Configuring Fortinet FortiWeb Firewall

To configure Fortinet FortiWeb Firewall client logs to send to IBM QRadar, complete the following steps.

Procedure

  1. Log in to the command line interface on your Fortinet FortiWeb Firewall appliance.
  2. To configure the network interfaces associated with the physical network ports of the FortiWeb appliance, type the following commands, in order, replacing the variables with values that suit your environment. 
    config system interface
edit "<interface_name>"
set status {up | down}
set type {aggregate | physical | vlan | redundant}
set algorithm {layer2 | layer2_3 | layer3_4}
set allowaccess {HTTP HTTPS ping snmp ssh FortiWeb-manager}
set ip6-allowaccess {HTTP HTTPS ping snmp ssh FortiWeb-manager}
set wccp {enable | disable}
set description "<comment_str>"
set interface "<interface_name>"
set intf {"<port_name>" ...}
set ip "<interface_ipv4mask>"
set ip6 "<interface_ipv6mask>"
set mode {static | dhcp}
set ip6-mode {static | dhcp}
set vlanid <vlan-id_int>
set vlanproto {8021q | 8021ad}
set lacp-speed {fast | slow}
set mtu <mtu_int>
set system interface
set system interface
set system interface
set system interface
config secondaryip
edit <entry_index>
set ip {"<interface_ipv4mask>" | "<interface_ipv6mask>"}
next
end
next
end
    To configure static routes, including the default gateway, type the following command:
    config router static
edit <route_index>
set device “<interface_name>”
set dst “<destination_ip>”
set gateway “<router_ip>”
next
end
  3. To enable the Syslog in FortiWeb Firewall appliance, complete the following steps:
    1. Login to FortiWeb web UI.
    2. Choose the proper action depending upon log types.
      • Go to Log & Report > Event Log for system events (for example: admin login, reboots).
      • Go to Log & Report > Attack Log for detected threats.
      • Go to Log & Report > Trafffic Log for HTTP or HTTPS traffic details.
    Note: For more information, see