Understand FortiAnalyzer Key Concepts

0:00Hello and welcome. My name is Keith Barker and in this set of videos we're going to take a look at the basic concepts and fundamentals. We've got this wonderful tool called "40 Analyzer from Fordnet".

0:00So as we begin our discussion of the beautiful tool called 40 Analyzer, let's also take a minute and let me review this topology with you which we'll be using throughout this course. So here I've got four firewalls or 440 gates. I've got one called HQ firewall one right here . I've got one called HQ firewall two right here one called HQ firewall three right there. And over here I have a branch firewall and it also has an HA pair which I think at the moment maybe offline but in any case I've got a firewall here at the branch office as well. Now for instructions on how to configure the 40 gates themselves and configure them and their policies. We have separate content here at CBT nuggets on that topic as well. And as we continue together in this 40 analyzer course we're going to be focusing on the integration of the use of this tool right here called 40 Analyzer. So let's begin with the purpose. Why would we even want to have this device called 40 Analyzer? Well one of the main benefits of having a 40 Analyzer it can act as a central clearing house for all of our log information coming from not just 40 gate firewalls but also lots of different for net devices. So we're all right out centralized logs and that way you and I we can log in to 40 Analyzer and they'll have those logs from all of our devices. So we have a single pane of glass where we can look at and analyze and do investigations regarding all the log messages coming from our

1:16for net devices. Now in order to get those logs from these devices over to the 40 Analyzer we're going to do a couple things. Number one we're going to register our devices for example firewall two firewall three firewall one the branch firewall will register all those with the 40 Analyzer and that way not just any device can go ahead and send logs they'll have to be registered where the 40 Analyzer is accepting those log messages and then at the 40 Analyzer it can buffer and organize and keep all that information regarding the logs and then what we can do so this is us right here. Us as administrators can then go ahead and log in to 40 Analyzer to do the investigation we can view and search the logs we can drill down into the details and also create reports instead of automated reports regarding what's happening in our environment. And one of the major benefits of having all that data right here is that we can then correlate different events that are happening across different devices to help identify what's really happening on the network. For example do we have a virus or some malware or some other activity where it's being seen by multiple devices we can then collect all that and analyze it right here at the 40 Analyzer. So the types of information logs that we're going to have here are going to include things such as security events things like malware showing up or denial of service attacks or some other intrusion prevention related activities as well as system events for example configurations being changed on our devices or who logged on who logged off as well as traffic logs all of that can be contained here at the 40

2:35Analyzer. Now behind the scenes the 40 Analyzer is going to use a structured query language database and that's spelled SQL and you can either spell it out like that SQL or it can say SQL and SQL stands for structured query language. So behind the scenes 40 Analyzer is taking all that data coming in putting into this database the SQL database and then when you and I connect to and log into the 40 Analyzer it can present that information in nice easy format for us including generating reports but again behind the scenes it was using SQL and that type of database to keep track and organize everything. And there's many different types of SQL databases and on the 40 Analyzer the one they use is right here. So a person doesn't have to be an expert at SQL however for some of the advanced reporting capabilities if you're familiar with SQL and how it works it would be easier to generate some of those reports. So make the notice a little bit and let's talk about a few other benefits and functions of 40 Analyzer. So let me go ahead and clean this up a little bit and let's chat about some of the other fundamentals regarding 40 Analyzer. There's two different operating modes that a 40 Analyzer can operate in and the default one is Analyzer and when the 40 Analyzer is in Analyzer mode it's going to act just as we discussed where we have different devices that have registered with that 40 Analyzer. All that log and event information is being sent over and then you and I log into the 40 Analyzer to see all the details. So with Analyzer mode

3:51devices are sending their logs directly to the 40 Analyzer. Now the other mode is called collector mode and think of a 40 Analyzer in collector mode is like being a middleman. So let's imagine we have a 40 gate firewall here that's forwarding its logs over to a collector really it's a 40 Analyzer that's in collector mode so I'll put FAZ here in collector mode and then the collector can then forward those over to another 40 Analyzer that's operating in Analyzer mode and it's really simple to flip the switch to tell the 40 Analyzer to be in collector mode or Analyzer mode and in small environments we're going to just skip the middleman and have our 40 gates and other 4-net devices send their information directly to the 40 Analyzer but in a bigger environment with wide area networking as possible we may want to use multiple collectors who then forward it to our 40 Analyzers and if so that would be the hierarchy right here. 40 gates and other 4-net devices sending them to the collector and then the collectors forwarding them to the 40 Analyzer. Now one thing to be aware of regarding a 40 Analyzer in collector mode is that we cannot at that device generate your ports and dig into the details we can only do that in a 40 Analyzer that set up in Analyzer mode. Now another aspect that we want to be aware of is a really cool feature inside of 4-net with 40 gates called a security fabric . So let's imagine that this firewall firewall 1 and firewall 2 and firewall 3 are all part of the

5:10same security fabric. Now in the security fabric let's also imagine that all three are sending their login information over to the 40 Analyzer. Now if this Windows computer right here or this PC right here has some event that happens and that traffic is for example going out to the public internet that traffic would go through firewall 2 and through firewall 1 and one would think well we're going to have duplicate logs but fortunately on the 40 Analyzer if we have this 40 gate security fabric here the 40 Analyzer realizes those are all part of the same security fabric and it's going to help reduce the duplicates regarding the logging. Also not every firewall has the same rules some firewalls may be focused on denial of service attacks other firewalls may be focused on authentication and network address translation. So the cool thing is because the 40 Analyzer is also from 4-net it understands the security fabric it's going to help reduce duplicate log messages if it's showing the same information and that way of the best of both worlds we can get the logs and security events regarding traffic that's going through and we don't have to worry about a bunch of duplicate logs regarding the exact same traffic flow or the exact same events.

