Dashboards & Visualizations

Firewall Policy bandwidth usage is higher in Splunk than in Fortigate

shenathsilva
Engager

Hi all, 

I've set up Splunk to receive Fortigate logs according to the guide on https://www.fortinet.com/content/dam/fortinet/assets/alliances/Fortinet-Splunk-Deployment-Guide.pdf 

I've also set up a custom dashboard to make sure I'm receiving events properly.  Eg: this widget is supposed to count data usage on each policy. 

 

 

index="main"  (eventtype=ftnt_fgt_traffic)  |eval sum(bytes) = bytes | eval bytes = bytes/(1024*1024*1024) | rename bytes AS RootObject.bytes policyid AS RootObject.policyid | fields "_time" "host" "source" "sourcetype" "RootObject.bytes" "RootObject.policyid" | stats dedup_splitvals=t sum(RootObject.bytes) AS "Sum of bytes"  by RootObject.policyid | sort limit=0 RootObject.policyid | fields - _span  | rename RootObject.policyid AS "Policy ID"  | fields "Policy ID", "Sum of bytes"

 

 

 image.png

What I've noticed is that the bandwidth it shows on Splunk is higher than what it shows on Fortigate policy. 

Can someone advise me on what I am doing wrong and how to fix this? Let me know if you need any additional information. 

Splunk Enterprise Version:8.1.2 Build:545206cc9f70

Thank you! 

- Shenath 

Labels (3)
0 Karma
1 Solution

shenathsilva
Engager

Answering my own question for anyone else who has this issue with Fortigate FW logs on Splunk, 

This is not caused by duplicate logs but rather by how Fortigate handles long lived sessions. Apparently it sends interim logs which has rcvdbytes and sentbytes fields in the middle of a session. Fortigate calculates the usage properly by excluding these events but when we manually calculate we have to exclude them. 

Easiest solution would be to disable interim logs on Fortigate. 

This is an explanation of what is going on: https://docs.fortinet.com/document/fortianalyzer/6.2.0/new-features/902615/fortiview-long-lived-sess...

This is how to exclude interim logs on the Fortigate: https://kb.fortinet.com/kb/documentLink.do?externalID=FD43912  

View solution in original post

Tags (1)
0 Karma

shenathsilva
Engager

Answering my own question for anyone else who has this issue with Fortigate FW logs on Splunk, 

This is not caused by duplicate logs but rather by how Fortigate handles long lived sessions. Apparently it sends interim logs which has rcvdbytes and sentbytes fields in the middle of a session. Fortigate calculates the usage properly by excluding these events but when we manually calculate we have to exclude them. 

Easiest solution would be to disable interim logs on Fortigate. 

This is an explanation of what is going on: https://docs.fortinet.com/document/fortianalyzer/6.2.0/new-features/902615/fortiview-long-lived-sess...

This is how to exclude interim logs on the Fortigate: https://kb.fortinet.com/kb/documentLink.do?externalID=FD43912  

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...