Hi,
I have the below query with respect to Fortigate firewall in high availability mode.
Basically device-id field in the syslog is the serial number of FortiGate firewall which is non editable . Where as devname(hostname) field in the syslog is editable we can give any custom String for devname(hostname) field. Say if i have edited this devname field value to any other custom string(say My-FortiGate) to my failover device, will that value be retain during next configuration sync between the primary and Failover or will primary device devname (say EFI-APP-FW as per below sample log) value overwrite the modified devname(hostname) value for the failover?
Sample Syslog for reference:
<089>date=2010-06-17 time=08:38:41 devname=EFI-APP-FW device_id=FG300B3908600862 log_id=0003060006 type=traffic subtype=allowed pri=notice vd=root SN=5590378 duration=28 user=" ARICHA" group=" CN=FULL-INTERNET,OU=GROUPS,OU=TORRE CHARDON,DC=FONALLEDAS,DC=C" rule=3 policyid=3 proto=6 service=80/tcp app_type=N/A status=accept src=10.10.20.163 srcname=10.10.20.163 dst=204.160.105.066 dstname=204.160.105.066 src_int=" port1" dst_int=" port2" sent=16504 rcvd=9497 sent_pkt=53 rcvd_pkt=64 src_port=4659 dst_port=80 vpn=" N/A" tran_ip=76.76.202.170 tran_port=59736 dir_disp=org tran_disp=snat
Please clarify me in this regard.
Awaiting your response,
Thanks & Best Regards,
Mahi