Fortinet black logo

Handbook

FortiAnalyzer Connector

FortiAnalyzer Connector

When you create a connector for FortiAnalyzer, you are specifying how FortiADC can communicate with FortiAnalyzer for pushing logs to FortiAnalyzer. You can choose between two protocol types for sending logs to FortiAnalyzer: Syslog or OFTP.

Using the Syslog protocol will allow FortiADC to connect to FortiAnalyzer by UDP, TCP or TCP SSL depending on the FortiAnalyzer connector setting.

OFTP (Optimized Fabric Transfer Protocol) is used to synchronize information between FortiAnalyzer and other Fortinet products. So, this is the recommended protocol to use for pushing logs to FortiAnalyzer.

Requirements:
  • The FortiAnalyzer service is required to be exposed on External IP.

FortiADC supports integration with FortiAnalyzer versions 7.0.2 or later. As earlier versions of FortiAnalyzer is not optimally compatible with FortiADC, unexpected behavior may occur.

To create a FortiAnalyzer Connector:
  1. Go to Security Fabric > Fabric Connectors.
  2. Click Create New.
  3. Under Other Fortinet Products, click FortiAnalyzer to display the configuration editor.
  4. Configure the following Server Type settings:

    Setting

    Description

    Type

    Select either of the following options:

    • Syslog — To send logs to FortiAnalyzer using the syslog protocol.
    • FortiAnalyzer — To send logs to FortiAnalyzer using the OFTP.
    Depending on your Type selection, either the Syslog Server or FortiAnalyzer configuration section will appear.
  5. If the Server Type is Syslog, configure the following Syslog Server settings:

    Setting

    Description

    Status

    Enable/disable the Fabric Connector object.

    Address Specify the IP address of the FortiAnalyzer Log server.
    Port

    Specify the port that FortiADC uses to communicate with the log server.

    This is the listening port number of the syslog server. Usually this is UDP port 514.

    Proto

    Select the protocol used for log transfer from the following:

    • UDP

    • TCP

    • TCP SSL

    TCP Framing

    If Proto is TCP or TCP SSL, the TCP Framing options appear.

    Select one of the following options:

    • Traditional

    • Octet Counted

    Log Level

    Select the lowest severity to log from the following options:

    • Emergency — The system has become unstable.
    • Alert — Immediate action is required.
    • Critical — Functionality is affected.
    • Error — An error condition exists and functionality could be affected.
    • Warning — Functionality might be affected.
    • Notification — Information about normal events.
    • Information — General information about system operations.
    • Debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

    The exported logs will include the selected severity level and above. For example, if you select Error, the system sends the syslog server logs with level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with severity level Alert and Emergency.

    CSV

    Enable to export the logs as a CSV file.

    Facility

    Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use.

    Event

    Enable/disable logging for events.

    Event Category

    If Event is enabled, the Event Category options appear.

    Select one or more of the following event categories to include in the event logs export:

    • Configuration — Configuration changes.
    • Admin — Administrator actions.
    • System — System operations, warnings, and errors.
    • User — Authentication results logs.
    • Health Check — Health check results and client certificate validation check results.
    • SLB — Notifications, such as connection limit reached.
    • LLB — Notifications, such as bandwidth thresholds reached.
    • GLB — Notifications, such as the status of associated local SLB and virtual servers.
    • Firewall — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

    Traffic

    Enable/disable logging for traffic processed by the load-balancing modules.

    Traffic Category

    If Traffic is enabled, the Traffic Category options appear.

    Select one or more of the following traffic categories to include in the traffic logs export:

    • SLB — Server Load Balancing traffic logs related to sessions and throughput.
    • GLB — Global Load Balancing traffic logs related to DNS requests.
    • LLB — Link Load Balancing traffic logs related to session and throughput.

    Security

    Enable/disable logging for traffic processed by the security modules.

    Security Category

    If Security is enabled, the Security Category options appear.

    Select one or more of the following security categories to include in the security logs export:

    • DDoS — DoS protection logs.
    • IP Reputation — IP Reputation logs.
    • WAF — WAF logs.
    • GEO — Geo IP blocking logs.
    • AV — AV logs.
    • IPS — IPS logs.
    • FW — Firewall logs.
  6. If the Server Type is FortiAnalyzer, configure the following FortiAnalyzer settings:

    Setting

    Description

    Status

    Enable/disable the Fabric Connector object.

    Address Specify the IP address of the FortiAnalyzer Log server.

