Skip to main content
Frosty
Frosty
New Member
August 2, 2019
Solved

Fortigate stops logging after Fortianalyzer v6.2.1 upgrade

  • August 2, 2019
  • 1 reply
  • 17928 views

Just posting this in case it helps someone else ...

 

I upgraded our FAZ-VM from v5.6 to v6.0 and then v6.2.1 ... and found that logs were no longer being received ... they were queueing up on our Fortigate and the "test connectivity" on the FGT was failing.

 

After some mild panic and troubleshooting, then opening a ticket with Fortinet, I discovered that you MUST have encryption enabled on the FGT in the Logging configuration.  As soon as this was done, the problem was resolved.

 

I had read the Release Notes, however the Special Notices wording was as follows:

  All OFTP connections must be encrypted for FortiAnalyzer 6.2.0 (or higher)   Prior to upgrading to FortiAnalyzer 6.2, make sure that all FortiGate devices are configured to use encryption when   communicating with FortiAnalyzer. Starting with FortiAnalyzer 6.2.0, all OFTP communications must be encrypted.

 

It was not at all clear that OFTP meant Logging.  Not to me anyway.

 

Hope this helps someone else ...

      Best answer by miraching

      For VMs (FAZ & FG) do this

       

      @ FAZ

      config system global
      set log-forward-cache-size 4
      set oftp-ssl-protocol sslv3
      end
        @ FG 
      config log fortianalyzer setting
      set serial "FAZ-VM0000000001"
      set ssl-min-proto-version SSLv3
      end
        wait for a min or two then issue 
      execute log fortianalyzer test-connectivity

      1 reply

      Dragnipur
      Dragnipur
      New Member
      September 26, 2019

      you saved my day...

      miraching
      mirachingAnswer
      New Member
      April 21, 2021

      For VMs (FAZ & FG) do this

       

      @ FAZ

      config system global
      set log-forward-cache-size 4
      set oftp-ssl-protocol sslv3
      end
        @ FG 
      config log fortianalyzer setting
      set serial "FAZ-VM0000000001"
      set ssl-min-proto-version SSLv3
      end
        wait for a min or two then issue 
      execute log fortianalyzer test-connectivity

      StingRay
      StingRay
      New Member
      June 10, 2021

      Thank you miraching it worked for me and I only added one FAZ line you specified:

      set oftp-ssl-protocol sslv3

      Terms & ConditionsAccessibility statement