{"id":2819,"date":"2022-04-14T18:31:40","date_gmt":"2022-04-15T02:31:40","guid":{"rendered":"https:\/\/tungle.ca\/?p=2819"},"modified":"2022-04-16T22:26:42","modified_gmt":"2022-04-17T06:26:42","slug":"send-fortigate-logs-to-graylog-open-source-log-management-on-aws","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=2819","title":{"rendered":"Sending FortiGate logs to Graylog open-source log management on AWS via IPSEC VPN site-to-site"},"content":{"rendered":"\n<p>This is a diagram that I have used to build this lab.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"848\" height=\"481\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-324.png\" alt=\"\" class=\"wp-image-2820\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-324.png 848w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-324-300x170.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-324-768x436.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-324-200x113.png 200w\" sizes=\"auto, (max-width: 848px) 100vw, 848px\" \/><\/figure>\n\n\n\n<p>There are a couple of steps in this lab.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Configure IPSEC VPN site-to-site IKEv2 between FortiGate and AWS.<\/li><li>Implementing Graylog open-source log management on a Linux instance on AWS.<\/li><li>Download FortiGate Content Pack (.json file) for Graylog.<\/li><li>Upload the file into Graylog.<\/li><li>Configure FortiGate to send logs to Graylog via Graylog&#8217;s IP address and the destination UDP port 1500. <\/li><\/ul>\n\n\n\n<p>Use the link below to know how to deploy the VPN site-to-site between FortiGate on-prem and AWS.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;tungle.ca\/?p=2753<\/code><\/pre>\n\n\n\n<p>Create a new Linux instance (4GB RAM) to install Graylog.<\/p>\n\n\n\n<p>On Security Group, create a couple of following rules to allow FortiGate LAN subnets to communicate with Graylog on AWS LAN subnets.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"396\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-325-1024x396.png\" alt=\"\" class=\"wp-image-2821\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-325-1024x396.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-325-300x116.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-325-768x297.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-325-200x77.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-325.png 1417w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"554\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-328-1024x554.png\" alt=\"\" class=\"wp-image-2824\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-328-1024x554.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-328-300x162.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-328-768x416.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-328-200x108.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-328.png 1326w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>SSH to the Linux instance.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"450\" height=\"273\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-330.png\" alt=\"\" class=\"wp-image-2826\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-330.png 450w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-330-300x182.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-330-200x121.png 200w\" sizes=\"auto, (max-width: 450px) 100vw, 450px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"762\" height=\"412\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-332.png\" alt=\"\" class=\"wp-image-2828\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-332.png 762w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-332-300x162.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-332-200x108.png 200w\" sizes=\"auto, (max-width: 762px) 100vw, 762px\" \/><\/figure>\n\n\n\n<p>+ Update your system and install needed packages.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo hostnamectl set-hostname graylog\nsudo yum update -y\nsudo yum install epel-release\nsudo wget https:\/\/download-ib01.fedoraproject.org\/pub\/epel\/7\/x86_64\/Packages\/p\/pwgen-2.08-1.el7.x86_64.rpm\nsudo rpm -ivh pwgen-2.08-1.el7.x86_64.rpm<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"594\" height=\"310\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-333.png\" alt=\"\" class=\"wp-image-2829\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-333.png 594w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-333-300x157.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-333-200x104.png 200w\" sizes=\"auto, (max-width: 594px) 100vw, 594px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1015\" height=\"280\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-334.png\" alt=\"\" class=\"wp-image-2830\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-334.png 1015w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-334-300x83.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-334-768x212.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-334-200x55.png 200w\" sizes=\"auto, (max-width: 1015px) 100vw, 1015px\" \/><\/figure>\n\n\n\n<p>+ Install JAVA<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install java-1.8.0-openjdk-headless.x86_64 -y\nsudo java -version<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1020\" height=\"237\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-335.png\" alt=\"\" class=\"wp-image-2831\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-335.png 1020w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-335-300x70.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-335-768x178.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-335-200x46.png 200w\" sizes=\"auto, (max-width: 1020px) 100vw, 1020px\" \/><\/figure>\n\n\n\n<p>+ Create a repository file. Then add the content below to this repository.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/yum.repos.d\/mongodb-org.repo<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;mongodb-org-4.2]\nname=MongoDB Repository\nbaseurl=https:\/\/repo.mongodb.org\/yum\/redhat\/7\/mongodb-org\/4.2\/x86_64\/\ngpgcheck=1\nenabled=1\ngpgkey=https:\/\/www.mongodb.org\/static\/pgp\/server-4.2.asc<\/code><\/pre>\n\n\n\n<p>+ Install MongoDB.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install mongodb-org -y<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"765\" height=\"378\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-336.png\" alt=\"\" class=\"wp-image-2832\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-336.png 765w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-336-300x148.