6:14And while we're talking about fabric let's also chat about another concept regarding fabric but this time regarding 40 Analyzer and a 40 Analyzer fabric. So let me clean up some of this right here and let's talk about 40 Analyzer fabric. So let's imagine we have several 40 Analyzers in our Enterprise we'll call this FAS 1 and what this is FAS 2 and over here FAS 3 and let's imagine these are all in Analyzer mode and just for grins let's also throw in FAS E4 which is going to be in collector mode. So we can have some devices that are affording their logs and event information to FAS 4 as a collector who can then forward it to for example FAS 2 we're going to have other devices that are forwarding directly to FAS 3 and then FAS 2 and FAS 3 even though they 're an analyzer mode can still forward their logs over to FAS 1. If we've set up the 40 Analy zer fabric and here's how it would work we would configure FAS 1 here as a supervisor as part of the fabric which is kind of equivalent to a root of the security fabric with 40 gates so in the 40 Analy zer fabric we'd have one the second as a supervisor and then these two could behave as members which allows them to forward logs information to the supervisor and then 40 Analyzer 4 which is not an analyzer mode because in collector mode it can't actually become part of the fabric it's just

7:30forwarding information to the 40 Analyzer it was told to. So the 40 Analyzer fabric let me go ahead and put this in blue would be this part right here with the members forwarding to the supervisor and then a 40 Analyzer operating in collector mode would not become part of that fabric although it'd be forwarding to one of the members in that fabric. So as far as what we've covered so far in this overview we have the 40 gate security fabric which the 40 Analyzer can sort out and reduce duplicate events we also have the 40 Analyzer fabric which if we have multiple 40 Analyzers one would be supervisor and the other would be members in Analyzer mode so that 's an example of the 40 Analyzer fabric. Another concept I'd like to share with you in this overview is the concept of administrative domains or ADOMS for short. Now in the 40 gates we have something called V-DOMS where we logically segment a firewall into multiple logical sub-firewalls if you will and with 40 Analyzer we can set up 8 ADOMS administrative domains for the benefit of being able to give permissions to administrators to analyze and work with parts of the topology.

8:32So by setting up administrative domains we can have 140 Analyzer for example that's getting logs from all four of our firewalls but perhaps we have one administrative domain for these three firewalls at the head corridor location and we have a separate administrative domain regarding the branch firewall and that way different administrators could have different access and permissions as they interact with the 40 Analyzer depending on which administrative domain they've been given access and privileges to. And one other aspect that's really important when bringing up a new 40 Analyzer is understanding our options for connecting to it and the two major options are connecting via the command line interface or we could use the GUI and we think of the GUI like a browser using a browser to connect to the 40 Analyzer to do our work and at the 40 Analyzer we can specify via permissions exactly what is allowed regarding connecting to it. So for the CLI we can able things like SSH and for the GUI we can have HTTPS we also could allow HTTP although that's insecure because it's not encrypted and then for the CLI once we're at the GUI we also have an option from the GUI from the browser interface when we're working with the 40 Analyzer to go ahead and click a button to get a CLI to the 40 Analyzer should we need to issue command line interface commands. So as we go through this content together I'll give you examples of working with these options including options

9:48regarding how to connect to the 40 Analyzer.

0:00In this video, I'd like to do a couple just quick tests regarding the network topology and also walk you through access to the 40 Analyzer. Now, the 40 Analyzer itself can be deployed as an appliance or it can be deployed as a virtual machine. There's platforms as far as virtual machines are concerned for Microsoft and for VMware and others. And in my environment, in my lab environment, I've deployed this on an ESXi host. That's a host running VMware's virtualization software. And for its management interface, I put it on my management network, which is 192.168.1.0 with the slash 24. And it's IP address I gave it is .81. However, the challenge is that when you get a brand new 40 Analyzer, it's very likely not going to have the IP address that you want it to have.

0:46Also, that 40 Analyzer is probably not going to have the correct default gateway information. It may have the default DNS servers to use, which would be fine. But to get it up and running and connected up to the cloud to Fortinet so it can get licensed and validated, it's going to need to have a workable IP address with a gateway in the case of a private RFC 19 address like this. It's going to need to have NAT as well, network address translation. And also, as I mentioned, it needs DNS. It can do name resolution to connect to home to connect up to the Fortinet servers.

1:17So what I would like to do is I would like to go ahead and show you this 40 Analyzer that I have where it's currently being deployed in VMware. And then I'd like to also walk you through how we can see from the command line interface what the IP address is and also what the gateway is and the DNS information is. And that way, we can change it should we need to and we will, especially the default gateway so that we can have this 40 Analyzer connect out to the public Internet. So I'm going to use a terminal emulator called secure CRT. And I have an entry right here that's going to use SSH to connect to 192.168.1.81, which is the 40 Analyzer I have set up in my lab environment. I also through scripting told it to submit the username and password, which is admin with the password I'm using on this device. So the first thing I did is I configured port one as part of the interfaces and gave it the IP address I needed in my environment . So to do that, I did a config system interface. I then typed in edit port one. That's the first logical network interface on this virtual machine, the 40 Analyzer. And then here I'm just going to show you the current configuration that I have, which is for port one, the IP address is set to this address ending in dot 81 on my management network. I've also set allow access for ping, HTTPS SSH and HTTP.

