Stackvora.tech

Centralized Management with FortiManager & FortiAnalyzer

Managing multiple FortiGate next-generation firewalls across various locations or environments presents significant operational challenges. Consistent…

Managing multiple FortiGate next-generation firewalls across various locations or environments presents significant operational challenges. Consistent policy enforcement, configuration synchronization, and centralized logging are crucial for maintaining security posture and compliance. FortiManager and FortiAnalyzer are core components of the Fortinet Security Fabric, designed to address these challenges by providing centralized management, orchestration, and security analytics.

This article details the capabilities of FortiManager for policy and device management and FortiAnalyzer for comprehensive log aggregation and analysis, illustrating how they integrate to offer a unified "single pane of glass" experience for Fortinet deployments.

FortiManager: Centralized Configuration and Policy Management

FortiManager streamlines the deployment, configuration, and maintenance of FortiGate devices. It acts as a central repository for device configurations, security policies, and FortiGuard services, ensuring consistency and reducing administrative overhead. FortiManager supports various deployment models, including physical appliances (e.g., FortiManager 200F, 1000F), virtual machines (VMware ESXi, KVM, Azure, AWS, GCP), and FortiManager Cloud.

Device Registration and ADOMs

FortiGates are added to FortiManager through a registration process, typically using their serial number. Upon successful registration, FortiManager can retrieve the device's current configuration, known as a "retrieve config." For larger, more complex environments, FortiManager utilizes Administrative Domains (ADOMs). ADOMs provide logical separation of devices and administrators, allowing for multi-tenancy or segregation based on geographical location, business units, or security zones. For instance, a global enterprise might have ADOMs for "Americas," "EMEA," and "APAC," each managed by regional teams.


# On FortiGate CLI, to register with FortiManager
config system central-management
    set mode normal
    set fmg "192.168.1.10"  # FortiManager IP address
    set fmg-source-ip "10.0.0.1" # Source interface IP for FMG communication
    set fmg-keepalive-interval 10
    set fmg-last-disconnect 0
    set status enable
end

# To check registration status
get system central-management status

Policy and Object Management

One of FortiManager's primary strengths is its ability to centralize policy and object creation. Instead of configuring firewall policies, addresses, services, and security profiles (e.g., IPS, Antivirus, Web Filter) on each FortiGate individually, these can be defined once on FortiManager and then deployed to multiple devices or ADOMs. This ensures policy consistency and simplifies audits.

  • Global Policy Packages: Policies that apply across many FortiGates, often defined at the ADOM or global level.
  • Per-Device Policy Packages: Policies specific to an individual FortiGate or a small group, typically inheriting from global policies.
  • Shared Objects: Network addresses, service definitions, security profiles, and VPN tunnels that can be reused across multiple policy packages, reducing duplication and errors.

Installation and Deployment

After policies and objects are configured on FortiManager, they are installed onto the managed FortiGates. This process involves creating an "Install Wizard" task, selecting the target devices, and pushing the configuration. FortiManager provides a clear diff view, showing exactly what changes will be applied before they are committed, preventing unintended modifications.

A common workflow involves:

  1. Create or modify policies/objects in FortiManager.
  2. Save the changes to a Policy Package.
  3. Perform a "Policy Package Installation" or "Device Settings & Objects Installation."
  4. Review the proposed changes (diff).
  5. Execute the installation.

This process can be scheduled or executed manually. FortiManager also supports script deployment for custom CLI commands not directly exposed in the GUI or for specific remediation tasks.

FortiAnalyzer: Centralized Logging and Security Analytics

FortiAnalyzer is Fortinet's centralized logging, reporting, and forensic analysis platform. It aggregates log data from FortiGate devices, FortiManager (for its own logs), FortiClient, FortiMail, FortiWeb, and other Fortinet products, providing a holistic view of an organization's security posture. Similar to FortiManager, FortiAnalyzer is available as a physical appliance (e.g., FortiAnalyzer 1000F, 3000F), virtual machine, or FortiAnalyzer Cloud.

Log Collection and Storage

FortiAnalyzer collects various types of logs, including:

  • Traffic Logs: Records of network sessions, source/destination IPs, ports, protocols, bytes transferred, and policy matched.
  • Event Logs: System events, administrative logins, configuration changes, and daemon restarts.
  • Security Logs: Antivirus, IPS, Web Filter, Application Control, Data Leak Prevention (DLP), and Sandbox detections.
  • VPN Logs: IPsec and SSL VPN tunnel status, user logins, and session details.

Logs are typically sent from FortiGate to FortiAnalyzer using reliable syslog (TCP port 514) or FortiAnalyzer's native communication protocol (TCP port 8013). FortiAnalyzer stores these logs in a compressed, indexed format optimized for fast retrieval and analysis. Storage capacity and log retention policies are critical sizing considerations, often measured in GB/day or TB total storage.


