How-to: Configure Collector mode on a FortiAnalyzer

The FortiAnalyzer allows you to aggregate logs from multiple FortiGate firewalls giving you a central console to view logs, alerts and run reports for all the FortiGates in your organisation.

 Each FortiAnalyzer can only handle a certain number of logs per second, be it the hardware or VM models. If you have dozens, hundreds or even thousands of FortiGates it would not be feasible to have all these devices send their logs to one FortiAnalyzer. Good news is that FortiAnalyzers can be configured in a 'collector' mode and deployed regionally to take the burden from your Analyzer that is doing the reporting.

One advantage of this is that FortiAnalyzer VMs that have been configured as a collector have no GB per day limitation as their standard config does. This means you'll only need a FortiAnalyzer VM BASE license for each of the remote regions.

In this example I'll configure two FortiGates and FortiAnalyzers that have been configured in collector modes. This will simulate two regions for my organisation and the firewalls within each region. The collectors will then forward their logs to the global Analyzer from where I can run reports for the entire organisation.

The FortiGates are running 5.4.0 and the FortiAnalyzers 5.2.5.

Q&A: Can you stack FortiCloud licenses to increase the duration?

Yes you can. If you add multiple FortiCloud 1 year licenses to a FortiGate, it will increase the amount of years.

It won't increase the storage space however.

FortiWeb RADIUS authentication login failing

I'm currently rebuilding my FortiWeb VM in the lab and started the configuration from scratch.

One of the config steps I have for all my devices is to use RADIUS for the user authentication. For some reason though when I test the RADIUS server it keeps on giving me a timeout error.

Looking at my FortiAuthenticator I can see the request has come through and been authenticated correctly.

So what's going on here?

How-to: Seperate UTM security logs from traffic logs

With FortiOS 5.0 Fortinet had decided to consolidate all logs into the traffic log. This improves performance, and allows you to search for all logs (traffic and security) in the one screen.

While I can see the benefit and reasoning behind this, I prefer to have my security logs separated from my traffic ones since they are generally the kind that I would look through.

Thankfully Fortinet haven't disabled this feature and still allow you to configure the device to separate the security and traffic logs. We'll go through the steps required to enable this for each of the security profiles.

Unable to see any applications in 'Top Applications' on a FortiGate

Recently upon upgrading to 5.0.5 I've noticed that none of the applications are showing up correctly in the 'Top Applications' dashboard. Instead they are all showing up as 'Unknown'.

We'll go through the quick steps to re-enable Application logging so that this dashboard shows us the correct applications.

How-to: Enable disk logging on a FortiGate running FortiOS 5

By default disk logging has been disabled on FortiOS v5.0. One of the reasons this was done is because the flash memory on some devices are not designed for constant read/writes, so saving logs to it can degrade the disk (resulting in corrupted sectors). Having said that, we've got a few FortiGates that have been logging to disk for a few years now with no problems.