FortiAnalyzer VM - Install Guide for KVM

Version 6.0
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com

FORTINET VIDEO GUIDE
https://video.fortinet.com

FORTINET BLOG
https://blog.fortinet.com

CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com

FORTINET COOKBOOK
https://cookbook.fortinet.com

FORTINET TRAINING & CERTIFICATION PROGRAM
https://www.fortinet.com/support-and-training/training.html

NSE INSTITUTE
https://training.fortinet.com

FORTIGUARD CENTER
https://fortiguard.com/

END USER LICENSE AGREEMENT
https://www.fortinet.com/doc/legal/EULA.pdf

FEEDBACK
Email: [email protected]

March 18, 2019

FortiAnalyzer VM 6.0 Install Guide for KVM
05-600-480495-20190318
 TABLE OF CONTENTS

Change Log 4
About FortiAnalyzer VM on KVM 5
Licensing 5
Evaluation license 5
Preparing for deployment 7
Minimum system requirements 7
Registering your FortiAnalyzer VM 8
Editing FortiAnalyzer VM IP addresses 9
Deployment package for Linux KVM 10
Downloading deployment packages 10
Deployment 12
Deploying FortiAnalyzer VM on KVM 12
Creating the virtual machine 12
Configuring hardware settings 14
Starting the virtual machine 16
Configuring initial settings 16
Enabling GUI access 16
Connecting to the GUI 17
Uploading the license file 17
Configuring your FortiAnalyzer VM 18
Index 19

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Change Log

Date Change Description

2018-04-18 Initial release.

2018-09-07 VM deployment package versions updated.

2019-03-18 Added Minimum system requirements on page 7.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

About FortiAnalyzer VM on KVM

This document provides information about deploying a FortiAnalyzer virtual appliance in Linux KVM server
environments.
This includes how to configure the virtual hardware settings of the virtual appliance. This guide presumes that the
reader has a thorough understanding of virtualization servers.
This document does not cover configuration and operation of the virtual appliance after it has been successfully
installed and started. For that information, see the FortiAnalyzer Administration Guide in the Fortinet Document
Library.

Licensing

Fortinet offers the FortiAnalyzer VM in a stackable license model. This model allows you to expand your VM solution as
your environment expands. Virtual appliance licenses are also perpetual - they never expire.
For information on purchasing a FortiAnalyzer VM license, contact your Fortinet Authorized Reseller, or visit
https://www.fortinet.com/how_to_buy/.
When configuring your FortiAnalyzer VM, ensure that you configure hardware settings as outlined in the following table
and consider future expansion. Contact your Fortinet Authorized Reseller for more information.

GB / Day of logs Storage Capacity

VM-BASE 1 500GB

VM-GB1 +1 +500GB

VM-GB5 +5 +3TB

VM-GB25 +25 +10TB

VM-GB100 +100 +24TB

VM-GB500 +500 +48TB

VM-GB2000 +2000 +100TB

See also Minimum system requirements on page 7 and the FortiAnalyzer product data sheet:
https://www.fortinet.com/products/management.html#models-specs

Evaluation license

FortiAnalyzer VM includes a free, full featured 15 day trial license. No activation is required for the built-in evaluation
license.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

About FortiAnalyzer VM on KVM 6

The trial period begins the first time you start the FortiAnalyzer VM. When the trial expires, all functionality is disabled
until you upload a license file.

Technical support is not included with the 15-day evaluation.

Contact your Fortinet Reseller to request a full evaluation (60-days) license.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Preparing for deployment

You can prepare for deployment by reviewing the following information:

l Minimum system requirements
l Registering your FortiAnalyzer VM
l Downloading deployment packages

Minimum system requirements

The following table lists the minimum system requirements for your VM hardware, based on the analytic sustained rate
of your VM.

Analytic Sustained Rate (logs/sec) VM Hardware Requirements

RAM (GB) CPU cores IOPS

3000 8 4 300

4000 8 4 400

5000 8 4 500

6000 16 8 600

7000 16 8 700

8000 16 8 800

9000 16 8 900

10000 16 8 1000

20000 32 16 2000

30000 32 16 3000

40000 64 32 4000

50000 64 32 5000

The collector sustained rate can be calculated by multiplying the analytic sustained rate by
1.5.

This table does not take into account other hardware specifications, such as bus speed, CPU
model, or storage type.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Preparing for deployment 8

Registering your FortiAnalyzer VM

After placing an order for FortiAnalyzer VM, a license registration code is sent to the email address used in the order
form. Use the license registration code provided to register the FortiAnalyzer VM with Customer Service & Support at
https://support.fortinet.com.
Upon registration, you can download the license file. You will need this file to activate your FortiAnalyzer VM. You can
configure basic network settings from the CLI to complete the deployment. Once the license file is uploaded and
validated, the CLI and GUI will be fully functional.

