Troubleshooting Tip: FortiAnalyzer Packet Capture

FortiGate and other Fortinet products use the OFTPD protocol to transfer logging data through secure or insecure protocols over port 514.

To track the traffic, first confirm the protocol used, for example, on a FortiGate device, run the following command:

To be executed on FortiGate:

get log fortianalyzer setting

    set status enable

    set certificate-verification enable

    set reliable enable -> Disabled by default.

The setting of reliable enables TCP, together with certificate verification establish a secure connection. If the setting is disabled, then UDP will be used to forward logging data.

For testing purposes, capture the inbound traffic from a FortiGate to the FortiAnalyzer port1.

• From the GUI -> System Settings -> Network -> Packet Capture, + Create New.

• Select OK and start capturing from the Actions column.

• Once the sample is taken, select stop and download in the Actions column.

• Open the resulting file with the desired network analyzer.