Description
This article describes a method to configure FortiManager and FortiAnalyzer to set up an SNMP trap to FortiSIEM.
Scope
FortiSIEM, FortiManager, FortiAnalyzer.
Solution
FortiSIEM can be configured to receive an SNMP trap from FortiManager and FortiAnalyzer to monitor the performance. Use the following procedure for the configuration:
- On FortiManager/FortiAnalyzer, configure the settings below:
- Enable SNMP on the interface:
- Configure the SNMPv3 user under Network -> SNMPv3:
- In the FortiManager/FortiAnalyzer CLI, configure the command below:
config sys snmp sysinfo
set status enable
end
- In FortiSIEM, configure SNMP discovery for FortiManager/FortiAnalyzer. See this guide.
Note:
Users should be able to get FortiManager/FortiAnalyzer in the CMDB:
- In the FortiSIEM CLI, stop the phParser and run the following command:
phtools --stop phParser
snmptrapd -f -Dlcd_set_enginetime -Lo
Note:
While the command is running on the FortiSIEM, go to FortiManager/FortiAnalyzer CLI to send a test trap.
diag test application snmpd 4
Monitor the output in FortiSIEM and record the Engine ID as below:
Press Ctrl + C to stop the command in the FortiSIEM CLI.
- Go to the FortiSIEM CLI and configure the following:
#vi /etc/snmp/snmptrapd.conf
#disableAuthorization no
#createUser -e 0x<engineId from FortiManager/FortiAnalyzer> <snmptrapuser> <authprotocol> <authpassphrase> <privprotocol> <privpassphrase>
#authUser log,execute,net <snmptrapuser>
Example:
- In the FortiSIEM CLI, run the command below to test if the Trap is received from FortiManager/FortiAnalyzer:
snmptrapd -f -Dusm -Lo
Note:
After running the command above on the FortiSIEM CLI, send a test Trap from FortiManager/FortiAnalyzer:
diag test application snmpd 4
- Start the phParser and monitor the GUI:
phtools –start phParser
Note:
Test to ensure the Trap from FortiManager/FortiAnalyzer is received in the GUI as well:
diag test application snmpd 4
Note:
The Event Type will show as FortiGate-Generic because the Parser for FortiSIEM is using the FortiOS Generic parser. Check the raw event log and verify the serial number of FortiManager/FortiAnalyzer for verification.
Related documents:
