Send FortiGate Logs to FortiAnalyzer

Effective security posture management and incident response rely heavily on centralized logging and analysis. FortiGate firewalls generate a wealth of…

Effective security posture management and incident response rely heavily on centralized logging and analysis. FortiGate firewalls generate a wealth of security events, traffic logs, and system diagnostics. Sending these logs to a FortiAnalyzer appliance or cloud instance consolidates this information, enabling advanced analytics, reporting, and long-term retention. This article details the process of configuring FortiGates to forward logs to FortiAnalyzer, covering both the FortiGate and FortiAnalyzer sides of the integration, including essential verification steps.

Prerequisites and Initial Considerations

Before configuring log forwarding, ensure the following:

  • FortiGate Firmware Compatibility: Ensure your FortiGate is running a supported FortiOS version. While logging to FortiAnalyzer is a core feature across many versions, specific options or capabilities might vary. FortiOS 6.x and 7.x are widely supported.
  • FortiAnalyzer Version Compatibility: FortiAnalyzer also needs to be running a compatible FortiAnalyzer OS version. Always consult the Fortinet Compatibility Matrix for specific version pairings. For example, FortiOS 7.0.x is typically best paired with FortiAnalyzer OS 7.0.x or later.
  • Network Connectivity: The FortiGate must have IP reachability to the FortiAnalyzer on UDP port 514 (FortiAnalyzer native logging protocol) and potentially TCP port 514 (for reliable logging, though UDP is more common for initial setup and performance) or 50000/50001 for Fabric ADOMs. A static route or proper routing table entries are often necessary.
  • FortiAnalyzer Licensing/Capacity: Verify that your FortiAnalyzer has sufficient disk space and license capacity to ingest logs from the FortiGate. Overrunning disk space will lead to log drops.
  • Time Synchronization: Ensure both FortiGate and FortiAnalyzer have accurate time synchronization, preferably via NTP. Time discrepancies can lead to issues with log correlation and reporting.

FortiGate Configuration for FortiAnalyzer Logging

The primary configuration on the FortiGate involves specifying the FortiAnalyzer's IP address and enabling logging. This can be done via the GUI or CLI.

CLI Configuration (Recommended for Automation/Precision)

Access the FortiGate CLI via SSH or console. The following commands configure logging to a FortiAnalyzer with IP 10.10.10.10:

config log fortianalyzer setting
    set status enable
    set server 10.10.10.10
    set upload-option store-and-upload  <-- Recommended for reliable delivery
    set reliable enable                 <-- Use TCP for reliable delivery (port 514 or 50001 for Fabric ADOMs)
    set enc-algorithm high              <-- Encrypt logs with strong encryption (AES256)
    set pki-based enable                <-- Use PKI for secure certificate-based authentication (requires CA/cert setup)
    set source-ip 192.168.1.1           <-- Optional: specify the source interface/IP for logging traffic
    set server-hold-time 300            <-- How long to wait before trying another server if FAZ is down (seconds, default 300)
    set max-log-rate 0                  <-- Optional: throttle log rate (0 = no limit)
    set conn-timeout 30                 <-- Connection timeout in seconds (default 30)
end

Explanation of Key Parameters:

  • set status enable: Activates FortiAnalyzer logging.
  • set server <FAZ-IP>: Specifies the IP address of the FortiAnalyzer. If using a high-availability (HA) pair of FortiAnalyzers, you can specify multiple servers (e.g., set server 10.10.10.10 10.10.10.11).
  • set upload-option store-and-upload: The FortiGate will store logs locally and then upload them to the FortiAnalyzer. This is generally preferred over realtime (which sends logs immediately but can drop if FAZ is unavailable) or store-and-forward (which is older and less common).
  • set reliable enable: Enables reliable TCP-based log delivery. If disabled, logs are sent via UDP 514. When enabled, the FortiGate uses TCP 514 (for regular ADOMs) or TCP 50001 (for Fabric ADOMs, common in newer FortiOS/FortiAnalyzer versions).
  • set enc-algorithm high: Encrypts logs in transit using AES256-GCM. Other options include high-medium (AES192), high-medium-low (AES128), and disable (no encryption). Encryption is highly recommended for security.
  • set pki-based enable: Enables certificate-based authentication between FortiGate and FortiAnalyzer, providing stronger security than pre-shared keys. This requires proper CA and certificate management on both devices. Without PKI, the FortiGate will authenticate to FortiAnalyzer using its serial number and an authorization key if configured.
  • set source-ip <interface-ip>: Useful in multi-interface or VPN scenarios to ensure logs originate from a specific IP address that the FortiAnalyzer is configured to accept.

