Fortianalyser - added device down

[Inadmin]

Hi all, a new fortianalyzer VM, located in a datacenter, everything is setup and working properly, latest version.

Added a single device, status shows "down", device was added using its serial number, external IP automatically detected. Port 514 forwarded into the fortianalyzer VM.

On the FGT, a fabric connector to the FAZ was successfully setup, showing "connected" status, and even log traffic is being shown.

What am i missing?

[ede_pfau]

Is the FAZ authenticated on the FGT as well? this needs to be bi-directional. Connected <> authorized.

If so, the serial no. of the FAZ is added to the config, so you could find it easily with

"show full | grep <serialno_of_FAZ>"

[Inadmin]

I have added 8gb RAM to the VM (it's now 16) - the device shows as "online" now but the last log time still shows "n/a" - the above command indeed shows the S/N of the analyzer.