FortiIsolator add to FAZ

[Mandalorian]

I have a FortiIsolator in version 2.4.7 build 1120  I'm trying to hook it up to my FAZ in version 7.2.10 build 1682 but I'm having problems after hooking the device up to the FortiAnalyzer.

Below are the test already done:

- Release compatibility between products (matrix rules). OK

- Firewall policies enabled via Fortigate under my management, traffic ok enabled protocols list: ICMP, UDP/514 and TCP/514. OK

- Routing between FAZ and FortiIsolator ping ok, routing is managed by my Fortigate where the above policies are also present. OK

- FortiIsolator setting under LOG -> REMOTE SERVER

Fault description

See below the hook from FAZ to FortiIsolator the error found

Is it possible that I'm doing something wrong or maybe the connection with FortiIsolator has to be done differently than the classic Fortigate ?

Thanks in advance!

FortiAnalyzer #FortiIsolator

[AEK]

Hi Mandalorian

When you add a syslog device you don't add it this way.

Once you configure the device to send syslogs to FAZ, once FAZ starts to receive the first log you should see a new alarm in FAZ's top-right corner.

Click on the alarm to authorize the device, then go to Unauthorized Devices menu to complete the process.

Once done you can see the logs in the log view section.

This is the way.

[Mandalorian]

Hi AEK,

We tried the procedure you recommended, and we generated event logs but on our FAZ we don't find any notifications on the root vdom under unauthorized devices.
Is it possible that I'm doing something wrong with the FortiIsolator configuration under LOG -> REMOTE SERVER ?
If you have any suggestions, we're ready to test them.

I would like to add that the IP set on the FortiIsolator is related to the VIP of the interfaces between the two FAZs (HA type is active-passive).

Thanks in advance!

FortiAnalyzer #FortiIsolator

[AEK]

Hi Mandalorian

Use the following command on FAZ to check if it is receiving syslog messages from FIS.

diag sniffer packet any 'host x.x.x.x' 4

Where x.x.x.x is FIS' IP.

This is the way

[filiaks1]

So as @AEK mentioned this is like adding 3-rth party device Technical Note: How to add a third party ... - Fortinet Community

[VinayHM]

Authorize the device