Fortianalyser logging interface

[darrencarr]

Hi guys, How do you change the interface that your firewall appliance uses to log (send) traffic to a Fortianalyser appliance? Mine is currently trying to use my Internet (first physical interface). Can you change this? Thanks, Darren

[rwpatterson]

This sounds like a routing issue. If the FAZ is in the routing table, there shouldn' t be an issue.

[abelio]

Hi,

How do you change the interface that your firewall appliance uses to log (send) traffic to a Fortianalyser appliance? Mine is currently trying to use my Internet (first physical interface). Can you change this?

If you' re in a multi-wan scenario, maybe you' ll need policy routes to reach your FAZ using the interface you want. Under 4.3.x fortiOS you have a new CLI command to control that

 config log fortianalyzer setting
    set source-ip <address_ipv4>
 end
 

However, by your signature you' re running 4.1.x Under such scenario you could try to force the interface on which your 1000A will detect your FAZ by using FDP protocol

 config log fortianalyzer setting
   set fdp-interface <interface>
 end
 

regards

[emnoc]

If the FAZ is in the routing table, there shouldn' t be an issue

but Are you sure the FAZ default gateway is set correctly? I' ve seen very weird things when the gateway is not set on the analyzer. you can rule out some of the above,m with pings between the 2 devices, and using the interface that you have configured ( FGT>>>FAZ or FAZ>>>FGT ) Also if you have the FAZ behind any FWs, make sure the fwpolicies are correct.

[darrencarr]

Hi All, Sorry, me again. Same issue as above. We recently changed the IP address of the interface for which logs should be sent from to the Fortianalyser. I can confirm that from the Fortianalyser I can PING the firewall I am expecting the logs from. From the firewall, if I set the source in the ping-options to the Interface IP I can ping the Fortianalyser. If however I set up a sniffer the source is showing up as my Internet interface IP address? I have policies/routing configured correctly. Any idea what could be causing this? Obviously something is a miss but on the face of it it looks ok to me??? Any pointers would be much appreciated.

[darrencarr]

I should also add that after I have adjusted the policies I can PING the Fortianalyser from another host on the same network as the Fortigate (10.3.1.0/28) the host is 10.3.1.1. The strange thing is that it is sending it to the IPSec interface but with the source address of the Internet interface. I' ve included the layout of the network between the firewall and fortianalyser