DO NOT REPRINT

© FORTINET
Lab 5: Logging and Monitoring

In this lab, you will configure log settings on Local-FortiGate, configure alert email, and view logs.

Objectives
l Configure logging on FortiGate so FortiGate understands how to log traffic.
l Configure threat weight.
l Monitor logs through alert emails.
l View logs on the Local-FortiGate GUI.

Time to Complete
Estimated: 35 minutes

Prerequisites
Before beginning this lab, you must restore a configuration file to Local-FortiGate. After the reboot, you must also
check your web filter license status, because you will be using web filtering in this lab and it must show as
licensed.

To restore the Local-FortiGate configuration file

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. In the upper-right corner of the screen, click admin, and then click Configuration > Restore.

3. Click Local PC, and then click Upload.

4. Click Desktop > Resources > FortiGate-Security > Logging > local-logging.conf, and then click
Open.
5. Click OK.
6. Click OK to reboot.

90 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Lab
NOT REPRINT
5: Logging and Monitoring

© FORTINET
To check the web filter license status upon reboot
1. Continuing on the Local-Windows VM, log in to the Local-FortiGate GUI at 10.0.1.254 with the user name
admin and password password.
2. Select Dashboard, and in the Licenses widget, verify that there is a green check mark next to Web Filtering,
indicating the service is licensed and active.
If it is licensed, continue to Configuring Log Settings on page 92

3. If there is a grey ? icon next to Web Filtering, indicating the license status is unavailable, complete the following:
a. Click System > FortiGuard.
b. Scroll to the bottom of the page, and then, next to Filtering Services Availability, click Check Again to
force an update.

c. Click OK to confirm.
You should see a confirmation message indicating that the web filtering service is available.

FortiGate Security 6.0 Lab Guide 91

Fortinet Technologies Inc.
DO NOT REPRINT
© FORTINET
Exercise 1: Configuring Log Settings

To record network activity, you must configure logging on FortiGate. In this exercise, you will configure the log
settings.

Configure Log Settings

Configuring log settings does not generate logs directly on FortiGate. Rather, log settings define if, where, and
how a log is stored.

The objective of this exercise is to prepare the log settings on Local-FortiGate. For the purposes of this lab, this
includes:

l Enabling disk logging, so that logs are stored locally on FortiGate.

l Enabling Historical FortiView, so that more than just real-time information is captured in the FortiView
dashboards.
l Configuring event logging for all activity, to track and monitor events that occur on FortiGate.
l Disabling Local Traffic logging, to prevent filling up your disk too quickly with traffic going directly to and from
FortiGate.
l Configuring FortiGate to resolve hostnames, so that FortiGate performs reverse DNS lookups for all the IPs and
makes searching logs easier.

Take the Expert Challenge!

Configure the log settings on Local-FortiGate (10.0.1.254 | admin / password) according to the
objective stated above.

If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Configure Threat Weight on page 94.

To configure the log settings

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. Click Log & Report > Log Settings.
3. In the Local Log section, enable the following:

Field Value

Disk <enable>

Enable Historical FortiView <enable>

92 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT1: Configuring
REPRINT Log Settings Configure Log Settings

© FORTINET

4. In the Log Settings section, make sure the following settings are configured:

Field Value

Event Logging All

Event logs provide all of the system information generated by the FortiGate
device (they are not caused by traffic passing through firewall policies).
However, it is good practice to track and monitor events that occur on
FortiGate.

Local Traffic Log Customize - with all settings disabled

These logs record traffic directly to and from FortiGate and can fill up your disk
quickly if not properly managed and monitored. For the purposes of this lab,
leave all local traffic log options disabled.

5. In the GUI Preferences section, configure the following:

Field Value

Resolve Hostnames <enable>

Resolving hostnames requires FortiGate to perform reverse DNS lookups for

all the IPs and makes searching logs easier.

6. Click Apply.

FortiGate Security 6.0 Lab Guide 93

Fortinet Technologies Inc.
DO Configure
NOTThreat REPRINT
Weight Exercise 1: Configuring Log Settings

© FORTINET
Configure Threat Weight

To prioritize solving the most relevant issues easily, you can configure severity levels for IPS signatures, web
categories, and applications that are associated with a threat weight (or score). Threat weight allows you to set
the risk values for low, medium, high, and critical levels, and then apply a threat weight to specific categories.

The objective of this task is to set the following categories to critical status:

l Malicious Websites
l Hacking
l Explicit Violence
l Pornography
You will use threat weight later when searching for logs at a specific threat weight.

To configure threat weight

1. Continuing on the Local-FortiGate GUI, click Log & Report > Threat Weight.
2. In the Web Activity section, select the Critical option for the following categories:

3. In the Risk Level Values section, record the value associated with the Critical risk level.
You will use this information later to search for logs using the risk level value as a filter.

