| Description |
This article describes the issue when the FortiAnalyzer certificate does not reflect the correct serial number. In these scenarios, FortiGates may have issues with establishing OFTP connections for log submission. |
| Scope | FortiAnalyzer, FortiGate. |
| Solution |
Earlier license files (from 2018 or earlier) for the FortiAnalyzer VMs did not include a certificate that reflected the actual serial number of the FortiAnalyzer.
This became a problem starting in v6.2 when FortiGates started checking the serial number when establishing a secure connection (Optimized Fabric Transfer Protocol, or OFTP) with the FortiAnalyzer.
On the FortiGate, debugs from the miglogd process may show errors like the following:
diagnose debug application miglogd -1 [...] <9061> _check_oftp_certificate()-248: checking sn:FAZ-VM0000014XXX vs cert sn:FAZ-VM0000000001 <9061> _check_oftp_certificate()-258: The certificate CN (FAZ-VM0000000001) doesn't match the Serial numbers sent by 172.17.x.y
To solve this particular issue, download a new copy of the FortiAnalyzer license file (.lic) from the Fortinet Support Portal and apply the new license file to the existing FortiAnalyzer-VM. This will update the certificate to match the serial number of this VM.
Note: The above issue occurs when the FortiAnalyzer's OFTP certificate does not have the Serial Number as the Common Name (CN) in the Subject field. This also means that using custom certificates for OFTP on FortiAnalyzer (i.e. using a certificate signed/provided by a trusted Certificate Authority) can result in the FortiGate failing to connect for OFTP log submission.
Workaround: If the FortiAnalyzer's OFTP certificate does not contain its serial number then a workaround is to disable certificate-verification on the FortiGate. This instructs the FortiGate to not compare/validate the FortiAnalyzer's advertised serial number against the SN contained within the certificate, which can allow the connection to establish:
config log fortianalyzer setting set certificate-verification disable end
The above option is available on v6.2.0 and later. A similar option exists on the FortiGate for FortiAnalyzer Cloud, available as of v7.0.4, v7.2.0, and later:
config log fortianalyzer-cloud setting set certificate-verification disable end
Related articles: |
