In scenarios where all your FortiGate deployment logs are centralized within a FortiAnalyzer, you can use it to accelerate the deployment of Lumu and forward all firewall logs at once using the FortiAnalyzer data collection capabilities from Lumu. The Lumu Virtual Appliance (VA) offers the option to create Collectors, a seamless way to integrate with network metadata of your entire enterprise and forward it to the Lumu cloud with the lowest impact on the network operation. 

In cases where the attacks avoid domain resolution, the traces of adversarial contact can lie in the access logs of firewalls. This option is also available for accommodating networks where DNS configuration is not possible. In this scenario, the firewall forwards the logs to Lumu’s VA for processing traffic. If the firewall has URL filtering enabled, and the URLs can be included in the logs, all the IT assets using the firewall would be monitored. This approach ensures compromise visibility without having to make major changes.

In this guide, we provide you with instructions and resources on how to configure FortiAnalyzer to forward all Firewall logs to Lumu through Virtual Appliance.

Requirements

• FortiAnalyzer version 7.00+.
• Have admin access to create a new Forwarding configuration.
• Have the most recent version of the Lumu Virtual Appliance installed.

These are the general steps you should follow to configure a syslog server on a FortiGate to send all metadata to Lumu:

Deploy and Set Up Lumu VA

All the detailed steps and guidance to create, download and install a virtual appliance on your preferred hypervisor or Cloud solution are available in our documentation:

• Deploy Virtual Appliances
  
• Configure Virtual Appliances and set up collector
  

Set up a Lumu VA Firewall Log Collector

Go to the Lumu Virtual Appliance and refresh the VA Collectors settings by running the command lumu-appliance collectors refresh . If the appliance is running, it should be stopped for setting up collectors.

Select the option that refers to FortiGate and the format that suits you best, then inform the following data:

• Protocol type: you can select between TCP and UDP according to your infrastructure and your FortiGate’s settings.
• Port number: provide a number between 1024 and 65535, inclusive.
• Timezone: The timezone for setting up the VA. Use the canonical ID (e.g. America/Chicago). You can use this external article for reference.

Configure FortiAnalyzer to Send Metadata to Lumu VA

You can add up to 5 forwarding configurations in FortiAnalyzer. To add a new configuration, follow these steps on the GUI: