Issues ingesting encrypted traffic from Fortinet to Sentinel

%3CLINGO-SUB%20id%3D%22lingo-sub-1737675%22%20slang%3D%22en-US%22%3EIssues%20ingesting%20encrypted%20traffic%20from%20Fortinet%20to%20Sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1737675%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Guys%2C%20We've%20been%20setting%20up%20Fortinet%20Connector%20and%20would%20like%20to%20encrypt%20traffic%20using%20TLS%201.2%20between%20Firewall%20and%20Collector%20(In%20Azure-Linux%20VM).%20The%20certificates%20are%20generated%20on%20the%20collector%20and%20distributed%2Fconfigured%20on%20a%20Fortinet%20Firewall.%3CBR%20%2F%3EThe%20Collector%20status%20is%20running%20fine%20with%20RSyslog%20Daemon.%20I%20have%20been%20doing%20testing%20but%20unfortunately%2C%20when%20the%20collector%20receives%20encrypted%20traffic%20(I%20can%20see%20encrypted%20in%20tcpdump)%20it's%20not%20getting%20decrypted%20or%20forwarded%20to%20Log%20Analytics%20Workspace).%20Please%20note%20when%20I%20send%20test%20logger%2Fmock%20messages%20from%20a%20collector%20or%20send%20plain%20text%20traffic%20from%20Fortinet%2C%20I%20can%20see%20the%20logs%20getting%20ingested%20into%20LAW%20in%20CEF%20without%20any%20issues.%20Would%20be%20great%20if%20you%20could%20please%20help..%3CBR%20%2F%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi Guys, We've been setting up Fortinet Connector and would like to encrypt traffic using TLS 1.2 between Firewall and Collector (In Azure-Linux VM). The certificates are generated on the collector and distributed/configured on a Fortinet Firewall.
The Collector status is running fine with RSyslog Daemon. I have been doing testing but unfortunately, when the collector receives encrypted traffic (I can see encrypted in tcpdump) it's not getting decrypted or forwarded to Log Analytics Workspace). Please note when I send test logger/mock messages from a collector or send plain text traffic from Fortinet, I can see the logs getting ingested into LAW in CEF without any issues. Would be great if you could please help..
Thanks

0 Replies