Hello.
Please,
I've set up a vpn between a Fortigate 90D v5.4.8,build1183 (GA) LAN 192.168.130.1 and a Fortigate 100D v5.6.4 build1575 (GA) 10.241.10.1, I can ping lans in both sides, but pinging on the device itself, for example from 90D to 100D it does not work, it works if I set it to ping from source 192.168.130.1, because of that I can't configure Fortianalizer.
I have other Fortigates configured the same way and that doesn't occurres.
Thank you.
Alexandre Cardoso
So your (IPsec?) VPN is working between the lans, but logging from the remote FortiGate to a FortiAnalyzer across the VPN isn't working?
The FortiAnalyzer should be expecting the FortiGates internal IP (not the public IP used for the VPN). This is assuming you're connecting to the lan IP of the FAZ through the VPN.
config log fortianalyzer setting set source-ip <FortiGate Internal IP> You'll need to have your routes and security policies defined to allow this. The security policies, since they are going lan to lan through the VPN, should not use NAT.
You could maybe set a ip address in the vpn tunnel and src-ip from that interface.
Ken Felix
PCNSE
NSE
StrongSwan
Thank's for the response.
Yes, logging from the remote FortiGate to FortiAnalyzer across the VPN isn't working.
From FortiAnalyzer I reach the local FortiGate's local interface.
FortiAnalyzer-400C # execute ping 192.168.130.1 PING 192.168.130.1 (192.168.130.1): 56 data bytes 64 bytes from 192.168.130.1: seq=0 ttl=254 time=28.338 ms 64 bytes from 192.168.130.1: seq=1 ttl=254 time=97.904 ms 64 bytes from 192.168.130.1: seq=2 ttl=254 time=105.249 ms 64 bytes from 192.168.130.1: seq=3 ttl=254 time=28.374 ms
--- 192.168.130.1 ping statistics --- 4 packets transmitted, 4 packets received, 0% packet loss round-trip min/avg/max = 28.338/64.966/105.249 ms
FortiAnalyzer-400C #
Now, from FortiGate (192.168.130.1) I can't reach FortiAnalyzer (10.241.10.3)
FGT-DP4RS # execute ping 10.241.10.3
PING 10.241.10.3 (10.241.10.3): 56 data bytes
--- 10.241.10.3 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss
Unless
FGT-DP4RS # execute ping-options source 192.168.130.1
FGT-DP4RS # execute ping 10.241.10.3 PING 10.241.10.3 (10.241.10.3): 56 data bytes 64 bytes from 10.241.10.3: icmp_seq=0 ttl=62 time=27.7 ms 64 bytes from 10.241.10.3: icmp_seq=1 ttl=62 time=30.0 ms 64 bytes from 10.241.10.3: icmp_seq=2 ttl=62 time=28.6 ms 64 bytes from 10.241.10.3: icmp_seq=3 ttl=62 time=28.0 ms 64 bytes from 10.241.10.3: icmp_seq=4 ttl=62 time=28.9 ms
--- 10.241.10.3 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 27.7/28.6/30.0 ms
Alexandre Cardoso
With my own setup doing logging from a remote FortiGate over IPsec VPN to a FortiAnalyzer I also set the local-ip for the vpn interface.
One related question: Are you trying to do this just for logging to the FAZ, or as part of a Fortinet Security Fabric? With the security fabric there are a couple other hoops you need to jump through.
And note that you'll need appropriate security policies for all this.
Hi, I'm sorry about the delayed response, but the issue remains;
I'm trying to connect FGW straight to FAZ.
It seems like this, but I can't set FGW to send packages using local interface 192.168.130.1 by default, I guess it would solve the question.
Alexandre Cardoso
It worked now guys? Thank you very much! ######################
FGT-DP4RS # config log fortianalyzer setting
FGT-DP4RS (setting) # set server 10.241.10.3
FGT-DP4RS (setting) # set s
FGT-DP4RS (setting) # end
##############################
FGT-DP4RS (setting) # show full-configuration config log fortianalyzer setting set status enable set ips-archive enable set server "10.241.10.3" set enc-algorithm high set conn-timeout 10 set monitor-keepalive-period 5 set monitor-failure-retry-period 5 set source-ip "192.168.130.1" set upload-option store-and-upload set upload-interval daily set upload-time 00:59 end
##############################
FGT-DP4RS (setting) # end
FGT-DP4RS # execute log fortianalyzer test-connectivity FortiAnalyzer Host Name: FortiAnalyzer-400C FortiGate Device ID: FGT90D3Z14002035 Registration: registered Connection: allow Disk Space (Used/Allocated): 0/1000 MB Total Free Space: 1847181 MB Log: Tx & Rx (log not received) IPS Packet Log: Tx & Rx Content Archive: Tx & Rx Quarantine: Tx & Rx
###############################
Alexandre Cardoso
User | Count |
---|---|
2056 | |
1173 | |
770 | |
448 | |
341 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.