[FORTISIEM] WINDOWS Agent Disconnected

[adrifesa95]

Hi Team,

I have installed windows agent in test server and that is working fine after doing all the troubleshooting.

But issue is that when I installed the agent in production server, all agents are showing disconnected.

I have researched a lot about this issue but not getting help. 

Version is 7.2.2

I have tested connectivity between agents and collector and supervisor.

Request you to please help in this situation. Thanks in advance.

[Secusaurus]

Hi @adrifesa95,

Note that the IP-address/FQDN you provide in the installation is not the place where you define how the Agent communicates. Do you have correct IPs in you Admin Settings (Cluster Config)?

If yes:

Do you receive any kind of log/status before it goes "disconnected" or is there not a single line of information you get?

Best,

Christian

[Arjunpatil]

Hi team,
Could you please advise on how to resolve this?

Supervisor version: 7.1.3

Agent version: 7.1.11

The setup is working on 2 servers, but on 3 other servers, the agent status is showing as disconnected.

Collector is configured to act as an HTTPS proxy. However, after checking the trace.log on the affected servers,
it appears that the agents are trying to connect directly to the Supervisor IP, which seems to be causing the disconnection.

[Arjunpatil]

@premchanderr 

If you’re able to help here, I came across your post [#378663] regarding agent disconnection. We’re facing a similar issue and would appreciate your input.

Here’s what we’ve checked so far:

• The collector HTTPS configuration seems fine — it's working for another server.

• The server can reach the collector IP; telnet connectivity is working as expected.

• However, in the trace logs, the agent appears to be trying to connect directly to the Supervisor instead of the Collector.

• A HTTPS proxy is enabled on the Collector, so the agent should be routing traffic through it.

Could you suggest any additional actions or checks we might have missed?

[adem_netsys]

Hi @Arjunpatil 

Is Collector Proxy selected when installing the agent? Can you try this way?

[Arjunpatil]

Hi adem_netsys,

Sorry, but could you please clarify what you mean by selected collector proxy?

In our setup, the Collector is acting as an HTTPS proxy. So, during the agent installation on the server, I'm entering the Collector’s IP as the Supervisor IP.

[adem_netsys]

Hi @Arjunpatil,

When the agent selects the "ignore system proxy" option during its setup, it does not attempt to go to Super. There's no LB in between, is there?

[Arjunpatil]

Hi @adem_netsys ,

I am installing the FortiSIEM Windows Agent manually using the GUI method, but the installer does not prompt for the "Ignore system proxy" option during the installation process.

[premchanderr]

Hi @Arjunpatil ,

I understand that you installed agent via collector https proxy but it is reporting health status to Supervisor.  

If there is IP/FQDN configured in Admin -> Settings -> System -> Cluster Config -> Supervisors  <-- When you apply the template configuration, this Supervisor IP is sent to the agent to use it, creating an IP conflict.

Remove the value in Cluster Config -> Supervisors and keep it blank. Save. (If its not HA setup)

Now wait for 10min and let me know on result. 

Note: Take a snapshot of VM before making any modification.

[Arjunpatil]

Hi @premchanderr ,

Thank you for your response.

The steps you suggested were already implemented about four months ago, and everything has been working fine for all new customers since then. However, I’m now encountering the agent disconnection issue again—but only for this specific customer on one server. Interestingly,
for the same customer, two other servers show the agent as running and active.