Staff

Technical Tip: How to migrate a FortiAnalyzer log and config to a new system after an RMA or a FortiAnalyzer upgrade

Forum|Forum|8 years ago
August 2, 2018
0 replies
65153 views

Description

This article describes how to migrate logs and the configuration from one FortiAnalyzer to another. This is useful for replacing FortiAnalyzer or FortiAnalyzer platform upgrade or replacement (RMA).

Scope

FortiAnalyzer.

Solution

Note:
This is a guide on how to migrate from FortiAnalyzer to another FortiAnalyzer of the same type or model, and the version of firmware must be the same. To transfer the config to a different HW or VM type, use the execute migrate all-settings <ftp/scp/sftp> CLI command.
When migrating VM FortiAnalyzer data, two valid VM-licensed instances are needed. (Alternatively, use the same VM license within the 7-day grace period before the license becomes invalid.)
Regardless of the destination, the destination FortiAnalyzer must have at least the same ADOM quota allocated as the source FortiAnalyzer (the 'diagnose log device' CLI command can be used for verification).

FortiAnalyzer replacement.

Note:

This article focuses only on operational FortiAnalyzer units that need to be migrated due to a platform upgrade or other reasons.
If the FortiAnalyzer replacement is linked to hardware issues, backing up the system configuration and logs should be done before the issue arises. Setting up an automatic backup is recommended for each FortiAnalyzer unit, but that topic is beyond the scope of this article.

FortiAnalyzer hardware replacement must be done using the same kind of hardware and software. The first step is to prepare the new FortiAnalyzer with the same configuration as the old one by performing a config backup and restore process.

If the user needs to perform a hardware migration, this section may be skipped. Relevant information can be found in the following article for exporting devices:
Log data migration from an old FortiAnalyzer to a new FortiAnalyzer

Migrate the configuration:

Configure the backup and restore process. Go to System Settings -> System Configuration -> Backup.

Disable the Encryption option as follows:

Using the CLI:

This example shows how to back up all FortiAnalyzer unit system settings to a file named faz.cfg on a server at IP address 10.5.50.40 using the ftpuser username and a password of 12345678:

execute backup all-settings ftp 10.5.50.40 /ftpbackup/allsetting/faz.dat ftpuser 12345678

Validate the config integrity:
Modify the config file extension format from *.dat to *.tgz:

Check whether the file can be decompressed without issue.

Install the config file on a new FortiAnalyzer after renaming it back to the *.dat format.

Uncheck the Overwrite current IP and routing settings option to avoid any duplicate IP conflicts with the old system.

Repoint FortiGates to the new FortiAnalyzer:

Once the new FortiAnalyzer is ready to receive the logs from the FortiGate, all the senders need to be configured so that the new IP address is used to receive logs.

To do this, use the following CLI command:

config log fortianalyzer2 setting

Log in to each FortiGate CLI and repoint them to the new FortiAnalyzer.
This can be done with a FortiManager script.

Migrate the archive logs:

There are many ways to migrate the archive logs from old to new FortiAnalyzer. For a description of each approach and the pros and cons of each, see:
Technical Tip: Different methods for migrating logs between FortiAnalyzer units | Community

After archive logs are transferred over, the new FortiAnalyzer will generate the Analytic logs based upon the Archive logs.

Related articles: