FortiAnalyzer: register a FortiGate and start log forwarding

Integrating FortiGate devices with FortiAnalyzer for centralized logging and reporting is a fundamental operational requirement for many network…

Integrating FortiGate devices with FortiAnalyzer for centralized logging and reporting is a fundamental operational requirement for many network environments. This guide details the process of registering a FortiGate appliance with a FortiAnalyzer, configuring log forwarding, and verifying data ingestion. We will cover both FortiGate and FortiAnalyzer configurations, including considerations for FortiAnalyzer deployment modes and potential network challenges.

FortiAnalyzer Deployment Modes and Initial Setup

Before integrating FortiGates, understand the FortiAnalyzer's role. FortiAnalyzer can operate in several modes:

Analyzer: The default mode, suitable for log collection, analysis, and reporting.
Collector: Designed for high-volume log collection, acting as an intermediary for multiple FortiGates before forwarding to a central Analyzer. This offloads processing from the Analyzer.
Collector & Analyzer: A combined role, often used in smaller deployments or distributed environments where local analysis is also required.

For most deployments, the default Analyzer mode is sufficient. Ensure your FortiAnalyzer is properly licensed, has adequate disk space for expected log volume (consider at least 1GB/day/FortiGate for typical traffic, but this varies wildly), and its network interfaces are configured with appropriate IP addresses and routes. Common ports for communication are TCP/514 (reliable logging over FortiLog protocol) and UDP/514 (syslog, less common for FortiGate-to-FortiAnalyzer). For FortiGate-FortiAnalyzer, the proprietary FortiLog protocol over TCP/514 is standard.

FortiGate Configuration for FortiAnalyzer Integration

Configuring a FortiGate to send logs to FortiAnalyzer is straightforward and can be done via the CLI or GUI. The primary goal is to tell the FortiGate where its FortiAnalyzer lives and to enable logging to it.

CLI Configuration

The following CLI commands configure a FortiGate (running FortiOS 6.x or 7.x) to forward logs to a FortiAnalyzer at 10.0.0.5. Adjust the IP address to match your FortiAnalyzer's management interface IP.

config log fortianalyzer setting
    set status enable
    set server 10.0.0.5
    set server-port 514
    set enc-algorithm high # Recommended for secure communication (AES256-SHA)
    set reliable enable # Ensures delivery using TCP and retransmission
    set upload-day every # Upload logs every day
    set upload-time 23:59 # Upload time (if not real-time)
    set log-quota 0 # Use FortiAnalyzer's quota. 0 disables local log quota enforcement.
    set serial FortiAnalyzer_SN_Here # Optional, but recommended for security. Replaced by FOS v7.4.x 'set monitor-fgid enable'.
    set source-ip 192.168.1.10 # Optional: Source interface IP for log traffic if specific routing is required
end

config log fortianalyzer override-filter
    set severity information # Or lower, e.g., debug, to capture more verbose logs
    set traffic enable
    set local-traffic enable
    set event enable
    set dlp enable
    set ips enable
    set virus enable
    set webfilter enable
    set app-ctrl enable
    set voip enable
    set netscan enable
    set anomaly enable
    set gtp enable
    set sctp enable
end

config log setting
    set local-in-allow enable # Include traffic hitting the FortiGate itself
    set fwpolicy-implicit-log enable # Log traffic denied by the implicit deny policy
end

Explanation of Key Commands:

set status enable: Activates FortiAnalyzer logging.
set server 10.0.0.5: Specifies the FortiAnalyzer's IP address.
set server-port 514: Standard port for FortiLog.
set enc-algorithm high: Enables strong encryption (AES256-SHA) for log traffic between FortiGate and FortiAnalyzer. Prioritize security for sensitive log data. Other options include low (AES128-SHA) and disable.
set reliable enable: Essential for ensuring log delivery. Uses TCP with retransmission mechanisms. Disable only if specific network conditions or compliance requirements prevent TCP.
set upload-day every / set upload-time 23:59: These settings are primarily for scheduled log uploads. When reliable enable is set, logs are typically forwarded in near real-time, so these become less critical for immediate data flow but can still influence buffer behavior.
set log-quota 0: Directs the FortiGate to defer to the FortiAnalyzer's log quota settings. Setting it to 0 means the FortiGate will not enforce its own log quota limits for logs sent to FortiAnalyzer.
set serial FortiAnalyzer_SN_Here: (FortiOS 7.3 and earlier) This is a critical security measure. The FortiGate will only send logs to a FortiAnalyzer matching this serial number. This prevents unauthorized FortiAnalyzers from receiving logs. For FortiOS 7.4.0 and later, this option has been replaced by set monitor-fgid enable under config log fortianalyzer setting, which achieves a similar goal by using FortiGate IDs. If not set, FortiAnalyzer will prompt for authorization based on the incoming serial number.
set source-ip 192.168.1.10: If your FortiGate has multiple interfaces and you need to force log traffic out a specific interface or with a specific source IP, use this. Otherwise, the FortiGate will use the IP of the interface through which it routes to the FortiAnalyzer.
config log fortianalyzer override-filter: This section allows granular control over which log types are forwarded. By default, many are enabled, but you can tailor this to reduce noise or meet specific compliance requirements. Setting severity information ensures most operational logs are sent.
set local-in-allow enable & set fwpolicy-implicit-log enable: These global log settings ensure that traffic destined to the FortiGate itself (local-in) and traffic blocked by the implicit deny policy at the end of the firewall ruleset are also logged. These are vital for comprehensive security auditing.