Risk Level Value

Critical

4. Click Apply.

94 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO NOT REPRINT
© FORTINET
Exercise 2: Enabling Logging on Firewall Policies

Now that you've defined if, where, and how a log is stored using the FortiGate log settings, you must define
whether logs are generated. To accomplish this, you must enable logging on your firewall policy. A log message
can generate only when logging is enabled on a firewall policy.

Enable Logging on a Firewall Policy

For the purposes of this lab, two firewall policies have been created for you. However, you will now need to
configure these firewall polices for logging.

The two firewall policies are:

l IPS: You will use this firewall policy to capture IPS traffic.
l Full Access: You will use this firewall policy to capture antivirus, web filter, DNS, and application control traffic.

Take the Expert Challenge!

On the Local-FortiGate GUI (10.0.1.254 | admin/password), configure logging for all sessions on
both the IPS and Full Access firewall policies. Enable the following security profiles:

IPS
l IPS | default
Full Access
l AntiVirus | default
l Web Filter | Category-block-and-warning
l DNS Filter | default
l Application Control | block-high-risk
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see Monitoring Logs Through Alert Email on page 98.

To enable logging on the IPS firewall policy

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. Click Policy & Objects > IPv4 Policy, and then edit the IPS firewall policy.

FortiGate Security 6.0 Lab Guide 95

Fortinet Technologies Inc.
DO Enable
NOT REPRINT
Logging on a Firewall Policy Exercise 2: Enabling Logging on Firewall Policies

© FORTINET

2. In the Security Profiles section, configure the following:

Security Profile Profile

IPS default

3. In the Logging Options section, enable Log Allowed Traffic, and then select All Sessions.
Remember, you will not get logs of any kind if Log Allowed Traffic is not enabled.

4. Click OK.
You've successfully enabled logging on your firewall policy. Later in this lab, you will test these log settings.

To enable logging on the Full Access firewall policy

1. Continuing on the Local-FortiGate GUI, click Policy & Objects > IPv4 Policy, and then edit the Full Access
firewall policy.

96 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT2: Enabling
REPRINT
Logging on Firewall Policies Enable Logging on a Firewall Policy

© FORTINET

2. In the Security Profiles section, configure the following:

Security Profile Profile

AntiVirus default

Web Filter Category-block-and-warning

DNS Filter default

Application Control block-high-risk

3. In the Logging Options section, enable Log Allowed Traffic, and then select All Sessions.
Remember, you will not get logs of any kind if Log Allowed Traffic is not enabled.

4. Click OK.
You've successfully enabled logging on your firewall policy. Later in this lab, you will test these log settings.

FortiGate Security 6.0 Lab Guide 97

Fortinet Technologies Inc.
DO NOT REPRINT
© FORTINET
Exercise 3: Monitoring Logs Through Alert Email

In this exercise, you will configure alert emails, run some traffic through the Local-FortiGate, and view alert
emails.

Configure Alert Emails

Because you can’t always be physically at the FortiGate device, you can monitor events by setting up alert
emails. Alert emails provide an efficient and direct method of notifying an administrator of events.

An SMTP mail server is required for alert email to operate. Because configuring a mail
server is out of scope for this lab, it has been preconfigured for you. You can view the
email service configuration on the Local-FortiGate GUI by clicking System >
Advanced.

To configure email alerts

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. Click Log & Report > Email Alert Settings.
3. Turn on the Enabled switch.
The page loads with configuration options.

4. In the Email Alert Settings section, configure the following:

Field Value

From FortiGate@training.lab

To admin@training.lab

Alert parameter Events

Interval 1

5. In the Security section, enable the following:

l Intrusion detected
l Web Filter blocked traffic
6. Click Apply.

Generate Traffic

For the purposes of this lab, you must generate traffic so you can see the logs collected by FortiGate.

98 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT3: Monitoring
REPRINT Logs Through Alert Email Generate Traffic

© FORTINET
The traffic you generate will go through Local-FortiGate. You have already enabled
the security policy on the IPS firewall policy and enabled logging for all sessions.

You will use two different tools to create different types of traffic.

Generate Traffic Through FIT

The Firewall Inspection Tester (FIT) program on the FIT VM generates web browsing traffic, application control,
botnet IP hits, malware URLs, and malware downloads.

In this lab, you will direct FIT-generated traffic through the Local-FortiGate. The FIT is behind port3 on the Local-
FortiGate. The traffic from FIT will go through the Full Access firewall policy. For more information, see
Network Topology on page 10.

You configured the Full Access firewall policy to include the following security policies and logging options:

Because FIT-generated traffic will originate from the IP of the FIT VM (10.0.1.20),
all these logs will show the same source IP in the logs. This is a limitation of the lab
environment. In a real-world scenario, you will likely see many different source IPs for
your traffic.

