Connecting Fortigate(Multi VDOM) and Fortianalyzer

[yw2023]

Hi All,

FortiGate600E (HA) and FortiAnalyzer200F are connected.
The FG has a 2 VDOM. (I don't use "root".)
VDOM1 is the main network and is also used for management.
VDOM2 has a separate network.

Both are connected to the Internet by separate lines.

FA is on the VDOM1 side and is logged by VDOM1.
I want to get this with FA for VDOM2 logs as well.
However, VDOM2 cannot access VDOM1's network.

What solutions are possible?

- The way I come up with it.
1. Set up connection to FA with Global, not VDOM1.
2. Enable "set use-management-vdom" in "config log fortianalyzer override-setting" in VDOM2
(This also sends the VDOM2 logs to the FA via the VDOM1 interface, am I correct?)
3. Enable communication from VDOM2 to VDOM1 using VDOM link

- Proposals claimed by others.
4. Physically wire and connect from Switches connected to VDOM2 to FA
(In this case, the second port of FA needs to be connected)

Plan 3 has been confirmed to be doable.
I think plan 2 is a reasonable one.
However, since there is only one FA, I think the original form would be to set it up in Global of Plan 1, not in each VDOM.

I think plan 4 is wrong.
The person who proposed this plan says that Plans 2 and 3 are a last resort, to be done when there is no other way.
(For me, this is the last resort).

What is the most appropriate means?

[gfleming · Accepted solution]

If you change to global it's a very minor change. You'll possibly lose a few logs as things switch over on the FAZ side. That's about it. I would suggest you just enable FAZ on the global setting that would be easiest for you.

You can also try the "use-management-vdom" setting which sounds like it will accomplish something similar.

You don't need to add any interfaces to the FGT. You already have all of your physical connectivity. We are talking about logical connections now. (Unless you are thinking about the option to add an interface to FAZ for connectivity into VDOM 2. But that doesn't need a new intf on the FGT).

[yw2023]

thanks @funkylicious

Normally, I would agree with you.
Even though there are two virtual devices, there is only one target to manage.
I wish you had done it globally when you connected FG and FAZ when you built it...
(Plan1)