In my network, a specific url is being blocked by fortiguard firewall. Now I want to know which all devices had tried to access that blocked url. I traced the mac address inside the packet. But how will I know which person has tried to access blocked url if the device in no longer connected to that network ?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 16:19

You could track that by going to Destinations in Fortiview, or if it is blocked by Fortigate you can find more info from FortiView-Web sites

  • if that is accessed through wireless device, and the device is not in the network now, can I trace the ip ??? – abby rj Apr 17 '17 at 10:07
  • @abbyrj, packets have both the source and destination IP addresses in the packet header. The firewall usually has a log of all denied access attempts, including the source address that tries the attempt. – Ron Maupin Apr 17 '17 at 10:38
  • I agree. Imagine a there is 10 wireless devices (including laptops and tablets) connected to a WAP. The IP assigned to the device 'A' will be assigned to other device which is newly connected to the network after the device 'A' leaves the network. In this case, how will I know the device that has accessed the blocked url after few days ?? (say; a month) – abby rj Apr 17 '17 at 10:54
  • Your dhcp server should log which MAC address was granted what IP address at what time. Find the time of the access, then go backwards in your dhcp logs from that time until you find the IP being allocated/renewed. Done. – David Mackintosh Apr 17 '17 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.