Local in and local out logging

Traffic generated by the FortiGate (local out) or traffic destined for the FortiGate (local in) is not handled by the same policies as forward traffic (traffic that is intended to pass through the FortiGate).

While forward traffic is handled by the policies found in firewall policies, local in traffic is controlled using interface configuration, such as enabling or disabling Administrative access traffic (HTTPS, PING, SSH, and so on), as well as the local in policy. By default, local in policies exist to allow traffic enabled by interface settings and FortiGate services such as IPsec and central management. See Firewall policy and Local-in policy.

Default local in policies do not have a policy ID and their logs will show policyid=0. This is not the same as the forward traffic firewall policies, where policyid=0 is the implicit deny. User-defined local in policies will include a policy ID.

Local out logs are not filtered by the FortiGate and by default rely on routing table lookups to determine the egress interface that is used to initiate the connection. See Local out traffic.

To enable local traffic logging and to review a sample local traffic log, see Traffic Logs > Local Traffic.