The configuration displayed in the exhibit indicates that the FortiAnalyzer is set up with a cluster

virtual IP address of 192.168.101.222 assigned to interface port1. This setup is typically used for the

FortiAnalyzer to receive logs on that interface when operating in a High Availability (HA)

configuration. The exhibit does not provide enough information to conclude whether this

FortiAnalyzer will be the primary unit in the HA cluster or the duration for the failover trigger; it only

confirms the interface configuration for log reception. Reference: Based on the FortiAnalyzer 7.4.1

Administration Guide, the similar configurations for HA and log reception are discussed, which would

be relevant for understanding the settings in FortiAnalyzer 7.2.

Fabric connectors in FortiAnalyzer, such as security fabric connectors (e.g., FortiClient EMS, FortiMail,

FortiCASB) and storage connectors (e.g., Amazon S3, Azure Blob Container, Google Cloud Storage),

provide efficient integration and data sharing capabilities. Using fabric connectors for direct

integration with FortiAnalyzer is more efficient and reliable than relying on third-party applications

to poll information through the FortiAnalyzer API. Additionally, the ability to send logs to cloud

storage platforms like Amazon S3, Azure Blob, and Google Cloud directly through storage connectors

is a built-in feature that does not require an additional license, thus saving on storage costs and

improving redundancy without incurring extra licensing fees.

Reference: FortiAnalyzer 7.4.1 Administration Guide, "Fabric Connectors" and "Storage connectors"

sections.

To restrict administrative access on FortiAnalyzer, two effective methods are using administrator

profiles and configuring trusted hosts. Administrator profiles allow for defining the level of access

and permissions for different administrators, controlling what each administrator can see and do

within the FortiAnalyzer unit. Configuring trusted hosts enhances security by limiting administrative

access to specified IP addresses, ensuring that administrators can only connect from approved

locations or networks, thus preventing unauthorized access from outside specified subnets or IP

addresses.

Reference: FortiAnalyzer 7.4.1 Administration Guide, "Administrators" and "Trusted hosts" sections.

If the administrator "fortinet" can view logs and perform device management tasks but cannot create

a mail server for alert emails, it is likely due to the administrative profile assigned to them. The

Standard_User administrative profile may restrict certain administrative functions, such as creating

mail servers. To perform all administrative tasks, including creating mail servers, a higher privilege

profile, such as Super_Admin, might be required.

Reference: FortiAnalyzer 7.2 Administrator Guide, "Mail Server" section.

The registration methods that automatically place a device in its assigned ADOM are using the serial

number and fabric authorization. When devices are added to FortiAnalyzer using these methods,

they are automatically placed in the appropriate ADOM, which could be a default ADOM based on

the device type or a predefined ADOM based on the serial number or fabric authorization. This

simplifies the management of devices and their logs by organizing them into their respective ADOMs

from the moment they are registered.

Reference: FortiAnalyzer 7.4.1 Administration Guide, "Default device type ADOMs" and "Assigning

devices to an ADOM" sections.

Regarding ADOMs (Administrative Domains) in FortiAnalyzer, a fabric ADOM is capable of including

all device types that FortiAnalyzer supports. This is part of the flexibility offered by ADOMs to

manage and report on logs from various devices within a Fortinet security fabric. ADOMs can be

enabled to support non-FortiGate devices as well, and the root ADOM in Fabric ADOMs provides

visibility into all Security Fabric devices. Additionally, it should be noted that in normal mode, you

cannot assign different FortiGate VDOMs to different ADOMs, while in advanced mode, you can,

which provides a more granular control over the log data from individual VDOMs.

Reference: FortiAnalyzer 7.4.1 Administration Guide, "ADOMs" and "ADOM device modes" sections.

Link aggregation is a method used to combine multiple network connections in parallel to increase

throughput and provide redundancy in case one of the links fail. This feature is used in network

appliances, including FortiAnalyzer, to add redundancy to the network connections, ensuring that

there is a backup path for traffic if the primary path becomes unavailable. Reference: The

FortiAnalyzer 7.4.1 Administration Guide explains the concept of link aggregation and its relevance to

On FortiAnalyzer, analytics logs refer to the logs that have been processed, indexed, and then stored

in the SQL database. This process allows for efficient data retrieval and analytics. Unlike basic log

storage, which might involve simple compression and storage in a file system, analytics logs in

FortiAnalyzer undergo an indexing process. This enables advanced features such as quick search,

report generation, and detailed analysis, making it easier for administrators to gain insights into

network activities and security incidents.

Reference: FortiAnalyzer 7.2 Administrator Guide - "Log Management" and "Data Analytics" sections.

The amount of reserved disk space required by FortiAnalyzer is influenced by the disk size and the

RAID level. The system reserves a portion of the disk space for system use and unexpected quota

overflow, with the rest available for device allocation. The RAID level determines the disk size and

the reserved disk quota level, with different RAID configurations leading to variations in the reserved

space.

Reference: FortiAnalyzer 7.2 Administrator Guide, "Disk Space Allocation" and "RAID Level Impact"

sections.

In a Fortinet Security Fabric, an upstream FortiGate may create traffic logs for sessions initiated on

downstream FortiGate devices if the downstream device is unable to connect to FortiAnalyzer. This

allows for continuity of logging and ensures that session logs are captured and stored even if the

downstream device loses its connection to the log management system.

Reference: FortiAnalyzer 7.4.1 Administration Guide, "Fortinet Security Fabric" section.