Technical Tip: Troubleshooting FortiGate not getting connected to FortiAnalyzer Cloud

Description

This article describes the steps to troubleshoot a FortiGate device that is not getting connected and logging to FortiAnalyzer Cloud. The user may encounter this issue when the FortiGate device is not visible on the FortiAnalyzer Cloud portal.

Scope

FortiGate, FortiAnalyzer.

Solution

To troubleshoot the issue, follow these steps:

1. Confirm account registration and subscription.

• Ensure both FortiGates and the FortiAnalyzer Cloud subscription are under the same FortiCare account.

• Verify an 'active FortiAnalyzer Cloud license' exists for each firewall.

• If devices were recently re-registered, allow synchronization with FortiCloud before testing connectivity.

2. Check connectivity and authentication.

Run the CLI command on the FortiGate:

execute log fortianalyzer-cloud test-connectivity

The expected output will provide the following information:

• Registration: Registered.

• Connection: Allow.

• Tx/Rx counters increasing.
   

If the either the error 'Authentication Failed (-19)' or 'Not Authorized' occurs, re-authenticate under the same FortiCare account and confirm tenant alignment in the FortiCloud portal.

3. Re-onboard to FortiAnalyzer Cloud (if previously reset or moved):

Via the GUI Path:
Go to Security Fabric -> Fabric Connectors -> Logging & Analytics -> Edit -> Enable FortiAnalyzer Cloud Logging -> Apply.

CLI alternative:

• 'set status' is disabled by default.

config log fortianalyzer-cloud setting 
    set status enable
    set upload-option realtime 
end

Make sure the FortiGate devices can reach FortiAnalyzer Cloud endpoints (e.g., 'logctrl1.fortinet.com').

4. Troubleshoot common causes:

• FortiManager interference: If FortiAnalyzer is managed by FortiManager, run `execute log device permissions all all enable`.

• Certificate or firmware mismatches: Renew certificates using `diagnose forticare direct-registration`, and ensure firmware compatibility with FortiAnalyzer Cloud.

• HA group naming issue: Avoid special characters in HA group names when using HA.

5. Verification after fix:

• From Log & Report -> Log Settings, verify that Cloud Logging is Authorized and Upload Option is set to Realtime. Use diagnostic commands like 'diagnose test application fgtlogd 1'.

• Confirm the connection state shows connected and log counters increment.

• If logs still do not resume, open a TAC ticket with the debug output  (from 'diagnose debug flow', 'execute log fortianalyzer-cloud test-connectivity') attached.

To get in touch with TAC support:

It is recommended to contact TAC by creating a web ticket in the the Fortinet Support Portal -> Guidelines and Policies ->  FortiCompanions and Ticket Creation Guide.