To Resolve the issue , there are two proposed solutions:
a. First Solution:
- Disable the Certificate Verification on FGT either through CLI or GUI
On CLI:
On GUI:
b. Second Solution:
- Re-apply the FAZ license that was downloaded from the Fortinet Support portal on FAZ
By re-applying the FAZ license, it is possible to have the correct VM serial number applied back to it .
- This process will reboot the FAZ ,however the FGT will keep caching the logs so that it can be sent to the FAZ once it’s back online
Please check the Cached logs before and after applying the license as below:
Advanced commands to check connectivity
Analyzing OFTPD application debugging on the FortiAnalyzer
On FortiAnalyzer CLI:
# diagnose debug application oftpd 8 10.109.52.211 -> FGT- IP Address
oftpd debug filter: ip==10.109.52.211
# diagnose debug enable
Then click on Test Connectivity under Log Setting of the FortiGate GUI or run the command ‘diag log test’ form the FGT CLI, one should see packets received and sent from both devices.
A successful attempt will display "Login Request" messages:
[OFTP_try_accept_SSL_connection:1705 10.109.52.211] SSL_accept one client SUCCESS [ protocol : (772) TLS 1.3 ]
[OFTP_try_accept_SSL_connection:1734 10.109.52.211] SSL socket[24] pid[975] ssl[0x7f4e5c085010] SSL_accepted
[OFTP_recv_SSL_packet:1779 10.109.52.211] SSL socket[24] pid[975] ssl[0x7f4e5c085010] received [12] bytes:
[OFTP_recv_SSL_packet:1779 10.109.52.211] SSL socket[24] pid[975] ssl[0x7f4e5c085010] received [474] bytes:
[oftpd_handle_session:3613 10.109.52.211] handle LOGIN_REQUEST_LEGACY (2)
[_login_get_other_opt:2521 10.109.52.211] host = 'FGT-Wempy_30'
[_login_get_other_opt:2550 10.109.52.211] Version: FortiGate-VM64 v6.4.7,build1911,210825 (GA)
Virus-DB: 89.07394(2021-12-02 04:20)
IPS-DB: 6.00741(2015-12-01 02:30)
APP-DB: 18.00199(2021-11-18 01:19)
Industrial-DB: 18.00197(2021-11-16 01:27)
Serial-Number: FGVM01TM21001063
Virtual domain configuration: disable
Current HA mode: standalone
Current HA group:
[__fill_dev_ext_info:559 10.109.52.211] ha_group_name:, ha_mode:0.
[_login_get_other_opt:2526 10.109.52.211] vdom = 1
[OFTP_send_SSL_packet:1839 FGVM01TM21001063] SSL socket[24] pid[975] ssl[0x7f4e5c085010] sent [24] bytes:
[_login_send_ack:2631 FGVM01TM21001063] login succeed
[OFTP_recv_SSL_packet:1779 FGVM01TM21001063] SSL socket[24] pid[975] ssl[0x7f4e5c085010] received [12] bytes:
On FortiGate CLI:
It is recommended to enable the below command to see the Keepalives being sent to the FortiAnalyzer
# diagnose debug application miglogd 6
Debug messages will be on for 3 minutes.
# diagnose debug enable
# <239> _build_keep_alive_usage_pkt()-718: Pushed keepalive packet to queue for global-faz.
<171> _build_keep_alive_usage_pkt()-718: Pushed keepalive packet to queue for global-faz.
<239> _build_keep_alive_usage_pkt()-718: Pushed keepalive packet to queue for global-faz.
di<171> _build_keep_alive_usage_pkt()-718: Pushed keepalive packet to queue for global-faz.
Disable the debug using below command:
# diag debug disable
For Further Analysis , Please share the output of the below commands from FAZ and FGT sides and share it with TAC:
Related Articles:
https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-FortiGate-to-FortiAnalyzer-conne...
