Skip to main content

​
Set up

  1. Follow the shared Log Forwarders guide to add Fortinet and open Forwarder Details
  2. Login to your Fortinet instance
  3. Configure syslog forwarding using one of the methods below

​
GUI configuration

Use this method when your FortiGate UI lets you specify both the syslog server address and port.
  1. Go to Settings > Log & Report > Log Settings
  2. Click the Syslog Server tab
  3. Click Add to display the configuration dialog
  4. Provide the IP and listener port from Forwarder Details
  5. Click Apply
Fortinet GUI documentation reference Some FortiGate models and firmware versions do not let you specify a custom syslog port in the web UI. The GUI may only support forwarding to port 514 (the default syslog port), which is not the port Wirespeed assigns. Use the FortiGate CLI to forward syslog to the IP address and port from Forwarder Details. We recommend the CLI path whenever the UI cannot target your Wirespeed-assigned port.
  1. Connect to your FortiGate via SSH or the CLI console
  2. Run the following commands, replacing <WIRESPEED_IP> and <WIRESPEED_PORT> with the values from Forwarder Details:
  1. If your FortiGate must send syslog from a specific source IP, add set source-ip "<SOURCE_IP>" before end
  2. If syslogd is already in use, repeat the commands with syslogd2, syslogd3, or syslogd4 instead. FortiGate supports up to four syslog destinations.
Fortinet CLI reference: config log syslogd setting
Note: Coalition’s claims data shows that companies using SSL VPN solutions have a significantly higher frequency of breaches and claims. Using Wirespeed helps reduce this risk substantially, but it remains important to ensure that MFA is enforced for all users and to patch devices promptly when new security issues are reported. We strongly recommend signing up for a premium Coalition Control account so you can be kept aware of new vulnerabilities in these devices.