If logging is enabled for a gateway firewall, gateway firewall packets will be logged.

The log file is /var/log/syslog. Each log message conforms to the syslog format, and consists of a syslog header and firewall-specific information. For more informaion about syslog, see Log Messages and Error Codes.

The firewall-specifc portion of a log message has the following fields:

Field Notes
<VRF ID and interface UUID> You can get this information about an interface by running a CLI command. For example:
edge-1> get firewall interfaces 
Interface           : 55f1af2f-4875-44e9-b0e0-59132ad7753d
Type                : UPLINK
Sync enabled        : true
Name                : Uplink_40_1
VRF ID              : 1
...
Address family Possible values: INET, INET6
Reason Possible values:
  • match: Packet matches a rule.
  • fragment: A fragment that comes after the first fragment.
  • short: Packet too short (for example, no IP header, or TCP/UDP header).
  • normalize: Malformed packets that do not have a correct header or a payload.
  • memory: Datapath out of memory.
  • ip-option: Invalid IP options are present.
  • TERM: A connection is terminated.
Action Possible values:
  • PASS: Accept the packet.
  • DROP: Drop the packet.
  • NAT: SNAT
  • RDR: DNAT
  • PBR: Service insertion.
  • LB: Load balancer.
Rule ID The firewall rule ID.
Direction Possible values: IN, OUT
Packet length Length in bytes.
Protocol Possible values: TCP, UDP, or PROTO (protocol number)
Source IP address and port For SNAT, this is the address before translation.
Destination IP address and port For DNAT, this is the address before translation.
Examples of gateway firewall log messages for TCP: 
<181>1 2020-09-21T22:14:12.080427+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET reason-match PASS 1005 OUT 60 TCP 1.1.1.10/45120->91.189.92.38/443 S

<181>1 2020-09-21T22:14:19.963758+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET TERM PASS 1005 OUT TCP 1.1.1.10/45120->91.189.92.38/443
Examples of gateway firewall log messages for UDP: 
<181>1 2020-09-21T22:05:05.686346+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET reason-match PASS 1005 IN 328 UDP 40.40.40.10/60613->1.1.1.10/42917

<181>1 2020-09-21T22:05:48.301116+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET TERM PASS 1005 IN UDP 40.40.40.10/60613->1.1.1.10/42917
Examples of gateway firewall log messages for PROTO: 
<181>1 2020-09-21T21:54:38.047682+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET reason-match PASS 1005 IN 84 PROTO 1 40.40.40.10->1.1.1.10

<181>1 2020-09-21T21:54:45.036957+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET TERM PASS 1005 IN PROTO 1 40.40.40.10->1.1.1.10
Examples of gateway firewall log messages for SNAT: 
<181>1 2020-09-21T22:57:24.203037+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET reason-match PASS 1005 OUT 60 TCP 1.1.2.10/49974->40.40.40.10/22 S

<181>1 2020-09-21T22:57:24.203615+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET reason-match NAT 536870914 OUT 60 TCP 2.2.2.10/37305-OR 1.1.2.10/49974->40.40.40.10/22 S

<181>1 2020-09-21T22:57:32.125757+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET TERM NAT 536870914 OUT TCP 2.2.2.10/37305-OR 40.40.40.10/22->1.1.2.10/49974
Examples of gateway firewall log messages for DNAT: 
<181>1 2020-09-21T22:49:00.978192+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET reason-match RDR 536870913 IN 60 TCP 40.40.40.10/40082->10.10.10.1/22-OR 1.1.1.10/22 S

<181>1 2020-09-21T22:50:01.915154+00:00 lur-svc.nsxedge-ob-16404613-1-gdefw NSX 2802 FIREWALL [nsx@6876 comp="nsx-edge" subcomp="datapathd.firewallpkt" level="INFO"] <1 55f1af2f487544e9:b0e059132ad7753d> INET TERM RDR 536870913 IN TCP 40.40.40.10/40082->10.10.10.1/22-OR 1.1.1.10/22