Skip to main content
KT06
Visitor III
March 20, 2026
Question

FortiSIEM 7.2.5 Linux Agent Picking Wrong Interface (Need Fix Without Upgrade)

  • March 20, 2026
  • 5 replies
  • 304 views

Hello Community, I have successfully installed the FortiSIEM Linux Agent version 7.2.5 on a production RHEL server. The installation completed without any errors and the agent is visible in the CMDB console. However, I am facing an issue with the network interface selection. Issue: The agent is automatically picking up the primary network interface (eno1) which has the IP 10.10.10.10, and this IP is being registered in the CMDB. But this interface is dedicated to our internal heartbeat monitoring service and is not the correct management IP. The correct IP of this server is 10.10.20.10 which is assigned to interface eno5np0. I need the CMDB to reflect this IP (10.10.20.10) instead of 10.10.10.10. What I have tried: I checked the installer help options and noticed that the -I flag (network interface selection) is available in version 7.3.0 and above, but it does NOT appear to be supported in version 7.2.5. When I try using -I in the install command, it just displays the help screen. Environment Details: • FortiSIEM Version: 7.2.5 • Linux Agent Version: 7.2.5.0274 • OS: RHEL (Production Server) • Primary Interface: eno1 — IP: 10.10.10.10 (used for heartbeat service) • Required Interface: eno5np0 — IP: 10.10.20.10 (management/production IP) Questions: 1. Is there any supported way in version 7.2.5 to specify which network interface the Linux Agent should use during or after installation? 2. Is editing the linux-agent-config.txt file directly a supported method to override the interface or IP? 3. Is upgrading the agent to 7.3.0 via the Supervisor the only official solution to use the -I flag? Any guidance or official documentation reference for version 7.2.5 would be greatly appreciated. Thank you.

5 replies

KT06
KT06Author
Visitor III
March 25, 2026

@Secusaurus Kindly help me out.

KT06
KT06Author
Visitor III
March 25, 2026

@AEK Hey man, do you think you can help me out in this

AEK
SuperUser
SuperUser
March 29, 2026

Hi KT06,

I recommend to upgrade to 7.3.5.

Sorry I don't know any other solution.

However I don't think this is an issue if it remains like that. The SIEM can register with 10.10.10.10 and will receive connection from 10.10.20.10, then you will only need to approve it.

AEK
iLuca90
Explorer
March 25, 2026

I get what you’re saying, but I’d be a bit cautious relying on the config file tweak long-term. In my experience, automated updates or even certain agent restarts can silently revert the interface back, which could cause unexpected monitoring gaps. The Test update warning is real any production environment using this method needs frequent checks. Honestly, upgrading to 7.3.x and using the -I flag from the start saves a lot of headache down the line.

iLuca90
Explorer
March 25, 2026

Mike i Totally agree with the practical angle, Upgrading to 7.3.x later still makes sense for long-term reliability, but this approach works well in the meantime.

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!