and is okay to ignore. If you suspect this message was returned in error, please contact Fortinet support.

1. Configure the syslogd filter

   1. Enter the following command to enter the syslogd filter config

      • config log syslogd filter

        1. Note: Add a number to “syslogd” to match the configuration used in Step 1.

   2. Enter the following commands to set the filter config

      • set severity information
      • set anomaly enable
      • set forward-traffic enable
      • set local-traffic enable
      • set multicast-traffic enable
      • set sniffer-traffic enable
      • set forti-switch disable
      • set gtp enable
      • set http-transaction enable
      • set voip disable
      • set ztna-traffic enable

   3. Exit and save the config

      • End

   4. Verify the syslogd filter configuration

      • show log syslogd filter

2. Enable logging of CLI commands

   1. Enter the following command to enter the global config

      • config system global

   2. Enter the following command to enable CLI command logging

      • set cli-audit-log enable

   3. Exit and save the config

      • End