Fortigate 7.2.8 FortiAnalyzer v7.6.2 KVM interface MUST be set error

[AlexandreP]

In FortiAnalyzer (v7.6.2 KVM), I authorized the Fortigate (v7.2.8), and Added the Fortigate in the devices list.

They are all FortiCloud connected on the same account.

On the Fortigate, when going to Security Fabric - Connectors - Logging & Analytics - right clic EDIT - Settings - FortiAnalyzer , I Enabled, wrote the server ip, and if I wait, there is the circle of death for the Connection status, but if I click on Cloud Logging, and come back to FortiAnalyzer, it's now connected! If I click on OK, I get the message "Empty values are not allowed. Attribute interface MUST be set" error. See image.

The versions are compatible in the matrix, so anyone has any idea what's the bug?

 

FortiGate

FortiAnalyzer 

[solenol4]

There is a FortiGate and FAZ compatibility matrix, I would check that to make the systems are on the right OS. You probably already checked, but make sure you are allowing TCP/UDP 514 if there is a network device between the two systems

[Debbie_FTNT]

Hey Alexandre,

the error "attribute 'interface' must be set" sounds like a CLI error, to be honest.

Can you do the following in your FortiGate CLI:

#config log fortianalyzer
#show full

There may be some CLI settings related to interface (such as select method); depending on what those settings are, FortiGate might expect an interface to be set (which is not available in GUI) and return an error if the interface value is empty.

For example, if the interface select method is set to specify, not auto, then FortiGate expects a source interface to be set through which is should send traffic to FortiAnalyzer.

Cheers,

Debbie

[AlexandreP]

Hi Debbie,

So I went the CLI way and dig, and it worked, and I see logs stating to enter the FAZ.

By the way it's: "# config log fortianalyzer setting" now ;)

You where right that the "set interface-select-method auto" is not present in my case, for I don't know what reason, in the GUI of the Fortigate.

Should I create a ticket (I have support licences) so this is in the list of bugs to put on the radar for the dev team?

Also, maybe something weird was there when I used the CLI :

-- START --

# config log fortianalyzer setting

(setting) # set status enable
(setting) # set server [IP.ADDRESS]
(setting) # set conn-timeout 5
(setting) # set interface-select-method auto
(setting) # set serial FAZ-correctSERIAL
(setting) # set upload-option realtime
(setting) # end
The Serial Number for FortiAnalyzer is not entered.
In order to verify identity of FortiAnalyzer serial number is needed.
If serial number is not set, connection will be set as unverified and
access to local config and files will be accessible only with user name/password.
FortiGate can establish a connection to obtain the serial number now.Do you want to try to connect now? (y/n)y

Obtained serial number from X509 certificate of Fortianalyzer is: FAZ-correctSERIAL
Serial number from certificate MUST be the same as serial number observed in Fortianalyzer.
If these two serial numbers don't match, connection will be dropped.
Please make sure the serial numbers are matching.
In case that Fortianalyzer is using a third-party certificate, certificate verification must be disabled.
Do you confirm that this is the correct serial number? (y/n)y

serial to be set:FAZ-correctSERIAL

-- END --

I already did set the serial, and it's telling me it's not there? That's a little confusing, but not critical I guess.

Thanks for your answer, it sent me in the right direction!