2:33But you know what, I really don't need HTTP. So let me go ahead and take that off. I'll do an edit port one. Oh, I'm already in port one. So I'm going to go ahead and do a set allow access for ping HTTPS and SSH only. So I'll copy and paste that press enter. And then we 'll do a show just to make sure that took because I don't need HTTP. I'm going to use just HTTPS for the GUI. So the default IP address on most fortunate devices is going to be 192, once state 1. 99. And so in my topology, I wanted to be 81. And that's why I said it here. So let me go ahead and clear the screen.

3:04The next thing I chose to do, which I didn't have to because the defaults were going to be fine is I specified DNS using 8888. And that's Google. And the secondary is from Cloud flare. But you could just take the defaults and that would work. And then finally, I also set up my routing. So in my environment, my default gateway for my management network going out to the public internet is 192 once state 1.1. So I set up the routing to tell it specifically the correct default gateway to use. Because if you don't have a default route, the 40 analyzer can't get off the local network and won't be able to reach out to the cloud for getting the license validated. Also , my experience has been with the 40 analyzer. If you haven't deployed a 40 analyzer yet and you want to download it, there's an option for a trial license. I think it's good for some period of days where you can work with it and play with it just to get comfortable with it as well. That would require setting up an account up at Fortinet and then downloading the software and then deploying it and then choosing the option for using a trial license. So for my 40 analyzer, if I use the command GetSystemStatus, I added some licenses to it so I could demonstrate the things I needed to. And currently I'm using version 474, which is a mature version. There was also an option of using a feature version, but sometimes those have bugs. It's also specifying here the maximum number of

4:22administrative domains we can set up as five and it also shows here that the current license is valid. So if we confirm the IP address once again, it's 192.168.1.81. Let's go ahead and open up a browser for my management computer and connect to it via GUI. So that's what I've done right here. I'm in fullscreen mode, so I connected to https colon slash 192.168.1.81. And I'm going to specify the using a password I have for this device, which is admin and then my lab password and click on login. I also took a moment to chose this cute cat background for it and that's optional as well.

4:55You don't have to you can take the default. It works just as well. So I'll click on login and here we are directly connected to the 40 analyzer interface. So just to confirm the two options for connecting initially to the 40 analyzer would be through the CLI, which may be through a console cable. If you're going to a physical device or through VMware or Hyper-V, it could be a console provided by that virtualized environment. And then once you have the IP address all set up the way you need to and the default gateway setup, we could then go ahead and connect to be a browser to connect to the device. Also, from the GUI here we could verify our settings. So if we get on the system settings and go down to network, this would confirm for us our IP address on port one that I'm currently using and also our DNS information is shown right here as well. If we scroll down here's our default route as well.

5:42But once again to get the initial connectivity to the internet and to connect to this device, we'd want to go to the command line interface and specify the IP address as well as the default gateway so that device can be registered.

0:00So now that we have the 40 Analyzer verified, it's reachable by our management computer. Let me walk you through how we can add individual devices like 40 gate firew alls to send their logging information and event information over to the 40 Analyzer. So at the moment, I currently have firewall one and also the branch firewall here, both setting their log information over to the 40 Analyzer. But what isn't happening is I don't have firewall two or firewall three yet setting their log information over. So it's really simple to both tell these firewalls to send the logs. It's also very simple to sell the 40 Analyzer to welcome those incoming logs. So let's demonstrate that right now. So this is the 40 Analyzer and currently to see who is sending logs to this device, we go to device manager. And with device manager selected, it's showing us that we have hg firewall one, and also this device over at dot 71 on my management network, which is the branch firewall that's saying it over as well. And because this firewall right here is part of a h a cluster. That's why it's showing up with this name right here cluster one fgd 60 f also I thought it'd be interesting to go ahead and have firewall one here with a feature release seven six and the firewall over at the branch office is currently 748, which is the as of this recording, one of the more mature versions available for the 40 us. So

1:17again, what's not here is firewall two and firewall three. And just to confirm where they are on the topology firewall two is right here. And firewall three is right here. And my 192 168 one management network is consistent across the rest. So firewall two ends in dot 52 for its management interface, firewall three ends in dot 53. So with that in mind, let's go over to firewall two and firewall three and tell them to start sending their logs over to the 40 analyzer. So here is firewall two just at the top left there shows us the actual name at hq firewall two. And now to tell this firewall firewall to to start sending log and event messages over to the 40 analyzer, we 're going to go down to security fabric, and then we're going to click on external connectors.

1:55So here on firewall two, we're going to go down to security fabric and click on fabric connectors. And here for logging and analytics, currently, we're not logging to a 40 analyzer. So we'll click here, then click on edit, and then specify for 40 analyzer, we want to enable logging, and then we 'll specify where we're going to log to, and we'll put in the IP address that's reachable on our measurement network, which is 192 dot 168 dot 1 dot 81. And then let's go ahead and say real time uploads. And that way, when something happens at this 40 gate regarding logs and events, it can immediately send them over. And then we'll click on, okay, 40 analyzer needs to approve and authorize the inbound messages from firewall two. So that's an additional step that needs to happen as well. So we'll take care of that as well. So I'll click on accept here. And let's go on to firewall three and tell it also to start sending log information over to the 40 analyzer. So here we are at firewall three. I did slightly change the color coding here. So that's easy to recognize it's a different firewall.

