#4 - How to Enable Fortinet Security Fabric in PNETLab / EVE-NG with FortiGate and FortiAnalyzer Without Integration Issues

If you are trying to enable Fortinet Security Fabric in PNETLab / EVE-NG, this guide shows the minimum setup required with 2 FortiGates and 1 FortiAnalyzer, along with the adjustments that help avoid bugs, validation errors, and integration issues.

In lab environments, Security Fabric does not always work properly with the default configuration. Depending on the image versions and the behavior of the virtualized environment, communication between FortiGate and FortiAnalyzer may require troubleshooting before the integration can be completed successfully. Keep the appliances on an isolated, trusted lab segment and do not weaken TLS or cipher settings to work around compatibility problems.

In this tutorial, you will see the minimum topology required and the specific configuration changes needed to make Security Fabric work properly in PNETLab / EVE-NG.

Minimum Topology

To make this setup work properly, use at least:

• 2 FortiGates
• 1 FortiAnalyzer

The idea is to have:

• one FortiGate acting as the Security Fabric root;
• a second FortiGate joining the Fabric;
• one FortiAnalyzer integrated into the environment.

This is the minimum structure required to validate the integration more completely in a lab scenario.

Step 1: Adjust the FortiAnalyzer

On the FortiAnalyzer, apply the following configuration:

config system global
    set enc-algorithm high
    set oftp-ssl-protocol tlsv1.2
end

These settings keep OFTP log transport on high-strength encryption with TLS 1.2 as the minimum protocol version. If the appliances cannot negotiate these settings, align or upgrade the images rather than falling back to TLS 1.0 or low-encryption cipher suites.

Step 2: Adjust the FortiGate Integration with FortiAnalyzer

On the FortiGate Root, apply the following configuration:

config log fortianalyzer setting
    set reliable enable
    set enc-algorithm high
    set ssl-min-proto-version TLSv1-2
    set serial FAZ-XXXXXXXXXXX
end

At this stage, the configuration keeps communication between FortiGate and FortiAnalyzer encrypted with high-strength algorithms and a minimum of TLS 1.2.

The most important part here is the set serial command. In some PNETLab / EVE-NG scenarios, you may need to manually enter the FortiAnalyzer serial number so the integration can complete successfully.

Another point worth noting is the set reliable option. In the setup used for this guide, reliable enable was kept in place, and the FortiAnalyzer serial number was manually configured to make the integration work consistently.

However, in some lab environments, using reliable disable may allow the FortiGate to discover the FortiAnalyzer without requiring the serial number to be set manually. This behavior is not always consistent and may vary depending on the FortiGate version, FortiAnalyzer version, and the specific behavior of the PNETLab / EVE-NG images.

For that reason, the most stable approach in this tutorial is to keep reliable enable and manually define the FortiAnalyzer serial number when needed.

If you want, I can now revise the full English article with this paragraph already integrated.

Important Note

Depending on the FortiGate version, FortiAnalyzer version, and the behavior of the PNETLab / EVE-NG environment, the discovery and validation process may behave differently.

In the scenario shown here, the most stable approach was to keep the encryption and protocol parameters at secure values and manually define the FortiAnalyzer serial number on the FortiGate.

If the integration does not work as expected, verify version compatibility, system clocks, certificates, registration, serial number, and network reachability. Do not enable TLS 1.0, SSLv3, or low-encryption cipher suites, even temporarily in the lab.

Conclusion

Enabling Fortinet Security Fabric in PNETLab / EVE-NG may require troubleshooting that would not normally be necessary in a standard environment. In lab scenarios, the key point is to ensure version compatibility between FortiGate and FortiAnalyzer while preserving strong encryption.

With 2 FortiGates and 1 FortiAnalyzer, you already have a functional minimum topology for validating Security Fabric in the lab. In the scenario covered here, matching secure OFTP settings on both appliances, along with the manual definition of the FortiAnalyzer serial number, were the key factors that prevented integration issues and made the setup work properly.