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-336-200x99.png 200w\" sizes=\"auto, (max-width: 765px) 100vw, 765px\" \/><\/figure>\n\n\n\n<p>+ Enable and start the mongoDB service on the system.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl daemon-reload\nsudo systemctl enable mongod.service\nsudo systemctl start mongod.service\nsudo systemctl --type=service --state=active | grep mongod<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"638\" height=\"97\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-337.png\" alt=\"\" class=\"wp-image-2833\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-337.png 638w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-337-300x46.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-337-200x30.png 200w\" sizes=\"auto, (max-width: 638px) 100vw, 638px\" \/><\/figure>\n\n\n\n<p>+ Check MongoDB service port.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>netstat -antp | grep 27017<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"75\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-340-1024x75.png\" alt=\"\" class=\"wp-image-2836\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-340-1024x75.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-340-300x22.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-340-768x56.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-340-200x15.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-340.png 1070w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>+ Installing Elasticsearch.<\/p>\n\n\n\n<p>Create a repository, then add the following contents to the file.<\/p>\n\n\n\n<p>sudo nano \/etc\/yum.repos.d\/elasticsearch.repo<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;elasticsearch-6.x]\nname=Elasticsearch repository for 6.x packages\nbaseurl=https:\/\/artifacts.elastic.co\/packages\/oss-6.x\/yum\ngpgcheck=1\ngpgkey=https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch\nenabled=1\nautorefresh=1<\/code><\/pre>\n\n\n\n<p>Install the open-source version of Elasticsearch.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install elasticsearch-oss -y<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"539\" height=\"90\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-341.png\" alt=\"\" class=\"wp-image-2837\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-341.png 539w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-341-300x50.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-341-200x33.png 200w\" sizes=\"auto, (max-width: 539px) 100vw, 539px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>#Edit the elasticsearch.yml file on \/etc\/elasticsearch\/elasticsearch.yml\nsudo nano \/etc\/elasticsearch\/elasticsearch.yml<\/code><\/pre>\n\n\n\n<p>Modify the Elasticsearch configuration file. Set the cluster name to graylog and add \u201caction.auto_create_index: false\u201d to the file.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"728\" height=\"425\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-342.png\" alt=\"\" class=\"wp-image-2838\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-342.png 728w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-342-300x175.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-342-200x117.png 200w\" sizes=\"auto, (max-width: 728px) 100vw, 728px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"650\" height=\"665\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-343.png\" alt=\"\" class=\"wp-image-2839\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-343.png 650w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-343-293x300.png 293w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-343-195x200.png 195w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/figure>\n\n\n\n<p>Save and exit the file. Enable, start and check the status of elastic search on the system.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl daemon-reload\nsudo systemctl enable elasticsearch.service\nsudo systemctl restart elasticsearch.service\nsudo systemctl --type=service --state=active | grep elasticsearch<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"983\" height=\"129\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-344.png\" alt=\"\" class=\"wp-image-2840\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-344.png 983w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-344-300x39.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-344-768x101.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-344-200x26.png 200w\" sizes=\"auto, (max-width: 983px) 100vw, 983px\" \/><\/figure>\n\n\n\n<p>Check elastic search health.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -XGET 'http:\/\/localhost:9200\/_cluster\/health?pretty=true'<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"672\" height=\"326\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-345.png\" alt=\"\" class=\"wp-image-2841\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-345.png 672w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-345-300x146.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-345-200x97.png 200w\" sizes=\"auto, (max-width: 672px) 100vw, 672px\" \/><\/figure>\n\n\n\n<p>+ Installing the Graylog.<\/p>\n\n\n\n<p>Now install the Graylog repository configuration with the following command.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo rpm -Uvh https:\/\/packages.graylog2.org\/repo\/packages\/graylog-4.2-repository_latest.rpm<\/code><\/pre>\n\n\n\n<p>Install Graylog-server.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install graylog-server -y<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"491\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-346-1024x491.png\" alt=\"\" class=\"wp-image-2842\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-346-1024x491.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-346-300x144.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-346-768x369.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-346-200x96.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-346.png 1067w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"632\" height=\"135\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-347.png\" alt=\"\" class=\"wp-image-2843\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-347.png 632w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-347-300x64.