Adding Fortigate cluster to Fortianalyzer

[vishal]

Hi All, Running an Fortigate 500E firmware 6.0.5 in A-A cluster. Added cluster unit fortigate in fortianalyzer running same firmware version. What I observed now that in fortianalyzer cluster list fortigate which is standby showing at position 1 and master at position 2. What can I do to make my master fortigate at position 1 in fortianalyzer cluster list. Attaching reference diagram to understand my scenerio

[ede_pfau]

I wouldn't bother too much, just as I don't care which cluster member is 'master' at each moment. Both units are registered and allowed at the FAZ as both may be active anytime.

Your situation is that - by chance - the now slave contacted FAZ first.

[vishal]

Thanks ede_pfau Would it be effect log collecting/analyzing to fortianalyzer unit. As per my understanding of fortigate is in A-A cluster only master fortigate process or handle logs as compared to slave fortigate. Correct me if I'm wrong

[ede_pfau]

That's correct but you need to worry about it. Logging at full blast is not going to affect CPU load much on a 500E. Say, fully logging traffic on every policy, estimate how many logs are sent per second. Then multiply by 100 (100 bytes per log entry) and compare that to the physical bandwidth of the interface.

For example, in some customer's LAN I see 180 logs/sec, which amounts to ~ 18 kB/sec which is nothing compared to data load. Even if logs were 100x as often as that the FGT would tackle that easily.