Skip to main content
Mandalorian
Mandalorian
Explorer III
June 30, 2025
Question

FortiIsolator add to FAZ

  • June 30, 2025
  • 3 replies
  • 1001 views

I have a FortiIsolator in version 2.4.7 build 1120  I'm trying to hook it up to my FAZ in version 7.2.10 build 1682 but I'm having problems after hooking the device up to the FortiAnalyzer.

Below are the test already done:

- Release compatibility between products (matrix rules). OK

- Firewall policies enabled via Fortigate under my management, traffic ok enabled protocols list: ICMP, UDP/514 and TCP/514. OK

- Routing between FAZ and FortiIsolator ping ok, routing is managed by my Fortigate where the above policies are also present. OK

- FortiIsolator setting under LOG -> REMOTE SERVER

Immagine senza nome.png

 

 

 

 

 

 

 

faz2025.jpg

 

 

 

 

 

 

 

 

 

 

 

 

Fault description

 

See below the hook from FAZ to FortiIsolator the error found

 

FIS FASE1.jpg

 

 

 

 

 

FIS2.jpg

 

 

 

 

 

 

 

 

 

FIS3.jpg

 

 

 

 

 

 

 

 

 

 

 

Is it possible that I'm doing something wrong or maybe the connection with FortiIsolator has to be done differently than the classic Fortigate ?

 

Thanks in advance!

 

FortiAnalyzer #FortiIsolator

 

    3 replies

    AEK
    SuperUser
    AEK
    SuperUser
    July 29, 2025

    Hi Mandalorian

     

    When you add a syslog device you don't add it this way.

    Once you configure the device to send syslogs to FAZ, once FAZ starts to receive the first log you should see a new alarm in FAZ's top-right corner.

     

    faz1.png

     

    Click on the alarm to authorize the device, then go to Unauthorized Devices menu to complete the process.

     

    faz2.png

     

    Once done you can see the logs in the log view section.

     

    This is the way.

    AEK
      Mandalorian
      MandalorianAuthor
      Explorer III
      July 31, 2025

      Hi AEK,

      We tried the procedure you recommended, and we generated event logs but on our FAZ we don't find any notifications on the root vdom under unauthorized devices.
      Is it possible that I'm doing something wrong with the FortiIsolator configuration under LOG -> REMOTE SERVER ?
      If you have any suggestions, we're ready to test them.

      I would like to add that the IP set on the FortiIsolator is related to the VIP of the interfaces between the two FAZs (HA type is active-passive).

      Thanks in advance!

      FortiAnalyzer #FortiIsolator

      AEK
      SuperUser
      AEK
      SuperUser
      July 31, 2025

      Hi Mandalorian

      Use the following command on FAZ to check if it is receiving syslog messages from FIS.

      diag sniffer packet any 'host x.x.x.x' 4

      Where x.x.x.x is FIS' IP.

      This is the way

      AEK
        filiaks1
        filiaks1
        Explorer III
        July 31, 2025

        So as @AEK mentioned this is like adding 3-rth party device Technical Note: How to add a third party ... - Fortinet Community

          VinayHM
          Staff
          VinayHM
          July 31, 2025

          Authorize the device

            Terms & ConditionsAccessibility statement