FortiAnalyzer treats a FortiGate High Availability (HA) cluster as a single logical device. If the individual FortiGate units were added to FortiAnalyzer before being configured into an HA cluster, they will appear as separate devices. To correctly represent the cluster, an administrator must manually group these existing device entries on FortiAnalyzer. This is accomplished by selecting the relevant devices in the device list and using the "Group HA" function. This action consolidates their management and logging under a single cluster entity, ensuring proper reporting and analysis.

B: FortiAnalyzer primarily identifies individual cluster members by their unique serial number (devid) contained within the logs, not by the source IP address in the log message headers.

C: FortiAnalyzer handles HA failover automatically. When a new primary takes over, it begins sending logs, and FortiAnalyzer recognizes it as part of the cluster without requiring manual intervention.

D: FortiAnalyzer supports logging from FortiGate HA clusters in both active-passive and active-active modes. There is no requirement to limit the configuration to active-passive mode.

1. Fortinet FortiAnalyzer Administration Guide 7.4.1

"Adding a FortiGate HA cluster"

Page 51.

"If you have already added the FortiGate devices to the device list

you can group them together into an HA cluster. ... In the content pane

select the devices that you want to group into an HA cluster

then click Group HA in the toolbar." This directly supports option A.

"When a FortiGate HA cluster is added to FortiAnalyzer

FortiAnalyzer sees the HA cluster as a single device. ... If a failover occurs

the new primary FortiGate sends logs to FortiAnalyzer." This refutes option C.

2. Fortinet FortiOS Administration Guide 7.4.1

"Logging"

Page 671.

"FortiAnalyzer uses the device ID to identify the FortiGate." This supports the reasoning for why option B is incorrect

as the serial number (device ID) is the primary identifier.

3. Fortinet FortiOS Handbook - High Availability 7.4.0

"Active-active HA"

Page 31.

This section details the operation of active-active HA

including how traffic and logging are handled

with no mention of incompatibility with FortiAnalyzer

thus refuting the limitation suggested in option D.