When configuring a FortiAnalyzer to act as a collector device, which two steps must you perform? (Choose two.)

Understanding FortiAnalyzer Roles:

FortiAnalyzer can operate in two primary modes: collector mode and analyzer mode.

Collector Mode: Gathers logs from various devices and forwards them to another FortiAnalyzer

operating in analyzer mode for detailed analysis.

Analyzer Mode: Provides detailed log analysis, reporting, and incident management.

Steps to Configure FortiAnalyzer as a Collector Device:

A . Enable Log Compression:

While enabling log compression can help save storage space, it is not a mandatory step specifically

required for configuring FortiAnalyzer in collector mode.

Not selected as it is optional and not directly related to the collector configuration process.

B . Configure Log Forwarding to a FortiAnalyzer in Analyzer Mode:

Essential for ensuring that logs collected by the collector FortiAnalyzer are sent to the analyzer

FortiAnalyzer for detailed processing.

Selected as it is a critical step in configuring a FortiAnalyzer as a collector device.

Step 1: Access the FortiAnalyzer interface and navigate to log forwarding settings.

Step 2: Configure log forwarding by specifying the IP address and necessary credentials of the

FortiAnalyzer in analyzer mode.

Reference: Fortinet Documentation on Log Forwarding FortiAnalyzer Log Forwarding

C . Configure the Data Policy to Focus on Archiving:

Data policy configuration typically relates to how logs are stored and managed within FortiAnalyzer,

focusing on archiving may not be specifically required for a collector device setup.

Not selected as it is not a necessary step for configuring the collector mode.

D . Configure Fabric Authorization on the Connecting Interface:

Necessary to ensure secure and authenticated communication between FortiAnalyzer devices within

the Security Fabric.

Selected as it is essential for secure integration and communication.

Step 1: Access the FortiAnalyzer interface and navigate to the Fabric authorization settings.

Step 2: Enable Fabric authorization on the interface used for connecting to other Fortinet devices and

FortiAnalyzers.

Reference: Fortinet Documentation on Fabric Authorization FortiAnalyzer Fabric Authorization

Implementation Summary:

Configure log forwarding to ensure logs collected are sent to the analyzer.

Enable Fabric authorization to ensure secure communication and integration within the Security

Fabric.

Conclusion:

Configuring log forwarding and Fabric authorization are key steps in setting up a FortiAnalyzer as a

collector device to ensure proper log collection and forwarding for analysis.

Reference:

Fortinet Documentation on FortiAnalyzer Roles and Configurations FortiAnalyzer Administration

Guide

By configuring log forwarding to a FortiAnalyzer in analyzer mode and enabling Fabric authorization

on the connecting interface, you can ensure proper setup of FortiAnalyzer as a collector device.