FortiGate Syslog UDP Setup

Step 1: Configure Syslog Destination

You can configure the Syslog server target either through the Web GUI or using the CLI (recommended for custom UDP ports).

The FortiGate GUI configures the default Syslog port (UDP 514). If you need to use a custom port, use the CLI tab instead.

Run the following commands in the FortiGate CLI console:

config log syslogd setting
    set status enable
    set server "192.168.1.100"
    set mode udp
    set port 514
    set facility local7
end

Replace 192.168.1.100 with your Syslog server IP and 514 with your target UDP port.

Step 2: Enable Logging on Firewall Policies

Traffic logs are only generated and sent if logging is explicitly enabled on the relevant firewall policies.

Open Firewall Policies

Navigate to Policy & Objects > Firewall Policy.

Configure LAN -> WAN Policy

Configure WAN -> LAN Policy

Select the inbound rule (WAN to LAN, e.g., VIPs / Port Forwarding) and click Edit.
Enable Log Allowed Traffic > All Sessions.
Click OK.

Step 1: Configure Syslog Destination