Missing Source NAT (SNAT) IP in Traffic Logs Causing PCI-DSS Audit Failure
FortiOS firewall policies operating in default logging modes omit post-NAT translation attributes (transip, transport) from session closure records, destroying forward-and-backward IP traceability mandated by PCI-DSS v4.0 Requirement 10 and HIPAA audits.
Technical Root Cause Analysis
PCI-DSS v4.0 Requirement 10.2.2 and 10.3.1 strictly mandate that audit trails record all administrative and user network interactions with cardholder data, including individual source identities, destination addresses, and post-translation endpoints. When a FortiGate performs Source Network Address Translation (dynamic pool or outgoing interface PAT), the kernel session table (sys session) maintains both original direction tuples (srcip, srcport) and reply direction tuples (transip, transport).
However, the logging subsystem (miglogd) formats traffic log records based on policy-specific directives. In configurations where logtraffic is set to default or utm (logging only UTM security events), or where logtraffic-start is omitted on long-running flows, the translation tuple is suppressed from the emitted LogID 0000000013 (Traffic Log). Egress flows appear in SIEM collectors with purely internal private RFC 1918 addresses without the public egress translation IP, creating a critical forensic blind spot where external providers cannot correlate abuse or access events back to internal workstations.
Affected Firmware & Compliance Blast Radius
| FortiOS Branch | Default Configuration Behavior | Required Policy Setting | Compliance Status |
|---|---|---|---|
| FortiOS 7.6 | Requires explicit logtraffic all |
set logtraffic all | Audit Compliant if configured |
| FortiOS 7.4 | Omits transip on offloaded fast-path sessions | set logtraffic all + pool log | Audit Compliant if configured |
| FortiOS 7.2 | Default policy omits SNAT port allocation logs | set logtraffic all | Audit Compliant if configured |
| FortiOS 7.0 | Default policy template sets logtraffic utm |
logtraffic utm (Default Non-compliant) | Violates PCI-DSS Req 10 |
Platform Impact: All FortiGate appliances protecting payment processing environments, healthcare HIPAA enclaves, or ISO 27001 scope perimeters utilizing SNAT.
Step 01: Free Verification CLI (Safe Read-Only)
Run these diagnostic commands directly via SSH or Web Serial to audit your firewall policies and verify whether active log streams include translation attributes:
Diagnostic Commands
# 1. Audit firewall policies touching sensitive segments for logtraffic configuration
show firewall policy | grep -B 2 -A 5 "logtraffic"
# 2. Filter local log buffer for real-time forward traffic records
execute log filter category 0
execute log filter field subtype forward
execute log display | grep -E "trandisp|transip"
# 3. Verify session table translation parameters on an active CDE flow
diagnose sys session filter src 10.240.12.0 255.255.255.0
diagnose sys session list | grep -E "proto=|saddr=|daddr=|act="Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
By default, FortiOS firewall policies may have logtraffic configured to 'utm' instead of 'all', or NAT port allocation is offloaded directly to hardware NP7/NP6 ASICs without passing translation metadata back to miglogd on session termination unless explicit traffic logging is enforced.
PCI-DSS v4.0 Requirement 10 (specifically 10.2.2, 10.3.1, and 10.3.4), HIPAA Security Rule §164.312(b), and NIST SP 800-53 AU-3 mandate that audit trails identify the actor, origin, and exact egress IP/port for all network connections initiating from or traversing secure segments.
On high-capacity appliances (FG-100F and above), session-close logging has negligible ASIC impact. However, if 'logtraffic-start' is enabled across millions of concurrent short-lived connections, miglogd queue depth must be monitored using Runbook #04 to avoid buffer accumulation.