Setting up Fortinet FortiGate Firewall Collector

To set up Fortinet FortiGate Firewall Collector, do the following procedures, below:

• Enable Fortinet FortiGate Firewall Collector
• Install the XDR Collector
• Configure the firewall
• Open the port on the XDR Collector Host

Enable Fortinet FortiGate Firewall Collector

1. In Barracuda XDR Dashboard, navigate to Administration >  Integrations.
2. On the Fortinet FortiGate Firewall Collector card, click Setup.
   
3. Select the Enable check box.
   
4. Click Save.

Install the XDR Collector

• If you haven't already set up the XDR Collector, do one of the following:
  • Setting up the XDR Collector for Windows
  • Setting up the XDR Collector for Linux

Configuring the Firewall

• Log into the FortiGate command line and run the command below, where <X.X.X.X> is the IP address of the Collector:
  config log syslogd setting
set status enable
set server <X.X.X.X>
set mode udp
set port 9202
set facility local7
end

Open the Port on the XDR Collector Host

Ensure incoming traffic is allowed on UDP port 9202.

Linux

sudo ufw allow 9202/udp

Windows

netsh advfirewall firewall add rule name="Fortinet FortiGate Firewall Events" dir=in action=allow protocol=UDP localport=9202