Send Logs to FortiAnalyzer through IPSEC Tunnel
Confirmed 7/20/2026
Problem
How to successfully send logs from FortiGate to FortiAnalyzer when the FortiAnalyzer is reachable through IPSEC Tunnel
Symptoms
Logs do not arrive at the FortiAnalyzer although it is configured on the FortiGate
Environment
FortiGate
FortiOS version
All Versions
Root Cause
The tunnel interface has no ip address so that by default the public IP of the WAN interface will be used as source address of the connection.
Solution
a source ip must be set when sending logs to FortiAnalyzer. In FortiGate under FortiAnalyzer log setting, it is possible to specify the outgoing interface via 3 methods. auto <----- Set outgoing interface automatically.
sdwan <----- Set outgoing interface by SD-WAN or policy routing rules.
specify <----- Set outgoing interface manually.
The reliable method to have connectivity via IPsec Tunnel can be achieved by specifying outgoing interface as tunnel interface manually.
This Configuration is only supported by CLI.
config log fortianalyzer setting set status enable set server 'FAZ IP' set interface-select-method specify set interface 'Tunnel interface' set source-ip 'FGT ip' set upload-option realtime set reliable enable
The source IP should be the IP of one of the internal interfaces of FortiGate and be allowed in the IPSec phase 2 selector of the tunnel that connects to the FortiAnalyzer and allowed through firewall policy.
Verification
FortiGate can be authorized now in FortiAnalyzer and logs begin to show up.
Rollback
to roll back run the following command to disable fortianalyzer log settings: config log fortianalyzer setting set status disable
Tags
No tags yet.
Community rating
— / 5 (0)