Technical Tip: Error 'FortiAnalyzer stopped to detect FortiGate in manager device'

FortiGate device was registered previously in FortiAnalyzer.

The current status is down.

Key information with the current evidence:

1. It was working properly.
2. It can verify the same IP and Serial Number.

It identified the last date/time FortiAnalyzer logged last time.

1. Verify topology used, in this point, FortiAnalyzer and FortiGate are in the same network according to design.
   
   

2. Verify the FortiGate status and if it is up and working without alarms.

    

   

    

3. Verify connectivity between FortiGate and FortiAnalyzer.
   
   From FortiGate to FortiAnalyzer.
   
   

    

   From FortiAnalyzer to FortiGate.
   
   

                                  

4. Verify the upgrade path in FortiAnalyzer according to the reporter just upgraded FortiAnalyzer to the latest version but FortiGate was registered correctly and sometime before it stopped it was being registered.
   
   

   

5. Verify the status of FortiAnalyzer and it is ok.
   
   

   

    

6. Verify the test from FortiGate to FortiAnalyzer and verify the status in FAZ.

    

   

    

   

    

7. Perform a sniffer and confirm there are sharing packets in port 443.
                                       
                                 

8. Verify the log received during the last days and confirm FortiAnalyzer received this week's logs from FortiGate but this day does not.
                                

   

    

9. In the security fabric, it could confirm the connector was enabled and the parameters were correct.
               
   
   

    

   

    

10. According to this information, the FortiAnalyzer is working and the next step is to validate the FortiGate side. During validation, the status of FortiGate can be something different from the original status of the FortiGate shared by the reporter. The FortiGate originally was stand-alone and now is in HA.

     

    

     

11. Validate the FortiGate system setting for HA and confirm HA was created near of issue date.

     

    

     

    

     

12. After checking that it could match the status in FortiAnalyzer where is not defined as HA in FortiAnalyzer:

       

    

     

13. It was needed to edit the configuration in FortiAnalyzer to enable HA type and add the 2nd serial number.
    
    

    

     

    

     

    

     

    

     

     

The problem caused: HA was configured recently and did not change the configuration in FortiAnalyzer of the HA cluster.

After reconfiguring HA parameters and adding a secondary device, the serial number could go up correctly.