# On FortiGate CLI, to configure logging to FortiAnalyzer
config log fortianalyzer setting
    set status enable
    set server "192.168.1.20" # FortiAnalyzer IP address
    set upload-option realtime
    set reliable enable      # Use reliable TCP communication
    set enc-algorithm high
    set server-hold-period 60 # seconds
end

# Verify log settings
get log fortianalyzer setting

ADOMs on FortiAnalyzer

Just like FortiManager, FortiAnalyzer uses ADOMs to segregate log data. This allows different administrators or departments to view and analyze only the logs relevant to their specific devices or security domains, ensuring data privacy and reducing clutter. ADOMs must be configured identically on both FortiManager and FortiAnalyzer if devices are managed by FortiManager and logs are sent to FortiAnalyzer.

Monitoring and Reporting

FortiAnalyzer offers extensive monitoring and reporting capabilities:

  • Log Viewers: Detailed, filterable views of raw logs, allowing for forensic analysis and drill-down into specific events.
  • FortiView: Real-time and historical dashboards providing graphical summaries of network activity, threats, and user behavior. This includes top applications, destinations, sources, and blocked threats.
  • Reports: Customizable reports covering compliance (e.g., PCI DSS, HIPAA), security posture, traffic analysis, and user activity. Reports can be scheduled for automatic generation and delivery via email or SFTP. Templates are available for common requirements.

SIEM Integration

FortiAnalyzer can act as a central log repository that feeds into a larger Security Information and Event Management (SIEM) system. It supports various methods for SIEM integration:

  • Syslog Forwarding: FortiAnalyzer can forward parsed and unparsed logs to an external syslog server. This is commonly used for generic SIEMs.
  • CEF (Common Event Format) / LEEF (Log Event Extended Format) Export: For more structured data, FortiAnalyzer can export logs in formats compatible with popular SIEMs like Splunk, IBM QRadar, or ArcSight.
  • API Integration: FortiAnalyzer provides a REST API for programmatic access to log data and reporting functions.

Integration and Synergies: FortiManager and FortiAnalyzer

The true power of FortiManager and FortiAnalyzer emerges when they are integrated. This integration typically involves:

  • Single GUI: FortiManager can display FortiAnalyzer's dashboards and reports directly within its interface, providing a unified console for both management and analytics. This is achieved by configuring FortiManager to access FortiAnalyzer's web services.
  • Automatic Registration: Devices added to FortiManager can be automatically configured to send logs to FortiAnalyzer, simplifying initial setup.
  • Contextual Logging: When viewing a policy on FortiManager, administrators can directly jump to the relevant logs on FortiAnalyzer that pertain to that specific policy, greatly aiding troubleshooting and policy validation.

This seamless integration is often referred to as "FortiManager-FortiAnalyzer-in-a-box" if both roles are run on the same hardware/VM, though for larger deployments, separate instances are recommended for performance and scalability.

Feature FortiManager FortiAnalyzer Combined View (Integrated)
Primary Function Centralized configuration, policy, and device management Centralized log aggregation, analytics, and reporting Unified security operations console
Key Activities Policy deployment, device provisioning, firmware upgrades Log viewing, threat analysis, compliance reporting Policy management with direct log validation
Data Type Managed Configurations, security policies, objects Traffic logs, event logs, security logs Both configuration state and security events
Typical Users Network Engineers, Security Architects, Administrators Security Analysts, Incident Responders, Compliance Officers All above, cross-functional teams
Example Use Case Deploying a new branch office firewall configuration Investigating a potential malware outbreak Reviewing a firewall policy and verifying its impact via logs

Common Pitfalls and Troubleshooting

  • IP Connectivity: Ensure FortiGates can reach FortiManager (TCP 53, 541, 8890) and FortiAnalyzer (TCP 514, 8013) on the configured interfaces. Firewall policies might be required on intermediate devices.
  • ADOM Mismatch: If ADOMs are not configured identically on FortiManager and FortiAnalyzer, devices or logs might not appear correctly. Devices sending logs to an incorrect ADOM will not be processed.
  • Log Disk Full: FortiAnalyzer's log disk filling up is a common issue. Monitor disk usage and adjust log retention policies, purges, or expand storage. Check diag log fortianalyzer drq status on FortiAnalyzer.
  • Policy Conflicts: When deploying policies from FortiManager, review the "diff" carefully. Unintended changes or conflicts with local FortiGate configurations can cause service interruptions. Use the "Re-ADOM" feature carefully.
  • Firmware Compatibility: FortiManager and FortiAnalyzer versions must be compatible with the FortiGate firmware they manage/collect logs from. Consult Fortinet's compatibility matrix before upgrading.
  • NTP Synchronization: Time synchronization (NTP) is crucial across all devices (FortiGates, FortiManager, FortiAnalyzer) for accurate log correlation and reporting.
  • High Log Volume: If FortiAnalyzer is overwhelmed by log volume, consider adjusting FortiGate logging settings to only send critical logs, or upgrading FortiAnalyzer hardware/VM resources. Check Dropped Logs in FortiAnalyzer FortiView.

Back to the knowledge base · Ask the AI assistant