To register your FortiAnalyzer VM:

1. Ensure that you have the following items needed to complete the procedure:
l License registration code that was emailed to you after you placed an order for FortiAnalyzer VM
l Support contract number
l IPv4 address for the FortiAnalyzer VM
2. Log into the Fortinet Customer Service & Support portal at https://support.fortinet.com/ using an existing support
account, or click Create an Account to create a new account.
3. In the toolbar, select Asset > Register/Renew. The Registration Wizard opens.
4. Enter the registration code from the FortiAnalyzer VM License Certificate that was emailed to you, select the end
user type, and then click Next. The Registration Info page is displayed.

5. Enter your support contract number, product description, Fortinet Partner, and IP address in the requisite fields,
then select Next.

As a part of the license validation process, FortiAnalyzer VM compares its configured IP

addresses with the IP information in the license file. The license must be associated with
an IP address assigned to one of the interfaces on the FortiAnalyzer VM. If a new license
has been imported or the FortiAnalyzer VM’s associated IP address has been changed,
the FortiAnalyzer VM must be rebooted in order for the system to validate the change and
operate with a valid license.

The Customer Service & Support portal currently does not support IPv6 for FortiAnalyzer
VM license validation. You must specify an IPv4 address in both the support portal and the
port management interface.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

 Preparing for deployment 9

6. On the Fortinet Product Registration Agreement page, select the checkbox to indicate that you have read,
understood, and accepted the service contract, then select Next to continue to the Verification page.
7. The verification page displays the product entitlement. Select the checkbox to indicate that you accept the terms
then select Confirm to submit the request.

8. From the Registration Completed page, you can download the FortiAnalyzer VM license file, select Register More
to register another FortiAnalyzer VM, or select Finish to complete the registration process.
Select License File Download to save the license file (. lic) to your management computer. For instructions on
uploading the license file to your FortiAnalyzer VM via the GUI, see Uploading the license file on page 17 .

Editing FortiAnalyzer VM IP addresses

To edit the FortiAnalyzer VM IP address:

1. In the toolbar, select Asset > Manage/View Products to open the View Products page.
2. Select the FortiAnalyzer VM serial number to open the Product Details page.
3. Click Edit to change the description, partner information, and IP address of your FortiAnalyzer VM from the Edit
Product Info page.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Preparing for deployment 10

4. Enter the new IP address, then select Save.

You can change the IP address five (5) times on a regular FortiAnalyzer VM license. There
is no restriction on a full evaluation license.

5. Select License File Download to save the license file (. lic) to your management computer. For instructions on
uploading the license file to your FortiAnalyzer VM via the GUI, see Uploading the license file on page 17.

Deployment package for Linux KVM

FortiAnalyzer VM deployment packages are included with firmware images on the Customer Service & Support site.
The following table list the available VM deployment package.

VM Platform Deployment File

Linux KVM RedHat 7.1 FAZ_VM64_KVM-vX-buildxxxx-FORTINET.out.kvm.zip

The .out.kvm.zip file contains:

l faz.qcow2: TheFortiAnalyzer VM system hard disk in QCOW2 format.
The log disk and virtual hardware settings have to be configured manually.
For more information FortiAnalyzer VM, see the FortiAnalyzer VM datasheet available on the Fortinet web site:
https://www.fortinet.com/products/management/fortianalyzer.html.

Downloading deployment packages

Firmware image FTP directories are organized by firmware version, major release, and patch release. The firmware
images in the directories follow a specific naming convention. Each firmware image is specific to the device model. For
example, the FAZ_VM64_HV-vX-buildxxxx-FORTINET.out.hyperv.zip image, found in the 5.6.0 directory,
is specific to the 64bit Microsoft Hyper-V Server virtualization environment.

You can download the FortiAnalyzer Release Notes and MIB file from this directory. The
Fortinet Core MIB file is located in the FortiAnalyzer 6.0.0 directory.

Download the .out file to upgrade your existing FortiAnalyzer VM installation.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Preparing for deployment 11

To download deployment packages:

1. Log in to the Fortinet Customer Service & Support portal then, from the toolbar select Download > Firmware
Images. The Firmware Images page opens.
2. Select FortiAnalyzer from the Select Product drop-down list, then select Download.
3. Browse to the appropriate directory for the version that you would like to download.
4. Download the appropriate firmware image and release notes to your management computer.
5. Extract the contents of the package to a new folder on your management computer.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Deployment

