FCP_FAZ_AD-7.4 · Question #11
Refer to the exhibit. The capture displayed was taken on a FortiAnalyzer. Why is a single IP address shown as the source for all logs received?
The correct answer is C. FortiAnalyzer is receiving logs from the root FortiGate of a Security Fabric. In a Fortinet Security Fabric, logs from downstream devices can be sent to FortiAnalyzer through the root FortiGate. This is why all the logs have the same source IP address (the root FortiGate). The root FortiGate aggregates and forwards the logs from all downstream devices…
Question
Refer to the exhibit. The capture displayed was taken on a FortiAnalyzer. Why is a single IP address shown as the source for all logs received?
Exhibit
Options
- AFortiAnalyzer is using the device MAC addresses to differentiate their logs.
- BThe logs belong to devices that are part of a high availability (HA) cluster.
- CFortiAnalyzer is receiving logs from the root FortiGate of a Security Fabric.
- DThe device sending logs has two VDOMs in the same ADOM.
How the community answered
(52 responses)- A2% (1)
- B6% (3)
- C83% (43)
- D10% (5)
Explanation
In a Fortinet Security Fabric, logs from downstream devices can be sent to FortiAnalyzer through the root FortiGate. This is why all the logs have the same source IP address (the root FortiGate). The root FortiGate aggregates and forwards the logs from all downstream devices, so the source IP in the log capture will appear to be from the root FortiGate itself, even though the logs originate from multiple devices within the fabric.
Topics
Community Discussion
No community discussion yet for this question.