Skip to main content
vishal
vishal
Visitor III
November 11, 2019
Question

Adding Fortigate cluster to Fortianalyzer

  • November 11, 2019
  • 1 reply
  • 3914 views
Hi All, Running an Fortigate 500E firmware 6.0.5 in A-A cluster. Added cluster unit fortigate in fortianalyzer running same firmware version. What I observed now that in fortianalyzer cluster list fortigate which is standby showing at position 1 and master at position 2. What can I do to make my master fortigate at position 1 in fortianalyzer cluster list. Attaching reference diagram to understand my scenerio

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 12, 2019

    I wouldn't bother too much, just as I don't care which cluster member is 'master' at each moment. Both units are registered and allowed at the FAZ as both may be active anytime.

    Your situation is that - by chance - the now slave contacted FAZ first.

     

    vishal
    vishalAuthor
    Visitor III
    November 13, 2019
    Thanks ede_pfau Would it be effect log collecting/analyzing to fortianalyzer unit. As per my understanding of fortigate is in A-A cluster only master fortigate process or handle logs as compared to slave fortigate. Correct me if I'm wrong
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 17, 2019

    That's correct but you need to worry about it. Logging at full blast is not going to affect CPU load much on a 500E. Say, fully logging traffic on every policy, estimate how many logs are sent per second. Then multiply by 100 (100 bytes per log entry) and compare that to the physical bandwidth of the interface.

     

    For example, in some customer's LAN I see 180 logs/sec, which amounts to ~ 18 kB/sec which is nothing compared to data load. Even if logs were 100x as often as that the FGT would tackle that easily.

    Terms & ConditionsAccessibility statement