Fortinet FortiGate
FortiGate is Fortinet's next-generation firewall line, running FortiOS on hardware appliances and virtual machines from branch offices up to the data-centre perimeter. It produces three broad log types: traffic logs for sessions the firewall forwarded or blocked, UTM logs from the inspection engines (antivirus, web filter, application control, IPS, DNS filter, SSL inspection), and event logs covering system, VPN, user authentication and administrative activity. Its syslog output is emitted as key-value pairs, which makes it comparatively easy to parse reliably and a dependable backbone for network detection and investigation.
Device-side setup
Configure the device to forward syslog to the listener described below, following the vendor's own documentation for its syslog export. Nothing has to be built on the platform side beyond installing the template below: it supplies the parser and wires the pipeline.
Syslog configuration
The appliance sends to a syslog listener: either the cloud syslog endpoint or a local collector appliance. The two destinations use different ports. The cloud endpoint has a per-tenant domain and a block of ports allocated to your account: Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports) shows the domain, the port range, and which protocol listens on which port; read the numbers off that page rather than assuming a standard one. A collector appliance listens on UDP/514 and TCP/514 by default; a TLS listener (usually 6514 for TLS, 7514 for TLS RFC 6587) is one you add on its Syslog Ports tab and open in the collector's firewall, and each of its listeners can carry a Customer Tag that attributes the records arriving on it. See Syslog Import for the protocol options and Syslog Ports for the listener configuration.
FortiOS frames its TLS syslog output with RFC 6587 octet counting, not the plain TLS framing. Send it to the TLS RFC 6587 listener (on a collector, one you add on its Syslog Ports tab and open in its firewall, usually on port 7514), not the plain Syslog TLS port. Pointed at a plain TLS listener the connection is accepted and the session looks healthy, but the records never parse.
Where a FortiAnalyzer already aggregates logs, forward from the analyzer rather than from each appliance.
Install the Application
- v2 interface
- Classic v1 interface
In the navigation rail, open Applications and click Install Application, then choose FortiGate NGFW Syslog from the On-Premise IT category of the Application Catalog, and click Install Application. The form has only the Application section's Instance name and Display name.
The Applications page opens with the notice Default is launching., and the new application is listed with a green Running badge once the pipeline is up.
Go to Platform → Applications → Install Application From Template and choose FortiGate NGFW Syslog from the On-Premise IT category, then press Install.
The template's description reads FortiGate Firewall Events via Syslog V2 and its template ID is FortiGateFWLogV2, so a configuration that names the V2 template refers to this entry. The template takes no parameters: it supplies the parser and builds the pipeline, and the transport is configured on the syslog listener rather than on the form. There is no source to add, no processor to attach, and no sink to wire by hand.
Related
- On-Prem / Syslog: other syslog devices.
- Fortigate Firewall parser: the FPL parser cookbook for this device's syslog. The template ships a parser already, so this is only needed if you want to customise the parsing.
- Syslog Import and Syslog Ports: the transport and listener.
- Time Adjustment: a recipe for correcting device timestamps sent in local time.