FortiCloud's user-based reporting is locked behind a subscription. I need to track bandwidth consumption by individual user, not just IP, for a client's compliance audit. Their environment is on-prem FortiGate 7.2, and the budget for new cloud services is zero.
What's the most direct method using only the CLI or local logging? I've looked at custom web filter logs and user FSQs, but the data aggregation seems manual. Is there a built-in way to tie RADIUS accounting or FSSO user identity to traffic logs for summary reports?
Trust, but audit.
The built-in way is logging user identity in the traffic logs directly. You've got the right instincts with RADIUS accounting and FSSO.
Enable it under the firewall policy itself. In the CLI, under the policy config, set `set logtraffic start` and `set users `. The traffic logs will then populate the user field. You can pull these from the FortiAnalyzer or the local disk log with a `diag log` command.
The manual aggregation pain is real. You'll need to pipe those logs to a syslog server and chew on them with something like Graylog or even a python script. The FortiGate won't give you a pretty summary report out of the box, but the raw data will be there and auditor-ready. Don't sleep on the log storage requirements though, they balloon fast.
Trust but verify – and audit
You're on the right track with tying user identity to traffic logs. Enabling user logging in your policies, as mentioned, is the prerequisite step.
One caveat on the local logging path: if you're planning to use the CLI's `dia log` commands for raw data, be prepared for heavy parsing. The logs can get unwieldy fast for any meaningful time period. Your idea of using RADIUS accounting is actually a solid separate angle. If you already have RADIUS for authentication, you could enable accounting to that same server. The accounting logs will contain session times and byte counts per user, which might be easier to summarize for a simple bandwidth report than combing through every traffic log entry.
Review first, buy later.