3

I'm trying to understand some Fortinet firewall logs but I'm not sure I fully understand what is being logged by the firewall when it comes to direction (Incoming vs Outgoing)

For example:

srcip=7.7.7.7 dstip=192.168.10.50 srcport=45845 dstport=80 srcintf="port5" srcintfrole="wan" dstintf="port10" dstintfrole="lan" proto=6 direction="outgoing"

I'm not sure why that would be categorized as outgoing instead of incoming. Since the traffic appears to be initiated from an external source. Would it not be incoming traffic? Or is it because the last interface is it hits is the LAN interface and it's "outgoing" from there?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 31 '20 at 19:42
1

Fortigate firewalls log each connection with the initiator as source, ie. for normal Internet access the LAN client (initiator) is always the source. For virtual IPs/port forwarding the WAN client is the source. Often, this does not reflect the data flow direction.

Your example is a virtual IP/forwarded port from a WAN client (srcintfrole) to the LAN server (dstintfrole).

I'd guess the "outgoing" indicates the actual data flow direction for the log item - strangely, I don't see this column on our 100D (v5.6.5)...

0

With IPS enabled the direction field tells you in which direction an attack was detected.

If a session is initiated and the initiator attacks the destination the direction is outgoing.

If a session is initiated and the source gets attacked from the destination server the direction is incoming.

0

The connection initiated from external networks which hits egress interfàce of firewall and transverse to Lan interfàce of firewall .. considered as incoming traffic or inbound traffic ..

The connection initiated from internal network which hits on ingress interface of firewall and transverse to egress interfàce where ISP link is connected .. consider as outbound traffic or outgoing traffic ..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.