Prior to deploying the FortiAnalyzer VM, the VM platform must be installed and configured so that it is ready to create
virtual machines. The installation instructions for FortiAnalyzer VM presume that you are familiar with the management
software and terminology of your VM platform.
You might also need to refer to the documentation provided with your VM server. The deployment information in this
guide is provided as an example because, for any particular VM server, there are multiple ways of creating a virtual
machine - command line tools, APIs, alternative graphical user interface tools.
Before you start your FortiAnalyzer VM appliance for the first time, you might need to adjust virtual disk sizes and
networking settings. The first time you start FortiAnalyzer VM, you will have access only through the console window of
your VM server environment. After you configure one network interface with an IP address and administrative access,
you can access the FortiAnalyzer GUI (see Enabling GUI access on page 16).
If the FortiAnalyzer VMdoes not have a valid Logical Volume Management (LVM) configuration, the LVM service will not
start automatically upon boot-up when the disk already contains data. To manually enable the service, use the
execute lvm start CLI command.

Deploying FortiAnalyzer VM on KVM

Once you have downloaded the FAZ_VM64_KVM-vX-buildxxxx-FORTINET.out.kvm.zip file and extracted

the virtual hard drive image file, you can create the virtual machine in your KVM environment.
The following topics are included in this section:
l Creating the virtual machine
l Configuring hardware settings
l Starting the virtual machine

Creating the virtual machine

To create the virtual machine:

1. Launch Virtual Machine Manager (virt-manager) on you KVM host server. The Virtual Machine Manager home
page opens.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Deployment 13

2. On the toolbar, click Create a new virtual machine.

3. Enter a name for the virtual machine, such as FAZ-KVM-DOC.

4. Ensure that Connection is localhost, select Import existing disk image, then click Forward to continue.

5. In the OS Type field select Linux.

6. In the Version field select Generic 2.6.x kernel. You may have to first select Show all OS options.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

 Deployment 14

7. Click Browse to locate the storage volume.

8. If you copied the faz.qcow2 file to /var/lib/libvirt/images it will be shown on the right. If you saved it
elsewhere on the server, click Browse Local to find it.
9. Once the file has been located, click Choose Volume, then click Forward.

10. Specify the amount of memory and the number of CPUs to allocate to this VM, then select Forward. To determine
your required memory, see Minimum system requirements on page 7.
11. Expand the Advanced options section. By default, a new virtual machine includes one network adapter. Select a
network adapter on the host computer.
Optionally, set a specific MAC address for the virtual network interface.
12. Set Virt Type to virtio and set Architecture to qcow2.
13. Click Finish to create the VM.

Configuring hardware settings

Before powering on your FortiAnalyzer VM you must configure virtual disks and at least four network interfaces.

To configure settings on the server:

1. In the Virtual Machine Manager, locate the name of the VM, then click Open on the toolbar.
2. In the Virtual Machine window, select Show virtual hardware details.
3. Click Add Hardware to open the Add Hardware window

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Deployment 15

4. Select Storage.

5. Select Create a disk image on the computer's harddrive, and set the size to 80GB.

If you know your environment will expand in the future, or if you will be using ADOMs, it is
recommended to add hard disks larger than 500GB. This will allow your environment to be
expanded as required while not taking up more space than is needed. See Licensing on
page 5 for more information.

The FortiAnalyzer VM allows for 12 virtual log disks to be added to a deployed instance.
When adding additional hard disks use the following CLI command to extend the LVM
logical volume:
execute lvm start
execute lvm extend <arg ..>

6. Enter the following information:

Device Type Virtio disk

Cache mode writethrough

Storage format raw

7. Select Network to add more network interfaces. The Device Model must be Virtio.

A new VM includes one network adapter by default. More can be added through the Add Hardware window.
FortiAnalyzer VM supports up to four network adapters. You can configure network adapters to connect to a virtual

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

 Deployment 16

switch or to network adapters on the host computer.

8. Click Finish.

Starting the virtual machine

You can now proceed to power on your FortiAnalyzer VM.

1. Right-click on the FortiAnalyzer VM and select Run, or
2. Select the FortiAnalyzer VM from the list of VMs, then click Power on the virtual machine from the toolbar.

Once the VM has started, proceed with the initial configuration. See Configuring initial settings on page 16.

Configuring initial settings

Before you can connect to the FortiAnalyzer VM, you must configure basic network settings via the CLI console. Once
configured, you can connect to the FortiAnalyzer VM GUI and upload the FortiAnalyzer VM license file that you
downloaded from the Customer Service & Support portal.
The following topics are included in this section:
l Enabling GUI access
l Connecting to the GUI
l Uploading the license file

Enabling GUI access

To enable GUI access to the FortiAnalyzer VM, you must configure the IP address and network mask of the appropriate
port on the FortiAnalyzer VM. The following instructions use port 1.

