Configure FortiAnalyzer-BigData as IPFIX log server on FortiGate

After external IP addresses for Security Manager hosts are set, you can configure a FortiGate with Hyperscale firewall features to send NetFlow v10 (IPFIX) log messages over UDP to FortiAnalyzer-BigData. For more information, see Hyperscale Firewall Hardware logging in the Fortinet Doc Library.

To configure FortiAnalyzer-BigData as NetFlow log server on FortiGate:

1. Go to Log & Report > Hyperscale SPU Offload Log Settings.
2. Select NetFlow version V10.
3. In Log Servers, click Create New to add each external IP address of FortiAnalyzer-BigData Security Manager Host.
4. In the Source port and Destination port, enter 2055.

   

5. In Log Servers Groups, click Create New to create a log group.
6. For Logging mode, select Per-Session ending.
7. For Log format, select NetFlow.
8. For Log servers, add all the log servers created in the previous step.
9. Click OK.

   The FortiGate is configured to send NetFlow log messages to FortiAnalyzer-BigData.