2:51So we're on firewall three. Once again, we go down to security fabric, and then we go to fabric connectors. And then here in the section called logging and analytics, we'll go ahead and click on that, and then click on edit, and then specify one to enable 40 analyzer logging, and then specify the IP address of our 40 analyzer, which is 192.168.1.81. And let's also do real time there as well, and click on okay. And then once again, before this allowed to actually send the logs, we need to authorize that over at the 40 analyzer. So click on accept there, and then we 'll go to the 40 analyzer and say, Hey, you know, these two firewalls firewall two and firewall three, they both would like to log to is that okay? And once the 40 analyzer says yes, then firewall two and firewall three can start forwarding their logs. So back to the 40 analyzer, we go and here under device manager, you'll notice we have two firewalls that are authorized logging devices. And then we have couple here that are unauthorized. So if we click on that, it's going to show us those two firewalls.

3:47That's firewall two and firewall three. So we just click on both of them to select them, and then click on authorize. And it's asking us to confirm also right here, if we had set up multiple administrative domains, we could actually associate these firewalls with a specific administrative domain. So I'm going to put these in the root domain effectively , we're not using multiple adams yet, and we'll click on okay, so it's doing the device authorization, and that may take a moment or two. So we'll click on close, it's now starting to up and two down. But here in a moment firewall two and firewall three should show up as well. So we'll give that a moment to go ahead and settle. Meanwhile, let's go take a look at firewall two and firewall three. So here's firewall two, it still says unauthorized. So let's go ahead and refresh this page by just bouncing off and coming back to it. And the 40 analyzer hasn't finished its work yet. So let's also verify on firewall three. And there we go firewall three doesn't show a problem, which is 40 analyzer connected fantastic. Let's go back to firewall two. So back at firewall two, sure enough, we are now showing connected there. And if we go back to the 40 analyzer and do a refresh there, it shows three up one down. But I imagine here for way just a moment or two, it should show us that we have four out of four up. So let me go ahead and click on device manager again. And sure enough, we have four out of four up and reporting. So all the logs now from these four 48 firew alls are being sent

5:02over to 40 analyzer. So as the test here's what I propose we do, let's go to PC two. And let's go ahead and forward some traffic out to the internet. And that information regarding PC two should be sent over to 40 analyzer. Also be aware that at the moment firewall two firewall three and firewall one are not part of the same security fabric. So until we have that set up, we may have some duplicate logs as well. So let's go to PC two and send some traffic out to the internet. So here is PC two, let me go ahead and open up a browser. And on one of the two firewalls, and it's going to be either firewall two or firewall one, they're requiring authentication. So open the network login page, then we'll log on is ad dash user dash two, I'll put in the password for that user, and then we'll click on continue. Fantastic. And let's go to for net.com. So I'll close that browser. So that traffic should be logged here on firewall two and also here at firewall one, as that client's traffic is going out to the internet. And because firewall two and firewall one are both reporting to 40 analyzer, we should be able to see both of those logs right here at the 40 analyzer regarding PC two's traffic.

6:09In fact, let's generate some traffic that'll be really easy to identify. So let 's go to YouTube, and that way it'll be easier to pick it out of the crowd. All right, so we're going to YouTube, fantastic. I'll close that. I'll minimize that browser. And let's go back to the 40 analyzer and take a look at the logs. So back at 40 analyzer, we're going to talk a lot about the different options here to look at the details and logs. But if we go to log view, and then we go to 40 gate, we can look at the individual 40 gate firewalls at their logs. And what's really happening is we're not reaching out and looking at the logs at those 40 gates, those 40 gates have already sent that log information over to the 40 analyzer. So currently I have traffic selected, looking at the traffic logs. So here in the traffic logs, if we want to sort out based on 40 firewall, I can say instead of looking at all devices, let's take a look at firewall two, and we'll click on okay. And this is just going to show us the logs that were sent over from firewall two, which is our Linux client right here. So if we click on that, it 's 10, 20, 0, 1, 0, 2, let me just confirm that's the IP address on our Linux device, which is PC two. So we'll bring up a command prompt here, and do an IF config. And sure enough, 10 dot 20 dot 0 dot 1, 0, 2. Then if we go back up here and say, you know, instead of just firewall two, let's go ahead and change that just to firewall one and click on okay. Once again, we should be able to see information from firewall one's perspective about the traffic. So if we

7:27scroll down and go to page two, there we go. There's 80 user two. So the failed connection is very likely before we authenticated. So I could right click here and then add a filter. And then this is firewall one reporting on all the logs where the traffic was sourced from 80 user two at that IP address 10 dot 20 dot 0 dot 1, 0, 2. And the quick traffic would be related to the way that YouTube is forwarding the streams of data down to the client. Now it's also interesting to note that firewall one has associated this IP address with 80 user two. But if we go back, if we clear the filters by clicking on the X here, if we go back to firewall two only and click on okay, there's our Linux client. But from the perspective of firewall two, here we have the Linux client again, but it doesn't say that it's 80 dash user two. And that very likely is because of this firewall one has some policies in place requiring authentication identifying who the user is while firewall two doesn't . And as a result, that's why the reports coming from firewall one included the ID and the reports coming from firewall two didn't. And this will all be more cohesive if if we had a 40 gate security fabric where, for example, firewall one was the route. And then firewall two and firewall three were members of the security fabric. In fact, in the next video, let's do exactly that and tell these three firewalls that they are part of the same security fabric. And then we can compare and contrast

8:44that with the 40 analyzer logs that are coming in. So I'll see you in the next video for exactly that.

