Deployment and System Configuration
Deployment and System Configuration is the foundation domain: it tests whether you can design a FortiAnalyzer 7.4 deployment, partition it with ADOMs, register devices correctly, and put HA and system services in place before troubleshooting logs. Questions often present a topology or a registration failure and ask for the first correct action.
Deployment roles
- Standalone FortiAnalyzer collects, stores, analyzes, and reports on logs.
- Collector mode receives logs and forwards them to an analyzer; it is useful when a remote site has limited WAN bandwidth or when you want centralized analysis. The collector is not the reporting tier.
- Analyzer mode stores logs and serves FortiView, reports, and event handling.
- Virtual appliances are licensed by daily log volume and device count; verify capacity before registering devices.
ADOMs
ADOMs separate devices, logs, reports, event handlers, and administrators. Enable ADOMs in System Settings before creating them. The ADOM firmware version must match the managed device's firmware, or parsing and FortiView will be incomplete. Use Normal mode for log-collecting ADOMs; Backup mode is for configuration backup and does not collect logs. The root ADOM is the default and should not be used as a dumping ground for production devices.
Device registration and HA
Register a FortiGate by serial number or IP, then authorize it from the FortiGate side if required. A FortiGate HA cluster should appear as one logical device. FortiAnalyzer HA uses a primary/secondary pair with heartbeat and configuration synchronization; both nodes need matching firmware and model, and log sources should point at the HA virtual IP.
System services
Configure interfaces, routes, DNS, NTP, admin authentication, mail server, SNMP, and syslog forwarding. NTP matters because log timestamps, report periods, and event windows depend on it.
Worked example
A branch FortiGate must send logs to HQ over a slow link. Put a collector at the branch and an analyzer at HQ. Create an ADOM on both nodes with the FortiGate's firmware version. Register the FortiGate in that ADOM on the collector, point the FortiGate's log fortianalyzer setting at the collector, and configure collector forwarding to the analyzer. Reasoning: collection is local, analysis and retention are centralized, and the matching ADOM version prevents parsing errors.
Traps
- Registering a device before creating the correct ADOM.
- Mixing firmware versions between device and ADOM.
- Expecting a Backup-mode ADOM to hold traffic logs.
- Building HA with mismatched firmware or unconfigured heartbeat interfaces.
- Skipping NTP and then misreading event and report time windows.