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-347-200x43.png 200w\" sizes=\"auto, (max-width: 632px) 100vw, 632px\" \/><\/figure>\n\n\n\n<p>Configure Graylog.<\/p>\n\n\n\n<p>Generate password_secret.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pwgen -N 1 -s 96<\/code><\/pre>\n\n\n\n<p>[ec2-user@ip-10-0-0-64 ~]$ pwgen -N 1 -s 96<br>Bv6a46BXTALlfI3VRZ3ACfzBoIZOo3evqd7v7FY0fsrSXNZDflPcWRtYoxRrm5BZfMvq2TKffWEobYL6iSwBW908gpSC9z79<\/p>\n\n\n\n<p>Generate root_password_sha2.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo -n graylog@123 | sha256sum | cut -d\u201d \u201d -f1<\/code><\/pre>\n\n\n\n<p>[ec2-user@ip-10-0-0-64 ~]$ echo -n graylog@123 | sha256sum | cut -d&#8221; &#8221; -f1<br>cc41de147e5c624c6a7c230648545f6d14f82fa0e591148dc96993b3e539abfc<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"771\" height=\"146\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-348.png\" alt=\"\" class=\"wp-image-2844\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-348.png 771w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-348-300x57.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-348-768x145.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-348-200x38.png 200w\" sizes=\"auto, (max-width: 771px) 100vw, 771px\" \/><\/figure>\n\n\n\n<p>Edit etc\/graylog\/server\/server.conf file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/graylog\/server\/server.conf<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"986\" height=\"477\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-350.png\" alt=\"\" class=\"wp-image-2846\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-350.png 986w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-350-300x145.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-350-768x372.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-350-200x97.png 200w\" sizes=\"auto, (max-width: 986px) 100vw, 986px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"883\" height=\"736\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-349.png\" alt=\"\" class=\"wp-image-2845\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-349.png 883w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-349-300x250.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-349-768x640.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-349-200x167.png 200w\" sizes=\"auto, (max-width: 883px) 100vw, 883px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>Comment the following line.\n#http_bind_address = 127.0.0.1:9000\n\nAdd the following line with IP address of Graylog.\nhttp_bind_address = 10.0.0.64:9000 <\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"846\" height=\"428\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-351.png\" alt=\"\" class=\"wp-image-2847\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-351.png 846w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-351-300x152.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-351-768x389.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-351-200x101.png 200w\" sizes=\"auto, (max-width: 846px) 100vw, 846px\" \/><\/figure>\n\n\n\n<p>Enable and start Graylog service.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl enable graylog-server.service\nsudo systemctl start graylog-server.service<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"331\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-353-1024x331.png\" alt=\"\" class=\"wp-image-2849\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-353-1024x331.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-353-300x97.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-353-768x248.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-353-200x65.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-353.png 1084w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Check Graylog Server listening port.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>netstat -antp | grep 9000<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"636\" height=\"722\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-354.png\" alt=\"\" class=\"wp-image-2850\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-354.png 636w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-354-264x300.png 264w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-354-176x200.png 176w\" sizes=\"auto, (max-width: 636px) 100vw, 636px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"624\" height=\"62\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-355.png\" alt=\"\" class=\"wp-image-2851\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-355.png 624w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-355-300x30.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-355-200x20.png 200w\" sizes=\"auto, (max-width: 624px) 100vw, 624px\" \/><\/figure>\n\n\n\n<p>Access Graylog web interface from Kali&#8217;s machine on FortiGate LAN subnets.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;10.0.0.4:9000\nuser:admin\npassword:graylog@123<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-356.png\" alt=\"\" class=\"wp-image-2852\" width=\"668\" height=\"539\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-356.png 701w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-356-300x242.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-356-200x161.png 200w\" sizes=\"auto, (max-width: 668px) 100vw, 668px\" \/><\/figure>\n\n\n\n<p>Back to FortiGate, configure the Syslog setting to send logs via the Graylog server on its IP address 10.0.0.64 with a destination port is 1500.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>config log syslogd setting\nset status enable\nset server 10.0.0.64\nset port 1500\nend <\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"522\" height=\"191\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-359.png\" alt=\"\" class=\"wp-image-2855\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-359.png 522w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-359-300x110.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-359-200x73.png 200w\" sizes=\"auto, (max-width: 522px) 100vw, 522px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>show log syslogd setting<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"469\" height=\"161\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-360.png\" alt=\"\" class=\"wp-image-2856\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-360.png 469w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-360-300x103.