0:00In this video I like to walk you through what it looks like when we have these three firewalls as part of the same security fabric and that way the login information will be listed duplicates here at the 4D Analyzer because all three of these devices are part of the same security fabric. So to do that let's go ahead and make firewall 1 the root of the security fabric and then we'll have firewall 2 and firewall 3 joins. So port 4 will be the upstream port that firewall 2 and firewall 3 will use to join this security fabric and if we come across any bumps in the road we'll handle them as they come up. Alright so currently we have firewall 1, 2, and 3 as three separate individuals who are reporting to 4D Analyzer and let's go to firewall 1 and we'll go down to security fabric and fabric connectors and currently it's stand alone here in the security fabric setup so we'll click that click on edit on firewall 1 and we'll serve as the fabric root. We'll use port 4 as the port that the downstream firewalls can join the fabric and we'll call this our FGT fabric and for the management IP address I'm going to specify the management IP address I'm currently using to manage that firewall which is firewall 1 and we'll click on okay I also want to make sure under network and interfaces I want to make sure port 4 is willing to go ahead and allow security fabric connections. So here under network interface for

1:15port 4 currently we're allowing security fabric connections to come in fantastic. So let me go back to security fabric fabric connectors and currently we are the root and we 're currently logging to 4D Analyzer so let's go over to firewall 2 and tell it to join the fabric. So here in firewall 2 we'll go down to security fabric and then fabric connectors and here on the tile for security fabric setup we'll go ahead and click on it click on edit and we'll say you're not going to be stand alone you're going to go ahead and join an existing fabric and I don't need to worry about an anthropology about other downstream devices beyond it and the upstream 4D gate IP address is 10.123.0.51. So let's confirm that together. So this port 4 here is the IP address of 10.123.0.51 that's the IP address the last octet last number I used for all of its interfaces. So that would be the correct IP address for firewall 2 to use to join the root and become part of the 4D gate security fabric. So for a single sign- on I'm going to set that to manual click on okay and it says joining an upstream device will cause this device's automation configuration to be discarded and because I haven't set up any animation yet that's okay and we'll click on okay all right and then we'll go to firewall 3 and we'll do a similar thing we'll go to security fabric fabric connectors and then here for security fabric setup we'll click that click on edit and

2:31then we'll specify that we wanted to join the fabric as well. So we're going to join an existing fabric and that's the upstream slash firewall 1's IP address of 10.123.0.51. For SAML settings let's go ahead and do manual and then click on okay. Again this warning is that any device automation configuration will be discarded that's fine because we haven't configured any yet and I'll click on okay. So now these three firewalls firewall 1 firewall 2 and firewall 3 are part of the same security fabric. Another interesting note is that if we hadn't yet had firewall 2 and firewall 3 sending logging over to 40 analyzer by joining the security fabric where firewall 1 was already sending over to the 40 analyzer firewall 2 and firewall 3 would also have incorporated the sending of messages over to 40 analyzer and once again we'd have to go to 40 analyzer to specify that we want to allow those inbound connections as authorized devices and as we go back to firewall 2 and firewall 3 oh we have to add firewall 1 specify that we need to authorize firewall 2 and firewall 3 to join the security fabric. So back at firewall 1 we need to authorize firewall 2 and firewall 3 to join so let's go ahead and click on the link there and then click on firmware and registration which takes us to system firmware and registration and then we can go ahead and take firewall 2 and firewall 3 and with them both selected we can click on authorize. So now those

3:46two firewalls are authorized to join this fabric. So now if we go back to firewall 2 it's showing as authorized and same thing for firewall 3 it's also showing as authorized and the benefit of having these 40 gates as part of the same security fabric is that now as they're all sending logs over to the 40 analyzer the 40 analyzer can logically treat them all as one device or one entity and can help reduce duplicates. So for doing for example IDS here, IPS here or an anti-mal ware here and maybe other security measures here all that log information is going to be sent over and correlated here at the 40 analyzer. So we won't miss anything but at the same time we won't have duplicate information for the same exact event coming from two different firewalls. Because the 40 analyzers treat the security fabric as one larger logical device. So back at 40 analyzer now if we go to device manager it's now showing us that as part of this FGT fabric it includes firewall 1 firewall 2 and firewall 3 as part of that same security fabric and this one up here is the branch firewall off on the right hand side of our topology.

0:00So now that we have all of our data, log and event information sent over to the 40 analyzer, the next thing we should take a look at is how to actually work with those logs that are sitting here at the 40 analyzer. And one of the challenges with 40 analyzers is that there's more than just one way to look at and search for logs and events that are happening. So I'm going to start off with basic old logs that are being sent from the 40 gates over to the 40 analyzer and give you some examples in action of looking for and working with logs. So to start off, I'm going to log back into 40 analyzer and click log in. And also while we're right here at the initial steps for the 40 analyzer, let me also walk you through how we could change a few settings should we need to.

0:41So right here, we have this widget for system information. I'll go ahead and make that bigger. So there's the host name, the serial number, the platform, the version, and how long it's been up. So if we wanted to use administrative domains, what we would do is click right here, boom, and enable administrative domains. That way, various firewalls and various Vd oms could be put into separate administrative domains. And that way you could have four or five different administrators responsible for different parts of the network. And you wouldn't have one giant blob of aggregated data you could segment it with administrative domains. So that's how you enable it right here.

1:14And then when you log on, you'd log on to a specific administrative domain. So I'm not going to enable that yet. So I'll click on cancel there. The second thing I want to share with you that we talked about in the overview was the operation mode. So if we're in analyzer mode, which is the default, that means we can run the reports from here, we can dig into the details of the logs, do everything. And that's the basic way we think about a 40 analyzer. However, if you want this device to be a collector as an intermediate to collect the login information and to forward them off to another 40 analyzer, we click that button right there to tell this 40 analyzer to be in collector mode. So I'm going to leave it in analyzer mode. So I'll click on cancel there. But I also want to share with you how to do that. So go ahead and restore that to its normal size. And let's just confirm real quick with device manager that we have all of our 40 gates reporting, which they are fantastic.

