FortinetConfig0 downloads

Fortinet FortiOS SNMP v3 and Syslog

SNMPv3 with host restriction, per-interface SNMP access control, syslog to multiple collectors with severity filtering, and NTP - configured per VDOM where VDOMs are enabled.

↓ example.txt

What is it?

SNMP and syslog are how a FortiGate tells you what it is doing. SNMP is polled: the monitoring system asks for counters such as session count, CPU, memory and interface throughput. Syslog is pushed: the firewall sends events as they occur, including traffic logs, VPN negotiations, admin logins and configuration changes. FortiOS differs from most platforms in two ways that cause most of the setup problems. First, SNMP will not respond unless the interface's `allowaccess` list includes it, no matter how correct the SNMP configuration is. Second, where VDOMs are enabled, logging is configured per VDOM, so configuring it in root does nothing for traffic in another VDOM.

When to use

·Every FortiGate in production, configured at deployment time alongside the base config
·Capacity planning: session count and memory are the two counters that predict when a FortiGate needs replacing
·Security operations: traffic and UTM logs forwarded to a SIEM are usually the point of having the firewall at all
·Change auditing: FortiOS logs every configuration change with the admin account that made it
·HA monitoring: the ha-switch and ha-hb-failure traps tell you about a failover as it happens, rather than at the next poll

When NOT to use

·SNMPv1 or v2c anywhere reachable from untrusted networks - the community string is cleartext
·Forwarding `forward-traffic` logs at `information` severity from a busy edge firewall without checking the volume first. A FortiGate at scale can emit tens of thousands of events per second and overwhelm both the link and a licensed SIEM
·Disk logging on entry-level models with no SSD. Logging to flash wears it out; use remote logging only on those platforms
·Relying on syslog alone for FortiAnalyzer-style reporting. If you have FortiAnalyzer, use it - the native integration carries structured data that plain syslog loses
·Enabling every event filter on a device with limited CPU - log generation is not free

How it compares

vs Cisco ASA SNMP/SyslogThe ASA controls SNMP access with `snmp-server host <interface> <ip>`, naming the interface inline. FortiOS separates the two: SNMP users define who may poll, and the interface `allowaccess` list independently decides whether SNMP is answered at all. Forgetting the second step is the most common FortiOS-specific failure.

vs Palo Alto PAN-OS SNMP/SyslogPAN-OS attaches log forwarding to security policy rules through a log forwarding profile, so you choose per-rule what gets logged. FortiOS filters globally per syslog target with `config log syslogd filter`. PAN-OS gives finer control per rule; FortiOS is simpler to configure but coarser.

vs Cisco IOS SNMP/SyslogIOS has one global configuration. FortiOS with VDOMs enabled has a configuration per VDOM, and logging configured in root does not apply to other VDOMs. This surprises people migrating from a single-context platform.

vs FortiAnalyzerPlain syslog sends text. FortiAnalyzer receives structured logs with full UTM detail and provides correlation, reporting and long-term archival. If FortiAnalyzer is available, send to it and treat syslog as a secondary feed to the SIEM.

Prerequisites

→Management reachability to the NMS and the syslog collector, from the correct VDOM
→NTP configured first - SNMPv3 authentication is time-sensitive and timestamps must be correct
→Knowledge of whether VDOMs are enabled, since that changes where logging is configured
→SNMPv3 credentials stored in a secrets manager, not in the repository
→An estimate of log volume before enabling forward-traffic logging on a busy firewall

Config Generator

Hostname *

VDOM

Leave as root unless VDOMs are enabled. Logging is configured per VDOM

SNMP Location

SNMP Contact

SNMPv3 Username *

SNMPv3 Auth Password *

SHA authentication. Never commit the real value

SNMPv3 Privacy Password *

AES encryption. Use a different value from the auth password

SNMP Pollers *

Management Interface *

SNMP must be allowed in this interface's allowaccess list or polls never arrive

Primary Syslog Server *

Secondary Syslog Server

FortiOS configures each collector as its own numbered block (syslogd, syslogd2...), not as a list

Syslog Port

Minimum Severity

emergency, alert, critical, error, warning, notification, information, debug

Primary NTP Server *

Secondary NTP Server

Timezone Index

FortiOS uses numeric timezone indexes. 04 is GMT/UTC. Run 'set timezone ?' to list them

Verification commands

get system snmp sysinfo

Confirm the SNMP agent is enabled and show the system description

ExpectedStatus enable, with location and contact populated. If status is disable, nothing else in the SNMP configuration matters.

show system interface <mgmt_interface> | grep allowaccess

Confirm the interface actually permits SNMP

Expected`snmp` present in the allowaccess list. This is the step most often missed - the SNMP configuration can be perfect and the device still will not answer a poll.

diagnose sniffer packet any 'udp port 161' 4

Confirm poll packets are arriving at the firewall

ExpectedInbound packets from the NMS address. No packets means a routing or upstream filtering problem rather than a FortiOS configuration problem.

execute log display

Show recent log entries from local storage

ExpectedRecent events. If local logging is empty, the event filters are off or disk logging is disabled.

Debug commands

diagnose debug application snmpd -1\ndiagnose debug enable

Trace SNMP agent processing, including authentication failures

WarningVerbose on a polled device. Always finish with `diagnose debug disable` and `diagnose debug reset` - leaving debug enabled measurably affects CPU.

diagnose sniffer packet any 'host 10.0.0.60 and port 514' 4

Confirm syslog is actually leaving the firewall

WarningShows traffic only while running. On a busy firewall add a tighter filter, and stop it with Ctrl-C rather than leaving it running.

diagnose test application miglogd 6

Show log daemon statistics including dropped messages

WarningThe daemon numbers vary by FortiOS version; confirm the right number for your release before relying on the output.

Common mistakes & fixes

SymptomSNMP is configured correctly but the NMS gets no response

CauseThe interface allowaccess list does not include snmp

FixThis is the FortiOS-specific trap. `config system interface / edit <port> / append allowaccess snmp`. Use `append` rather than `set` - `set` replaces the whole list and will remove ping and https along with it, potentially locking you out.

SymptomLogging works in root but not in another VDOM

CauseLogging is configured per VDOM, and the configuration was applied only to root

FixEnter the VDOM first: `config vdom / edit <vdom>` then configure `log syslogd setting` there. Verify with `diagnose log test` from inside the VDOM.

SymptomThe syslog collector is flooded and the link is saturated

Causeforward-traffic logging enabled at information severity on a high-throughput firewall

FixRaise the severity to `warning` or `notification`, or disable forward-traffic and keep only event and UTM logs. Measure first: `diagnose sys session stat` gives a sense of session rate and therefore log volume.

SymptomSNMPv3 polls fail while v2c would have worked

CauseAuth or privacy protocol mismatch between the firewall and the NMS

FixFortiOS supports sha256/aes256 on recent releases, but many NMS platforms default to sha1/aes128. Confirm both ends use the same pair, and that security-level is auth-priv on both.

SymptomLog timestamps are wrong by hours

CauseTimezone index set incorrectly, or NTP not synchronising

FixFortiOS uses numeric timezone indexes rather than names - `set timezone ?` lists them, and 04 is GMT. Confirm sync with `diagnose sys ntp status`. Use UTC across all sites to make correlation possible.

Further learning

Recommended books to go deeper on this topic.

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · Network management: SNMP v1/v2c/v3, syslog levels, NTP, NetFlow

Kindle ↗Hardcover ↗