Starting from 6.2.0, FortiAnalyzer supports a new ADOM type called Fabric ADOM, which contains logs from all Fabric products (FortiGate, FortiMail, FortiWeb, FortiSandbox, FortiClient, and so on). When FortiManager is managing a FortiAnalzyer that contains a Fabric ADOM:
- ADOM type on FortiManager will be converted to a Fabric ADOM.
- Devices will be synchronized to the new ADOM (non-FortiGate devices are synchronized as log-only devices).
- Users can access logs from all devices in the remote ADOM.
This feature requires both FortiManager and FortiAnalyzer to be running version 6.2.0 or later.
FortiManager adds FortiAnalyzer devices by using central management. Any FortiGate devices that exist in FortiManager, but not in FortiAnalyzer will synchronize to FortiAnalyzer as logging devices. Any FortiGate devices that exists in FortiAnalyzer, but not in FortiManager will synchronize to FortiManager as configuration and logging devices, which means you must provide valid IP addresses and login credentials when adding the device. The non-FortiGate logging devices that exist in FortiAnalyzer, but not in FortiManager will synchronize to FortiManager as logging-only devices.
This procedure requires the following steps:
- On FortiAnalyzer, create a Fabric ADOM.
- On FortiManager, add an ADOM, and add the FortiAnalyzer device to the ADOM
To create a Fabric ADOM on FortiAnalyzer:
- On FortiAnalyzer create a Fabric ADOM.
- Open the ADOM, and add FortiGate logging devices, Security Fabric group and non-FortiGate logging devices, such as FortiWeb, FortiCache, FortiSandbox, and so on.
To configure FortiManager:
- On FortiManager, create a FortiGate ADOM with the same name as the Fabric ADOM in FortiAnalyzer.
The FortiGate ADOM will be used to manage the FortiAnalyzer Fabric ADOM. Although FortiManager supports Fabric ADOMs, you cannot use the GUI to create a Fabric ADOM.
- Open the ADOM, and go to Device Manager.
- From the Add Device menu, select Add FortiAnalyzer to use the wizard to add the FortiAnalyzer device.
When the FortiAnalyzer ADOM type is Fabric, a warning is displayed. If you continue to synchronize the ADOM, the FortiManager ADOM type will change from FortiGate to Fabric.
- Click Synchronize ADOM and Devices.
FortiManager starts to synchronize devices, and the Add Multiple Devices dialog box is displayed where you can edit the device name/ IP Address/ Admin User/ Password.
A valid IP address and login credentials are required to add FortiGate devices.
After all devices are synchronized, FortiAnalyzer is successfully added to FortiManager.