FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
psalian
Staff
Staff
Description
By design on the FortiAnalyzer:

1) It is always expected to see the slave members with serial number and not a host name under device manager as HA is recognized using HA group name used on FortiGate Cluster and is mapped to master SN.

2) The slave member would show up as "New Device" instead of a device name or Serial number when using the option " Add Other Device " > new serial number and then use '+'.

This article explains on how to overcome these to rename slave members with a hostname.

Scope
v5.6.3 or later and v6.x

Solution
Use the following steps to rename the slave member:

1.  Disable using HA group name as follows (keeping it enabled would add the cluster with slave using its serial number):

config sys global
set set ha-member-auto-grouping disable
end

2.  Use the Device Manager to add the FortiGate cluster - Master device to FortiAnalyzer.

psalian_FD43675_tn_FD43675-1.jpg

3.  Edit the Master. The Slave device details would not be in there.

4.  If you click on "Add other device" and give the serial number of the Slave and click on "+", the Slave would be added as "New Device".

psalian_FD43675_tn_FD43675-2.jpg


Do not use this option.

5.  The slave device would show up in the "Unregistered Device" list. Promote it to the FortiAnalyzer.  It would be added as a separate device.  A name can be given when promoting it.

psalian_FD43675_tn_FD43675-3.jpg

psalian_FD43675_tn_FD43675-4.jpg


6.  Edit the Slave device and uncheck the "HA Cluster" check box.

psalian_FD43675_tn_FD43675-5.jpg

7. Edit the Master FortiGate and click "Add Existing Device", the drop down will show the slave device.

psalian_FD43675_tn_FD43675-6.jpg

8.  The cluster is now added with the proper hostnames

psalian_FD43675_tn_FD43675-7.jpg

9.  The name of this cluster can now be changed as required.

psalian_FD43675_tn_FD43675-7.jpg



Contributors