GUI Configuration (FortiOS 7.x)

Navigate to Log & Report > Log Settings.
Under "Remote Logging and Archiving," find the "FortiAnalyzer Settings" section.
Toggle Send Logs to FortiAnalyzer to "Enable."
Enter the IP Address of your FortiAnalyzer (e.g., 10.0.0.5).
Keep the Port at 514 (default).
Set Upload Option to "Realtime." This is the default when "Reliable Connection" is enabled.
Enable Reliable Connection.
Select Log Encrypt to "High" (AES256-SHA).
(Optional, FortiOS 7.3 and earlier) Enter the FortiAnalyzer serial number.
For "FortiAnalyzer Event Log Settings" and "FortiAnalyzer Traffic Log Settings," set the Event Logging and Traffic Logging to "Information" or lower (e.g., "Debug") to capture desired log levels.
Click Apply.

FortiAnalyzer Device Authorization

Once the FortiGate is configured, the FortiAnalyzer will detect it as an unauthorized device. You need to explicitly authorize it.

Log in to your FortiAnalyzer GUI.
Navigate to System Settings > Device Manager.
In the main pane, you'll see a section for "Unauthorized Devices." The newly configured FortiGate should appear here, typically identified by its serial number and hostname/IP.
Select the FortiGate from the list.
Click Authorize in the toolbar.
A dialog box will appear. You may be prompted to add it to an ADOM (Administrative Domain) if ADOMs are enabled. Select the appropriate ADOM or the "root" ADOM.
Click OK.

Upon successful authorization, the device will move from "Unauthorized Devices" to "All FortiGates" (or the specific ADOM's device list). Its "Status" column should eventually show a green icon indicating healthy connectivity.

Verifying Log Flow

Logs should start flowing from the FortiGate to the FortiAnalyzer within seconds of authorization. Verify this through the FortiAnalyzer's log viewer.

On the FortiAnalyzer, navigate to Log View.
Select the authorized FortiGate from the "Device" dropdown menu (top left, if ADOMs are used, ensure you're in the correct ADOM).
Choose a log type, e.g., "Traffic" or "Event."
Refresh the view. You should see recent logs from your FortiGate appearing.
You can also use the CLI on the FortiAnalyzer to check log reception:
```
diagnose log daemon fortiweb # Or fortipt, fortips, etc.
diagnose debug application offtpd -1 # Show incoming FortiLog packets
diagnose debug enable
        
```
This CLI method is more for deep troubleshooting and should be used with caution, disabling debugs afterward.

Common Pitfalls and Troubleshooting

Network Connectivity: The most common issue. Ensure the FortiGate can reach the FortiAnalyzer's management IP on TCP/514. Use execute ping 10.0.0.5 and execute telnet 10.0.0.5 514 from the FortiGate CLI.
Firewall Rules: If there's an intermediate firewall or the FortiAnalyzer itself has host-based firewalling enabled, ensure TCP/514 is allowed from the FortiGate's source IP.
Incorrect FortiAnalyzer IP/Port: Double-check the set server and set server-port commands on the FortiGate.
FortiAnalyzer Serial Number Mismatch: If set serial was used on the FortiGate (FortiOS < 7.4), ensure it exactly matches the FortiAnalyzer's serial number. A mismatch will prevent authorization.
ADOMs (Administrative Domains): If ADOMs are enabled on FortiAnalyzer, ensure the FortiGate is authorized into the correct ADOM, and your FortiAnalyzer user has access to that ADOM.
Log Disk Full: If the FortiAnalyzer's log disk is full, it will stop accepting new logs. Check System Settings > Dashboard for disk usage.
Time Synchronization: Significant time differences between the FortiGate and FortiAnalyzer can cause issues with log processing and display. Ensure both devices sync with reliable NTP sources.
FortiGate Log Buffer: If connectivity is intermittent, the FortiGate buffers logs. Once connectivity is restored, it will attempt to send buffered logs. Ensure the log buffer isn't constantly overflowing. Use get log fortianalyzer setting on the FortiGate to check its status.