    Log Level

    Select the lowest severity to log from the following options:

    • Emergency — The system has become unstable.
    • Alert — Immediate action is required.
    • Critical — Functionality is affected.
    • Error — An error condition exists and functionality could be affected.
    • Warning — Functionality might be affected.
    • Notification — Information about normal events.
    • Information — General information about system operations.
    • Debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

    The exported logs will include the selected severity level and above. For example, if you select Error, the system collects logs with severity level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with severity level Alert and Emergency.

    Event

    Enable/disable logging for events.

    Event Category

    If Event is enabled, the Event Category options appear.

    Select one or more of the following event categories to include in the event logs export:

    • Configuration — Configuration changes.
    • Admin — Administrator actions.
    • System — System operations, warnings, and errors.
    • User — Authentication results logs.
    • Health Check — Health check results and client certificate validation check results.
    • SLB — Notifications, such as connection limit reached.
    • LLB — Notifications, such as bandwidth thresholds reached.
    • GLB — Notifications, such as the status of associated local SLB and virtual servers.
    • Firewall — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

    Traffic

    Enable/disable logging for traffic processed by the load-balancing modules.

    Traffic Category

    If Traffic is enabled, the Traffic Category options appear.

    Select one or more of the following traffic categories to include in the traffic logs export:

    • SLB — Server Load Balancing traffic logs related to sessions and throughput.
    • GLB — Global Load Balancing traffic logs related to DNS requests.
    • LLB — Link Load Balancing traffic logs related to session and throughput.

    Security

    Enable/disable logging for traffic processed by the security modules.

    Security Category

    If Security is enabled, the Security Category options appear.

    Select one or more of the following security categories to include in the security logs export:

    • DDoS — DoS protection logs.
    • IP Reputation — IP Reputation logs.
    • WAF — WAF logs.
    • GEO — Geo IP blocking logs.
    • AV — AV logs.
    • IPS — IPS logs.
    • FW — Firewall logs.
  7. Click Save.

After the connector is created, FortiADC will push the logs to the FortiAnalyzer server. The above configurations are also available in Log&Report > Log Setting > Syslog Server tab or FortiAnalyzer tab.

FortiAnalyzer Connector

When you create a connector for FortiAnalyzer, you are specifying how FortiADC can communicate with FortiAnalyzer for pushing logs to FortiAnalyzer. You can choose between two protocol types for sending logs to FortiAnalyzer: Syslog or OFTP.

Using the Syslog protocol will allow FortiADC to connect to FortiAnalyzer by UDP, TCP or TCP SSL depending on the FortiAnalyzer connector setting.

OFTP (Optimized Fabric Transfer Protocol) is used to synchronize information between FortiAnalyzer and other Fortinet products. So, this is the recommended protocol to use for pushing logs to FortiAnalyzer.

Requirements:
  • The FortiAnalyzer service is required to be exposed on External IP.

FortiADC supports integration with FortiAnalyzer versions 7.0.2 or later. As earlier versions of FortiAnalyzer is not optimally compatible with FortiADC, unexpected behavior may occur.

To create a FortiAnalyzer Connector:
  1. Go to Security Fabric > Fabric Connectors.
  2. Click Create New.
  3. Under Other Fortinet Products, click FortiAnalyzer to display the configuration editor.
  4. Configure the following Server Type settings:

    Setting

    Description

    Type

    Select either of the following options:

    • Syslog — To send logs to FortiAnalyzer using the syslog protocol.
    • FortiAnalyzer — To send logs to FortiAnalyzer using the OFTP.
    Depending on your Type selection, either the Syslog Server or FortiAnalyzer configuration section will appear.
  5. If the Server Type is Syslog, configure the following Syslog Server settings:

    Setting

    Description

    Status

    Enable/disable the Fabric Connector object.

    Address Specify the IP address of the FortiAnalyzer Log server.
    Port

    Specify the port that FortiADC uses to communicate with the log server.

    This is the listening port number of the syslog server. Usually this is UDP port 514.

    Proto

    Select the protocol used for log transfer from the following:

    • UDP

    • TCP

    • TCP SSL

    TCP Framing

    If Proto is TCP or TCP SSL, the TCP Framing options appear.

    Select one of the following options:

    • Traditional

    • Octet Counted

    Log Level

    Select the lowest severity to log from the following options:

    • Emergency — The system has become unstable.
    • Alert — Immediate action is required.
    • Critical — Functionality is affected.
    • Error — An error condition exists and functionality could be affected.
    • Warning — Functionality might be affected.
    • Notification — Information about normal events.
    • Information — General information about system operations.
    • Debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

    The exported logs will include the selected severity level and above. For example, if you select Error, the system sends the syslog server logs with level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with severity level Alert and Emergency.

