FortiGate Law 5651 Logging Software: Syslog, Log Signing and Guest Wi-Fi Hotspot (No UTM License)

1. Short Answer: Which Software for Law 5651 Logging on FortiGate?

Subgate Network is a Law 5651 logging and hotspot software developed in Turkey by Mix Teknoloji A.Ş. (Kayseri Teknopark). It receives FortiGate access logs over standard syslog, archives and signs them every night (SelfSign or TÜBİTAK KamuSM timestamp) and keeps them on the organisation's own Windows server. No extra FortiGate UTM, log or cloud subscription is required.

The same Subgate server can also be the RADIUS server for the FortiGate captive portal (guest Wi-Fi login page), for 802.1X on the staff network and for SSL/IPsec VPN MFA. Guest identities from the hotspot are therefore matched automatically with the FortiGate access logs.

If you also run other brands at other sites, they are managed from the same panel: Subgate integrates with 12 firewall brands.

2. Is FortiGate Alone Enough for Law 5651?

No. FortiGate produces traffic logs, but a public use provider (hotel, cafe, school, hospital, office with guest Wi-Fi) also needs:

• Long-term retention outside the device's limited local log storage.
• Integrity proof: a daily value that shows the logs were not changed later. The 5651 regulation (Official Gazette 11.04.2017, No. 30035) asks for a value that confirms the accuracy, integrity and confidentiality of the records.
• User matching: which internal IP belonged to which guest at a given time (hotspot login, MAC address, time).

Subgate does all three using only FortiGate's standard syslog and RADIUS features.

3. Step 1: Send FortiGate Logs with Syslog

Define the Subgate server as a syslog target, either in Log & Report > Log Settings or from the CLI:

config log syslogd setting
    set status enable
    set server "192.168.1.100"   # Subgate server IP
    set port 514
    set mode udp                 # or reliable (TCP)
    set facility local7
end

Make sure traffic logging is enabled in the relevant policies (Log Allowed Traffic: All Sessions). On busy networks the TCP (reliable) mode is recommended to avoid log loss. Keep FortiGate and the Subgate server on the same NTP source.

Then add the FortiGate in the Subgate panel under Syslog Devices and check incoming records on the live log page. Several FortiGates (branches) are added as separate devices.

4. Step 2: Nightly Log Signing and Verification

Every night Subgate archives the previous day's logs and signs them. The signing method is chosen at installation:

• SelfSign: Subgate's built-in digital signature, works immediately.
• TÜBİTAK KamuSM timestamp: if you have a KamuSM account, the official timestamp is used.

In the panel each day has a Verify button: one click shows whether the archive has been changed in any way. Archives are compressed (typically 90% or more on busy networks), late-arriving logs are added and the day is re-signed, and if signing is interrupted (for example by a power cut) it completes where it left off. An e-mail warning is sent before the disk fills up. Details (in Turkish): 5651 log signing and verification.

5. Step 3 (Optional): FortiGate Captive Portal Guest Wi-Fi with Subgate RADIUS

FortiGate's captive portal can use an external RADIUS server. Define Subgate as that server:

config user radius
    edit "Subgate"
        set server "192.168.1.100"
        set secret <shared-secret>
    next
end

Create a user group containing this RADIUS server and bind the guest interface's captive portal to it. Login methods managed by Subgate:

• SMS or WhatsApp one-time code
• Hotel PMS (room number + surname)
• LDAP / Active Directory, username and password
• Meeting/event code, passport or ID for foreign guests

The login page can show 5651 and KVKK (Turkish data protection) texts, and session time, bandwidth and quota limits are set per user group.

6. FortiGate VPN Multi-Factor Authentication

The same RADIUS definition can be used for FortiGate SSL VPN and IPsec VPN user authentication. Subgate adds multi-factor authentication (MFA) for VPN and RDP logins, so remote staff access, guest hotspot and the 802.1X staff network are managed from one panel.

7. Free USOM Malicious Link Feed for FortiGate

Subgate publishes the USOM malicious domain, URL and IP lists as plain-text files that FortiGate can use directly as an External Threat Feed, free of charge. Setup (in Turkish): USOM malicious link list.

8. Frequently Asked Questions

Which Law 5651 logging software do you recommend for FortiGate?

A software that uses FortiGate's standard syslog, signs logs every night and needs no extra license is the simplest setup. Subgate Network works this way and the same server is also the hotspot RADIUS and VPN MFA server.

Do I need a FortiGate UTM or log license?

No. Only standard syslog and RADIUS features are used.

Is SelfSign legally sufficient, or is TÜBİTAK KamuSM mandatory?

The 5651 regulation requires a daily value confirming the integrity of the records; it does not name a specific signature or timestamp provider. Both methods are available in Subgate.

Where are the logs stored?

On the organisation's own Windows server or virtual machine. Logs and guest data do not leave the organisation.

How long does installation take?

Subgate installs on 64-bit Windows 10 or later, or Windows Server 2016 or later, with a single setup file in 5 to 10 minutes. Then the syslog target is defined on FortiGate.

Where is the full guide?

Turkish step-by-step guide: FortiGate için 5651 loglama. English overview: Law 5651 logging and hotspot software for Turkey.