Fortinet FortiAnalyzer-100A, Administration Manual, Page: 139 / 162

Network Analyzer Connecting the FortiAnalyzer for analyzing network traffic
FortiAnalyzer Version 3.0 MR3 Administration Guide
05-30003-0082-20060925
139
Network Analyzer
The FortiAnalyzer unit extends its log and report functionality with a network traffic
sniffer that captures activity occurring on your network, using a dedicated port on
the FortiAnalyzer unit.
The FortiAnalyzer network analyzer enables you to reach areas of the network
where FortiGate firewalls are not employed, or if you do not have a FortiGate unit
as a firewall. The FortiAnalyzer network analyzer functions as a sniffer to capture
traffic data, save it to the FortiAnalyzer hard disk and display it or generate reports
using the data.
This section describes how to enable and view network activity in real time as well
as view historical logs of network traffic activity. It also describes log storage
configuration options.
This section includes the following topics:
• Connecting the FortiAnalyzer for analyzing network traffic
• Traffic viewer
• Browsing network traffic logs
• Customizing the traffic analyzer log view
• Search the network traffic logs
• Log rolling
Connecting the FortiAnalyzer for analyzing network traffic
To use the FortiAnalyzer unit for traffic sniffing, connect the FortiAnalyzer unit to
the SPAN, or mirroring port of the Ethernet switch. Both the management and
sniffing ports can be connected to the same switch.
To connect the FortiAnalyzer unit
1 Connect an Ethernet cable to a port on the FortiAnalyzer unit other than the
existing Ethernet port used to connect to the network to collect device logs. For
example, port 2.
2 Connect the other end of the Ethernet cable to the SPAN or mirroring port of an
Ethernet switch.
3 In the web-based manager, go to Tools > Network Analyzer > Config .
4 Select Enable Network Analyzer on, and select a port from the list. Do not select
the port you are using for management and log message collecting activities.
5 Select Apply.
Note: The network analyzer feature is not available on the FortiAnalyzer-100. The network
analyzer feature requires a dedicated port to connect to the span or mirror port of a network
switch.