Including zone information fields in logs

Source and destination zone fields can be enabled for logs to enhance scalability and efficiency in log management. This reduces the need to search logs by individual interfaces within zones.

CLI syntax

The srczone and dstzone fields can be enabled in logs using the following command:

config log setting
    set zone-name {enable | disable}
end

Example

The following example demonstrates configuring zone information in a firewall policy and enabling it so that this information is displayed in the logs.

To enable zone information fields in the logs:

1. Enable the inclusion of the zone fields in logs:

   config log setting
       set zone-name enable
   end

2. Configure the zones:

   config system zone
       edit "zone-1"
           set interface "port1" "port15"
       next
       edit "zone-2"
           set interface "port2" "port16"
       next
   end

3. Apply the zones in a firewall policy:

   config firewall policy
       edit 1
           set name "out"
           set srcintf "zone-1"
           set dstintf "zone-2"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set srcaddr6 "all"
           set dstaddr6 "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set av-profile "av"
           set logtraffic all
           set nat enable
       next
   end

4. Review the traffic logs:

   #execute log display
   date=2025-05-29 time=11:51:21 eventtime=1748544681417779289 tz="-0700" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" srcip=10.1.100.22 srcport=45970 srcintf="port1" srcintfrole="undefined" srczone="zone-1" dstip=172.16.200.44 dstport=22 dstintf="port2" dstintfrole="undefined" dstzone="zone-2" srccountry="Reserved" dstcountry="Reserved" sessionid=2754 proto=6 action="close" policyid=1 policytype="policy" poluuid="e12d3e48-3cb4-51f0-3e20-28d63a9401de" policyname="out" service="SSH" trandisp="snat" transip=172.16.200.2 transport=45970 appcat="unscanned" duration=4 sentbyte=2621 rcvdbyte=2437 sentpkt=17 rcvdpkt=14
   
   date=2025-05-29 time=11:52:15 eventtime=1748544734697773392 tz="-0700" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="vdom1" srcip=10.1.100.22 srcport=35680 srcintf="port1" srcintfrole="undefined" srczone="zone-1" dstip=172.16.200.55 dstport=80 dstintf="port2" dstintfrole="undefined" dstzone="zone-2" srccountry="Reserved" dstcountry="Reserved" sessionid=2756 proto=6 action="close" policyid=1 policytype="policy" poluuid="e12d3e48-3cb4-51f0-3e20-28d63a9401de" policyname="out" service="HTTP" trandisp="snat" transip=172.16.200.2 transport=35680 appcat="unscanned" duration=30 sentbyte=1732 rcvdbyte=1972 sentpkt=30 rcvdpkt=8 utmaction="block" countav=1 crscore=50 craction=2 utmref=65528-28

5. Review the UTM logs:

   #execute log display
   date=2025-05-29 time=11:51:45 eventtime=1748544704623697175 tz="-0700" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="vdom1" policyid=1 poluuid="e12d3e48-3cb4-51f0-3e20-28d63a9401de" policytype="policy" msg="File is infected." action="blocked" service="HTTP" sessionid=2756 srcip=10.1.100.22 dstip=172.16.200.55 srcport=35680 dstport=80 srccountry="Reserved" dstcountry="Reserved" srcintf="port1" srcintfrole="undefined" srczone="zone-1" dstintf="port2" dstintfrole="undefined" dstzone="zone-2" srcuuid="85bf1200-90ae-51ef-7a00-759244bb35e4" dstuuid="85bf1200-90ae-51ef-7a00-759244bb35e4" proto=6 direction="incoming" filename="eicar.com" checksum="6851cf3c" quarskip="No-skip" virus="EICAR_TEST_FILE" viruscat="Virus" dtype="av-engine" itype="infected" ref="https://fortiguard.com/encyclopedia/virus/2172" virusid=2172 url="http://172.16.200.55/virus/eicar.com" profile="av" agent="curl/7.68.0" httpmethod="GET" analyticscksum="275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"

6. Review the interface cache for zone information:

   # diagnose test application miglogd 18
   Network interface cache (version=6):
           ID=50, name=fortilink, phy=, role=undefined, vfid=0 type=2 detail=0
           ID=4, name=ha, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=40, name=l2t.root, phy=, role=undefined, vfid=0 type=3 detail=0
           ID=44, name=l2t.vdom1, phy=, role=undefined, vfid=1 type=3 detail=0
           ID=48, name=l2t.vdom2, phy=, role=undefined, vfid=2 type=3 detail=0
           ID=3, name=mgmt, phy=, role=lan, vfid=1 type=0 detail=0
           ID=37, name=modem, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=39, name=naf.root, phy=, role=undefined, vfid=0 type=3 detail=0
           ID=43, name=naf.vdom1, phy=, role=undefined, vfid=1 type=3 detail=0
           ID=47, name=naf.vdom2, phy=, role=undefined, vfid=2 type=3 detail=0
           ID=35, name=npu0_vlink0, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=36, name=npu0_vlink1, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=7, name=port1, phy=, role=undefined, vfid=1 type=0 detail=0, zone-name: zone-1, zone_id:1, zone:zone-1
           ID=8, name=port2, phy=, role=undefined, vfid=1 type=0 detail=0, zone-name: zone-2, zone_id:2, zone:zone-2
           ID=9, name=port3, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=10, name=port4, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=11, name=port5, phy=, role=undefined, vfid=2 type=0 detail=0
           ID=12, name=port6, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=13, name=port7, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=14, name=port8, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=15, name=port9, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=16, name=port10, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=17, name=port11, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=18, name=port12, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=19, name=port13, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=20, name=port14, phy=, role=undefined, vfid=0 type=0 detail=0
           ID=21, name=port15, phy=, role=undefined, vfid=1 type=0 detail=0, zone-name: zone-1, zone_id:1, zone:zone-1
           ID=22, name=port16, phy=, role=undefined, vfid=1 type=0 detail=0, zone-name: zone-2, zone_id:2, zone:zone-2