Managing Devices Flashcards
Device Registration States
Registered: Authorized to store logs on FAZ
Unregistered: Requesting to store logs on FAZ
How to register device
Initiate from FAZ or remote device
stage devices on FAZ by prepopulating information
Add individual devices or a Security Fabric
Pre-Shared Key method
Only usable for FGTs
Which Logs are Collected from FortiGate?
Logs - Traffic, Event, Security
DLP Archive
Quarantine
IPS Packet Log
Command to see devices and IPs connecting to FAZ
diagnose test application oftpd 3
ADOM and Device list commands
diagnose dvm adom list - what adoms are enabled and configured
diagnose dvm device list - what devices or VDOMs are currently registered or unregistered
Troubleshooting commands
execute ping
diagnose debug application oftpd 8 - Is FAZ receiving logs?
show log fortianalyzer settings - Is FGT configured for remote logging to FAZ, is FAZ source IP set on FGT?
show log fortianalyzer filter - Are logging filters for logs sent to FAZ on FGT enabled?
diagnose log test - is FGT capable of generating logs?
Troubleshooting traffic to FAZ
Run sniffers on both devices.
diagnose sniff packet <interface> <filter> <level> <count> <timestamp></timestamp></count></level></filter></interface>
Steps to Troubleshooting Communications
Debug the oftpd process
Generate test logs on FGT
Verify logs are received
Moving Registered Devices between ADOMs
Don’t if you don’t have to.
Can move them after registration. (Restricted to Super_User Admins)
Don’t need to create a new ADOM if you upgrade FGT firmware(not necessary to seperate ADOMs by FortiOS version)
After moving a device
Ensure Disk quota has enough space
When you move a device, only the archive logs are migrated to new adom. Analytics logs stay in the old one until you rebuild the databases
Adding a FGT HA cluster
FAZ automatically discovers if a FGT is in a cluster. If registered to FAZ before forming the clust, add them manually together
How to get Analytics Logs in New ADOM after Moving a device?
execute sql-local rebuild-adom <new-adom-name></new-adom-name>
How to get rid of Analytics Logs of new device in Old ADOM?
execute sql-local rebuild-adom <old-adom-name></old-adom-name>
How does FAZ distinguish FGT cluster member logs?
FAZ distinguishes them by serial numbers from log message headers.
Each device generates its own logs, separated by serial numbers of devices. The primary is responsible for sending logs to FAZ.
