Fortinet black logo

Administration Guide

Syslog sources

Syslog sources

The FortiAuthenticator can parse username and IP address information from a syslog feed from a third-party device, and inject this information into FSSO so it can be used in FortiGate identity based policies.

Syslog objects include sources and matching rules. Sources identify the entities sending the syslog messages, and matching rules extract the events from the syslog messages. Messages coming from non-configured sources will be dropped.

note icon Injection of IPv6 addresses using Syslog-to-FSSO and API-to-FSSO is supported. IPv6 addresses are accepted by the backend parsing engine.

To configure syslog objects, go to Fortinet SSO Methods > SSO > Syslog Sources.

Syslog SSO must be enabled to configure syslog objects. Go to Fortinet SSO Methods > SSO > General to enable Syslog SSO. See General settings.

The following options and information are available:

Create New Create a new syslog source or matching rule.
Delete Select to delete the selected object or objects.
Edit Select to edit the selected object.
View Select Syslog Sources or Matching Rules from the dropdown menu.
Name The name of the source or rule.
Client name/IP The IP address or the client.

Syslog sources

Each syslog source must be defined for the syslog daemon to accept traffic. Each source must also be configured with a matching rule (either pre-defined or custom built; see below), and syslog service must be enabled on the network interface(s) that will listen to remote syslog traffic.

To add a new syslog source:
  1. In the syslog list, select Syslog Sources from the View dropdown menu.
  2. Select Create New. The Create New Syslog Source page ones.
  3. Enter the following information:
    NameEnter a name for the source.
    IP addressEnter the IP address of the source.

    TLS encryption

    Enable to specify if TLS encryption is required.

    Note: This option is only available when Allow TLS encryption under Enable Syslog SSO is enabled in Fortinet SSO Methods > SSO > General.

    Matching ruleSelect the requisite matching rule from the dropdown menu. A matching must already be created for the source.
    SSO user type

    Select the SSO user type:

    • External: Users are not defined on the FortiAuthenticator and user groups come from the source.
    • Local users: Users are defined on the FortiAuthenticator as local users, and user groups are retrieved from the local groups. Any group from the syslog messages are ignored.
    • Remote users: Users are defined on a remote LDAP server and user groups are retrieved from the LDAP server. Any group from the syslog messages are ignored.
    Strip off prefix or suffix from username if anyEnable to strip prefixes and suffixes from the SSO usernames.
  4. Select OK to add the source.

Matching rules

A matching rule is a query, or policy, that is applied to a syslog message in order to determine required information, such as the username and IP address. Rules are required for every syslog source.

Predefined rules are available for FortiNAC appliances, and Aruba and Cisco wireless controllers (see Predefined rules). For other systems, custom policies can be created to parse message files in various formats.

Predefined rules

Predefined matching rules are included for FortiNAC appliances, and Aruba and Cisco ACS or ISE wireless controllers.

Note

Each field containing a variable (e.g. Client IPv4 and Client IPv6 fields) needs one or more characters after the {{:variable}} to let FortiAuthenticator know where to stop the parsing. Any combination of characters will work. The examples below use ",".

FortiNAC

Trigger FSSO
Auth Type Indicators Logon: login

Logoff: logout

Username field username={{:username}},
Client IPv4 field IP={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},
Group field tags="{{:group}}"
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Aruba

Trigger None; any logs are accepted.
Auth Type Indicators Logon: User Authentication Successful (exact match required; no delimiter or value)
Username field username={{:username}},
Client IPv4 field IP={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},
Group field AAA profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Cisco

Trigger NOTICE Radius-Accounting
Auth Type Indicators

Logon: Acct-Status-Type=Start

Update: Acct-Status-Type=Interim

Logoff: Acct-Status-Type=Stop

Username field User-Name={{:username}},
Client IPv4 field Framed-IP-Address={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},
Group field e.g. profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).
To create a new matching rule:
  1. In the syslog list, select Matching Rules from the View dropdown menu.
  2. Select Create New. The Create New Syslog Matching Rule page opens.
  3. Enter the following information:
    NameEnter a name for the source.
    DescriptionOptionally enter a description of the rule.
    Fields to ExtractConfigure the fields to extract from the message.
    TriggerOptionally, enter a string that must be present in all syslog messages. This will act as a pre-filter.
    Auth Type IndicatorsEnter strings to differentiate between the types of user activities: Logon, Update (optional), and Logoff (optional).
    Username fieldDefine the semantics of the username field. For example: User-Name={{:username}}, where {{:username}} indicates where the username is extracted from.
    Client IPv4 fieldDefine the semantics of the client IPv4 address.
    Client IPv6 fieldDefine the semantics of the client IPv6 address.
    Group field

    Optionally, define the semantics of the group. The group may not always be included in the syslog message, and may need to be retrieved from a remote LDAP server.

    Use the Group list separator to specify the separator.

    Test RulePaste a sample log message into the text box, then select Test to test that the desired fields are correctly extracted.
  4. Select OK to add the new matching rule.

Syslog sources

The FortiAuthenticator can parse username and IP address information from a syslog feed from a third-party device, and inject this information into FSSO so it can be used in FortiGate identity based policies.

Syslog objects include sources and matching rules. Sources identify the entities sending the syslog messages, and matching rules extract the events from the syslog messages. Messages coming from non-configured sources will be dropped.

note icon Injection of IPv6 addresses using Syslog-to-FSSO and API-to-FSSO is supported. IPv6 addresses are accepted by the backend parsing engine.

To configure syslog objects, go to Fortinet SSO Methods > SSO > Syslog Sources.

Syslog SSO must be enabled to configure syslog objects. Go to Fortinet SSO Methods > SSO > General to enable Syslog SSO. See General settings.

The following options and information are available:

Create New Create a new syslog source or matching rule.
Delete Select to delete the selected object or objects.
Edit Select to edit the selected object.
View Select Syslog Sources or Matching Rules from the dropdown menu.
Name The name of the source or rule.
Client name/IP The IP address or the client.

Syslog sources

Each syslog source must be defined for the syslog daemon to accept traffic. Each source must also be configured with a matching rule (either pre-defined or custom built; see below), and syslog service must be enabled on the network interface(s) that will listen to remote syslog traffic.

To add a new syslog source:
  1. In the syslog list, select Syslog Sources from the View dropdown menu.
  2. Select Create New. The Create New Syslog Source page ones.
  3. Enter the following information:
    NameEnter a name for the source.
    IP addressEnter the IP address of the source.

    TLS encryption

    Enable to specify if TLS encryption is required.

    Note: This option is only available when Allow TLS encryption under Enable Syslog SSO is enabled in Fortinet SSO Methods > SSO > General.

    Matching ruleSelect the requisite matching rule from the dropdown menu. A matching must already be created for the source.
    SSO user type

    Select the SSO user type:

    • External: Users are not defined on the FortiAuthenticator and user groups come from the source.
    • Local users: Users are defined on the FortiAuthenticator as local users, and user groups are retrieved from the local groups. Any group from the syslog messages are ignored.
    • Remote users: Users are defined on a remote LDAP server and user groups are retrieved from the LDAP server. Any group from the syslog messages are ignored.
    Strip off prefix or suffix from username if anyEnable to strip prefixes and suffixes from the SSO usernames.
  4. Select OK to add the source.

Matching rules

A matching rule is a query, or policy, that is applied to a syslog message in order to determine required information, such as the username and IP address. Rules are required for every syslog source.

Predefined rules are available for FortiNAC appliances, and Aruba and Cisco wireless controllers (see Predefined rules). For other systems, custom policies can be created to parse message files in various formats.

Predefined rules

Predefined matching rules are included for FortiNAC appliances, and Aruba and Cisco ACS or ISE wireless controllers.

Note

Each field containing a variable (e.g. Client IPv4 and Client IPv6 fields) needs one or more characters after the {{:variable}} to let FortiAuthenticator know where to stop the parsing. Any combination of characters will work. The examples below use ",".

FortiNAC

Trigger FSSO
Auth Type Indicators Logon: login

Logoff: logout

Username field username={{:username}},
Client IPv4 field IP={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},
Group field tags="{{:group}}"
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Aruba

Trigger None; any logs are accepted.
Auth Type Indicators Logon: User Authentication Successful (exact match required; no delimiter or value)
Username field username={{:username}},
Client IPv4 field IP={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},
Group field AAA profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).

Cisco

Trigger NOTICE Radius-Accounting
Auth Type Indicators

Logon: Acct-Status-Type=Start

Update: Acct-Status-Type=Interim

Logoff: Acct-Status-Type=Stop

Username field User-Name={{:username}},
Client IPv4 field Framed-IP-Address={{:client_ip}},
Client IPv6 field e.g. Framed-IPv6-Address={{:client_ipv6}},
Group field e.g. profile={{:group}}
Group list separator SSO syslog feed can parse multiple groups if the names are separated by a plus (+) symbol or a comma (,).
To create a new matching rule:
  1. In the syslog list, select Matching Rules from the View dropdown menu.
  2. Select Create New. The Create New Syslog Matching Rule page opens.
  3. Enter the following information:
    NameEnter a name for the source.
    DescriptionOptionally enter a description of the rule.
    Fields to ExtractConfigure the fields to extract from the message.
    TriggerOptionally, enter a string that must be present in all syslog messages. This will act as a pre-filter.
    Auth Type IndicatorsEnter strings to differentiate between the types of user activities: Logon, Update (optional), and Logoff (optional).
    Username fieldDefine the semantics of the username field. For example: User-Name={{:username}}, where {{:username}} indicates where the username is extracted from.
    Client IPv4 fieldDefine the semantics of the client IPv4 address.
    Client IPv6 fieldDefine the semantics of the client IPv6 address.
    Group field

    Optionally, define the semantics of the group. The group may not always be included in the syslog message, and may need to be retrieved from a remote LDAP server.

    Use the Group list separator to specify the separator.

    Test RulePaste a sample log message into the text box, then select Test to test that the desired fields are correctly extracted.
  4. Select OK to add the new matching rule.