[FORTISIEM] WINDOWS Agent Disconnected

Hi @adrifesa95,

Note that the IP-address/FQDN you provide in the installation is not the place where you define how the Agent communicates. Do you have correct IPs in you Admin Settings (Cluster Config)?

If yes:

Do you receive any kind of log/status before it goes "disconnected" or is there not a single line of information you get?

Best,

Christian

Hi team,
Could you please advise on how to resolve this?

Supervisor version: 7.1.3

Agent version: 7.1.11

The setup is working on 2 servers, but on 3 other servers, the agent status is showing as disconnected.

Collector is configured to act as an HTTPS proxy. However, after checking the trace.log on the affected servers,
it appears that the agents are trying to connect directly to the Supervisor IP, which seems to be causing the disconnection.

@premchanderr 

If you’re able to help here, I came across your post [#378663] regarding agent disconnection. We’re facing a similar issue and would appreciate your input.

Here’s what we’ve checked so far:

• The collector HTTPS configuration seems fine — it's working for another server.

• The server can reach the collector IP; telnet connectivity is working as expected.

• However, in the trace logs, the agent appears to be trying to connect directly to the Supervisor instead of the Collector.

• A HTTPS proxy is enabled on the Collector, so the agent should be routing traffic through it.

Could you suggest any additional actions or checks we might have missed?

Hi @premchanderr ,

Could you please help, when checked trace log getting below x.x.x.x is our supervisor IP

2025-06-30 11:08:21,133 [13] ERROR FortiSIEM.Webproxy.AOWebService - Discovery exception
System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond x.x.x.x:443
at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
--- End of inner exception stack trace ---
at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context)
at System.Net.HttpWebRequest.GetRequestStream()
at FortiSIEM.Common.Connection.sendReceive(Boolean isEvent, Byte[] bRequest, String method, String mimeType, String resource, Byte[]& bResponse)
at FortiSIEM.Webproxy.SuperManager.Discovery(String discoveryXML)
at FortiSIEM.Webproxy.AOWebService.SendDiscovery(String discoveryXML)

Hi Team,

Could anyone help me with above query I tried to install agent version 7.1.1 as well but its working on 2 servers but for remaining servers its still disconnected.

Hi Fortinet Community,

I’m still actively working with the customer and have already performed all possible troubleshooting steps, but the issue remains unresolved. Any further guidance or support would be greatly appreciated.

Thank you in advance!