> For the complete documentation index, see [llms.txt](https://docs.apica.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apica.io/integrations/list-of-integrations/fortinet-firewalls.md).

# Fortinet FortiGate Firewall Logs

You can integrate Apica Flow with your FortiGate Firewall to forward either all or selected logs to Apica Ascent using the firewall's built-in syslog forwarding capabilities.

## Configuration

Drop into the firewall CLI and switch to the log syslogd configuration page

```
config log syslogd setting
```

![Fortigate Firewall configuration](https://2948796384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LmzGprckLqwd5v6bs6m%2Fuploads%2FwtW8958P1aNYOg60CxEs%2FScreen%20Shot%202022-05-30%20at%2011.02.18%20AM.png?alt=media\&token=5e739037-e714-4b9c-bab8-730590dd101e)

## Syslogd forwarding

Once in the syslogd configuration settings, set the following to enable forwarding to Apica Flow

```
set status enable
set server <IP/FQDNS of Apica Ascent Server here>
set mode reliable
set facility local1
set format rfc5424
```

## Log Filtering configurations

For the log forwarding to work, you may need to tweak additional settings such as filtering (see example below - in this configuration, all log-level debug and above are configured to be sent to Apica Flow):

```
FGTAWSX5HFDA6I36 # config log syslogd filter

FGTAWSX5HFDA6I36 (filter) # show
config log syslogd filter
    set severity debug
end

FGTAWSX5HFDA6I36 (filter) # 
```

Additional filtering options can be found under the ***Log & Report*** section in the UI:

![](https://2948796384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LmzGprckLqwd5v6bs6m%2Fuploads%2Fa7YuEqWwHExt8hSofE50%2FScreen%20Shot%202022-05-30%20at%2011.12.11%20AM.png?alt=media\&token=9982cbe1-b1cf-48da-9e6a-1da35b0fd2da)

### Key Validation Steps:

* Set severity to ***warning*** or ***error*** at the FortiGate filter for traffic logs, and reserve ***debug*** for security event and authentication log categories only — use separate ***syslogd filter*** configs per log type
* Confirm Apica Flow's syslog receiver is configured with octet-counting enabled for RFC5424 over TCP
* Enable TLS on the syslog connection (port 6514, mutual TLS with certificate pinning)
* Assign distinct facility codes per FortiGate appliance to enable per-source routing in Flow
* Use separate syslogd destinations per log category (traffic, event, security) rather than a single catch-all stream