Registration of FortiGate and FortiCloud Issues

[albaker1]

We are relatively new to the FortiGate platform, but we had on individual on the team who registered the firewall under his Fortinet account. We ended up having to register FortiCloud (free version) under the same account, as the email that pops up for FC registration can't be changed and is the same as what the FGT was configured for. We noticed a significant disparity between the logs that are in FGT memory and the logs in FC. The problem is that only one of us can get into FC, so the logs we frequently search for on the FGT with the log source pointed to FC don't show up. Given we have the FGTs with no SSD, the amount of logs we have access to on the firewall is very limited, with one only having 10-15 seconds of available logs.

We did open a TAC case for the log issue, and we were told we needed the FortiCloud Premium, and the logs will show up as expected on the FGT. There is some aversion to spending the money, so we want to move the firewall licensing and FC to a shared account used by everyone on the team as we have to have the logs available to each of us.  

Here's are my questions:

1. When we unregister the license with the current account, will production traffic be impacted? 

2. Has anyone else experienced log discrepancy when using the free version of FC? Do we really need to go with FC Premium?

Thank you

[hbac]

Hi @albaker1,

1. As long as the FortiGate has valid license, production traffic should not be impacted. 

2. Without FortiCloud premium, you should be able to keep logs on FortiCloud for 7 days. What is the firmware version you are using? Can you make sure that you are sending logs to FortiCloud? https://community.fortinet.com/t5/FortiGate/Technical-Tip-Sending-logs-to-FortiCloud/ta-p/191694

Regards, 

[albaker1]

1. We have to temporarily unregister the FortiGate to get it registered under another account. Does that mean there will not be a valid license between the deregistration and the reregistration? 

2. We're running 7.2.6. We are sending logs to FortiCloud. However, when we're on the FortiGate and have FortiCloud set as the log source, as an example we can see a log entry for DNS traffic to 8.8.8.8. However, we set a filter to only see 8.8.8.8 traffic, and the log entry is blank. I've also performed packet captures on the FortiGate, and I'll see specific traffic I'm looking for. I'll wait for the logs to get put into FortiCloud, and even entries from the past hour I just saw in the capture never show up with no filter applied.

Absolutely sure logs are sent to FortiCloud. Most of the time, we can find the logs entries on the FortiGate after selecting FortiCloud as the source, but if I can't find what I'm looking for, it's possible to log directly into FortiCloud and see it there. I just don't have direct access to that FortiCloud instance, so I have to ask a colleague to look for it.

[albaker1]

It's not like we can't find any logs in FortiCloud, but it's just not consistent. We had an open TAC case, and the engineer confirmed what's showing up on our firewall and what's in FortiCloud is sometimes not the same.