Fortinet black logo

Syslog sources

Syslog sources

The FortiAuthenticator can parse username and IP address information from a syslog feed from a third-party device, and inject this information into FSSO so it can be used in FortiGate identity based policies.

Syslog objects include sources and matching rules. Sources identify the entities sending the syslog messages, and matching rules extract the events from the syslog messages. Messages coming from non-configured sources will be dropped.

note icon Injection of IPv6 addresses using Syslog-to-FSSO and API-to-FSSO is supported. IPv6 addresses are accepted by the backend parsing engine.

To configure syslog objects, go to Fortinet SSO Methods > SSO > Syslog Sources.

Syslog SSO must be enabled to configure syslog objects. Go to Fortinet SSO Methods > SSO > General to enable Syslog SSO. See General settings.

The following options and information are available:

Create New Create a new syslog source or matching rule.
Delete Select to delete the selected object or objects.
Edit Select to edit the selected object.
View Select Syslog Sources or Matching Rules from the dropdown menu.
Name The name of the source or rule.
Client name/IP The IP address or the client.

Syslog sources

Each syslog source must be defined for the syslog daemon to accept traffic. Each source must also be configured with a matching rule (either pre-defined or custom built; see below), and syslog service must be enabled on the network interface(s) that will listen to remote syslog traffic.

To add a new syslog source:
  1. In the syslog list, select Syslog Sources from the View dropdown menu.
  2. Select Create New. The Create New Syslog Source page ones.
  3. Enter the following information:
  4. Name Enter a name for the source.
    IP address Enter the IP address of the source.
    Matching rule Select the requisite matching rule from the dropdown menu. A matching must already be created for the source.
    SSO user type

    Select the SSO user type:

    • External: Users are not defined on the FortiAuthenticator and user groups come from the source.
    • Local users: Users are defined on the FortiAuthenticator as local users, and user groups are retrieved from the local groups. Any group from the syslog messages are ignored.
    • Remote users: Users are defined on a remote LDAP server and user groups are retrieved from the LDAP server. Any group from the syslog messages are ignored.
    Strip off prefix or suffix from username if any Enable to strip prefixes and suffixes from the SSO usernames.
  5. Select OK to add the source.

Matching rules

A matching rule is a query, or policy, that is applied to a syslog message in order to determine required information, such as the username and IP address. Rules are required for every syslog source.

Predefined rules are available for FortiNAC appliances, and Aruba and Cisco wireless controllers (see Predefined rules). For other systems, custom policies can be created to parse message files in various formats.

Predefined rules

Predefined matching rules are included for FortiNAC appliances, and Aruba and Cisco ACS or ISE wireless controllers.

FortiNAC

Trigger FSSO
Auth Type Indicators Logon: login

Logoff: logout

Username field username={{:username}}
Client IPv4 field IP={{:client_ip}}
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},:
Group field tags="{{:group}}"
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Aruba

Trigger None; any logs are accepted.
Auth Type Indicators Logon: User Authentication Successful (exact match required; no delimiter or value)
Username field username={{:username}}
Client IPv4 field IP={{:client_ip}}
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},:
Group field AAA profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Cisco

Trigger NOTICE Radius-Accounting
Auth Type Indicators

Logon: Acct-Status-Type=Start

Update: Acct-Status-Type=Interim

Logoff: Acct-Status-Type=Stop

Username field User-Name={{:username}},
Client IPv4 field Framed-IP-Address={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},:
Group field e.g. profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).
To create a new matching rule:
  1. In the syslog list, select Matching Rules from the View dropdown menu.
  2. Select Create New. The Create New Syslog Matching Rule page opens.
  3. Enter the following information:
  4. Name Enter a name for the source.
    Description Optionally enter a description of the rule.
    Fields to Extract Configure the fields to extract from the message.
    Trigger Optionally, enter a string that must be present in all syslog messages. This will act as a pre-filter.
    Auth Type Indicators Enter strings to differentiate between the types of user activities: Logon, Update (optional), and Logoff (optional).
    Username field Define the semantics of the username field. For example: User-Name={{:username}}, where {{:username}} indicates where the username is extracted from.
    Client IPv4 field Define the semantics of the client IPv4 address.
    Client IPv6 field Define the semantics of the client IPv6 address.
    Group field

    Optionally, define the semantics of the group. The group may not always be included in the syslog message, and may need to be retrieved from a remote LDAP server.

    Use the Group list separator to specify the separator.

    Test Rule Paste a sample log message into the text box, then select Test to test that the desired fields are correctly extracted.
  5. Select OK to add the new matching rule.

