Expanding storage for FortiAnalyzer 5.2.x units

1. (Server) Configuring the temporary FortiAnalyzer unit to receive logs 

Ensure that you have configured an administrator account with a Super_User profile. You can use the default admin account, which is assigned the Super_User profile. Alternately, you can create a custom administrator account by going to System Settings > Admin > Administrator. The client will need to provide the login credentials of this Administrator account to get authenticated by the server.

Add the FortiAnalyzer for which you want to increase storage capacity to the temporary FortiAnalyzer by going to Device Manager > Add Device. The Add Device wizard is displayed. Follow the wizard to add the device.

Enable the log aggregation service by going to System Settings > Dashboard.  In the CLI Console widget, enter the following CLI commands:

config system aggregation-service
    set accept-aggregation enable
end

get system aggregation-service
accept-aggregation  : enable
aggregation-disk-quota: 20000
password            : *   <-- set for password

config system interface
edit port<number> 
set ip <ip address> <netmask>
set allowaccess ping https ssh snmp telnet http webservice aggregator fgfm
end

2. (Client) Configuring log forwarding on the FortiAnalyzer unit for which you want to increase storage capacity.

Configure log forwarding in aggregation mode by going to System Settings > Dashboard.  In the CLI Console widget, enter the following CLI commands:

config system aggregation-client
    edit 1
        set mode aggregation
        set server-ip <ip address>
        set agg-password <password>

3. Reconfigure FortiGate to send logs to the temporary FortiAnalyzer unit.

4. Increase storage capacity for the FortiAnalyzer unit.

Add new hard disks with a total size greater than 16 TB to FortiAnalyzer.

Format the FortiAnalyzer disks to have more than 16TB of storage capacity.

5. Return logs to the FortiAnalyzer unit with increased storage capacity.

Set up log forwarding as follows to return the logs to the FortiAnalyzer:

• Configure the FortiAnalyzer unit with the new storage capacity as the log-forwarding server.
• Configure the temporary FortiAnalyzer as the log-forwarding client.

The log-forwarding client sends all of the logs to the log-forwarding server. As a result, the log-forwarding feature returns all of the logs to the FortiAnalyzer unit with increased storage capacity.

6. Reconfigure FortiGate to send logs to the FortiAnalyzer unit with increased storage capacity.

7. Results