Technical Tip: How to configure FortiWeb to send logs to FortiAnalyzer

Description

Scope

Solution:

1. Configure FortiWeb with a FortiAnalyzer IP.

• Go to Log & Report -> Log Policy -> FortiAnalyzer Policy.
• Create a new policy.
  
• Set Name.
• Set FortiAnalyzer IP.
• Select 'OK'.

 

• Using the FortiWeb CLI:

 

config log fortianalyzer-policy
    edit "0"
        set ip-address <FortiAnalyzer-IP>
    next
end

 

2. Configure FortiAnalyzer log settings.

• Go to Log & Report -> Log Config -> Global Log Settings.
• Enable the FortiAnalyzer checkbox.
• Specify 'Log Level' as 'Information'.
  
• Specify 'FortiAnalyzer Policy' as 'FortiAnalyzer' (the name of the FortiAnalyzer policy created in the previous step).
• Select 'Apply'.
  
  

 

• Using the CLI:

 

config log forti-analyzer
    set severity debug
    set fortianalyzer-policy 0
end

 

On the FortiAnalyzer:

1. ADOM Configuration.

• Enable the ADOM, either from the Dashboard or from System Settings -> ADOMs.
  
  

2. Device registration.

• Go to Root-ADOM -> Device Manager -> Unregistered device.

 

• After selecting 'OK', the device will be added, verified, and 'CLOSE' will be selected.

• Log in to the FortiWeb ADOM:

There is another option to integrate FortiWeb with FortiAnalyzer.

 

1. Creating New ADOM.

• Go to System Settings -> ADOMs -> Create New.
• Set Name.
• Select 'FortiWeb' as the type.
• Keep all other settings with default values.
• Select 'OK'.
  
  

 

2. Change to the New FortiWeb ADOM to integrate FortiWeb.

    

   • Go to Dashboard -> Select the ADOM Button.
                                                      

   

   • Select the new FortiWeb ADOM created.
     
     

   

    

3. Configure FortiWeb in FortiAnalyzer -> Device Manager.

   • Go to Device Manager.
   • Select Add Device.
     
     

   

    

   • Set Name.
   • Select Link Device by: Serial Number.
   • Set FortiWeb Serial Number.
   • Select FortiWeb Device Model.
   • Select 'Next'.

    

   

    

   • A New Database is created, and FortiWeb will be integrated.
   • Select 'Next' to finish.

    

   

    

   • It is possible to see the wrong Version and Model; it is normal, as FortiAnalyzer and FortiWeb need to complete the synchronization.
     
     

   

    

   • Complete the configuration on FortiWeb (as mentioned in step 1). Then, after a few seconds, the FortiWeb connects to FortiAnalyzer and the correct information is visible.
     
     

   

Related documents:

• Logging
• Adding Devices