FortiSIEM Discussions
JoeSkinner
New Contributor

Remote laptops

We have a bunch of laptops that never make it into an office, so they don't connect to a collector.  We have VPN, but some users only use that rarely.  We created a NAT on the firewall to the collector and installed nxlog, and pointed nxlog to the NAT IP.  This works, until that laptop gets a different IP.  The CMDB will create a new object with the same hostname, but the new IP.  We have some laptops with a dozen CMDB objects.

Is there a way to do either of these?

1.  Have the supervisor give the agent the NAT IP for the collector
2.  Make CMDB understand that IP can change and track on hostname instead
1 REPLY 1
ParthaBhattacharya

If you are running an agent, then we merge by host name and not ip. So there would be 1 entry in CMDB with the latest IP. This was done few years ago. Let me know if this does not work this way.-------------------------------------------
Original Message:
Sent: Jan 14, 2022 07:48 AM
From: Joe Skinner
Subject: Remote laptops

We have a bunch of laptops that never make it into an office, so they don't connect to a collector.  We have VPN, but some users only use that rarely.  We created a NAT on the firewall to the collector and installed nxlog, and pointed nxlog to the NAT IP.  This works, until that laptop gets a different IP.  The CMDB will create a new object with the same hostname, but the new IP.  We have some laptops with a dozen CMDB objects.

Is there a way to do either of these?

1.  Have the supervisor give the agent the NAT IP for the collector
2.  Make CMDB understand that IP can change and track on hostname instead