Manage Fortianalyzer

[burim]

Hello,

We have a client with 2 FG and 2 FAZ appliances and they want a centralized management. I know I can manage FG appliances using Fortimanager but I don't know if I can manage FAZ appliances as well. 

Any idea please.

Thanks. 

[DirkDuesentrieb]

Hi,

in the Release notes of 5.6 you can find

Managed FortiAnalyzer

[ul]

Support managed FortiAnalyzer by adding a FortiAnalyzer unit to an ADOM in FortiManager.

Automatically synchronize the device configuration on FortiManager to the managed FortiAnalyzer.

View log analytics, monitor events, and generate reports from the single FortiManager console.

Modify a policy via a policy ID from Log View and view policy related logs from Policy Package.[/ul]

http://docs.fortinet.com/uploaded/files/3865/fortimanager-v5.6.0-release-notes.pdf

However: I tested that and had issues with ADOMs and the synchronization. So it might work in the near future but currently it seems like a WiP.

Cheers,

Dirk

[chall_FTNT]

Dirk,

You mentioned that you "tested [Managed FortiAnalyzer] and had issues with ADOMs and the synchronization".  Can you elaborate? There are two documented limitations as noted in Adding FortiAnalyzer devices

[ul]

You can add one FortiAnalyzer device to each ADOM

You cannot add the same FortiAnalyzer device to multiple ADOM[/ul]

It should also be noted that FortiAnalyzer must also be running 5.6. Otherwise, the feature works fine.

[DirkDuesentrieb]

Hi,

yes it's a documented limitation, but I had to read very carefully to find a hint to this limitation after I tested everything. The NSE5 Trainer wasn't sure here as well and he guessed it will be transparently like the embedded FAZ in FortiManager. 

Cheers,

Dirk