Fortinet Next-Generation Firewall (NGFW)

1 About The Device
2 Device Information
3 Collection Method
4 Port Requirements
5 Device Configuration
6 Integration Parameters

About The Device

FortiGate combines a number of security features to protect your network from threats. As a whole, these features, when included in a single Fortinet security appliance, are referred to as Unified Threat Management (UTM).

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Fortinet
Product Name	Next-Generation Firewall (NGFW)
Type of Device	Hosted

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method
FortiGate	FORTINET_FIREWALL	Syslog	CyberHub

Port Requirements

Source	Destination	Port

Source	Destination	Port
Fortinet NGFW	CyberHub	601 (TCP)
Fortianalyzer	CyberHub	514 (UDP)

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

To configure Fortigate to send logs to CyberHub

Log in to FortiGateUTM.
Log in to Command Line Interface, and enter the following commands:
1. To enable the extended logs, enter the following commands (This is applicable to FortiGate v5.0 and it is optional configuration):

config log syslogd setting  

set status enable

Users who have configuring syslogd for the first time must enable the status for enabling syslogd, else this step is not needed.

set facility <local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7> 

It is recommended to use facility from local0 to local7 for informational log.

Set port 601 

set reliable enable

set server <ip_address of CyberHub/FortiAnalyzer>  

end

Config antivirus profile

Edit default

Set extended-utm-log enable  

end

Config application  

Edit default  

Set extended-utm-log enable  

end

Config webfilter

Edit default

Set extended-utm-log enable

end

Config spamfilter

Edit default  

Set extended-utm-log enable

end

Config dlp

Edit default

Set extended-utm-log enable

end

Config ips

Edit default  

Set extended-utm-log enable

end

To configure FortiAnalyzer to send logs to CyberHub

Run the following commands:

 config system aggregation-client  
 edit 1
 set mode realtime  [Note: #mode is set to realtime, so that the realtime  events can be forwarded to the CyberHub]
 set fwd-remote-server syslog  [Note: #Real time syslog traffic is configured  to forward to a remote server]
 set server-ip <CyberHub IP>   [Note: #CyberHub IP has to be given here]
 set server-name <"name ">  [Note: #The name of the CyberHub server , its user defined>] 
 set server-port <server port : 514>
 next
 end

Integration Parameters

Parameters required from customer for Integration.

Property	Default Value	Description

Property	Default Value	Description
IP Address	Fortinet NGFW interface IP address	Hostname or IP address of the device which forwards logs to the CyberHub.