Replace Fortianalyzer 400E by FAZ 810G

[mendess_Jk]

We will replace FAZ 400E (7.4.1) by FAZ 810G (7.4.3)

What s the best way to do it, if we want to migrate logs too, as we will have to shutdown the old FAZ 400E. For sure i think i will  have to upgrade 400E to 7.4.3 as 7.4.1 is not supported on 810G. Right ?

We found these topics

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-migrate-a-FortiAnalyzer-log-and...

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Using-exec-migrate-to-migrate-to-a-new...

But during the migration, both FAZ will be available and joinable.

-Does Log Aggregation permit to migrate all real time and old logs ?

-Does Log Fetching permit to move all type of logs ?

-Should i just exe backup/restore logs ? 

What is the best way to do miragte completely all logs between both FAZ ?

[ozkanaltas]

Hello @mendess_Jk ,

I've done this before with log fetching on two FortiAnalyzer VMs.

First of all, I gave the IP address of the old FortiAnalyzer to the new one and ensured that all new logs were sent to the new FortiAnalyzer.

I then gave the old FortiAnalyzer a different IP address. I gave an IP address to the new FortiAnalyzer from the same subnet and started the log fetching process. When the transfer was completed, all old logs were transferred to the new FortiAnalyzer.

I think this is the easiest and safest way to transfer.

You can review the details of this process in the document below.

https://docs.fortinet.com/document/fortianalyzer/7.4.3/administration-guide/651442/log-fetching