How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

The "Trusted Hosts" feature in FortiAnalyzer is specifically designed to enhance security by restricting administrative access. When configuring an administrator account, you can specify up to ten trusted host IP addresses or subnets. If configured, FortiAnalyzer will only permit login attempts for that administrator account if they originate from one of the specified IP addresses. This directly addresses the requirement to allow logins from only specific locations, effectively limiting the management attack surface.

A. Use static routes: Static routes are used to define paths for network traffic and do not control administrative access based on the source IP address.

B. Use administrative profiles: Administrative profiles define the permissions an administrator has after logging in (e.g., read-only or read-write access), not the locations from which they can log in.

D. Use secure protocols: Secure protocols like HTTPS and SSH encrypt the management session but do not restrict the source IP address of the connection.

1. FortiAnalyzer Administration Guide 7.4

"System Settings > Admin > Administrators > Creating administrators".

The guide states: "You can configure trusted hosts for an administrator to restrict the IP addresses that the administrator can log in from. You can configure up to ten trusted hosts for each administrator. The trusted hosts can be a specific IP address or a subnet." This directly confirms that Trusted Hosts is the correct feature for this purpose.