FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 326954
Description This article describes how to re-image FortiSIEM Hardware.
Scope FortiSIEM.
Solution
  1. Requirements:
    • USB Keyboard.
    • USB Mouse.
    • VGA Monitor.
    • 1 USB thumb drive of 16GB or more.
    • or 4 GB thumb drive (for Ubuntu live) and 8 GB thumb drive (for FortiSIEM image).
    • Ubuntu Desktop Setup Files (IE ubuntu-20.04.2.0-desktop-amd64.iso https://ubuntu.com/download/desktop0).
    • Rufus Bootable USB Utility (https://rufus.ie/).
    • FortiSIEM Image with CheckSum validated (IE FSM_Full_All_RAW_HARDWARE_7.2.1_build0241.zip from https://support.fortinet.net).

 

 

  1. Create Bootable Linux Image:
    1. Connect a 4GB USB drive to the system (desktop or laptop).
    2. Open Rufus.
    3. Select the following settings for the USB:
      1. Partition scheme and target system type: MBR partition scheme for BIOS or UEFI.
      2. File system: FAT32.
      3. Cluster size: 4096 bytes (Default).
      4. Quick Format: Enable.
      5. Create a bootable disk using: an ISO image.
    4. Select the 'CD-ROM' icon and select the Ubunt.u Setup ISO.
    5. Select Start and allow Rufus to complete.
    6. Once finished, the disk is ready to boot.

Note:

Alternatively,  use the Ubuntu guide for creating a USB drive with Ubuntu.

 

  1. Copy the FortiSIEM image to the USB:
    1. Connect 8GB USB Drive to the system (desktop or laptop).
    2. Open Windows Explorer -> 'right-click' Drive -> Format.
    3. Select the following options:
      1. File system: NTFS.
      2. Allocation unit size: 4096 bytes.
      3. Quick Format: Enable.
      4. Copy the image file to a USB drive. For example:# FSM_Full_All_RAW_HARDWARE_7.2.1_build0241.zip
      5. Safely remove the USB drive from the desktop or laptop by unmounting it through the operating system.

 

  1. Prepare 2000F/G by removing FortiSIEM:
    1. Connect to the console/SSH of the FortiSIEM.
    2. Run the following command: execute fsm-clean.
    3. After fsm-clean is complete, format RAID by executing the command: execute format disk
    4. Power off the FortiSIEM.

 

  1. Configure 2000F/G BIOS to Boot into the USB Drive.
    1. Connect the 4GB USB drive to the FortiSIEM.
    2. Power on the FortiSIEM.
    3. During the boot screen, press F11 or DEL or ESC to log in to the boot options. BIOS password was provided separately by support.
    4. Select the option to enter into the BIOS setup.
    5. Select the option for Boot options.
    6. Select the 'USB drive'.
    7. Save the options and quit the setup.

 

  1. Reimage 2000F/G boot drive from USB Linux.
    1. Power on FortiSIEM appliance.
    2. Once the FortiSIEM appliance loads from the USB drive, click Try Ubuntu.
    3. Connect the 8GB USB drive to the FortiSIEM appliance.
    4. Open a terminal.
    5. Type the following command to identify the FortiSIEM boot disk with size of 29.5GB:

 

sudo fdisk -l

 

Note:

This drive will be referred to as /dev/sdb in the following steps as an example.

This could be another disk name /dev/sdX referenced in your system. Use the proper /dev/sdX FortiSIEM boot disk with a size of 29.5GB of the system for the next steps.

Warning: On FortiSIEM-2200G appliances, 2 disks of 29.5GB are listed in fdisk -l results. Use the second listed disk for the next steps.

 

  1. Enter into root while in the terminal using the following command:

 

sudo -s

 

  1. Determine the mount point of this drive by using the following command (if there is any, unmount the FortiSIEM boot disk (29.5GiB) before running the extract command):

 

df -l

 

  1. Extract the raw image to the boot disk:

 

unzip -p FSM_Full_All_RAW_HARDWARE_7.2.1_build0241.zip | dd status=progress of=/dev/sdb

 

  1. Once this is completed, power off the FortiSIEM using the following command:

 

shutdown -h now

 

  1. After shutdown, remove both USB drives from the FortiSIEM.
  2. Power on the FortiSIEM.
  3. Return to the BIOS menu and restore the default configuration. Save and Reset.
  4. Optional From the console, run the next commands to make sure the proper version has been installed:
  5.  

cd /tmp
tar -zxvf /fsmopt.tar.gz opt/phoenix/bin/VERSION
cat opt/phoenix/bin/VERSION
rm -rf opt

 

  1. From the console, run the next commands to finalize the setup:

 

execute fsm-clean

execute factoryreset --force

reboot

 

The system is now, ready to be processed through the installation setup.

 

Related document

Appliance Setup 

Technical Tip: How to Re-image a FortiSIEM Appliance of any model