A Collector needs to martial Linux agents and Windows agents.

[KarlH]

Hello,

Should two proxy files be run?

How should all this be executed for the different OS's?

Is there one proxy conf file that handles both system types? or do I run two different conf files.

The linux proxy is supposed to look like this :

ProxyPass /phoenix/rest/register/linuxAgent https://{actual IP address of the Supervisor node}/phoenix/rest/register/linuxAgent

ProxyPassReverse /phoenix/rest/register/linuxAgent https://{actual IP address of the Supervisor node}/phoenix/rest/register/linuxAgent

ProxyPass /phoenix/rest/linuxAgent/update https://{actual IP address of the Supervisor node}/phoenix/rest/linuxAgent/update

ProxyPassReverse /phoenix/rest/linuxAgent/update https://{actual IP address of the Supervisor node}/phoenix/rest/linuxAgent/update

SSLProxyEngine on

SSLProxyVerify none

SSLProxyCheckPeerCN off

SSLProxyCheckPeerExpire off

-------------------------------------------------------------------------------------------------------------------------------

The Windows Proxy is supposed to look like this

ProxyPass /phoenix/rest/register/windowsAgent https://<Supervisor IP Address>/phoenix/rest/register/windowsAgent
ProxyPassReverse /phoenix/rest/register/windowsAgent https://<Supervisor IP Address>/phoenix/rest/register/windowsAgent
ProxyPass /phoenix/rest/windowsAgent/update https://<Supervisor IP Address>/phoenix/rest/windowsAgent/update
ProxyPassReverse /phoenix/rest/windowsAgent/update https://<Supervisor IP Address>/phoenix/rest/windowsAgent/update
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerExpire off

#Required for upgrade Windows Agent on FortiSIEM 6.4.0+

ProxyPass /WinAgentUpgrade/FSMLogAgent.exe https://<Supervisor IP Address>/WinAgentUpgrade/FSMLogAgent.exe
ProxyPassReverse /WinAgentUpgrade/FSMLogAgent.exe https://<Supervisor IP Address>/WinAgentUpgrade/FSMLogAgent.exe

ProxyPass /WinAgentUpgrade/AutoUpdate.exe https://<Supervisor IP Address>/WinAgentUpgrade/AutoUpdate.exe
ProxyPassReverse /WinAgentUpgrade/AutoUpdate.exe https://<Supervisor IP Address>/WinAgentUpgrade/AutoUpdate.exe

#Required for Windows Agent 5.0.0 or later

ProxyPass /phoenix/rest/device/update https://<Supervisor IP Address>/phoenix/rest/device/update
ProxyPassReverse /phoenix/rest/device/update https://<Supervisor IP Address>/phoenix/rest/device/update

#Required for Windows Agent 7.1.0 or later

ProxyPass /phoenix/rest/osquery/result https://<Supervisor IP Address>/phoenix/rest/osquery/result
ProxyPassReverse /phoenix/rest/osquery/result https://<Supervisor IP Address>/phoenix/rest/osquery/result

Can some one please enlighten me? are we meant to run two different files? or somehow make one file with an if than else that looks at the OS?

Thanks in advance all!

~Karl

[Stephen_G]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Arjunpatil]

Hi Stephan,

Could you please update on query raised by Karl?

[Stephen_G]

Hi Arjunpatil,

Sorry it took so long to get back on this thread. 

To add a proxy for both Linux and Windows, you can add all of the lines in agent-proxy.conf on the collector. I hope that helps!

[Arjunpatil]

Hi @Stephen_G ,

Thank you for quick reply on this.

So while adding both lines in single file can you please help me with command to add those on collector with Hyper-V image?
or please let me know if we can run below curl command on collector to replace super IP?
curl https://gitlab.com/-/snippets/4805419/raw/main/agent-proxy.conf -o /etc/httpd/conf.d/agent-proxy.conf; sed -i "s/<Supervisor IP Address>/super IP/" /etc/httpd/conf.d/agent-proxy.conf; cat /etc/httpd/conf.d/agent-proxy.conf

[Stephen_G]

Hi Arjunpatil,

Sorry, I don't think I can help you with that. :( I recommend you create a new post in FortiSIEM discussions (the current forum) - you'll be more likely to receive a reply for your setup.