> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FortiGate Syslog UDP Setup

> Quick guide to enable FortiGate log forwarding via UDP for WAN and LAN policies.

This guide covers how to forward FortiGate traffic logs (WAN to LAN and vice versa) to a specific IP address and UDP port using Syslog, via both the **GUI** and **CLI**.

## Step 1: Configure Syslog Destination

You can configure the Syslog server target either through the Web GUI or using the CLI (recommended for custom UDP ports).

<Tabs>
  <Tab title="GUI (Web Console)">
    1. Go to **Log & Report** > **Log Settings**.
    2. Toggle on **Send Logs to Syslog**.
    3. Enter the **IP Address/Name** of your Syslog server.
    4. Set **Mode** to **UDP** (or leave default if standard port 514 is used).
    5. Click **Apply** at the bottom of the page.

    <Note>
      The FortiGate GUI configures the default Syslog port (`UDP 514`). If you need to use a custom port, use the CLI tab instead.
    </Note>
  </Tab>

  <Tab title="CLI (Custom Port)">
    Run the following commands in the FortiGate CLI console:

    ```text theme={null}
    config log syslogd setting
        set status enable
        set server "192.168.1.100"
        set mode udp
        set port 514
        set facility local7
    end
    ```

    <Warning>
      Replace `192.168.1.100` with your Syslog server IP and `514` with your target UDP port.
    </Warning>
  </Tab>
</Tabs>

***

## Step 2: Enable Logging on Firewall Policies

Traffic logs are only generated and sent if logging is explicitly enabled on the relevant firewall policies.

<Steps>
  <Step title="Open Firewall Policies">
    Navigate to **Policy & Objects** > **Firewall Policy**.
  </Step>

  <Step title="Configure LAN -> WAN Policy">
    1. Select the outbound rule (**LAN to WAN**) and click **Edit**.
    2. Scroll down to the **Logging Options** section.
    3. Enable **Log Allowed Traffic**.
    4. Select **All Sessions** to capture all connections.
    5. Click **OK**.
  </Step>

  <Step title="Configure WAN -> LAN Policy">
    1. Select the inbound rule (**WAN to LAN**, e.g., VIPs / Port Forwarding) and click **Edit**.
    2. Enable **Log Allowed Traffic** > **All Sessions**.
    3. Click **OK**.
  </Step>
</Steps>

***

## Step 3: Verify Traffic Output

To verify that Syslog UDP packets are actively being sent from the FortiGate, run a packet trace via CLI:

```text theme={null}
diagnose sniffer packet any 'host 192.168.1.100 and port 514' 4 0 l
```