Hello,
I am reaching out regarding the possibility of setting up syslog log forwarding from FortiAnalyzer (FAZ) or FortiManager (FAM) while implementing mutual TLS (mTLS) authentication.
I have reviewed the "Log Forwarding" feature available on FortiAnalyzer/FortiManager, but it does not seem to support mutual TLS authentication. My requirement is to collect logs from managed FortiGate devices and forward them securely to an external syslog server using mTLS. I am not looking to forward the local logs of the FortiAnalyzer/FortiManager itself (so the "Syslog server" functionality is of no use to me).
I would like to confirm whether there is any supported method to achieve this, or if there are plans to add mutual TLS support for syslog forwarding in the future. As a reference, FortiGate devices do support client certificate authentication when forwarding logs via syslog, using the following command:
config log syslogd setting
set status enable
set server <SYSLOG_SERVER_IP>
set mode reliable
set certificate <CLIENT_CERT>
end
Would it be possible to achieve a similar configuration on FortiAnalyzer/FortiManager? If not, do you have any recommendations or workarounds?
Thanks in advance for your help :)
Best regards,