FortiGate Security 6.0 Lab Guide 99

Fortinet Technologies Inc.
DO Generate
NOTTraffic
REPRINT Exercise 3: Monitoring Logs Through Alert Email

© FORTINET
To generate traffic through FIT
1. Continuing on the Local-Windows VM, open PuTTY and connect over SSH to the FIT saved session.
2. At the login prompt, enter student with the password password.
3. Type the following commands:

cd FIT

./fit.py all --repeat

Traffic begins to generate and repeats the script each time it completes.

4. Leave the PuTTY session open (you can minimize it) so traffic continues to generate.
This will run throughout the remainder of this lab.

Do not close the FIT PuTTY session or traffic will stop generating.

Generate Traffic Through Nikto

Nikto generates intrusion prevention system (IPS) traffic.

You will direct the Nikto-generated traffic through Local-FortiGate. Nitko is running on the Linux VM, and the
traffic will go through the egress to ingress firewall policy named IPS. For more information, see Network
Topology on page 10.

You configured the IPS firewall policy to include the following security policy and logging options:

100 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT3: Monitoring
REPRINT Logs Through Alert Email Generate Traffic

© FORTINET
Because Nikto-generated traffic will originate from the IP of the Linux VM where Nikto
is installed (10.200.1.254), all these logs will show the same source IP in the
FortiGate logs. This is a limitation of the lab environment. In a real-world scenario, you
will likely see many different source IPs for your traffic.

To generate traffic through Nikto

1. Continuing on the Local-Windows VM, open a second PuTTY application and connect over SSH to the LINUX
saved session.
2. Log in as student with password password.
3. Type the following command:

nikto.pl -host 10.200.1.10

The vulnerability scanning will result in traffic beginning to generate.

The scan will continue for approximately 25 minutes. The dialog displays an End Time and indication that 1
host is tested when complete.

You can run the command again after the scan completes (press the up arrow and then press Enter) to
generate more logs, but it's not required. One cycle will provide enough logs for the purposes of this lab.

4. Leave the PuTTY session open (you can minimize it) so traffic continues to generate.
This will run for the remainder of the lab.

Do not close the LINUX PuTTY session or traffic will stop generating.

FortiGate Security 6.0 Lab Guide 101

Fortinet Technologies Inc.
DO View
NOT REPRINT
Alert Emails Exercise 3: Monitoring Logs Through Alert Email

© FORTINET
View Alert Emails

Now that traffic is being sent through your FortiGate, you can check the admin@training.lab email to see if any
alerts have been generated based on that traffic. You configured the alert email to generate an alert every one
minute any time an intrusion is detected by the IPS security profile on the IPS firewall policy, and any time the
web filter security profile blocks traffic on the Full Access firewall policy.

The log message that accompanies an alert provides more details about the traffic that caused the alert.

To view your alert emails

1. Continuing on Local-Windows, on the desktop, open Mozilla Thunderbird.

2. Select the inbox of the admin@training.lab email account and click Get Messages.
You should see a message in the admin inbox with a subject of "Message meets Alert condition". If no email
appears in the inbox, wait 30 seconds, and then click Get Messages again.

3. Open any alert email and review the log message.

As you can see, the log message is in raw format. In the web filter example below (you may receive a
different log message), the log message header provides the type (utm) and subtype (webfilter). The log
message body provides information about the web filter security profile that was applied to the traffic
(Category_block-and-warning), the action it took (blocked), and the category description of the traffic
(Malicious Websites).

4. Open another alert email and record the following information from a single web filter log:

Field Value

date

time

logid

subtype

level

102 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT3: Monitoring
REPRINT Logs Through Alert Email View Alert Emails

© FORTINET
Field Value

sessionid

profile

catdesc

crscore

You will locate this log on the Local-FortiGate GUI in the next exercise.

5. Select the email of the log you recorded by clicking the star icon to the left of the email subject.
The star icon turns yellow.

If you would like to review more alert emails, click Get Messages in your admin inbox
again. You configured your alert email to send messages that meet the alert condition
every one minute.

6. Close the Thunderbird email client when you are finished.

FortiGate Security 6.0 Lab Guide 103

Fortinet Technologies Inc.
DO NOT REPRINT
© FORTINET
Exercise 4: Viewing Logs on the FortiGate GUI

In this exercise, you will view logs using both the Log & Report and FortiView menus of the Local-FortiGate
GUI. You will also configure filter options to locate specific logs.

View Logs from Log & Report

In this exercise, you will examine the logs on the Local-FortiGate GUI, based on the traffic you generated from
the FIT VM and Nikto.

Forward Traffic
The first place you will examine logs is on the Forward Traffic page.

All security profile-related logs are tracked within the forward traffic logs, so you can search all forward traffic in
one place. This is helpful if you are looking to see all activity from a particular address, security feature, or traffic.
Security profile logs are still tracked separately in the GUI, but only appear when logs exist.

