Troubleshooting Tip: FortiGate HA devices are unable to connect to FortiAnalyzer due to special characters

To resolve the issue of FortiGate devices not connecting to FortiAnalyzer or FortiAnalyzer Cloud, follow these steps:

Check the HA group name configuration on the FortiGate devices. The HA group name should not contain any characters such as '<>()#\"'.' due to FortiAnalyzer limitations.

Rename the HA group name 'HAgroup.123' to a valid format, such as 'HAgroup-123', and re-test the connection to FortiAnalyzer.

Refer to the config below :

config system ha

    set group-name HAGroup-123                         <------  No special characters. 

end

Run the FortiAnalyzer debug commands below and check the error:

diagnose debug app oftpd 8 x.x.x.x      <----- IP address of the FortiGate.

diagnose debug timestamp enable
diagnose debug enable

2025-04-18 05:42:54 [firmware_version_info_parse:323 ] os_type(0) os_ver(7) mr(2) patch(8) build(1639)
2025-04-18 05:42:54 [__fill_dev_ext_info:362 ] ha_group_name:fw001/02, ha_mode:1.
2025-04-18 05:42:54 [_login_get_other_opt:3230 ] vdom = 1
2025-04-18 05:42:54 [OFTP_send_SSL_packet:1999 FGVM8VTM22001609] SSL socket[54] pid[24867] ssl[0x7f95c40ce640] sent [129] bytes:
2025-04-18 05:42:54 [__helper_thr_run_task:3959 FGVM8VTM22001609] LOGIN_REQUEST_LEGACY error:<-----
2025-04-18 05:42:54 [__SSL_info_callback:301] SSLv3/TLS read client certificate

On FortiGate, run the following debug commands and check the error:

diagnose debug application fgtlogd 7

diagnose debug timestamp enable
diagnose debug enable

<2151> __handle_logs()-1129: 2184 bytes received
pid:16562-__oftp_auth_rcvd()-757: Oftp login failed. 19
<16562> __on_connect()-1666: oftp_connect(global-faz) failed: oftp failed to authenticate.  <-----
pid:16562-__handle_msg()-414: Subscriber:1 received package. pubid:1 pkgid:45462 pkg_index:0

Disable the debug commands using the following set of commands:

diagnose debug disable
diagnose debug reset

Workaround: Add the device manually to the FortiAnalyzer.

For more information on configuring FortiGate devices for logging to FortiAnalyzer, refer to the Fortinet Support Portal.

Related articles:

Technical Tip: How to enable FortiAnalyzer Logging on FortiGate using FortiManager