GUI Configuration

  1. Navigate to Log & Report > Log Settings.
  2. Under "Remote Logging and Archiving," find the "FortiAnalyzer Settings" section.
  3. Enable "Send logs to FortiAnalyzer."
  4. Enter the FortiAnalyzer's IP address in the "IP Address" field.
  5. Optionally, enable "Upload logs reliably" (TCP), select an "Encryption" level, and specify a "Source IP" if needed.
  6. Click Apply.

Remember to ensure that logging is enabled for the specific security policies that you want to monitor. Edit your firewall policies and verify that "Log Allowed Traffic" is set to "Security Events" or "All Sessions" and "Log Denied Traffic" is enabled.

FortiAnalyzer Configuration and Device Authorization

After configuring the FortiGate, the FortiAnalyzer must recognize and authorize the device.

Authorizing the FortiGate

  1. Log in to your FortiAnalyzer GUI.
  2. Navigate to Device Manager (or Fabric View > Device & Services in newer versions).
  3. You should see the FortiGate listed under "Unauthorized Devices" or "Unregistered Devices." It might take a few moments for the FortiGate to appear after configuration.
  4. Select the FortiGate and click Authorize.
  5. In the "Authorize Device" dialog box, you can assign it to an existing ADOM (Administrative Domain) or create a new one. A "Root" ADOM is the default for single-ADOM setups. For larger deployments, ADOMs provide logical separation of devices and data.
  6. Click OK.

Once authorized, the FortiGate should move to the "Authorized Devices" list. Its status should eventually change from "Unauthorized" or "Offline" to "Online."

Configuring ADOMs (If Applicable)

If you're using ADOMs, ensure the FortiGate is assigned to the correct one. ADOMs are critical for multi-tenancy or organizing logs from different FortiGates into distinct analysis contexts. You can create ADOMs under System Settings > ADOMs.

Verification and Troubleshooting

After configuration on both ends, it's crucial to verify that logs are flowing correctly.

On the FortiAnalyzer

  1. Device Manager Status: In Device Manager, check the FortiGate's status. It should be "Online" and ideally show "Log Status: Receiving." If it shows "Offline" or "Log Status: Not Receiving," there's an issue.
  2. Log View: Navigate to Log View > FortiGate > Traffic or Security. Select the specific FortiGate from the device list. You should start seeing live logs appear. It can take 5-10 minutes for the first batch of logs to be processed and displayed.
  3. System Event Logs: Check Log View > FortiAnalyzer > System. Look for messages related to device authorization or log receiving from your FortiGate. For instance, "Log received from device <FortiGate_SN>" confirms log ingestion.

On the FortiGate

  1. CLI Log Status: 
    diagnose log fortianalyzer test-connectivity
diagnose test application miglogd 8

    The test-connectivity command will attempt to connect to the FortiAnalyzer and report success or failure. The miglogd 8 command provides detailed debug output for the log daemon, showing connection attempts, successful log sending, or errors.

  2. Log Forwarding Statistics: 
    get log fortianalyzer setting

    This command will show the current configuration and statistics like the number of logs uploaded and errors encountered.

  3. Network Connectivity Check: 
    execute ping 10.10.10.10  <-- Ping FortiAnalyzer IP
execute telnet 10.10.10.10 514 <-- Telnet to UDP/TCP port 514 (or 50001 if reliable/Fabric ADOM)

    A successful telnet on the correct port indicates network reachability. If telnet fails, check firewalls (FortiGate outbound policy, any intermediate firewalls, FortiAnalyzer's local firewall) and routing.

Common Pitfalls

  • Firewall Rules: Often overlooked. Ensure an explicit security policy exists on the FortiGate allowing outbound UDP/TCP 514 (or 50001) traffic from the FortiGate's logging interface to the FortiAnalyzer's IP address.
  • ADOM Mismatch: If the FortiGate is assigned to an ADOM that doesn't exist or isn't properly configured on the FortiAnalyzer, logs won't be processed correctly.
  • Time Skew: Significant time differences between the FortiGate and FortiAnalyzer can cause logs to be rejected or improperly indexed, leading to issues with reporting. Use NTP on both.
  • FortiAnalyzer Disk Space/License: If the FortiAnalyzer is out of disk space or has exceeded its device/log capacity license, it will stop receiving and storing logs.
  • Incorrect Source IP: If set source-ip is configured on the FortiGate, but the FortiAnalyzer is expecting logs from a different IP (e.g., if there's NAT in between or if the FortiAnalyzer's local firewall is IP-restricted), logs won't be accepted.
  • Reliable Logging and Ports: If set reliable enable is used, the FortiGate expects TCP port 514 (or 50001 for Fabric ADOMs) to be open and listening on the FortiAnalyzer. A common mistake is only allowing UDP 514.
  • PKI Configuration Errors: If pki-based enable is used without proper certificate setup on both devices, authentication will fail, and logs will not be sent. For initial setup, it's often easier to disable PKI and re-enable once basic logging is confirmed.

Back to the knowledge base · Ask the AI assistant