Technical Tip: Troubleshooting FortiGate not getting connected to FortiAnalyzer Cloud

To troubleshoot the issue, follow these steps:

1. Confirm account registration and subscription.

• Ensure both FortiGates and the FortiAnalyzer Cloud subscription are under the same FortiCare account.
• Verify an 'active FortiAnalyzer Cloud license' exists for each firewall.
• If devices were recently re-registered, allow synchronization with FortiCloud before testing connectivity.

2. Check connectivity and authentication.

Run the CLI command on the FortiGate:

execute log fortianalyzer-cloud test-connectivity

The expected output will provide the following information:

• Registration: Registered.
• Connection: Allow.
• Tx/Rx counters increasing.
   

If the following error occurred ('Authentication Failed (-19)' or 'Not Authorized'), re-authenticate under the same FortiCare account and confirm tenant alignment in the FortiCloud portal.

3. Re-onboard to FortiAnalyzer Cloud (if previously reset or moved):

Via the GUI Path:

Go to Security Fabric -> Fabric Connectors -> Logging & Analytics -> Edit -> Enable FortiAnalyzer Cloud Logging -> Apply.

CLI alternative:

config log fortianalyzer-cloud setting
    set status enable
    set upload-option realtime
end

Make sure the FortiGate devices can reach FortiAnalyzer Cloud endpoints (e.g., 'logctrl1.fortinet.com').

4. Troubleshoot common causes:

• FortiManager interference: If FortiAnalyzer is managed by FortiManager, run `execute log device permissions all all enable`.
• Certificate or firmware mismatches: Renew certificates using `diagnose forticare direct-registration`, and ensure firmware compatibility with FortiAnalyzer Cloud.
• HA group naming issue: Avoid special characters in HA group names when using HA.

5. Verification after fix:

• From Log & Report -> Log Settings, verify that Cloud Logging is Authorized and Upload Option is set to Realtime. Use diagnostic commands like 'diagnose test application fgtlogd 1'.

• Confirm the connection state shows connected and log counters increment.

• If logs still do not resume, open a TAC ticket with the debug output  (from 'diagnose debug flow', 'execute log fortianalyzer-cloud test-connectivity') attached.

To get in touch with TAC support:

It is recommended to contact TAC by creating a web ticket in the the Fortinet Support Portal -> Guidelines and Policies ->  FortiCompanions and Ticket Creation Guide.