FG-FAZ no connectivity issue
Hello,
I need help about our issue with connectivity FG<->FAZ.Â
We are currently troubleshooting connectivity between a FortiGate 200G and a FortiAnalyzer VM.
Environment overview:
FortiGate 200G running in multi-VDOM mode
Dedicated management interface configured
FortiAnalyzer VM reachable through data-plane routing from the root VDOM
Management and data interfaces are located in different VDOM/routing contexts
Observed behavior:
FortiGate is attempting to establish a connection toward the FortiAnalyzer using:
TCP/514 (reliable logging / OFTP)
UDP/514
diagnose test application fgtlogd 1 shows:
state=disconnected
oftp-state=connecting
Packet sniffer on FortiGate shows:
mgmt out -- 10.0.0.2 -> 192.168.0.4:514
Packet sniffer on FortiAnalyzer VM does not see any packets from the FortiGate.
Traceroute sourced from 10.0.0.2 toward 192.168.0.4 does not pass the first hop.
FortiGate configuration notes:
The management interface is configured as:
set dedicated-to management
Because of this, FAZ/FMG/DNS/NTP traffic is using the management-plane routing context rather than the root VDOM routing table.
Root VDOM routing toward the FortiAnalyzer subnet appears correct, but it is not used for FortiAnalyzer communication.
Current understanding / suspected root cause:
The issue appears to be related to management-plane routing/reachability rather than FortiAnalyzer configuration itself.
FortiGate is transmitting traffic through the dedicated management interface, but the packets are not reaching the FortiAnalyzer network.
Additional observations:
Security Fabric access is enabled on the management interface.
FortiAnalyzer configuration itself appears correct.
Reliable logging is enabled.
No SYN-ACK responses are received from the FAZ side.
Intermediate firewall devices do not see traffic sourced from 10.0.0.2.
We would like help and confirmation regarding:
1. Expected FortiAnalyzer routing behavior when using set dedicated-to management?
2. Whether FAZ traffic can be forced to use a data-plane/root VDOM interface on this FortiOS build/platform?
3. Whether this behavior is expected in multi-VDOM deployments with dedicated management enabled?
4. Recommended best practice for FAZ connectivity in this architecture?