    CSV

    Enable to export the logs as a CSV file.

    Facility

    Select the source facility of the logs. We only support the local use facilities which are not reserved and are available for general use.

    Event

    Enable/disable logging for events.

    Event Category

    If Event is enabled, the Event Category options appear.

    Select one or more of the following event categories to include in the event logs export:

    • Configuration — Configuration changes.
    • Admin — Administrator actions.
    • System — System operations, warnings, and errors.
    • User — Authentication results logs.
    • Health Check — Health check results and client certificate validation check results.
    • SLB — Notifications, such as connection limit reached.
    • LLB — Notifications, such as bandwidth thresholds reached.
    • GLB — Notifications, such as the status of associated local SLB and virtual servers.
    • Firewall — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

    Traffic

    Enable/disable logging for traffic processed by the load-balancing modules.

    Traffic Category

    If Traffic is enabled, the Traffic Category options appear.

    Select one or more of the following traffic categories to include in the traffic logs export:

    • SLB — Server Load Balancing traffic logs related to sessions and throughput.
    • GLB — Global Load Balancing traffic logs related to DNS requests.
    • LLB — Link Load Balancing traffic logs related to session and throughput.

    Security

    Enable/disable logging for traffic processed by the security modules.

    Security Category

    If Security is enabled, the Security Category options appear.

    Select one or more of the following security categories to include in the security logs export:

    • DDoS — DoS protection logs.
    • IP Reputation — IP Reputation logs.
    • WAF — WAF logs.
    • GEO — Geo IP blocking logs.
    • AV — AV logs.
    • IPS — IPS logs.
    • FW — Firewall logs.
  6. If the Server Type is FortiAnalyzer, configure the following FortiAnalyzer settings:

    Setting

    Description

    Status

    Enable/disable the Fabric Connector object.

    Address Specify the IP address of the FortiAnalyzer Log server.

    Log Level

    Select the lowest severity to log from the following options:

    • Emergency — The system has become unstable.
    • Alert — Immediate action is required.
    • Critical — Functionality is affected.
    • Error — An error condition exists and functionality could be affected.
    • Warning — Functionality might be affected.
    • Notification — Information about normal events.
    • Information — General information about system operations.
    • Debug — Detailed information about the system that can be used to troubleshoot unexpected behavior.

    The exported logs will include the selected severity level and above. For example, if you select Error, the system collects logs with severity level Error, Critical, Alert, and Emergency. If you select Alert, the system collects logs with severity level Alert and Emergency.

    Event

    Enable/disable logging for events.

    Event Category

    If Event is enabled, the Event Category options appear.

    Select one or more of the following event categories to include in the event logs export:

    • Configuration — Configuration changes.
    • Admin — Administrator actions.
    • System — System operations, warnings, and errors.
    • User — Authentication results logs.
    • Health Check — Health check results and client certificate validation check results.
    • SLB — Notifications, such as connection limit reached.
    • LLB — Notifications, such as bandwidth thresholds reached.
    • GLB — Notifications, such as the status of associated local SLB and virtual servers.
    • Firewall — Notifications for the Firewall module, such as SNAT source IP pool is using all of its addresses.

    Traffic

    Enable/disable logging for traffic processed by the load-balancing modules.

    Traffic Category

    If Traffic is enabled, the Traffic Category options appear.

    Select one or more of the following traffic categories to include in the traffic logs export:

    • SLB — Server Load Balancing traffic logs related to sessions and throughput.
    • GLB — Global Load Balancing traffic logs related to DNS requests.
    • LLB — Link Load Balancing traffic logs related to session and throughput.

    Security

    Enable/disable logging for traffic processed by the security modules.

    Security Category

    If Security is enabled, the Security Category options appear.

    Select one or more of the following security categories to include in the security logs export:

    • DDoS — DoS protection logs.
    • IP Reputation — IP Reputation logs.
    • WAF — WAF logs.
    • GEO — Geo IP blocking logs.
    • AV — AV logs.
    • IPS — IPS logs.
    • FW — Firewall logs.
  7. Click Save.

After the connector is created, FortiADC will push the logs to the FortiAnalyzer server. The above configurations are also available in Log&Report > Log Setting > Syslog Server tab or FortiAnalyzer tab.