1:58The branch is by itself. And then as part of our fabric, we have firewall one, two, and three. So let's start off with log view. Now there's a thing called 40 view as well, which gives us like a summarized grouping of information we'll cover that separately later. But let's start off with log view. And then let's go to 40. So when click around 40 gate from our previous video, I had left this at firewall to so we go ahead and let me go ahead and select all devices, click on okay. And then if we want to also we can click on refresh, if we thought there might be new data is coming in. So this is all the logs from all of the reporting, 40 gate devices. Now currently we're looking at traffic logs as identified by this tab being selected. But there's also logs that we could look at regarding security. And there's also logs regarding events. So if we go to security, there's options for these security logs. And there's also events for these types of events.

2:46So right now we're just looking at traffic logs because this is selected. Now I 've also noticed that on various different versions of 40 analyzer, they change the screens a little bit from time to time. And that's okay. So I'm gonna give us a little more real estate by collapsing the left hand column. So we're under log view, 40 gate, I'll go ahead and collapse that and that'll give us a little more room to work here. Now in a slightly older version of 40 analyzer, they had a little icon for a wrench for tools. But now we have an option called more. And that can give us these additional options. So if we click on more here, we can go to real time log.

3:16And with real time log, it's going to push the logs as they come in. So you're gonna see updates as those computers on the network are generating traffic and going through the firewall. Now even in real time view here, if we want to pause it, we can use this pause icon right here, simply pause it. And that would keep it from scrolling and moving until we clicked on go again. Or if we go to the more and go to historical log, that's just going to show us what's there without refreshing automatically. However, even here with historical log, if we want to click on refresh, that'll cause the refresh to happen. So we can see the latest and greatest information. And then for any of these logs, we could double click on it to get more information regarding that specific log event, including the firewall that reported it, the source IP address of the device, where that traffic came into the firewall on port four, the user ad dash user one, and also where they were going and the activity associated with that in the application recognized with HTTPS.

4:08And a protocol six, that's the number for TCP has information on the duration and number of packets and so forth. And as we continue to scroll down, additional information on the authentication server used to identify that user, which is right there. Also the centralized source net rule that it went through and the actual name of the policy that permitted that traffic to go through. So I'll go ahead and close that now. Another option that we have is that we can actually look at these logs in a raw format, not formatted. So to do that, we click on more. And then from the dropdown, we can go ahead and select raw log, or if you want to see the formatted logs again, we could go back to more and select formatted log. Now also, as we look at this traffic log, we're currently looking at all devices. And it's also showing us for any time, we're not putting a date range, for example, we could say we want to look for traffic logs within the last, for example, seven days, or we could do a custom look up, we say, you know what, I want it between start time of January 1st, 1970, all the way to July 20th, 2025, click on Okay. And then it would only show us the logs in that range, which based on the state, that's everything going way, way back. So we asked for traffic, for example, in the last five minutes, we could select that. And that would show us only the last five minutes, in this case, of traffic logs, and it was here, there's

5:24only four pages, where if we said, you know what, let's take a look at the last seven days, then we have a lot more pages to deal with. All right, I'm gonna go to page one, I'm gonna go ahead and specify for this anytime, again, showing the logs for all devices for all time. Now, in addition to looking at the traffic logs, we can also look at these security logs. So we have quite a few options. Now, one thing you'll discover on a new 40 analyzer is that if it hasn't seen, for example, security information security logs regarding antivirus or IPS or application control, etc, they mean that show up here. So it doesn't mean it's broken or you're lacking a license.

5:58It simply means that it doesn't have any in the logs yet that can show you. So if we go to summary, this is going to show us the widgets for antivirus web filter SSL, DNS queries, and also take a look at the time it set is for the last hour. So if we said, you know what, let's go ahead and say last , how about last three weeks, then it's going to put that filter. And now it's going to include additional information, because we're asking it to look at a longer period of time. So there's an incident or something happened, you want to narrow it down to a narrow range of time, we could do it right here. So now we have an antivirus file that was seen, we have some web filter events DNS queries, we have application firewall and SSL events as well. And if you wanted to narrow this down, we could go ahead and say, you know, let's take a look at just web filter events. So it looks like we have some policies in place that are monitoring traffic, but it looks like everything is being allowed through. So if we wanted to right click here, I'm passed through and say, you know what, let's go ahead and let's put a filter in place where the action is not passed through, then we could go ahead and see blocks. So here are the 123456789 blocks that have happened based on web filtering on the 40 analyzer coming from any possible device. So we could drill down into one of these, for example, let's go ahead and drill down into this one right here,

7:16we'll just go ahead and double click on it. And if we look at the details, it'll tell us the action of blocked right there. It's also indicating here why it was blocked because of a web filtering policy, denying access to any categories of websites that are based on alcohol. Where if we take a look at this one right here and click on it, this was also blocked. There's the URL is trying to go to, which is a test malware site. And the reason for that it was another category of malicious websites. So the idea I want to share here is that we can get very granular with what we want to look at, where it's coming from, including what ranges of time we want to look at. So let's also have a little fun with this. Let me go ahead and remove the filter sitting looking for just the blocked.

