# Ubuntu VMware logserver + Fortigate 30E firewall

**URL:** <https://discuss.elastic.co/t/ubuntu-vmware-logserver-fortigate-30e-firewall/352537>\
**Category:** Logstash\
**Created:** [February 5, 2024, 12:54pm UTC](https://discuss.elastic.co/t/ubuntu-vmware-logserver-fortigate-30e-firewall/352537 "2024-02-05T12:54:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dadafaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadafaf/32/131317_2.png) [@dadafaf](https://discuss.elastic.co/u/dadafaf)\
**Post date:** [February 5, 2024, 12:54pm UTC](https://discuss.elastic.co/t/ubuntu-vmware-logserver-fortigate-30e-firewall/352537/1 "2024-02-05T12:54:09Z")

</div>

Hi, I need a bit of help from those wiser.

I've built a virtual machine log server that runs on Ubuntu. The log server has an ELK stack installed through which logs from other virtual machines (normal Ubuntu and Windows Server) are already passing. The problem is that I can't get any logs from FortiGate into Logstash on the log server; the `/var/log/logstash/logstash-plain.log` file doesn't show any information about the FortiGate logs. I have set the virtual machine's IP address and the port 5144, which I use in the Logstash configuration file, from the firewall's management panel. I've also modified the virtual machine's NAT port forwarding settings. I wonder where the problem might be and where I could ask for help.

 ![pic1](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f0907a8b466f4d04aa9efc3bbf2ea351f344b586.png)  
 ![pic2](https://us1.discourse-cdn.com/elastic/original/3X/e/b/ebbdcc8a81a798c1371086b216e31684a51f35ed.png)

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 5, 2024, 9:46pm UTC](https://discuss.elastic.co/t/ubuntu-vmware-logserver-fortigate-30e-firewall/352537/2 "2024-02-05T21:46:39Z")

</div>

can you share the fortigate syslog configuration?

Have you opened UDP 5144 on the Ubuntu firewall? Something like `sudo ufw allow 5144/udp` if it's a recent version of Ubuntu.

For troubleshooting your next step might be taking a packet capture on the fortigate to verify that it's sending traffic and a packet capture on the ubuntu host to make sure that it's receiving the traffic.

---

<div class="post-metadata">

**Author:** ![dadafaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadafaf/32/131317_2.png) [@dadafaf](https://discuss.elastic.co/u/dadafaf)\
**Post date:** [February 6, 2024, 8:54am UTC](https://discuss.elastic.co/t/ubuntu-vmware-logserver-fortigate-30e-firewall/352537/3 "2024-02-06T08:54:16Z")

</div>

![kuvatprojekt](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84a07da6f66e7bb6a366ef9f53c81ff448de5767.png)  
 ![projekti2](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a256d9abf2d85b627d8e0485a6d273ac7964775.png)  
 ![projekti4](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4da84ba5738aebcb43b17ecc7d941d89ee9bcdac.png)  
 ![projektikuvaa](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1855944362564db452664884405eb013becadf8.png)  
 ![projektiliikenne](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a92a858ed1228f4fc707e9920f9ddbf280d34dbd.png)  
Yes i have opened UDP 5144 in ubuntu firewall. Here is some screenshots. I can ping Fortigate in linux but i cannot ping linux in Fortigate CLI-console.

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [February 6, 2024, 12:46pm UTC](https://discuss.elastic.co/t/ubuntu-vmware-logserver-fortigate-30e-firewall/352537/4 "2024-02-06T12:46:33Z")

</div>

> [@dadafaf](#):
>
> i cannot ping linux in Fortigate CLI-console.

The `wan out` in the last screenshot I think means it is trying to send the syslog out the wan interface, is your wan also a 192 address space?

You could try adding a static route to the firewall for the syslog server to use the right interface or you can configure syslog over a specific IP and interface:

```auto
config log syslogd setting
    set source-ip y.y.y.y
end

```

With source ip being the inside interface IP from the fortigate

If that doesn't work you can also try:

```auto
    set interface-select-method specify
    set interface "<inside interface to syslog server>"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2024, 12:46pm UTC](https://discuss.elastic.co/t/ubuntu-vmware-logserver-fortigate-30e-firewall/352537/5 "2024-03-05T12:46:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.