Configuring Syslog's and NetFlow's from Fortinet/ FortiGate firewalls

Overview

Fortinet / FortiGate is a network firewall , delivering networking and security capabilities in a single platform. We here providing you the steps to ingest the device with Seceon SIEM to have a better visibility of threats happening in your environment .

Steps Of Configuration

• Log in to the firewall User Interface

Open

• Change VDOM

  • By default, user would logon to “root” vdom.

  • They need to make sure that Global vdom is selected.

  • User can do that by clicking on the dropdown on top left side and select the vdom root.

Open

For Logs Configuration:

•  Click and expand "Log & Report" then click on 'Log Settings'

•  Add the CCE IP address

•  Check the option 'send logs to syslog'

•  Click Apply to save your settings.

NetFlow configuration steps for version 7.0.0 onwards :

• To Configure NetFlow, Login into CLI with correct privileges.

  • config system netflow

  • Description: Configure NetFlow.

  • set collector-ip {ipv4-address}

  • set collector-port {integer}

  • set source-ip {ipv4-address}

  • set active-flow-timeout {integer}

  • set inactive-flow-timeout {integer}

  • set template-tx-timeout {integer}

  • set template-tx-counter {integer}

  • end

For Netflow configuration older version of FortiOS.

• Click on the dashboard and scroll down to the CLI console

• Click on the CLI console to connect.

• To Configure Netflow, type the following commands on the console one after another. Make sure to replace <ipv4_addr> with CCE IP Address

  • config global Firewall  (This step might not be required in some versions of FortiGate firewall) 

  • config system netflow 

  • set collector-ip <ipv4_address>

  • set collector-port 9995

  • end

• To Enable Netflow, type the following

  • config system interface 

  • edit <interface name>    ....with all the interfaces to be configured

  • set netflow-sampler both

  • end

Verification

Verification can be done in two ways

On CCE:

Run the command on CCE server to check if you start getting logs and flows from firewall:

To check the logs :

sudo tcpdump -i any port 514 and host <Firewall IP>

To check the flows:

sudo tcpdump -i any port 9995 and host <Firewall IP>

On UI

STEP1: Login to UI >> SYSTEM>> LOGS AND FLOWS COLLECTION STATUS .

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS .

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.