The appropriate port can be determined by matching the MAC address of the network adapter
and the HWaddr provided by the CLI command diagnose fmnetwork interface
list.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

 Deployment 17

To configure the port1 IP address and netmask:

1. In your hypervisor manager, start the FortiAnalyzer VM and access the console window. You might need to press
Enter to see the login prompt.
2. At the FortiAnalyzer VM login prompt, enter the username admin, then press Enter. By default, there is no
password.
3. Using CLI commands, configure the port1 IP address and netmask.
config system interface
edit port1
set ip <IP address> <netmask>
end

The port management interface should match the first network adapter and virtual switch
that you have configured in the hypervisor virtual machine settings.

4. To configure the default gateway, enter the following commands:

config system route
edit 1
set device port1
set gateway <gateway_ipv4_address>
end

The Customer Service & Support portal does not currently support IPv6 for FortiAnalyzer
VM license validation. You must specify an IPv4 address in both the support portal and the
port management interface.

Connecting to the GUI

Once you have configured a port's IP address and network mask, launch a web browser and enter the IP address you
configured for the port management interface. At the login page, enter the user name admin and no password, then
select Login.
The GUI will open with an Evaluation License dialog box.

Uploading the license file

FortiAnalyzer VM includes a free, full featured 15 day trial.

Before using the FortiAnalyzer VM, you must enter the license file that you downloaded from the Customer Service &
Support portal when you registered your FortiAnalyzer VM. See Registering your FortiAnalyzer VM on page 8.

To upload the license via the CLI:

1. Open the license file in a text editor and copy the VM license string.
2. In a FortiAnalyzer VM console window, enter the following:
execute add-vm-license <"vm license string">
See the FortiAnalyzer CLI Reference, available from the Fortinet Document Library, for more details on using this
command.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Deployment 18

To upload the license file via the GUI:

1. In the Evaluation License dialog box, select Enter License.

Optionally, you can also select Upload License in the License Information dashboard widget.
2. In the license upload page, click Browse, locate the VM license file (. lic) on your computer, then click OK to
upload the license file.
A reboot message will be shown, then the FortiAnalyzer VM system will reboot and load the license file.
3. Refresh your browser and log back into the FortiAnalyzer VM with username admin and no password.
The VM registration status appears as valid in the License Information widget once the license has been validated.

As a part of the license validation process, FortiAnalyzer VM compares its IP address with
the IP information in the license file. If a new license has been imported or the
FortiAnalyzer’s IP address has been changed, the FortiAnalyzer VM must be rebooted in
order for the system to validate the change and operate with a valid license.

If the IP address in the license file and the IP address configured in the FortiAnalyzer VM do not match, you will
receive an error message when you log back into the VM.
If this occurs, you will need to change the IP address in the Customer Service & Support portal to match the
management IP and re-download the license file. To change the management IP address, see Editing
FortiAnalyzer VM IP addresses on page 9

After an invalid license file has been loaded onto the FortiAnalyzer VM, the GUI will be
locked until a valid license file is uploaded. A new license file can be uploaded via the CLI.

Configuring your FortiAnalyzer VM

Once the FortiAnalyzer VM license has been validated, you can configure your device.

If the amount of memory or number of CPUs are too small for the VM, or if the allocated hard
drive space is less than the licensed VM storage volume, warning messages will be shown in
the GUI in the System Resources widget on the dashboard and in the Notification list.

For more information on configuring your FortiAnalyzer VM, see the FortiAnalyzer Administration Guide available in the
Fortinet Document Library.

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Index

C I

CLI 8, 12, 15-17 instance 15

Command Line Interface See CLI interface 12, 14

configure IOPS 7

hardware 5 IP address 8, 12, 16-18

VM 18
K
CPU 7, 14, 18
KVM 5, 10, 12
cores 7
L
D
license 5, 8, 10, 16-18
datasheet 10
evaluation 5, 10, 17-18
deploy
file 6, 8, 10, 16-17
package 10
trial 5
device
upload 17
model 10, 15
logs
type 15
daily maximum 5
disk
M
virtio 15
MAC 14, 16
F
maximum
firmware 10
logs per day 5

G Media Access Control See MAC

Graphical User Interface See GUI memory

GUI minimum 7

access 16 size 14, 18

minimum
H
cores 7
hardware requirements 7
IOPS 7
Hyper-V 10

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

network – VM 20

memory 7

network

adapter 14-16

interface 12, 14

package

deployment 10

password 17-18

QCOW2 10

requirements 7

storage

format 15

type 7

volume 14, 18

system requirements 7

virtio 14-15

Virtual Machine See VM

Virtual Processor See CPU

VM

configure 18

create 12, 14

start 16

FortiAnalyzer VM Install Guide for KVM Fortinet Technologies Inc.

Copyright© 2019 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., in
the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be
trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and
other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding
commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s
General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such
event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be
limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features or
development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations, and
guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most
current version of the publication shall be applicable.