7:55So I'm looking at web filter activity, because that's what's selected here from all devices, any possible time. And let's go back to summary. And let's take a look at the widget here for web filter. So if we look at web filters, scroll down, wow, look at this proxy avoidance. So if we have policies in place that are supposed to not allow customers to try to bypass our proxies, it appears here, based on proxy avoidance and the action of pass through, it appears here that we have failed because we have some proxy avoidance, but we have pass through and 307 in the count field here. So we click on proxy avoidance, it automatically puts a filter in where the action is passed through category description is proxy avoidance. And then we can take a look at what's going on, including who's doing it. So looks like user to here, has a whole bunch of proxy avoidance websites they've been going to. And that would be absolutely something we'd want to look into.

8:48So if it's a problem with our policy, we don't have fix our policy to specify that we don't want to just allow that traffic, we want to go ahead and block it if the customer is trying to go to proxy avoidance types of websites. So if we grab one of these, let's go ahead and let's grab this right here, I'll just double click on it to bring it up. As we scroll down, it 's 80 user two at this IP address 1020 0.102 that was doing it. As we continue to scroll down, the action was passed through and the profile is called monitor all. And that monitor all profile, which is associated with the security policy is allowing proxy avoidance to go through. And as we continue to scroll down, here's the actual URL that the client was going to. So as a test of that, let's right click that and copy that. Let's go back to PC to his computer, let's open up a browser and just confirm we can still get there. So I'll go ahead and put that URL in and a proxy.com. So here 's where testing that it's being allowed. So if we wanted to correct that, we'd want to go back to the policy and correct it. So if we scroll up, so it's HQ firewall one, and if we scroll down a little bit, and it's a profile called monitor all that's using. So if we don't want to monitor all, and we want to start blocking on proxy avoidance types of websites, we could either replace that profile with a profile that starts blocking, or we can modify that profile. So let's go back to firewall one. So here at firewall

10:03one under security profiles web filter, there's the profile right there. Let's go ahead and edit it. Currently shows it's being used. If we click that, it'll show us where it's being used in the end out with LDAP authentication. Great, great, great. So let's go ahead and modify this profile for web filtering. So I'm going to double click on it to edit it. And although it'll still be called monitor all, we'll go down to proxy avoidance and specify that we want to go ahead and do a block instead of just monitor, click on OK. And because that profile is being used by the policy, that client should no longer be able to go to proxy avoidance websites. So I'll go ahead and grab that URL, close the browser, and let's try it again. So we'll open up a browser, right click, paste and go. And this time says not not not gonna happen. Now in addition to us fixing that problem, if that was a security violation for our company, we're also going to have that logged information at the 40 analyzer, because firewall one and the other firewalls are all saying their information over to 40 analyzer. So if we go back to our 40 analyzer, and let's go ahead and say for web filtering, let's go ahead and look at the last five minutes, and I still have the filter in place for proxy avoidance, let me go ahead and clear off that filter. And right there , we have our blocks.

11:12Now another way of finding that would be to go ahead and say, you know what, I want to find everything that's not passed through. So put that filter in place, and that will show us those two blocks and those happen in the last five minutes. Here's another example of using the same technique I'm going to go ahead and specify I want to go ahead and use any time range. I 'm also going to click on the X here to remove the filter for action doesn't equal pass through. And here in security, let's go down to application control. So if we scroll to the right a little bit, here 's our applications, in fact, let me drag that over here a little bit further, so we can see it without having to scroll and scroll down. So regarding application control, let's say we want to find any log entries regarding social media, you can click on add filter, and then we go down to application category, and then over to the right, we can then go ahead and specify equals, and then we can have in social media, and then click on apply, and that'll put a filter in where the application category equals social media. So instead of having to write it all out, you can actually use the interface to help you build it. So here in the application, we have LinkedIn, Facebook, Twitter, anybody narrow it down to what's happened more recently, we get once again, specify, for example, last five minutes. So here it says no record found, but if we send out traffic to social media site, let's do it. So here's PC2 and our topology, saying traffic through firewall two and also the firewall one to get up to the internet, let's go ahead and go to Fortinet, and let's also go ahead and go to

12:29some social media. So here's a set of bookmarks for social media, let's go to YouTube, and let's also go ahead and go to Facebook, and let's also go to Instagram, Grace, there's YouTube, Facebook, and Instagram, and we'll go ahead and close the browser and minimize our client here. And now currently it says no record found, but if we do a refresh here by clicking here on refresh, now it's showing us from the last five minutes, any application categories of social media, which includes our Facebook, LinkedIn, Twitter, and I'm not sure why Instagram is not showing up, they're only clicking on refresh.

13:01Now there we go, just a little bit of a delay for that information to get all sorted out here on the 40 analyzer. So before I leave this, I'm going to go ahead and clear my filters, and we could also use this for other types of events as well, DNS, wealth filtering, IPS, etc. Now another option we have on the 40 analyzer, I'm going to go ahead and bring back the sidebar here on the left, is we also have an option called a Fort review. And think of Fort review as a way of some views of our data and our logs that are kind of pre formatted for us. So here under Fort review, I'm going to go ahead and click here on threats. Now by default, it's showing us the last week, I'm going to go ahead and I'm going to say custom, because a few days ago, I generated some traffic.

