TCP port 514 in FortiAnalyzer

[yeowkm99]

During a recent VAPT security scanning, TCP port 514 was flagged out to be have weak SSL cert.

The recommendation was to get a propert SSL certificate for the appliance.

Can we disable port 514 on the Analyzer ?

my firmware version is 6.4.10. will upgrade to version 7.2 soon.

Contact the Certificate Authority to have the certificate reissued.

Purchase or generate a proper certificate for this service.

[srajeswaran]

TCP port 514 on Fortianalyzer is used by fortigates to connect and send logs, unfortunately we cannot disable that.

https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/766616/fortianalyzer-open-por...

[Debbie_FTNT · Accepted solution]

You can generate a certificate via Let's Encrypt for example, and use that instead (replace the server certificate in FortiAnalyzer system settings):

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/718606/provision-a-trusted-certificate-...

-> the guide is for FortiGate, but generating the certificate is very similar on FortiAnalyzer

[Edu_Master]

Hello guys!

I'm trying to understand why my hosts conected to fortiEMS keep sending this logs to Fortianalyzer.

Can someone help me understand that, please!?

[ozkanaltas]

Hello @Edu_Master ,

If you configured "Upload Logs to FortiAnalyzer/FortiManager" in the endpoint profiles-> system settings. Your client wants to send their log to Fortianalyzer.

You can find more information about in this link.

https://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/107284/system-settings