Local in and local out logging

Traffic generated by the FortiGate (local out) or traffic destined for the FortiGate (local in) is not handled by the same policies as forward traffic (traffic that is intended to pass through the FortiGate).

While forward traffic is handled by the policies found in firewall policies, local in traffic is controlled using interface configuration, such as enabling or disabling Administrative access traffic (HTTPS, PING, SSH, and so on), as well as the local in policy. By default, local in policies exist to allow traffic enabled by interface settings and FortiGate services such as IPsec and central management. See Firewall policy and Local-in policy.

Default local in policies do not have a policy ID and their logs will show policyid=0. This is not the same as the forward traffic firewall policies, where policyid=0 is the implicit deny. User-defined local in policies will include a policy ID.

Local out logs are not filtered by the FortiGate and by default rely on routing table lookups to determine the egress interface that is used to initiate the connection. See Local out traffic.

To enable local traffic logging and to review a sample local traffic log, see Traffic Logs > Local Traffic.

Logging local traffic per local-in policy

Starting in 7.6.0, local traffic logging can be configured for each local-in policy. This enables more precise and targeted logging by focusing on specific local-in policies that are most relevant to your needs.

Logging can be configured per local-in policy in the Log & Report > Log Settings page or by using the following commands:

config log setting
    set local-in-policy-log {enable | disable}
end
config firewall local-in-policy
    edit <id>
        set logtraffic {enable | disable}
    next
end
config firewall local-in-policy6
    edit <id>
        set logtraffic {enable | disable}
    next
end

For more information, see Logging local traffic per local-in policy.