FortiAnalyzer send Alarm / Incident if a FortiGate send no logs

 Problem

A FortiAnalyzer logs various FortiGates. To simplify the daily work of the administrator, he does not want to check every morning whether all FortiGates logs are really sent to the FortiAnalyzer.
How can it be ensured that the FortiAnalyzer triggers an "alarm" as soon as a FortiGate does not send a log file for a certain time?

Solution

Create a local log entry when a device is not sending data

Via the CLI you can configure if the FortiAnalyzer creates a local log entry if a device does not send log entries for a certain time.
Furthermore, there are a few more helpful options which are presented here.
config system locallog settings
    set log-interval-dev-no-logging 15
    set log-interval-disk-full 1440
    set log-interval-gbday-exceeded 720
end
  • log-interval-dev-no-logging: Interval in minute for logging the event of no logs received from a device. 0 is default and disable the log entry
  • log-interval-disk-full: Interval in minute for logging the event of disk full. 0 is default and disable the log entry
  • log-interval-gbday-exceeded: Interval in minute for logging the event of the GB/Day license exceeded. 0 is default and disable the entry.
In this example, a local log entry is created every 15 minutes as soon as a device has not delivered any data.

Create FortiAnalyzer Event-Handler 

Next, we create a FortiAnalyzer event handler to catch the generated local log entry.

Verify

Comming soon.


Comments

Post a Comment

Popular posts from this blog

FortiGate BGP dual-home with multiple ISP

Image
Problem Design with two ISPs and an RIPE Routed public IP Ranges. How to solve, that the public Range is available over both ISPs but without asymetric Routing and ISP-1 is the primary. Solution FortiGate Basic BGP configuration First start with basic BGP configuration config router bgp set as 65301 set router-id 100.200.100.254 set keepalive-timer 45 set holdtime-timer 120 set bestpath-med-missing-as-worst enable set graceful-restart enable     config redistribution connected          set status enable     end end bestpath-med-missing-as-worst :  The route without MED is automaticly the worst destination. gracefule-restart :  Advertise reboots to neighbors so they don't see the router as offline, wait before declaring them offline, and how long to wait when they reboot before advertising updates. These commands apply to neighbors and are part of the BGP capabilities. This prevents unneeded routing updates. holdtime-timer: How long the router will wait for
Read more

FortiMail - Server Basic Configuration

Image
 Problem Nowhere is it written exactly how FortiMail must be configured in Server Mode to run a secure Basic Mail Server. Here is a summary of most of the settings: Solution System Network Configure your Interfaces Be sure that you have configured an default Gateway Port Forwarding FortiMail are able to forward Traffic from a the internet to the local LAN (DNAT). For more information:  FortiMail Doc FortiGate The FortiGate are able to send SMTP traffic through an WCCP Tunnel to the FortiMail for scanning. See for more information:  FortiDoc Configuration Set the correct Time Zone Configure your Password Policy Change the Admin Ports  to non default ports If you need configure the SNMP settings Mail Settings Set the Hostname  and the Local domain name . Togther there are the FQDN of the FortiMail. Activate the SMTP MA service  (use other ports for mail submiting by clients as mail transfer to other Mail servers.  Relay Host If you run the FortiMail behind another Mailserver which acts a
Read more

FortiGate as DNS Server or DNS Proxy

Image
 Problem Especially in small networks, sometimes you do not have a dedicated DNS server available. For this purpose, the FortiGate can be used as DNS server. For larger installations, all DNS queries should be proxied for security reasons. The FortiGate can also help here. Solution A detail documentation about the DNS Server functionality is in the offical documentation:  Fortinet Doc In this post I would like to clearly present the most important functions and configuration types of the DNS function. DNS-Server In the following example the FortiGate act as DNS Server: Enable DNS Feature Enable the DNS Feature in the GUI: CLI command: config system settings     set gui-dns-database enable end Configure DNS Server Enable the DNS Feature on the interface on which DNS requests should be answered: Select Network Select DNS Servers Select the listen Interface Select the DNS Server Mode (see delecration below) The same on the CLI: config system dns-server     edit DMZ2          set mode recu
Read more