Syslog sources

The FortiAuthenticator can parse username and IP address information from a syslog feed from a third-party device, and inject this information into FSSO so it can be used in FortiGate identity based policies.

Syslog objects include sources and matching rules. Sources identify the entities sending the syslog messages, and matching rules extract the events from the syslog messages. Messages coming from non-configured sources will be dropped.

note icon Injection of IPv6 addresses using Syslog-to-FSSO and API-to-FSSO is supported. IPv6 addresses are accepted by the backend parsing engine.

To configure syslog objects, go to Fortinet SSO Methods > SSO > Syslog Sources.

Syslog SSO must be enabled to configure syslog objects. Go to Fortinet SSO Methods > SSO > General to enable Syslog SSO. See General settings.

The following options and information are available:

Create New Create a new syslog source or matching rule.
Delete Select to delete the selected object or objects.
Edit Select to edit the selected object.
View Select Syslog Sources or Matching Rules from the dropdown menu.
Name The name of the source or rule.
Client name/IP The IP address or the client.

Syslog sources

Each syslog source must be defined for the syslog daemon to accept traffic. Each source must also be configured with a matching rule (either pre-defined or custom built; see below), and syslog service must be enabled on the network interface(s) that will listen to remote syslog traffic.

To add a new syslog source:
  1. In the syslog list, select Syslog Sources from the View dropdown menu.
  2. Select Create New. The Create New Syslog Source page ones.
  3. Enter the following information:
  4. Name Enter a name for the source.
    IP address Enter the IP address of the source.
    Matching rule Select the requisite matching rule from the dropdown menu. A matching must already be created for the source.
    SSO user type

    Select the SSO user type:

    • External: Users are not defined on the FortiAuthenticator and user groups come from the source.
    • Local users: Users are defined on the FortiAuthenticator as local users, and user groups are retrieved from the local groups. Any group from the syslog messages are ignored.
    • Remote users: Users are defined on a remote LDAP server and user groups are retrieved from the LDAP server. Any group from the syslog messages are ignored.
    Strip off prefix or suffix from username if any Enable to strip prefixes and suffixes from the SSO usernames.
  5. Select OK to add the source.

Matching rules

A matching rule is a query, or policy, that is applied to a syslog message in order to determine required information, such as the username and IP address. Rules are required for every syslog source.

Predefined rules are available for FortiNAC appliances, and Aruba and Cisco wireless controllers (see Predefined rules). For other systems, custom policies can be created to parse message files in various formats.

Predefined rules

Predefined matching rules are included for FortiNAC appliances, and Aruba and Cisco ACS or ISE wireless controllers.

FortiNAC

Trigger FSSO
Auth Type Indicators Logon: login

Logoff: logout

Username field username={{:username}}
Client IPv4 field IP={{:client_ip}}
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},:
Group field tags="{{:group}}"
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Aruba

Trigger None; any logs are accepted.
Auth Type Indicators Logon: User Authentication Successful (exact match required; no delimiter or value)
Username field username={{:username}}
Client IPv4 field IP={{:client_ip}}
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},:
Group field AAA profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Cisco

Trigger NOTICE Radius-Accounting
Auth Type Indicators

Logon: Acct-Status-Type=Start

Update: Acct-Status-Type=Interim

Logoff: Acct-Status-Type=Stop

Username field User-Name={{:username}},
Client IPv4 field Framed-IP-Address={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},:
Group field e.g. profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).
To create a new matching rule:
  1. In the syslog list, select Matching Rules from the View dropdown menu.
  2. Select Create New. The Create New Syslog Matching Rule page opens.
  3. Enter the following information:
  4. Name Enter a name for the source.
    Description Optionally enter a description of the rule.
    Fields to Extract Configure the fields to extract from the message.
    Trigger Optionally, enter a string that must be present in all syslog messages. This will act as a pre-filter.
    Auth Type Indicators Enter strings to differentiate between the types of user activities: Logon, Update (optional), and Logoff (optional).
    Username field Define the semantics of the username field. For example: User-Name={{:username}}, where {{:username}} indicates where the username is extracted from.
    Client IPv4 field Define the semantics of the client IPv4 address.
    Client IPv6 field Define the semantics of the client IPv6 address.
    Group field

    Optionally, define the semantics of the group. The group may not always be included in the syslog message, and may need to be retrieved from a remote LDAP server.

    Use the Group list separator to specify the separator.

    Test Rule Paste a sample log message into the text box, then select Test to test that the desired fields are correctly extracted.
  5. Select OK to add the new matching rule.