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-360-200x69.png 200w\" sizes=\"auto, (max-width: 469px) 100vw, 469px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"671\" height=\"512\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-358.png\" alt=\"\" class=\"wp-image-2854\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-358.png 671w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-358-300x229.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-358-200x153.png 200w\" sizes=\"auto, (max-width: 671px) 100vw, 671px\" \/><\/figure>\n\n\n\n<p>On Graylog.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-357.png\" alt=\"\" class=\"wp-image-2853\" width=\"676\" height=\"395\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-357.png 892w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-357-300x175.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-357-768x449.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-357-200x117.png 200w\" sizes=\"auto, (max-width: 676px) 100vw, 676px\" \/><\/figure>\n\n\n\n<p>Download FortiGate Content Pack from Github. <\/p>\n\n\n\n<p><a href=\"https:\/\/marketplace.graylog.org\/addons\/bff74987-2846-4754-9f58-afd9bb8e8693\">https:\/\/marketplace.graylog.org\/addons\/f1b25e9c-c<\/a><a href=\"https:\/\/marketplace.graylog.org\/addons\/f1b25e9c-c908-41e4-b5de-4549c500a9d0\">908-41e4-b5de-4549c500a9d0<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/teon85\/fortigate6.4_graylog4\">https:\/\/github.com\/teon85\/fortigate6.4_graylog4<\/a><\/p>\n\n\n\n<p>Download the JSON file (fortigate6.4_graylog4.json)<\/p>\n\n\n\n<p>Go to System &#8211; Content Packs &#8211; Upload. Select the file (fortigate6.4_graylog4.json) and upload. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1021\" height=\"228\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-361.png\" alt=\"\" class=\"wp-image-2857\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-361.png 1021w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-361-300x67.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-361-768x172.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-361-200x45.png 200w\" sizes=\"auto, (max-width: 1021px) 100vw, 1021px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"747\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-368-1024x747.png\" alt=\"\" class=\"wp-image-2864\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-368-1024x747.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-368-300x219.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-368-768x560.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-368-200x146.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-368.png 1037w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Click Install. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"754\" height=\"454\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-369.png\" alt=\"\" class=\"wp-image-2865\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-369.png 754w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-369-300x181.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-369-200x120.png 200w\" sizes=\"auto, (max-width: 754px) 100vw, 754px\" \/><\/figure>\n\n\n\n<p>Change the Syslog port to 1500.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1025\" height=\"573\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-365.png\" alt=\"\" class=\"wp-image-2861\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-365.png 1025w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-365-300x168.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-365-768x429.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-365-200x112.png 200w\" sizes=\"auto, (max-width: 1025px) 100vw, 1025px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1022\" height=\"753\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-370.png\" alt=\"\" class=\"wp-image-2866\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-370.png 1022w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-370-300x221.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-370-768x566.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-370-200x147.png 200w\" sizes=\"auto, (max-width: 1022px) 100vw, 1022px\" \/><\/figure>\n\n\n\n<p>FortiGate dashboard.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"917\" height=\"672\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-372.png\" alt=\"\" class=\"wp-image-2868\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-372.png 917w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-372-300x220.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-372-768x563.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-372-200x147.png 200w\" sizes=\"auto, (max-width: 917px) 100vw, 917px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"772\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-373-1024x772.png\" alt=\"\" class=\"wp-image-2869\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-373-1024x772.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-373-300x226.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-373-768x579.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-373-200x151.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-373.png 1030w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>This is a diagram that I have used to build this lab. There are a couple of steps in this lab. Configure IPSEC VPN site-to-site IKEv2 between FortiGate and AWS. Implementing Graylog open-source log management on a Linux instance on AWS. Download FortiGate Content Pack (.json file) for Graylog. Upload the file into Graylog. Configure [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,3,11],"tags":[20,27,8],"class_list":["post-2819","post","type-post","status-publish","format-standard","hentry","category-cloud","category-fortigate","category-security","tag-cloud","tag-fortigate","tag-linux"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2819","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2819"}],"version-history":[{"count":10,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2819\/revisions"}],"predecessor-version":[{"id":2965,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2819\/revisions\/2965"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2819"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2819"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2819"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}