I'm trying to understand some Fortinet firewall logs but I'm not sure I fully understand what is being logged by the firewall when it comes to direction (Incoming vs Outgoing)

For example:

srcip= dstip= srcport=45845 dstport=80 srcintf="port5" srcintfrole="wan" dstintf="port10" dstintfrole="lan" proto=6 direction="outgoing"

I'm not sure why that would be categorized as outgoing instead of incoming. Since the traffic appears to be initiated from an external source. Would it not be incoming traffic? Or is it because the last interface is it hits is the LAN interface and it's "outgoing" from there?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:02

Fortigate firewalls log each connection with the initiator as source, ie. for normal Internet access the LAN client (initiator) is always the source. For virtual IPs/port forwarding the WAN client is the source. Often, this does not reflect the data flow direction.

Your example is a virtual IP/forwarded port from a WAN client (srcintfrole) to the LAN server (dstintfrole).

I'd guess the "outgoing" indicates the actual data flow direction for the log item - strangely, I don't see this column on our 100D (v5.6.5)...

| improve this answer | |

With IPS enabled the direction field tells you in which direction an attack was detected.

If a session is initiated and the initiator attacks the destination the direction is outgoing.

If a session is initiated and the source gets attacked from the destination server the direction is incoming.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.