FortiAnalyzer Configuration

ADOM Modes

• In normal mode, the ADOM disk quota is fixed, but in advanced mode, it is flexible
• ADOM modes can be changed through the CLI
• In advanced ADOM mode, FortiGate VDOMs from a single FortiGate device can be assigned to multiple FortiAnalyzer ADOMs
• Normal mode is the default ADOM mode

FortiAnalyzer Command: diagnose system print netstat

• The command provides network statistics for active connections
• The statistics include protocols, IP addresses, and connection states

New Administrator Configuration

• Enabling "Match all users on remote server" creates a wildcard administrator using an LDAP server
• Administrators can log in to FortiAnalyzer using their credentials on the remote LDAP server

Device Connection Status: Unauthorized

• The status means a device's registration has not yet been accepted in FortiAnalyzer

FortiAnalyzer Configuration Purpose

• It is to improve security

Offline Logs on FortiAnalyzer

• Offline logs are compressed logs
• They are also known as archive logs

System Backup Elements

• Report information is contained in the backup
• System information is too

FortiAnalyzer Fabric Members

• FortiAnalyzer1
• FortiAnalyzer3 can be members of a FortiAnalyzer Fabric

Log Arrival Issues on FortiAnalyzer

• FortiGate logging might not be configured correctly

Administrator Account Problem

• If an administrator (fortinet) is unable to create a mail server to send alert emails, it is because fortinet is assigned the default Standard_User administrative profile

Total Quota Calculation Parameters

• Reserved space
• Total system storage

Non-Local Administrator Authentication

• An administrator group is required
• One or more remote LDAP servers are too

FortiGate Device Move between ADOMs

• Archived logs will be moved to ADOM1 from the root ADOM automatically

FortiGate HA Clusters and FortiAnalyzer

• If devices were registered to FortiAnalyzer before forming a cluster, you can manually add them together

Handling Hard Disk Failure on FortiAnalyzer with RAID

• Perform a hot swap of the disk

Command Purpose

• The command serves to record the hash value and authentication code of log files

RAID 10 (1+0) on FortiAnalyzer

• It's a configuration with four disks, each with 2 TB capacity, providing a total space of 4 TB

Joining HA Cluster

• The FortiAnalyzer will join the existing HA cluster as the secondary

Parameters Impacting Reserved Disk Space

• RAID level
• Disk size

New Administrator on FortiAnalyzer with LDAP Server

• This password is used if the authentication server becomes unreachable

Fortinet Security Fabric and Traffic Logs

• The upstream FortiGate is configured to do NAT

High Availability (HA) on FortiAnalyzer

• FortiAnalyzer HA supports synchronization of logs, system, and configuration settings
• All devices in a FortiAnalyzer HA cluster must operate in the same mode (analyzer or collector)

Deleting ADOMs

• ADOMs with registered devices cannot be deleted
• Default ADOMs cannot be deleted

Single IP Address in Log Capture

• Logs belong to devices that are part of a high availability (HA) cluster

Disk Status: Degraded

• The hard drive is no longer being used by the RAID controller

Process Enforcing Log File Size

• logfiled is responsible

FortiAnalyzer Operating Modes

• When in analyzer mode, FortiAnalyzer supports event management and reporting features
• Analyzer mode is the default operating mode

Log Forwarding Modes

• Both forwarding and aggregation support encryption of logs between devices
• Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time

Authorization Request Issues

• The management computer does not have connectivity to the authorization IP address and port combination
• The fabric authorization settings on FortiAnalyzer are misconfigured

Restricting Administrative Access on FortiAnalyzer

• Configure trusted hosts
• Use administrator profiles

Firmware Upgrade on HA Cluster

• First, upgrade the secondary devices, and then upgrade the primary device

RAID Configurations Providing Fault Tolerance

• RAID 5
• RAID 1
• RAID 6+0 provide fault tolerance

Connection Status

• The connection between FortiGate and FortiAnalyzer is overloaded

Analytics Logs on FortiAnalyzer

• Analytics logs are indexed and stored in the SQL database

Process Caching Logs

• miglogd process caches logs on FortiGate when FortiAnalyzer is not reachable

Log Synchronization States for HA

• With Initial Logs Sync, when adding a unit to an HA cluster, the primary device synchronizes its logs with the backup device.
• Log Data Sync provides real-time log synchronization to all backup devices

Log Forwarding Modes

• Aggregation mode requires two FortiAnalyzer devices.
• Forwarding mode forwards logs to other FortiAnalyzer devices, syslog servers, or CEF servers

Logging Status

• FortiGate has logs to send, but FortiAnalyzer is unavailable

Creating ADOMs

• FortiAnalyzer creates default ADOMs when ADOMs are enabled
• The ADOM type you create must match the device type you are planning to add

Device Registration Methods

• Serial number registration will place the device automatically in its assigned ADOM
• Pre-shared key registration will too

SAML Roles

• Identity provider
• Service provider can be configured for the FortiAnalyzer

FortiAnalyzer Command: execute format disk

• Intended to earase all device settings and images, databases, and log data from the disk, but preserve the IP and routing info

ADOMs

• A fabric ADOM can include all the device types supported by FortiAnalyzer

FortiAnalyzer Fabric

• Fabric members support HA

Primary FortiAnalyzer Failure in HA Cluster

• The configured priority is checked first

Command: set log-checksum

• To prevent log modification or tampering
• To protect log data from man-in-the-middle attacks

Command: execute sql-local rebuild-adom

• Populates the new ADOM with analytical logs for the moved device, so you can run reports