Technical Tip: Difference in FortiSwitch Registration with FortiAnalyzer when NAT is enabled

Description

This article describes the differences when NAT is enabled on FortiGate and how the FortiSwitches linked to FortiGate appear registered as syslog devices in FortiAnalyzer.

Scope

FortiAnalyzer v7.6.x.

Solution

When adding FortiSwitches connected to FortiGate via Fortilink, there are differences on how those devices are registered in FortiAnalyzer based on whether NAT is enabled on the Firewall Policy allowing that traffic flow.

The topology consists of a FortiGate connected to 2xFortiSwitches as follows:

FG200F# execute switch-controller get-conn-status

Managed-devices in current vdom root:
FortiLink interface : fortilink
SWITCH-ID VERSION STATUS FLAG ADDRESS JOIN-TIME SERIAL

S424EPTFXXXXXX v7.6.6 (1137) Authorized/Up 2 180.180.180.2 Tue Jun 23 04:38:44 2026 S424EPTFXXXXXX

S424EPTFYYYYYY v7.6.6 (1137) Authorized/Up 2 180.180.180.3 Tue Jun 23 04:41:45 2026 S424EPTFYYYYYY

Flags: C=config sync, U=upgrading, S=staged, D=delayed reboot pending, E=config sync error, 2=L2, 3=L3, V=VXLAN, T=tunnel, X=External

Managed-Switches: 2 (UP: 2 DOWN: 0 MAX: 64)

1. NAT is disabled:

FG200F)# show firewall policy 2
config firewall policy
edit 2
set name "FAZ"
set uuid f7484b5a-6e18-51f1-c4d1-cfe5bd60cbb8
set srcintf "fortilink"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
next
end

Two syslog device type will appear as unauthorized devices with their own Fortilink IP addresses.
They are authorized and Device Name is assigned to them:

Note:
The derived Serial Number is the dotted decimal representation of the IP Address of each FortiSwitch, e.g.:

180.180.180.2 = B4B4B402

2. NAT is enabled:
   
   

FG200F# show firewall policy 2 
config firewall policy
edit 2
set name "FAZ"
set uuid f7484b5a-6e18-51f1-c4d1-cfe5bd60cbb8
set srcintf "fortilink"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set nat enable
next
end

Now only one entry will appear as Syslog-Device, that is due to the fact that Fortilink IP addresses are being translated to a FortiGate Port1 IP address.
Since the decimal conversion is done for the Serial Number 0A05D3E1 which equals 10.5.211.225, only one entry is effectively registered.

Although it is important to take into account that all syslog logs from both FortiSwitches will still be received under Logs -> Fortinet Logs -> Syslog.

However all logs will be stored with the given Device Name. The device_id that is the real Serial Number of each FortiSwitch will still be contained in the logs: