Configuring a FortiTelemetry Controller

An on-premise FortiGate hardware model running FortiOS 7.6.3 or later can be configured to act as a FortiTelemetry Controller. For information about requirements, see the FortiTelemetry Administration Guide.

You must supply and maintain the certificates used by FortiTelemetry Windows agents because they are not included by default.

To prepare a certificate:

1. Create a certificate authority (CA) certificate using your preferred certificate authority.

   • For details about creating a local CA certificate and user certificate using FortiAuthenticator, see Local CAs and End entities, respectively.

   • For details about creating a local CA certificate and user certificate using XCA, see Creating certificates with XCA.

   • For details about creating a local CA certificate and user certificate using Windows Server with Active Directory Certificate Services (AD CS), see Implement and manage Active Directory Certificate Services.

2. Upload the CA certificate on the FortiGate acting as FortiTelemetry Controller:

   1. Go to System > Certificates.

   2. Click Create/Import > CA Certificate.

   3. Select Type as File, and then upload the CA certificate.

   4. Click OK. Once uploaded, you will see the certificate under Remote CA Certificate.

3. Using your certificate authority, create a user certificate, so you can import the certificate file to the Windows OS local machine that is hosting the FortiTelemetry Windows agent. The private key information is required, and the user certificate should be of the PFX or p12 file type. See the FortiTelemetry Administration Guide for details.

To configure the FortiTelemetry Controller:

1. Enable FortiTelemetry, and specify a data port:

   Although specified, the data port is not currently used but reserved for a future use.

   config system global
       set telemetry-controller enable
       set telemetry-data-port 35246
   end

2. Configure the retry interval for FortiTelemetry Cloud and the CA certificate used to validate the identity of the FortiTelemetry Windows agent:

   config telemetry-controller global
       set region global
       set retry-interval 60
       set telemetry-ca-certificate "CA_Cert_1"
   end

3. Enable telemetry feature visibility in the GUI:

   config system settings
       set gui-fortitelemetry enable
   end

4. Include fabric in the FortiGate interface allowaccess, and enable automatic discovery of FortiTelemetry agents:

   This example is for port2.

   config system interface
       edit "port2"
           set ip 192.168.253.99 255.255.255.0
           set allowaccess ping https ssh snmp http telnet fabric
           set telemetry-discover enable
       next
   end

   Ensure that the interface has an IP address configured when including fabric in the interface allowaccess setting.