{"id":96036,"date":"2020-10-07T01:42:11","date_gmt":"2020-10-06T23:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/2-fortianalyzer-getting-started-v6-4-podgotovka-maketa"},"modified":"2020-10-07T01:42:11","modified_gmt":"2020-10-06T23:42:11","slug":"2-fortianalyzer-getting-started-v6-4-podgotovka-maketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/2-fortianalyzer-getting-started-v6-4-podgotovka-maketa","title":{"rendered":"2. FortiAnalyzer Getting Started v6.4. Preparing the template","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"2.
\n
\nWelcome to the second lesson of the course FortiAnalyzer Getting Started<\/a><\/noindex>. Today we will discuss the mechanism of administrative domains on FortiAnalyzer<\/a><\/noindex>, and we will also review the log processing\u2014understanding the principles of these mechanisms is essential for initial setup FortiAnalyzer<\/a><\/noindex>. After that, we will discuss the layout we will be using throughout the course and perform an initial configuration FortiAnalyzer<\/a><\/noindex>. The theoretical part and the full video recording of the lesson can be found below. <\/a><\/noindex><\/p>\n

To start, let's revisit administrative domains. There are a few key points you should know about them before you start using: <\/p>\n

    \n
  1. The ability to create administrative domains is enabled and disabled centrally.<\/li>\n
  2. For the registration of any devices other than FortiGate, a separate administrative domain is required. That means, if you want to register multiple FortiMail devices on one device, you need a separate administrative domain for that. However, this does not preclude the ability to create various administrative domains for the convenience of grouping FortiGate devices. <\/li>\n
  3. The maximum number of supported administrative domains depends on the model of the FortiAnalyzer device. <\/li>\n
  4. When enabling the ability to create administrative domains, you must select their operation mode\u2014Normal or Advanced. In Normal mode, you cannot add various virtual domains (or VDOMs) of one FortiGate to different administrative domains of the FortiAnalyzer device. In Advanced mode, this is possible. The Advanced mode allows the processing of data from various virtual domains and obtaining separate reporting for them. If you've forgotten what virtual domains are, please refer to the second lesson of the Fortinet Getting Started course<\/a><\/noindex>, where this is explained in detail. <\/li>\n<\/ol>\n

    \nWe will look at the creation of administrative domains and the allocation of resources between them a bit later in the practical part of the lesson. <\/p>\n

    Now let's talk about the mechanism of logging and processing logs that come to the FortiAnalyzer.
    \nLogs received by FortiAnalyzer are compressed and saved in a log file. When this file reaches a certain size, it is overwritten and archived. These logs are referred to as archived logs. They are considered offline logs, as they cannot be analyzed in real time. They are only available in raw format for viewing. The data retention policy in the administrative domain defines how long these logs will be stored in the device's memory.
    \nAt the same time, the logs are indexed in an SQL database. These logs are used for data analysis through the Log View, FortiView, and Reports mechanisms. The data retention policy in the administrative domain determines how long these logs will be stored in the device's memory. After the logs are deleted from the device's memory, they may remain as archived logs, but this depends on the data retention policy in the administrative domain. <\/p>\n

    For understanding the initial settings of this knowledge, we have enough information. Now let's discuss our layout:<\/p>\n

    \"2.
    \n
    \nHere you see 6 devices \u2013 FortiGate, FortiMail, FortiAnalyzer, domain controller, external user computer, and internal user computer. FortiGate and FortiMail are used to generate logs from various Fortinet devices, allowing us to examine aspects of working with different administrative domains. The internal and external users, as well as the domain controller, are necessary for generating different traffic. The internal user computer has Windows OS installed, while the external user computer runs Kali Linux.
    \nIn this example, FortiMail operates in Server mode, meaning it is a separate mail server through which internal and external users can exchange emails. Necessary settings, such as MX records, are configured on the domain controller. For the external user, the DNS server is the internal domain controller \u2013 this is achieved through port forwarding (or using the Virtual IP technology) on FortiGate.
    \nThese settings are not covered in this lesson, as they are not related to the course topic. We will discuss the deployment and initial configuration of the FortiAnalyzer device. The other components of the current layout have been prepared in advance. <\/p>\n

    The system requirements for various devices are provided below. I have this layout running on a pre-prepared machine in a virtual environment using VMWare Workstation. The specifications of this machine are also listed below. <\/p>\n

    The device
    \nRAM, GB
    \nvCPU
    \nHDD, GB<\/p>\n

    Domain Controller
    \n6
    \n3
    \n40<\/p>\n

    Internal User
    \n4
    \n2
    \n32<\/p>\n

    External User
    \n2
    \n2
    \n8<\/p>\n

    FortiGate
    \n2
    \n2
    \n30<\/p>\n

    FortiAnalyzer
    \n8
    \n4
    \n80<\/p>\n

    FortiMail
    \n2
    \n4
    \n50<\/p>\n

    Machine for the Layout
    \n28
    \n19
    \n280<\/p>\n

    The system requirements outlined in this table are the minimum \u2014 typically, more resources are needed under real conditions. Additional information on system requirements can be found on this website<\/a><\/noindex>. <\/p>\n

    The video tutorial includes the theoretical material discussed above, as well as the practical part \u2014 with the initial configuration of the FortiAnalyzer device. Enjoy watching!<\/p>\n

    \r\n \"Play\r\n
    <\/div>\r\n <\/div><\/center>
    \nIn the next lesson, we will examine the aspects of working with logs in detail. To not miss it, subscribe to our     YouTube channel<\/a><\/noindex>.<\/p>\n

    You can also follow updates on the following resources:<\/p>\n

    VK Group<\/a><\/noindex>
    \n    Yandex Zen <\/a><\/noindex>
    \n    Our website<\/a><\/noindex>
    \n    Telegram channel<\/a><\/noindex>
    \n
    Source:     habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u043c \u043d\u0430 \u0432\u0442\u043e\u0440\u043e\u043c \u0443\u0440\u043e\u043a\u0435 \u043a\u0443\u0440\u0441\u0430 FortiAnalyzer Getting Started. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043f\u0440\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u043d\u0430 FortiAnalyzer, \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u0441\u0443\u0434\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043b\u043e\u0433\u043e\u0432 \u2014 \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u043e\u0432 \u0440\u0430\u0431\u043e\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a FortiAnalyzer. \u0418 \u043f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043c\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u043c \u043c\u0430\u043a\u0435\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u0445\u043e\u0434\u0435 \u043a\u0443\u0440\u0441\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043c \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e FortiAnalyzer. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0447\u0430\u0441\u0442\u044c, \u0430 \u0442\u0430\u043a\u0436\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96037,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96036","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd472. FortiAnalyzer Getting Started v6.4. Layout Preparation | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/2-fortianalyzer-getting-started-v6-4-podgotovka-maketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd472. FortiAnalyzer Getting Started v6.4. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 \u043c\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/2-fortianalyzer-getting-started-v6-4-podgotovka-maketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-06T23:42:11+00:00","article:modified_time":"2020-10-06T23:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96036","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:52:25","updated":"2022-10-03 07:29:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/96036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=96036"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/96036\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/96037"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=96036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=96036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=96036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}