Skip to main content
n00b
n00b
New Member
May 15, 2016
Question

Fortigate with VDOMS forwarding logs to FortiAnalyzer

  • May 15, 2016
  • 1 reply
  • 16562 views

May I ask as to what is the best practice when the Fortigate has 3 VDOMS including the root VDOM and the logs are forwarded to FortiAnalyzer? Right now, every VDOM is allocated 1 port on the FortiAnalyzer so that every VDOM can forward logs to the FortiAnalyzer. The Fortigate has 3 VDOMs including the root VDOM. The FortiAnalyzer 200D has only 4 ports. Is there a way so that 1 Fortigate device however how many number of VDOMs it has can forward logs to the FortiAnalyzer using one port only on the FortiAnalyzer?

1 reply

MrSinners
MrSinners
New Member
May 15, 2016

Hiya,

 

You may have misunderstood or configured something wrongly. Normally you configure just 1 interface on the FortiAnalyzer, then on the FortiGate you configure logging to the FortiAnalyzer globally (Global > Log Config > Log settings) which is then applied for every VDOM. This ensures that all logging from the FortiGate, including those of alle VDOM's, are sent out from the management VDOM (normally root)  to the FortiAnalyzer. The FortiAnalyzer is capable of seeing which VDOM's are present on the FortiGate, and the log view can be split out over VDOM's using Log Arrays for easier reading.

n00b
n00bAuthor
New Member
May 16, 2016

Yes, I also think that I got it wrong. I was expecting that from FortiGate Global, logs from all the VDOMs are forwarded to the FortiAnalyzer.

However, when an interface in the FortiGate Global was given an IP address that is in the same subnet as the FortiAnalyzer interface, ping is not possible.

Example:

FortiGate>Global>Network>Interfaces>port1>192.168.1.99/24

FortiAnalyzer>System Settings>Network>port1>192.168.1.100/24

 

FortiGate>Global>CLI>ping 192.168.1.100

result: cannot ping

 

Do I ping from the Global?

Or do I ping from the root VDOM?

 

Thanks for in advance for any feedback.

 

MrSinners
MrSinners
New Member
May 16, 2016

Ping can only be used within VDOM's, in this case "execute ping 192.168.1.100" within VDOM root. Make sure that:

- VDOM root is indeed marked as the management VDOM (Global > VDOM >VDOM and then verify the upper right value after "Switch Management")

- The trusted hosts of the configured administrators on the FortiAnalyzer and/or FortiGate do not block this ping request. (e.g. the trusted hosts should contain 192.168.1.0/24 or 0.0.0.0/0.0.0.0)

- PING is allowed and enabled on the interface.

 

Otherwise there is a layer 2 issue, as ping should work especially within the same subnet/vlan. (check cables and switch configurations) You can also try and directly connect your laptop to either interface and ping the FortiGate/FortiAnalyzer as a way of checking where the fault is.

 

Terms & ConditionsAccessibility statement