Fortinet FortiGate Next-Generation Firewall

SamurAI [Local] Collector	SamurAI [Cloud] Collector

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From FortiGate Next-Generation Firewall console:

• Configure Syslog Forwarding Settings
• Configure Log Settings for Each Security Feature
• Configure IPS Packet Logging
• Configure the Storage Settings
• Configure API Access Permission and Create API Key

3) If you have configured the options above, from the SamurAI Portal:

• Complete the Fortinet FortiGate Next-Generation Firewall Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Configure Syslog Forwarding Settings

Execute the CLI commands outlined in the FortiGate Next Generation Firewall documentation.

• config log syslogd4 setting

config log syslogd4 setting
   set status enable  
   set server [IP address of your Samurai Collector]
   set mode udp
   set port 514
   unset source-ip
   set format default
end

• config log syslogd4 filter

config log syslogd4 filter
   set filter [see table 1]
   set filter-type include  
end

The following table shows the value indicating the send log for each security function.

Table 1: Security Features Logs To Be Sent

Optional: Multi‑VDOM syslog configuration

If VDOMs are enabled and you require per‑VDOM logging behavior, enable syslog override in each VDOM that should send logs directly to the Samurai Local Collector.

At VDOM level, use the FortiGate CLI and documentation to:

• Enable syslog override under global settings:
  • config log setting – enable syslog-override
• Configure a VDOM‑specific syslog server:
  • Configuring syslog overrides for VDOMs

Use these options to:

• Enable syslog override for the VDOM
• Configure the syslog server (Samurai Local Collector IP and UDP/514)
• Configure the VDOM‑specific syslog filters according to your logging requirements

Configure Log Settings for Each Security Feature

Execute the CLI commands outlined in the FortiGate Next Generation Firewall documentation.

• config firewall policy

config firewall policy
   edit [Policy ID]
       ...
   set logtraffic [utm or all]
   set logtraffic-start disable
       ...
   next
end  

• config antivirus profile

config antivirus profile
   edit [Profile Name]
      ...
      set extended-log enable
      ...
   next
end

• config webfilter profile

config webfilter profile
   edit [Profile Name]
      ...
    set log-all-url disable
    set web-content-log enable
    set web-filter-activex-log enable
    set web-filter-command-block-log enable
    set web-filter-cookie-log enable
    set web-filter-applet-log enable
    set web-filter-jscript-log enable
    set web-filter-js-log enable
    set web-filter-vbs-log enable
    set web-filter-unknown-log enable
    set web-filter-refere-log enable
    set web-filter-cookie-removal-log enable
    set web-url-log enable
    set web-invalid-domain-log enable
    set web-ftgd-err-log enable
    set web-ftgd-quota-usage enable
    set extended-log enable
    set web-extended-all-action-log enable
   next  
end  

• config ips sensor

config ips sensor
   edit [Sensor Name]
      ...
     set extended-log enable
        config entries
           edit [ID]
           set location all
           set severity info low
           set protocol all
           set os all
           set application all
           set status [enable or default]
            (please refer to the table below)
           set log enable
           set log-packet disable
           set log-attack-context disable
           set action [pass or block or reset or default]
            (please refer to the table below)
            ...
           next
           edit [ID]
              set location all
              set severity medium high critical
              set protocol all
              set os all
              set application all
              set status [enable or default]
               (please refer to the table 2)
              set log enable
              set log-packet enable
              set log-attack-context disable
              set action [pass or block or reset or default]
              (please refer to the table 2)
              ...
        end
   next
end

Table 2: Matching Actions to Status

Configure IPS Packet Logging

Execute the CLI command outlined in the FortiGate Next Generation Firewall documentation.

• config ips settings

config ips settings
   set packet-log-history 5
   set packet-log-post-attack 10
   set ips-packet-quota 0
end

Configure the Storage Settings

After checking [HD logging space] with the following command, determine the size of [log-quota] with the following calculation:

[log-quota] = [Total HD logging space] / 2

[log-quota] should be rounded down to the nearest thousand. In the following example, the [log-quota] is 88000.

diagnose sys logdisk usage
Total HD usage: 236286 MB/333 MB
Total HD logging space: 177214 MB
HD logging space usage for vdom "root": 106 MB/177214 MB  

Execute the CLI command outlined in the FortiGate Next Generation Firewall documentation.

• config log disk setting

config log disk setting
   set status enable  
   set ips-archive enable  
   set max-policy-packet-capture-size 100  
   set log-quota [calculated value above,for example here, 88000]  
   set maximum-log-age 5  
   set full-first-warning-threshold 75  
   set full-second-warning-threshold 90  
   set full-final-warning-threshold 95  
   set max-log-file-size 20  
   set roll-schedule daily  
   set diskfull overwrite
   ...
end

Configure API Access Permission and Create API Key

Follow the steps outlined in the FortiGate Next Generation Firewall documentation.

• Administrator profiles

Use the following parameters when completing the deployment:

Table 3: Administrator Profile

Ensure that the administrator profile has access to the VDOMs you plan to use with SamurAI; API requests can only retrieve data from VDOMs that the API admin is permitted to access.

• Create new REST API admin

Use the following parameters when completing the deployment:

Table 4: REST API Admin

Complete the Fortinet FortiGate Next-Generation Firewall Integration

1. Login to the SamurAI Portal
2. Click Telemetry and select Integrations from the main menu
3. Click Create
4. Find and select Fortinet FortiGate Next-Generation Firewall
5. Select the relevant Local Collector and click Next
6. You will be presented with the Local Collector IP Address on the left of the screen
7. To configure Extended Telemetry Collection ensure it is enabled via the toggle
8. Enter the following information:
   • Name for the Integration - the name will appear in the SamurAI Portal for you to easily reference
   • Description - optional but if completed will appear in the SamurAI Portal for you to easily reference
   • API-Key - you generated under Create new Rest API Admin
   • Hostname/IP - hostname or IP address of Fortinet device to collect alerts from
   • Custom Port - if you have changed the default port enter the port number, if not, we default to 443
   • VDOM - optional, enter the FortiGate VDOM name if you want SamurAI to scope API calls to a specific VDOM (for example root, customer1, dmz). If left blank, SamurAI will use the API admin’s default VDOM context as defined on the FortiGate (FortiOS REST API uses the current VDOM when the vdom parameter is omitted).

Optional: Skip Packet Captures

You may choose to enable:

Skip packet captures (optional)

• Packet capture data will not be ingested
• Firewall logs and security events will continue to be analysed

9. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.