Description
This article describes how to register and activate a FortiGate Cloud account in a FortiGate device.
Scope
FortiGate Cloud is a hosted security management and log retention service for FortiGate. It provides centralized reporting, traffic analysis, configuration management, and log retention without the need for additional hardware or software. FortiGate Cloud offers a wide range of features:
- Simplified central management.
- Monitoring and alerting in real-time.
- Customized or pre-configured reporting and analysis tools.
- Maintain important configuration information uniformly.
- Service security.
Solution
A standalone FortiGate could be activated directly either via GUI or CLI. There are some requirements to activate a FortiGate Cloud account in a FortiGate HA Cluster:
- FortiGate Cloud account should be available (it is a requirement for a standalone appliance as well).
- Both HA pairs must be registered under the same account. Follow the document Asset Management.
- Each cluster member has to have its own FortiGate Cloud subscription license.
Activating in a standalone FortiGate:
1. To activate the FortiGate Cloud account: In the FortiGate GUI. Go to Dashboard -> Status:
- In the FortiGate Cloud widget, select a 'Not Available' status, then select the 'Activate' button:
- A pop-up menu will appear. Enter the support.fortinet.com credentials, along with the domain (mainly US, Global, EU), and select OK to activate the FortiGate Cloud on FortiGate:
Activating in a standalone FortiGate via CLI:
- Run the following command:
execute fortiguard-log login <email> <password> <domain>
- If no domain is specified, the unit will join the Global FortiGate Cloud region. To get the domain list, run the following command:
execute fortiguard-log domain
A FortiGate dashboard will look similar to the one in the screenshot below:
Also, in case some services need to be validated can be checked over Security Fabric -> Fabric connectors and see if the Central Management works and/or the logs are sent to FortiGate Cloud over Logging & Analytics, and should not request any registration email:
Activating a FortiGate Cloud subscription in FortiGate HA cluster (prerequisites are above):
In most cases, activating a primary device in an HA cluster to the FortiGate Cloud triggers activation on a secondary node as well. It may be necessary to add the devices to FortiGate Cloud separately. There are two options to do this.
Option 1: Via CLI.
- To activate FortiGate Cloud on the secondary unit, first access its CLI from the primary FortiGate. Follow the steps indicated in Technical Tip: How to access secondary unit of HA cluster via CLI.
execute ha manage [Secondary-Index] [admin-account]
For example:
execute ha manage 1 admin
- Check the available FortiGate Cloud domains:
execute fortiguard-log domain
- Activate FortiGate Cloud using a CLI command:
execute fortiguard-log login <email> <password> <domain>
Replace <email>, <password>, and <domain> with valid FortiGate Cloud account credentials and the appropriate domain returned from the previous step.
Option 2: By failing over to the Secondary Node (inactivated account appliance).
- Trigger a failover to make the device with no FortiGate Cloud connection an active node, then activate FortiGate Cloud from the new active unit. The recommended way to perform a failover on an HA cluster is by using the command below in an active primary node (with an activated account). Failover should be done during a maintenance window and terminate any existing VPN connections:
diagnose system ha reset-uptime
- Restore the primary node as an active appliance.
Logging into the FortiGate Cloud portal:
Once logging has been configured and the account registered, it is possible to log into the FortiGate Cloud portal and start viewing the logging results. There are two methods to reach the FortiGate Cloud portal:
Once logging has been configured and the account registered, it is possible to log into the FortiGate Cloud portal and start viewing the logging results. There are two methods to reach the FortiGate Cloud portal:
- From a FortiGate GUI:
- Go to Dashboard -> Status.
- In the FortiGate Cloud widget, in the Status field, select 'Activated' and 'Launch Portal'.
- Or, in the Licenses widget, select 'FortiCare Support' and 'Launch Portal'.
- Direct access to the FortiGate Cloud page:
Make sure to select the region on FortiGate Cloud as shown in the Dashboard of the FortiGate (in the example in this article, the FortiGate is located in the 'Global' region). To change the region, see this article: Technical Tip: FortiGate Cloud switch region.
Related documents:
FortiCare and FortiGate Cloud login
Technical Tip: How to register and activate a FortiCloud account