To view and filter forward traffic logs

1. On the Local-Windows VM, open a browser and log in to the Local-FortiGate GUI at 10.0.1.254 with the user
name admin and password password.
2. Click Log & Report > Forward Traffic.
3. To narrow down the logs (results), on the search bar, click Add Filter, and then add some filters. For example:

104 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT4: Viewing
REPRINT
Logs on the FortiGate GUI View Logs from Log & Report

© FORTINET
Filter Value

Date/Time Last 5 Minutes

This filters on all logs from the last 5 minutes.

Result Deny (all)

This filters on all blocked traffic.

Threat Score >=50

This filters on all Web activity greater than or equal to the Critical (50) risk
level.

Remember, you set Malicious Websites, Hacking, Explicit Violence, and

Pornography to the critical risk level.

If the information on which you are filtering does not appear in the table, you may
need to add the related column to the table. To do so, right-click any column in the
table and select the column you want to add. For example, to view the Threat Score
column, add Threat Score. At the bottom of the list, click Apply to refresh the table
with the new column.

4. Double-click the log you want to view.

The Log Details pane appears on the right side of the page.

FortiGate Security 6.0 Lab Guide 105

Fortinet Technologies Inc.
DO View
NOT REPRINT
Logs from Log & Report Exercise 4: Viewing Logs on the FortiGate GUI

© FORTINET

5. View both the Details and Security tabs to see what information is available.

Security Profile Logs

Now, you will examine the security profile logs, which are tracked separately on the GUI. The menu item for the
specific security profile only appears on the GUI if logs of that type exist.

To view web filter logs

1. Continuing on the Local-FortiGate GUI, click Log & Report > Web Filter.

If this menu item does not display, you can refresh the page, or log out of the Local-
FortiGate GUI and log in again.

2. Locate the log in the alert email that you recorded in To view your alert emails on page 102 by using log filters.

106 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT4: Viewing
REPRINT
Logs on the FortiGate GUI View and Filter IPS Logs

© FORTINET
Stop and think!
Which filter would best return the specific log you are seeking? For example, filters based on log subtype or
crscore would most likely return too many logs, making the search inefficient.

Answer: Log original timestamp or Session ID.

3. After you locate the log, double-click the entry to view the log details.
As you can see, the log details in the alert email are the same as the log details on the GUI. The only
difference is the format. Alert emails provide the log detail information in raw format, while the GUI provides
the log detail information in a formatted format.

View and Filter IPS Logs

In this exercise, you will view and filter IPS logs.

Take the Expert Challenge!

On the Local-FortiGate GUI (10.0.1.254), complete the following:

l View the GUI page that shows intrusion prevention logs only.
l Filter for a log with the attack name NetworkActiv.Web.Server.XSS.
l View information about the attack on FortiGuard.
If you require assistance, or to verify your work, use the step-by-step instructions that follow.

After you complete the challenge, see View Logs in FortiView on page 108.

To view and filter IPS logs

1. Continuing on the Local-FortiGate GUI, click Log & Report > Intrusion Prevention.
2. Double-click any IPS log to view more information about an attack.
3. In the Log Details pane, under Intrusion Prevention, click the reference link.

FortiGate Security 6.0 Lab Guide 107

Fortinet Technologies Inc.
DO View
NOT Logs inREPRINT
FortiView Exercise 4: Viewing Logs on the FortiGate GUI

© FORTINET

This takes you to the FortiGuard website, where you can gather more information about the specific attack,
such as the description of the attack, affected products, impact, and recommended actions.

4. After you finish, close the FortiGuard tab.

View Logs in FortiView

FortiView is a comprehensive monitoring system for your network that integrates real-time and historical data into
a single view on your FortiGate.

Now, you will view your logs in FortiView.

To view logs in FortiView

1. Continuing on the Local-FortiGate GUI, click FortiView > Web Sites.
By default, the search settings are set to display logs being created now. If no logs are being created
currently, the page will be blank. This is expected.

2. Use the search settings to display the Web activity in a different way. For example:
l Select Categories and 1 hour to see the Web categories most accessed in the last hour.

108 FortiGate Security 6.0 Lab Guide

Fortinet Technologies Inc.
DO Exercise
NOT4: Viewing
REPRINT
Logs on the FortiGate GUI View Logs in FortiView

© FORTINET

l Click the table icon ( ), and then select Bubble Chart.

l Use the Sort By drop-down menu to display the information by Threat Score, Sessions, Browsing Time or
Bytes.

3. Click FortiView > Threats.

4. Use the filters and sort options to examine different ways you can view the threats to the network.

Close both the FIT and LINUX PuTTY sessions to stop log generation.

FortiGate Security 6.0 Lab Guide 109

Fortinet Technologies Inc.