13:45So we have something to look at here. So here under 40 view threats, top threats, my custom time frame is from 713 all the way to 720 of this year 2025. Or I could go ahead and say, you know, let's take a look at the last, let's say three weeks that'll cover us as well. And so I had a lot of fun not getting in generating a lot of events that would show up here as well. So we're going to these top threats, we can click here on add filter, and we can go to, for example, threat level. And then with threat level selected, we go ahead and say equal. And we could go ahead and say, I only want to see the critical threat levels. So the critical selected, we click on apply, and that's going to be a filter in place to only show us where the threat level is critical. And that's based on the data here from the last three weeks. Or if we want to see the threat level of high, we could go ahead and remove that filter, click on add filter again, go down to threat level, and say, I want to see the high and click on apply. And this time it's going to show us just the threat level of high. And if there's a CBE ID associated with that, you could also click to research that or go on a filter on a specific threat, we could, for example, right click on that threat. And from the sub menu select threat equals that exact threat. And that would filter out the where it's threat level high, and the exact threat is that one. And we could double click on this to look at more details regarding it. So there's the source user IP address coming into the firewall and the WAN1

15:03interface. There's the threat score and the bytes received. And fortunately, this was blocked as indicated by the yellow right here. Now, because this was blocked, let's go back and make clear the filters. And let's take a look at examples something else that was allowed to go through. So we're going to top threats, and go ahead and clear the filters. And I have searched down here for some blue icons, which means that traffic was allowed to go through. And let's go ahead and select this one right here. So I'm going to say threat equals that one, which puts that filter in for us. And then I double click on this entry is putting a filter in place. And then for more detail, we just continue to double click.

15:36So here is detail about it regarding the 48, which was firewall one, the source and destination information and the action, which was allowed. And that was before we changed the profile to not allow proxy avoidance. So if we brought our client back in, and we'll open up a browser, and we'll go to proxym.com again, our attempt to impress enter, that should be denied. And also, that new information will be sent over to the 40 analyzer, where we can now see it in the logs as well. So let me go ahead and close that browser, even minimize that, I go back to log view, I go back to source, let me go back to top threats and refresh here. And now we have an update. So now regarding proxym.com, if we double click on that, we have some that was allowed and some that was blocked. And that's being reflected right here. And one other item I want to share with you here in 40 view is this section down here, these are called monitors under this line right here. So if we click on threats and events under the 40 view section, currently, it's set up for the last week. Let me go ahead and say the last, let's go ahead and say the last three weeks, all devices. And I'll let this refresh. This is going to show us our threats in a map view. So it's presuming we have our firewall set up as far as the location of those firewalls correctly as part of 40 analyzer. And this is showing us our threat map in an animated fashion. You can also control

16:54the replay rate, then has a top threat destinations. And let me go ahead and make that full screen. There we go. So it was small enough where it wouldn't draw it. So here it's showing us the traffic for our top threat destinations. So I'm launching it from here. I have to be in Las Vegas, Nevada, and a lot of the attacks that I simulated and generated, we're going to United Kingdom and Spain and Germany and Indonesia and India. That's a great way to visually see our traffic flows. Go ahead and minimize that. And as we can just scroll down, we also have our top threats right here. And here it's currently sorted by threat level, but we could also sort it based on threat score. And as we scroll down, here's the top threats by weight and count right here. And then if we continue to scroll down, here's the top virus instance over time. And I only did it once. It was right here. So if you had lots of virus incidents, you could go ahead and say instead of saying most recent, you could also say most detected. So I'm going to go back to most recent. So with the four of you, it's some really clever, pre-prepared ways of viewing what's happening on your networks by using 40 analyzer to give us that overall view of what's happening. And if there's a widget that you don't want, you can go ahead and simply remove it by using the drop down here and saying remove. If you change your mind, you can always add it back by clicking on add widget and then add the widget back in, just like that. And here in the top threats by weight and count, you can also

18:10hover to identify what the event was. So that was a critical threat. Again, here in the kind of reddish orange color. And then down here, we have proxy avoidance, which was a medium threat. And also with the color coding of yellow versus blue, what was allowed, what was not allowed.

0:00To wrap up this section on the fundamentals and introduction to using 40 Analy zer, I'd like to pose a customer scenario and here it is. The customer is considering using a 40 Analyzer in their Fortinet based network. They have a few questions for us before they pull the trigger. So here's the questions. How does the 40 Analyzer, I'll put Faz for short there , how does the 40 Analyzer store the log and event data? And then secondly, does the 40 Analyzer reduce duplicate log and event entries and how does it do that? So here's what I love you to do. I'd like you to pause the video at this point, give those two questions some thought. And then when you're ready, click on resume and let's review that together.

0:37All right, so regarding how does the 40 Analyzer store the log and event data? It uses a flavor of SQL, structured query language, effectively a database to sort and keep track of all the log entries that it receives. And then secondly, does the 40 Analyzer reduce duplicate log and event entries? And if so, how? Well, the way it does that is if we have a group of 40 gate firewalls that are part of the same security fabric. And by doing that, it can logically treat those 40 gates as like one grouping or family, and it will reduce the duplicate entries. So Firewall 2 is doing IPS functions and Firewall 1 is doing filtering based on application types or categories of websites. All that information regarding what's happening is going to be consolidated here at the 40 Analyzer to give us a better picture and reduce all the duplicates. So that way, if it's just traffic, for example, going from this Windows computer out to the public internet. And let's imagine that traffic is allowed by all the firewall policies in place. The 40 Analyzer, because these devices are on the same security fabric is going to reduce unnecessary duplicate entries. And that's how it does it by leveraging the 40 gate security fabric.

1:48So thanks for joining me in this set of videos as we've taken a first look at this wonderful tool called the 40 Analyzer. And I look forward to seeing you, my friend, in another set of videos very, very soon. Until then, I hope this has been informative, and I'd like to thank you for viewing.