| Solution |
Prerequisites:
- From FortiSIEM:
An agent user account should have been created for agent registration: For Enterprise, Go to CMDB -> Users -> FortiSIEM Users -> New -> enter a User Name, checkmark the System Admin box, checkmark the Agent Admin box, add a Password, confirm the Password, and Save.
- For the Service Provider, Go to Global View -> Admin -> Setup -> Organization -> Select the Organization -> Edit -> In the Agent User section, enter a username, enter a Password, confirm the Password, and Save.
Note the Organization Name and Organization ID for the agent registration.
- From Windows Host: Test the connection on port 443 to Supervisor with the following command from Powershell:
Test-NetConnection <Super_IP> -port 443
The result should show: TcpTestSucceded = True
If the result is TcpTestSucceded = False, it is necessary to check the port 443 connection between the host and the Supervisor.
- Net framework version. Check the NetFramework version in the Windows host is up to date with the following command. Make sure the version is 4.6.2 or higher.
reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /s
- TLS v1.2. Check that TLS1.2 is enabled and running on the Host with the following command:
reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client"
If TLS1.2 is not enabled, run the following command in Powershell:
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" /v DisabledByDefault /t REG_DWORD /d 00000000
- Installation: 'Right-click' in the FSMLogAgent.exe file -> Choose License Type and Add the registration information.
Troubleshooting.
There are 3 reasons for the registration to fail:
- Package requirements are not installed in the host, or the OS version is not supported.
- Registration information is incorrect. This includes Supervisor IP/FDQN, username, password, Orgname, and OrgID.
- Connection issues include network configuration/communication on port 443, NAT, SSL inspection, external firewall rules blocking, and certificate configuration. Etc.
- Review the Agent Trace log file on the Windows host to identify the HTTP status codes.
Location: C:\ProgramData\FortiSIEM\Logs\Trace.log
401 and 403 errors indicate an authentication issue - Review the registration information. For example: ORG name, ORG ID, agent username, and password. If necessary, create a new Windows agent user account.
- Manual URL Check:
Using a web browser on the Windows host, enter: https://<ip of super>/phoenix/rest/register/winAgent.
Note:
A username and password prompt is expected. DO NOT enter any credentials here, as it will not pass. This is only a check to verify the URL's availability.
- Check the SSL Supervisor's log to confirm the host connection. SSH to Supervisor:
cat /var/log/httpd/ssl_access_log
Review the HTTP status code.
- Leave running the tail command in Supervisor and Run the agent installation in the host:
tail -f /opt/glas*/dom*/dom*/logs/phoenix.log
For example:
The registration logs will provide more information about the registration.
Check if the Trusted Hosts are configured. ADMIN -> Settings -> Trusted Hosts.
If the trusted hosts are configured, please include the workstation IP address in that list.
For example: 10.0.100.10/32
 |
