https://community.splunk.com/t5/Getting-Data-In/SC4S-TLS-config-for-Fortigate-logs/m-p/756599#M119997 <P>FortiGate isn’t handled the same way as iDRAC in SC4S.</P><P>SC4S doesn’t have a Fortinet specific TLS listener, so swapping TCP to TLS in the env vars won’t actually do anything. Essentially, there is no SC4S_LISTEN_FORTINET_TLS_PORT, which is why your logs stopped showing up.</P><P>For Fortinet, you should enable TLS globally and the logs should be sent to the default TLS syslog listener, not a Fortinet-named port. The correct setup would be to enable TLS and configure a default TLS port, for example 6514 or whatever custom port you want to use. FortiGate then sends syslog over TLS to that port. Because you’re no longer using a Fortinet-specific listener, SC4S may not automatically tag the events as Fortinet based on port. The right way to handle that is to use source-based metadata overrides (by FortiGate IP or hostname) to force the correct sourcetype and index. That’s a pretty common when multiple vendors share the same TLS listener.</P><P>Also make sure the FortiGate side matches what SC4S is listening for. Fortinet TCP syslog often uses RFC6587 framing, and switching to TLS can change behavior depending on the options you pick. If the framing or mode doesn’t match, SC4S will accept the connection but not parse the data correctly.</P> Wed, 17 Dec 2025 21:50:28 GMT Wander 2025-12-17T21:50:28Z https://community.splunk.com/t5/Getting-Data-In/SC4S-TLS-config-for-Fortigate-logs/m-p/756440#M119977 <P>Hi,<BR /><BR />I was recieving fortigate log just fine when i was using the below config in the env file.<BR /><SPAN>SC4S_SOURCE_TLS_ENABLE=yes</SPAN><BR />SC4S_LISTEN_FORTINET_RFC6587_PORT=9XXX<BR />SC4S_LISTEN_FORTINET_RFC5425_PORT=9XXX</P><P>After applying TLS on my other sources, for example it went from</P><P>SC4S_LISTEN_DELL_IDRAC_TCP_PORT=9XXX to SC4S_LISTEN_DELL_IDRAC_TLS_PORT=9XXX</P><P>and it worked just by replacing the protocol to TLS.&nbsp;</P><P>However, it's not that straight forward for the FORTINET logs.&nbsp; Anyone has encountered this situation before?</P><P>Appreciate the help. <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></P> Fri, 12 Dec 2025 07:05:05 GMT https://community.splunk.com/t5/Getting-Data-In/SC4S-TLS-config-for-Fortigate-logs/m-p/756440#M119977 wayne333 2025-12-12T07:05:05Z https://community.splunk.com/t5/Getting-Data-In/SC4S-TLS-config-for-Fortigate-logs/m-p/756599#M119997 <P>FortiGate isn’t handled the same way as iDRAC in SC4S.</P><P>SC4S doesn’t have a Fortinet specific TLS listener, so swapping TCP to TLS in the env vars won’t actually do anything. Essentially, there is no SC4S_LISTEN_FORTINET_TLS_PORT, which is why your logs stopped showing up.</P><P>For Fortinet, you should enable TLS globally and the logs should be sent to the default TLS syslog listener, not a Fortinet-named port. The correct setup would be to enable TLS and configure a default TLS port, for example 6514 or whatever custom port you want to use. FortiGate then sends syslog over TLS to that port. Because you’re no longer using a Fortinet-specific listener, SC4S may not automatically tag the events as Fortinet based on port. The right way to handle that is to use source-based metadata overrides (by FortiGate IP or hostname) to force the correct sourcetype and index. That’s a pretty common when multiple vendors share the same TLS listener.</P><P>Also make sure the FortiGate side matches what SC4S is listening for. Fortinet TCP syslog often uses RFC6587 framing, and switching to TLS can change behavior depending on the options you pick. If the framing or mode doesn’t match, SC4S will accept the connection but not parse the data correctly.</P> Wed, 17 Dec 2025 21:50:28 GMT https://community.splunk.com/t5/Getting-Data-In/SC4S-TLS-config-for-Fortigate-logs/m-p/756599#M119997 Wander 2025-12-17T21:50:28Z