Integrate Fortinet FortiGate

You can integrate Fortinet FortiGate with Sophos Central. This lets FortiGate send firewall alerts to Sophos for analysis.

This integration uses a log collector hosted on a virtual machine (VM). Together they're called an integration appliance. The appliance receives third-party data and sends it to the Sophos Data Lake.

Key steps

The key steps in an integration are as follows:

• Add an integration for this product. In this step, you create an image of the appliance.
• Download and deploy the image on your VM. This becomes your appliance.
• Configure FortiGate to send data to the appliance.

Requirements

Appliances have system and network access requirements. To check that you meet them, see Appliance requirements.

Add an integration

To add the integration, do as follows:

1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.

2. Click Fortinet FortiGate.

   The Fortinet FortiGate page opens. You can add integrations here and see a list of any you've already added.

3. In Data Ingest (Security Alerts), click Add Configuration.

   Note

   If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See Provide your domain and IP details.

   Integration setup steps appears.

Configure the appliance

In Integration setup steps, you can configure a new appliance or use an existing one.

We assume here that you configure a new appliance. To do this, create an image as follows:

1. Enter an integration name and description.
2. Click Create new appliance.
3. Enter a name and description for the appliance.
4. Select the virtual platform. Currently we support VMware ESXi 6.7 Update 3 or later and Microsoft Hyper-V 6.0.6001.18016 (Windows Server 2016) or later.

5. Specify the IP settings for the Internet-facing network ports. This sets up the management interface for the appliance.

   • Select DHCP to assign the IP address automatically.

     Note

     If you select DHCP, you must reserve the IP address.

   • Select Manual to specify network settings.

6. Select the Syslog IP version and enter the Syslog IP address.

   You'll need this syslog IP address later, when you configure Fortigate to send data to your appliance.

7. Select a Protocol.

   You must use the same protocol when you configure Fortigate to send data to your appliance.

8. Click Save.

   We create the integration and it appears in your list.

   In the integration details, you can see the port number for the appliance. You'll need this later when you configure Fortigate to send data to it.

   It might take a few minutes for the appliance image to be ready.

Deploy the appliance

Use the image to deploy the appliance as follows:

1. In the list of integrations, in Actions, click the download action for your platform, for example Download OVA for ESXi.
2. When the image download finishes, deploy it on your VM. See Deploy appliances.

Configure FortiGate

Now you configure FortiGate to send alerts to the Sophos appliance on the VM.

Configure Fortigate as follows:

1. Sign into the command-line interface (CLI).

2. Enter the following commands to turn on syslog forwarding and send data to your appliance. Ensure you use the correct commands for your FortiGate version.

   FortiGate 7 and laterFortiGate 6 and earlier

   config log syslogd setting
   set status enable
   set facility user
   set port <port number of your appliance>
   set server <syslog IP address of your appliance>
   set mode udp
   set format cef
   end
   

   config log syslogd setting
   set status enable
   set facility user
   set port [port number of your appliance]
   set server [syslog IP address of your appliance]
   set format cef
   set reliable disable
   end
   

Your FortiGate alerts should now appear in the Sophos Data Lake after validation.

Customize alerts

Most FortiGate features are logged by default.

To make sure the Traffic, Web and URL Filtering features are logged, enter the following commands. Ensure you use the correct commands for your FortiGate version.

config log syslogd filter
set severity warning
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
end

config log syslogd filter
set traffic enable
set web enable
set url-filter enable
end

FortiGate 5.4 and later can also log referrer URLs. A referrer URL is the address of the web page where a user clicked a link to go to the current page. This is useful for web usage analysis.

To turn on referrer URL logging for each web profile, do as follows:

config webfilter profile
edit [Name of your profile]
set log-all-url enable
set web-filter-referer-log enable
end

More resources

This video takes you through setting up the integration.

For more information on logging to a remote syslog server, see Fortinet’s Logging and Reporting Guide.