How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

[PeteVuko]

I would like to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment.

I found the following documentation about Fortigate and ArcSight communication, but there is no information about the TCP syslog configuration between this two platforms.

http://help.fortinet.com/fdb/5-0-0/html/source/concepts/c_dam_notification_tab.html

Is it possible to send TCP syslog messages (with or without TLS) from Fortigate firewall device to the Arcsight SIEM?

[PauloRaponi · Accepted solution]

Hi,

# config log syslogd setting

# set reliable enable

# end

Regards,

Paulo Raponi

[PeteVuko]

Can ArcSight be configured to accept that?

Rgrds,

Peter

[PauloRaponi]

Sure. Are the same contend as UDP. The difference are that it need create a session between Fortigate and ArcSight... The traffic inside the TCP session are clear text.

[cr0wd3d_FTNT]

Be advised that FortiGate still sends reliable syslog based on RFC 3195, which is obsolete.  This has been an issue with SIEMs that now run reliable syslog based on RFC 5425.  NFR 250344 has been requested to fix this.

[PeteVuko]

Thanks you guys for your support, especially for showing this Mantis.

Rgrds,

Peter